Internet protocol virtual private network realization using multi-protocol label switching tunnels

[0002] The invention relates generally to the field of virtual private networks and more particularly, to distribution of private network information over shared network infrastructure in the Multi-Protocol Label Switching domain.

[0003] With the growing popularity of the Internet and networks in general, there is a trend towards centralized network services and centralized network service providers. To be profitable, however, network service providers need to constantly maintain and if possible enlarge their customer base and their profits. Since leased line services are coming under increased competition, profit margins have been decreasing for these providers. Thus, an increased number of providers are trying to attract small and medium sized businesses by providing centralized network management.

[0004] Network providers are offering Virtual Private Networks (VPNs) to interconnect various customer sites that are geographically dispersed. VPNs are of great interest to both providers and to their customers because they offer privacy and cost efficiency through network infrastructure sharing. There has been difficulty providing this service, however, due to address conflicts, security problems, scalability issues and performance problems.

[0005] Various VPN models have been proposed with various degrees of security, privacy, scalability, ease of deployment and manageability. Some providers have even attempted to solve these problems using Multi-Protocol Label Switching (MPLS) networks. However the MPLS models proposed still suffer from some of the same problems discussed above (i.e. scalability, etc.).

[0006] Accordingly there exists the need for a scalable system which allows the implementation of separate virtual private networks over common infrastructure while providing security and sufficient performance to each network.

[0007] The need further exists for such a system which allows for communicating private traffic through a shared network.

[0008] It is accordingly an object of the present invention to provide a scalable system which allows the implementation of separate virtual private networks over common infrastructure while providing security and sufficient performance to each network.

[0009] It is another object of the invention to provide such a system which employs MPLS.

[0010] It is another object of the invention to provide such a system which allows for communication of private traffic through a shared network.

[0011] These and other objects of the invention will become apparent to those skilled in the art from the following description thereof.

[0012] It has now been discovered that these and other objects may be accomplished by the present virtual private networks which enable private communications over a shared MPLS network, between at least two private networks. The present invention includes multiple routers in communication with the shared MPLS network and configured to dynamically distribute VPN information across the shared MPLS network. The VPN information distributed by a particular one of the routers includes a VPN identifier assigned to that router. The VPN identifier identifies a VPN which the particular routers is associated with. One of the routers includes a first table, stored therein of label switched paths from that router to the remainder of routers in communication with the shared MPLS network. That router also includes a second table, stored therein, of nested label switched paths from that router to the remainder of routers in communication with the shared MPLS network which share a common VPN identifier.

[0013] In an embodiment of the invention, the virtual private network includes router means in communication with the shared MPLS network for routing VPN information across the shared MPLS network. The VPN information includes a VPN identifier assigned to the router means, which identifies a VPN with which the router means is associated. A first table is stored in the router means, and contains a list of all label switched paths across the shared MPLS network. A second table is stored in the router means and contains a list of nested label switched paths from a portion of the router means which is configured to communicate with one of the at least two private networks to another portion of the router means which is configured to communicate with another of the at least two private networks.

[0014] In another embodiment, the invention includes a method of configuring virtual private networks over a shared MPLS network. The method includes configuring the shared MPLS network including at least two routers in communication therewith. It further includes determining first information about all label switched paths between a first of the at least two routers and all others of the at least two routers, and storing the first information in the first router. The all others of the at least two routers includes a second router. The method also includes assigning a common VPN identifier to the first and second routers. It includes determining second information about all label switched paths between the second router and all remaining of the at least two routers, and storing the second information in the second router. The first router is a member of the remaining routers. It includes determining third information about all nested label switched paths between the first router and all others of the at least two routers which are assigned the common VPN identifier, and storing the third information in the first router. It also includes determining fourth information about all nested label switched paths between the second router and all remaining routers which are assigned the common VPN identifier, and storing the fourth information in the second router.

[0015] The invention will next be described in connection with certain illustrated embodiments; however, it should be clear to those skilled in the art that various modifications, additions and subtractions can be made without departing from the spirit or scope of the claims.

[0016] For a fuller understanding of the nature and objects of the invention, reference should be made to the following detailed description and accompanying drawings, in which:

[0017] FIG. 1 depicts a block diagram of a shared MPLS network in accordance with the invention;

[0018] FIG. 2 depicts a block diagram of a the shared MPLS network depicted in FIG. 1 illustrating a router building up an LSP list;

[0019] FIG. 3 depicts an example of communicating an IP packet in accordance with the invention over the MPLS network depicted in FIG. 1.

[0020] The present invention enables the formation of VPNs by distributing VPN information throughout a shared Multi-Protocol Label Switched (MPLS) network. While only Label Distribution Protocol (LDP) connections will be discussed, those skilled in the art will recognize that there are several ways to accomplish the distribution of the VPN information such as OSPF opaque LSAs, TCP connections, BGP-4, etc. without departing from the scope of the present invention.

[0021] The present invention exploits the Label Switch Path (LSP) mesh implicitly established between all edge routers in a MPLS domain. It uses 2 levels of LSP tunneling: the outer/base level, which is the hop by hop LSP tunneling that interconnect all VPN Border/Label Switched Routers (VBRs/LSRs). VBRs are also referred to as edge routers); and, the bottom of label stack/nested level, which provides logically single hop tunnels between VBRs. For each IP VPN, single hop nested tunnels are established between all VBRs serving that particular VPN.

[0022] FIG. 1. illustrates a possible configuration of an MPLS network. Those skilled in the art will recognize that other configurations are possible (i.e. more or fewer LSRs also referred to as core routers, more or fewer VBRs, and different connections therebetween). A service provider or consortium of service providers (the provider) wishing to offer IP VPN service first configures one or more MPLS domains. Each MPLS domain becomes a VPN area. The VPN area consists of VBRs 10 around the edge and core LSRs 20, interconnected by links 30. The interfaces to the links 30 each have assigned to them an IP address from the provider's IP address space. In particular a VBR 10 has an IP address in the provider's IP address space. This address is not directly visible within any of the IP VPNs that the VBR 10 will support.

[0023] The provider determined routing regime determines routes within the MPLS domain and then, as per normal MPLS operation, Label Distribution Protocol is invoked to establish implicit LSPs across the MPLS domain which include the intermediate hops required to get from one VBR 10 to another VBR 10. FIG. 2 illustrates the label switched path tree terminating on a VBR 10. The full mesh is realized by label switched path trees terminating on all VBRs 10. The result is a full mesh of LSPs between all LSRs 20 and VBRs 10. (i.e. in each LSR and VBR there is a Forwarding Equivalence Class (FEC) to next hop label map that has an entry in it for every other LSR and VBR for the first hop of an LSP to that VBR. This defines the base tunnel mesh). These first hop labels in the FEC map are referred to as base labels. They will be used as the top of stack labels for all inter VBR traffic. Base labels will be swapped at each LSR 20 on the path to the destination VBR 10.

[0024] After the MPLS network is configured, the provider can configure a VPN. To do so, the provider selects VBRs 10 from the MPLS domain that will serve the VPN and configures a Virtual Router (VR) at each one by assigning it a VPN ID. While VRs are discussed herein, those skilled in the art will recognize that other routing mechanisms such as bridges, switches and the like could be employed without departing from the scope of the invention. The provider then provisions stub links (i.e. links between VRs and one or more routers at each private network (private routers)). Stub link interfaces are assigned IP addresses from the private network's IP address space. If the provider has a globally unique subnet address range, he can reuse it within every IP VPN. It will not overlap with the private network IP address space whether the private network is using its own globally unique address space, or is using private addresses, 10.x.x.x etc.

[0025] If the IP VPN to be established spans multiple VPN areas the provider must enable VRs in some of the gateway VBRs 10 that straddle the relevant VPN areas. These gateway VRs will participate in the following steps in all the VPN areas in which they are configured to operate.

[0026] Using a VR to exchange routing information with one or more enterprise site routers is the most general mechanism for disseminating private network reachability information. Part of the stub link configuration is to specify what routing protocol runs over it, between the private network router and the VBR 10.

[0027] The LDP session initiation process is used as the method of VRs discovering their peers, since an object of the present invention is to establish a second level of MPLS tunnels. Every VR sends an LDP hello message down every base network LSP that exits its VBR. Hello messages (and any subsequent session messages) are encapsulated with the base MPLS label so that they are carried all the way to destination VBR 10. The LDP hello message is a form of query to determine if a VR for the same VPN (a peer) resides at the destination VBR. The VPN ID is carried in the header of the LDP link hello as the <label space id> field. A receiving VBR 10 will only register an LDP hello adjacency if the <label space id> is one that it supports (i.e. if it has a VR for the same VPN ID).

[0028] When a hello adjacency is registered, the relevant VR proceeds to initiate an LDP session with its peer. One of the two VRs will initiate a TCP connection to the other. The IP source and destination addresses used here are the base network IP addresses of the respective VBRs 10. After the TCP connection is in place, and the necessary initiation messages have been exchanged, then an LDP session between the peer VRs exists. The LDP session is established and the two VRs offer each other a label for a LSP tunnel to itself. The peer VR will store this in a forwarding table as the nested label 40 (i.e. the first label to be pushed on the label stack) for the destination VR. This nested label 40 does not include any labels for intermediate hops required to traverse the MPLS network. As far as the VRs are concerned, this LSP tunnel is a single hop to its peer. This label is referred to as the peer label or nested tunnel label.

[0029] The peer labels may be the only ones that are exchanged between VRs, but this is not a requirement. Extra labels may be exchanged for encapsulating different classes of traffic destined for different VRs.

[0030] As a result of routing exchanges between peer VRs and between VRs and private network routers, as appropriate, each VR will build a forwarding table that relates private network address prefixes (forward equivalency classes) to next hop. The next hop could be stored as the IP addresses of the end points the nested LSP tunnel to be used, or it could just be the tunnel labels (both levels). As illustrated in FIG. 3, when IP packets arrive whose next hop is a VBR 10, the forwarding process pushes first the label 40 for the peer VR (the nested tunnel label). Then the base label 50, for the first hop of the base network LSP that leads to the VBR 10, is pushed onto the packet. The doubly labeled packet is then forwarded to the next LSR in the base network LSP. When the packet arrives at the destination VBR 10 the outermost label 50 may have changed several times, but the nested label 40 has not changed. As the label stack is popped, the nested label 40 is used to direct the packet to the correct VR.

[0031] It will thus be seen that the invention efficiently attains the objects set forth above, among those made apparent from the preceding description. In particular, the invention provides a virtual private network and methods of configuring the same over a MPLS shared network. Those skilled in the art will appreciate that the configuration depicted in FIGS. 1-3 discloses a shared MPLS network which allows the implementation of separate networks over common infrastructure while providing security, scalability and performance to each network.

[0032] It will be understood that changes may be made in the above construction and in the foregoing sequences of operation without departing from the scope of the invention. It is accordingly intended that all matter contained in the above description or shown in the accompanying drawings be interpreted as illustrative rather than in a limiting sense.

[0033] It is also to be understood that the following claims are intended to cover all of the generic and specific features of the invention as described herein, and all statements of the scope of the invention which, as a matter of language, might be said to fall therebetween.