Split control plane for private mobile network
A method for implementing a software-defined private mobile network (SD-PMN) for an entity includes, at a physical location of the entity, deploying a first set of control plane components for the SD-PMN, the first set of control plane components including a security gateway, a user-plane function (UPF), an AMF (access and mobility management function), and an SMF (session management function). At an SD-WAN (software-defined wide area network) PoP (point of presence) belonging to a provider of the SD-PMN, the method further includes deploying a second set of control plane components for the SD-PMN that includes a subscriber database that stores data associated with users of the SD-PMN. The method uses an SD-WAN edge router located at the physical location of the entity and a SD-WAN gateway located at the SD-WAN POP to establish a connection from the physical location of the entity to the SD-WAN PoP.
1 . A method for implementing a software-defined private mobile network (SD-PMN) for an entity using a split control plane, the method comprising:
at a physical location of the entity, configuring a first set of control plane components for the SD-PMN, the first set of control plane components comprising a security gateway, a user-plane function (UPF), an AMF (access and mobility management function), and an SMF (session management function); and
at an SD-WAN (software-defined wide area network) PoP (point of presence) belonging to a provider of the SD-PMN, configuring a second set of control plane components for the SD-PMN, the second set of control plane components comprising a subscriber database that stores data associated with users of the SD-PMN, the SD-WAN POP disposed at a location separate from the physical location of the entity,
wherein the first set of control plane components and the second set of control plane components operate together to provide control plane functionality for the SD-PMN, and
wherein the method further comprises:
receiving, by an access node at the location of the entity, an access request from a user device;
sending, by the AMF of the first set of control plane components at the location of the entity, an authentication request to the subscriber database of the second set of control plane components at the location of the SD-WAN POP; and
receiving, by the AMF in response to sending the authentication request, a reply from the subscriber database, the reply indicating one of (i) that the user device is authorized to use the network or (ii) that the user device is not authorized to use the network.
2 . The method of claim 1 further comprising configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP for control plane communication between the CP components at the entity's physical location and at the POP.
3 . The method of claim 1 further comprising configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP for forwarding data plane communications between the entity's physical location and components of the SD-PMN outside of the entity's physical location.
4 . The method of claim 1 further comprising configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP to establish a connection from the physical location of the entity to the SD-WAN PoP.
5 . The method of claim 1 , wherein configuring the security gateway at the physical location of the entity comprises configuring the security gateway to establish security tunnel between the security gateway and each access point in a set of access points deployed in the physical location.
6 . The method of claim 5 , wherein the set of access points provide a connection between a plurality of user devices operating in the physical location and the SD-PMN.
7 . The method of claim 1 further comprising configuring an SD-WAN edge router located at the physical location of the entity to use multiple physical network links to access destinations external to the physical location.
8 . The method of claim 7 , wherein configuring the SD-WAN edge router comprises configuring the SD-WAN edge router to perform a multi-link optimization process to establish a secure tunnel between the SD-WAN edge router and the SD-WAN gateway at the SD-WAN POP to use to send data messages between the SD-WAN edge router and the SD-WAN gateway.
9 . The method of claim 8 , wherein configuring the SD-WAN edge router further comprises:
configuring the SD-WAN edge router (i) to periodically perform uni-direction performance metric measurements using probe packets to collect a set of performance metrics associated with the secure tunnel, and (ii) to periodically communicate the collected set of performance metrics to the SD-WAN gateway; and
configuring the SD-WAN gateway (i) to periodically perform uni-direction performance metric measurements using probe packets to collect a set of performance metrics associated with the secure tunnel, and (ii) to periodically communicate the collected set of performance metrics to the SD-WAN edge router.
10 . The method of claim 1 further comprising configuring an SD-WAN edge router located at the physical location of the entity (i) to communicate with a SD-WAN router located at the SD-WAN PoP to establish a connection from the physical location of the entity to the SD-WAN POP, and (ii) to utilize a DMPO-like (dynamic multipath optimization) process in communication with the SD-WAN router located at the SD-WAN POP.
11 . The method of claim 1 , wherein:
the physical location of the entity is one of a plurality of physical locations of the entity;
at least one SD-WAN edge router is deployed at each physical location in the plurality of physical locations of the entity;
the SD-WAN POP is one of a plurality of SD-WAN PoPs belonging to the SD-PMN provider; and
each SD-WAN POP in the plurality of SD-WAN PoPs is connected to the SD-PMN by a respective SD-WAN gateway deployed to the SD-WAN POP.
12 . The method of claim 11 , wherein each SD-WAN POP in the plurality of SD-WAN PoPs includes a same set of network elements, the same set of network elements comprising at least the subscriber database that stores data associated with users of the SD-PMN.
13 . The method of claim 12 , wherein:
each SD-WAN edge router in the plurality of SD-WAN edge routers is assigned at least a primary SD-WAN gateway associated with a first SD-WAN POP and a secondary SD-WAN gateway associated with a second SD-WAN POP; and
the same set of network elements share a same set of common IP (Internet protocol) addresses across the plurality of SD-WAN PoPs including the first and second SD-WAN PoPs.
14 . The method of claim 11 , wherein:
each SD-WAN edge router at each physical location in the plurality of physical locations connects to each other SD-WAN edge router at each other physical location in the plurality of locations; and
each SD-WAN gateway at each SD-WAN Pop in the plurality of SD-WAN PoPs connects to (i) each SD-WAN edge router at each physical location in the plurality of physical locations and (ii) at least one external network.
15 . The method of claim 1 , wherein:
the SD-PMN is a multi-tenant SD-PMN;
the particular entity is a first entity in a plurality of entities for which the SD-PMN provides services; and
the subscriber database stores data associated with multiple tenant entities serviced by the SD-PMN provider.
16 . The method of claim 1 , wherein the SD-WAN POP further comprises a single-pass service chain for performing one or more sets of services on data messages sent to and from the SD-WAN POP, wherein at least one set of services in the one or more sets of services comprises a set of SASE (secure access service edge) services.
17 . A non-transitory machine readable medium storing a program for executing by a set of processing units, the program for implementing a software-defined private mobile network (SD-PMN) for an entity using a split control plane, the program comprising sets of instructions for:
at a physical location of the entity, configuring a first set of control plane components for the SD-PMN, the first set of control plane components comprising a security gateway, a user-plane function (UPF), an AMF (access and mobility management function), and an SMF (session management function);
at an SD-WAN (software-defined wide area network) PoP (point of presence) belonging to a provider of the SD-PMN, configuring a second set of control plane components for the SD-PMN, the second set of control plane components comprising a subscriber database that stores data associated with users of the SD-PMN, the SD-WAN POP disposed at a location separate from the physical location of the entity,
wherein the first set of control plane components and the second set of control plane components operate together to provide control plane functionality for the SD-PMN, and
wherein the sets of instructions are further for:
receiving, by an access node at the location of the entity, an access request from a user device;
sending, by the AMF of the first set of control plane components at the location of the entity, an authentication request to the subscriber database of the second set of control plane components at the location of the SD-WAN POP; and
receiving, by the AMF in response to sending the authentication request, a reply from the subscriber database, the reply indicating one of (i) that the user device is authorized to use the network or (ii) that the user device is not authorized to use the network.
18 . The non-transitory machine readable medium of claim 17 further comprising a set of instructions for configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP for control plane communication between the CP components at the entity's physical location and at the PoP.
19 . The non-transitory machine readable medium of claim 17 further comprising a set of instructions for configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP for forwarding data plane communications between the entity's physical location and components of the SD-PMN outside of the entity's physical location.
20 . The non-transitory machine readable medium of claim 17 further comprising a set of instructions for configuring an SD-WAN edge router located at the physical location of the entity to communicate with a SD-WAN router located at the SD-WAN POP to establish a connection from the physical location of the entity to the SD-WAN PoP.