Edward J Lopez

US Patent:

20180227229, Aug 9, 2018

Filed:

Nov 12, 2017

Appl. No.:

15/810103

Inventors:

- Sunnyvale CA, US
Edward Lopez - Herndon VA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 12/741
H04L 29/12
H04L 12/26
H04L 29/06
H04L 12/813

Abstract:

Methods and systems for detecting an application associated with a given IP flow and differentially forwarding packets based on determined application are provided. According to one embodiment, an initial Internet Protocol (IP) packet of an IP flow is received by a network device. An application with which the initial IP packet is associated is determined by the network device. Based on the determined application, a forwarding rule to be applied to the initial IP packet is identified by the network device. Thereafter, the initial IP packet and subsequent IP packets associated with the IP flow are forwarded by the network device based on the identified forwarding rule.

US Patent:

20170195253, Jul 6, 2017

Filed:

Dec 31, 2015

Appl. No.:

14/985746

Inventors:

- Sunnyvale CA, US
Venkateswara Adusumilli - San Jose CA, US
Che-Lin Ho - San Jose CA, US
Edward Lopez - South Riding VA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 12/947
H04L 12/813
H04L 12/24
H04L 12/745

Abstract:

Methods and systems for implementing scalable SDN devices having a flexible data path pipeline having multiple flow tables and a hybrid memory approach are provided. According to one embodiment, an SDN switch performs a method of storing a flow table within a memory device most suitable for the type of rules contained within the flow table. A flow table for use in connection with determining how to process a packet received by the SDN switch is received by the SDN switch. The flow table is stored within a DRAM device of the SDN switch when rules contained within the flow table include keys against which exact matching is performed with fields of the packet. The flow table is stored within a TCAM device of the SDN switch when rules contained within the flow table include keys against which regular expression-based matching is performed with the fields of the packet.

US Patent:

20170195254, Jul 6, 2017

Filed:

Dec 31, 2015

Appl. No.:

14/985811

Inventors:

Son Pham - San Jose CA, US
Donald Krall - San Jose CA, US
Venkateswara Adusumilli - San Jose CA, US
Edward Lopez - South Riding VA, US
Neil Huynh - Fremont CA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 12/947
H04L 12/24
H04L 29/06
H04L 12/935
H04L 12/741

Abstract:

Systems and methods for an SDN switch that provides application-based conditional forwarding and session-aware load balancing are provided. According to one embodiment, a packet is received at an input port of a Software Defined Networking (SDN) switch. The packet is forwarded by the SDN switch to a first flow processing unit (FPU) of multiple FPUs of the SDN switch. The first FPU determines whether the packet is to be tracked. And, if so, the received packet is transmitted to a second FPU of the SDN switch; otherwise, the packet is transmitted to a third FPU of the SDN switch. When the packet is received at the second FPU, the packet is conditionally forwarded by the SDN switch to an application device. When the packet is received at the third FPU, the packet is conditionally forwarded to an output port or dropped.

US Patent:

20170195255, Jul 6, 2017

Filed:

Dec 31, 2015

Appl. No.:

14/985819

Inventors:

- Sunnyvale CA, US
Donald Krall - San Jose CA, US
Venkateswara Adusumilli - San Jose CA, US
Edward Lopez - South Riding VA, US
Neil Huynh - Fremont CA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 12/947
H04L 12/741
H04L 12/46
H04L 12/24
H04L 12/935

Abstract:

Systems and methods for an SDN switch that facilitates forwarding/differential routing decision determination are provided. A packet is received at an input port of the SDN switch. The switch includes a first and second set of flow processing units (FPUs). The packet is forwarded to a first FPU of the first set. Based on a flow table associated with the first FPU, it is determined whether the packet is to be forwarded to a network device or an output port. The packet is received from the network device at a second FPU of the second set. Based on a flow table associated with the second FPU, it is determined whether to execute one or more instructions to forward the packet to the input or output port, or to drop or default forward the packet to the input or output port.

US Patent:

20170195257, Jul 6, 2017

Filed:

Dec 31, 2015

Appl. No.:

14/985783

Inventors:

- Sunnyvale CA, US
Venkateswara Adusumilli - San Jose CA, US
Che-Lin Ho - San Jose CA, US
Edward Lopez - South Riding VA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 12/937
H04L 12/741
H04L 12/24
H04L 12/935

Abstract:

Systems and methods for scalable SDN devices having ports/network interfaces mapped to cardinal flow processing (CFP) units are provided. According to one embodiment, an incoming packet is received, at a software-defined networking (SDN) switch. An ingress port on which the incoming packet was received is determined. A cardinal direction to which the ingress port is mapped is determined. Based on the determined cardinal direction, the SDN switch identifies a cardinal flow processing (CFP) unit within the SDN switch with which the determined cardinal direction is associated. The SDN switch then causes the incoming packet to be processed by the identified CFP unit.

US Patent:

20170195292, Jul 6, 2017

Filed:

Dec 31, 2015

Appl. No.:

14/985827

Inventors:

Son Pham - San Jose CA, US
Donald Krall - San Jose CA, US
Venkateswara Adusumilli - San Jose CA, US
Edward Lopez - South Riding VA, US
Neil Huynh - Fremont CA, US

Assignee:

Fortinet, Inc. - Sunnyvale CA

International Classification:

H04L 29/06
H04L 12/947
H04L 12/935
H04L 12/24

Abstract:

Systems and methods for an SDN switch that provides service group chaining for sequentially serving multiple network security devices are provided. According to one embodiment, a packet received by the switch is processed by a first FPU based on a first set of rules and forwarded conditionally to a first security device. The packet is security processed, including dropping it or forwarding it to an egress port or forwarding it to a second FPU. When forwarded to the second FPU, the packet is processed based on a second set of rules by forwarding it to a second security device or dropping it or forwarding it to the egress port. When forwarded to the second security device, the packet is security processed, including dropping it or forwarding it to the egress port or conditionally forwarding it to a third FPU to be sequentially forwarded to a third security device.