Methods and apparatus for providing multiple policies for a virtual private network

• US 20070186009A1
• Filed: 02/09/2006
• Published: 08/09/2007
• Est. Priority Date: 02/09/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Khalid, Mohamed, Guichard, James, Weis, Brian, Wainner, W.
• Granted Patent: US 7,613,826 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/42 Centralised routing
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

A system provides a request for a policy from a policy server, and receives the policy from the policy server. The policy indicates processing to be applied to a traffic partition passing through the device. The system configures the policy within a routing structure associated with the traffic partition for the policy in the device, and routes a stream of traffic for the routing structure in accordance with the policy for that routing structure.

Claims

1. In a device, in a network, a method of providing a policy to a traffic partition in the network, the method comprising:

providing a request for the policy from a policy server;

receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device;

configuring the policy within a routing structure associated with the traffic partition for the policy in the device; and

routing a stream of traffic for the routing structure in accordance with the policy for that routing structure.

2. The method of claim 1 wherein providing a request for the policy from a policy server comprises:

notifying the policy server of the presence of the device; and

notifying the policy server that the device is active.

3. The method of claim 2 wherein notifying the policy server that the device is active comprises:

receiving an authentication message from the policy server; and

responding to the authentication message from the policy server.

4. The method of claim 1 wherein the policy server is a plurality of policy servers and wherein receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device comprises:

receiving the policy from at least one policy server of the plurality of policy servers.

5. The method of claim 4 wherein the policy is a plurality of policies and wherein receiving the policy from at least one policy server of the plurality of policy servers comprises:

receiving at least one policy from the plurality of policies, the at least one policy received from at least one policy server of the plurality of policy servers.

6. The method of claim 5 wherein receiving at least one policy from the plurality of policies, the at least one policy received from at least one policy server of the plurality of policy servers comprises:

providing an identity of the device onto the network to allow the plurality of policy servers to receive the identity of the device to determine whether the plurality of policy servers have at least one policy from the plurality of policies for that device; and

in response, providing the at least one policy for that device to the device, when the identity of the device is associated with the at least one policy from the plurality of policies.

7. The method of claim 1 wherein the traffic partition is a plurality of traffic partitions and wherein receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device comprises:

receiving a policy dedicated to the plurality of traffic partitions.

8. The method of claim 1 wherein the policy defines an encryption key and an address range within the network and wherein configuring the policy within a routing structure associated with the traffic partition for the policy in the device comprises:

configuring, for a first traffic partition within the device, a first policy with a first address range; and

configuring, for a second traffic partition within the device, a second policy with a second address range, the second address range overlapping the first address range.

9. The method of claim 1 wherein routing a stream of traffic for the routing structure in accordance with the policy for that routing structure comprises:

applying the policy to the stream of traffic passing through the traffic partition on the device in the network; and

processing the stream of traffic within at least one constraint defined by the policy.

10. The method of claim 1 wherein the device is a router and wherein the traffic partition is a virtual private network and wherein the routing structure is a virtual routing and forwarding instance and wherein the policy defines security processing for the virtual private network on the network and wherein providing a request for the policy from a policy server comprises:

providing a request for the policy from a policy server dedicated to providing security processing for that virtual private network; and

wherein receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device comprises;

receiving the policy from the dedicated policy server, the policy indicating security processing to be applied to the virtual private network passing through the router; and

wherein configuring the policy within a routing structure associated with the traffic partition for the policy in the device comprises;

configuring the policy within the virtual routing and forwarding instance associated with the virtual private network passing through the router; and

wherein routing a stream of traffic for the routing structure in accordance with the policy for that routing structure comprises;

routing the stream of traffic for the virtual routing and forwarding instance in accordance with the security processing for that virtual routing and forwarding instance.

11. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with a policy providing application that when executed on the processor provides policies to a traffic partition on the computerized device by performing the operations of;

providing a request for the policy from a policy server;

receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device;

configuring the policy within a routing structure associated with the traffic partition for the policy in the device; and

routing a stream of traffic for the routing structure in accordance with the policy for that routing structure.

12. The computerized device of claim 11 wherein when the computerized device performs the operation of providing a request for the policy from a policy server, the computerized device performs the operations of:

notifying the policy server of the presence of the device; and

notifying the policy server that the device is active.

13. The computerized device of claim 12 wherein when the computerized device performs the operation of notifying the policy server that the device is active, the computerized device performs the operations of:

receiving an authentication message from the policy server; and

responding to the authentication message from the policy server.

14. The computerized device of claim 11 wherein the policy server is a plurality of policy servers and wherein when the computerized device performs the operation of receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device, the computerized device performs the operation of:

receiving the policy from at least one policy server of the plurality of policy servers.

15. The computerized device of claim 14 wherein the policy is a plurality of policies and wherein when the computerized device performs the operation of receiving the policy from at least one policy server of the plurality of policy servers, the computerized device performs the operation of:

receiving at least one policy from the plurality of policies, the at least one policy received from at least one policy server of the plurality of policy servers.

16. The computerized device of claim 15 wherein when the computerized device performs the operation of receiving at least one policy from the plurality of policies, the at least one policy received from at least one policy server of the plurality of policy servers, the computerized device performs the operations of:

providing an identity of the device onto the network to allow the plurality of policy servers to receive the identity of the device to determine whether the plurality of policy servers have at least one policy from the plurality of policies for that device; and

in response, providing the at least one policy for that device to the device, when the identity of the device is associated with the at least one policy from the plurality of policies.

17. The computerized device of claim 11 wherein the traffic partition is a plurality of traffic partitions and wherein when the computerized device performs the operation of receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device, the computerized device performs the operation of:

receiving a policy dedicated to the plurality of traffic partitions.

18. The computerized device of claim 11 wherein the policy defines an encryption key and an address range within the network and wherein when the computerized device performs the operation of configuring the policy within a routing structure associated with the traffic partition for the policy in the device, the computerized device performs the operations of:

configuring, for a first traffic partition within the device, a first policy with a first address range; and

configuring, for a second traffic partition within the device, a second policy with a second address range, the second address range overlapping the first address range.

19. The computerized device of claim 11 wherein the device is a router and wherein the traffic partition is a virtual private network and wherein the routing structure is a virtual routing and forwarding instance and wherein the policy defines security processing for the virtual private network on the network and wherein when the computerized device performs the operation of providing a request for the policy from a policy server, the computerized device performs the operation of:

providing a request for the policy from a policy server dedicated to providing security processing for that virtual private network; and

wherein when the computerized device performs the operation of receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device, the computerized device performs the operation of;

receiving the policy from the dedicated policy server, the policy indicating security processing to be applied to the virtual private network passing through the router; and

wherein when the computerized device performs the operation of configuring the policy within a routing structure associated with the traffic partition for the policy in the device, the computerized device performs the operation of;

configuring the policy within the virtual routing and forwarding instance associated with the virtual private network passing through the router; and

wherein when the computerized device performs the operation of routing a stream of traffic for the routing structure in accordance with the policy for that routing structure, the computerized device performs the operation of;

routing the stream of traffic for the virtual routing and forwarding instance in accordance with the security processing for that virtual routing and forwarding instance.

20. A computer readable medium encoded with computer programming logic that when executed on a process in a computerized device produces a policy providing process that provides policies by causing the computerized device to perform the operations of:

providing a request for the policy from a policy server;

receiving the policy from the policy server, the policy indicating processing to be applied to the traffic partition passing through the device;

configuring the policy within a routing structure associated with the traffic partition for the policy in the device; and

routing a stream of traffic for the routing structure in accordance with the policy for that routing structure.