Method and apparatus for learning endpoint addresses of IPSec VPN tunnels
Customer Edge (CE) network elements can automatically learn IPSec tunnel endpoints for other CEs connected to sites in a Virtual Private Network (VPN) so that manual configuration of IPSec tunnel endpoints is not required and so that a centralized database of IPSec tunnel endpoints is not required to be separately maintained. According to an embodiment of the invention, a BGP export route policy is set on all CEs, so that when they announce their VPN routes in the standard format, the application of this export route policy changes the announcement to replace the BGP peering point address that would ordinarily be advertised with the IPSec tunnel endpoint address. When any given site receives a VPN route update formatted in this manner, it processes the VPN route update and learns from the update the IPSec tunnel endpoint as well as the associated VPN routes.
1. A method of communicating an endpoint address of an Internet Protocol Security (IPSec) Virtual Private Network (VPN) tunnel by a Customer Edge (CE) network element implementing a Multiprotocol Border Gateway Protocol (MPBGP) peering session with another CE network element, the method comprising the steps of:
receiving route information comprising a route distinguisher:ip-prefix, a peering point address of the MPBGP peering session, and the route target;
formatting, by the CE network element, a MPBGP route advertisement to include the route distinguisher:ip-prefix, an endpoint address of an IPSec VPN tunnel, and the route target; and
transmitting the MPBGP route advertisement over the MPBGP peering session to the other CE network element; and
wherein the step of formatting comprises replacing the peering point address of the MPBGP peering session with the endpoint address of the IPSec VPN tunnel; and
wherein the peering point address and the endpoint address of the IPSec VPN tunnel are different addresses on the CE network element.
2. The method of claim 1 , wherein the endpoint address of the IPSec VPN tunnel is an IP address for an IPSec tunnel terminating at the CE network address other than an MPBGP peering point address for the CE network element.
3. The method of claim 1 , wherein the route distinguisher:ip-prefix identifies the route, wherein the route target identifies a VPN with which the route is associated.
4. The method of claim 1 , wherein the method further comprises causing the CE network element to segregate routes by implementing Virtual Routing and Forwarding processes (VRFs).
5. The method of claim 1 , wherein the MPBGP route advertisement is implemented as a data structure stored in a tangible computer readable medium, the MPBGP route advertisement comprising:
the route distinguisher:IP-prefix, the endpoint address of the IPSec VPN tunnel, and the route target, and
wherein the
IPSec VPN tunnel endpoint address of the IPSec VPN tunnel is inserted as a next hop attribute of the MPGBP route advertisement.
6. The method of claim 5 , wherein the route target identifies a VPN associated with the route advertisement, and wherein the route distinguisher identifies a unique address within the enterprise for the case of overlapping IP addresses among VPNs.
7. The method of claim 6 , wherein the format of the route advertisement is <RD:prefix, VPN-nh, RT>, in which RD:prefix is the route distinguisher and ip prefix, VPN-nh is the IPSec VPN tunnel endpoint address, and RT is the route target.
8. The method of claim 6 , wherein the IPSec VPN tunnel endpoint address is a public address of a Customer Edge network element configured to implement the VPN tunnel on behalf of at least one VPN site.
9. A network, comprising:
a Group Controller Key Server (GCKS),
a plurality of Customer Edge (CE) network elements, each of the CE network elements having an established secure control channel between a Multiprotocol Border Gateway Protocol (MPBGP) routing peering endpoint address on the CE and a MPBGP routing peering endpoint address on the GCKS, each of the CE network elements also having at least one established secure data channel having a secure data channel endpoint address other than its MPBGP routing peering endpoint address;
wherein each of the CE network elements includes a routing table containing routing information correlating routes with the secure data channel endpoint addresses of the other CE network elements; and
wherein each of the CE network elements is configured to transmit MPBGP route advertisements including a route distinguisher:IP-prefix, its own secure data channel endpoint address, and a route target.
10. The network of claim 9 , wherein the CE network elements are all associated with an enterprise.
11. The network of claim 9 , wherein the secure data channels are formed using IPSec.
12. The network of claim 9 , wherein the secure data channels use a common key obtained from the GCKS.
13. The network of claim 9 , wherein a BGP route export policy is set on each of the CE network elements to change a MPBGP peering point address in route advertisements to be transmitted to the endpoint address of the IPSec VPN tunnel.
14. The network of claim 9 , wherein the MPBGP route advertisement is implemented as a data structure stored in a tangible computer readable medium, the MPBGP route advertisement comprising:
the route distinguisher:IP-prefix, the endpoint address of the IPSec VPN tunnel, and the route target, and
wherein the IPSec VPN tunnel endpoint address of the IPSec VPN tunnel is inserted as a next hop attribute of the MPGBP route advertisement.
15. The network of claim 14 , wherein the route target identifies a VPN associated with the route advertisement, and wherein the route distinguisher identifies a unique address within the enterprise for the case of overlapping IP addresses among VPNs.
16. The network of claim 15 , wherein the format of the route advertisement is <RD:prefix, VPN-nh, RT>, in which RD:prefix is the route distinguisher and ip prefix, VPN-nh is the IPSec VPN tunnel endpoint address, and RT is the route target.
17. The network of claim 15 , wherein the IPSec VPN tunnel endpoint address is a public address of a Customer Edge network element configured to implement the VPN tunnel on behalf of at least one VPN site.