Methods and systems for a distributed provider edge

• US 8,085,776 B2
• Filed: 09/30/2006
• Issued: 12/27/2011
• Est. Priority Date: 06/04/2002
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh, Srinivasan, Vijay, Tyagi, Sanjeev, Reddy, Pasula Srinivasa, Sargor, Chandramouli, Crawbuck, John
• Primary Examiner(s): SOL, ANTHONY M
• Application Number:
  US11/537,609
• Publication Number:
  US 20070064704A1
• Time in Patent Office: 1,914 Days
• Field of Search: None
• US Class Current: 370/392
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/655 Interaction between route computation entities and forwarding entities, e.g. for route determination or for flow table update

Abstract

Methods and Systems are provided for a distributed Provider Edge (PE). A single Virtual Routing and Forwarding device (VRF) is associated with a single customer site. The VRF includes a single routing table (RIB) and a single forwarding table (FIB). The VRF also includes a plurality of Virtual Private Network (VPN) Protocol Instance Modules (VRP), where each VRP is associated with a different VPN from the customer site. Each VRP accesses the RIB directly and the FIB indirectly to acquiring addressing/routing information for a received data packet. Moreover, each VRP uses a data plane of the VRP to communicate the data packets to a PE backbone device. In turn, the PE backbone device uses the data plane to communicate with each of the VRPs, and the PE backbone device communicates with one or more tunnels.

Claims

1. A method comprising:

creating, within a physical provider edge device (PE) of a service provider, a Virtual Routing and Forwarding device (VRF) having a plurality of Virtual Private Network (VPN) Protocol Instance Modules (VRPs), a single routing information base (RIB) and a single forwarding information base (FIB), the VRF operable to interface with customer edge devices (CEs) associated with a plurality of VPN sites of one or more customers of the service provider that participate in a common set of VPNs;

associating a VRP of the plurality of VRPs with each VPN of the common set of VPNs;

receiving at the PE a first data packet from a first CE of the CEs on a first VPN of the common set of VPNs;

a first VRP of the plurality of VRPs associated with the first VPN accessing the single RIB to acquire routing information for the first data packet;

receiving at the PE a second data packet from a second CE of the CEs on a second VPN of the common set of VPNs;

a second VRP of the plurality of VRPs associated with the second VPN accessing the single RIB to acquire routing information for the second data packet; and

wherein the plurality of VRPs are implemented in one or more processors and one or more computer-readable media of the PE, the one or more computer-readable media having instructions tangibly embodied therein operable to instantiate the plurality of VRPs responsive to execution by the one or more processors.

2. The method of claim 1, wherein the plurality of VRPs communicate directly with the single RIB and indirectly with the single FIB.

3. The method of claim 1, wherein the plurality of VRPs communicate with the single RIB by importing and exporting routes from the single RIB.

4. The method of claim 1, wherein a plurality of data planes communicatively couple the VRF and a backbone interface device of the PE, which is operable to transmit outbound data packets onto a network backbone, and the method further comprises the plurality of VRPs selectively using one of a plurality of data planes to communicate the outbound data packets to the backbone interface device based on a type of traffic represented by the outbound data packets.

5. The method of claim 4, wherein the single FIB is used to forward traffic received by the VRF to the backbone interface device as labeled packets.

6. The method of claim 4, further comprising enabling different services for the outbound data packets based on the selected data plane.

7. The method of claim 6, wherein the different services include policy-based services, Network Address Translation (NAT) services, firewall services or proxy services.

8. The method of claim 1, wherein the first VPN provides access to an Intranet associated with the one or more customers and the second VPN provides access to an Extranet associated with the one or more customers.

9. A physical distributed provider edge (PE) system embodying modules to perform a method for processing network traffic of a service provider, the method comprising:

creating, within the PE system, a Virtual Routing and Forwarding device (VRF) having a plurality of Virtual Private Network (VPN) Protocol Instance Modules (VRPs), a single routing information base (RIB) and a single forwarding information base (FIB), the VRF operable to interface with customer edge devices (CEs) associated with a plurality of VPN sites of one or more customers of the service provider that participate in a common set of VPNs;

associating a VRP of the plurality of VRPs with each VPN of the common set of VPNs;

receiving at the PE a first data packet from a first CE of the CEs on a first VPN of the common set of VPNs;

a first VRP of the plurality of VRPs associated with the first VPN accessing the single RIB to acquire routing information for the first data packet;

receiving at the PE a second data packet from a second CE of the CEs on a second VPN of the common set of VPNs; and

a second VRP of the plurality of VRPs associated with the second VPN accessing the single RIB to acquire routing information for the second data packet.

10. The system of claim 9, wherein the plurality of VRPs communicate directly with the single RIB and indirectly with the single FIB.

11. The system of claim 9, wherein the plurality of VRPs communicate with the single RIB by importing and exporting routes from the single RIB.

12. The system of claim 9, wherein a plurality of data planes communicatively couple the VRF and a backbone interface device of the PE, which is operable to transmit outbound data packets onto a network backbone, and the method further comprises the plurality of VRPs selectively using one of a plurality of data planes to communicate the outbound data packets to the backbone interface device based on a type of traffic represented by the outbound data packets.

13. The system of claim 12, wherein the single FIB is used to forward traffic received by the VRF to the backbone interface device as labeled packets.

14. The system of claim 12, wherein the method further comprises enabling different services for the outbound data packets based on the selected data plane.

15. The system of claim 14, wherein the different services include policy-based services, Network Address Translation (NAT) services, firewall services or proxy services.

16. The system of claim 9, wherein the first VPN provides access to an Intranet associated with the one or more customers and the second VPN provides access to an Extranet associated with the one or more customers.