Techniques for customer self-provisioning of edge nodes for a virtual private network

• US 7,778,199 B2
• Filed: 06/02/2005
• Issued: 08/17/2010
• Est. Priority Date: 02/19/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Luo, Wei, Weber, Greg, Townsley, William Mark, Booth, Earl Hardin III
• Primary Examiner(s): Kumar; Pankaj
• Assistant Examiner(s): SMITH, MARCUS
• Application Number:
  US11/143,551
• Publication Number:
  US 20060187855A1
• Time in Patent Office: 1,902 Days
• Field of Search: None
• US Class Current: 370/254
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]

Abstract

Techniques for configuring a particular network interface on a particular node at an edge of a provider network to support a particular virtual private network include receiving customer input data. The provider network is a packet-switched network and the particular virtual private network is a link layer virtual private network. The customer input data indicates a topology for customer equipment devices outside the provider network on the particular virtual private network, and may include properties for corresponding interfaces that connect the customer equipment devices to the edge nodes. Based on the customer input data, configuration data is determined for configuring the particular interface at the particular node. The particular node is caused to configure the particular interface based on the configuration data without human intervention. Among other effects, these techniques support zero-touch provisioning of virtual private networks.

Claims

1. A method for configuring a network interface on an intermediate network node at an edge of a provider network to support a virtual private network, comprising the steps of:

receiving, without intervention by a service provider, customer input data that indicates, for a particular virtual private network over a provider network of the service provider, a topology for a plurality of customer equipment devices outside the provider network to be joined on the particular virtual private network;

based on the customer input data, determining configuration data without intervention by the service provider for configuring a particular interface of a particular edge node among a plurality of interfaces that connect the plurality of customer equipment devices to a plurality of edge nodes at an edge of the provider network for the particular virtual private network, wherein the particular interface is configured to direct HyperText Transfer Protocol (HTTP) data packets to the subscription server and to not forward other types of data packets; and

causing the particular edge node to configure the particular interface based on the configuration data without intervention by the service provider, wherein packets are switched with attachment circuits at the particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network.

2. A method as recited in claim 1, said step of receiving customer input data further comprising receiving a plurality of properties for the plurality of interfaces that connect the plurality of customer equipment devices to the plurality of edge nodes.

3. A method as recited in claim 1, said step of receiving customer input data further comprising receiving the customer input data at a World Wide Web server accessed through a public Internet.

4. A method as recited in claim 1, said step of receiving customer input data that indicates the topology further comprising:

sending a prompt message to a customer device that prompts the customer to enter a type of VPN service; and

receiving input data that indicates the type of VPN in response to sending the message.

5. A method as recited in claim 2, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter a unique identifier for the particular interface; and

receiving input data that indicates the unique identifier for the particular interface in response to sending the message.

6. A method as recited in claim 1, said step of receiving customer input data that indicates the topology further comprising:

sending a prompt message to a customer device that prompts the customer to enter a unique identifier for each customer equipment device of the plurality of customer equipment devices; and

receiving input data that indicates the unique identifier for each customer equipment device in response to sending the message.

7. A method as recited in claim 1, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter a level of service for a tunnel between two customer equipment devices of the plurality of customer equipment devices; and

receiving input data that indicates the level of service for a tunnel between two customer equipment devices in response to sending the message.

8. A method as recited in claim 1, said step of receiving customer input data that indicates the plurality of property further comprising:

sending a prompt message to a customer device that prompts the customer to enter data that indicates a network protocol for the particular interface; and

receiving input data that indicates the network protocol for the particular interface in response to sending the message.

9. A method as recited in claim 8, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter data that indicates a value for a parameter for the network protocol for the particular interface; and

receiving input data that indicates the value for the parameter for the network protocol for the particular interface in response to sending the message.

10. A method as recited in claim 1, wherein the particular interface is a virtual circuit of a plurality of virtual circuits on the same physical circuit.

11. A method as recited in claim 1, wherein the particular interface is a physical circuit.

12. A method as recited in claim 1, said step of determining configuration data further comprising determining a mapping between a customer identification for the particular interface and a particular virtual private network.

13. A method as recited in claim 1, said step of determining configuration data further comprising determining values for service parameters that are specific to the particular interface.

14. A method as recited in claim 1, said step of determining configuration data further comprising determining values for the type of virtual private network among a plurality of types that include at least two of a virtual private wire service (VPWS), a virtual private local area network service (VPLS) and an inter-local access and transport area private line service (IPLS).

15. A method as recited in claim 1, said step of determining configuration data further comprising determining a mapping between the particular virtual private network and a different node on the edge of the provider network to which the particular node should establish a tunnel for the particular private network.

16. A method as recited in claim 1, said step of determining configuration data further comprising determining a property for a tunnel for the particular private network from the particular node to a different node on an edge of the provider network from a plurality of properties that include at least one of a name for the tunnel and a service level for traffic through the tunnel.

17. A method as recited in claim 1, said step of causing the particular node to configure the particular interface further comprising the steps of:

storing the configuration data;

determining whether conditions are satisfied for sending the configuration data to the particular node; and

if it is determined that conditions are satisfied for sending the configuration data, then sending the configuration data to the particular node to cause the particular node to configure the particular interface without intervention for the particular virtual private network based on the configuration data.

18. A method as recited in claim 1, said step of causing the particular node to configure the particular interface further comprising the step of sending the configuration data to a provisioning server on a lost computer on the provider network, which host computer is different from the particular node, wherein the provisioning server performs the steps of:

storing the configuration data;

determining whether conditions are satisfied for sending the configuration data to the particular node; and

if it is determined that conditions are satisfied for sending the configuration data, then sending the configuration data to the particular node to cause the particular node to configure the particular interface without intervention for the particular virtual private network based on the configuration data.

19. A method as recited in claim 18, wherein the provisioning server is a Remote Access Dial-In Service (RADIUS) Server.

20. A method as recited in claim 19, said step of determining whether conditions are satisfied for sending the configuration data further comprising determining whether a RADIUS user authentication request message is received from the particular node, which request includes a RADIUS user name attribute with data that indicates the particular interface.

21. A method for configuring a network interface on an intermediate network node at an edge of a provider network to support a virtual private network, comprising the steps of:

receiving data that indicates a subscription server on a provider network of a service provider;

configuring a first attachment circuit on a particular edge node of a plurality of attachment circuits for connection to customer equipment outside the provider network on a plurality of edge nodes at an edge of the provider network to exchange data packets for a particular protocol with the subscription server;

receiving on the first attachment circuit a data packet that uses the particular protocol and includes at least a portion of customer input data that indicates, for a particular virtual private network over the provider network, a topology for a plurality of customer equipment devices outside the provider network to be joined on a particular virtual private network;

forwarding the data packet to the subscription server;

receiving configuration data based on the customer input data; and

configuring a second attachment circuit on the particular edge node to join the particular virtual private network without intervention based on the configuration data;

wherein packets are switched with attachment circuits at the particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network, wherein a particular interface of the particular edge node is configured to direct HTTP data packets to the subscription server and to not forward other types of data packets.

22. A method as recited in claim 21, wherein the second attachment circuit is the same as the first attachment circuit.

23. A method as recited in claim 21, wherein the second attachment circuit is a physical circuit.

24. A method as recited in claim 21, wherein the second attachment circuit is a virtual circuit of a plurality of virtual circuits on the same physical circuit.

25. A method as recited in claim 21, said step of receiving the configuration data further comprising receiving the configuration data from a provisioning server different from the subscription server.

26. A method as recited in claim 21, wherein the particular protocol is a HyperText Transfer Protocol (HTTP).

27. An apparatus for configuring a network interface on an intermediate network node at an edge of a provider network to support a virtual private network, comprising:

means for receiving, without intervention by a service provider, customer input data that indicates, for a particular virtual private network over a provider network of the service provider, a topology for a plurality of customer equipment devices outside the provider network to be joined on the particular virtual private network;

means for determining without intervention by the service provider, based on the customer input data, configuration data for configuring a particular interface of a particular edge node among a plurality of interfaces that connect the plurality of customer equipment devices to a plurality of edge nodes at an edge of the provider network for the particular virtual private network, wherein the particular interface is configured to direct HTTP data packets to the subscription server and to not forward other types of data packets; and

means for causing the particular edge node to configure the particular interface based on the configuration data without intervention by the service provider,

wherein packets are switched with attachment circuits at the particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network.

28. An apparatus for configuring a network interface on an intermediate network node at an edge of a provider network to support a virtual private network, comprising:

means for receiving data that indicates a subscription server on a provider network of a service provider,

means for configuring a first attachment circuit on a particular edge node of a plurality of attachment circuits for connection to customer equipment outside the provider network on a plurality of edge nodes at an edge of the provider network to exchange data packets for a particular protocol with the subscription server,

means for receiving on the first attachment circuit a data packet that uses the particular protocol and includes at least a portion of customer input data that indicates, for a particular virtual private network over the provider network, a topology for a plurality of customer equipment devices outside the provider network to be joined on a particular virtual private network;

means for forwarding the data packet to the subscription server;

means for receiving configuration data based on the customer input data; and

means for configuring a second attachment circuit on the particular edge node to join the particular virtual private network without intervention based on the configuration data, wherein a particular interface of the particular edge node is configured to direct HTTP data packets to the subscription server and to not forward other types of data packets, wherein packets are switched with attachment circuits at the particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network.

29. An apparatus for configuring a network interface on an intermediate network node at an edge of a provider network of a service provider to support a virtual private network, comprising:

a network interface that is coupled to a provider network for communicating therewith a data packet;

one or more processors;

a computer-readable medium; and

one or more sequences of instructions stored in the computer readable medium, which, when executed by the one or more processors, causes the one or more processors to carry out the step of;

receiving, without intervention by a service provider, customer input data that indicates, for a particular virtual private network over a provider network of the service provider, a topology for a plurality of customer equipment devices outside the provider network to be joined on the particular virtual private network;

based on the customer input data, determining, without intervention by the service provider, configuration data for configuring a particular interface of a particular edge node among a plurality of interfaces that connect the plurality of customer equipment devices to a plurality of edge nodes at an edge of the provider network for the particular virtual private network, wherein the particular interface is configured to direct HTTP data packets to the subscription server and to not forward other types of data packets; and

causing the particular edge node to configure the particular interface based on the configuration data without intervention by the service provider,

wherein packets are switched with attachment circuits at the particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network.

30. An apparatus as recited in claim 29, said step of receiving customer input data further comprising receiving a plurality of properties for the plurality of interfaces that connect the plurality of customer equipment devices to the plurality of edge nodes.

31. An apparatus as recited in claim 29, said step of receiving customer input data further comprising receiving the customer input data at a World Wide Web server accessed through a public Internet.

32. An apparatus as recited in claim 29, said step of receiving customer input data further comprising causing the particular node to configure the particular interface to switch a data packet of a particular protocol received on the particular interface to a subscription server that uses the particular protocol for prompting the customer for the customer input data.

33. An apparatus as recited in claim 29, said step of receiving customer input data that indicates the topology further comprising:

sending a prompt message to a customer device that prompts the customer to enter a type of VPN service; and

receiving input data that indicates the type of VPN in response to sending the message.

34. An apparatus as recited in claim 30, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter a unique identifier for the particular interface; and

receiving input data that indicates the unique identifier for the particular interface in response to sending the message.

35. An apparatus as recited in claim 29, said step of receiving customer input data that indicates the topology further comprising:

sending a prompt message to a customer device that prompts the customer to enter a unique identifier for each customer equipment device of the plurality of customer equipment devices; and

receiving input data that indicates the unique identifier for each customer equipment device in response to sending the message.

36. An apparatus as recited in claim 29, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter a level of service for a tunnel between two customer equipment devices of the plurality of customer equipment devices; and

receiving input data that indicates the level of service for a tunnel between two customer equipment devices in response to sending the message.

37. An apparatus as recited in claim 29, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter data that indicates a network protocol for the particular interface; and

receiving input data that indicates the network protocol for the particular interface in response to sending the message.

38. An apparatus as recited in claim 37, said step of receiving customer input data that indicates the plurality of properties further comprising:

sending a prompt message to a customer device that prompts the customer to enter data that indicates a value for a parameter for the network protocol for the particular interface; and

receiving input data that indicates the value for the parameter for the network protocol for the particular interface in response to sending the message.

39. An apparatus as recited in claim 29, wherein the particular interface is a virtual circuit of a plurality of virtual circuits on the same physical circuit.

40. An apparatus as recited in claim 29, wherein the particular interface is a physical circuit.

41. An apparatus as recited in claim 29, said step of determining configuration data further comprising determining a mapping between a customer identification for the particular interface and a particular virtual private network.

42. An apparatus as recited in claim 29, said step of determining configuration data further comprising determining values for service parameters that are specific to the particular interface.

43. An apparatus as recited in claim 29, said step of determining configuration data further comprising determining values for the type of virtual private network among a plurality of types that include at least two of a virtual private wire service (VPWS), a virtual private local area network service (VPLS) and an inter-local access and transport area private line service (IPLS).

44. An apparatus as recited in claim 29, said step of determining configuration data further comprising determining a mapping between the particular virtual private network and a different node on the edge of the provider network to which the particular node should establish a tunnel for the particular private network.

45. An apparatus as recited in claim 29, said step of determining configuration data further comprising determining a property for a tunnel for the particular private network from the particular node to a different node on an edge of the provider network from a plurality of properties that include at least one of a name for the tunnel and a service level for traffic through the tunnel.

46. An apparatus as recited in claim 29, said step of causing the particular node to configure the particular interface further comprising the steps of:

storing the configuration data;

determining whether conditions are satisfied for sending the configuration data to the particular node; and

if it is determined that conditions are satisfied for sending the configuration data, then sending the configuration data to the particular node to cause the particular node to configure the particular interface without intervention for the particular virtual private network based on the configuration data.

47. An apparatus as recited in claim 29, said step of causing the particular node to configure the particular interface further comprising the step of sending the configuration data to a provisioning server on a host computer on the provider network, which host computer is different from the particular node, wherein the provisioning server performs the steps of:

storing the configuration data;

determining whether conditions are satisfied for sending the configuration data to the particular node; and

if it is determined that conditions are satisfied for sending the configuration data, then sending the configuration data to the particular node to cause the particular node to configure the particular interface without intervention for the particular virtual private network based on the configuration data.

48. An apparatus as recited in claim 47, wherein the provisioning server is a Remote Access Dial-In Service (RADIUS) Server.

49. An apparatus as recited in claim 48, said step of determining whether conditions are satisfied for sending the configuration data further comprising determining whether a RADIUS user authentication request message is received from the particular node, which request includes a RADIUS user name attribute with data that indicates the particular interface.

50. An apparatus for configuring a network interface on an intermediate network node at an edge of a provider network to support a virtual private network, comprising:

a provider network interface that is coupled to a provider network for communicating therewith a data packet;

a customer network interface for coupling to customer premises equipment outside the provider network for communicating therewith a data packet;

one or more processors;

a computer-readable medium; and

one or more sequences of instructions stored in the computer-readable medium, which, when executed by the one or more processors, causes the one or more processors to carry out the step of;

receiving data that indicates a subscription server on a provider network of a service provider,

configuring a first attachment circuit on the customer network interface to exchange data packets for a particular protocol with the subscription server;

receiving on the first attachment circuit a data packet that uses the particular protocol and includes at least a portion of customer input data that indicates, for a particular virtual private network over the provider network, a topology for a plurality of customer equipment devices outside the provider network to be joined on a particular virtual private network;

forwarding the data packet to the subscription server;

receiving configuration data based on the customer input data; and

configuring a second attachment circuit for coupling to customer premises equipment to join the particular virtual private network without intervention based on the configuration data,

wherein packets are switched with attachment circuits at a particular edge node through a default pseudo wire associated with a subscription server until the attachment circuits are configured to join the particular virtual private network wherein a particular interface of the particular edge node is configured to direct HTTP data packets to the subscription server and to not forward other types of data packets.

51. An apparatus as recited in claim 50, wherein the second attachment circuit is the same as the first attachment circuit.

52. An apparatus as recited in claim 50, wherein the second attachment circuit is a physical circuit.

53. An apparatus as recited in claim 50, wherein the second attachment circuit is a virtual circuit of a plurality of virtual circuits on the same physical circuit.

54. An apparatus as recited in claim 50, said step of receiving the configuration data further comprising receiving the configuration data from a provisioning server different from the subscription server.

55. An apparatus as recited in claim 50, wherein the particular protocol is a HyperText Transfer Protocol (HTTP).