MANAGING AND PROVISIONING VIRTUAL ROUTERS

• US 20110128891A1
• Filed: 02/08/2011
• Published: 06/02/2011
• Est. Priority Date: 09/13/2000
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Sarkar, Manojit, Kumar, Dileep
• Granted Patent: US 8,320,279 B2
• Time in Patent Office: Days
• US Class Current: 370/255
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/76 Routing in software-defined topologies, e.g. routing between virtual machines
• CPC Class Codes: H04L 49/65 Re-configuration of fast packet switches
• CPC Class Codes: H04L 49/70 Virtual switches

Abstract

Methods and systems are provided for provisioning and managing network-based virtual private networks (VPNs). According to one embodiment, a routing configuration for each of multiple network-based customer VPNs is generated for multiple customers based on (i) site reachability information for multiple service processing switches and (ii) a global customer routing profile for a network-based customer VPN of the plurality of network-based customer VPNs. Multiple virtual routers (VRs) distributed among the service processing switches are provisioned to support the network-based customer VPNs based on the routing configurations. A custom routing profile, identifying one or more routing protocols to be used for one or more segments of the network-based customer VPN profile, is received for the network-based customer VPN. The network-based customer VPN is automatically reconfigured by programmatically generating appropriate routing configurations for VRs partitioned to the network-based customer VPN based on the site reachability information and the custom routing profile.

Claims

1. A method of simplifying the provisioning and management of network-based virtual private networks (VPNs), the method comprising:

generating, by a service management system (SMS), a routing configuration for each of a plurality of network-based customer virtual private networks (VPNs) for a plurality of customers based on (i) site reachability information for a plurality of service processing switches and (ii) a global customer routing profile for a network-based customer VPN of the plurality of network-based customer VPNs;

provisioning, by the SMS, a plurality of virtual routers (VRs) distributed among the plurality of service processing switches to support the plurality of network-based customer VPNs based on the routing configurations;

receiving, at the SMS, a custom routing profile for the network-based customer VPN, the custom routing profile identifying one or more routing protocols to be used for one or more segments of the network-based customer VPN; and

automatically reconfiguring, by the SMS, the network-based customer VPN by programmatically generating appropriate routing configurations for VRs of the plurality of VRs partitioned to the network-based customer VPN based on the site reachability information and the custom routing profile.

2. The method of claim 1, wherein the custom routing profile is based upon the global customer routing profile.

3. The method of claim 1, further comprising disseminating portions of the site reachability information to routers associated with the plurality of network-based customer VPNs.

4. The method of claim 3, wherein said disseminating portions of the site reachability information comprises reading subnets for sites of the plurality of customers and creating static routes for the subnets.

5. The method of claim 3, wherein said disseminating portions of the site reachability information comprises placing the portions of site reachability information in one or more directories and providing access to the one or more directories via Lightweight Directory Access Protocol (LDAP).

6. The method of claim 3, wherein said disseminating portions of the site reachability information comprises use of a static configuration in which the subnets are manually configured into the plurality of network-based customer VPNs.

7. The method of claim 3, wherein said disseminating portions of the site reachability information comprises exchanging the portions via one or more routing protocols.

8. The method of claim 3, wherein said disseminating portions of the site reachability information comprises conveying the portions via Multiprotocol Label Switching Label Distribution Protocol (MPLS LDP).

9. The method of claim 3, wherein the custom routing profile comprises an Open Shortest Path First (OSPF) profile and wherein the OSPF profile includes a route aggregation policy.

10. The method of claim 3, wherein the custom routing profile includes parameters relating to one or more of Internet Protocol Security (IPSec), LT2P, Point-to-Point Tunneling Protocol (PPTP), Generic Route Encapsulation (GRE) protocol and Multiprotocol Label Switching (MPLS).

19. The program storage device of claim 3, wherein the custom routing profile comprises an Open Shortest Path First (OSPF) profile and wherein the OSPF profile includes a route aggregation policy.

11. A non-transitory program storage device readable by a service management system (SMS) of a service provider, tangibly embodying a program of instructions executable by one or more computer processors of the SMS to perform method steps for simplifying the provisioning and management of network-based virtual private networks (VPNs), said method steps comprising:

generating a routing configuration for each of a plurality of network-based customer virtual private networks (VPNs) for a plurality of customers based on (i) site reachability information for a plurality of service processing switches and (ii) a global customer routing profile for a network-based customer VPN of the plurality of network-based customer VPNs;

provisioning a plurality of virtual routers (VRs) distributed among the plurality of service processing switches to support the plurality of network-based customer VPNs based on the routing configurations;

receiving a custom routing profile for the network-based customer VPN, the custom routing profile identifying one or more routing protocols to be used for one or more segments of the network-based customer VPN; and

automatically reconfiguring the network-based customer VPN by programmatically generating appropriate routing configurations for VRs of the plurality of VRs partitioned to the network-based customer VPN based on the site reachability information and the custom routing profile.

12. The program storage device of claim 11, wherein the custom routing profile is based upon the global customer routing profile.

13. The program storage device of claim 11, the method further comprising disseminating portions of the site reachability information to routers associated with the plurality of network-based customer VPNs.

14. The program storage device of claim 13, wherein said disseminating portions of the site reachability information comprises reading subnets for sites of the plurality of customers and creating static routes for the subnets.

15. The program storage device of claim 13, wherein said disseminating portions of the site reachability information comprises placing the portions of site reachability information in one or more directories and providing access to the one or more directories via Lightweight Directory Access Protocol (LDAP).

16. The program storage device of claim 13, wherein said disseminating portions of the site reachability information comprises use of a static configuration in which the subnets are manually configured into the plurality of network-based customer VPNs.

17. The program storage device of claim 13, wherein said disseminating portions of the site reachability information comprises exchanging the portions via one or more routing protocols.

18. The program storage device of claim 13, wherein said disseminating portions of the site reachability information comprises conveying the portions via Multiprotocol Label Switching Label Distribution Protocol (MPLS LDP).

20. The program storage device of claim 13, wherein the custom routing profile includes parameters relating to one or more of Internet Protocol Security (IPSec), LT2P, Point-to-Point Tunneling Protocol (PPTP), Generic Route Encapsulation (GRE) protocol and Multiprotocol Label Switching (MPLS).

21. A service management system (SMS) comprising:

a non-transitory storage device having stored therein a program of instructions configured to provision and manage a plurality of network-based virtual private networks (VPNs); and

one or more processors coupled to the non-transitory storage device configured to execute the program of instructions to (i) provision a plurality of virtual routers (VRs) distributed among a plurality of service processing switches to support the plurality of network-based VPNs and (ii) automatically reconfigure a network-based VPN of the plurality of network-based VPNs, responsive to receipt of a custom routing profile for the network-based VPN, where;

the plurality of VRs are provisioned by generating a routing configuration for each of the plurality of network-based VPNs for a plurality of customers based on (i) site reachability information for the plurality of service processing switches and (ii) a global customer routing profile for a network-based VPN of the plurality of network-based VPNs; and

the custom routing profile identifies one or more routing protocols to be used for one or more segments of the network-based VPN.

22. The SMS of claim 21, wherein the custom routing profile is based upon the global customer routing profile.

23. The SMS of claim 21, wherein portions of the site reachability information are disseminated to routers associated with the plurality of network-based VPNs.

24. The SMS of claim 23, wherein said subnets for sites of the plurality of customers are read and static routes for the subnets are created.

25. The SMS of claim 23, wherein the portions of site reachability information are placed in one or more directories and access to the one or more directories is provided via Lightweight Directory Access Protocol (LDAP).

26. The SMS of claim 23, wherein a static configuration is used in which the subnets are manually configured into the plurality of network-based customer VPNs.

27. The SMS of claim 23, wherein the portions are exchanged via one or more routing protocols.

28. The method of claim 23, wherein the portions are conveyed via Multiprotocol Label Switching Label Distribution Protocol (MPLS LDP).

29. The method of claim 23, wherein the custom routing profile comprises an Open Shortest Path First (OSPF) profile including a route aggregation policy.

30. The method of claim 23, wherein the custom routing profile includes parameters relating to one or more of Internet Protocol Security (IPSec), LT2P, Point-to-Point Tunneling Protocol (PPTP), Generic Route Encapsulation (GRE) protocol and Multiprotocol Label Switching (MPLS).