Abstract: Some embodiments provide a method that receives a piece of network data. Based on a set of values in a set of headers of the piece of network data, the method determines whether the piece of network data is precision time protocol (PTP) network data and a particular port in the set of ports of the network device through which the piece of network data is to be forwarded. Based on the particular port, the method determines a port profile from a set of port profiles. Based on a value of the field in the port profile and the determination of whether the piece of network data is PTP network data, the method determines whether to bypass a set of data security operations on the piece of network data. The method transmits the piece of network data through the particular port of the network device.

Abstract: Techniques are provided that enable a programmable network application-specific integrated circuit (ASIC) to switch over from L3 forwarding (i.e., routing) to L2 forwarding (i.e., bridging) an L3 network packet in certain scenarios, such as a scenario in which the packet fails to meet one or more criteria defined by a routing protocol. In various embodiments, this switchover (referred to as “fallback to bridging”) is achieved by leveraging programmable aspects of the ASIC's packet processing pipeline.

Abstract: A method of forwarding a data packet includes, in part, receiving the data packet at an ingress interface, reordering entries of the data packet such that a first forwarding equivalence class (FEC), indexed by a first forwarding lookup table, is caused to point to a virtual private network (VPN) identifier associated with a tunnel through which the data packet is to be forwarded. The reordering of the entries causes a second FEC to point to a multitude of common tunnel header entries. The second FEC is indexed by the first FEC and has a lower level than the first FEC. The data packet with the reordered entries is forwarded through the tunnel. The egress tunnel header rewrite table entries are also reordered in accordance with which the data packet is forwarded.

Abstract: Some embodiments provide a method that receives a piece of network data. Based on a set of values in a set of headers of the piece of network data, the method determines whether the piece of network data is precision time protocol (PTP) network data and a particular port in the set of ports of the network device through which the piece of network data is to be forwarded. Based on the particular port, the method determines a port profile from a set of port profiles. Based on a value of the field in the port profile and the determination of whether the piece of network data is PTP network data, the method determines whether to bypass a set of data security operations on the piece of network data. The method transmits the piece of network data through the particular port of the network device.

Abstract: A method of forwarding a data packet includes, in part, receiving the data packet at an ingress interface, reordering entries of the data packet such that a first forwarding equivalence class (FEC), indexed by a first forwarding lookup table, is caused to point to a virtual private network (VPN) identifier associated with a tunnel through which the data packet is to be forwarded. The reordering of the entries causes a second FEC to point to a multitude of common tunnel header entries. The second FEC is indexed by the first FEC and has a lower level than the first FEC. The data packet with the reordered entries is forwarded through the tunnel. The egress tunnel header rewrite table entries are also reordered in accordance with which the data packet is forwarded.

Abstract: A networking device receives packets that may include a label header specifying a label for processing the packet based on a corresponding entry in a label table. When the label has a corresponding entry in the label table, the packet is processed according to the label entry. When the packet has a label but the label table does not have a corresponding label, rather than discarding the packet, the networking device converts the packet for forwarding according to a network address specified in the packet. Label headers may be removed from the packet to prevent subsequent devices from incorrectly continuing label-based processing, enabling the packet to “exit” the overall path represented by the labels and processed as though the packet didn't arrive with a label header. When devices may lack intended labels, this permits continued processing of packets according to the network address information.

Abstract: A network device or a system can be used to implement a private virtual local area network (VLAN). Such network device or system can receive a packet via an ingress port, perform a VLAN mapping lookup to identify a private VLAN domain based on the ingress port and an ingress subdomain associated with a primary VLAN or a secondary VLAN in the private VLAN domain, set a forwarding domain of the packet to the private VLAN domain, store the ingress subdomain and optionally the private VLAN domain as metadata, perform learning and forwarding lookups using the private VLAN domain to identify the ingress port and an egress port for the packet, reset the forwarding domain of the packet back to the ingress subdomain by the end of the forwarding lookup, and perform VLAN filtering based on the ingress subdomain.