Virtual routing for virtual local area networks having overlapping IP addresses

• US 7,814,541 B1
• Filed: 05/19/2006
• Issued: 10/12/2010
• Est. Priority Date: 05/19/2006
• Status: Active Grant

• Current Assignee: Array Networks Incorporated (Hitachi, Ltd.)
• Original Assignee: Array Networks Incorporated (Hitachi, Ltd.)
• Inventors: Manvi, Rajendra
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Reza; Mohammad W
• Application Number:
  US11/437,453
• Time in Patent Office: 1,607 Days
• Field of Search: 726/15, 726/13, 713/154
• US Class Current: 726/15
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 49/35 Switches specially adapted for specific applications
• CPC Class Codes: H04L 61/2535 Multiple local networks, e.g. resolving potential IP address conflicts

Abstract

A method of virtual routing an overlapping IP address using a virtual private network (VPN) device connected to a virtual private network (VLAN). The method comprises the step of receiving an overlapping Internet protocol (IP) address from a virtual site, the overlapping IP address having a virtual site address tag (Vsite) associated with a client. The overlapping IP address is converted into a non-overlapping IP address. The non-overlapping IP address is then converted into an overlapping IP address having a virtual local area network (Vlan) tag, wherein the virtual local are network tag (Vlan) is associated with at least one local area network (LAN) within the virtual private network.

Claims

1. A method of virtual routing an overlapping IP address for a virtual private network (VPN) device connected to a virtual local area network (VLAN) without affecting Internet protocol (IP) processing within the VPN device, the method comprising:

receiving on the VPN device, a packet with an overlapping Internet protocol (IP) address from a virtual site, the overlapping IP address having a virtual site tag associated with it;

converting the overlapping IP address into a non-overlapping unique IP address by a virtual network address layer (VNAT) upon reception, so that Internet Protocol (IP) processing within the VPN device is not affected in a demilitarized zone of the VPN device;

performing internet protocol processing within the VPN device on the packet using the non-overlapping unique IP address;

converting the non-overlapping unique IP address back to the overlapping IP address having a virtual local area network tag by a virtual LAN (local area network) aware NAT (Network Address Translaton) layer within the VPN device to provide a mapping function, and wherein the mapping function returns a valid IP address only if the virtual site address tag in question has a local area network tag, which contains a subnet holding the requested IP address; and

forwarding the packet with the overlapping IP address with the virtual local area network tag to at least one local area network (LAN).

2. The method of claim 1, wherein converting the overlapping IP address into a non-overlapping unique IP address is performed by a virtual LAN (local area network) aware NAT (Network Address Translation) layer within the VPN device.

3. The method of claim 1, further comprising a plurality of clients, the plurality of clients each having a virtual site address tag associated therewith.

4. The method of claim 1, further comprising a plurality of local area networks, the plurality of local area networks each having a virtual local address tag associated therewith.

5. The method of claim 1, further comprising forwarding a request to establish a session with the VPN device from the client to an authentication and authorization server within the VPN device for authentication and authorization of the client to access the VLAN.

6. A system for virtual routing to a virtual private network (VLAN), which is comprised of a plurality of local area networks (LAN), the system comprising:

a client; and

a virtual private network (VPN) device, the VPN device having a virtual Network Address Translation (VNAT) layer configured to;

receive a packet with an overlapping Internet protocol (IP) address from a client, the overlapping IP address having a virtual site address tag associated with it;

convert the overlapping IP address into a non-overlapping unique IP address by a virtual network address layer (VNAT) upon reception, so that Internet Protocol (IP) processing within the VPN device is not affected in a demilitarized zone of the VPN device;

perform internet processing protocol within the VPN device on the packet using the non-overlapping unique IP address;

convert the non-overlapping unique IP address back to the overlapping IP address having a virtual local area network tag by a virtual LAN (local area network) aware NAT (Network Address Translation) layer within the VPN device to provide a mapping function, and wherein the mapping function returns a valid IP address only if the virtual site address tag in question has a local area network tag, which contains a subnet holding the requested IP address, wherein the virtual local area network tag is associated with at least one local area network (LAN); and

direct the packet with the overlapping IP address having a virtual local area network tag to at least one local area network.

7. The system of claim 6, wherein the client further comprises a plurality of clients, the plurality of clients each having a virtual site address tag associated therewith.

8. The system of claim 6, wherein the VPN device directs the overlapping IP address to at least one local area network.

9. The system of claim 6, wherein the VPN device directs the overlapping IP address to at least two local area networks.

10. The system of claim 6, further comprising a virtual local area network, and wherein the virtual local area network comprising a plurality of local area networks.