Firewall Mark Routing Table Selection in Policy Based Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Policy Based Routing (PBR) systems, the selection of routing tables becomes slow due to the large number of PBR rules, leading to increased complexity and management burden, especially when hundreds or thousands of rules are involved, and traditional techniques fail to provide efficient packet classification and routing table selection.
Innovation Solution
A method and network device that generate a Firewall Mark (fwmark) including a network domain indication and packet classification indication, which determines a match with PBR rules to select the appropriate routing table, significantly speeding up the routing table selection process and reducing the number of PBR rules required, thereby improving performance and management efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional PBR rule matching is used for routing table selection, then comprehensive packet classification and routing control can be achieved, but routing table selection speed becomes severely reduced due to the large number of PBR rules
Solution Approach 1:
The patent introduces a firewall mark (fwmark) as an intermediary value that bridges packet classification and routing table selection. The fwmark is generated by classifying packets based on multiple criteria (source/destination IP, ports, protocol) and then used as a key to quickly identify the appropriate routing table, avoiding direct comparison against hundreds or thousands of PBR rules while maintaining comprehensive classification capabilities
Solution Approach 2:
The system performs preliminary packet classification to generate the fwmark before the actual routing table selection process. This preliminary classification groups packets into categories that can be quickly mapped to routing tables, so that when routing decisions are needed, the system only needs to match the pre-computed fwmark rather than re-evaluating all classification criteria against multiple routing rules
2Adaptability or versatility
If hundreds or thousands of PBR rules are used to cover multiple network domains, then comprehensive routing control is achieved, but the burden on managing RPDBs increases significantly
Solution Approach 1:
The patent merges multiple packet classification criteria (source IP, destination IP, source port, destination port, protocol type) into a single fwmark value. This consolidation allows the system to maintain comprehensive multi-domain routing control while reducing the management burden, as the fwmark serves as a unified key that encapsulates all classification dimensions without requiring separate rules for each criterion combination
Solution Approach 2:
The fwmark mechanism serves multiple functions simultaneously: it classifies packets, identifies routing tables, and provides a compact representation of complex packet characteristics. This multi-functionality allows a single data structure to replace what would otherwise require multiple separate PBR rules, simplifying RPDB management while maintaining comprehensive routing control across diverse network domains
3Measurement precision
If each packet is compared against a large number of PBR rule selectors, then accurate routing table selection can be made, but routing table selection speed becomes severely reduced
Solution Approach 1:
The patent extracts the essential classification information from complex PBR rule comparisons and encapsulates it in the fwmark. Instead of comparing each packet against numerous PBR rule selectors, the system extracts packet characteristics into the pre-computed fwmark and uses this compact representation for rapid routing table identification, maintaining selection accuracy while dramatically reducing processing time
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method implemented by a network device for selection of a routing table in a Policy Based Routing (PBR) system is described. The method may include receiving a packet from a first network domain; generating a firewall mark for the packet, wherein the firewall mark includes a network domain indication and a packet classification indication; determining a match between the network domain indication of the packet and a selector of a matched rule in a set of rules; and upon determining the match between the network domain indication of the packet and the selector of the matched rule, inputting the firewall mark to a function of the matched rule to identify a routing table for the packet.