Fastpath implementation for transparent local area network (LAN) services over multiprotocol label switching (MPLS)

[0001] This application claims priority of U.S. Provisional Patent Application Serial No. 60/364,147, which was filed on Mar. 15, 2002. The subject matter of the earlier filed application is hereby incorporated by reference.

[0002] 1. Field of the Invention

[0003] This invention relates to systems and methods for providing Transparent Local Area Network (LAN) Services (TLS) to subscribers whom are not all connected to a single LAN.

[0004] 2. Description of the Related Art

[0005] Traditionally, a Virtual Private Network (VPN) has been defined as a private network for voice and data built with carrier services. Most traditional carrier-based VPNs are frame relay and Asynchronous Transfer Mode (ATM) networks. In these types of conventional VPNs, packet-, frame-, and cell-switching networks carry information in discrete bundles, commonly referred to as packets that are routed through a mesh network of switches to a destination. A transmission path for the packets is routed through the switches and relays of the switching network. Many users share the network. To route a packet through the transmission path, carriers of the VPNs may program virtual circuits into the network that simulate dedicated connections between a company's sites. A web of these virtual circuits forms a virtual private network over the carrier's packet-switched network. While these traditional carrier-based VPNs can provide service guarantees using the virtual circuits, setting up and implementing Internet VPNs has become a simpler and more cost-effective method to provide VPN services to subscribers.

[0006] Thus, recently, the development of Internet VPNs has become a growing trend. Accordingly, the term VPN has come to describe private, encrypted tunnels through the Internet for transporting both voice and data between an organization's different sites.

[0007] Unlike conventional carrier-based VPNs, which have been used to traditionally connect a company's different sites, Internet VPNs can include everyone in the company, including mobile users and home workers. Users anywhere may simply dial into a local Internet service provider (ISP), rather than in to the corporate network, using 800 numbers, modern pools, and remote access servers. In addition, local and remote users can connect using a variety of connection methods, including modem dial-up lines or high-speed dedicated leased lines into the Internet. An Internet VPN may ultimately replace all the on-site equipment associated with remote access services, essentially moving all that functionality to an ISP.

[0008] Several initiatives and standards are under development for implementing Internet VPN. For instance, the Internet Engineering Task Force (IETF) assembled a working group to render several Internet-Drafts that suggest the architecture for and various aspects of Internet VPNs. One such Internet VPN studied by IETF is Transparent LAN Service (TLS). TLS is an Internet VPN that takes advantage of local connections to an ISP and wide area connections provided by the Internet to enable subscribers whom are not all connected to a single LAN to function as a single LAN.

[0009] Although the IETF has offered suggestions within its Internet Drafts regarding the concept of TLS, the protocol with which to create and implement a TLS has been left to the discretion of the implementer. Accordingly, the present discussion provides a system and method of the implementation of TLS.

[0010] According to an embodiment of the invention, provided is a network device for providing multipoint services. The network device includes a port, a mapping module, a signaling module, an encapsulation module, a port interface, and an address learning module. The port is configured to send and receive a packet, and the port is connected to a first network entity. The mapping module is connected to the first network entity and configured to determine a virtual path LAN segment assigned to the port. The signaling module is connected to the mapping module and configured to determine virtual channel information assigned to the port. The signaling module is configured to exchange the virtual channel information to a second network entity. The encapsulation module is connected to the signaling module and configured to add stacking labels to a header of the packet. The encapsulation module is configured to assign a quality of service to be applied to the packet. The port interface is connected to the first network entity and configured to map a routing path for the packet. The address learning module is connected to the first network entity and the second entity. The address learning module is configured to learn the routing path to transport the packet from the first network entity to the second network entity.

[0011] According to another embodiment of the invention, provided is a method of transmitting a packet in a network. The method includes a step of providing a port configuration to receive and transfer a packet at a first network entity. The method also includes a step of determining a virtual path LAN segment and virtual channel information assigned to the port at the first network entity. The method further includes a step of transmitting the virtual channel information to a second network entity. A step of adding stacking labels to a header of the packet at the first network entity is also included in the method. The method further includes a step of providing a port interface connected to the port of the first network entity for mapping a routing path for the packet; and learning the routing path to transport the packet from the first network entity to the second network entity.

[0012] According to another embodiment of the invention, provided is a network device. The network device includes a port, a mapping means, a signaling means, an encapsulation means, a port interfacing means, and an address learning means. The port is configured to send and receive a packet, and the port is connected to a first network entity. The mapping means is connected to the first network entity and is used for determining a virtual path LAN segment assigned to the port. The signaling means is connected to the signaling module and is used for determining virtual channel information assigned to the port. The signaling means is configured to exchange the virtual channel information to a second network entity. The encapsulation means is connected to the signaling module and is used for adding stacking labels to a header of the packet. The encapsulation means is configured to assign a quality of service to be applied to the packet. The port interfacing means is connected to the first network entity and for mapping a routing path for the packet. The address learning means is connected to the first network entity and the second network entity, and the address learning means is used for learning the routing path to transport the packet form the first network entity to the network entity.

[0013] The objects and features of the invention will be more readily understood with reference to the following description and the attached drawings, wherein:

[0014] FIG. 1A is a diagram of a network providing TLS services according to an embodiment of the invention;

[0015] FIG. 1B is a diagram of a point-to-point network.

[0016] FIG. 1C is a diagram of a multipoint network according to an embodiment of the invention.

[0017] FIG. 2 illustrates a layer 2 (L2 ) multiprotocol label switching (MPLS) packet encapsulation according to an embodiment of the invention;

[0018] FIG. 3 is a TLS deployment where groups of ports operate as independent I2 switches according to an embodiment of the invention;

[0019] FIG. 4 shows an example of a mapping scheme according to an embodiment of the invention;

[0020] FIG. 5 shows an example of another mapping scheme which may be employed in an embodiment of the invention; and

[0021] FIGS. 6A-B are flowcharts of a method for providing TLS services to subscribers connected to a network according to an embodiment of the invention.

[0022] The invention provides a system and method for offering TLS connectivity between geographically dispersed subscriber sites across MAN (Metropolitan Area Networks)/WAN (Wide Area Networks), as if the subscribers were connected through a Local Area Network (LAN). As shown in FIG. 1A, a network 100 offering TLS may appear virtually as a LAN to the ISP subscribers. However, in a TLS network, the subscribers are not all connected to a single LAN; the subscribers may be spread across a metro or wide area. In essence, a TLS glues several individual LANs across a metro area to appear and function as a single LAN. As a result, TLS technology is poised to become very important for Metropolitan Service Providers (MSP)s.

[0023] One aspect of the invention is to extend corporate bridging domains over multiprotocol label switching (MPLS) clouds 105 on the Internet and interconnect remote corporate private networks using TLS. TLS can leverage the inherent broadcast capabilities for router discovery along MPLS cloud 105. The switching application of TLS provides a virtual LAN switching service to end users, i.e., the subscribers. The switching application may also be used for interconnecting subscriber switches across a MAN/WAN network. Therefore, if several sites, such as a corporation, university and hospital, subscribe to a TLS service, these multiple subscribers may appear as if these sites are co-located, and are connected via a local Ethernet switch providing bridging services for the delivery of an Ethernet service to the multiple subscribers. Thus, the invention can be used to aggregate all multiple subscribers' traffic and carry the traffic via an uplink to a service provider as opposed to having a separate uplink for each subscriber.

[0024] TLS may be introduced as an (Layer 2) L2 (Provider Provisioned VPN) PPVPN solution. Layer 2 VPN (L2VPN) allows a network operation to build a Layer 2 VPN with Ethernet as the interconnect; and MPLS-based L2VPN allows one to signal an Ethernet connection across a packet switched networks. Both of these, however, offer point-to-point Ethernet services as shown in FIG. 1B. What distinguishes TLS from L2VPN and MPLS-based L2VPN is that VPLS offers a multipoint service. This means in the case of TLS, the subscribers in the VPN are connected by a multipoint network, which offers multiple point to point services.

[0025] The TLS offers a multipoint Layer 2 service over multiple tunnels 115a-c across packet switched networks, such as service provider networks (FIG. 1C). If a subscriber wishes to establish a communication link over tunnels 115a-c of the TLS system, the subscriber may access any one of the multiple tunnels 115a-c to which the subscriber has been assigned a subscription. In a point-to-point VPN system, only a single common tunnel 110 is established between subscribers 1a-b, 2a-b, and 3a-b, as shown in FIG. 1B.

[0026] Service provider networks may include subscriber facing access points into their network called provider edges (PE)s 110, as depicted in FIG. 1A. Each subscriber's traffic may be mapped to some logical entity on the ingress of a PE 110. When a subscriber requires a LAN segment, a logical endpoint called Virtual Private LAN Segment (VPLS) may be used to receive and forward the subscriber's traffic over the TLS. In some contexts, the terms TLS and VPLS are used interchangeably.

[0027] In a TLS, a remote subscriber may dial into a service provider network located at an ISP. A LSP (label switched path) tunnel 115 for TLS is then established across the Internet to a corporate gateway server. Each LSP tunnel 115 may be a point-to-point within which individual subscriber virtual circuits exist. The point-to-point service may be facilitated through a pair of LSPs facing in opposite directions, to form a single virtual pipe or tunnel 115. Each LSP tunnel 115 aggregates the virtual circuit of subscribers assigned to each respective tunnel into a single tunnel. To implement such a network, a TLS device may include the following functional elements: mapping; signaling for tunneling multiplexing; encapsulation, packet forwarding, address learning; and flooding of broadcast, multicast and unknown unicast destination traffic over MPLS.

[0028] In conducting mapping, the LSP tunnels 115 may transport L2 packets from one PE to another. The PE may be an endpoint in a VPLS. Two LSPs are created between a pair of PEs, one in each direction to form an LSP tunnel. For instance in FIG. 1A, a LSP1-2 tunnel exists between PE1 and PE2. Another LSP2-3 tunnel lies between PE2 and PE3. Similarly, LSP1-3 forms a tunnel between PE1 and PE3.

[0029] A full mesh of LSPs tunnel between all the PEs may be required to create the transport layer for the virtual LAN (VLAN). The VPLS may be a domain of L2 medium access control (MAC) addresses and VLANs. The VPLS may have multiple subscribers wherein each subscriber can have its own independent set of VLANs, if a VPLS is dedicated to a subscriber. Thus, the VLAN Ids used by different VPLSs may overlap within each PE.

[0030] A typical scenario in a PE may be as follows:

	TABLE 1
	VPLS 1	Subscriber A.	VLAN 1
		Subscriber A.	VLAN 2
	.
	.
	.
	Subscriber B.	VLAN 101
	Subscriber B.	VLAN 102
	.
	.
	.
	VPLS 2	Subscriber Q.	4K VLANs

[0031] Since subscribers' VLANs can be overlapping within a VPLS, the PEs may include the capability of associating each subscribers' VLANs with a unique identifier for identification.

[0032] Furthermore, since many subscriber links can be multiplexed over the same tunnel 115, the PE devices may need to determine which PE devices constitutes a given VPLS. Mapping is the process by which the PEs determine all the subscribers' ports that belong to the same VPLS. More specifically, a given PE that has one or more subscribers' ports that belong to a particular VPLS may need to determine all other PEs that have one or more ports that belong to the same VPLS. In the example given above in Table 1, this means that PE1, PE2, and PE3 determine that subscriber A and subscriber B both belong to VPLS 1, and that each PE knows to which PE the subscriber's device is attached.

[0033] In addition, the PE devices may be capable of establishing the transport tunnels 115 to other PEs in order to deliver the subscriber's traffic. Thus, in performing the signaling function of the TLS, the PE device may serve as an edge router capable of running a signaling protocol an/or routing protocols to exchange virtual channel (VC) label information. The PE devices may be capable of establishing transport tunnels 115 to other PEs to deliver virtual circuit (VC) LSP traffic transmitted from the subscribers to a network device. As shown in FIG. 1A, a VPLS may be created on top of the PE tunnel mesh 150 by creating a full mesh of VCs. Each VC may be identified by a separate VC label for each ingress PE. An egress PE signals the VC label to be used by the ingress PE for a given VPLS. FIG. 1A illustrates the VPLS domains overlaid on the PE tunnel mesh.

[0034] FIG. 1A shows a TLS with two VPLS domains over MPLS cloud 105. VPLS 1 is used by Subscriber 1 and VPLS 2 is used by Subscriber 2.

[0035] In FIG. 1A, as discussed above, PEs 1, 2 and 3 are the provider edges so that point-to-point LSPs are created between each PE and adjacent PE, in each direction. Thus, LSP 1-2, LSP 2-3, and LSP 1-3 form the PE tunnel mesh 150.

[0036] As shown in FIG. 1A, the VC labels allocated by each PE for a VPLS may be different for each ingress PE. For example, PE1 may allocate VC label 112 for PE 2 and VC label 113 for PE 3 for VPLS 1. Subscriber 1 may create a VLAN 1, which resides on PEs 1 and 3. Subscriber 1 may also create VLAN 2, which resides on PEs 1, 2 and 3. Subscriber 2 may create a VLAN 1, which resides on PEs 1, 2 and 3. Subscriber 2 may create VLAN 2, which resides on PEs 1 and 3. Thus, subscribers 1 and 2 have overlapping VLAN Ids.

[0037] Both subscribers 1 and 2 may share the same tunnel mesh formed by LSP 1-2, LSP 1-3 and LSP 2-3. The QoS (quality of service) parameters for each LSP may be configured by the respective system operators so that the terms of the individual subscriber's contracts are satisfied.

[0038] The endpoint of each LSP may appear to be a virtual Ethernet port to each PE. Traffic coming into MPLS cloud 105 at each PE may then be forwarded over the LSPs just like Ethernet traffic over any other physical ports belonging to a VLAN, as long as the packet includes the necessary encapsulation.

[0039] A packet sent over an LSP tunnel between two PEs may need to be encapsulated by a stack of two MPLS labelsa tunnel label and a VC label, as shown in FIG. 2, before the packet is sent. Label stacking may be used to create hierarchies, which separate the LSPs and the virtual channels that exist inside tunnel 115. The tunnel label may be positioned at the top of the stack to uniquely identify the LSP from one PE to the other in a single direction. The VC label may represent each virtual channel. The VC label may be used by the egress in order to map the channel to the individual Group ID (GID) and VLAN ID (VID). As shown in FIG. 3, the ingress of a PE can be organized into groups of ports, which are identified by the GID. Each port group represents a VPLS domain of L2 MAC addresses and VLANs. FIG. 3 shows a TLS deployment where groups of ports operate like independent L2 switches. All the VLANs in a port group may have unique VLAN Ids.

[0040] The second label, shown in FIG. 2, may be the VC label, which may be positioned at the bottom when the original packet 160a is encapsulated in a two-label stack. Each egress PE may identify the label encapsulated packet 160b using the VC label. The egress PE or the disposition router may indicate the VC label binding to a VPLS using a LDP (label distribution protocol) downstream unsolicited mode message. The LDP is the set of procedures and messages by which label switching routers (LSRs) establish label switch paths. This way, an ingress PE knows the VC label to encapsulate the packet 160a with, so that the egress PE uniquely maps the encapsulated packet 160b to a VPLS.

[0041] If the encapsulated packet 160b is transported over an Ethernet to the next hop LSR, a new Ethernet header may be added to the encapsulated packet 160b before the packet is transmitted over the output Ethernet port as shown in FIG. 2. The EtherType may be established as 08847 for a unicast MPLS packet 160c and 08848 for a multicast packet 160c. FIG. 2 illustrates an L2 MPLS encapsulation.

[0042] In forwarding the packet 160b, when the packet reaches the destination PE, ingress PE may be responsible for classifying the packet based on the QoS parameters associated with the packet. Once the packet has been classified, the tunnel label may be stripped off by the ingress routers of the destination PE. Thus, the egress VPLS may receive a packet that has already had the tunnel label removed. The egress VPLS may use the VC label to point to the GID and VID and to determine the local ports. The destination address (DA) of the encapsulated packet and the VID may be used to take further L2 decisions, such as learning and bridging, similar to an Ethernet packet arriving from a physical Ethernet port. Network 100 may be configured so that if the Ethernet packet sent on the LSP is not a tagged 802.1Q frame, only non-qualified learning may be supported on a PE. That is only MAC addresses will be learnt.

[0043] As mentioned above, one feature of TLS is that it offers a multipoint service. Thus, the entire service provider network may be configured to appear as a single logical learning bridge for each VPLS that network 100 supports. Learning consists of associating source MAC addresses of the packets with the ports on which they arrive. This association may occur within a forwarding information base (FIB), which is the information that is maintained in the routers and contains the set of forwarding paths reflecting the various policy and QOS rankings available for the packets to reach each known destination. Thus, the FIB may be used for forwarding the packets. For example, suppose a PE receives a packet with source MAC address S on port P. If subsequently, the PE receives another packet with destination MAC address S, the PE will know that it should send the packet out on port P. However, when a bridge receives a packet to a destination that is not stored in its FIB, the bridge may flood the packet on all the other ports. Similarly, a PE may flood packets to an unknown destination to all other PEs in the VPLS.

[0044] There may be two modes of learning: qualified and non-qualified learning. In qualified learning, the learning decisions at the PE may be based on the subscriber Ethernet packet's MAC address and VLAN tag. Within one VPLS, there may be multiple logical FIBs, one for each subscriber VLAN tag identified in a subscriber packet. Every PE may have at least one FIB for each VPLS that the PE participates in. Thus, the broadcast domains may be defined in a VPLS by the VLANs and multicast groups setup in the VPLS.

[0045] Non-unqualified learning, learning may be based on a subscriber Ethernet packet's MAC address only. In other words, at any PE, there may be only one FIB per VPLS in non-qualified learning. In the non-qualified mode, the MAC addresses may not be qualified by any other membership like the VID. The VPLS itself may serve as the broadcast domain in this mode. Multicast groups can exist and broadcast to members of the multicast group may be restricted to the group. If untagged packets are to be supported over MPLS cloud 105, the non-qualified mode may be assumed.

[0046] In the embodiment shown in FIG. 4, in network device 200a, LSPs 1-8 may be configured as virtual Ethernet ports. Virtual switches may be positioned within each PE. The virtual switches may include logical ports, such as virtual Ethernet ports, as interfaces. Each LSP may have a unique physical port associated with it. For example in the embodiment of FIG. 5, the physical port may be an interface such as a System Packet Interface Level 4 (SPI-4) port channel. In network device 200a, SPI-4 may serve as an interface for packet and cell transfer between a physical layer (PHY) device and a link layer device, for aggregate bandwidths of OC-192 ATM and Packet Synchronous Optical Network (SONET)/Synchronous Digital Hierarchy (SDH) (POS), as well as 10 Gb/s Ethernet applications. OC-192 is a type of fiber-optic cable that can carry up to 9,953 Mbps (megabits per second), or about 10 Gbps (gigabits per second). Although the SPI-4 interface may be designed to meet this particular application, the SPI-4 may be installed in any type of network as a system packet interface for data transfer between a link layer and a PHY device.

[0047] The embodiment shown in FIG. 4 may be installed in a line card where a SPI-4 interface is used to interface with a dedicated network processor performing routing and MPLS functions. The SPI-4 interface may be configured to relieve the network processor of all the TLS data path processing. Alternatively, the physical port can be an Ethernet port in network device 200b shown in FIG. 5.

[0048] The line card in conjunction with the SPI-4 interface may perform the packet forwarding functions. Each line card may perform an independent lookup of a destination address for each packet received on a local copy of the forwarding table. The packet may be switched across a crossbar switch fabric to the destination line card. The basic functions of the line card may be queuing, congestion control and statistics gathering.

[0049] FIG. 4 shows an example of LSP to SPI-4 port channel mapping network device 200a, and FIG. 5 shows an example of LSP to Ethernet port mapping network device 200b.

[0050] The data structure, which may be employed to implement the invention, may include several lookup tables. A key stored in the table may be associated with each lookup table. A search algorithm may compare the key value with the values stored in the table. If a table entry matches the key, relevant fields from that entry may be used for further processing.

[0051] For instance, the invention may perform a physical port to group identification mapping. The group identification for each Ethernet port may be stored in each ingress port. A CPU (not shown) attached to a chip or SPI-4 interface may be connected to all the port groups. A table, which includes the group identification and label switched path, may be used as a key to map to a VC label table. This group identification and label switched patent table may be stored in an external memory SRAM (not shown) accessed by the LSP associated port egress logic. This table may be stored in the ingress of all LSP associated ports. Another table that the invention may include is a label switched path to port channel table, which may include the physical (port channel) as the entries. This table may be stored in a SPI-4 port egress.

[0052] In a table, which includes group identification and VLAN identification columns, each entry may contain a list of port LSPs and non-LSP associated physical ports, which map to a VLAN. The VLAN may be assigned to the port group given by the GID, which may be the VLAN table and may be stored in each Ethernet port ingress. In the qualified mode, this table may be looked up using the group identification and VLAN identification as the key. In the non-qualified mode, the group identification may be used as the key. Each entry in the L2 multicast table may contain a list of ports and port LSPs which map to a L2 multicast group. The L2 multicast table may be used to flood multicast packets to only those ports which have members of the L2 multicast group, instead of flooding packets to the entire VLAN. The L2 multicast table may be looked up using the group identification, the virtual channel identification and the multicast destination address as the key in the qualified mode, and the group identification and destination address as the key in the non-qualified mode.

[0053] In the L2 Address table, the L2 lookup may be performed using the group identification, VLAN identification and destination address in the qualified mode and the group identification and destination address as the key in the non-qualified mode. The L2 Address table may return the L2 table entry which contains outgoing physical (Ethernet/SPI-4) port and the LSP number if the packet is destined to go out on an LSP. The L2 Address table may be configured to perform the same functions as an ARL (address resolution logic) table used by the ingress of each Ethernet port. Another table that may be employed by the invention is a table of 32-bit tunnel labels, columns and next hop the destination address columns indexed by the LSP number. This table may be used by the egress logic of the LSP associated port. There may be one tunnel label table per egress port. The MPLS Router MAC address table may be used by the egress logic of a port associated with an LSP to maintain MPLS router MAC address.

[0054] The invention may be configured to perform Ethernet packet forwarding for L2 processing using TLS. In situations where a packet arrives on an Ethernet port, which is not associated with MPLS LSPs, the treatment applied to the packet may depend upon whether the packet is a L2 unicast packet or a L2 unknown unicast/multicast/broadcast packet. When an Ethernet packet arrives on a physical port, if the packet is unicast, for the qualified mode, the GID, VID and the DA of the packet may be used to perform a lookup in the L2 Address table. In the non-qualified mode, the GID and DA of the packet may be used to perform the L2 address lookup. If there is a match, and if the outgoing port is a port LSP, the packet may need to be encapsulated before being forwarded.

[0055] The packet may be forwarded to the egress physical port obtained from the L2 address lookup. The LSP on which the packet is to be transmitted and the VPLS (GID) to which the packet belongs may be sent to the egress port. The egress logic may use the incoming GID and LSP number from the L2 address lookup, to lookup the group identification and label switched path, which maps to VC Label table so that the VC label is obtained. The VC label may be first appended to the packet header in front of the DA.

[0056] The egress logic may use the outgoing LSP number to index into the Egress LSP to the Tunnel label table. The tunnel label may be appended in front of the VC label. As discussed above, the tunnel label may be the egress tunnel label, which maps to the egress tunnel LSP.

[0057] Optionally, an additional Ethernet header may be required to send the packet 160c to the next hop. The MPLS Router MAC address may be the SA (source address) and the next hop router DA may be obtained from the Egress port to next hop DA table. The EtherType field may have a value of 08847, as illustrated in FIG. 2.

[0058] If there is no match, the unknown packet may need to be flooded onto all the ports and port LSPs of the VPLS VLAN. An unknown unicast or broadcast packet may be flooded to all the physical ports and LSPs associated with the VPLS VLAN the packet belongs to. The port and port LSP list may be stored in the GID and VID table, which includes the group identification and VLAN identification. The port and port LSP list may be looked up using the GID and the VID as the key in the qualified mode and using the GID in the non-qualified mode. The packet may be transmitted over the listed ports and port LSPs using the encapsulation required for each LSP.

[0059] A multicast can be treated exactly the same way an unknown unicast or broadcast packet is treated. A multicast packet may be optionally switched using the L2 multicast table. If this option is chosen, the port and port LSP list may be stored in the L2 multicast table. This table may be looked up using the GID, VID, and DA as the key in the qualified mode and the GID and DA in the non-qualified mode.

[0060] On each egress port associated with an LSP, the VC label from the VC label table and the tunnel label from the tunnel label table may be appended to the packet header. Optionally, the next hop DA may be obtained from the Egress port to next hop DA table and the SA may be the MPLS Router MAC address. The EtherType for multicast/broadcast may be 08848.

[0061] The packet may then be broadcast to other non-LSP associated Ethernet ports using 802.1q and 802.1p rules for tagged and untagged packets.

[0062] The invention may also provide LSP packet forwarding for L2 forwarding when a packet arrives on an Ethernet port or an SPI-4 port, which is associated with MPLS LSPs. For an L2 Unicast MPLS packet, when an encapsulated Ethernet packet arrives on a LSP associated port, if the port is an Ethernet port, the incoming DA may be the MPLS router DA. When this configuration is detected, the DA, SA and the Ether Type fields (assuming the packet is an Ethernet II packet) are stripped off. For an SPI-4 MPLS facing (LSP associated) port, the Ethernet-encaps-in bit in a TBD register may indicate if the packets will arrive with the Ethernet header.

[0063] Also, the tunnel label may be stripped off. The presence of the Tunnel Label may be indicated by a PHP (Penultimate Hop Popping) bit in a configuration register for LSP associated ports. This register may be TBD.

[0064] The VC Label may be used to index into the VC Label to GID and LSP table and the VPLS and VLAN associated with the packet may be obtained. Thus, the GID may indicate the VPLS.

[0065] The priority of the packet may be obtained from the VLAN tag. Optionally, the priority of the frame can be a function of the channel number on which the packet arrived.

[0066] Then the L2 address table lookup may be performed using the GID, VID and the DA in the qualified mode. In the non-qualified mode, the GID and DA may be used to lookup the L2 table. If there is a match and the resulting entry does not indicate an LSP association, the packet may be forwarded on the Ethernet port obtained from the entry. If there is an LSP associated with this DA, the packet may be dropped, indicating an error condition.

[0067] If the L2 lookup fails, the packet may be designated as an unknown unicast, and process as discussed above. 802.1q and 802.1p standard rules may apply for forwarding the received packet over the egress Ethernet port.

[0068] When an encapsulated multicast Ethernet packet arrives on a LSP associated port, if the port is an ethernet port, the incoming Ethernet encapsulation may be stripped off as in the unicast case. If the port is a SPI-4 port, the Ethernet encapsulation may optionally be stripped off. The tunnel label may also be stripped off.

[0069] If the packet is a broadcast or unknown unicast packet, the VC label may index into the VC label to the GID and LSP table and the VPLS VLAN membership of the packet may be determined. The packet may then be forwarded over all the physical ports of the VPLS VLAN, which are not associated with any LSP. The port list may be obtained by the GID and VID table lookup using the GID and VID as the key in the qualified mode or the GID as the key in the non-qualified mode. The packet may not be sent over the LSPs listed in the table entry to ensure a split horizon.

[0070] Multicast packets can be treated exactly the same way as broadcast or unknown unicast packets. Optionally, multicast packets may be switched using the L2 multicast table. In this mode, the GID, VID and DA in the qualified mode or the GID and DA in the non-qualified mode may be used to lookup in the L2 multicast table and the list of ports and port LSPs are found. The packet may be forwarded to all the ports not associated with an LSP.

[0071] In performing address learning, the treatment applied to the packet may depend upon whether the packet is received from a non-LSP port or a LSP port. When a unicast packet is received from a non-LSP associated Ethernet port, an L2 address table lookup may be performed using the GID, VID, and SA as the key in the qualified mode or the GID and SA as the key in the non-qualified mode. If there is a hit, the hit bit may be updated. Otherwise, a new entry may be created in the L2 address table. The Ethernet port number on which the packet was received may be stored in the L2 address entry.

[0072] When a unicast packet is received on an LSP, the VC label may be used to index into the VC label to the GID and LSP table. An L2 address table lookup may be performed using the GID, VID, and SA as the key in the qualified mode or the GID and SA in the non-qualified mode. If there is a hit, the hit bit may be updated. If there is a miss, a new entry may be created in the L2 table. The entry may contain the ingress port number on which the packet was received and the LSP number taken from the VC Label to the GID and LSP table. The physical port on which the packet arrived may be assigned the ingress port number.

[0073] The software running on the system CPU (not shown) may be responsible for setting up some of the data structures employed by the invention. For example, the physical port to GID table can be configured by the CPU (not shown) to suit the requirements of the system. The data structure for the egress LSP to tunnel label table may contain the list of tunnel labels for the PE tunnel mesh. The indices to the tunnel labels may be the LSP numbers. The software may configure this table on the LSP associated egress ports when the tunnel mesh is created. An entry may be created in the GID and LSP to VC label table every time a new VPLS is configured. The PE (Egress PE) may signal to its peer that the VC label to be used to send packets to the new GID using the LDP unsolicited downstream message. The ingress PE may then create an entry in this table. The index corresponding to the tunnel label used to route the packet to the egress PE may be used as the LSP number to lookup into the GID and LSP entries which can be mapped to the VC label table. When a new VPLS is created in an (egress) PE, an entry may be created in the VC Label to the GID and LSP table. The VC label signaled to the ingress PE may be used as the index and the GID and egress LSP number (which maps to the tunnel LSP to be used to route the packet to the ingress PE) and may be stored in the table on the egress PE.

[0074] The CPU may configure the LSP to port channel table when the PE tunnel mesh is created. For each LSP number (which is the index to the tunnel table), the physical port channel number may be stored in this SPI-4 port table. An entry may be created in the GID and VID table when a new VLAN is configured for a port group. The physical ports as well as the port LSP numbers may be stored in the entry. Network 100 may be configured so that address learning/aging may need to be performed by the system CPU only if the CPU based learning and aging is selected by the system operator. Hardware based learning and aging was been described above.

[0075] The L2 Multicast table may be a table for the creation of L2 multicast groups. The CPU may create an entry in the L2 Multicast table whenever an L2 multicast group is created. Each entry may contain the list of ports and port LSPs on which members of this L2 multicast group (identified by GID, VID, DA) are present. An existing entry may be updated to add or delete a port or port LSP depending on members joining or leaving the multicast group. The egress port to next hop DA table may be an entry stored in each Egress port, to be configured when the CPU learns of the next hop's DA. The CPU may also configure the MPLS Router MAC address.

[0076] The PHP bit may be a bit in a TBD register in an LSP associated port. The CPU may configure the PHP bit on a per LSP associated port to know if penultimate hop popping is being performed by the LSR connected to the switch. The Ethernet Encaps bit may also be a bit stored in a TBD register in an LSP associated port. An Ethernet Encaps out-bit may be configured on a per LSP associated port to determine if the packet being sent on an egress LSP includes a next hop DA, router SA, 08847/08848 encapsulation. Another bit that may be stored in a TBD register in an LSP associated port is an Ethernet Encaps in-bit. This bit also may be configured on a per LSP associated port to determine if the packet being received on an ingress LSP includes the next hop DA, router SA, 08847 or 08848 encapsulation.

[0077] FIG. 6A is a flow chart of a method for providing multipoint services to subscribers according to an embodiment of the fast path function of the invention. At Step S6A-1, a packet is received at a port such as an Ethernet port of a network entity such as a subscriber's device. The packet may be encapsulated, in Step S6A-2, before the packet is transmitted across the network. A port interface, such as a SPI-4 interface, may map the routing path for the packet in Step S6A-3. In Step S6A-4, the PE may forward the packet to the destination entity. In Step S6A-5, as the packet is being transmitted to a destination PE, the routing path and the QoS of the packet may be learned by the PEs.

[0078] FIG. 6B is a flow chart of a method for providing multipoint services to subscribers according to an embodiment of the slow path function of the invention. At Step S6B-1, the PE maps the local subscriber ports to a VPLS. At Step S6B-2, a signal protocol, which may be included in the PEs, may be used to exchange the VC label information associated with each port.

[0079] The invention may include several features within the TLS services provided to subscribers. For example, the VPLS may be a logical entity to which unique VLANs are mapped. The VPLS can map to a group of subscriber facing ports in a PE. The subscriber facing port group can be mapped to an explicit Group ID (GID). This GID can be carried in a custom header in the packet received from the subscriber facing port for further processing by the TLS data path forwarding engine. On the PE ingress, all the VLANs on a VPLS may include unique VIDs. Thus, a subscriber can be assigned to one or more Ethernet ports and all the subscriber's VLANs may reside behind that port group. More than one subscriber can share the same ingress Ethernet port group as long as they share the same set of unique VLAN IDs. The QoS guarantees for each subscriber may be policed at the ingress PE. Network 100 may be configured so that it is the MSP's (Metro Service Provider) responsibility to make sure that all the traffic going out on the MPLS port is shaped such that the individual subscriber guarantees can be met. Another feature offered by the invention is that the VC label used in the PE may be unique across all VPLSs. Furthermore, a single tunnel mesh may be used between all the PEs.

[0080] One having ordinary skill in the art will readily understand that the steps of the method may be performed in different order, or with multiple steps in parallel with one another. Also, one having ordinary skill in the art will understand that a network device may be configured to perform the above-described method either in silicon or in software. Accordingly, one will understand that the switching configurations described herein are merely exemplary. Accordingly, although the invention has been described based upon these preferred embodiments, it would be apparent to those of skill in the art that certain modifications, variations, and alternative constructions would be apparent, while remaining within the spirit and scope of the invention. In order to determine the metes and bounds of the invention, therefore, reference should be made to the appended claims.