Method and apparatus for supporting multiple customer provisioned IPSec VPNs
View Patent ↗Customer Traffic may be segregated using customer provisioned IPSec VPNs implemented using group security association for IPSec tunnels, by causing the CE network element to implement multiple VRFs for the several VPNs, each of which may be used for a different segment of the customer's traffic. The CE network element may implement a single MPBGP peering session with the GCKS/RR for all VPNs, and may establish secure data channels for each of the VPNs based on the group security associations for each of the VPNs. Although a common MPBGP peering session may be used, routing information for the several VRFs may be separated by applying per-VRF import policies at the CE, so that each VPN only has access to routes intended to be advertised to that VPN.
1. A method of supporting multiple customer provisioned Virtual Private Networks (VPNs) in a scalable manner, the method comprising the steps of:
instantiating, by a Customer Edge (CE) network element, a Virtual Routing and Forwarding (VRF) process for each of the customer provisioned VPNs to be supported by the CE network element;
establishing, by the CE network element, a separate Internet Protocol Security (IPSec) secure data channel for each VPN to be supported, by obtaining a shared group security association for each VPN from a Group Controller Key Server (GCKS); and
instantiating, by the CE network element, a Network Routing Engine (NRE) process configured to interact with the VRF processes, the NRE process maintaining an interface table containing a mapping between VRF name and interface ID for each of the secure control channels, secure data channels, and local interfaces.
2. The method of claim 1 , further comprising the step of establishing, by the CE network element, a secure control channel with a route reflector associated with the GCKS, said secure control channel being configured to carry routing information between CE and the route reflector for the multiple VRF processes instantiated on the CE.
3. The method of claim 1 , wherein each of the VPNs supported by the CE network element are associated with one Local Area Network.
4. The method of claim 1 , wherein each VRF process is configured to apply its own route import policy to create a per-VRF routing table.
5. The method of claim 4 , wherein the per-VRF routing tables comprise tables correlate route information with interface next hop values.
6. The method of claim 5 , wherein the per-VRF routing tables are different for the several VPNs.
7. The method of claim 1 , wherein each VRF process is configured to program routes into a forwarding plane of the CE to enable the CE to use the routes in connection with traffic for the VPN associated with the VRF.
8. The method of claim 1 , wherein the NRE process is further configured to selectively leaking routes between VRFs.
9. A network, comprising:
a plurality of CE network elements interconnected by a provider network, at least some of the CE network elements being connected to more than one Virtual Private Network (VPN) site, the CE network elements implementing a separate Virtual Routing and Forwarding (VRF) process for each VPN site to which they are attached and implementing a separate Internet Protocol Security (IPSec) secure data channel for each VPN site to which they are attached;
a GCKS accessible over the provider network and configured to provide group security associations to the CE network elements for use in creation of the secure data channels; and
a route reflector accessible over the provider network and configured to perform route reflection on secure control channels between the route reflector and the CE network elements;
wherein the CE network elements are each configured to use one of the secure control channels to transmit routing information for each of the VRFs implemented on that CE network element,
wherein the CE network elements instantiate Network Routing Engine (NRE) processes configured to interact with the VRF processes, each NRE process maintaining an interface table containing a mapping between VRF name and interface ID for each of the secure control channels, secure data channels, and local interfaces.
10. A Customer Edge (CE) network element, comprising:
a data plane configured to forward data traffic on a communication network; and
a control plane configured to control a manner in which the data plane is configured to forward traffic on the communication network, the control plane containing at least one processor containing control logic that is configured to:
instantiate a plurality of Virtual Routing and Forwarding (VRF) process, each of the VRF processes being associated with a separate Virtual Private Network (VPN);
establish a separate Internet Protocol Security (IPSec) secure data channel for each VRF process using a group security association for the VPN associated with the VRF;
establish a secure control channel for use by all VRF processes between the CE and a routing peering point; and
instantiate, by the CE network element, a Network Routing Engine (NRE) process configured to interact with the VRF processes, the NRE process maintaining an interface table containing a mapping between VRF name and interface ID for each of the secure control channels, secure data channels, and local interfaces.
11. The CE network element of claim 10 , wherein the control logic is configured to receive the group security association for each VPN from a Group Controller Key Server (GCKS).
12. The CE network element of claim 10 , wherein the routing peering point is a route reflector.
13. The CE network element of claim 12 , wherein the route reflector is associated with the GCKS.
14. The CE network element of claim 12 , wherein the secure control channel is configured to carry routing information between the CE and the route reflector for the multiple VRF processes instantiated on the CE.