Gateway shared by multiple virtual private networks
View Patent ↗A VPN gateway for interfacing two or more VPNs to external networks such as the internet or a PSTN having different addressing schemes, has a NAT shared by the VPNs for converting VPN addresses to addresses of the external network. An advantage of this is reduced number of additional network elements, e.g. boxes, and fewer additional addresses. The NAT can be a source and destination NAT, arranged such that entities in the external networks appear to have an address within an address range of the respective VPN. Thus, entities in the external resource can appear as trusted resources inside the VPN. The gateway can incorporate a converter for converting between formats such as VoIP packets and TDM calls.
1. Virtual private network (VPN) gateway apparatus comprising a control processor to interface two or more virtual private networks (VPNs) to one or more external networks, the external network or networks having a different addressing scheme or schemes to those of the VPNs, the VPN gateway apparatus having a network address translator (NAT) shared by the VPNs, the NAT comprising a source and destination NAT, to convert VPN addresses of entities within the VPNs to addresses of the external network and to convert addresses of entities in the external network to internal addresses within an address range of a respective VPN wherein entities in the external networks appear to one of the VPNs to have an address within an address range of the respective VPN, the NAT being arranged to modify source and destination addresses for outgoing packets and pass the packets to an entity in the external network and to reconvert the modified addresses for incoming packets received in response.
2. The VPN gateway apparatus of claim 1 , the entities in the external networks comprising at least one of: a call server, a SIP proxy, a web server, a storage server, a video server, a mail server, an H.323 gateway, a telephony client, or a telephony media gateway.
3. The VPN gateway apparatus of claim 1 , the external network address used for each VPN entity being unique in the corresponding external network.
4. The VPN gateway apparatus of claim 1 having one or more physical or logical interface ports, and being arranged to determine an identity of each of the VPNs based on which one or more physical or logical interface port on the VPN gateway is used to couple the respective VPN.
5. The VPN gateway apparatus of claim 1 , the VPNs each comprising a part of an Internet Protocol (IP) network.
6. The VPN gateway apparatus of claim 5 where the multiple VPNs use overlapping private IP addressing schemes.
7. The VPN gateway apparatus of claim 5 , being arranged to provide protocol conversion.
8. The VPN gateway apparatus of claim 1 , the VPNs being arranged to use at least one of ATM, Frame Relay, MPLS or IP.
9. The VPN gateway apparatus of claim 1 arranged to couple communication sessions having one end in one of the VPNs and another end in the external network, the sessions being controlled by a server.
10. The VPN gateway apparatus of claim 9 , the communication sessions being one of data sessions, telephony calls, or video calls.
11. The VPN gateway apparatus of claim 9 , arranged to communicate to the external network entities the VPN identity associated with a given communication session.
12. A method of operating virtual private network (VPN) gateway apparatus, the method comprising: interfacing two or more VPNs to one or more external networks, the external network or networks having different addressing schemes to those of the VPNs, the VPN gateway apparatus having a network address translator (NAT) shared by the VPNs, the NAT comprising a source and destination NAT, to convert VPN addresses of entities within the VPNs to addresses of the external network and to convert addresses of entities in the external network to internal addresses within an address range of a respective VPN, using the VPN gateway apparatus to pass information between the two or more VPNs and the one or more external networks, including modifying source and destination addresses for outgoing packets and passing the packets to an entity in the external network and reconverting the modified addresses for incoming packets received in response wherein entities in the external networks appear to one of the VPNs to have an address within an address range of the respective VPN.