Network Device Policy Translation for Vendor-Neutral IPv4/IPv6 Filters

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network devices struggle with consuming excessive computing and networking resources due to the inability to support vendor-neutral firewall configurations, leading to inefficiencies in filtering traffic and security issues.

Innovation Solution

The network device translates vendor-neutral policy configurations into two separate Layer-3 family filters (IPv4 and IPv6) and associates them with routing instances and interfaces, maintaining separate operational state data for each, allowing aggregation when requested.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the network device uses vendor-specific policy configuration, then the device can natively support the configuration format, but it cannot handle vendor-neutral configurations and consumes excessive computing resources

Engineering Contradiction:

Improveconfiguration compatibilityVSAvoidcomputing resource consumption

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The patent segments the vendor-neutral policy configuration into multiple vendor-specific policy configurations by identifying and separating vendor-specific elements (such as filter names, interface names, routing instance names) from the vendor-neutral structure. This segmentation allows the device to process each segment using its native vendor-specific format, improving compatibility while maintaining efficient resource usage through standardized processing pipelines.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary configuration translation mechanism that converts vendor-neutral policy configurations into vendor-specific formats. This intermediary layer acts as a mediator between the vendor-neutral input and the vendor-specific processing engine, enabling the device to handle diverse configuration formats without requiring native support for each format, thus improving adaptability while maintaining efficient resource consumption.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the network device translates vendor-neutral configuration to multiple vendor-specific configurations, then configuration compatibility improves, but the device complexity increases

Engineering Contradiction:

Improveconfiguration compatibilityVSAvoidconfiguration processing complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The translation process is segmented into distinct stages: parsing the vendor-neutral configuration, identifying vendor-specific elements, generating multiple vendor-specific configurations, and applying them to appropriate routing instances. This segmentation of the translation process reduces overall complexity by breaking down a complex monolithic operation into manageable, standardized steps that can be independently optimized and maintained.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent creates a universal configuration processing framework that can handle multiple vendor-specific configurations through a single vendor-neutral interface. This multi-functional approach allows the same translation mechanism to generate different vendor-specific configurations (e.g., Juniper, Cisco formats) from a single vendor-neutral input, reducing device complexity by avoiding the need for separate processing logic for each vendor format.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If the network device maintains separate operational state data for each family filter, then filtering precision improves, but memory consumption increases

Engineering Contradiction:

Improvetraffic filtering precisionVSAvoidmemory consumption

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent merges the operational state data management for IPv4 and IPv6 family filters by implementing a unified state tracking mechanism that consolidates memory usage. Instead of maintaining completely separate operational state structures for each protocol family, the system combines them into a shared memory space with protocol-specific fields, reducing overall memory consumption while preserving the ability to track filtering precision for each protocol independently.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12457197B2Supporting a vendor-neutral policy configuration on a network device with a vendor-specific policy configuration

Publication Date: 2025.10.28 JUNIPER NETWORKS INC

AI summary

A network device may receive a vendor-neutral policy configuration, and may translate the vendor-neutral policy configuration to a first family filter and a second family filter. The network device may associate each of the first family filter and the second family filter with a routing instance and an interface, and may generate a policy configuration supported by the network device based on the first family filter, the second family filter, the routing instance, and the interface.