Automated instantiation of wireless virtual private networks
A wireless virtual private network (VPN) connection may be automatically instantiated from a wireless VPN client device using a VPN instantiation server. The VPN client device may automatically connect to the VPN instantiation server to obtain client configuration information for a VPN connection to a VPN endpoint server. The VPN instantiation server may instantiate the VPN endpoint server using a network function virtualization (NFV) platform. Then, the VPN client may establish a layer 2 tunnel across a wireless network to the VPN endpoint server.
1. A method for instantiating virtual private networks, the method comprising:
receiving, at a virtual private network (VPN) instantiation server from a VPN client, an indication that the VPN client has established a wireless network connection;
sending client configuration information to the VPN client to enable the VPN client to instantiate a VPN connection with a VPN endpoint server, the client information including an authentication key to establish a security tunnel between the VPN client and a metropolitan area network (MAN), a tunnel identifier to establish a layer 2 tunnel, a session identifier to establish a session in the layer 2 tunnel, and termination endpoint information for the MAN;
sending server configuration information including the authentication key, the tunnel identifier, the session identifier, and the termination endpoint information for the MAN to a network function virtualization (NFV) platform, the server configuration information usable by the NFV platform to instantiate the VPN endpoint server, wherein the VPN endpoint server has non-wireless access to the MAN, and wherein the VPN endpoint server is enabled for:
establishing the security tunnel with the VPN client,
establishing the layer 2 tunnel with the VPN client within the security tunnel, and
using the layer 2 tunnel and the wireless network connection, establishing the VPN connection to the MAN for the VPN client; and
managing a plurality of termination endpoints for a plurality of independent VPN connections provided to a plurality of VPN clients by allocating computational resources in the VPN endpoint server for routing functions for each new instance of a connected VPN client.
2. The method of claim 1 , wherein the MAN is a metro Ethernet.
3. The method of claim 2 , wherein the security tunnel is an Internet-protocol security tunnel, and wherein the layer 2 tunnel utilizes a layer 2 tunneling protocol.
4. The method of claim 1 , wherein sending the client configuration information to the VPN client further comprises:
sending the client configuration information via the wireless network connection.
5. The method of claim 1 , wherein the VPN endpoint server has non-wireless access to a wireless network providing the wireless network connection.
6. The method of claim 1 , wherein the wireless network is selected from at least one of: a long-term evolution network; and an IEEE 802.11 network.
7. A non-transitory computer readable memory media storing instructions executable by a processor to instantiate virtual private networks, the instructions comprising instructions to:
receive, at a virtual private network (VPN) instantiation server from a VPN client, an indication that the VPN client has established a wireless network connection;
send client configuration information to the VPN client to enable the VPN client to instantiate a VPN connection with a VPN endpoint server, the client information including an authentication key to establish a security tunnel between the VPN client and a metropolitan area network (MAN), a tunnel identifier to establish a layer 2 tunnel, a session identifier to establish a session in the layer 2 tunnel, and termination endpoint information for the MAN;
send server configuration information including the authentication key, the tunnel identifier, the session identifier, and the termination endpoint information for the MAN to a network function virtualization (NFV) platform, the server configuration information usable by the NFV platform to instantiate the VPN endpoint server, wherein the VPN endpoint server has non-wireless access to the MAN, and wherein the VPN endpoint server is enabled for:
establishing the security tunnel with the VPN client,
establishing the layer 2 tunnel with the VPN client within the security tunnel, and
using the layer 2 tunnel and the wireless network connection, establishing the VPN connection to the MAN for the VPN client; and
manage a plurality of termination endpoints for a plurality of independent VPN connections provided to a plurality of VPN clients by allocating computational resources in the VPN endpoint server for routing functions for each new instance of a connected VPN client.
8. The memory media of claim 7 , wherein the security tunnel is an Internet-protocol security tunnel, and wherein the layer 2 tunnel utilizes a layer 2 tunneling protocol.
9. The memory media of claim 7 , wherein the instructions to send the client configuration information to the VPN client further comprise instructions to:
send the client configuration information via the wireless network connection.
10. The memory media of claim 7 , wherein the VPN endpoint server has non-wireless access to a wireless network providing the wireless network connection.
11. The method of claim 1 , wherein the termination endpoint information for the MAN is a network address or a virtual local area network (VLAN) tag for a VLAN utilized to guide traffic from the MAN to the VPN client.
12. The memory media of claim 7 , wherein the termination endpoint information for the MAN is a network address or a virtual local area network (VLAN) tag for a VLAN utilized to guide traffic from the MAN to the VPN client.
13. The memory media of claim 7 , wherein the MAN is a metro Ethernet.
14. The memory media of claim 7 , wherein the wireless network is selected from at least one of: a long-term evolution network; and an IEEE 802.11 network.