REGULATION OF NETWORK TRAFFIC IN VIRTUAL PRIVATE NETWORKS

• US 20100290485A1
• Filed: 05/18/2009
• Published: 11/18/2010
• Est. Priority Date: 05/18/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Martini, Luca, Guichard, James Neil
• Granted Patent: US 8,867,349 B2
• Time in Patent Office: Days
• US Class Current: 370/477
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/22 Traffic shaping

Abstract

In an embodiment, a method is provided for regulating network traffic and virtual private networks. In this method, network traffic transmitted along multiple communication paths is received, and these communication paths are associated with forwarding identifiers. A portion of the forwarding identifiers is identified to match a particular forwarding identifier associated with a particular virtual private network. At the same time, the policy associated with the particular virtual private network is identified. A portion of the network traffic that is associated with the portion of the identified forwarding identifiers can then be regulated based on the policy.

Claims

1. A method comprising:

receiving network traffic transmitted along a plurality of communication paths, the plurality of communication paths being associated with a plurality of forwarding identifiers;

identifying a portion of the plurality of forwarding identifiers to match a forwarding identifier associated with a particular virtual private network;

identifying a policy associated with the particular virtual private network; and

regulating a portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy.

2. The method of claim 1, wherein the plurality of communication paths is further associated with a control plane identifier, the method further comprising mapping the control plane identifier to the plurality of forwarding identifiers.

3. The method of claim 1, wherein the plurality of communication paths is a plurality of label switched communication paths, the plurality of forwarding identifiers is a plurality of input labels, and the forwarding identifier associated with the particular virtual private network is a label.

4. The method of claim 3, wherein the identification of the portion of the plurality of forwarding identifiers comprises comparing each input label in the plurality of input labels with the label associated with the particular virtual private network.

5. The method of claim 1, wherein the regulation of the portion of the network traffic comprises shaping the portion of the network traffic.

6. The method of claim 1, wherein the regulation of the portion of the network traffic comprises dropping at least the portion of the network traffic that exceeds a threshold traffic rate.

7. The method of claim 1, wherein the network traffic is a portion of a total network traffic associated with the particular virtual private network, the total network traffic is divided between a plurality of remote routing devices, the method further comprising:

receiving a network bandwidth utilization associated with the total network traffic from at least one of the plurality of remote routing devices; and

regulating the portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy and the network bandwidth utilization.

8. Logic encoded in one or more tangible media for execution and when executed operable to:

receive network traffic transmitted along a plurality of communication paths, the plurality of communication paths being associated with a plurality of forwarding identifiers;

identify a portion of the plurality of forwarding identifiers to match a forwarding identifier associated with a particular virtual private network;

identify a policy associated with the particular virtual private network; and

regulate a portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy.

9. The logic of claim 8, wherein the plurality of communication paths is further associated with a control plane identifier, the logic further operable to map the control plane identifier to the plurality of forwarding identifiers.

10. The logic of claim 9, wherein the operation of mapping the control plane identifier comprises:

access a data structure that is configured to store a plurality of control plane identifiers, a plurality of groups of forwarding identifiers, and a plurality of associations between each of the plurality of control plane identifiers and each of the plurality of groups of forwarding identifiers;

identify a match of the control plane identifier with one of the plurality of control plane identifiers; and

identify one group in the plurality of groups of forwarding identifiers that is associated with the one of the plurality of control plane identifiers based on one of the plurality of associations between the one group and the one of the plurality of control plane identifiers.

11. The logic of claim 9, wherein the control plane identifier is a virtual private network identifier.

12. The logic of claim 9, wherein the control plane identifier is a route target.

13. The logic of claim 8, further operable to:

identify a network bandwidth utilization associated with the particular virtual private network; and

transmit the network bandwidth utilization to a plurality of remote routing devices.

14. The logic of claim 13, wherein network bandwidth utilization is transmitted by way of an Inter-Control Center Communications protocol (ICCP).

15. The logic of claim 8, wherein the particular virtual private network is a Layer 2 virtual private network.

16. The logic of claim 8, wherein the particular virtual private network is a Layer 3 virtual private network.

17. The logic of claim 8, wherein the policy is a quality of service (QoS) policy.

18. An apparatus comprising:

at least one processor; and

a machine-readable medium in communication with the at least one processor, the machine-readable medium being configured to store a policy management and application module, the policy management and application module being executed by the at least one processor cause operations to be performed, comprising;

receiving network traffic transmitted along a plurality of communication paths, the plurality of communication paths being associated with a plurality of forwarding identifiers;

identifying a portion of the plurality of forwarding identifiers to match a forwarding identifier associated with a particular virtual private network;

identifying a policy associated with the particular virtual private network; and

regulating a portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy.

19. The apparatus of claim 18, wherein the apparatus is an autonomous system border router.

20. The apparatus of claim 18, the operations further comprising:

identifying a network bandwidth utilization associated with the particular virtual private network; and

transmitting the network bandwidth utilization to a plurality of remote routing devices.

21. The apparatus of claim 18, wherein the network traffic is a portion of a total network traffic associated with the particular virtual private network, the total network traffic is divided between a plurality of remote routing devices, the operations further comprising:

receiving a network bandwidth utilization associated with the total network traffic from at least one of the plurality of remote routing devices; and

regulating the portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy and the network bandwidth utilization.

22. An apparatus comprising:

a virtual private network traffic identification module configured to receive network traffic transmitted along a plurality of communication paths, the plurality of communication paths being associated with a plurality of forwarding identifiers;

a first means for identifying a portion of the plurality of forwarding identifiers to match a forwarding identifier associated with a particular virtual private network;

a second means for identifying a policy associated with the particular virtual private network; and

a third means for regulating a portion of the network traffic associated with the portion of the plurality of forwarding identifiers based on the policy.