Arrangements for constructing a virtual private network (VPN) using forwarding techniques

• US 8,379,649 B2
• Filed: 06/29/2009
• Issued: 02/19/2013
• Est. Priority Date: 09/29/2008
• Status: Active Grant

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Inventors: Yamate, Keiichirou, Nozaki, Shinji, Arai, Masaya
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Ghafoerkhan, Faiyazkhan
• Application Number:
  US12/493,360
• Publication Number:
  US 20100080235A1
• Time in Patent Office: 1,331 Days
• Field of Search: None
• US Class Current: 370/395.31
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's

Abstract

An extranet direct route allowing extranet forwarding to a directly linked device is written in a layer 2-layer 3-integrated forwarding table. The procedure of introducing a layer 3 address-to-layer 2 address correspondence relation table entry into the layer 2-layer 3-integrated forwarding table searches the layer 2-layer 3-integrated forwarding table with a layer 3 address of the correspondence relation table entry and a layer 3 interface as search keys to retrieve any forwarding entry relating to an extranet direct route as a forwarding destination. The procedure subsequently extracts a VRF of each retrieved forwarding entry and introduces the correspondence relation table entry for the extracted VRF into the layer 2-layer 3-integrated forwarding table.

Claims

1. A forwarding apparatus including multiple VPN routing and forwarding tables (VRFs) configured to individually have routing tables provided for respective virtual private networks (VPNs),

wherein each of the routing tables is structured to record a communication route of a packet based on a layer 3 address specifying an address of the packet and a forwarding destination layer 3 address specifying a forwarding destination of the packet from an assigned VRF or a VRF assigned to the routing table, as well as an extranet communication route of forwarding the packet from the assigned VRF to another VRF,

the forwarding apparatus comprising:

a first storage module configured to store a layer 2-layer 3-integrated forwarding table structured to record at least one entry, wherein each entry includes VRF information and a packet destination layer 3 address as search conditions for specifying the forwarding destination of the packet, as well as a forwarding destination layer 3 interface, a forwarding destination layer 3 address, and a forwarding destination layer 2 address as search results, when a correspondence relation of the forwarding destination layer 3 address to the forwarding destination layer 2 address is unresolved for an entry, the entry including specific data representing an ‘

unresolved’

state of the forwarding destination layer 2 address;

a route introducer configured to introduce each communication route, which is recorded in each of the routing tables, into the layer 2-layer 3-integrated forwarding table;

an address resolving module configured to introduce a correspondence relation of a layer 3 address to a layer 2 address of an adjacent device as an adjacent device layer 3 address-to-layer 2 address correspondence relation with regard to the forwarding destination layer 3 interface of an entry recorded in the layer 2-layer 3-integrated forwarding table, into the layer 2-layer 3-integrated forwarding table; and

a forwarding destination identification module configured to search the layer 2-layer 3-integrated forwarding table with a layer 3 address specifying an address recorded in the packet as a search key to specify the forwarding destination of the packet,

in response to presence of an entry, which includes a direct route using a packet destination layer 3 address as the forwarding destination layer 3 address and the VRF information as the search condition for specifying the forwarding destination of the packet that is different from a VRF assigned to the forwarding destination layer 3 interface, in the layer 2-layer 3-integrated forwarding table, the address resolving module utilizing VRF information identical with the VRF information as the search condition to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table;

a second storage module configured to store a direct route VRF table that is structured to record at least one entry, wherein each entry includes a correspondence relation of a layer 3 interface and a layer 3 address to a VRF identifier group,

wherein the address resolving module searches the direct route VRF table with a layer 3 interface connected to the adjacent device and the layer 3 address of the adjacent device as search keys to obtain a VRF identifier group and uses each VRF identifier of the obtained VRF identifier group for the VRF information as the search condition of specifying the forwarding destination of the packet to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table.

2. The forwarding apparatus in accordance with claim 1, the forwarding apparatus further including:

a direct route VRF table updating module configured to, in the course of introduction of the direct route using the packet destination layer 3 address as the forwarding destination layer 3 address into the layer 2-layer 3-integrated forwarding table, record a VRF of the direct route corresponding to a forwarding destination layer 3 interface of the direct route and a packet destination layer 3 address of the direct route into the direct route VRF table,

in the course of introduction of each direct route among multiple direct routes, which use the packet destination layer 3 address as the forwarding destination layer 3 address and have an identical forwarding destination layer 3 interface and an identical packet destination layer 3 address, into the layer 2-layer 3-integrated forwarding table, the direct route VRF table updating module adding a VRF identifier group of each direct route introduced in the layer 2-layer 3-integrated forwarding table to each corresponding entry including the forwarding destination layer 3 interface and the packet destination layer 3 address in the direct route VRF table.

3. The forwarding apparatus in accordance with claim 1, wherein the layer 2-layer 3-integrated forwarding table has a field for storing a type of each communication route that identifies whether the communication route is introduced by the route introducer or by the address resolving module,

the forwarding apparatus further including:

a deletion module configured to, in the case of invalid adjacent device layer 3 address-to-layer 2 address correspondence relation, check the type of each of any entry in the layer 2-layer 3-integrated forwarding table, which has a forwarding destination layer 3 interface and a forwarding destination layer 3 address identical with the layer 3 interface and the layer 3 address of the adjacent device, and to set an ‘

unresolved’

forwarding destination layer 2 address for the entry having the type of the communication route introduced by the route introducer, while deleting the entry having the type of the communication route introduced by the address resolving module.

4. The forwarding apparatus in accordance with claim 3, the forwarding apparatus further including:

multiple counters provided corresponding to multiple counting targets including a whole apparatus, individual VRFs, and individual layer 3 interfaces;

a counter adder configured to, in the case of introduction of an entry including the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table, respectively increment by one a value of the counter provided for the whole apparatus, a value of the counter provided for a VRF as a search condition for specifying a forwarding destination of a packet in the introduced entry, and a value of the counter provided for a forwarding destination layer 3 interface of the introduced entry; and

a counter subtractor configured to, in the case of deletion of an entry by introduction of the adjacent device layer 3 address-to-layer 2 address correspondence relation from the layer 2-layer 3-integrated forwarding table, respectively decrement by one the value of the counter provided for the whole apparatus, a value of the counter provided for a VRF as a search condition for specifying a forwarding destination of a packet in the deleted entry, and a value of the counter provided for a forwarding destination layer 3 interface of the deleted entry.

5. The forwarding apparatus in accordance with claim 4, the forwarding apparatus further including:

a user interface processor configured to transmit information to and from a terminal device operated by an operator,

the user interface processor having a counter value transmitter configured to send a value of each counter to the terminal device, in response to reception of a command for obtaining values of the multiple counters from the terminal device.

6. The forwarding apparatus in accordance with claim 4, the forwarding apparatus further including:

an upper limit storage module configured to store an upper limit set in advance for each of the multiple counters,

wherein the address resolving module has an introduction prohibition module configured to prohibit introduction of the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table, when a value of at least one of the multiple counters reaches or exceeds the upper limit set for the counter.

7. The forwarding apparatus in accordance with claim 6, the forwarding apparatus further including:

a user interface processor configured to transmit information to and from a terminal device operated by an operator,

the user interface processor having;

an upper limit change command receiving module configured to receive a command for changing at least one of the upper limits stored in the upper limit storage module from the terminal device; and

an upper limit changing module configured to change at least one upper limit among the upper limits stored in the upper limit storage module, in response to the command received by the upper limit change command receiving module.

8. A forwarding apparatus including multiple VPN routing and forwarding tables (VRFs) configured to individually have routing tables provided for respective virtual private networks (VPNs),

wherein each of the routing tables is structured to record a communication route of a packet based on a layer 3 address specifying an address of the packet and a forwarding destination layer 3 address specifying a forwarding destination of the packet from an assigned VRF or a VRF assigned to the routing table, as well as an extranet communication route of forwarding the packet from the assigned VRF to another VRF,

the forwarding apparatus comprising:

a first storage module configured to store a layer 2-layer 3-integrated forwarding table structured to record at least one entry, wherein each entry includes VRF information and a packet destination layer 3 address as search conditions for specifying the forwarding destination of the packet, as well as a forwarding destination layer 3 interface, a forwarding destination layer 3 address, and a forwarding destination layer 2 address as search results, when a correspondence relation of the forwarding destination layer 3 address to the forwarding destination layer 2 address is unresolved for an entry, the entry including specific data representing an ‘

unresolved’

state of the forwarding destination layer 2 address;

a route introducer configured to introduce each communication route, which is recorded in each of the routing tables, into the layer 2-layer 3-integrated forwarding table;

an address resolving module configured to introduce a correspondence relation of a layer 3 address to a layer 2 address of an adjacent device as an adjacent device layer 3 address-to-layer 2 address correspondence relation with regard to the forwarding destination layer 3 interface of an entry recorded in the layer 2-layer 3-integrated forwarding table, into the layer 2-layer 3-integrated forwarding table; and

a forwarding destination identification module configured to search the layer 2-layer 3-integrated forwarding table with a layer 3 address specifying an address recorded in the packet as a search key to specify the forwarding destination of the packet,

in response to presence of an entry, which includes a direct route using a packet destination layer 3 address as the forwarding destination layer 3 address and the VRF information as the search condition for specifying the forwarding destination of the packet that is different from a VRF assigned to the forwarding destination layer 3 interface, in the layer 2-layer 3-integrated forwarding table, the address resolving module utilizing VRF information identical with the VRF information as the search condition to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table;

a determination module configured to, upon specification of an ‘

unresolved’

forwarding destination layer 2 address as a result of the search in the layer 2-layer 3-integrated forwarding table by the forwarding destination identification module, determine whether a corresponding entry as the result of the search is related to the direct route using the packet destination layer 3 address as the forwarding destination layer 3 address and whether a VRF as the search condition for specifying the forwarding destination of the packet is different from the VRF assigned to the forwarding destination layer 3 interface;

a retrieval module configured to, in response to an affirmative determination by the determination module, search the layer 2-layer 3-integrated forwarding table with a forwarding destination layer 3 interface and a packet destination layer 3 address of the corresponding entry with the affirmative determination as search keys to retrieve a condition-satisfying adjacent device layer 3 address-to-layer 2 address correspondence relation; and

a first introduction module configured to, when the condition-satisfying adjacent device layer 3 address-to-layer 2 address correspondence relation retrieved by the retrieval module has already been learnt, use a packet-receiving VRF for the VRF information as the search condition for specifying the forwarding destination of the packet to introduce the learnt adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table.

9. The forwarding apparatus in accordance with claim 8, wherein the address resolving module further has:

a second introduction module configured to, when the condition-satisfying adjacent device layer 3 address-to-layer 2 address correspondence relation retrieved by the retrieval module has not yet been resolved, introduce a certain entry into the layer 2-layer 3-integrated forwarding table, wherein the certain entry includes the packet-receiving VRF for the VRF information as the search condition for specifying the forwarding destination of the packet, the packet destination layer 3 address of the corresponding entry for the layer 3 address as the search condition, the forwarding destination layer 3 interface of the corresponding entry as the forwarding destination layer 3 interface, the packet destination layer 3 address as the forwarding destination layer 3 address, and a value representing an ‘

unresolved state’

as the forwarding destination layer 2 address.

10. The forwarding apparatus in accordance with claim 8, wherein the layer 2-layer 3-integrated forwarding table has a field for storing a type of each communication route that identifies whether the communication route is introduced by the route introducer or by the address resolving module,

the forwarding apparatus further including:

a deletion module configured to, in the case of invalid adjacent device layer 3 address-to-layer 2 address correspondence relation, check the type of each of any entry in the layer 2-layer 3-integrated forwarding table, which has a forwarding destination layer 3 interface and a forwarding destination layer 3 address identical with the layer 3 interface and the layer 3 address of the adjacent device, and to set an ‘

unresolved’

forwarding destination layer 2 address for the entry having the type of the communication route introduced by the route introducer, while deleting the entry having the type of the communication route introduced by the address resolving module.

11. The forwarding apparatus in accordance with claim 10, the forwarding apparatus further including:

multiple counters provided corresponding to multiple counting targets including a whole apparatus, individual VRFs, and individual layer 3 interfaces;

a counter adder configured to, in the case of introduction of an entry including the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table, respectively increment by one a value of the counter provided for the whole apparatus, a value of the counter provided for a VRF as a search condition for specifying a forwarding destination of a packet in the introduced entry, and a value of the counter provided for a forwarding destination layer 3 interface of the introduced entry; and

a counter subtractor configured to, in the case of deletion of an entry by introduction of the adjacent device layer 3 address-to-layer 2 address correspondence relation from the layer 2-layer 3-integrated forwarding table, respectively decrement by one the value of the counter provided for the whole apparatus, a value of the counter provided for a VRF as a search condition for specifying a forwarding destination of a packet in the deleted entry, and a value of the counter provided for a forwarding destination layer 3 interface of the deleted entry.

12. The forwarding apparatus in accordance with claim 11, the forwarding apparatus further including:

a user interface processor configured to transmit information to and from a terminal device operated by an operator,

the user interface processor having a counter value transmitter configured to send a value of each counter to the terminal device, in response to reception of a command for obtaining values of the multiple counters from the terminal device.

13. The forwarding apparatus in accordance with claim 11, the forwarding apparatus further including:

an upper limit storage module configured to store an upper limit set in advance for each of the multiple counters,

wherein the address resolving module has an introduction prohibition module configured to prohibit introduction of the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table, when a value of at least one of the multiple counters reaches or exceeds the upper limit set for the counter.

14. The forwarding apparatus in accordance with claim 13, the forwarding apparatus further including:

a user interface processor configured to transmit information to and from a terminal device operated by an operator,

the user interface processor having;

an upper limit change command receiving module configured to receive a command for changing at least one of the upper limits stored in the upper limit storage module from the terminal device; and

an upper limit changing module configured to change at least one upper limit among the upper limits stored in the upper limit storage module, in response to the command received by the upper limit change command receiving module.

15. A forwarding method effected in a forwarding apparatus including multiple VPN routing and forwarding tables (VRFs) configured to individually have routing tables provided for respective virtual private networks (VPNs), the forwarding method comprising

structuring each of the routing tables to record a communication route of a packet based on a layer 3 address specifying an address of the packet and a forwarding destination layer 3 address specifying a forwarding destination of the packet from an assigned VRF or a VRF assigned to the routing table, as well as an extranet communication route of forwarding the packet from the assigned VRF to another VRF,

storing a layer 2-layer 3-integrated forwarding table structured to record at least one entry, wherein each entry includes VRF information and a packet destination layer 3 address as search conditions for specifying the forwarding destination of the packet, as well as a forwarding destination layer 3 interface, a forwarding destination layer 3 address, and a forwarding destination layer 2 address as search results, when a correspondence relation of the forwarding destination layer 3 address to the forwarding destination layer 2 address is unresolved for an entry, the entry including specific data representing an ‘

unresolved’

state of the forwarding destination layer 2 address;

introducing, via a route introducer, each communication route, which is recorded in each of the routing tables, into the layer 2-layer 3-integrated forwarding table;

introducing, via an address resolving module, a correspondence relation of a layer 3 address to a layer 2 address of an adjacent device as an adjacent device layer 3 address-to-layer 2 address correspondence relation with regard to the forwarding destination layer 3 interface of an entry recorded in the layer 2-layer 3-integrated forwarding table, into the layer 2-layer 3-integrated forwarding table; and

searching, via a forwarding destination identification module, the layer 2-layer 3-integrated forwarding table with a layer 3 address specifying an address recorded in the packet as a search key to specify the forwarding destination of the packet,

in response to presence of an entry, which includes a direct route using a packet destination layer 3 address as the forwarding destination layer 3 address and the VRF information as the search condition for specifying the forwarding destination of the packet that is different from a VRF assigned to the forwarding destination layer 3 interface, in the layer 2-layer 3-integrated forwarding table, the address resolving module utilizing VRF information identical with the VRF information as the search condition to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table;

storing, via a second storage module, a direct route VRF table that is structured to record at least one entry, wherein each entry includes a correspondence relation of a layer 3 interface and a layer 3 address to a VRF identifier group,

wherein the address resolving module searches the direct route VRF table with a layer 3 interface connected to the adjacent device and the layer 3 address of the adjacent device as search keys to obtain a VRF identifier group and uses each VRF identifier of the obtained VRF identifier group for the VRF information as the search condition of specifying the forwarding destination of the packet to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table.

16. A forwarding method effected in a forwarding apparatus including multiple VPN routing and forwarding tables (VRFs) configured to individually have routing tables provided for respective virtual private networks (VPNs), the forwarding method comprising

structuring each of the routing tables to record a communication route of a packet based on a layer 3 address specifying an address of the packet and a forwarding destination layer 3 address specifying a forwarding destination of the packet from an assigned VRF or a VRF assigned to the routing table, as well as an extranet communication route of forwarding the packet from the assigned VRF to another VRF,

storing a layer 2-layer 3-integrated forwarding table structured to record at least one entry, wherein each entry includes VRF information and a packet destination layer 3 address as search conditions for specifying the forwarding destination of the packet, as well as a forwarding destination layer 3 interface, a forwarding destination layer 3 address, and a forwarding destination layer 2 address as search results, when a correspondence relation of the forwarding destination layer 3 address to the forwarding destination layer 2 address is unresolved for an entry, the entry including specific data representing an ‘

unresolved’

state of the forwarding destination layer 2 address;

introducing, via a route introducer, each communication route, which is recorded in each of the routing tables, into the layer 2-layer 3-integrated forwarding table;

introducing, via an address resolving module, a correspondence relation of a layer 3 address to a layer 2 address of an adjacent device as an adjacent device layer 3 address-to-layer 2 address correspondence relation with regard to the forwarding destination layer 3 interface of an entry recorded in the layer 2-layer 3-integrated forwarding table, into the layer 2-layer 3-integrated forwarding table; and

searching, via a forwarding destination identification module, the layer 2-layer 3-integrated forwarding table with a layer 3 address specifying an address recorded in the packet as a search key to specify the forwarding destination of the packet,

in response to presence of an entry, which includes a direct route using a packet destination layer 3 address as the forwarding destination layer 3 address and the VRF information as the search condition for specifying the forwarding destination of the packet that is different from a VRF assigned to the forwarding destination layer 3 interface, in the layer 2-layer 3-integrated forwarding table, the address resolving module utilizing VRF information identical with the VRF information as the search condition to introduce the adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table;

determining, via a determination module, upon specification of an ‘

unresolved’

forwarding destination layer 2 address as a result of the search in the layer 2-layer 3-integrated forwarding table by the forwarding destination identification module, whether a corresponding entry as the result of the search is related to the direct route using the packet destination layer 3 address as the forwarding destination layer 3 address and whether a VRF as the search condition for specifying the forwarding destination of the packet is different from the VRF assigned to the forwarding destination layer 3 interface;

searching, via a retrieval module, in response to an affirmative determination by the determination module, the layer 2-layer 3-integrated forwarding table with a forwarding destination layer 3 interface and a packet destination layer 3 address of the corresponding entry with the affirmative determination as search keys to retrieve a condition-satisfying adjacent device layer 3 address-to-layer 2 address correspondence relation; and

using, when the condition-satisfying device layer 3 address-to-layer 2 address correspondence relation retrieved by the retrieval module has already been learnt, a packet-receiving VRF for the VRF information as the search condition for specifying the forwarding destination of the packet to introduce the learnt adjacent device layer 3 address-to-layer 2 address correspondence relation into the layer 2-layer 3-integrated forwarding table.