Verification of configuration information in BGP VPNs
View Patent ↗Described are mechanisms for verifying configuration information in 2547 BGP VPNs. An originating PE generates a first knowledge digest encoding first configuration information associated with a current set of information advertised for a VRF. The originating PE also generates a second knowledge digest encoding second configuration information associated with cumulative information advertised for the VRF. The originating PE is capable of receiving a message from a user PE, the message including a third knowledge digest encoding third configuration information related to the user VRF. The originating PE is capable of comparing the first knowledge digest to the third knowledge digest and producing a first indication if the third configuration information encoded in the third knowledge digest is not a subset of the first configuration information encoded in the first knowledge digest.
1. A method of verifying configuration information in a virtual private network (VPN), the VPN using border gateway protocol (BGP), the method comprising:
generating a first knowledge digest encoding first configuration information associated with a current set of information advertised for a provider edge device, the current set of information comprising at least one forwarding table entry associated with the provider edge device;
generating a second knowledge digest encoding second configuration information associated with cumulative information advertised for the provider edge device over a period of time, wherein the cumulative information comprises at least one forwarding table entry additional to the current set of information; receiving a third knowledge digest encoding third configuration information; and comparing the first knowledge digest to the third knowledge digest to determine whether the configuration information encoded in the third knowledge digest is a subset of the configuration information encoded in the first knowledge digest.
2. The method of claim 1 , wherein the provider edge device comprises a virtual routing and forwarding engine.
3. The method of claim 1 , further comprising:
when the configuration information encoded in the third knowledge digest is not a subset of the configuration information encoded in the first knowledge digest, comparing the second knowledge digest to the third knowledge digest; and
producing an error indication when the configuration information encoded in the third knowledge digest is not a subset of the configuration information encode in the first knowledge digest.
4. The method of claim 3 , further comprising:
producing a first indication when the configuration information encoded in the third knowledge digest is not a subset of the configuration information encoded in the first knowledge digest; and
comparing the second knowledge digest to the third knowledge digest responsive to the first indication.
5. The method of claim 3 , wherein:
the first and second knowledge digests are generated at an originating network element;
the third knowledge digest is received at the originating network element;
the first and third knowledge digests are compared at the originating network element;
the second and third knowledge digests are compared at the originating network element; and
the error indication is produced at the originating provider network element.
6. The method of claim 5 , wherein the third knowledge digest is received at the originating network element from a user network element.
7. The method of claim 6 , comprising sending the third knowledge digest from the user network element to the originating network element.
8. The method of claim 6 , wherein the user network element comprises a user provider edge device.
9. The method of claim 5 , wherein the originating network element comprises an originating provider edge device.
10. The method of claim 3 , wherein the VPN is compliant with IETF RFC 2547.
11. The method of claim 1 , wherein at least one of the first, second and third knowledge digests is a fixed length bit array.
12. The method of claim 11 , wherein all of the first, second and third knowledge digests are fixed length bit arrays.
13. The method of claim 1 , wherein at least one of the first, second and third knowledge digests are bloom filters.
14. The method of claim 13 , wherein all of the first, second and third knowledge digests are bloom filters.
15. The method of claim 1 , wherein:
the first and second knowledge digests are generated at an originating network element;
the third knowledge digest is received at the originating network element; and
the first and third knowledge digests are compared at the originating network element.
16. The method of claim 15 , wherein the third knowledge digest is received at the originating network element from a user network element.
17. The method of claim 16 , comprising sending the third knowledge digest from the user network element to the originating network element.
18. The method of claim 16 , wherein the user network element comprises a user provider edge device.
19. The method of claim 15 , wherein the originating network element comprises an originating provider edge device.
20. The method of claim 1 , wherein the VPN is compliant with IETF RFC 2547.