METHODS AND SYSTEMS FOR A DISTRIBUTED PROVIDER EDGE

• US 20070064704A1
• Filed: 09/30/2006
• Published: 03/22/2007
• Est. Priority Date: 06/04/2002
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Sargor, Chandramouli, Balay, Rajesh, Srinivasan, Vijay, Reddy, Pasula, Crawbuck, John, Tyagi, Sanjeev
• Granted Patent: US 8,085,776 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/655 Interaction between route computation entities and forwarding entities, e.g. for route determination or for flow table update

Abstract

Methods and Systems are provided for a distributed Provider Edge (PE). A single Virtual Routing and Forwarding device (VRF) is associated with a single customer site. The VRF includes a single routing table (RIB) and a single forwarding table (FIB). The VRF also includes a plurality of Virtual Private Network (VPN) Protocol Instance Modules (VRP), where each VRP is associated with a different VPN from the customer site. Each VRP accesses the RIB directly and the FIB indirectly to acquiring addressing/routing information for a received data packet. Moreover, each VRP uses a data plane of the VRP to communicate the data packets to a PE backbone device. In turn, the PE backbone device uses the data plane to communicate with each of the VRPs, and the PE backbone device communicates with one or more tunnels.

Claims

1. A method comprising:

receiving at a provider edge device (PE) of a service provider a plurality of data packets from a first customer edge device (CE) of a customer of the service provider, the plurality of data packets representative of N different network configurations of the customer; and

accessing a routing table associated with a Virtual Routing and Forwarding device (VRF) of M VRFs residing on the PE to acquire addressing information for the plurality of data packets, where M<

N;

2. The method of claim 1, where M=1 and N≧

2;

3. The method of claim 1, wherein a first network configuration of the N different network configurations of the customer comprises a first Virtual Private Network (VPN) and a second network configuration of the N different network configurations of the customer comprises a second VPN.

4. The method of claim 3, further comprising:

receiving a first data packet at the PE, wherein the first data packet is associated with the first VPN;

steering the first data packet to a first VPN Protocol Instance module (VRP) residing on the VRF;

the first VRP accessing the routing table and a forwarding table associated with the VRF to acquire first addressing information for the first data packet;

receiving a second data packet at the PE, wherein the second data packet is associated with the second VPN; and

the first and second VRPs using a data plane associated with the VRF to communicate the first and second data packets to a PE backbone device.

5. The method of claim 3, further comprising receiving PE backbone data packets that are relayed to the first VRP or the second VRP, wherein the PE backbone device receives the PE backbone data packets from a tunnel and uses the data plane to communicate the PE backbone data packets to the first VRP or the second VRP.

6. The method of claim 4, wherein the VRF uses Border Gateway Protocol to export routing information from the routing table to the first VRP and the second VRP.

7. The method of claim 3, wherein the first VPN provides access to an Intranet associated with the customer or an Extranet associated with the customer.

8. The method of claim 7, wherein the second VPN provides access to the Intranet or the Extranet.

9. A provider edge (PE) system comprising:

a backbone device having a data plane;

a Virtual Routing and Forwarding device (VRF) associated with a single customer site and having a routing table and forwarding table;

a plurality of Virtual Private Network (VPN) Routing and Protocol means (VRPs), residing on the VRF, for communicating directly with the routing table and indirectly with the forwarding table; and

wherein each VRP of the plurality of VRPs communicates with the backbone device through the data plane and each VRP of the plurality of VRPs is associated with a single customer VPN.

10. The PE system of claim 9, wherein a plurality of VPN interfaces is associated with the VRF.

11. The PE system of claim 9, wherein a plurality of VPN traffic communicating with the VRF use the single forwarding table.

12. The PE system of claim 9, wherein each VRP of the plurality of VRPs communicates with the single routing table by importing and exporting routes from the single routing table.

13. The PE system of claim 9, wherein the single forwarding table is used to forward traffic received by the VRF to the PE backbone device as labeled packets.

14. The PE system of claim 9, wherein the PE backbone device communicates via a tunnel to one or more additional PE backbones or an Internet router device for an Internet connection.

15. The PE system of claim 14, wherein the PE backbone forwards inbound traffic received from one or more of the additional PE backbones as Internet Protocol (IP) packets to one or more VRPs of the plurality of VRPs.

16. A distributed provider edge (PE) system, comprising:

a PE backbone means for transmitting data packets via a first tunnel and a second tunnel;

a plurality of VPN Protocol Instance means (VRPs), residing on a single Virtual Routing and Forwarding device (VRF), for communicating with a routing table and a forwarding table associated with the VRF, the VRF being associated with a plurality of VPNs from a single customer site and each VRP of the plurality of VRPs being associated with one of the plurality of VPNs;

a first data plane used by a first set of the plurality of VRPs and the PE backbone device to communicate via the first tunnel;

a second data plane used by a second set of the plurality of VRPs and the PE backbone device to communicate via the second tunnel; and

wherein the plurality of VRPs communicate directly with the routing table and indirectly with the forwarding table and selectively uses one of the first or second data planes to communicate the data packets associated with the plurality of VPNs to the PE backbone device.

17. The system of claim 16, wherein the first tunnel comprises an Internet connection to an Internet router device and the second tunnel comprises a VPN tunnel.

18. The system of claim 16, wherein the first tunnel comprises a first VPN tunnel and the second tunnel comprises a second VPN tunnel.

19. The system of claim 16, wherein the first tunnel comprises an Intranet tunnel and the second tunnel comprises an Extranet tunnel.

20. The system of claim 16, wherein different services are enabled for the data packets based on the selected data plane.

21. The system of claim 20, wherein the different services include at least one of a Network Address Translation (NAT) service and a firewall service.