Method and system for supporting a dedicated label switched path for a virtual private network over a label switched communication network

• US 7,283,529 B2
• Filed: 03/07/2003
• Issued: 10/16/2007
• Est. Priority Date: 03/07/2003
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Basso, Claude, Gorti, Brahmanand K., Vaidhyanathan, Natarajan, Verrilli, Colin B.
• Primary Examiner(s): HSU, ALPUS
• Application Number:
  US10/383,973
• Publication Number:
  US 20040174879A1
• Time in Patent Office: 1,684 Days
• Field of Search: 370/392, 370/395.31, 370/397, 370/409, 709/238, 709/242
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/54 Organization of routing tables

Abstract

A system and method for transmitting data from a first site to a second site over a shared Multi-Protocol Label Switched (MPLS) network comprising a plurality of routers, including an ingress router in communication with the first site and an egress router in communication with the second site, includes configuring a plurality of label switching paths between the ingress router and the egress router over a plurality of label switching devices. The method further includes performing a first lookup on one of at least one virtual routing and forwarding (VRF) table stored in the ingress router, whereby the first lookup identifies one routing table from a plurality of routing tables stored in the ingress router, each routing table being associated with one of the plurality of label switched paths, and performing a second lookup on the one routing table, wherein the routing table defines the associated label switched path between the ingress router and the egress router for a virtual private network (VPN) between the first site and the second site.

Claims

1. A method for transmitting a data packet from a first site to a second site over a shared Multi-Protocol Label Switched (MPLS) network, the shared MPLS network comprising a plurality of routers, the plurality of routers including an ingress router in communication with the first site and an egress router in communication with the second site, the method comprising the steps of:

(a) configuring a plurality of label switched paths between the ingress router and the egress router over a plurality of label switching devices;

(b) upon receiving the data packet from the first site, performing a first lookup on at least one private virtual routing and forwarding (VRF) table stored in the ingress router, wherein the first lookup identifies one routing table from a plurality of routing tables stored in the ingress router, wherein each routing table is associated with one of the plurality of label switched paths; and

(c) performing a second lookup on the one routing table, wherein the one routing table defines the associated label switched path between the ingress router and the egress router for a virtual private network (VPN) between the first site and the second site.

2. The method of claim 1, wherein the first lookup step (b) includes the steps of:

(b1) processing a network address layer associated with the data packet to identify the at least one VRF table, wherein the network address layer includes an IP destination address for the second site;

(b2) matching the IP destination address with an entry in the at least one VRF table; and

(b3) identifying an inner label based on the entry, wherein the inner label is used by the egress router to forward the data packet to the second site.

3. The method of claim 2, wherein the first lookup step (b) further includes:

(b4) identifying the one routing table for the second lookup based on the entry.

4. The method of claim 3, wherein identifying step (b4) includes:

(b4i) checking a value in a Table ID column in the at least one VRF table, wherein the value in the Table ID column identifies the one routing table.

5. The method of claim 2, wherein the second lookup step (c) includes:

(c1) identifying an outer label, wherein the outer label defines the associated label switched path between the ingress router and the egress router.

6. The method of claim 5 further including the steps of:

(d) installing the inner label and the outer label onto the data packet; and

(c) forwarding the data packet to a first label switching device on the associated label switched path.

7. The method of claim 1, wherein the at least one VRF table is associated with the first site and defines a virtual private network (VPN) between the first site and the second site.

8. The method of claim 7, wherein at least one of the plurality of routing tables is associated with the VPN between the first site and the second site.

9. The method of claim 8, wherein at least one of the plurality of routing tables is a public shared by all VPNs traversing the MPLS network through the ingress router and the egress router.

10. A computer readable medium encoded with computer executable program instructions for transmitting a data packet from a first site to a second site over a shared Multi-Protocol Label Switched (MPLS) network, the shared MPLS network comprising a plurality of routers, the plurality of routers including an ingress router in communication with the first site and an egress router in communication with the second site, comprising the instructions for:

(a) configuring a plurality of label switched paths between the ingress router and the egress router over a plurality of label switching devices;

(b) upon receiving the data packet from the first site, performing a first lookup on at least one private virtual routing and forwarding (VRF) table stored in the ingress router, wherein the first lookup identifies one routing table from a plurality of routing tables stored in the ingress router, wherein each routing table is associated with one of the plurality of label switched paths; and

(c) performing a second lookup on the one routing table, wherein the one routing table defines the associated label switched path between the ingress router and the egress router for a virtual private network (VPN) between the first site and the second site.

11. The computer readable medium of claim 10, wherein the first lookup instruction (b) includes instructions for:

(b1) processing a network address layer associated with the data packet to identify the at least one VRF table, wherein the network address layer includes an IP destination address for the second site;

(b2) matching the IP destination address with an entry in the at least one VRF table; and

(b3) identifying an inner label based on the entry, wherein the inner label is used by the egress router to forward the data packet to the second site.

12. The computer readable medium of claim 11, wherein the first lookup instruction (b) further includes:

(b4) identifying the one routing table for the second lookup based on the entry.

13. The computer readable medium of claim 12, wherein identifying instruction (b4) includes:

(b4i) checking a value in a Table ID column in the at least one VRF table, wherein the value in the Table ID column identifies the one routing table.

14. The computer readable medium of claim 11, wherein the second lookup instruction (c) includes:

(c1) identifying an outer label, wherein the outer label defines the associated label switched path between the ingress router and the egress router.

15. The computer readable medium of claim 14 further including instructions for:

(d) installing tile inner label and the outer label onto the data packet; and

(e) forwarding the data packet to a first label switching device on the associated label switched path.

16. The computer readable medium of claim 10, wherein the at least one VRF table is associated with the first site and defines a virtual private network (VPN) between the first site and the second site.

17. The computer readable medium of claim 16, wherein at least one of the plurality of routing tables is associated with the VPN between the first site and the second site.

18. The computer readable medium of claim 17, wherein at least one of the plurality of routing tables is a public routing table shared by all VPNs traversing the MPLS network through the ingress router and the egress router.

19. A system for transmitting data from a first site to a second site over a shared Multi-Protocol Label Switched (MPLS) network, comprising:

a plurality of routers in communication with the shared MPLS network, the plurality of routers comprising an ingress router in communication with the first site and an egress router in communication with the second site;

a plurality of label switching devices defining a plurality of label switched paths between the ingress router and the egress router;

at least one virtual routing and forwarding (VRF) tables stored in the ingress router, wherein one of the at least one VRF tables is associated with the first site and identifies a virtual private network (VPN) between the first site and the second site; and

a plurality of routing tables stored in the ingress router, wherein each of the routing tables is associated with one of the plurality of label switched paths between the ingress router and the egress router.

20. The system of claim 19, wherein at least one of the plurality of routing tables is associated with the VPN between the first site and the second site.

21. The system of claim 19, wherein each VRF table includes a Table ID column.

22. The system of claim 21, wherein a value in the Table ID column indicates which one of the plurality of routing tables is associated with the VPN between the first site and the second site.

23. The system of claim 22, wherein the one VRF table further includes information related to the first site and the second site.

24. The system of claim 23, wherein the information in the one VRF table is based on an IP destination address for the second site and includes an IP address for the egress router.

25. The system of claim 24, wherein the value in the Table ID column is based on the IP address for the egress router.

26. The system of claim 19, wherein the one VRF table provides an inner label for use by the egress router.

27. The system of claim 20, wherein each of the at least one routing tables provides an outer label used to tunnel the data across the MPLS network.

28. The system of claim 20, wherein at least one of the plurality of routing tables is a public routing table shared by all VPNs traversing the MPLS network through the ingress router and the egress router.