Method and Apparatus for Specifying IP Termination in a Network Element

Abstract

IP applications may be hosted on processors other than the processor on which their associated routing entity is hosted by causing the routing context to be extended to the new processor and causing IP termination to occur at the new processor. Applications may define policies specifying packet attributes and actions to be taken on matching packets, so that packets matching the policy may be directed to a processor hosting the application rather than a processor hosting the routing entity. A steering policy manager may be implemented to receive policies from the applications, verify the policy format and uniqueness vis-à-vis previously implemented policies, and implement the policies by passing the policies to one or more steering policy agents. Filters may be programmed into the data plane or the control plane to cause IP termination to occur on the processor hosting the application.

1 - 19 . (canceled) 
     
     
         20 . A network system, comprising:
 VPN routing control logic configured to implement a Virtual Private Network (VPN) routing entity;   application control logic configured to implement an application process operable in the context of the VPN with access to packet flows over the VPN, the application process being configured to generate steering policies associated with packet flows; and   steering policy management control logic configured to receive steering policies generated by the application control logic and configured to pass steering policies to at least one steering policy agent, the steering policy agent being configured to enable packets in the packet flows to be affected by the policies, so that the application process associated with the VPN may obtain access to the packet flows over the VPN even though it is instantiated in the application control logic rather than being instantiated in the VPN routing control logic.   
     
     
         21 . A network system as defined in  claim 20 , wherein the VPN routing control logic, the application control logic and the steering policy management control logic are implemented in a single network element. 
     
     
         22 . A network system as defined in  claim 20 , wherein the VPN routing control logic and the application control logic are implemented on separate processors. 
     
     
         23 . A network system as defined in  claim 20 , wherein the policies each comprise:
 a header containing information usable to identify a policy;   attributes containing packet flow identification information usable to identify packets within a packet flow associated with the policy; and   action information specifying an action to be taken on packets in the packet flow associated with the policy.   
     
     
         24 . A network system as defined in  claim 20 , wherein the steering policy management control logic is configured to verify a format of the steering policies against a plurality of available formats. 
     
     
         25 . A network system as defined in  claim 20 , wherein the steering policy management control logic is configured to determine whether policies generated by the application process are unique with respect to packets associated with the routing entity by checking new steering policies against a steering policy verification tree containing policy information from previous policies. 
     
     
         26 . A network system as defined in  claim 20 , wherein the application control logic implements an IP application process operable in the context of the VPN with access to IP packet flows over the VPN, the application process being configured to generate steering policies associated with IP packet flows. 
     
     
         27 . A method of operating a network system, comprising:
 generating, in an application process operable in the context of a VPN, at least one steering policy associated with packet flows, the application process not being instantiated in VPN routing control logic configured to control the VPN but having access to packet flows over the VPN;   passing the policy to a steering policy agent; and   operating the steering policy agent to direct packets meeting the policy to the application process to enable packets in the packet flows to be affected by the policy.   
     
     
         28 . A method of operating a network system as defined in  claim 27 , wherein the VPN routing control logic, the application process and the steering policy agent are implemented in a single network element. 
     
     
         29 . A method of operating a network system as defined in  claim 27 , wherein the VPN routing control logic and the application process are implemented on separate processors. 
     
     
         30 . A method of operating a network system as defined in  claim 27 , wherein the at least one policy comprises:
 a header containing information usable to identify a policy;   attributes containing packet flow identification information usable to identify packets within a packet flow associated with the policy; and   action information specifying an action to be taken on packets in the packet flow associated with the policy.   
     
     
         31 . A method of operating a network system as defined in  claim 27 , wherein the steering policy agent is configured to verify a format of the steering policy against a plurality of available formats. 
     
     
         32 . A method of operating a network system as defined in  claim 27 , wherein the steering policy agent is configured to determine whether policies generated by the application process are unique with respect to packets associated with the routing control logic by checking new steering policies against a steering policy verification tree containing policy information from previous policies. 
     
     
         33 . A method of operating a network system as defined in  claim 27 , wherein the application process is an IP application process operable in the context of the VPN with access to IP packet flows over the VPN, the application process being configured to generate steering policies associated with IP packet flows.