US20110176552A1 - Managing interworking communications protocols - Google Patents
Managing interworking communications protocols Download PDFInfo
- Publication number
- US20110176552A1 US20110176552A1 US13/050,387 US201113050387A US2011176552A1 US 20110176552 A1 US20110176552 A1 US 20110176552A1 US 201113050387 A US201113050387 A US 201113050387A US 2011176552 A1 US2011176552 A1 US 2011176552A1
- Authority
- US
- United States
- Prior art keywords
- protocol
- service processing
- subscriber
- vpn
- service
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/18—Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
Definitions
- Embodiments of the present invention generally relate to computer network routers.
- embodiments of the present invention relate to systems and methods of managing interworking protocols for such routers.
- TCP Transmission Control Protocol
- IP Internet Protocol
- ATM Asynchronous Transfer Mode
- a service management system communicatively coupled with multiple service processing switches of a service provider provisions transport network interfaces of the service processing switches to provide a transport between subscriber interfaces of the service processing switches.
- the subscriber interfaces are configured to communicate data in accordance with a first protocol.
- the transport network interfaces configured to communicate data in accordance with a second protocol.
- the SMS causes a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) to be created through which subscriber sites securely exchange data by establishing a virtual router (VR) within the service processing switches corresponding to each subscriber interface.
- the VRs communicate the data among the service processing switches by encapsulating packets received from the subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
- FPoSP first-protocol-over-second-protocol
- VPN Virtual Private Network
- FIG. 1 is a block diagram of a hardware and operating environment in which various embodiments of the present invention may be practiced.
- FIG. 2 is a block diagram illustrating an exemplary frame of IP configuration according to an embodiment of the present invention.
- FIG. 3 is a flowchart illustrating a method according to an embodiment of the present invention.
- FIG. 4 is a diagram illustrating an exemplary Virtual Private Network (VPN) used in an embodiment of the invention.
- VPN Virtual Private Network
- FIG. 5 is a diagram illustrating further details regarding segments of an exemplary VPN used in accordance with various embodiments of the present invention.
- FIG. 6 is a diagram illustrating inter-VPN reachability according to one embodiment of the present invention.
- FIG. 7 is a diagram illustrating dynamic intra-VPN routing according to one embodiment of the present invention.
- FIG. 8 is a flowchart illustrating a method for provisioning a router configuration according to an embodiment of the present invention.
- FIG. 1 is a diagram of a hardware and operating environment in conjunction with which embodiments of the invention may be practiced.
- the description of FIG. 1 is intended to provide a brief, general description of suitable computer routing hardware and a suitable computing environment in conjunction with which the invention may be implemented.
- program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types.
- the system 100 includes a service processing switch 110 , access routers 104 , service management system 118 , and customer network management system 106 .
- service processing switch 110 provides switching, routing and computing resources that can be allocated by a service provider to customers.
- the service processing switch 110 is an IPSX 9000 service processing switch from Cosine Communications, Inc.
- the invention is not limited to any particular switch, router or service processing hardware.
- Service processing switch 110 can contain one or more blades 112 .
- blades 112 have a type associated with them.
- Examples of blade types include, processing functions such as network blades, control blades, trunk blades, and processor blades.
- Network blades provide interfaces to different types of networks.
- Control blades provide system management and accounting functions to the service processing system 110 .
- Trunk blades provide access to high speed trunk networks.
- Processor blades provide general purpose computer processors that in some embodiments of the invention provide firewall, intrusion detection, or directory services. Blades are communicably coupled to one another, in one embodiment a packet ring is used to couple the blades.
- each of blades 112 includes one more processing elements 114 .
- Processing elements 114 include a CPU and memory that provide computing resources for the blade. The invention is not limited to any particular number of processing elements on a blade, nor is the invention limited to any particular number of blades in a service processing switch 110 .
- Network 116 can also be a Wide Area Network (WAN), a Local Area Network (LAN), or a private network.
- WAN Wide Area Network
- LAN Local Area Network
- Service processing system 110 is also typically communicably coupled to a plurality of customer networks 102 via customer access routers 104 .
- Service management system 118 is communicably coupled to service processing system 110 , and hosts software that is used to configure and control the operation of service processing switch 110 .
- the service management system is a SPARC system available from Sun Microsystems, Inc. running the Invision product from Cosine Communications, Inc.
- Service management system 118 can be used to define and allocate resources within service processing switch 110 to various customers.
- the Simple Network Management Protocol (SNMP) is used to communicate with the service processing system 110 and to update SNMP MIB 126 .
- FIG. 2 illustrates an exemplary configuration in which two network protocols interwork.
- a customer manages two sites A and B, 202 and 204 respectively, and wishes to establish a logical network connection 212 between the two.
- the customer desires to use Frame Relay protocols in and out of the two sites.
- the customer establishes a Frame Over IP (FRoIP) link between the two sites 202 and 204 .
- FRoIP Frame Over IP
- two service processing switches 110 . 1 and 110 . 2 are used.
- Switch 110 . 1 is located near site 202 , and switch 110 .
- Transport 208 is used to communicably couple switches 110 . 1 and 110 . 2 , and a private virtual circuit (PVC) 206 is established within transport 208 .
- PVC private virtual circuit
- the method begins when a system executing the method, such as service management system 118 provisions a first endpoint for an interworking protocol (block 302 ).
- a system executing the method such as service management system 118 provisions a first endpoint for an interworking protocol (block 302 ).
- the provisioning of the endpoint can be accomplished either manually, or it can be accomplished using the policy based provisioning methodologies described below, such as those described with reference to FIG. 8 .
- the system proceeds to provision the transport network (block 304 ).
- the transport network interfaces can be provisioned using predefined policies.
- FRoIP Frame Over IP
- one embodiment of the invention includes the following parameters that can be determined by policies:
- Default window-size the window size determines the length of the buffered packet sequence. It enables the FRoIP instance to hold a series of IP packets in a memory buffer, in preparation for reassembly of the original frame sequence that is ultimately sent to its destination DLCI.
- the default-window-size applies to all subsequent FRoIP transports that are created. If this value is changed after some transports already exist, only subsequent newly created transports will use the new default.
- the default value is 4 packets, and permissible values range from 1 to 10.
- Default window-timeout the window-timeout sets the time limit for holding packets in the buffer before they are sent to their destination. It is measured in milliseconds. The default value is 10,000 milliseconds or 10 seconds total. As with default window-size, this value is used as a global default for all transports.
- Max-transport the maximum number of transports that can be terminated at the FRoIP instance. The default value is 24. The number of transports that can be run depends on the load in the system, and on the particular blade.
- the Virtual Interface identified by its number, across which the Frame Relay traffic is to be carried. This value cannot be changed while active Frame Relay transports are running.
- Permit-bad-event the number of allowed bad events, such as a failure to reassemble a frame, that are permitted before the service processing switch declares the FRoIP transport to be taken down by the switch. The same number is used as a criterion for re-enabling the transport. See event-window-size below for more details. The default is 3 events.
- Event-window-size this feature interacts with the permit-bad-event setting.
- the transport is taken down by the Control Blade. For example, if for every 10 events three or more events are bad, the interface (transport) is marked as down. Conversely, if three or more events subsequently are known as good in a following sequence, the interface is re-enabled by the Control Blade.
- this setting operates for both states: good events and bad events.
- Keep-alive-period the keep-alive interval is the period of time between issued “keep this Frame Relay connection live” messages from the local transport. This value is specified in seconds.
- Admin-status is a switch that enables or disables FRoIP Transport configuration on the current switch. The default is enabled.
- Window-size this value corresponds to the default-window-size value that is specified at the FRoIP level. If you change this value, it overrides the FRoIP default-window-size value for the local transport, otherwise it automatically uses the default window-size value previously defined in the FRoIP level.
- Window-timeout this value corresponds to the default-window-timeout value that is specified at the FRoP level., and overrides the default value as described for window-size.
- a private virtual circuit is provisioned (block 306 ).
- a user can select from a set of predefined policies in order to supply configuration parameters related to the provisioning.
- the following transport parameters can be set using policies:
- a second end point is provisioned (block 308 ). Like the other previously described blocks, the second end point can be provisioned using predefined policies.
- Embodiments of the invention provide advantages over previous systems. For example, policies can be used to make it easier to provision the various components of an interworking networking system, reducing or eliminating the need for manual configuration.
- FIG. 4 provides an illustration of a VPN as used in various embodiments of the invention.
- a VPN is typically a logical grouping of virtual routers (VRs) 406 .
- the connectivity between VPNs and customer sites 402 is provided by means of virtual interfaces (VIs). Users can create VIs and connect them to customer sites or to VIs of other VRs.
- the virtual connection can also be configured to be a tunnel interface (TI) to a type of secured tunnel, such as an IPSec tunnel.
- Customer sites can be connected via a network interface 404 , which can be a leased line interface such as DS3.
- the invention is not limited to any particular type of network interface.
- customer VRs are used to build customer VPNs
- ISP VRs are used to build ISP VPN.
- the ISP VPN is connected to an ISP backbone network 510 ( FIG. 5 ).
- ISP backbone network 510 FIG. 5
- each ISP needs only one ISP VPN.
- Customer VRs can be connected to the ISP VPN by means of VIs.
- Every virtual router can use one or more routing protocols, including STATIC, RIP, OSPF, and BGP, to disseminate reachability information. For routing purposes, every VPN based on this framework can be treated as an extension of the customer network.
- Various embodiments of the invention allow network managers to define profiles.
- the profile information may be used to automatically generate the routing configuration for a VPN.
- a customer VPN is divided into three segments, which are illustrated in FIG. 5 .
- ISP-Edge segment 305 is a VPN segment that connects the VPN to customer sites. This segment includes all virtual interfaces connected to logical interfaces and tunnel interfaces whose remote end is outside the VPN. This segment is used for disseminating customer site reachability information.
- Intra-VPN segment 504 (also referred to as an Intra-VPN segment) is a VPN segment that provides connectivity among different VRs 406 . This segment is used to disseminate intra-VPN reachability information.
- Inter-VPN segment 502 is a VPN segment that connects different types of VPNs; for example, the interfaces that connect a customer VPN with an ISP VPN.
- FIG. 6 illustrates how the routing needs of the Inter-VPN segment 302 may be taken care of at the time a customer VR 406 is created.
- a customer VR 406 When a customer VR 406 is created, the user is given the option to automatically connect the VR with an ISP VR 508 .
- service management system 118 FIG. 1
- NAT network address translation
- ISP-Edge 506 ISP-Edge 506
- Intra-VPN 504 Intra-VPN 504
- Border Gateway Protocol (BGP) is excluded as a possible choice for configuring customer VPNs. There are a few reasons for this. First, there are only two cases in which BGP would be used in a VPN environment. ISP-VPNs might use BGP to talk to the Internet core. Also, if a VPN connects two very large customer sites, BGP might be needed for the Intra-VPN segment to ensure scalability. There will generally be very few ISP VPNs (in most networks, there is only one), and it's unlikely that a VPN will be used to connect two or more large sites.
- BGP Border Gateway Protocol
- the second reason for excluding BGP from the profile is the VR-specific customization that is required to make BGP work in a VPN environment. Because BGP connects ISP VRs to the ISP core, a careful selection of export and import policies is needed to minimize the number of routes in each ISP VR. It is very difficult to represent this type of configuration by means of a generic routing profile.
- Service management system 118 FIG. 1 ) provides an interface to configure BGP on VRs. This interface allows user to enable BGP on a VR, set its BGP neighbors, and add import and export policies.
- the profile defines a simple routing configuration, that is, static routing for the Intra-VPN segment.
- static routing will be used to communicate with each customer site. This configuration is desirable because it puts a minimum load on the device, thus increasing the number of VPNs that can be managed by each service processing switch 110 .
- ISPs need to manage static routes for each customer. As new subnets are added to customer networks and old ones are removed, the static routes corresponding to these subnets should be added or removed in the corresponding VPNs.
- this problem can be solved by having service management system 118 ( FIG. 1 ) take ownership of automatically managing static routes based on the customer site subnet information. In these cases, customers can directly add or remove subnet information using tools such as the customer network management system 106 ( FIG. 1 ). This capability will transfer the ownership of managing routing to customers.
- a second issue with static routing is that the routing by definition is STATIC. If a site interface is down, traffic cannot be re-routed to an alternate path.
- a partial solution to this problem can be provided by allowing customers to disable routing on a site that is down. This can be done by means of customer network management system 106 ( FIG. 1 ). In this scenario, service management system 118 ( FIG. 1 ) would remove the static routes from the network that belongs to the site that is down. This action would allow the traffic to go through the backup path.
- embodiments of the invention provide a mechanism for a user to choose more advanced routing options in profiles.
- a viable option is Routing Information Protocol (RIP), while larger sites operators might choose Open Shortest Path First (OSPF) gateway protocol.
- OSPF Open Shortest Path First gateway protocol.
- the dynamic routing transfers the burden of managing route changes from the network manager to the device. If a user selects dynamic routing at the edge, then the service management system will also have to use dynamic routing to disseminate Intra-VPN reach ability information.
- FIG. 5 illustrates this scenario. If a site link to virtual router A 206 . 1 is down, virtual router B 206 . 2 will know that the traffic going through that link needs to be rerouted to virtual router C 206 . 3 only if dynamic routing is specified for Intra-VPN segment 504 .
- service management system 118 will allow the user to choose between RIP and OSPF for Intra-VPN routing.
- the user will typically select RIP if there are relatively few VRs in the VPN. Because OSPF is more scalable, it is a logical choice for bigger VPNs. If a user decides to run OSPF at a site edge, it is desirable to select OSPF for the Intra-VPN segment.
- FIG. 8 a flowchart shown in FIG. 8 .
- the methods to be performed by the operating environment may constitute computer programs made up of computer-executable instructions. Describing the methods with reference to a flowchart enables one skilled in the art to develop such programs including such instructions to carry out the methods on suitable computers (the processor of the computer executing the instructions from computer-readable media).
- the method illustrated in FIG. 8 is inclusive of the acts required to be taken by an operating environment executing an exemplary embodiment of the invention.
- the method begins at block 802 when a system executing the method learns, or discovers, the current routes to sites connected via the service processing switch 110 ( FIG. 1 ).
- each edge router To build or include new sites in a VPN, each edge router must learn the routes to all sites connected to all the edges in the network.
- An edge in a network is a boundary between two routers, an edge router is typically a network device that routes data between one or more local area networks backbone network. Two components of routing information are typically needed for the VPN:
- the system disseminates site reachability information (block 804 ).
- site reachability information (block 804 ).
- Various embodiments of the invention employ different mechanisms to disseminate the information.
- static configuration is used. In static configuration, all the subnets associated with each customer site are manually configured into the VPN.
- customer network management (CNM) 106 FIG. 1 ) tools can be enhanced to allow customers to directly add and remove subnet information from the VPN.
- the subnet information can be used to automatically create the static routes in the VPN. In this case, the customer also needs to add static routes to the CPE routers of non-stub sites.
- directory lookup is used to disseminate the site routing information.
- a central directory server can maintain the identities of edge routers associated with a VPN, and the set of customer site links bound to the VPN per edge router.
- Each edge router can query this information using some defined mechanism (for example, LDAP) upon startup. This mechanism requires some kind of database synchronization mechanism in order for all edge routers to learn the addition and deletion of sites from the VPN.
- a routing protocol can be run between the CPE edge router and the ISP edge router to exchange reachability information. This allows an ISP edge router to learn the prefixes that can be reached at a customer site, and enables a CPE router to learn the destinations that can be reached via the provider network.
- the MPLS Label Distribution Protocol can be extended to convey the set of prefixes at each stub site, together with the appropriate labeling information.
- the service management system 118 can use the subnets configured for each site to automatically create static routes for dissemination of intra-VPN reachability information.
- directory lookup information is used.
- a central directory can maintain a listing of the address prefixes associated with each end point.
- each edge router runs an instance of a routing protocol on each VPN to disseminate intra-VPN reachability information.
- this mechanism both full-mesh and arbitrary, VPN topologies can be easily supported.
- a still further alternative embodiment uses a Link Reachability Protocol.
- each edge router can run a link reachability protocol carrying the necessary information. This protocol runs across the tunnel between the two edge routers.
- the two preferred choices for this approach are a variation of MPLS LDP and IBGP.
- the link reachability protocol-based schemes can support only fully meshed VPNs.
- site reach ability information is disseminated by Piggybacking on IP Backbone Routing Protocols.
- the set of address prefixes associated with each stub interface can also be piggybacked into the routing advertisements from each edge router and propagated through the network. Other edge routers extract this information from received route advertisements.
- This scheme typically requires that intermediate routers cache intra-VPN routing information to propagate the data further. This also has implications for the level of security possible for intra-VPN routing information.
- a global routing profile can be defined (block 806 ).
- the global routing profile includes the following parameters:
- the system provides for the definition of a custom site profile (block 808 ).
- Multiple types of site information can be configured. First, if the site routing profile needs to be customized, the user may do so. Second, if a user wants static routing at the edge, the network subnets that are associated with the site must be provided. This configuration will allow the service management system to automatically create static routes.
- the site profile contains following parameters:
- a custom OSPF profile can be defined (block 810 ).
- service management system 118 FIG. 1
- OSPF OSPF
- RIP static profiles
- static profiles static profiles
- the user will want to customize the generic OSPF profile.
- the user can customize the generated profile using a policy-based profile configuration workflow.
- the workflow includes the following features:
- the service management system When configuring OSPF for intra-VPN segment, the service management system cannot use the same guidelines as those used in setting up a normal OSPF network, because each router in a VPN is a virtual router. To optimize performance, it is desirable to minimize the size of the routing table. This can be accomplished by keeping the OSPF areas small. In a normal OSPF network, the network manager would not let the size of an OSPF area grow beyond 50-60 routers. With a VPN, it is desirable to not let the OSPF area grow beyond 20-25 VRs. The larger the OSPF area, the higher the load on each VR, and hence the fewer the VRs that can be created on the service processing switch. As a result, it is not desirable to make a complete mesh of all the VRs in a large VPN. The user should use a custom OSPF topology and create areas of reasonable size to ensure scalability and stability of the OSPF network.
- the system also provides for the definition of custom export/import policies (block 812 ).
- service management system 118 ( FIG. 1 ) generates default policies necessary for different routing protocols to talk to each other. In some situations, custom export and import policies are needed to control access to critical networks. The system allows users to add custom export and import policies.
- the service management system Based on the site reachability information and/or the global and custom profiles described above, the service management system generates routing configuration (block 814 ). Described below are items that are considered during the generation of the configuration:
- the generated and customized policies can act as templates that can be applied to particular VPNs, particular VRs, or groups of VRs. For example, assume an existing policy has been changed or further customized. In one embodiment of the invention, the user is presented with a list of VRs or VPNs that were configured with the existing policy. The user can then select the VRs to which the new policy should be applied.
- the user wishes to change the policy for a particular VR.
- the user selects the desired VR, and then selects a new policy to be applied to the VR.
- the new policy can then be applied immediately, or it can be applied at a later scheduled time.
- the policies can be used as a differentiator in providing VPN services. If user selects STATIC routing for ISP-Edge and Intra-VPN segments, the service processing switch does not need to run any routing instances per customer VR. On the other hand, if a user has chosen to run dynamic routing for Intra-VPN and ISP edge segments, the switch may have to run instances of routing protocols such as OSPF and RIP. Running routing instances on virtual routers consumes both processing power and memory on the processing elements and blades. The demand on the resources will depend on the size of VPN and its interaction with various customer sites. An ISP can recover the cost of the increased resource usage, by using routing as a differentiator in providing VPN services. The following are a few exemplary methods of providing services:
Abstract
Systems and methods for managing interworking protocols are provided. According to one embodiment, a service management system (SMS) communicatively coupled with multiple service processing switches of a service provider provisions transport network interfaces of the service processing switches to provide a transport between subscriber interfaces of the service processing switches. The subscriber interfaces are configured to communicate data in accordance with a first protocol. The transport network interfaces configured to communicate data in accordance with a second protocol. The SMS causes a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) to be created through which subscriber sites securely exchange data by establishing a virtual router (VR) within the service processing switches corresponding to each subscriber interface. The VRs communicate the data among the service processing switches by encapsulating packets received from the subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
Description
- This application is a continuation of U.S. patent application Ser. No. 12/537,898, filed Aug. 7, 2009, which is a continuation of U.S. patent application Ser. No. 09/663,457, filed Sep. 13, 2000, now U.S. Pat. No. 7,574,495, which is hereby incorporated by reference in its entirety for all purposes.
- Contained herein is material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure by any person as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all rights to the copyright whatsoever. Copyright© 2000-2011, Fortinet, Inc.
- 1. Field
- Embodiments of the present invention generally relate to computer network routers. In particular, embodiments of the present invention relate to systems and methods of managing interworking protocols for such routers.
- 2. Description of the Related Art
- As computer networking technology has evolved, a number of different communications protocols have been developed. For example, Transmission Control Protocol (TCP)/Internet Protocol (IP), Frame Relay, Asynchronous Transfer Mode (ATM) protocols currently exist, along with other communications protocols. Each of these protocols has different defining characteristics, such as supported bandwidth, reliability and communications distances. It is often desirable to have two or more protocols work together. In previous systems, configuring a network to support such interworking protocols is largely a manual process, prone to errors, and in general difficult to accomplish.
- Systems and methods are described for managing interworking protocols. According to one embodiment, a service management system (SMS) communicatively coupled with multiple service processing switches of a service provider provisions transport network interfaces of the service processing switches to provide a transport between subscriber interfaces of the service processing switches. The subscriber interfaces are configured to communicate data in accordance with a first protocol. The transport network interfaces configured to communicate data in accordance with a second protocol. The SMS causes a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) to be created through which subscriber sites securely exchange data by establishing a virtual router (VR) within the service processing switches corresponding to each subscriber interface. The VRs communicate the data among the service processing switches by encapsulating packets received from the subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
- Other features of embodiments of the present invention will be apparent from the accompanying drawings and from the detailed description that follows.
- Embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which:
-
FIG. 1 is a block diagram of a hardware and operating environment in which various embodiments of the present invention may be practiced. -
FIG. 2 is a block diagram illustrating an exemplary frame of IP configuration according to an embodiment of the present invention. -
FIG. 3 is a flowchart illustrating a method according to an embodiment of the present invention. -
FIG. 4 is a diagram illustrating an exemplary Virtual Private Network (VPN) used in an embodiment of the invention. -
FIG. 5 is a diagram illustrating further details regarding segments of an exemplary VPN used in accordance with various embodiments of the present invention. -
FIG. 6 is a diagram illustrating inter-VPN reachability according to one embodiment of the present invention. -
FIG. 7 is a diagram illustrating dynamic intra-VPN routing according to one embodiment of the present invention. -
FIG. 8 is a flowchart illustrating a method for provisioning a router configuration according to an embodiment of the present invention. - In the following detailed description of exemplary embodiments of the invention, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration specific exemplary embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention, and it is to be understood that other embodiments may be utilized and that logical, mechanical, electrical and other changes may be made without departing from the scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense.
- In the Figures, the same reference number is used throughout to refer to an identical component which appears in multiple Figures. Signals and connections may be referred to by the same reference number or label, and the actual meaning will be clear from its use in the context of the description.
- The detailed description is divided into multiple sections. In the first section the hardware and operating environment of different embodiments of the invention is described. In the second section, the software environment of varying embodiments of the invention is described. In the final section, a conclusion is provided.
-
FIG. 1 is a diagram of a hardware and operating environment in conjunction with which embodiments of the invention may be practiced. The description ofFIG. 1 is intended to provide a brief, general description of suitable computer routing hardware and a suitable computing environment in conjunction with which the invention may be implemented. - Although not required, the invention is described in the general context of computer-executable instructions, such as program modules, being executed by a computer, such as a personal computer or a server computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types.
- As shown in
FIG. 1 , the system 100 includes aservice processing switch 110,access routers 104,service management system 118, and customer network management system 106. In some embodiments,service processing switch 110 provides switching, routing and computing resources that can be allocated by a service provider to customers. In one embodiment, theservice processing switch 110 is an IPSX 9000 service processing switch from Cosine Communications, Inc. However, the invention is not limited to any particular switch, router or service processing hardware. -
Service processing switch 110 can contain one ormore blades 112. In some embodiments of the invention,blades 112 have a type associated with them. Examples of blade types include, processing functions such as network blades, control blades, trunk blades, and processor blades. Network blades provide interfaces to different types of networks. Control blades provide system management and accounting functions to theservice processing system 110. Trunk blades provide access to high speed trunk networks. Processor blades provide general purpose computer processors that in some embodiments of the invention provide firewall, intrusion detection, or directory services. Blades are communicably coupled to one another, in one embodiment a packet ring is used to couple the blades. - In some embodiments, each of
blades 112 includes onemore processing elements 114.Processing elements 114 include a CPU and memory that provide computing resources for the blade. The invention is not limited to any particular number of processing elements on a blade, nor is the invention limited to any particular number of blades in aservice processing switch 110. -
Service processing system 110 is typically communicably coupled to anetwork 116, for example the Internet.Network 116 can also be a Wide Area Network (WAN), a Local Area Network (LAN), or a private network. -
Service processing system 110 is also typically communicably coupled to a plurality ofcustomer networks 102 viacustomer access routers 104. -
Service management system 118 is communicably coupled toservice processing system 110, and hosts software that is used to configure and control the operation ofservice processing switch 110. In one embodiment of the invention, the service management system is a SPARC system available from Sun Microsystems, Inc. running the Invision product from Cosine Communications, Inc.Service management system 118 can be used to define and allocate resources withinservice processing switch 110 to various customers. In some embodiments, the Simple Network Management Protocol (SNMP) is used to communicate with theservice processing system 110 and to updateSNMP MIB 126. -
FIG. 2 illustrates an exemplary configuration in which two network protocols interwork. In the exemplary configuration, a customer manages two sites A and B, 202 and 204 respectively, and wishes to establish alogical network connection 212 between the two. In the exemplary scenario, the customer desires to use Frame Relay protocols in and out of the two sites. However, it is impractical to establish a Frame Relay link directly between the two sites. As a result, the customer establishes a Frame Over IP (FRoIP) link between the twosites site 202, and switch 110.2 is located nearsite 204, allowing a Frame Relay link to be established between each of the sites and its corresponding switch.Transport 208 is used to communicably couple switches 110.1 and 110.2, and a private virtual circuit (PVC) 206 is established withintransport 208. The end result is that a FRoIP connection between the switches 110.1 and 110.2 allows Frame Relay packets to be transmitted betweensites - Those skilled in the art will appreciate that the invention may be practiced with other routing system hardware configurations besides those described above.
- In the previous section, a system level overview of the operation of exemplary embodiments of the invention were described. In this section, the particular methods of the invention performed by an operating environment executing an exemplary embodiment are described with reference to a flowchart in
FIG. 3 . The methods to be performed by the operating environment constitute computer programs made up of computer-executable instructions. Describing the methods with reference to a flow chart enables one skilled in the art to develop such programs including such instructions to carry out the methods on suitable computers (the processor of the computer executing the instructions from computer-readable media). The methods described below are inclusive of the acts required to be taken by an operating environment executing an exemplary embodiment of the invention. - The method begins when a system executing the method, such as
service management system 118 provisions a first endpoint for an interworking protocol (block 302). Depending upon the particular embodiment, the provisioning of the endpoint can be accomplished either manually, or it can be accomplished using the policy based provisioning methodologies described below, such as those described with reference toFIG. 8 . - Next, the system proceeds to provision the transport network (block 304). Again, the transport network interfaces can be provisioned using predefined policies. In the case of Frame Over IP (FRoIP) provisioning, one embodiment of the invention includes the following parameters that can be determined by policies:
- Default window-size—the window size determines the length of the buffered packet sequence. It enables the FRoIP instance to hold a series of IP packets in a memory buffer, in preparation for reassembly of the original frame sequence that is ultimately sent to its destination DLCI. The default-window-size applies to all subsequent FRoIP transports that are created. If this value is changed after some transports already exist, only subsequent newly created transports will use the new default. The default value is 4 packets, and permissible values range from 1 to 10.
- Default window-timeout—the window-timeout sets the time limit for holding packets in the buffer before they are sent to their destination. It is measured in milliseconds. The default value is 10,000 milliseconds or 10 seconds total. As with default window-size, this value is used as a global default for all transports.
- Max-transport—the maximum number of transports that can be terminated at the FRoIP instance. The default value is 24. The number of transports that can be run depends on the load in the system, and on the particular blade.
- Local VI—the Virtual Interface, identified by its number, across which the Frame Relay traffic is to be carried. This value cannot be changed while active Frame Relay transports are running.
- Permit-bad-event—the number of allowed bad events, such as a failure to reassemble a frame, that are permitted before the service processing switch declares the FRoIP transport to be taken down by the switch. The same number is used as a criterion for re-enabling the transport. See event-window-size below for more details. The default is 3 events.
- Event-window-size—this feature interacts with the permit-bad-event setting. In other words, if a number of events <event-window-size> occurs that is carrying a <permitbad-event> number of bad events, the transport is taken down by the Control Blade. For example, if for every 10 events three or more events are bad, the interface (transport) is marked as down. Conversely, if three or more events subsequently are known as good in a following sequence, the interface is re-enabled by the Control Blade. Thus, this setting operates for both states: good events and bad events.
- Keep-alive-period—the keep-alive interval is the period of time between issued “keep this Frame Relay connection live” messages from the local transport. This value is specified in seconds.
- Admin-status—admin-status is a switch that enables or disables FRoIP Transport configuration on the current switch. The default is enabled.
- Window-size—this value corresponds to the default-window-size value that is specified at the FRoIP level. If you change this value, it overrides the FRoIP default-window-size value for the local transport, otherwise it automatically uses the default window-size value previously defined in the FRoIP level.
- Window-timeout—this value corresponds to the default-window-timeout value that is specified at the FRoP level., and overrides the default value as described for window-size.
- Next, a private virtual circuit is provisioned (block 306). Again, a user can select from a set of predefined policies in order to supply configuration parameters related to the provisioning. In one embodiment of the invention, the following transport parameters can be set using policies:
-
- BC Committed Burst Size
- BE Excess Burst Size
- CIR Committed Information Rate
- Finally, a second end point is provisioned (block 308). Like the other previously described blocks, the second end point can be provisioned using predefined policies.
- Systems and methods for managing interworking communications protocols are disclosed. Embodiments of the invention provide advantages over previous systems. For example, policies can be used to make it easier to provision the various components of an interworking networking system, reducing or eliminating the need for manual configuration.
- Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that any arrangement which is calculated to achieve the same purpose may be substituted for the specific embodiments shown. This application is intended to cover any adaptations or variations of the present invention.
-
FIG. 4 provides an illustration of a VPN as used in various embodiments of the invention. A VPN is typically a logical grouping of virtual routers (VRs) 406. The connectivity between VPNs and customer sites 402 is provided by means of virtual interfaces (VIs). Users can create VIs and connect them to customer sites or to VIs of other VRs. The virtual connection can also be configured to be a tunnel interface (TI) to a type of secured tunnel, such as an IPSec tunnel. Customer sites can be connected via a network interface 404, which can be a leased line interface such as DS3. The invention is not limited to any particular type of network interface. - In some embodiments of the invention, two types of virtual routers are supported, customer VRs and ISP VRs. Customer VRs are used to build customer VPNs, and ISP VRs are used to build ISP VPN. The ISP VPN is connected to an ISP backbone network 510 (
FIG. 5 ). In this framework, each ISP needs only one ISP VPN. Customer VRs can be connected to the ISP VPN by means of VIs. Every virtual router can use one or more routing protocols, including STATIC, RIP, OSPF, and BGP, to disseminate reachability information. For routing purposes, every VPN based on this framework can be treated as an extension of the customer network. - Various embodiments of the invention allow network managers to define profiles. The profile information may be used to automatically generate the routing configuration for a VPN. In some embodiments, to profile the routing on a VPN, a customer VPN is divided into three segments, which are illustrated in
FIG. 5 . - ISP-Edge segment 305 is a VPN segment that connects the VPN to customer sites. This segment includes all virtual interfaces connected to logical interfaces and tunnel interfaces whose remote end is outside the VPN. This segment is used for disseminating customer site reachability information.
- Inside-VPN segment 504 (also referred to as an Intra-VPN segment) is a VPN segment that provides connectivity among
different VRs 406. This segment is used to disseminate intra-VPN reachability information. -
Inter-VPN segment 502 is a VPN segment that connects different types of VPNs; for example, the interfaces that connect a customer VPN with an ISP VPN. - It is desirable to identify segment types, because it provides a mechanism for generating profiles that can be optimized depending on the segment type.
-
FIG. 6 illustrates how the routing needs of theInter-VPN segment 302 may be taken care of at the time acustomer VR 406 is created. When acustomer VR 406 is created, the user is given the option to automatically connect the VR with anISP VR 508. At that time, service management system 118 (FIG. 1 ) may also create adefault route 602 on thecustomer VR 406 and astatic route 606 on theISP VR 508, which accommodatescustomer VR 406 toISP VR 508 connectivity. In this model, in accordance with one embodiment, for all network address translation (NAT) addresses 604, the user adds static routes on the ISP VPN. - The profile discussed here takes care of the first two VPN segments: ISP-Edge 506 and
Intra-VPN 504. Given a VPN's routing requirements, there are typically three routing aspects that are considered: -
- 1) The routing protocol that should be turned on a virtual interface in a VR
- 2) When and how to redistribute routes between various routing protocols.
- 3) When enabling a routing protocol on a router or interface, the routing parameters to use for optimizing performance.
- Service management system 118 (
FIG. 1 ) uses VPN profile data to automatically generate the required routing configuration. In some embodiments of the invention, Border Gateway Protocol (BGP) is excluded as a possible choice for configuring customer VPNs. There are a few reasons for this. First, there are only two cases in which BGP would be used in a VPN environment. ISP-VPNs might use BGP to talk to the Internet core. Also, if a VPN connects two very large customer sites, BGP might be needed for the Intra-VPN segment to ensure scalability. There will generally be very few ISP VPNs (in most networks, there is only one), and it's unlikely that a VPN will be used to connect two or more large sites. - The second reason for excluding BGP from the profile is the VR-specific customization that is required to make BGP work in a VPN environment. Because BGP connects ISP VRs to the ISP core, a careful selection of export and import policies is needed to minimize the number of routes in each ISP VR. It is very difficult to represent this type of configuration by means of a generic routing profile. Service management system 118 (
FIG. 1 ) provides an interface to configure BGP on VRs. This interface allows user to enable BGP on a VR, set its BGP neighbors, and add import and export policies. - In some embodiments of the invention, the profile defines a simple routing configuration, that is, static routing for the Intra-VPN segment. Thus, static routing will be used to communicate with each customer site. This configuration is desirable because it puts a minimum load on the device, thus increasing the number of VPNs that can be managed by each
service processing switch 110. - There are two issues with static routing. First, ISPs need to manage static routes for each customer. As new subnets are added to customer networks and old ones are removed, the static routes corresponding to these subnets should be added or removed in the corresponding VPNs. In some embodiments, this problem can be solved by having service management system 118 (
FIG. 1 ) take ownership of automatically managing static routes based on the customer site subnet information. In these cases, customers can directly add or remove subnet information using tools such as the customer network management system 106 (FIG. 1 ). This capability will transfer the ownership of managing routing to customers. - A second issue with static routing is that the routing by definition is STATIC. If a site interface is down, traffic cannot be re-routed to an alternate path. A partial solution to this problem can be provided by allowing customers to disable routing on a site that is down. This can be done by means of customer network management system 106 (
FIG. 1 ). In this scenario, service management system 118 (FIG. 1 ) would remove the static routes from the network that belongs to the site that is down. This action would allow the traffic to go through the backup path. - To resolve the two issues described above, embodiments of the invention provide a mechanism for a user to choose more advanced routing options in profiles. For smaller sites, a viable option is Routing Information Protocol (RIP), while larger sites operators might choose Open Shortest Path First (OSPF) gateway protocol. The dynamic routing transfers the burden of managing route changes from the network manager to the device. If a user selects dynamic routing at the edge, then the service management system will also have to use dynamic routing to disseminate Intra-VPN reach ability information.
-
FIG. 5 illustrates this scenario. If a site link to virtual router A 206.1 is down, virtual router B 206.2 will know that the traffic going through that link needs to be rerouted to virtual router C 206.3 only if dynamic routing is specified forIntra-VPN segment 504. - If all the sites (ISP-Edge segment) are using static or RIP routing,
service management system 118 will allow the user to choose between RIP and OSPF for Intra-VPN routing. The user will typically select RIP if there are relatively few VRs in the VPN. Because OSPF is more scalable, it is a logical choice for bigger VPNs. If a user decides to run OSPF at a site edge, it is desirable to select OSPF for the Intra-VPN segment. - This section has described the various software components in a system that provides for the automatic generation and provisioning of routing configurations. As those of skill in the art will appreciate, the software can be written in any of a number of programming languages known in the art, including but not limited to C/C++, Java, Visual Basic, Smalltalk, Pascal, Ada and similar programming languages. Embodiments of the present invention are not limited to any particular programming language for implementation. Additionally, as the generation and provisioning of routing configurations may also include manual steps, embodiments of the present invention are not limited to wholly automated methods.
- In the previous section, a system-level overview of the operation of exemplary embodiments of the invention was provided. In this section, a process for automatically generating and provisioning routing configurations in accordance with a particular embodiment is described with reference to a flowchart shown in
FIG. 8 . The methods to be performed by the operating environment may constitute computer programs made up of computer-executable instructions. Describing the methods with reference to a flowchart enables one skilled in the art to develop such programs including such instructions to carry out the methods on suitable computers (the processor of the computer executing the instructions from computer-readable media). The method illustrated inFIG. 8 is inclusive of the acts required to be taken by an operating environment executing an exemplary embodiment of the invention. - The method begins at block 802 when a system executing the method learns, or discovers, the current routes to sites connected via the service processing switch 110 (
FIG. 1 ). To build or include new sites in a VPN, each edge router must learn the routes to all sites connected to all the edges in the network. An edge in a network is a boundary between two routers, an edge router is typically a network device that routes data between one or more local area networks backbone network. Two components of routing information are typically needed for the VPN: -
- 1) Site Reachability Information: Each edge router needs to learn the set of VPN addresses and address prefixes reachable at each site. The reachability information needed by the Customer Provided Equipment (CPE) router depends on site configuration. Customer sites are characterized into two categories: stub sites and non-stub sites. The CPE routers of stub sites have default routes pointing to an ISP edge router, while the CPE router of non-stub site do not, and therefore need to know the set of non-local destinations reachable via that link. Usually, if a VPN also provides Internet connectivity to a site and there is no backdoor connection between this and any other site, it is a stub site.
- 2) Intra-VPN Reachability Information: Once an edge router has learned the set of prefixes associated with each of its customer site's links, this information must be disseminated to each other router in the VPN.
- According to the present example, after learning routes to sites, the system disseminates site reachability information (block 804). Various embodiments of the invention employ different mechanisms to disseminate the information. In one embodiment, static configuration is used. In static configuration, all the subnets associated with each customer site are manually configured into the VPN. To increase the manageability of this information, customer network management (CNM) 106 (
FIG. 1 ) tools can be enhanced to allow customers to directly add and remove subnet information from the VPN. The subnet information can be used to automatically create the static routes in the VPN. In this case, the customer also needs to add static routes to the CPE routers of non-stub sites. - In an alternative embodiment, directory lookup is used to disseminate the site routing information. A central directory server can maintain the identities of edge routers associated with a VPN, and the set of customer site links bound to the VPN per edge router. Each edge router can query this information using some defined mechanism (for example, LDAP) upon startup. This mechanism requires some kind of database synchronization mechanism in order for all edge routers to learn the addition and deletion of sites from the VPN.
- In a further alternative embodiment, a routing protocol can be run between the CPE edge router and the ISP edge router to exchange reachability information. This allows an ISP edge router to learn the prefixes that can be reached at a customer site, and enables a CPE router to learn the destinations that can be reached via the provider network.
- In a still further embodiment, if a CPE router runs Multiprotocol Label Switching (MPLS), the MPLS Label Distribution Protocol (LDP) can be extended to convey the set of prefixes at each stub site, together with the appropriate labeling information.
- In addition to the above, several mechanisms for Disseminating Intra-VPN Reachability Information can be used. In one embodiment employing static configuration, the
service management system 118 can use the subnets configured for each site to automatically create static routes for dissemination of intra-VPN reachability information. - In an alternative embodiment, directory lookup information is used. In addition to VPN membership information, a central directory can maintain a listing of the address prefixes associated with each end point.
- In a further alternative embodiment, each edge router runs an instance of a routing protocol on each VPN to disseminate intra-VPN reachability information. Using this mechanism, both full-mesh and arbitrary, VPN topologies can be easily supported.
- A still further alternative embodiment uses a Link Reachability Protocol. Here each edge router can run a link reachability protocol carrying the necessary information. This protocol runs across the tunnel between the two edge routers. The two preferred choices for this approach are a variation of MPLS LDP and IBGP. The link reachability protocol-based schemes can support only fully meshed VPNs.
- In yet a further alternative embodiment, site reach ability information is disseminated by Piggybacking on IP Backbone Routing Protocols. The set of address prefixes associated with each stub interface can also be piggybacked into the routing advertisements from each edge router and propagated through the network. Other edge routers extract this information from received route advertisements. This scheme typically requires that intermediate routers cache intra-VPN routing information to propagate the data further. This also has implications for the level of security possible for intra-VPN routing information.
- In addition to learning and disseminating site reachability information, a global routing profile can be defined (block 806). In one embodiment of the invention, the global routing profile includes the following parameters:
-
- a. Routing administration status
- b. Routing protocol for Intra-VPN segments
- c. Default routing protocol at the ISP edge. All the customer sites will generally inherit this.
- d. Default site type: stub or non-stub: Stub sites have a default route going toward the ISP VPN (Internet). For stub sites, there is no need to export routes from the VPN. This information is used in creating default export and import policies.
- e. If the routing protocol for the Intra-VPN segment is OSPF, define the OSPF profile topology type.
- When a site is added, it inherits the routing configuration from the routing profile.
- In addition, the system provides for the definition of a custom site profile (block 808). Multiple types of site information can be configured. First, if the site routing profile needs to be customized, the user may do so. Second, if a user wants static routing at the edge, the network subnets that are associated with the site must be provided. This configuration will allow the service management system to automatically create static routes. In one embodiment of the invention, the site profile contains following parameters:
-
- a. Routing Protocol at the ISP edge
- b. Site Type: stub or non-stub
- c. OSPF Area ID: If OSPF is enabled at the edge
- d. Site subnets.
- In addition, a custom OSPF profile can be defined (block 810). When a user configures a routing profile, service management system 118 (
FIG. 1 ) automatically generates OSPF, RIP, and static profiles, if needed. In many cases, the user will want to customize the generic OSPF profile. The user can customize the generated profile using a policy-based profile configuration workflow. The workflow includes the following features: -
- 1) The user can define custom OSPF areas. He only needs to configure what VRs are included in what areas; Service management system 118 (
FIG. 1 ) generates the required configuration for each VR and VI. - 2) The user can define a route aggregation policy for an OSPF area; Service management system 118 (
FIG. 1 ) will auto-generate this configuration for all the VRs in that area. - 3) By default, Service management system 118 (
FIG. 1 ) generates one VR routing parameter policy, which applies to all VRs, and three VI routing parameter policies which apply to tunnel interfaces, customer site edges, and VI-VI connections. When routing configuration is generated, these policies are used to define routing parameters. The user can make changes in any of these policies, or create his own policies and assign them as defaults. The user also can define policies and set them to be applied on a set of VRs or VIs. Service management system 118 (FIG. 1 ) allows users to individually customize parameters for a VR or VI.
- 1) The user can define custom OSPF areas. He only needs to configure what VRs are included in what areas; Service management system 118 (
- When configuring OSPF for intra-VPN segment, the service management system cannot use the same guidelines as those used in setting up a normal OSPF network, because each router in a VPN is a virtual router. To optimize performance, it is desirable to minimize the size of the routing table. This can be accomplished by keeping the OSPF areas small. In a normal OSPF network, the network manager would not let the size of an OSPF area grow beyond 50-60 routers. With a VPN, it is desirable to not let the OSPF area grow beyond 20-25 VRs. The larger the OSPF area, the higher the load on each VR, and hence the fewer the VRs that can be created on the service processing switch. As a result, it is not desirable to make a complete mesh of all the VRs in a large VPN. The user should use a custom OSPF topology and create areas of reasonable size to ensure scalability and stability of the OSPF network.
- The system also provides for the definition of custom export/import policies (block 812). Using the router and site profile defined above, service management system 118 (
FIG. 1 ) generates default policies necessary for different routing protocols to talk to each other. In some situations, custom export and import policies are needed to control access to critical networks. The system allows users to add custom export and import policies. - Based on the site reachability information and/or the global and custom profiles described above, the service management system generates routing configuration (block 814). Described below are items that are considered during the generation of the configuration:
-
- The user can only configure one protocol for the Intra-VPN segment. This configuration is used to configure the routing on all the interfaces that connect one VR to another in the same VPN. In most cases, this takes care of all tunnel interfaces.
- If the user selects static routing for a site, service management system 118 (
FIG. 1 ) will auto-generate one static route per site subnet on the local VR. If the routing for the Intra-VPN segment is also static, service management system 118 (FIG. 1 ) will also generate one static route per subnet on each remote VR. Auto-generation of static routes assumes a meshed-topology for the VPN. If the topology is not meshed, some additional configuration may be needed for the routing to work. - If select dynamic routing is selected for the Intra-VPN segment, service management system 118 (
FIG. 1 ) auto-generates export policies to disseminate site reachability information to other VRs. - For a non-stub site that is using dynamic routing to communicate with the VPN, service management system 118 (
FIG. 1 ) will create an export policy to inject all the routes learned from the Intra-VPN segment's routing into the customer network. - If the user selects a custom OSPF topology for the Intra-VPN segment, he does not have to explicitly assign an area 10 for each interface. Service management system 118 (
FIG. 1 ) automatically interprets this information from the area configuration. - Once the profile is set, Service management system 118 (
FIG. 1 ) automatically handles the routing configuration for the addition and deletion of VRs and VIs. For example, if standard OSPF routing has been selected for the Intra-VPN segment, whenever the user creates an IPSec tunnel connecting two VRs, OSPF will be enabled with area ID 0. 0.0.0. - If a VPN is using only one routing protocol for the Intra-VPN segment, service management system 118 (
FIG. 1 ) can discover routing profiles from the device configuration. - Service management system 118 (
FIG. 1 ) supports explicit two-phase provisioning of routing profile configurations. In the first phase, the user makes changes to the routing profile and saves them in the database. In the second phase, the user commits the profile to the network. In this phase, the server translates delta changes in the profile configuration into a required low-level configuration and pushes it to appropriate devices. - Service management system 118 (
FIG. 1 ) allows users to temporarily remove routing configurations from the device. Users can do this by providing administration status attributes for the routing profile. Setting this attribute to a “disabled” state and committing the profile removes configurations from the device. Routing can be turned on again by setting the admin status to “enabled.”
- As can be seen from the above, the generated and customized policies can act as templates that can be applied to particular VPNs, particular VRs, or groups of VRs. For example, assume an existing policy has been changed or further customized. In one embodiment of the invention, the user is presented with a list of VRs or VPNs that were configured with the existing policy. The user can then select the VRs to which the new policy should be applied.
- Similarly, assume that the user wishes to change the policy for a particular VR. In one embodiment of the invention, the user selects the desired VR, and then selects a new policy to be applied to the VR. The new policy can then be applied immediately, or it can be applied at a later scheduled time.
- In addition, the policies can be used as a differentiator in providing VPN services. If user selects STATIC routing for ISP-Edge and Intra-VPN segments, the service processing switch does not need to run any routing instances per customer VR. On the other hand, if a user has chosen to run dynamic routing for Intra-VPN and ISP edge segments, the switch may have to run instances of routing protocols such as OSPF and RIP. Running routing instances on virtual routers consumes both processing power and memory on the processing elements and blades. The demand on the resources will depend on the size of VPN and its interaction with various customer sites. An ISP can recover the cost of the increased resource usage, by using routing as a differentiator in providing VPN services. The following are a few exemplary methods of providing services:
-
- 1) Allow user to select the routing protocol per site: STATIC, RIP, or OSPF. Based on the site configuration, ISP can automatically configure routing protocol for intra-VPN segment. The cost of the service should be the lowest for STATIC and the highest for OSPF.
- 2) Define a few fixed routing profiles and sell them as a part of service packages such as Gold, Silver, and Bronze. For instance, Gold will allow user to select OSPF for intra-VPN as well as ISP edge segment. Silver will allow user to configure OSPF for intra-VPN segment, while RIP for ISPF edge. The bronze package will permit customer to configure STATIC for ISP edge as well as Intra-VPN segment.
- 3) Provide additional services as part of a profile. For example, include firewall, intrusion detection, network address translation, proxy services, or other network services as part of a differentiated service package. The service can then be included in profiles defined as part of the service package, and excluded from profiles for customers that do not pay for the service.
- The terminology used in this application is meant to include all of these environments. It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. Therefore, it is manifestly intended that this invention be limited only by the following claims and equivalents thereof.
Claims (16)
1. A computerized method for managing interworking protocols comprising the following computer-implemented steps:
provisioning, by a service management system (SMS) communicatively coupled with a plurality of service processing switches of a service provider, transport network interfaces of the plurality of service processing switches to provide a transport between subscriber interfaces of the plurality of service processing switches, the subscriber interfaces configured to communicate data in accordance with a first protocol, the transport network interfaces configured to communicate data in accordance with a second protocol; and
causing to be created, by the SMS, a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) through which a plurality of subscriber sites securely exchange data by establishing a virtual router (VR) within the plurality of service processing switches corresponding to each subscriber interface, the VRs communicate the data among the plurality of service processing switches by encapsulating packets received from the plurality of subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
2. The computerized method of claim 1 , wherein the first protocol comprises a frame relay protocol.
3. The computerized method of claim 1 , wherein the second protocol comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol.
4. The computerized method of claim 1 , wherein the second protocol comprises an Internet Protocol Security (IPSec) protocol.
5. The computerized method of claim 1 , wherein the first protocol comprises an Asynchronous Transfer Mode (ATM) protocol.
6. The computerized method of claim 1 , wherein said provisioning transport network interfaces utilizes the parameters from the predefined policy.
7. A service processing system comprising:
a first service processing switch including a first plurality of processing elements;
a second service processing switch including a second plurality of processing elements; and
a service management system (SMS), communicably coupled to the first service processing switch and the second service processing switch, operable to automatically establish a logical network connection between subscriber sites associated with the first service processing switch and the second service processing switch by:
provisioning transport network interfaces of the first service processing switch and the second service processing switch to provide a transport between a first subscriber interface of the first service processing switch configured to communicate data in accordance with a first protocol and a second subscriber interface of the second service processing switch configured to communicate data in accordance with the first protocol, the transport network interfaces communicating in accordance with a second protocol; and
creating a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) through which the subscriber sites securely exchange data by establishing a first virtual router (VR) corresponding to the first subscriber interface and a second VR corresponding to the second subscriber interface, the first VR and the second VR communicate the data between the first service processing switch and the second service processing switch by encapsulating packets received from the subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
8. The service processing system of claim 7 , wherein the first protocol comprises a frame relay protocol.
9. The service processing system of claim 7 , wherein the second protocol comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol.
10. The service processing system of claim 7 , wherein the second protocol comprises an Internet Protocol Security (IPSec) protocol.
11. The service processing system of claim 7 , wherein the first protocol comprises an Asynchronous Transfer Mode (ATM) protocol.
12. A non-transitory computer-readable storage medium having stored thereon instructions, which when executed by one or more processors of a service management system (SMS) of a service provider that is operable to automatically establish a logical network connection among a plurality of subscriber sites through a plurality of service processing switches to which the SMS is communicatively coupled, cause a method to be performed comprising the following computer-implemented steps:
provisioning transport network interfaces of the plurality of service processing switches to provide a transport between subscriber interfaces of the plurality of service processing switches, the subscriber interfaces configured to communicate data in accordance with a first protocol, the transport network interfaces configured to communicate data in accordance with a second protocol; and
causing to be created a first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) through which a plurality of subscriber sites securely exchange data by establishing a virtual router (VR) within the plurality of service processing switches corresponding to each subscriber interface, the VRs communicate the data among the plurality of service processing switches by encapsulating packets received from the plurality of subscriber sites within packets of the second protocol and transmitting the encapsulated packets through the transport network interfaces.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the first protocol comprises a frame relay protocol.
14. The non-transitory computer-readable storage medium of claim 12 , wherein the second protocol comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol.
15. The non-transitory computer-readable storage medium of claim 12 , wherein the second protocol comprises an Internet Protocol Security (IPSec) protocol.
16. The non-transitory computer-readable storage medium of claim 12 , wherein the first protocol comprises an Asynchronous Transfer Mode (ATM) protocol.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/050,387 US20110176552A1 (en) | 2000-09-13 | 2011-03-17 | Managing interworking communications protocols |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/663,457 US7574495B1 (en) | 2000-09-13 | 2000-09-13 | System and method for managing interworking communications protocols |
US12/537,898 US7912936B2 (en) | 2000-09-13 | 2009-08-07 | Managing interworking communications protocols |
US13/050,387 US20110176552A1 (en) | 2000-09-13 | 2011-03-17 | Managing interworking communications protocols |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/537,898 Continuation US7912936B2 (en) | 2000-09-13 | 2009-08-07 | Managing interworking communications protocols |
Publications (1)
Publication Number | Publication Date |
---|---|
US20110176552A1 true US20110176552A1 (en) | 2011-07-21 |
Family
ID=40934390
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/663,457 Expired - Fee Related US7574495B1 (en) | 2000-09-13 | 2000-09-13 | System and method for managing interworking communications protocols |
US12/537,898 Expired - Fee Related US7912936B2 (en) | 2000-09-13 | 2009-08-07 | Managing interworking communications protocols |
US13/050,387 Abandoned US20110176552A1 (en) | 2000-09-13 | 2011-03-17 | Managing interworking communications protocols |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/663,457 Expired - Fee Related US7574495B1 (en) | 2000-09-13 | 2000-09-13 | System and method for managing interworking communications protocols |
US12/537,898 Expired - Fee Related US7912936B2 (en) | 2000-09-13 | 2009-08-07 | Managing interworking communications protocols |
Country Status (1)
Country | Link |
---|---|
US (3) | US7574495B1 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110225282A1 (en) * | 2010-03-15 | 2011-09-15 | Electronics And Telecommunications Research Institute | Apparatus and method for virtualizing of network device |
CN103051535A (en) * | 2012-12-18 | 2013-04-17 | 华为技术有限公司 | Data access method, data access device and data access system |
CN109120726A (en) * | 2018-10-30 | 2019-01-01 | 全讯汇聚网络科技(北京)有限公司 | A kind of multi-router VPN automatic network-building method and system based on collection medium-long range control |
CN109845302A (en) * | 2016-10-05 | 2019-06-04 | 信实资讯通信公司 | System and method for automatic identification and optimization overshoot cell |
Families Citing this family (32)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7574495B1 (en) * | 2000-09-13 | 2009-08-11 | Fortinet, Inc. | System and method for managing interworking communications protocols |
US7487232B1 (en) | 2000-09-13 | 2009-02-03 | Fortinet, Inc. | Switch management system and method |
US8250357B2 (en) | 2000-09-13 | 2012-08-21 | Fortinet, Inc. | Tunnel interface for securing traffic over a network |
US7181547B1 (en) | 2001-06-28 | 2007-02-20 | Fortinet, Inc. | Identifying nodes in a ring network |
FI20011949A0 (en) * | 2001-10-05 | 2001-10-05 | Stonesoft Corp | Managing a Virtual Private Network |
US7623477B2 (en) * | 2002-05-06 | 2009-11-24 | Qualcomm, Incorporated | Methods and apparatus for downlink macro-diversity in cellular networks |
US7203192B2 (en) | 2002-06-04 | 2007-04-10 | Fortinet, Inc. | Network packet steering |
US7177311B1 (en) * | 2002-06-04 | 2007-02-13 | Fortinet, Inc. | System and method for routing traffic through a virtual router-based network switch |
US7376125B1 (en) | 2002-06-04 | 2008-05-20 | Fortinet, Inc. | Service processing switch |
US7161904B2 (en) * | 2002-06-04 | 2007-01-09 | Fortinet, Inc. | System and method for hierarchical metering in a virtual router based network switch |
US7266120B2 (en) | 2002-11-18 | 2007-09-04 | Fortinet, Inc. | System and method for hardware accelerated packet multicast in a virtual routing system |
US7720095B2 (en) | 2003-08-27 | 2010-05-18 | Fortinet, Inc. | Heterogeneous media packet bridging |
US7499419B2 (en) | 2004-09-24 | 2009-03-03 | Fortinet, Inc. | Scalable IP-services enabled multicast forwarding with efficient resource utilization |
US7808904B2 (en) * | 2004-11-18 | 2010-10-05 | Fortinet, Inc. | Method and apparatus for managing subscriber profiles |
US8554916B2 (en) * | 2005-04-11 | 2013-10-08 | Accenture Global Services Gmbh | Service delivery platform and development of new client business models |
JP4421517B2 (en) * | 2005-06-07 | 2010-02-24 | 株式会社東芝 | Information processing server, remote operation system, and remote operation method |
JP4585479B2 (en) * | 2006-03-30 | 2010-11-24 | 株式会社東芝 | Server apparatus and video distribution method |
US8995301B1 (en) | 2009-12-07 | 2015-03-31 | Amazon Technologies, Inc. | Using virtual networking devices to manage routing cost information |
US9036504B1 (en) | 2009-12-07 | 2015-05-19 | Amazon Technologies, Inc. | Using virtual networking devices and routing information to associate network addresses with computing nodes |
US7937438B1 (en) | 2009-12-07 | 2011-05-03 | Amazon Technologies, Inc. | Using virtual networking devices to manage external connections |
US9203747B1 (en) | 2009-12-07 | 2015-12-01 | Amazon Technologies, Inc. | Providing virtual networking device functionality for managed computer networks |
US7991859B1 (en) | 2009-12-28 | 2011-08-02 | Amazon Technologies, Inc. | Using virtual networking devices to connect managed computer networks |
US8224971B1 (en) | 2009-12-28 | 2012-07-17 | Amazon Technologies, Inc. | Using virtual networking devices and routing information to initiate external actions |
US7953865B1 (en) | 2009-12-28 | 2011-05-31 | Amazon Technologies, Inc. | Using virtual networking devices to manage routing communications between connected computer networks |
US8458786B1 (en) * | 2010-08-13 | 2013-06-04 | Zscaler, Inc. | Automated dynamic tunnel management |
US9240970B2 (en) | 2012-03-07 | 2016-01-19 | Accenture Global Services Limited | Communication collaboration |
US9692832B2 (en) * | 2012-10-24 | 2017-06-27 | Blackberry Limited | System and method for controlling connection timeout in a communication network |
US10454708B2 (en) * | 2014-03-07 | 2019-10-22 | Nec Corporation | Network system, inter-site network cooperation control apparatus, network control method, and program |
US9385953B1 (en) | 2015-02-03 | 2016-07-05 | Google Inc. | Mesh network addressing |
US11115323B2 (en) | 2017-05-10 | 2021-09-07 | Saudi Arabian Oil Company | Securing Layer-3 virtual private network |
US10608942B1 (en) * | 2017-11-30 | 2020-03-31 | Amazon Technologies, Inc. | Reducing routes based on network traffic utilization |
US11394693B2 (en) * | 2019-03-04 | 2022-07-19 | Cyxtera Cybersecurity, Inc. | Establishing network tunnel in response to access request |
Citations (90)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4667323A (en) * | 1985-09-03 | 1987-05-19 | Allen-Bradley Company, Inc. | Industrialized token passing network |
US4726018A (en) * | 1986-08-25 | 1988-02-16 | International Business Machines Corporation | Method of providing priority access to a transmission communication ring |
US4881244A (en) * | 1986-12-11 | 1989-11-14 | Siemens Aktiengesellschaft | Transmission-reception equipment for a bus system |
US5550816A (en) * | 1994-12-29 | 1996-08-27 | Storage Technology Corporation | Method and apparatus for virtual switching |
US5598414A (en) * | 1991-02-06 | 1997-01-28 | Walser; Robert A. | Access to transmit on a message priority basis |
US5825891A (en) * | 1996-01-16 | 1998-10-20 | Raptor Systems, Inc. | Key management for network communication |
US5875290A (en) * | 1997-03-27 | 1999-02-23 | International Business Machines Corporation | Method and program product for synchronizing operator initiated commands with a failover process in a distributed processing system |
US5964847A (en) * | 1997-03-10 | 1999-10-12 | International Business Machines Corporation | Mobile client computer interacting with docking device |
US6094674A (en) * | 1994-05-06 | 2000-07-25 | Hitachi, Ltd. | Information processing system and information processing method and quality of service supplying method for use with the system |
US6134226A (en) * | 1998-12-31 | 2000-10-17 | Motorola, Inc. | Method and system for allocating a system resource to subscribers of a wireless communications system |
US6173399B1 (en) * | 1997-06-12 | 2001-01-09 | Vpnet Technologies, Inc. | Apparatus for implementing virtual private networks |
US6192051B1 (en) * | 1999-02-26 | 2001-02-20 | Redstone Communications, Inc. | Network router search engine using compressed tree forwarding table |
US6212556B1 (en) * | 1995-11-13 | 2001-04-03 | Webxchange, Inc. | Configurable value-added network (VAN) switching |
US6243580B1 (en) * | 1995-11-30 | 2001-06-05 | Amsc Subsidiary Corporation | Priority and preemption service system for satellite related communication using central controller |
US6246682B1 (en) * | 1999-03-05 | 2001-06-12 | Transwitch Corp. | Method and apparatus for managing multiple ATM cell queues |
US20010028636A1 (en) * | 2000-03-10 | 2001-10-11 | Robert Skog | Method and apparatus for mapping an IP address to an MSISDN number within a service network |
US20010033580A1 (en) * | 1997-11-19 | 2001-10-25 | Dorsey Paul C. | Multi-protocol packet translator |
US6324583B1 (en) * | 1998-11-17 | 2001-11-27 | International Business Machines Corp. | Method and apparatus for enabling communication between dissimilar protocol stacks |
US6339782B1 (en) * | 1997-11-21 | 2002-01-15 | International Business Machines Corporation | Persistence mechanism and method for objects |
US6343083B1 (en) * | 1998-04-09 | 2002-01-29 | Alcatel Usa Sourcing, L.P. | Method and apparatus for supporting a connectionless communication protocol over an ATM network |
US20020023171A1 (en) * | 2000-03-20 | 2002-02-21 | Garrett John W. | Service selection in a shared access network using policy routing |
US20020062344A1 (en) * | 1998-09-11 | 2002-05-23 | Tatu Ylonen | Method and arrangement for secure tunneling of data between virtual routers |
US20020071389A1 (en) * | 2000-12-09 | 2002-06-13 | Hyun-Chul Seo | Data structure for implementation of traffic engineering function in multiprotocol label switching system and storage medium for storing the same |
US20020097730A1 (en) * | 2001-01-25 | 2002-07-25 | Cresent Networks, Inc. | Network device virtual Interface |
US6453406B1 (en) * | 1990-10-17 | 2002-09-17 | Compaq Computer Corporation | Multiprocessor system with fiber optic bus interconnect for interprocessor communications |
US20020150093A1 (en) * | 2000-08-16 | 2002-10-17 | Maximilian Ott | High-performance addressing and routing of data packets with semantically descriptive labels in a computer network |
US6487666B1 (en) * | 1999-01-15 | 2002-11-26 | Cisco Technology, Inc. | Intrusion detection signature analysis using regular expressions and logical operators |
US6493349B1 (en) * | 1998-11-13 | 2002-12-10 | Nortel Networks Limited | Extended internet protocol virtual private network architectures |
US20030026262A1 (en) * | 2001-07-31 | 2003-02-06 | Patrik Jarl | Channel resource allocation arrangement and method |
US6542502B1 (en) * | 1996-01-26 | 2003-04-01 | International Business Machines Corporation | Multicasting using a wormhole routing switching element |
US6553423B1 (en) * | 1999-05-27 | 2003-04-22 | Cisco Technology, Inc. | Method and apparatus for dynamic exchange of capabilities between adjacent/neighboring networks nodes |
US6614781B1 (en) * | 1998-11-20 | 2003-09-02 | Level 3 Communications, Inc. | Voice over data telecommunications network architecture |
US6625650B2 (en) * | 1998-06-27 | 2003-09-23 | Intel Corporation | System for multi-layer broadband provisioning in computer networks |
US6629128B1 (en) * | 1999-11-30 | 2003-09-30 | Recursion Software, Inc. | System and method for distributed processing in a computer network |
US6640248B1 (en) * | 1998-07-10 | 2003-10-28 | Malibu Networks, Inc. | Application-aware, quality of service (QoS) sensitive, media access control (MAC) layer |
US6668282B1 (en) * | 2000-08-02 | 2003-12-23 | International Business Machines Corporation | System and method to monitor and determine if an active IPSec tunnel has become disabled |
US6680922B1 (en) * | 1998-07-10 | 2004-01-20 | Malibu Networks, Inc. | Method for the recognition and operation of virtual private networks (VPNs) over a wireless point to multi-point (PtMP) transmission system |
US6694437B1 (en) * | 1999-06-22 | 2004-02-17 | Institute For Information Technology | System and method for on-demand access concentrator for virtual private networks |
US20040037379A1 (en) * | 2000-12-07 | 2004-02-26 | Nadim Khlat | Multi-mode radio communications device using a common reference oscillator |
US6701449B1 (en) * | 2000-04-20 | 2004-03-02 | Ciprico, Inc. | Method and apparatus for monitoring and analyzing network appliance status information |
US6738821B1 (en) * | 1999-01-26 | 2004-05-18 | Adaptec, Inc. | Ethernet storage protocol networks |
US20040095932A1 (en) * | 2002-11-18 | 2004-05-20 | Toshiba America Information Systems, Inc. | Method for SIP - mobility and mobile - IP coexistence |
US6763236B2 (en) * | 2000-06-30 | 2004-07-13 | Nokia Mobile Phones, Ltd. | Resource allocating and service providing over a wireless network |
US6775284B1 (en) * | 2000-01-07 | 2004-08-10 | International Business Machines Corporation | Method and system for frame and protocol classification |
US6778502B2 (en) * | 1999-06-18 | 2004-08-17 | Savvis, Inc. | On-demand overlay routing for computer-based communication networks |
US6785691B1 (en) * | 1999-10-13 | 2004-08-31 | Avaya Technology Corp. | Object oriented processing system and data sharing environment for applications therein |
US6785224B2 (en) * | 2000-03-06 | 2004-08-31 | Fujitsu Limited | Ring configuring method and node apparatus used in the ring |
US6802068B1 (en) * | 1996-10-16 | 2004-10-05 | International Business Machines Corporation | Addressless internetworking |
US20040199569A1 (en) * | 2003-02-18 | 2004-10-07 | Mohan Kalkunte | Method and system for handling traffic for server systems |
US6807181B1 (en) * | 1999-05-19 | 2004-10-19 | Sun Microsystems, Inc. | Context based control data |
US6816462B1 (en) * | 2000-08-02 | 2004-11-09 | International Business Machines Corporation | System and method to determine connectivity of a VPN secure tunnel |
US6820210B1 (en) * | 1998-04-27 | 2004-11-16 | Cisco Technology, Inc. | System and method for fault recovery for a two line bi-directional ring network |
US6822958B1 (en) * | 2000-09-25 | 2004-11-23 | Integrated Device Technology, Inc. | Implementation of multicast in an ATM switch |
US20050002417A1 (en) * | 2003-07-02 | 2005-01-06 | Kelly Thomas J. | Systems and methods for performing protocol conversions in a work machine |
US20050055306A1 (en) * | 1998-09-22 | 2005-03-10 | Science Applications International Corporation | User-defined dynamic collaborative environments |
US20050108340A1 (en) * | 2003-05-15 | 2005-05-19 | Matt Gleeson | Method and apparatus for filtering email spam based on similarity measures |
US20050113114A1 (en) * | 2003-11-26 | 2005-05-26 | Nokia Corporation | Method and apparatus to provide efficient routing of packets for a network initiated data session |
US6907039B2 (en) * | 2002-07-20 | 2005-06-14 | Redback Networks Inc. | Method and apparatus for routing and forwarding between virtual routers within a single network element |
US20050147095A1 (en) * | 2003-12-30 | 2005-07-07 | Intel Corporation | IP multicast packet burst absorption and multithreaded replication architecture |
US6920580B1 (en) * | 2000-07-25 | 2005-07-19 | Network Appliance, Inc. | Negotiated graceful takeover in a node cluster |
US6920146B1 (en) * | 1998-10-05 | 2005-07-19 | Packet Engines Incorporated | Switching device with multistage queuing scheme |
US6922774B2 (en) * | 2001-05-14 | 2005-07-26 | The United States Of America As Represented By The National Security Agency | Device for and method of secure computing using virtual machines |
US20050163115A1 (en) * | 2003-09-18 | 2005-07-28 | Sitaram Dontu | Distributed forwarding in virtual network devices |
US20050213589A1 (en) * | 2004-03-26 | 2005-09-29 | Samsung Electronics Co., Ltd. | Method and system for assigning servers based on server status in a wireless network |
US6980528B1 (en) * | 1999-09-20 | 2005-12-27 | Broadcom Corporation | Voice and data exchange over a packet based network with comfort noise generation |
US6994994B1 (en) * | 1999-07-20 | 2006-02-07 | Compugent Ltd | Splice variants of CD40-receptor |
US7082477B1 (en) * | 2002-04-30 | 2006-07-25 | Cisco Technology, Inc. | Virtual application of features to electronic messages |
US7096495B1 (en) * | 2000-03-31 | 2006-08-22 | Intel Corporation | Network session management |
US7187676B2 (en) * | 2002-06-04 | 2007-03-06 | Sun Microsystems, Inc. | Apparatus and method for steering a communication to an open stream |
US7221945B2 (en) * | 2002-05-03 | 2007-05-22 | Leapstone Systems, Inc. | System and method for establishing and controlling access to network resources |
US7225259B2 (en) * | 2001-02-21 | 2007-05-29 | Nokia Inc. | Service tunnel over a connectionless network |
US7243371B1 (en) * | 2001-11-09 | 2007-07-10 | Cisco Technology, Inc. | Method and system for configurable network intrusion detection |
US7272643B1 (en) * | 2000-09-13 | 2007-09-18 | Fortinet, Inc. | System and method for managing and provisioning virtual routers |
US7293355B2 (en) * | 2005-04-21 | 2007-11-13 | Endicott Interconnect Technologies, Inc. | Apparatus and method for making circuitized substrates in a continuous manner |
US7316029B1 (en) * | 2001-10-25 | 2008-01-01 | Sprint Communications Company L.P. | Network security services architecture |
US7324889B2 (en) * | 2006-03-20 | 2008-01-29 | Nissan Motor Co., Ltd. | Intake-air quantity control system of engine |
US7324489B1 (en) * | 2003-02-18 | 2008-01-29 | Cisco Technology, Inc. | Managing network service access |
US20090131020A1 (en) * | 2004-05-24 | 2009-05-21 | Van De Groenendaal Joannes G | Wireless manager and method for configuring and securing wireless access to a network |
US20090279567A1 (en) * | 2002-10-16 | 2009-11-12 | Eric White | System and method for dynamic bandwidth provisioning |
US7720053B2 (en) * | 2002-06-04 | 2010-05-18 | Fortinet, Inc. | Service processing switch |
US20100146098A1 (en) * | 2001-04-24 | 2010-06-10 | Hitachi, Ltd | Intergrated service management system |
US20100146627A1 (en) * | 2006-03-01 | 2010-06-10 | Fortinet, Inc. | Electronic message and data tracking system |
US20100142527A1 (en) * | 2004-09-24 | 2010-06-10 | Fortinet, Inc. | Scalable IP-Services Enabled Multicast Forwarding with Efficient Resource Utilization |
US7761743B2 (en) * | 2002-08-29 | 2010-07-20 | Fortinet, Inc. | Fault tolerant routing in a non-hot-standby configuration of a network routing system |
US20100189016A1 (en) * | 2001-06-28 | 2010-07-29 | Fortinet, Inc. | Identifying nodes in a ring network |
US20100220741A1 (en) * | 2003-08-27 | 2010-09-02 | Fortinet, Inc. | Heterogeneous media packet bridging |
US7830787B1 (en) * | 2001-09-25 | 2010-11-09 | Cisco Technology, Inc. | Flooding control for multicast distribution tunnel |
US7843813B2 (en) * | 2004-11-18 | 2010-11-30 | Fortinet, Inc. | Managing hierarchically organized subscriber profiles |
US7912936B2 (en) * | 2000-09-13 | 2011-03-22 | Nara Rajagopalan | Managing interworking communications protocols |
US7933269B2 (en) * | 2002-11-18 | 2011-04-26 | Fortinet, Inc. | Hardware-accelerated packet multicasting in a virtual routing system |
Family Cites Families (111)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4667287A (en) | 1982-10-28 | 1987-05-19 | Tandem Computers Incorporated | Multiprocessor multisystem communications network |
US5742760A (en) | 1992-05-12 | 1998-04-21 | Compaq Computer Corporation | Network packet switch using shared memory for repeating and bridging packets at media rate |
US5490252A (en) | 1992-09-30 | 1996-02-06 | Bay Networks Group, Inc. | System having central processor for transmitting generic packets to another processor to be altered and transmitting altered packets back to central processor for routing |
US5955089A (en) * | 1993-04-20 | 1999-09-21 | Uab Research Foundation | Strain selection of pneumococcal surface proteins |
US5581705A (en) | 1993-12-13 | 1996-12-03 | Cray Research, Inc. | Messaging facility with hardware tail pointer and software implemented head pointer message queue for distributed memory massively parallel processing system |
US5745778A (en) | 1994-01-26 | 1998-04-28 | Data General Corporation | Apparatus and method for improved CPU affinity in a multiprocessor system |
US5473599A (en) | 1994-04-22 | 1995-12-05 | Cisco Systems, Incorporated | Standby router protocol |
US5987521A (en) | 1995-07-10 | 1999-11-16 | International Business Machines Corporation | Management of path routing in packet communications networks |
US6405262B1 (en) | 1995-07-14 | 2002-06-11 | Microsoft Corporation | Efficient inter-process object and interface pinging |
US5684800A (en) | 1995-11-15 | 1997-11-04 | Cabletron Systems, Inc. | Method for establishing restricted broadcast groups in a switched network |
US5699347A (en) | 1995-11-17 | 1997-12-16 | Bay Networks, Inc. | Method and apparatus for routing packets in networks having connection-oriented subnetworks |
EP0781068A1 (en) | 1995-12-20 | 1997-06-25 | International Business Machines Corporation | Method and system for adaptive bandwidth allocation in a high speed data network |
US5892924A (en) * | 1996-01-31 | 1999-04-06 | Ipsilon Networks, Inc. | Method and apparatus for dynamically shifting between routing and switching packets in a transmission network |
JP2002516042A (en) * | 1996-01-31 | 2002-05-28 | イプシロン ネットワークス インコーポレイテッド | Method and apparatus for dynamically shifting between packet routing and switching in a transmission network |
US5841973A (en) | 1996-03-13 | 1998-11-24 | Cray Research, Inc. | Messaging in distributed memory multiprocessing system having shell circuitry for atomic control of message storage queue's tail pointer structure in local memory |
JPH09275400A (en) * | 1996-04-04 | 1997-10-21 | Hitachi Ltd | Atm exchange system |
US6220768B1 (en) | 1996-06-28 | 2001-04-24 | Sun Microsystems, Inc. | Network asset survey tool for gathering data about node equipment |
JPH1079740A (en) * | 1996-09-03 | 1998-03-24 | Hitachi Ltd | Router device using atm switch |
US6169793B1 (en) | 1996-12-24 | 2001-01-02 | Evolving Systems, Inc. | Systems and methods for providing order and service mediation for telecommunications systems |
US6260073B1 (en) | 1996-12-30 | 2001-07-10 | Compaq Computer Corporation | Network switch including a switch manager for periodically polling the network ports to determine their status and controlling the flow of data between ports |
US6098110A (en) | 1996-12-30 | 2000-08-01 | Compaq Computer Corporation | Network switch with a multiple bus structure and a bridge interface for transferring network data between different buses |
JP2842530B2 (en) * | 1997-01-08 | 1999-01-06 | 日本電気株式会社 | ATM VLAN client-server system |
US6226296B1 (en) * | 1997-01-16 | 2001-05-01 | Physical Optics Corporation | Metropolitan area network switching system and method of operation thereof |
US6032193A (en) | 1997-03-20 | 2000-02-29 | Niobrara Research And Development Corporation | Computer system having virtual circuit address altered by local computer to switch to different physical data link to increase data transmission bandwidth |
CA2202572C (en) | 1997-04-14 | 2004-02-10 | Ka Lun Eddie Law | A scaleable web server and method of efficiently managing multiple servers |
US6137777A (en) | 1997-05-27 | 2000-10-24 | Ukiah Software, Inc. | Control tool for bandwidth management |
US6260072B1 (en) | 1997-06-12 | 2001-07-10 | Lucent Technologies Inc | Method and apparatus for adaptive routing in packet networks |
US20050081059A1 (en) | 1997-07-24 | 2005-04-14 | Bandini Jean-Christophe Denis | Method and system for e-mail filtering |
US6069895A (en) * | 1997-08-29 | 2000-05-30 | Nortel Networks Corporation | Distributed route server |
US6256295B1 (en) * | 1997-09-25 | 2001-07-03 | Nortel Networks Limited | Method and apparatus for determining multiple minimally-overlapping paths between nodes in a network |
US6631402B1 (en) | 1997-09-26 | 2003-10-07 | Worldcom, Inc. | Integrated proxy interface for web based report requester tool set |
US6381644B2 (en) * | 1997-09-26 | 2002-04-30 | Mci Worldcom, Inc. | Integrated proxy interface for web based telecommunications network management |
US6134315A (en) * | 1997-09-30 | 2000-10-17 | Genesys Telecommunications Laboratories, Inc. | Metadata-based network routing |
US6894994B1 (en) | 1997-11-03 | 2005-05-17 | Qualcomm Incorporated | High data rate wireless packet data communications system |
US6266695B1 (en) | 1997-12-23 | 2001-07-24 | Alcatel Usa Sourcing, L.P. | Telecommunications switch management system |
US6339595B1 (en) | 1997-12-23 | 2002-01-15 | Cisco Technology, Inc. | Peer-model support for virtual private networks with potentially overlapping addresses |
KR100269146B1 (en) * | 1997-12-29 | 2000-10-16 | 윤종용 | Gateway device in atm-based access network |
US6047330A (en) | 1998-01-20 | 2000-04-04 | Netscape Communications Corporation | Virtual router discovery system |
US6175867B1 (en) | 1998-03-23 | 2001-01-16 | Mci World Com, Inc. | System and method for managing networks addressed via common network addresses |
US6459682B1 (en) * | 1998-04-07 | 2002-10-01 | International Business Machines Corporation | Architecture for supporting service level agreements in an IP network |
US6278708B1 (en) | 1998-04-10 | 2001-08-21 | Cisco Technology, Inc. | Frame relay access device with user-configurable virtual circuit bundling |
US6249519B1 (en) | 1998-04-16 | 2001-06-19 | Mantra Communications | Flow based circuit steering in ATM networks |
US6639897B1 (en) | 1998-04-22 | 2003-10-28 | Nippon Telegraph And Telephone Corporation | Communication network of linked nodes for selecting the shortest available route |
US6434619B1 (en) * | 1998-04-29 | 2002-08-13 | Alcatel Canada Inc. | Internet-enabled service management system and method |
US6317748B1 (en) * | 1998-05-08 | 2001-11-13 | Microsoft Corporation | Management information to object mapping and correlator |
CN1214689C (en) * | 1998-06-19 | 2005-08-10 | 杜松网络公司 | Device for performing IP forwarding and ATM switching |
US6226788B1 (en) * | 1998-07-22 | 2001-05-01 | Cisco Technology, Inc. | Extensible network management system |
US6286038B1 (en) | 1998-08-03 | 2001-09-04 | Nortel Networks Limited | Method and apparatus for remotely configuring a network device |
US6697360B1 (en) | 1998-09-02 | 2004-02-24 | Cisco Technology, Inc. | Method and apparatus for auto-configuring layer three intermediate computer network devices |
US6338092B1 (en) | 1998-09-24 | 2002-01-08 | International Business Machines Corporation | Method, system and computer program for replicating data in a distributed computed environment |
US6856676B1 (en) * | 1998-10-15 | 2005-02-15 | Alcatel | System and method of controlling and managing voice and data services in a telecommunications network |
US6608816B1 (en) | 1998-11-18 | 2003-08-19 | Nortel Networks Limited | Method and apparatus for providing differentiated services using a multi-level queuing mechanism |
US6466976B1 (en) | 1998-12-03 | 2002-10-15 | Nortel Networks Limited | System and method for providing desired service policies to subscribers accessing the internet |
EP1142227A2 (en) | 1998-12-23 | 2001-10-10 | Nokia Wireless Routers, Inc. | A unified routing scheme for ad-hoc internetworking |
US6449650B1 (en) | 1999-02-01 | 2002-09-10 | Redback Networks Inc. | Methods and apparatus for deploying quality of service policies on a data communication network |
JP3465620B2 (en) * | 1999-03-17 | 2003-11-10 | 日本電気株式会社 | Virtual private network construction system |
US6658013B1 (en) | 1999-03-23 | 2003-12-02 | Nortel Networks Limited | Method and apparatus for ensuring survivability of inter-ring traffic |
US7000014B2 (en) * | 1999-04-02 | 2006-02-14 | Nortel Networks Limited | Monitoring a virtual private network |
US6542515B1 (en) | 1999-05-19 | 2003-04-01 | Sun Microsystems, Inc. | Profile service |
US6542466B1 (en) | 1999-05-20 | 2003-04-01 | Motorola, Inc. | Communication network method and apparatus |
US6938097B1 (en) | 1999-07-02 | 2005-08-30 | Sonicwall, Inc. | System for early packet steering and FIFO-based management with priority buffer support |
US6697359B1 (en) | 1999-07-02 | 2004-02-24 | Ancor Communications, Inc. | High performance switch fabric element and switch systems |
US6990103B1 (en) | 1999-07-13 | 2006-01-24 | Alcatel Canada Inc. | Method and apparatus for providing distributed communication routing |
US6868082B1 (en) | 1999-08-30 | 2005-03-15 | International Business Machines Corporation | Network processor interface for building scalable switching systems |
US6532088B1 (en) | 1999-09-10 | 2003-03-11 | Alcatel | System and method for packet level distributed routing in fiber optic rings |
EP1085711B1 (en) | 1999-09-20 | 2013-06-05 | Christian Prof. Dr. Tschudin | Method and apparatus for processing and forwarding data packets |
US6738371B1 (en) | 1999-09-28 | 2004-05-18 | Ericsson Inc. | Ingress data queue management in a packet data router |
US6556544B1 (en) | 1999-10-22 | 2003-04-29 | Nortel Networks Limited | Method and system for provisioning network resources for dynamic multicast groups |
US6775267B1 (en) | 1999-12-30 | 2004-08-10 | At&T Corp | Method for billing IP broadband subscribers |
JP2001202371A (en) | 2000-01-19 | 2001-07-27 | Sony Corp | Data communication system and receiver to be used therefor |
US6496935B1 (en) | 2000-03-02 | 2002-12-17 | Check Point Software Technologies Ltd | System, device and method for rapid packet filtering and processing |
US6985905B2 (en) * | 2000-03-03 | 2006-01-10 | Radiant Logic Inc. | System and method for providing access to databases via directories and other hierarchical structures and interfaces |
US6980526B2 (en) * | 2000-03-24 | 2005-12-27 | Margalla Communications, Inc. | Multiple subscriber videoconferencing system |
US6631519B1 (en) * | 2000-03-30 | 2003-10-07 | Microsoft Corporation | Automated schema and interface generation |
US6954429B2 (en) | 2000-04-05 | 2005-10-11 | Dyband Corporation | Bandwidth control system |
US20010048661A1 (en) | 2000-05-24 | 2001-12-06 | David Clear | Method and apparatus for multi-protocol redundant router protocol support |
US6414595B1 (en) | 2000-06-16 | 2002-07-02 | Ciena Corporation | Method and system for processing alarm objects in a communications network |
US6424657B1 (en) * | 2000-08-10 | 2002-07-23 | Verizon Communications Inc. | Traffic queueing for remote terminal DSLAMs |
US6883170B1 (en) | 2000-08-30 | 2005-04-19 | Aspect Communication Corporation | Method and system to maintain a hierarchy of instantiated application objects and to enable recovery from an applications failure |
US8250357B2 (en) * | 2000-09-13 | 2012-08-21 | Fortinet, Inc. | Tunnel interface for securing traffic over a network |
WO2002061525A2 (en) * | 2000-11-02 | 2002-08-08 | Pirus Networks | Tcp/udp acceleration |
US7313614B2 (en) * | 2000-11-02 | 2007-12-25 | Sun Microsystems, Inc. | Switching system |
US6985956B2 (en) * | 2000-11-02 | 2006-01-10 | Sun Microsystems, Inc. | Switching system |
US20020075901A1 (en) | 2000-12-19 | 2002-06-20 | Bruce Perlmutter | Bandwidth management for tunneling servers |
US7131140B1 (en) * | 2000-12-29 | 2006-10-31 | Cisco Technology, Inc. | Method for protecting a firewall load balancer from a denial of service attack |
US7054291B2 (en) * | 2001-01-22 | 2006-05-30 | Telefonaktiebolaget Lm Ericsson (Publ) | Method of and system for mobile station abbreviated point-to-point protocol negotiation |
US7039720B2 (en) | 2001-01-25 | 2006-05-02 | Marconi Intellectual Property (Ringfence) , Inc. | Dense virtual router packet switching |
US7042843B2 (en) * | 2001-03-02 | 2006-05-09 | Broadcom Corporation | Algorithm for time based queuing in network traffic engineering |
JP4481518B2 (en) | 2001-03-19 | 2010-06-16 | 株式会社日立製作所 | Information relay apparatus and transfer method |
US6944168B2 (en) | 2001-05-04 | 2005-09-13 | Slt Logic Llc | System and method for providing transformation of multi-protocol packets in a data stream |
US7042848B2 (en) | 2001-05-04 | 2006-05-09 | Slt Logic Llc | System and method for hierarchical policing of flows and subflows of a data stream |
US7020143B2 (en) | 2001-06-18 | 2006-03-28 | Ericsson Inc. | System for and method of differentiated queuing in a routing system |
US6940864B2 (en) | 2001-07-16 | 2005-09-06 | International Business Machines Corporation | Network access traffic sorter |
US7054311B2 (en) * | 2001-07-27 | 2006-05-30 | 4198638 Canada Inc. | Methods and apparatus for storage and processing of routing information |
US7342917B2 (en) | 2001-10-02 | 2008-03-11 | Comverse, Inc. | Multimedia personalized call management (MPCM) |
CA2361971A1 (en) * | 2001-11-14 | 2003-05-14 | Michael Gazier | A system and method for increasing the speed of activating dsl service |
US7379465B2 (en) | 2001-12-07 | 2008-05-27 | Nortel Networks Limited | Tunneling scheme optimized for use in virtual private networks |
US20030115308A1 (en) | 2001-12-19 | 2003-06-19 | Michael Best | Network management system architecture |
EP1331766A1 (en) | 2001-12-20 | 2003-07-30 | Alcatel | A telecommunications system employing virtual service network architecture |
US7801155B2 (en) | 2002-03-01 | 2010-09-21 | Verizon Business Global Llc | Resource allocation in virtual routers |
US7197553B2 (en) | 2002-04-19 | 2007-03-27 | Nortel Networks Limited | Network system having a virtual-service-module |
US20030212735A1 (en) | 2002-05-13 | 2003-11-13 | Nvidia Corporation | Method and apparatus for providing an integrated network of processors |
US7116665B2 (en) | 2002-06-04 | 2006-10-03 | Fortinet, Inc. | Methods and systems for a distributed provider edge |
US7177311B1 (en) * | 2002-06-04 | 2007-02-13 | Fortinet, Inc. | System and method for routing traffic through a virtual router-based network switch |
US7161904B2 (en) | 2002-06-04 | 2007-01-09 | Fortinet, Inc. | System and method for hierarchical metering in a virtual router based network switch |
US7203192B2 (en) * | 2002-06-04 | 2007-04-10 | Fortinet, Inc. | Network packet steering |
US6625169B1 (en) | 2002-06-14 | 2003-09-23 | Telesys Technologies, Inc. | Integrated communication systems for exchanging data and information between networks |
US6959194B2 (en) | 2002-09-04 | 2005-10-25 | Cmg International B.V. | SMS-messaging |
US7698456B2 (en) * | 2003-09-29 | 2010-04-13 | Cisco Technology, Inc. | Methods and apparatus to support routing of information |
US7620041B2 (en) * | 2004-04-15 | 2009-11-17 | Alcatel-Lucent Usa Inc. | Authentication mechanisms for call control message integrity and origin verification |
US7831834B2 (en) | 2005-03-14 | 2010-11-09 | Yahoo! Inc | Associating a postmark with a message to indicate trust |
-
2000
- 2000-09-13 US US09/663,457 patent/US7574495B1/en not_active Expired - Fee Related
-
2009
- 2009-08-07 US US12/537,898 patent/US7912936B2/en not_active Expired - Fee Related
-
2011
- 2011-03-17 US US13/050,387 patent/US20110176552A1/en not_active Abandoned
Patent Citations (99)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4667323A (en) * | 1985-09-03 | 1987-05-19 | Allen-Bradley Company, Inc. | Industrialized token passing network |
US4726018A (en) * | 1986-08-25 | 1988-02-16 | International Business Machines Corporation | Method of providing priority access to a transmission communication ring |
US4881244A (en) * | 1986-12-11 | 1989-11-14 | Siemens Aktiengesellschaft | Transmission-reception equipment for a bus system |
US6453406B1 (en) * | 1990-10-17 | 2002-09-17 | Compaq Computer Corporation | Multiprocessor system with fiber optic bus interconnect for interprocessor communications |
US5598414A (en) * | 1991-02-06 | 1997-01-28 | Walser; Robert A. | Access to transmit on a message priority basis |
US6094674A (en) * | 1994-05-06 | 2000-07-25 | Hitachi, Ltd. | Information processing system and information processing method and quality of service supplying method for use with the system |
US5550816A (en) * | 1994-12-29 | 1996-08-27 | Storage Technology Corporation | Method and apparatus for virtual switching |
US6212556B1 (en) * | 1995-11-13 | 2001-04-03 | Webxchange, Inc. | Configurable value-added network (VAN) switching |
US6243580B1 (en) * | 1995-11-30 | 2001-06-05 | Amsc Subsidiary Corporation | Priority and preemption service system for satellite related communication using central controller |
US5825891A (en) * | 1996-01-16 | 1998-10-20 | Raptor Systems, Inc. | Key management for network communication |
US6542502B1 (en) * | 1996-01-26 | 2003-04-01 | International Business Machines Corporation | Multicasting using a wormhole routing switching element |
US6802068B1 (en) * | 1996-10-16 | 2004-10-05 | International Business Machines Corporation | Addressless internetworking |
US5964847A (en) * | 1997-03-10 | 1999-10-12 | International Business Machines Corporation | Mobile client computer interacting with docking device |
US5875290A (en) * | 1997-03-27 | 1999-02-23 | International Business Machines Corporation | Method and program product for synchronizing operator initiated commands with a failover process in a distributed processing system |
US6173399B1 (en) * | 1997-06-12 | 2001-01-09 | Vpnet Technologies, Inc. | Apparatus for implementing virtual private networks |
US20010033580A1 (en) * | 1997-11-19 | 2001-10-25 | Dorsey Paul C. | Multi-protocol packet translator |
US6339782B1 (en) * | 1997-11-21 | 2002-01-15 | International Business Machines Corporation | Persistence mechanism and method for objects |
US6343083B1 (en) * | 1998-04-09 | 2002-01-29 | Alcatel Usa Sourcing, L.P. | Method and apparatus for supporting a connectionless communication protocol over an ATM network |
US6820210B1 (en) * | 1998-04-27 | 2004-11-16 | Cisco Technology, Inc. | System and method for fault recovery for a two line bi-directional ring network |
US6625650B2 (en) * | 1998-06-27 | 2003-09-23 | Intel Corporation | System for multi-layer broadband provisioning in computer networks |
US6680922B1 (en) * | 1998-07-10 | 2004-01-20 | Malibu Networks, Inc. | Method for the recognition and operation of virtual private networks (VPNs) over a wireless point to multi-point (PtMP) transmission system |
US6640248B1 (en) * | 1998-07-10 | 2003-10-28 | Malibu Networks, Inc. | Application-aware, quality of service (QoS) sensitive, media access control (MAC) layer |
US6438612B1 (en) * | 1998-09-11 | 2002-08-20 | Ssh Communications Security, Ltd. | Method and arrangement for secure tunneling of data between virtual routers |
US20020062344A1 (en) * | 1998-09-11 | 2002-05-23 | Tatu Ylonen | Method and arrangement for secure tunneling of data between virtual routers |
US20050055306A1 (en) * | 1998-09-22 | 2005-03-10 | Science Applications International Corporation | User-defined dynamic collaborative environments |
US6920146B1 (en) * | 1998-10-05 | 2005-07-19 | Packet Engines Incorporated | Switching device with multistage queuing scheme |
US6493349B1 (en) * | 1998-11-13 | 2002-12-10 | Nortel Networks Limited | Extended internet protocol virtual private network architectures |
US6324583B1 (en) * | 1998-11-17 | 2001-11-27 | International Business Machines Corp. | Method and apparatus for enabling communication between dissimilar protocol stacks |
US6614781B1 (en) * | 1998-11-20 | 2003-09-02 | Level 3 Communications, Inc. | Voice over data telecommunications network architecture |
US6134226A (en) * | 1998-12-31 | 2000-10-17 | Motorola, Inc. | Method and system for allocating a system resource to subscribers of a wireless communications system |
US6487666B1 (en) * | 1999-01-15 | 2002-11-26 | Cisco Technology, Inc. | Intrusion detection signature analysis using regular expressions and logical operators |
US6738821B1 (en) * | 1999-01-26 | 2004-05-18 | Adaptec, Inc. | Ethernet storage protocol networks |
US6192051B1 (en) * | 1999-02-26 | 2001-02-20 | Redstone Communications, Inc. | Network router search engine using compressed tree forwarding table |
US6246682B1 (en) * | 1999-03-05 | 2001-06-12 | Transwitch Corp. | Method and apparatus for managing multiple ATM cell queues |
US6807181B1 (en) * | 1999-05-19 | 2004-10-19 | Sun Microsystems, Inc. | Context based control data |
US6553423B1 (en) * | 1999-05-27 | 2003-04-22 | Cisco Technology, Inc. | Method and apparatus for dynamic exchange of capabilities between adjacent/neighboring networks nodes |
US6778502B2 (en) * | 1999-06-18 | 2004-08-17 | Savvis, Inc. | On-demand overlay routing for computer-based communication networks |
US6694437B1 (en) * | 1999-06-22 | 2004-02-17 | Institute For Information Technology | System and method for on-demand access concentrator for virtual private networks |
US6994994B1 (en) * | 1999-07-20 | 2006-02-07 | Compugent Ltd | Splice variants of CD40-receptor |
US6980528B1 (en) * | 1999-09-20 | 2005-12-27 | Broadcom Corporation | Voice and data exchange over a packet based network with comfort noise generation |
US6785691B1 (en) * | 1999-10-13 | 2004-08-31 | Avaya Technology Corp. | Object oriented processing system and data sharing environment for applications therein |
US6629128B1 (en) * | 1999-11-30 | 2003-09-30 | Recursion Software, Inc. | System and method for distributed processing in a computer network |
US6775284B1 (en) * | 2000-01-07 | 2004-08-10 | International Business Machines Corporation | Method and system for frame and protocol classification |
US6785224B2 (en) * | 2000-03-06 | 2004-08-31 | Fujitsu Limited | Ring configuring method and node apparatus used in the ring |
US20010028636A1 (en) * | 2000-03-10 | 2001-10-11 | Robert Skog | Method and apparatus for mapping an IP address to an MSISDN number within a service network |
US20020023171A1 (en) * | 2000-03-20 | 2002-02-21 | Garrett John W. | Service selection in a shared access network using policy routing |
US7096495B1 (en) * | 2000-03-31 | 2006-08-22 | Intel Corporation | Network session management |
US6701449B1 (en) * | 2000-04-20 | 2004-03-02 | Ciprico, Inc. | Method and apparatus for monitoring and analyzing network appliance status information |
US6763236B2 (en) * | 2000-06-30 | 2004-07-13 | Nokia Mobile Phones, Ltd. | Resource allocating and service providing over a wireless network |
US6920580B1 (en) * | 2000-07-25 | 2005-07-19 | Network Appliance, Inc. | Negotiated graceful takeover in a node cluster |
US6668282B1 (en) * | 2000-08-02 | 2003-12-23 | International Business Machines Corporation | System and method to monitor and determine if an active IPSec tunnel has become disabled |
US6816462B1 (en) * | 2000-08-02 | 2004-11-09 | International Business Machines Corporation | System and method to determine connectivity of a VPN secure tunnel |
US20020150093A1 (en) * | 2000-08-16 | 2002-10-17 | Maximilian Ott | High-performance addressing and routing of data packets with semantically descriptive labels in a computer network |
US7272643B1 (en) * | 2000-09-13 | 2007-09-18 | Fortinet, Inc. | System and method for managing and provisioning virtual routers |
US7885207B2 (en) * | 2000-09-13 | 2011-02-08 | Fortinet, Inc. | Managing and provisioning virtual routers |
US7912936B2 (en) * | 2000-09-13 | 2011-03-22 | Nara Rajagopalan | Managing interworking communications protocols |
US7639632B2 (en) * | 2000-09-13 | 2009-12-29 | Fortinet, Inc. | System and method for managing and provisioning virtual routers |
US6822958B1 (en) * | 2000-09-25 | 2004-11-23 | Integrated Device Technology, Inc. | Implementation of multicast in an ATM switch |
US20040037379A1 (en) * | 2000-12-07 | 2004-02-26 | Nadim Khlat | Multi-mode radio communications device using a common reference oscillator |
US20020071389A1 (en) * | 2000-12-09 | 2002-06-13 | Hyun-Chul Seo | Data structure for implementation of traffic engineering function in multiprotocol label switching system and storage medium for storing the same |
US20020097730A1 (en) * | 2001-01-25 | 2002-07-25 | Cresent Networks, Inc. | Network device virtual Interface |
US7225259B2 (en) * | 2001-02-21 | 2007-05-29 | Nokia Inc. | Service tunnel over a connectionless network |
US20100146098A1 (en) * | 2001-04-24 | 2010-06-10 | Hitachi, Ltd | Intergrated service management system |
US6922774B2 (en) * | 2001-05-14 | 2005-07-26 | The United States Of America As Represented By The National Security Agency | Device for and method of secure computing using virtual machines |
US20100189016A1 (en) * | 2001-06-28 | 2010-07-29 | Fortinet, Inc. | Identifying nodes in a ring network |
US20030026262A1 (en) * | 2001-07-31 | 2003-02-06 | Patrik Jarl | Channel resource allocation arrangement and method |
US7830787B1 (en) * | 2001-09-25 | 2010-11-09 | Cisco Technology, Inc. | Flooding control for multicast distribution tunnel |
US7316029B1 (en) * | 2001-10-25 | 2008-01-01 | Sprint Communications Company L.P. | Network security services architecture |
US7243371B1 (en) * | 2001-11-09 | 2007-07-10 | Cisco Technology, Inc. | Method and system for configurable network intrusion detection |
US7082477B1 (en) * | 2002-04-30 | 2006-07-25 | Cisco Technology, Inc. | Virtual application of features to electronic messages |
US7221945B2 (en) * | 2002-05-03 | 2007-05-22 | Leapstone Systems, Inc. | System and method for establishing and controlling access to network resources |
US7187676B2 (en) * | 2002-06-04 | 2007-03-06 | Sun Microsystems, Inc. | Apparatus and method for steering a communication to an open stream |
US20100220732A1 (en) * | 2002-06-04 | 2010-09-02 | Fortinet, Inc. | Service processing switch |
US7720053B2 (en) * | 2002-06-04 | 2010-05-18 | Fortinet, Inc. | Service processing switch |
US6907039B2 (en) * | 2002-07-20 | 2005-06-14 | Redback Networks Inc. | Method and apparatus for routing and forwarding between virtual routers within a single network element |
US7925920B2 (en) * | 2002-08-29 | 2011-04-12 | Wilson Talaugon | Fault tolerant routing in a non-hot-standby configuration of a network routing system |
US7761743B2 (en) * | 2002-08-29 | 2010-07-20 | Fortinet, Inc. | Fault tolerant routing in a non-hot-standby configuration of a network routing system |
US20090279567A1 (en) * | 2002-10-16 | 2009-11-12 | Eric White | System and method for dynamic bandwidth provisioning |
US7933269B2 (en) * | 2002-11-18 | 2011-04-26 | Fortinet, Inc. | Hardware-accelerated packet multicasting in a virtual routing system |
US20040095932A1 (en) * | 2002-11-18 | 2004-05-20 | Toshiba America Information Systems, Inc. | Method for SIP - mobility and mobile - IP coexistence |
US20040199569A1 (en) * | 2003-02-18 | 2004-10-07 | Mohan Kalkunte | Method and system for handling traffic for server systems |
US7324489B1 (en) * | 2003-02-18 | 2008-01-29 | Cisco Technology, Inc. | Managing network service access |
US20050108340A1 (en) * | 2003-05-15 | 2005-05-19 | Matt Gleeson | Method and apparatus for filtering email spam based on similarity measures |
US20050002417A1 (en) * | 2003-07-02 | 2005-01-06 | Kelly Thomas J. | Systems and methods for performing protocol conversions in a work machine |
US20100220741A1 (en) * | 2003-08-27 | 2010-09-02 | Fortinet, Inc. | Heterogeneous media packet bridging |
US7957407B2 (en) * | 2003-08-27 | 2011-06-07 | Fortinet, Inc. | Heterogeneous media packet bridging |
US20050163115A1 (en) * | 2003-09-18 | 2005-07-28 | Sitaram Dontu | Distributed forwarding in virtual network devices |
US20050113114A1 (en) * | 2003-11-26 | 2005-05-26 | Nokia Corporation | Method and apparatus to provide efficient routing of packets for a network initiated data session |
US20050147095A1 (en) * | 2003-12-30 | 2005-07-07 | Intel Corporation | IP multicast packet burst absorption and multithreaded replication architecture |
US20050213589A1 (en) * | 2004-03-26 | 2005-09-29 | Samsung Electronics Co., Ltd. | Method and system for assigning servers based on server status in a wireless network |
US20090131020A1 (en) * | 2004-05-24 | 2009-05-21 | Van De Groenendaal Joannes G | Wireless manager and method for configuring and securing wireless access to a network |
US20100142527A1 (en) * | 2004-09-24 | 2010-06-10 | Fortinet, Inc. | Scalable IP-Services Enabled Multicast Forwarding with Efficient Resource Utilization |
US20110122872A1 (en) * | 2004-09-24 | 2011-05-26 | Fortinet, Inc. | Scalable ip-services enabled multicast forwarding with efficient resource utilization |
US7843813B2 (en) * | 2004-11-18 | 2010-11-30 | Fortinet, Inc. | Managing hierarchically organized subscriber profiles |
US7869361B2 (en) * | 2004-11-18 | 2011-01-11 | Fortinet, Inc. | Managing hierarchically organized subscriber profiles |
US7961615B2 (en) * | 2004-11-18 | 2011-06-14 | Fortinet, Inc. | Managing hierarchically organized subscriber profiles |
US7293355B2 (en) * | 2005-04-21 | 2007-11-13 | Endicott Interconnect Technologies, Inc. | Apparatus and method for making circuitized substrates in a continuous manner |
US20100146627A1 (en) * | 2006-03-01 | 2010-06-10 | Fortinet, Inc. | Electronic message and data tracking system |
US7324889B2 (en) * | 2006-03-20 | 2008-01-29 | Nissan Motor Co., Ltd. | Intake-air quantity control system of engine |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110225282A1 (en) * | 2010-03-15 | 2011-09-15 | Electronics And Telecommunications Research Institute | Apparatus and method for virtualizing of network device |
US8862714B2 (en) * | 2010-03-15 | 2014-10-14 | Electronics And Telecommunications Research Institute | Apparatus and method for virtualizing of network device |
CN103051535A (en) * | 2012-12-18 | 2013-04-17 | 华为技术有限公司 | Data access method, data access device and data access system |
CN109845302A (en) * | 2016-10-05 | 2019-06-04 | 信实资讯通信公司 | System and method for automatic identification and optimization overshoot cell |
CN109120726A (en) * | 2018-10-30 | 2019-01-01 | 全讯汇聚网络科技(北京)有限公司 | A kind of multi-router VPN automatic network-building method and system based on collection medium-long range control |
Also Published As
Publication number | Publication date |
---|---|
US7912936B2 (en) | 2011-03-22 |
US7574495B1 (en) | 2009-08-11 |
US20090300159A1 (en) | 2009-12-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7912936B2 (en) | Managing interworking communications protocols | |
US7639632B2 (en) | System and method for managing and provisioning virtual routers | |
Gleeson et al. | A framework for IP based virtual private networks | |
US7489700B2 (en) | Virtual access router | |
CA2350711C (en) | Managing internet protocol connection oriented services | |
US7962602B1 (en) | Centralized management of quality of service (QoS) information for data flows | |
Muthukrishnan et al. | A core mpls ip vpn architecture | |
JP2006508605A (en) | Hierarchical resource management configuration and method in a hierarchical network architecture | |
US7500196B2 (en) | Method and system for generating route distinguishers and targets for a virtual private network | |
WO2018233580A1 (en) | Method, controller and system for establishing forwarding path in network | |
Callon et al. | A framework for layer 3 provider-provisioned virtual private networks (ppvpns) | |
CN112671650B (en) | End-to-end SR control method, system and readable storage medium under SD-WAN scene | |
Wu et al. | YANG data model for L3VPN service delivery | |
Gleeson et al. | RFC2764: A framework for IP based virtual private networks | |
Ogbu et al. | Cloud based virtual private networks using IP tunneling for remote site interfaces | |
Litkowski et al. | YANG Data Model for L3VPN service delivery | |
CN115002029A (en) | Traffic forwarding method, device, equipment and storage medium | |
Cisco | CiscoVsmBrowser.idl | |
Cisco | MPLS VPNS with BPX 8650, Configuration | |
Cisco | MPLS VPNS with BPX 8650 | |
Cisco | Provisioning IP VPN Services | |
Cisco | Introduction to Cisco Router Configuration: Student Guide Cisco Internetwork Operating System Release 11.0 | |
CN112737951B (en) | End-to-end SR control method, system and readable storage medium in public and private network mixed scene | |
Carthern et al. | Intermediate LAN Switching | |
Muthukrishnan et al. | RFC2917: A Core MPLS IP VPN Architecture |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |