一种新型的复合式NAT防护系统的实现机制  

Implementation Mechanism of Novel Compound NAT Firewall System

作　　者：司靓[1] 李昀晖[1] 郜帅[1] 

机构地区：[1]北京交通大学电子信息工程学院

出　　处：《计算机工程》2008年第17期123-126,共4页Computer Engineering

基　　金：国家自然科学基金资助项目(60473001);Intel“IXA大学合作计划”基金资助项目

摘　　要：提出一种基于可编程网络处理器IXP2400和GP-CPU的NAT/NAPT的实现方案,设计与实现了基于两片IXP2400和GP-CPU组成的具有安全防火墙功能的NAT防护系统。针对该NAT防护系统进行了性能分析,能够支持六十多万并发TCP/UDP的连接容量与全线速为2Gb/s以太网连接速率,实现了网络地址复用,提高了NAT/NAPT的操作速度,克服了传统NAT实现方案中的性能瓶颈。This paper puts forward an implementation scheme, which is called Network Address Translation（NAT）/Network Address Port Translation（NAPT） based on programmable Network Processor（NP） IXP2400 and GP-CPU. Meanwhile, the NAT firewall system with firewall function, containing a pair of Intel IXP2400 and GP-CPU, is designed and implemented. And the performance analysis of the NAT Firewall system is made, which can support more than six hundred thousand of concurrent TCP/UDP sessions and sustain the full line rate on two Gigabit Ethernet links. In addition, the NAT Firewall system can successfully achieve the multiplexing of network address, effectively improve the performance of NAT/NAPT processing and overcome the bottleneck of performance in traditional implementation of NAT.

关 键 词：网络处理器 网络地址转换技术 网络地址与端口转换 防火墙 功能模块 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]