Juniper Networks, Inc.

Netscreen Technologies, Inc.

Yan Ke

Yuming Mao

Guangsong Huang

Jian Tong

Dongping Luo

Feng Deng

Ken Xie

Changming Liu

Wilson Xu

Brian Yean-Shiang Leu

Zhong Wang

Lin Chen

Xiaosong Yang

Gregory M Lebovitz

Methods and apparatus, including computer program products, implementing and using techniques for processing a data packet. An input port receives a data packet, a switching board classifies the data packet, determines whether the data packet should be accepted, and switches the data packet to a management board if the data packet is a first data packet in a session, and to a processing board if the data packet is not a first data packet in a session. A management board receives a data packet from the switching board, examines the data packet and forwards the data packet to one of the processing boards. One or more processing boards receives non-first data packets from the switching board and data packets from the management board and processes the data packets. A firewall and a secure gateway with firewall and virtual private network functionality for processing a data packet are also described.

Network security device

Methods and apparatus, including computer program products, implementing and using techniques for processing a data packet in a packet forwarding device. A data packet is received. A virtual local area network destination is determined for the received data packet, and a set of rules associated with the virtual local area network destination is identified. The rules are applied to the data packet. If a virtual local area network destination has been determined for the received data packet, the data packet is output to the destination, using the result from the application of the rules. If no destination has been determined, the data packet is dropped. A security system for partitioning security system resources into a plurality of separate security domains that are configurable to enforce one or more policies and to allocate security system resources to the one or more security domains, is also described.

Internet security system

Network security device and method

In one aspect the invention provides a method for allocating bandwidth in a network appliance where the network appliance includes a plurality of guaranteed bandwidth buckets used to evaluate when to pass traffic through the network appliance. The method includes providing a shared bandwidth bucket associated with a plurality of the guaranteed bandwidth buckets, allocating bandwidth to the shared bandwidth bucket based on the underutilization of bandwidth in the plurality of guaranteed bandwidth buckets and sharing excess bandwidth developed from the underutilization of the guaranteed bandwidth allocated to the individual guaranteed bandwidth buckets. The step of sharing includes borrowing bandwidth from the shared bandwidth bucket by a respective guaranteed bandwidth bucket to allow traffic to pass immediately through the network appliance.

Guaranteed bandwidth sharing in a traffic shaping system

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine couples to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Firewall including local bus

A device described herein may include an input port operable to receive data packets; a switching board operable to classify the data packets, determine whether the data packets should be accepted by the device, and determine whether received data packets are first data packets in a session; a management board operable to receive the data packets from the switching board that were determined by the switching board to be the first data packets in a session; and one or more processing boards operable to receive data packets from the switching board that were determined by the switching board to not be the first data packets in a session and to process the received data packets.

A network device includes a data structure and an ager. The data structure includes a group of positions. One or more of the positions are associated with at least one item. The ager is configured to sequentially analyze each position of the group of positions, and recycle, at each analyzed position, any item associated with the analyzed position.

Recycling items in a network device

An improved firewall for providing network security is described. The improved firewall provides for dynamic rule generation, as well using conventional fixed rules. This improvement is provided without significant increase in the processing time required for most packets. Additionally, the improved firewall provides for translation of IP addresses between the firewall and the internal network.

Method, apparatus and computer program product for a network firewall

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine coupled to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Internet security device and method

A system and method for a network security system are provided. The method includes providing a master device and a backup device within a cluster of network security devices, providing the backup device with state information for the master device, detecting failure in the cluster and using the state information to recover from the failure.

Growing community of inventors

San Jose, CA, United States of America

Yan Ke