Service processing switch

Abstract

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, packets are load balanced among virtual routing processing resources of an IP service generator of a virtual router (VR) based switch. A packet flow cache is maintained with packet flow entries containing information indicative of packet processing actions and/or packet field manipulations for established packet flows. A determination is made regarding whether a packet is associated with an established packet flow. If so, the packet is directed to one of multiple virtual services processing resources representing application-tailored engines configured to provide managed firewall services. If the packet is allowed, it is returned to the source virtual routing processing resource for forwarding.

What is claimed is: 
     
         1 . A method for delivering network-based Internet Protocol (IP) services to a plurality of customers of a service provider, the method comprising:
 load balancing received packets among a plurality of virtual routing processing resources of an IP service generator of a virtual router (VR) based switch by for each received packet of the plurality of received packets (i) selecting a virtual routing processing resource of the plurality of virtual routing processing resources to process the received packet based on information regarding one or more of internal state and packet statistics provided by the plurality of virtual routing processing resources and (ii) directing the received packet to the selected virtual routing processing resource, wherein each received packet of the plurality of received packets is associated with one of a plurality of service requests issued by one of the plurality of customers;   maintaining a packet flow cache within the VR-based switch by setting up packet flow entries associated with each established packet flow through one of the plurality of virtual routing processing resources, each packet flow entry of the packet flow cache containing information indicative of one or more of packet processing actions and packet field manipulations to perform on packets associated with the established packet flow;   determining whether a received packet is associated with an established packet flow within the packet flow cache;   when an affirmative determination is made, directing the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide managed firewall services; and   when the received packet is not dropped or otherwise blocked as a result of the managed firewall services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding.   
     
     
         2 . The method of  claim 1 , wherein said load balancing is based at least in part on a virtual local area network (VLAN) with which the received packet is associated. 
     
     
         3 . The method of  claim 1 , wherein said directing the received packet to a selected virtual routing processing resource comprises steering the received packet across a switch fabric within the IP service generator. 
     
     
         4 . The method of  claim 1 , wherein the VR-based switch comprises a chassis-based switch and wherein the IP service generator is implemented within a blade of a plurality of blades of the chassis-based switch. 
     
     
         5 . The method of  claim 4 , wherein each of the plurality of virtual routing processing resources comprises a virtual routing engine (VRE) including at least one central processing unit and random access memory. 
     
     
         6 . The method of  claim 4 , wherein each of the plurality of virtual service processing resources comprises a virtual services engine (VSE) including at least one central processing unit and random access memory. 
     
     
         7 . A non-transitory computer-readable storage medium tangibly embodying a set of instructions, which when executed by one or more processors of an Internet Protocol (IP) service generator of a virtual router (VR) based switch, cause the one or more processors to perform a method comprising:
 load balancing received packets among a plurality of virtual routing processing resources of an IP service generator of a virtual router (VR) based switch by for each received packet of the plurality of received packets (i) selecting a virtual routing processing resource of the plurality of virtual routing processing resources to process the received packet based on information regarding one or more of internal state and packet statistics provided by the plurality of virtual routing processing resources and (ii) directing the received packet to the selected virtual routing processing resource, wherein each received packet of the plurality of received packets is associated with one of a plurality of service requests issued by one of the plurality of customers;   maintaining a packet flow cache within the VR-based switch by setting up packet flow entries associated with each established packet flow through one of the plurality of virtual routing processing resources, each packet flow entry of the packet flow cache containing information indicative of one or more of packet processing actions and packet field manipulations to perform on packets associated with the established packet flow;   determining whether a received packet is associated with an established packet flow within the packet flow cache;   when an affirmative determination is made, directing the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide managed firewall services; and   when the received packet is not dropped or otherwise blocked as a result of the managed firewall services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding.   
     
     
         8 . The computer-readable storage medium of  claim 7 , wherein said load balancing is based at least in part on a virtual local area network (VLAN) with which the received packet is associated. 
     
     
         9 . The computer-readable storage medium of  claim 7 , wherein said directing the received packet to a selected virtual routing processing resource comprises steering the received packet across a switch fabric within the IP service generator. 
     
     
         10 . The computer-readable storage medium of  claim 7 , wherein the VR-based switch comprises a chassis-based switch and wherein the IP service generator is implemented within a blade of a plurality of blades of the chassis-based switch. 
     
     
         11 . The method of  claim 10 , wherein each of the plurality of virtual routing processing resources comprises a virtual routing engine (VRE) including at least one central processing unit and random access memory. 
     
     
         12 . The method of  claim 10 , wherein each of the plurality of virtual service processing resources comprises a virtual services engine (VSE) including at least one central processing unit and random access memory. 
     
     
         13 . A virtual router (VR) based switch comprising:
 means for load balancing received packets among a plurality of virtual routing processing resources of an IP service generator of the VR-based switch by for each received packet of the plurality of received packets (i) selecting a virtual routing processing resource of the plurality of virtual routing processing resources to process the received packet based on information regarding one or more of internal state and packet statistics provided by the plurality of virtual routing processing resources and (ii) directing the received packet to the selected virtual routing processing resource, wherein each received packet of the plurality of received packets is associated with one of a plurality of service requests issued by one of the plurality of customers;   means for maintaining a packet flow cache within the VR-based switch by setting up packet flow entries associated with each established packet flow through one of the plurality of virtual routing processing resources, each packet flow entry of the packet flow cache containing information indicative of one or more of packet processing actions and packet field manipulations to perform on packets associated with the established packet flow;   means for determining whether a received packet is associated with an established packet flow within the packet flow cache;   means for, when an affirmative determination is made, directing the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide managed firewall services; and   means for, when the received packet is not dropped or otherwise blocked as a result of the managed firewall services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding.