Methods, apparatus and data structures for preserving address and service level information in a virtual private network

Abstract

Supporting virtual private networks by using a new layer 3 address to encapsulate a network-bound packet so that its context information, from which a layer 2 (e.g., MAC) address can be derived, is preserved. If this encapsulation was not done, the layer 2 address would change over each segment of the network. Thus, the encapsulation preserves the concept of group identification, using at least a part of the context, over the entire network and not just at the edge of the network. If a packet is received from the network (to be forwarded to a customer), the layer 3 address that was added in the encapsulation is stripped off. The original layer 3 destination address may be used with a client device addressing table to determine a new context information, and a layer 2 (e.g., MAC) address of a destination client device. If the client device addressing table does not include entries corresponding to the layer 3 destination address, an address resolution protocol (or “ARP”) may be broadcast to request such information or contents of inbound packets may be observed (snooping). The packet may then be forwarded to an aggregation device.

1 - 18 . (canceled)  
     
     
         19 . A method comprising: 
 receiving a packet originated by a source system via an ingress port, the packet including a destination layer  3  address and a layer  2  header portion;    retrieving context information from the layer  2  header portion of the packet, the context information corresponding to the ingress port and including a multicast indicator;    determining whether the packet is authorized for use of a multicast resource based on the multicast indicator;    allowing the packet to be forwarded to the destination layer  3  address when the packet is authorized.    
     
     
         20 . The method of  claim 19 , wherein the layer  2  header portion of the packet is an Ethernet header, and the destination layer  3  address is an Internet Protocol address.  
     
     
         21 . The method of  claim 19 , wherein the packet is an Internet Group Multicast Protocol (IGMP) packet.  
     
     
         22 . The method of  claim 19 , wherein the context information further includes a virtual private network (VPN) identifier associated with the ingress port.  
     
     
         23 . The method of  claim 19 , wherein the multicast indicator identifies a multicast access control list group.  
     
     
         24 . A processor-readable medium storing instructions executable by a processor and configured to perform the method of  claim 19  when executed by the processor.  
     
     
         25 . A method comprising: 
 receiving a packet originating from a source system over a first communications link at a first physical port, the packet including a layer  2  header;    determining a logical port associated with the first physical port;    determining context information associated with the logical port, the context information including a unique bit string;    replacing at least a portion of the layer  2  header with the context information;    determining a second physical port connected to a second communication link;    transmitting the packet via the second physical port.    
     
     
         26 . The method of  claim 25 , wherein the layer  2  header is an Ethernet header.  
     
     
         27 . The method of  claim 25 , wherein the unique bit string is a virtual private network identifier.  
     
     
         28 . The method of  claim 25 , wherein the second communication link is a higher bandwidth link than the first communication link, and transmitting the packet via the second physical port includes aggregating the packet with other packets originating from other source systems.  
     
     
         29 . A processor-readable medium storing instructions executable by a processor and configured to perform the method of  claim 25  when executed by the processor.  
     
     
         30 . A system comprising: 
 a plurality of first physical port devices;    a plurality of second physical port devices;    a processing system coupled to the plurality of first physical port devices and the plurality of second physical port devices, the processing system including 
 a first table storing port mapping information associating individual ones of the plurality of first physical port devices to individual ones of a plurality of logical port identifiers,  
 a second table storing logical port information associated with individual ones of the plurality of logical port identifiers,  
   wherein the processing system is configured to determine one of the logical port identifiers associated with a physical port via which a packet originated by a source system is received, modify a level  2  header portion of the packet to include a unique bit string based on the logical port information associated with the determined logical port identifier, and to cause the transmission of the packet via one of the plurality of second physical port devices.    
     
     
         31 . The system of  claim 30 , wherein the layer  2  header is an Ethernet header.  
     
     
         32 . The system of  claim 30 , wherein the unique bit string is a virtual private network identifier.  
     
     
         33 . The system of  claim 30 , wherein the plurality of first physical port devices are each connected to a respective one of a plurality of first communications links, wherein the plurality of second physical ports are each connected to a respective one of a plurality of second communications links, and wherein each of the plurality of second communication links is a higher bandwidth link than each of the plurality of first communication links.  
     
     
         34 . The system of  claim 33 , wherein transmitting the packet via one of the plurality of second physical port devices includes aggregating the packet with other packets originating from other source systems.