Methods and apparatus for providing an enhanced dynamic multipoint virtual private network architecture

• US 7,602,737 B2
• Filed: 05/01/2006
• Issued: 10/13/2009
• Est. Priority Date: 03/01/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sethi, Pratima Pramod, Khalid, Mohamed, Asati, Rajiv, Weis, Brian E.
• Primary Examiner(s): Kumar; Pankaj
• Assistant Examiner(s): Choi; Eunsook
• Application Number:
  US11/414,787
• Publication Number:
  US 20070206597A1
• Time in Patent Office: 1,261 Days
• Field of Search: None
• US Class Current: 370/255
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic

Abstract

A system transmits, to a hub from a first spoke, first routing information associated with the first spoke. The system receives, at the first spoke, from the hub, second routing information associated with a plurality of spokes in communication with the hub. The plurality of spokes includes a second spoke. The system resolves, at the first spoke, a next hop determination for the packet based on the second routing information received from the hub. The system routes the packet from the first spoke to the second spoke using the next hop determination.

Claims

1. A method, comprising:

transmitting, to a hub from a first spoke in a hub and spoke network, first routing information associated with the first spoke;

in response to transmitting the first routing information, receiving, at the first spoke, from the hub, second routing information associated with a plurality of spokes in the hub and spoke network, the plurality of spokes including a second spoke;

storing the second routing information in a routing table in the first spoke;

receiving a packet at the first spoke; and

forwarding the packet to a next-hop according to the second routing information.

2. The method of claim 1, where the second routing information comprises next-hop resolution information for the plurality of spokes in the hub and spoke network.

3. The method of claim 2,

where the second routing information comprises quality of service information associated with a next-hop.

4. The method of claim 1, where transmitting the first routing information associated with the first spoke comprises:

registering with a policy server to receive a policy; and

receiving, from the policy server, the policy.

5. The method of claim 4,

where the policy server is the hub;

and

where the hub and spoke network is a dynamic multipoint virtual private network (VPN) and the policy is a group policy that defines a group key for establishing tunnels between spokes in the hub and spoke network.

6. The method of claim 5, where the tunnel is a multipoint generic encapsulation (mGRE) tunnel and the hub and spoke network is a non-broadcast multiple access (NBMA) network.

7. The method of claim 1, wherein transmitting, to the hub from a first spoke, first routing information associated with the first spoke comprises:

advertising, to the hub, a plurality of routes with which the first spoke is associated;

where the routes comprise information for resolving next-hops.

8. The method of claim 1, comprising:

transmitting, to the hub, from the first spoke, a notification that a new address for the first spoke has replaced a previous address, the notification including a flag signaling the hub to recognize the new address associated with the first spoke; and

receiving notification that the hub has recognized the new address of the first spoke, and released the previous address.

9. The method of claim 1, comprising:

receiving a purge request at the first spoke, the purge request specifying that a third spoke in the hub and spoke network is unreachable; and

in response to the purge request, purging next-hop information related to the third spoke from the routing table.

10. The method of claim 1, comprising:

receiving, at the first spoke, from the hub, third routing information, where the third routing information specifies a change to the second routing information comprising one or more of, next-hop information about a new spoke and modified next-hop information about the plurality of spokes in the hub and spoke network.

11. The method of claim 1, comprising:

where forwarding the packet to a next-hop comprises encrypting the packet according to a group Internet Protocol Security (IPSec) security association (SA).

12. A computerized device, comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with a route determining application that when executed on the processor determines a next hop for a packet in a Non-Broadcast Multiple Access (NBMA) hub and spoke Dynamic Multipoint Virtual Private Network (DMVPN) by performing the operations of;

transmitting, to a hub from a first spoke in the NBMA hub and spoke DMVPN, first routing information associated with the first spoke;

in response to transmitting the first routing information, receiving, at the first spoke, from the hub, second routing information associated with a plurality of spokes in the NBMA hub and spoke DMVPN, the plurality of spokes including a second spoke;

storing the second routing information in a routing table in the first spoke;

receiving a packet at the first spoke; and

forwarding the packet to a next-hop according to the second routing information.

13. The computerized device of claim 12, where the operation of transmitting, the first routing information associated with the first spoke comprises:

registering with a policy server to receive a policy; and

receiving, from the policy server, the policy.

14. The computerized device of claim 13 where the policy server is the hub;

and

where the policy is a group policy that defines a group key for establishing tunnels between spokes in the NBMA hub and spoke DMVPN.

16. The computerized device of claim 12, where transmitting, to the hub from a first spoke, first routing information associated with the first spoke, the computerized device performs the operation of:

advertising, to the hub, a plurality of routes with which the first spoke is associated;

where the routes comprise information for resolving next-hops.

17. The computerized device of claim 12, where the computerized device performs the operations of:

transmitting, to the hub, from the first spoke, a notification that a new address for the first spoke has replaced a previous address, the notification including a flag signaling the hub to recognize the new address associated with the first spoke; and

receiving notification that the hub has recognized the new address of the first spoke, and released the previous address.

18. The computerized device of claim 12, comprising:

receiving a purge request at the first spoke, the purge request specifying that a third spoke in the NBMA hub and spoke DMVPN is unreachable; and

in response to the purge request, purging next-hop information related to the third spoke from the routing table.

19. The computerized device of claim 12, comprising the computerized device performing the operation of:

receiving, at the first spoke, from the hub, third routing information, where the third routing information specifies a change to the second routing information comprising one or more of next-hop information about a new spoke and modified next-hop information about the plurality of spokes in the NBMA hub and spoke DMVPN.

20. The computerized device of claim 12, the computerized device

where forwarding the packet to a next-hop comprises encrypting the packet according to a group Internet Protocol Security (IPSec) security association (SA).

15. The computerized device of 14,

where the second routing information comprises quality of service information associated with a next-hop and next-hop resolution information for the plurality of spokes in the NBMA hub and spoke DMVPN;

and

where the tunnel is a multipoint generic encapsulation (mGRE) tunnel.