Design And Implementation Of The Giga Firewall Based On IXP2400 Network Processor

A firewall is a barrier between the trusted interior network and untrustedexterior network (Internet). Nowadays giga networks are used more and morewidely, so the development of high-speed giga firewalls is always a hot pointin the field of network security. Those traditional firewalls are developedbased on the Intel X86 architecture or ASIC. But the technology of the IntelX86 architecture can't provide high enough performance and the technologyof ASIC has its shortcoming in flexibility. A network processor is aprogrammable network equipment which has been designed for high-speedpacket forwarding systems. It can satisfy the requests of both highperformance and high flexibility. It is the best choice for the development of agiga firewall.In present dissertation, we designed and implemented a giga firewallbased on IXP2400 Network Processor. First, a brief explain of IXP2400Network Processor and IXDP2400 Advanced Development Platform wasgiven. And then we gave out a model of layered architecture based on IntelIXA Portability Framework. We also considered the designs about theconcurrency among the microengines of IXP2400 and among the microenginethreads. During the implementation of the firewall, we first built an IPforwarding system, which could forward packets at line rate in a giga network.Then, based on the IP forwarding system, some firewall functions, such asState Inspection, NAT, Transparent Mode, Pre-drop Filter and Qos, wereimplemented in the microblocks which ran in the microengines, and we got agiga firewall of very high performance. On the end, we gave out twoimproving methods to the firewall.