Method and apparatus for implementing L2 VPNs on an IP network
View Patent ↗MP-BGP VPN infrastructure based on IETF RFC 4364/2547 is used to configure a layer 2 VPN on an IP network. VRFs for the VPN are configured on Ethernet switches and service IP addresses are associated with each configured VRF. The service IP addresses are exchanged to enable VPN traffic to be encapsulated for transport over the IP network. To enable a L2 VPN to be established on the network, a VPN-VLAN ID will be configured for the L2 VPN and import/export route targets for the VPN-VLAN will be set in each VRF and UNI-VLAN that is part of the VPN. The VPN-VLAN will be announced to all PEs using MP-iBGP with export route targets set for this VPN-VLAN. The PE's control plane learns the VPN-VLAN on a logical port if the import RT matches the export RT received by the MP-iBGP control plane. Once the VPN-VLAN is learned on a logical port, the PE will perform MAC learning on that logical port and treat the logical port as if it were part of the L2 VLAN.
1. A method of implementing a Layer 2 (L2) Virtual Private Network Virtual Local Area Network (VPN-VLAN) on a routed network, the method comprising the steps of:
configuring a Virtual Routing and Forwarding (VRF) process in a network element on the routed network, the VRF process being associated with the VPN-VLAN on the routed network and having a service Internet Protocol (IP) address, the VPN-VLAN having a VPN-VLAN identifier (VPN-VLAN ID) on the routed network;
learning, by the VRF process, one or more User-to-Network Interface Virtual Local Area Networks (UNI-VLANs) on one or more physical ports of the network element and associating, by the VRF process, the one or more UNI-VLANs with the VPN-VLAN on the routed network;
learning, by the VRF process, the VPN-VLAN ID on one or more logical ports of the network element, each of the logical ports being associated with a service IP address of another VRF process on another network element on the routed network.
2. The method of claim 1 , further comprising the step of performing MAC learning on the one or more logical ports of the network element associated with the VPN-VLAN.
3. The method of claim 2 , wherein the step of performing MAC learning on the one or more logical ports of the network element comprises the step of storing MAC addresses learned on the one or more logical ports along with forwarding information for the logical port in a forwarding database, the forwarding information for the logical port including the VPN-VLAN ID and the service IP address of the VRF process associated with the logical port.
4. The method of claim 3 , further comprising the steps of receiving a frame to be transmitted on the logical port and receiving, from the forwarding database, the VPN-VLAN ID and service IP address of the logical port to be used to transmit the frame on the routed network.
5. The method of claim 4 , further comprising the steps of adding the received VPN-VLAN ID to the frame as a Q-tag and adding an IP header using the received service IP address as a destination IP address.
6. The method of claim 5 , wherein when the frame is not tagged with a customer Q-tag, the Q-tag is added as a first tag to the frame.
7. The method of claim 5 , wherein when the frame is tagged with a customer Q-tag, the step of adding the VPN-VLAN ID to the frame as the Q-tag comprises replacing the customer Q-tag with the Q-tag containing the VPN-VLAN ID.
8. The method of claim 5 , wherein when the frame is tagged with a customer Q-tag, the step of adding the VPN-VLAN ID to the frame as the Q-tag comprises adding another Q-tag to the frame, the added Q tag containing the VPN-VLAN ID.
9. The method of claim 1 , further comprising the steps of receiving a frame from the UNI-VLAN on a physical port of the one or more physical ports addressed to an unknown MAC address, and flooding the frame out all other physical ports associated with the UNI-VLAN and out all logical ports associated with the VPN-VLAN.
10. The method of claim 1 , further comprising the steps of receiving a frame from the VPN-VLAN on a logical port of the one or more logical ports addressed to an unknown MAC address, and flooding the frame on the one or more UNI-VLANs associated with the VPN-VLAN.
11. The method of claim 1 , further comprising receiving an IP packet by the network element, using a destination address in an IP header associated with the IP packet to determine a VRF process to be used to process the IP packet, and reading, by the determined VRF process, a Q-tag associated with the IP packet to determine a VPN-VLAN associated with the packet.
12. The method of claim 1 , wherein the step of configuring the VRF process comprises setting an import/export Route Target (RT) for the VPN-VLAN ID in the VRF process.
13. The method of claim 12 , further comprising the step of announcing, using MultiProtocol Border Gateway Protocol (MP-BGP), the VPN-VLAN to all Provider Edge (PE) network elements that have an export RT configured for the VPN-VLAN.
14. The method of claim 12 , further comprising the step of receiving a MultiProtocol Border Gateway Protocol (MP-BGP) control message and learning the VPN-VLAN on a logical port if an import RT on the logical port matches an export RT in the MP-BGP control message.
15. A method of processing a frame for transmission on an Internet Protocol (IP) network by a Provider Edge (PE) network element, the method including the steps of:
receiving, by the PE network element, a frame from a User to Network Interface Virtual Local Area Network (UNI-VLAN), the UNI-VLAN being associated with a Layer 2 Virtual Private Network Virtual Local Area Network (VPN-VLAN) spanning the IP network;
tagging the frame with a Q-tag containing a VPN-VLAN Identifier (VPN-VLAN ID) of the VPN-VLAN on the IP network;
encapsulating the frame with an IP header containing, as a destination address, a service IP address of a Virtual Routing and Forwarding (VRF) process on a remote Provider Edge (PE) network element on the IP network; and
transmitting the tagged and encapsulated frame onto the IP network.
16. A method of claim 15 , wherein the PE network element has a VRF process instantiated therein.
17. A method of processing a frame for transmission on an Internet Protocol (IP) network by a Provider Edge (PE) network element, the method including the steps of:
receiving, by the PE network element, a frame from a User to Network Interface Virtual Local Area Network (UNI-VLAN), the UNI-VLAN being associated with a Layer 2 Virtual Private Network (L2VPN) spanning the IP network, the PE network element including a L2VPN process to be used to process frames associated with the L2VPN, the L2VPN process being represented into the IP network via a first service IP address;
determining a logical port of the PE network element associated with the received frame, the logical port including a second service IP address of a L2VPN process on a remote PE network element;
IP encapsulating the frame with an IP header, the IP header containing the first service IP address as the source IP address and the second service IP address as the destination IP address; and
transmitting the IP encapsulated frame onto the IP network.
18. The method of claim 17 , further comprising the steps of:
receiving, by the PE network element, a second IP encapsulated frame having a second IP header, the second IP header including a second destination IP address;
reading the second destination IP address to determine a local L2VPN process on the PE network element; and
passing the frame to the determined local L2VPN process to enable the frame to be switched in the context of the determined local L2VPN process.
19. The method of claim 18 , wherein the second IP header includes a second IP source address, the method further comprising the step of performing MAC learning against the second IP source address to learn a MAC address of an inner L2 packet.