Normalized lookup and forwarding of different virtual private networks

Abstract

This technique enables normalized lookup and forwarding of various virtual private networks in a multi-site network fabric deployment. A source device on a first Layer 2 site transmits a frame to a destination device on the same subnet but on a second Layer 2 site. The frame is encapsulated and routed to a fabric border node. The fabric border node matches the source subnet to the destination subnet and transmits an address request protocol ("ARP"). In response to not receiving a reply to the ARP, the fabric border node transmits a mapping request to a Layer 3 transport fabric control plane node. The control plane node extracts a destination identifier from the mapping request and determines that the destination identifier is a Layer 2 identifier. The control plane node transmits a mapping reply to the fabric border node, where the frame is re-encapsulated and forwarded to the destination device.

Description

Technical Field

[0001] This disclosure relates to a comprehensive lookup mechanism for delivering network traffic across all types of Virtual Private Networks (“VPNs”) in a single flow. Background Technology

[0002] In traditional network architecture deployments, the network architecture can provide different types of Virtual Private Network (“VPN”) services, such as Layer 2 VPNs and Layer 3 VPNs. In the context of Layer 2 and Layer 3 network architectures, the process of a Layer 2 architecture forwarding frames from one host on a Layer 2 site to another can become very complex. In traditional systems, it is difficult to forward network traffic between separate Layer 2 sites on the same subnet without a Layer 2 Virtual Extensible Local Area Network (“VXLAN”) network identifier (“VNI”). Traditional systems utilize a custom approach for lookup and forwarding, which is a heterogeneous environment, making implementation and operation complex. Numerous variations present a large number of objects and object instances. The mapping of dependencies between objects is intricate, making automation challenging. Attached Figure Description

[0003] Figure 1 It is a block diagram depicting a multi-site network structure system based on certain examples.

[0004] Figure 2 It is a block diagram depicting a network structure system based on certain examples.

[0005] Figure 3 It is a block diagram depicting the second-level frame based on some examples.

[0006] Figure 4 It is a block diagram depicting a Layer 2 frame encapsulated by a Virtual Extensible Local Area Network (“VXLAN”) based on certain examples.

[0007] Figure 5 It is a block diagram illustrating a normalized approach to finding and forwarding Virtual Private Networks (“VPNs”) based on certain examples.

[0008] Figure 6 It is a block diagram illustrating a method for routing VXLAN-encapsulated Layer 2 frames to structure boundary nodes, based on some examples.

[0009] Figure 7 It is a block diagram depicting a method for transmitting mapping requests to a transmission control plane node, based on certain examples.

[0010] Figure 8This is a block diagram illustrating a method for transmitting mapping responses to structural boundary nodes, based on certain examples.

[0011] Figure 9 It is a block diagram depicting computing machines and modules based on certain examples. Detailed Implementation

[0012] Overview

[0013] Various aspects of the invention are set forth in the independent claims, and preferred features are set forth in the dependent claims. A feature of one aspect may be applied alone to any aspect or in combination with other aspects to any aspect.

[0014] This technology allows for the normalized lookup and forwarding of various Virtual Private Networks (“VPNs”). Example VPNs include remote access VPNs, intranet-based site-to-site VPNs, and extranet-based site-to-node VPNs. VPNs can be Layer 2 or Layer 3 VPNs. Layer 2 VPNs integrate Layer 2 traffic over Internet Protocol (“IP”) / Multiprotocol Label Switching (“MPLS”) networks, such as Ethernet, Frame Relay, Asynchronous Transfer Mode (“ATM”), High-Level Data Link Control (“HDLC”), and Point-to-Point (“PPP”). Layer 3 VPNs use Border Gateway Protocol (“BGP”) to allocate VPN-related information. Layer 3 VPNs leverage Virtual Routing and Forwarding (“VRF”) to create and manage user data and utilize a combination of IP-based and MPLS-based networking technologies.

[0015] VPNs can also include network infrastructure. Network infrastructure is a network upper layer; it is the logical topology of the virtual connected devices and is built on top of any physical lower-layer topology. Examples of network upper layers include Generic Routing Encapsulation (“GRE”) or Multipoint Generic Cabling Encapsulation (“mGRE”), Multiprotocol Label Switching (“MPLS”), Virtual Private LAN Service (“VPLS”), Internet Protocol Security (“IPSec”), Dynamic Multipoint Virtual Private Network (“DMVPN”), Control and Configuration of Wireless Access Points (“CAPWAP”), Location ID Separation Protocol (“LISP”), Upper Layer Transport Virtualization (“OTV”), Dynamic Structure Automation (“DFA”), and Application-Centric Infrastructure (“ACI”).

[0016] The source host device within the first Layer 2 network architecture creates a Layer 2 frame to transmit it to the destination host device within the second Layer 2 network architecture. The first and second Layer 2 network architectures have the same subnet address but are located at different sites.

[0017] The source host device transmits the Layer 2 frame to the structure edge node within the first Layer 2 network structure. The structure edge node encapsulates the Layer 2 frame with a Virtual Extensible Local Area Network (“VXLAN”) header and transmits the VXLAN-encapsulated frame to the structure boundary node within the first Layer 2 network structure.

[0018] The structural boundary node decapsulates the VXLAN-encapsulated frames to determine the subnet destination identifier (“ID”) and the subnet source ID. The structural boundary node then determines whether the destination ID matches the source ID. If the destination ID does not match the source ID, the structural boundary node accesses the route from the VPN Virtual Private Network Routing and Forwarding (“VRF”) table and forwards the encapsulated frame to the destination host device.

[0019] If the destination ID matches the source ID, the structural boundary node determines whether the destination ID is a Layer 2 VPN. If the destination ID is a Layer 2 VPN, the structural boundary node transmits an Address Request Protocol (“ARP”) over the Layer 2 VPN and does not receive a reply because the address is not within the first Layer 2 network structure.

[0020] After the structural boundary node transmits an ARP request on the Layer 2 VPN and receives no reply, it forwards a mapping request for the Layer 3 VXLAN Network Identifier (“VNI”) to the Layer 3 transport structure. The transport control plane node within the Layer 3 transport structure receives the mapping request.

[0021] The transport control plane (TDC) retrieves the VNI from the mapping request. The TDC node determines whether the VNI is a Layer 2 VNI, a Layer 3 VNI, or an unrecognized VNI. If the TDC node determines the VNI is a Layer 3 VNI, it stores the mapping associated with the Layer 3 VNI in the Layer 3 cache and returns this information to the structure boundary node in the first Layer 2 network structure. If the TDC node determines the VNI is neither a Layer 2 nor a Layer 3 VNI, it generates a negative mapping response and stores it in both the Layer 2 and Layer 3 caches, and returns this information to the structure boundary node in the first Layer 2 network structure.

[0022] If the transport control plane node determines that the VNI is a Layer 2 VNI, it generates a mapping associated with the Layer 2 VNI and stores it in a Layer 2 buffer. The transport control plane node then transmits the mapping response to the structure boundary node within the first Layer 2 network structure. The structure boundary node re-encapsulates the Layer 2 frame using the mapping information and forwards the encapsulated frame to the Layer 2 VNI, which is a second Layer 2 network structure.

[0023] The second layer 2 network structure's boundary nodes receive encapsulated frames, decapsulate them, and extract the destination Media Access Control ("MAC") address associated with the destination host device from the layer 2 frames. The boundary nodes then forward the encapsulated frames to the edge nodes associated with the destination MAC address. The edge nodes decapsulate the encapsulated frames and forward the layer 2 frames to the destination MAC address.

[0024] This technology allows for standardized lookup and forwarding of various Virtual Private Networks (“VPNs”). It enables Layer 2 services to be provided within a single site and Layer 3 services to be provided across sites in a multi-site network. Independent Layer 2 sites within the same subnet can forward network traffic, while there is no Layer 2 VNI between sites. This technology achieves automated forwarding and lookup in multi-site architectures without requiring manual configuration.

[0025] These and other aspects, objects, features, and advantages of the disclosed technology will become apparent to those skilled in the art upon consideration of the detailed description of the examples shown below.

[0026] Example System Architecture

[0027] Turning now to the accompanying drawings, in which similar reference numerals denote similar (but not necessarily identical) elements, providing detailed examples of the technique.

[0028] Figure 1 This is a block diagram depicting a multi-site network architecture system 100 based on certain examples. While each server, system, and device shown in the architecture is represented by a single instance of the server, system, or device, multiple instances of each server, system, and device may be used. For example... Figure 1 As shown, the multi-site network structure system 100 includes a transmission structure 110, a network structure 120, and a network structure 130.

[0029] Transport structure 110 is a network structure configured to extend example network structures 120 and 130 without extending the network associated with the Virtual Network Identifier (“VNI”). Transport structure 110 can be used for inter-site communication. Transport structure 110 can connect various types of sites, including: software-defined access (“SD-Access”) sites (e.g., Location ID Separation Protocol (“LISP”), Virtual Extensible LAN (“VXLAN”), Cisco TrustSec (“CTS”)), and Internet Protocol (“IP”) sites (e.g., Virtual Private Network Routing and Forwarding Lite (“VRF-LITE”), and Multiprotocol Label Switching (“MPLS”)).

[0030] In one example, transport structure 110 is a Layer 3 network structure. Layer 3 in the Open Systems Interconnection (“OSI”) model is the network layer. Layer 3 network structures are used to transmit variable-length network packets or frames from a source to a destination host via one or more network structures. Layer 3 network structures use the Border Gateway Protocol (“BGP”) as a control plane node protocol to advertise prefixes, perform traffic planning, and label traffic. Layer 3 network structures utilize both Media Access Control (“MAC”) address tables and IP address tables, and handle communication and packet routing between different Virtual Private Networks (“VPNs”).

[0031] Transport structure 110 includes a domain-wide transport control plane node 111. The transport control plane node 111 includes one or more computing devices for tracking endpoints in the network structure and associating endpoints with structure nodes. The transport control plane node 111 implements functions such as a host traceable database (“HTDB”), a mapping server, and a mapping resolver. The HTDB is a central store for endpoint identifiers (“EIDs”) bound to structure edge nodes. The HTDB supports various types of EID lookup keys, such as Internet Protocol version 4 (“IPv4”), Internet Protocol version 6 (“IPv6”), or MAC. The mapping server is used to populate the HTDB. The mapping resolver responds to mapping queries from structure boundary nodes (e.g., structure boundary nodes 122 and 132).

[0032] Multisite network architecture system 100 includes network structures 120 and 130. Although network structures 120 and 130 are shown in the architecture as represented by an instance of each of network structures 120 and 130, multiple instances of each network structure 120 and 130 can be used, and additional network structures can be used. In one example, each network structure 120 and network structure 130 is a Layer 2 network structure. Layer 2 in the OSI model is the data link layer and provides services such as framing of network layer data packets, flow control, multiplexing, physical addressing, switching, Quality of Service (“QoS”), and Virtual Local Area Networks (“VLANs”). Traditional switching operates at Layer 2, where packets are sent to specific switching ports based on their destination MAC address. Layer 2 network structures include devices that can only communicate within the same network. In one example, and as... Figure 1 As described, network structures 120 and 130 are different and independent network sites.

[0033] Network structure 120 includes: control plane node 121, structure boundary node 122, structure edge nodes 123-1 to 123-n, and host devices 124-1 to 124-n. Control plane node 121 includes one or more computing devices for tracking endpoints in the network structure and associating endpoints with structure nodes. Control plane node 121 implements functions such as an HTDB, a mapping server, and a mapping resolver. The HTDB is a central storage for EIDs bound to structure edge nodes. Control plane node 121 receives EID mapping registrations from structure edge nodes (e.g., structure edge nodes 123-1 to 123-n). The mapping server is used to populate the HTDB. The mapping resolver responds to mapping queries from structure edge devices such as structure edge nodes 123-1 to 123-n.

[0034] Network architecture 120 includes structure boundary nodes 122. Although structure boundary node 122 is shown in the architecture as represented by a single instance of a structure boundary node, multiple instances can be used. Each structure boundary node 122 may include one or more computing devices.

[0035] Structural boundary node 122 acts as a gateway between network structure 120 and other network structures (e.g., transport structure 110 and network structure 130). Structural boundary node 122 serves as both an entry point and an exit point for data entering and leaving network structure 120. There are three types of structural boundary nodes 122: internal, external, and a combination of internal and external. If structural boundary node 122 is configured internally to network structure 120, it is used for known routes within network structure 120 and acts as a gateway for a specific network address. If structural boundary node 122 is configured externally to network structure 120, it is used for unknown routes outside network structure 120 and acts as a default exit point. Structural boundary node 122 can also be configured as a combination of internal and external nodes. The combination of internal and external structural boundary nodes 122 can be used for both known and unknown routes.

[0036] Structure boundary node 122 implements the advertisement function for the EID subnet, allowing traffic destined for the EID subnet to enter from outside network structure 120 via structure boundary node 122. Structure boundary node 122 is used to extend network virtualization from inside network structure 120 to outside network structure 120 using external virtual routing and forwarding (“VRF”) instances with VRF-aware routing protocols. Structure boundary node 122 serves as the egress point for the fabric domain of structure edge nodes 123-1 to 123-n. Structure boundary node 122 also maps security information from within network structure 120, thus retaining this security information when exiting network structure 120.

[0037] Network architecture 120 includes edge nodes 123-1 to 123-n. Each edge node 123 may include one or more computing devices. Figure 2 As shown, the number of edge nodes 123 can vary based on the number of endpoint devices (“EPD”) 220 and access points (“AP”) 230 in a particular network structure, or based on any other suitable factor.

[0038] Structure edge node 123 is a structure device that allows access to network structure 120 or is allocated within network structure 120. Structure edge node 123 is responsible for identifying and authenticating structure endpoints, such as static, 802.1X, and Active Directory. Structure edge node 123 and control plane nodes (e.g., control plane node 121) are responsible for endpoint registration (e.g., / 32 or / 128). When an EPD 220 is connected to or detected by structure edge node 123, the EID information associated with each EPD 220 is added to the local HTDB of each structure edge node 123. The EID information can be stored in the EID table of the local HTDB. Each structure edge node 123 transmits data stored in its local HTDB to a control plane node (e.g., control plane node 121) to populate the control plane node's HTDB. The edge node 123 identifies and authenticates EPD 220 and AP 230, and admits, encapsulates / decapsulates, and forwards traffic to and from EPD 220 and AP 230, which are connected to the edge of network structure 120.

[0039] Traffic between structure edge node 123 and structure boundary node 122 is encapsulated in a VXLAN header or other suitable header. In the example where network structure 120 is a Layer 2 network structure, EPD 220 can use the same MAC address within the encapsulation and can move between different structure edge nodes 123.

[0040] Network structure 120 includes one or more host devices 124-1 to 124-n. Host device 124 is a computer or other device connected to network structure 120 via wired or wireless telecommunications mechanisms. Host device 124 can be used as a server to provide information resources, services, and applications to other users or hosts within network structure 120 or to users or hosts outside network structure 120 (e.g., network structure 130). Each host device 124 can communicate with structure edge node 123 via wired or wireless telecommunications mechanisms.

[0041] Network structure 130 includes: control plane nodes 131, structure boundary nodes 132, structure edge nodes 133-1 to 133-n, and host devices 134-1 to 134-n. For example... Figure 1 As shown, network structure 130 is a component of multi-site network structure system 100, residing at a site separate from network structure 120. The components of network structure 130, control plane node 131, structure boundary node 132, structure edge nodes 133-1 to 133-n, and host devices 134-1 to 134-n function in a manner similar to the corresponding components previously described with respect to network structure 120, control plane node 121, structure boundary node 122, structure edge nodes 123-1 to 123-n, and host devices 124-1 to 124-n. Each structure edge node 133 can communicate with one or more host devices, such as host devices 134-1 to 134-n previously described with respect to structure edge node 123.

[0042] Each multisite network architecture system 100 includes a wired or wireless telecommunications mechanism through which network devices (including architectures 110, 120, and 130, and devices 111, 121, 122, 123, 124, 131, 132, 133, and 134) can communicate and exchange data. Each multisite network architecture system 100 may include, be implemented as, or be part of: wired or wireless communication networks, cloud computing environments, or any other suitable architecture or system that facilitates the communication of signals, data, and / or messages (generally referred to as data). For example, the multisite network architecture system 100 may include one or more of the following: Local Area Network (“LAN”), Wide Area Network (“WAN”), Intranet, Internet, Storage Area Network (“SAN”), Personal Area Network (“PAN”), Metropolitan Area Network (“MAN”), Wireless Local Area Network (“WLAN”), Virtual Private Network (“VPN”), Cellular or other mobile communication networks, Wireless connectivity, near field communication (“NFC”) connectivity, and any combination thereof, as well as any other suitable architecture or system that facilitates the communication of signals, data, and / or messages. Throughout the discussion of the example embodiments, it should be understood that the terms “data” and “information” are used interchangeably herein to refer to text, images, audio, video, or any other form of information that may exist in a computer-based environment.

[0043] Figure 2 This is a block diagram depicting a network structure system 200 based on certain examples. For example... Figure 2 As shown, the network structure system 200 includes structural boundary nodes 122, structural intermediate nodes 210, structural edge nodes 123, EPDs 220, and APs 230. (Previous reference) Figure 1 The structural boundary node 122 and structural edge node 123 are described.

[0044] The network architecture system 200 includes intermediate nodes 210-1 to 210-n. Each intermediate node 210 may include one or more computing devices. Although Figure 2 Four structural intermediate nodes 210 are depicted, but the number of structural intermediate nodes can vary based on the number of EPD 220 and AP230 in a particular network structure.

[0045] The intermediate node 210 may be part of a Layer 2 network used for interconnection between the structure boundary node 122 and the structure edge node 123. The intermediate node 210 is equivalent to a distribution switch and routes and transmits traffic within the network structure system 200. The intermediate node 210 has a maximum transmission unit (“MTU”) requirement to accommodate large packets encapsulated with VXLAN information.

[0046] Network architecture system 200 includes EPDs 220-1 to 220-n. Although Figure 2 Four EPD220s are depicted, but the number of EPD 220s can vary based on a specific network architecture 200 configuration with a large deployment (e.g., a deployment scale of up to 50,000 EPDs or more).

[0047] Although EPD 220-1 to 220-n are in Figure 2While depicted as similar devices, each EPD 220 can be one of many different types of computing devices. Each EPD 220 may include a wired or wireless telecommunications mechanism through which it communicates and exchanges data. Each EPD 220 may be a server, a personal computer, a mobile device (e.g., a laptop, handheld computer, tablet, netbook, personal digital assistant (“PDA”), video game device, GPS positioning device, cellular phone, smartphone, or other mobile device), a television with one or more processors embedded therein and / or coupled thereto, an Internet of Things (“IoT”) device, or other suitable technologies (including or coupled to a web browser or other applications for communication via the network infrastructure system 200).

[0048] Network architecture system 200 includes APs 230-1 to 230-n. Although Figure 2 Two AP230s are depicted, but the number of AP 230s can vary based on a specific network architecture system 200 with a large deployment (e.g., a deployment range of up to 2000 EPDs or more).

[0049] Although AP 230-1 to 230-n in Figure 2 While described as similar devices, each AP 230 can be one of many different types of network hardware devices. Each AP 230 may include one or more radio devices for transmitting and receiving radio signals. Each radio device may have an internal antenna, or both an internal and external antenna. The 802.11 standard specifies the radio frequency used by each AP 230. Each AP 230 can connect to a router (…). Figure 2 (not shown in the image), or it could be a component of the router itself.

[0050] Each AP 230 applies specific functions for the wireless media. For example, each AP 230 applies radio and service set identifier (“SSID”) policies, security policies, and peer blocking policies. Each AP 230 can translate 802.11 traffic and forward traffic using VXLAN encapsulation or other suitable encapsulation.

[0051] Each network architecture system 200 includes a wired or wireless telecommunications mechanism through which system devices (including devices 122, 123, 210, 220, and 230) can communicate and exchange data. Each network architecture system 200 may include, be implemented as, or be part of: a wired or wireless communication network, a cloud computing environment, or any other suitable architecture or system that facilitates the communication of signals, data, and / or messages (generally referred to as data). For example, network architecture system 200 may include one or more of the following: LAN, WAN, intranet, Internet, SAN, PAN, MAN, WLAN, VPN, cellular or other mobile communication network. Wireless connectivity, NFC connectivity, any combination thereof, and any other suitable architecture or system that facilitates the communication of signals, data, and / or messages. Throughout the discussion of the example embodiments, it should be understood that the terms "data" and "information" are used interchangeably herein to refer to text, images, audio, video, or any other form of information that may exist in a computer-based environment.

[0052] Figure 3 This is a block diagram depicting a Layer 2 frame 300 based on certain examples. The Layer 2 frame 300 may be referred to as a Packet or Protocol Data Unit (“PDU”). The Layer 2 frame 300 includes a MAC header 310, data 320, and a Cyclic Redundancy Check (“CRC”) sum check 330. In one example, the Layer 2 frame 300 is generated by a host device associated with a network structure, such as host device 124 with network structure 120 or host device 134 with network structure 130. The Layer 2 frame begins with a MAC header 310. The MAC header 310 includes a destination MAC address 311, a source MAC address 312, and an Ethernet type 313.

[0053] Destination MAC address 311 is the MAC address associated with the device to which Layer 2 frame 300 will be transmitted. Source MAC address 312 is the MAC address associated with the device that generated Layer 2 frame 300.

[0054] Ethernet Type 313 is a field in an Ethernet frame that indicates which protocol is used to encapsulate the frame's payload. For example, the protocol of payload 321 in Layer 2 frame 300. Example Ethernet Type 313 includes IPv4 datagrams, Address Request Protocol (“ARP”) frames, IPv6 frames, or IEEE 802.1Q tags.

[0055] The Layer 2 frame 300 includes data 320 as an intermediate portion, in which payload 321 data is transmitted to the destination MAC address 311. The Layer 2 frame 300 may end with a frame check sequence CRC checksum 330, for example, the CRC checksum 330 is a 32-bit cyclic redundancy check used to detect possible corruption of data during transmission.

[0056] Figure 4 This is a block diagram depicting a VXLAN-encapsulated Layer 2 frame 400, based on certain examples. The VXLAN-encapsulated Layer 2 frame 400 includes: an external MAC header 410, an external IP header 420, a User Data Protocol (“UDP”) header 430, a VXLAN header 440, and a Layer 2 frame 300 (previously referenced). Figure 3 (As described above). Encapsulation is the process of placing a header (and sometimes a trailer) around the data. In one example, the data is layer 2 frame 300.

[0057] The external MAC header 410 includes: destination MAC address 411, source MAC address 412, VLAN type 413, VLAN identifier (“ID”) 414, and Ethernet type 415. Destination MAC address 411 is the next-hop MAC address. Source MAC address 412 is the source VXLAN tunnel endpoint (“VTEP”) MAC address. VTEP is the endpoint responsible for encapsulating Layer 2 frames (e.g., Layer 2 frame 300).

[0058] VLAN type 413 can be a management VLAN, data VLAN, voice VLAN, default VLAN, local VLAN, or any other suitable VLAN type. VLAN type 413 is identified based on VLAN ID 414. VLAN ID 414 is an identifier number, typically between 0 and 4095. In one example, if VLAN type 413 is the default VLAN, then VLAN ID 414 could be VLAN 1. Ethernet type 415 is a field in Ethernet frames that indicates which protocol is encapsulated in the frame's payload. Example Ethernet type 415 includes IPv4 datagrams, ARP frames, IPv6 frames, or IEEE 802.1Q tags.

[0059] The external IP header 420 includes an IP header / miscellaneous 421, a protocol (UDP) 422, a header checksum 423, a source IP address 424, and a destination IP address 425. The IP header / miscellaneous 421 includes information used by a forwarding protocol (e.g., protocol (UPD) 422) to determine the next node. The IP header / miscellaneous 421 may also include miscellaneous data associated with routing information.

[0060] Protocol (UPD) 422 is an 8-bit field with a protocol number used to identify the protocol. Example protocol number codes can include any protocol number managed and assigned by the Internet Assigned Numbers Authority (“IANA”). An example protocol number could be 0x11, which represents UDP.

[0061] For example, header checksum 423 is a 32-bit cyclic redundancy check, used to detect possible data corruption during transmission. Source IP address 424 is the IP address of the VTEP that initiated Layer 2 frame 300, for example, source MAC address 312. Destination IP address 425 is the VTEP to which Layer 2 frame 300 will be transmitted, for example, destination MAC address 311.

[0062] The UDP header 430 includes the source port 431, destination port 432, UDP length 433, and checksum 434. The source port 431 indicates the port of transmission and can be the port from which a response is sent without additional information. The destination port 432 is the port of the device receiving the data, for example, the payload 321 of a Layer 2 frame 300.

[0063] UPD length 433 is a field that specifies the byte length of the UPD header 430 and the UDP data. In one example, the minimum length of UPD length 433 is 8 bytes. Checksum 434 is, for example, a 32-bit cyclic redundancy check, which is used to detect possible corruption of data during transmission.

[0064] The VXLAN header 440 includes a VXLAN flag 441, a segment ID 442, a Virtual Network (“VN”) ID 443, and a reserved byte 444. The VXLAN flag 441 is, for example, an 8-bit field within the VXLAN header 440. In one example, one of the 8 bits is designated for a single (individual, “I”) VXLAN network. The bit value is set to “1” to indicate that the VXLAN header 440 includes a valid VXLAN ID. The remaining 7 bits of the 8-bit field are reserved (“R”), and their bit values ​​are set to “0”.

[0065] Segment ID 442 is an identifier associated with segment routing. Through segment routing, the path from source to destination is encoded in the header as an ordered list of segments. Each segment is identified by Segment ID 442, which consists of a 32-bit integer. VN ID 443 is the VXLAN Network Identifier (“VNI”), which defines the VXLAN broadcast domain. Reserved byte 444 is a byte reserved for additional features that may be incorporated into future deployments.

[0066] The network computing devices and any other computing machines associated with the technologies described herein can be any type of computing machine, such as, but not limited to, those described herein. Figure 9 Those discussed in more detail. For example, each device may include a server, desktop computer, laptop computer, tablet computer, television set in which one or more processors are embedded and / or coupled, smartphone, handheld computer, PDA, router, switch, hub, gateway, modem, access point, bridge, or any other wired or wireless processor-driven device. The computing machines discussed herein may communicate with each other through one or more networks, as well as with other computing machines or communication systems. Each network may include various types of data or communication networks, including those related to… Figure 9 Any network technologies discussed.

[0067] Furthermore, any module associated with any of these computing machines (e.g., the module described herein) or any other module (script, network content, software, firmware, or hardware) associated with the technology described herein can be related to Figure 9 Any modules discussed in more detail.

[0068] The network connection shown is an example, and other means of establishing a communication link between a computer and a device can be used. Furthermore, those skilled in the art who will benefit from this disclosure will understand that... Figure 1-4 The device shown can have any of several other suitable computer system configurations.

[0069] Example process

[0070] The following describes the components of the multi-site network architecture system 100, network architecture system 200, Layer 2 frame 300, and Layer 2 frame 400 encapsulated with Virtual Extensible Local Area Network (“VXLAN”). Figures 5-8 The method shown. Figures 5-8 This method can also be executed on other systems and in other environments. Regarding... Figures 5-8 The operations described herein are implemented as executable code stored on a computer or machine-readable non-transitory tangible storage medium (e.g., floppy disk, hard disk, ROM, EEPROM, non-volatile RAM, CD-ROM, etc.), which is accomplished by the execution of the code based on processor circuitry implemented using one or more integrated circuits; the operations described herein may also be implemented as executable logic (e.g., programmable logic arrays or devices, field-programmable gate arrays, programmable array logic, application-specific integrated circuits, etc.) encoded in one or more non-transitory tangible media for execution.

[0071] Figures 5-8 The method describes routing a Layer 2 frame 300 from a host device 124 in network structure 120 to a destination host device 134 in network structure 130 over transport structure 110. Figures 5-8The method can also be implemented as follows: from host device 124 in network structure 120, across alternative transport structures, or to destination host device in alternative network structures ( Figure 1 (Not shown in the image). Figures 5-8 The method can also be implemented as follows: from host device 134 in network structure 130, across transmission structure 110, to destination host device 124 in network structure 120 or another network structure.

[0072] Figure 5 It is a block diagram of a method 500 for normalizing the lookup and forwarding of Virtual Private Networks (“VPNs”) based on certain examples.

[0073] According to some examples, in box 510, structural boundary node 122 receives a VXLAN-encapsulated Layer 2 frame 400. (References provided) Figure 6 Method 510 describes box 510 in more detail.

[0074] Figure 6 This is a block diagram of a method 510 for routing a VXLAN-encapsulated Layer 2 frame 400 to a structure boundary node 122, based on some examples.

[0075] In box 610, structure edge node 123 receives layer 2 frame 300. In one example, the structure edge node can be any of structure edge nodes 123-1 to 123-n in network structure 120. In one example, the layer 2 frame 300 is transmitted from host device 124 associated with structure edge node 123 to structure edge node 123.

[0076] Layer 2 frame 300 includes the destination MAC address 311 and the source MAC address 312, such as Figure 3 As shown. In one example, source MAC address 312 is associated with host device 124 in network structure 120, while destination MAC address 311 is associated with host device 134 in network structure 130. In one example, and as... Figure 1 As shown, network structure 120 and network structure 130 are different and separate network sites. In this example, network structure 120 and network structure 130 are Layer 2 network structures with the same subnet address.

[0077] In frame 620, structure edge node 123 encapsulates layer 2 frame 300 with a VXLAN header, as follows: Figure 4 As shown in the reference. Figure 4 The encapsulation described above is the process of placing a header (and sometimes a tail) around data (e.g., layer 2 frame 300).

[0078] In box 630, structure edge node 123 transmits a VXLAN-encapsulated Layer 2 frame 400 to structure boundary node 122. The VXLAN-encapsulated Layer 2 frame 400 can be transmitted from structure edge node 123 to structure boundary node 122 via one or more structure intermediate nodes 210. In one example, the structure boundary node can be any one of structure boundary nodes 122-1 to 122-n.

[0079] Method 510 returns from box 630 to Figure 5 The frame is 520.

[0080] In block 520, structural boundary node 122 transmits a mapping request to transmission control plane node 111. (This document references...) Figure 7 Method 520 describes box 520 in more detail.

[0081] According to some examples, Figure 7 A method 520 is described for transmitting a mapping request to a transmission control plane node 111.

[0082] In box 705, structure boundary node 122 receives a VXLAN-encapsulated Layer 2 frame 400 from structure edge node 123 and decapsulates the VXLAN-encapsulated Layer 2 frame 400. Structure boundary node 122 extracts the destination network identifier and source network identifier from the decapsulated VXLAN-encapsulated Layer 2 frame 400. In one example, structure boundary node 122 extracts the destination network identifier and source network identifier from the outer IP header 420 of the decapsulated VXLAN-encapsulated Layer 2 frame 400. Structure boundary node 122 extracts the source IP address 424 and destination IP address 425. In one example, the source IP address 124 can be 10.1.0.0 / 16 and can be an IP address associated with network structure 120. The destination IP address 425 can be 10.1.0.0 / 16 and can be an IP address associated with network structure 130.

[0083] In box 710, structure boundary node 122 determines whether the destination network ID matches the source network ID extracted in box 705. Structure boundary node 122 compares the source IP address 424 with the destination IP address 425. Continuing with the previous example, the source IP address 424 matches the destination IP address 425 of 10.1.0.0 / 16. If the destination network ID does not match the source network ID, the method proceeds to box 715.

[0084] In box 715, structure boundary node 122 accesses the route from the source network ID to the destination network ID from the VPN routing and forwarding table (“VRF”) of the Virtual Private Network (“VPN”) and forwards the VXLAN-encapsulated Layer 2 frame 400 to the structure edge node 123 associated with the destination MAC address 311. In one example, the VPN VRF table may be stored in memory associated with structure boundary node 122. In an alternative example, structure boundary node 122 may send a request to control plane node 121 to provide the route from the source network ID to the destination network ID. Structure boundary node 122 forwards the VXLAN-encapsulated Layer 2 frame 400 via the route from the VPN VRF table to the structure edge node 123 associated with the destination MAC address 311. Structure edge node 123 decapsulates the packet and forwards the Layer 2 frame 300 to the destination MAC address 311.

[0085] Returning to box 710, if structure boundary node 122 determines that the destination network ID matches the source network ID, then method 520 proceeds to box 720.

[0086] In box 720, structure boundary node 122 determines whether the destination network ID is a Layer 2 VPN. In one example, structure boundary node 122 is configured to exchange routing and reachability information between network structures using Border Gateway Protocol (“BGP”). Structure boundary node 122 can be configured to use BGP as the signaling protocol to discover Layer 2 VPNs. If structure boundary node 122 determines that the destination network ID is a Layer 2 VPN, method 520 proceeds to box 725.

[0087] In box 725, structure boundary node 122 transmits an Address Request Protocol (“ARP”) request over a Layer 2 VPN. In one example, the ARP is flooded within the Layer 2 VPN. Flooding is the process of transmitting a VXLAN-encapsulated Layer 2 frame 400 to all ports within network structure 120. Structure boundary node 122 extracts the Layer 2 VNI from the VXLAN-encapsulated Layer 2 frame 400. The VXLAN header 440 includes the Layer 2 VNI as the VN ID 443. ARP is a communication protocol used to discover Layer 2 addresses or link addresses associated with a specific destination address. In this example, structure boundary node 122 identifies the destination network ID as a Layer 2 VPN, but does not identify that the destination MAC address 311 is located in a separate network site (network structure 130). Structure boundary node 122 floods network structure 120 with ARP, requesting a response from destination MAC address 311. Since destination MAC address 311 is not located within network structure 120, structure boundary node 122 does not receive a reply. Since no response was received, method 520 proceeds to box 745.

[0088] In box 745, structure boundary node 122 issues a mapping request for the Layer 3 VNI. In one example, the Layer 3 VNI is associated with transport structure 110, and the mapping request is transmitted to and received by transport control plane node 111. In one example, transport structure 110 is a Layer 3 network structure.

[0089] Method 520 returns from box 745 to Figure 5 The frame is 530.

[0090] Returning to box 720, if structure boundary node 122 determines that the destination network ID is not a Layer 2 VPN, then method 520 proceeds to box 730.

[0091] In box 730, structure boundary node 122 determines whether the destination network ID is local to network structure 120. In one example, structure boundary node 122 transmits a mapping request to control plane node 121. Control plane node 121 uses a previously referenced... Figure 1 The discussed mapping resolver function determines whether a mapping registration with the destination network ID of destination MAC address 311 is stored in the mapping server. If a mapping registration exists in the mapping server, control plane node 121 transmits the mapping response to structure boundary node 122, and method 520 proceeds to block 735.

[0092] In box 735, structure boundary node 122 forwards the VXLAN-encapsulated Layer 2 frame 400 to its local destination. In a continuing example, structure boundary node 122 uses the route mapped back from control plane node 121 to forward the VXLAN-encapsulated Layer 2 frame 400 to structure edge node 123 associated with the destination MAC address 311. Structure edge node 123 decapsulates the VXLAN-encapsulated Layer 2 frame 400 and forwards the Layer 2 frame 300 to the destination MAC address 311.

[0093] Returning to box 730, if no mapping registration exists in the mapping server of control plane node 121, then method 520 proceeds to box 740.

[0094] In box 740, structure boundary node 122 proxies ARP replies. Proxy ARP is a method that allows a proxy device on a given network (e.g., structure boundary node 122 in network structure 120) to respond to ARP queries for addresses not on that network. Proxy ARP allows structure boundary node 122 to answer queries for destination MAC address 311. If structure boundary node 122 is aware of a route to destination MAC address 311, it can receive network traffic, such as VXLAN-encapsulated Layer 2 frames 400, as a proxy address to destination MAC address 311 and route the traffic to destination MAC address 311. However, because destination MAC address 311 is located at a separate site (network structure 130), structure boundary node 122 cannot route VXLAN-encapsulated Layer 2 frames 400 to destination MAC address 311. In this case, method 520 proceeds to box 745 previously described herein.

[0095] As mentioned earlier, return from box 745, method 520 to Figure 5 The box is 530.

[0096] In block 530, the transmission control plane node 111 transmits a mapping response to the structural boundary node 122. (This document references...) Figure 8 Method 530 describes box 530 in more detail.

[0097] In box 805, the transmission control plane node 111 receives a mapping request for a Layer 3 VNI from the structure boundary node 122. In one example, the mapping request consists of VN ID 443 from the VXLAN header 440.

[0098] In box 810, the transmission control plane node 111 uses a mapping resolver to look up the VN ID 443 extracted from the VXLAN header 440. In one example, the VN ID 443 can be a Layer 2 VNI, a Layer 3 VNI, or the transmission control plane node 111 may not recognize the VNI encapsulated within the VXLAN header 440. The mapping resolver function of the transmission control plane node 111 searches for the VN ID 443 extracted from the VXLAN header 440 in the mapping server associated with the transmission control plane node 111.

[0099] In box 815, transport control plane node 111 determines whether VN ID 443 is a Layer 2 VNI. In the continuing example, transport control plane node 111 uses the retrieved mapping to determine whether VN ID 443 is mapped to a Layer 2 VNI.

[0100] In block 815, if the transmission control plane node 111 determines that VN ID 443 is a Layer 2 VNI, then method 530 proceeds to block 835.

[0101] In box 835, the transport control plane node 111 generates a response to the Layer 2 VNI mapping and stores the mapping response in the Layer 2 cache. The mapping response associates VN ID 443 with the retrieved mapping to the Layer 2 VNI in network structure 130.

[0102] In box 840, the transmission control plane node 111 transmits the mapping response to the structural boundary node 122.

[0103] Return from box 840, method 530 Figure 5 The frame is 540.

[0104] Returning to box 815, if transmission control plane node 111 determines that VN ID 443 is not a Layer 2 VNI, then method 530 proceeds to box 820. In box 820, transmission control plane node 111 determines whether VN ID 443 is a Layer 3 VNI. In the continuing example, transmission control plane node 111 uses the retrieved mapping to determine whether VN ID 443 maps to a Layer 3 VNI. If transmission control plane node 111 determines that VN ID 443 is a Layer 3 VNI, then method 530 proceeds to box 825.

[0105] In block 825, transport control plane node 111 generates a response to the Layer 3 VNI mapping and stores the mapping response in the Layer 3 cache. The mapping response associates VN ID 443 with the retrieved mapping to the Layer 3 VNI. Then, method 530 proceeds to block 840, which was discussed earlier.

[0106] Returning to box 820, if the transmission control plane node 111 determines that VN ID 443 is not a Layer 3 VNI, then method 530 proceeds to box 830.

[0107] In block 830, transport control plane node 111 generates a negative mapping response and stores it in the layer 2 and layer 3 caches. In one example, the negative mapping response indicates that transport control plane node 111 cannot retrieve the mapping to the layer 2 VNI or layer 3 VNI associated with VN ID 443. Method 530 then proceeds to block 840, which was discussed earlier.

[0108] As mentioned earlier, method 530 returns from box 840 to Figure 5 Box 540. In box 540, structural boundary node 122 receives a mapping response from transmission control plane node 111 and, based on the instructions in the mapping response, transmits the VXLAN-encapsulated Layer 2 frame 400 to the destination structural boundary node 132. Structural boundary node 122 receives a mapping response associated with VN ID 443 and the Layer 2 VNI of network structure 130. Structural boundary node 122 re-encapsulates the VXLAN-encapsulated Layer 2 frame 400 using the mapping information from the mapping response as the outer header of the VXLAN-encapsulated Layer 2 frame 400. Structural boundary node 122 forwards the re-encapsulated VXLAN-encapsulated Layer 2 frame 400 to the destination structural boundary node 132 associated with the Layer 2 VNI of network structure 130.

[0109] In an alternative example, structure boundary node 122 receives a mapping response associated with VN ID 443 and a Layer 3 VNI. Structure boundary node 122 re-encapsulates the VXLAN-encapsulated Layer 2 frame 400 using the mapping information from the mapping response as the outer header of the VXLAN-encapsulated Layer 2 frame 400. Structure boundary node 122 forwards the re-encapsulated VXLAN-encapsulated Layer 2 frame 400 to the destination structure boundary node associated with the Layer 3 VNI.

[0110] In the second alternative example, structure boundary node 122 receives a negative mapping response indicating that transmission control plane node 111 cannot retrieve the mapping to a Layer 2 VNI or a Layer 3 VNI associated with VN ID 443. Structure boundary node 122 is unable to forward VXLAN-encapsulated Layer 2 frame 400.

[0111] In frame 550, the destination structure boundary node 132 of network structure 130 receives a VXLAN-encapsulated Layer 2 frame 400. The destination structure boundary node 132 decapsulates the VXLAN-encapsulated Layer 2 frame 400 and extracts the destination MAC address 311 from the MAC header 310 of the Layer 2 frame 300 encapsulated within the VXLAN-encapsulated Layer 2 frame 400.

[0112] In box 560, destination structure boundary node 132 routes the VXLAN-encapsulated Layer 2 frame 400 to the destination structure edge node associated with the destination MAC address 311. In one example, the destination structure edge node is destination structure edge node 133. Destination structure boundary node 132 obtains the route from destination structure boundary node 132 to destination structure edge node 133. In one example, the route can be obtained from a local database of destination structure boundary node 132, destination structure boundary node 132 can send a mapping request to control plane node 131 to obtain the route to destination structure edge node 133, or the route can be obtained in any other suitable manner.

[0113] In frame 570, destination structure edge node 133 decapsulates the VXLAN-encapsulated Layer 2 frame 400. Destination structure edge node 133 extracts the destination MAC address 311 from the MAC header 310 of the Layer 2 frame 300.

[0114] In box 580, destination structure edge node 133 forwards Layer 2 frame 300 to destination MAC address 311. In one example, destination MAC address 311 is associated with host device 134 in network structure 130.

[0115] Other examples

[0116] Figure 9 A computing machine 2000 and module 2050 are depicted according to certain examples. The computing machine 2000 may correspond to any of the various computers, servers, mobile devices, embedded systems, or computing systems presented herein. Module 2050 may include one or more hardware or software elements configured to facilitate the computing machine 2000 in performing the various methods and processing functions presented herein. The computing machine 2000 may include various internal or attached components, such as a processor 2010, a system bus 2020, a system memory 2030, a storage medium 2040, an input / output interface 2060, and a network interface 2070 for communicating with a network 2080.

[0117] The computing machine 2000 can be implemented as a conventional computer system, an embedded controller, a laptop, a server, a mobile device, a smartphone, a set-top box, a self-service kiosk, a router or other network node, a vehicle information system, one or more processors associated with a television, a custom machine, any other hardware platform, or any combination or multiple thereof. The computing machine 2000 can also be a distributed system configured to operate using multiple computing machines interconnected via a data network or bus system.

[0118] Processor 2010 may be configured to execute code or instructions to perform the operations and functions described herein, manage request flows and address mappings, and execute computation and generation commands. Processor 2010 may be configured to monitor and control the operation of components in computing machine 2000. Processor 2010 may be a general-purpose processor, processor core, multiprocessor, reconfigurable processor, microcontroller, digital signal processor (“DSP”), application-specific integrated circuit (“ASIC”), graphics processing unit (“GPU”), field-programmable gate array (“FPGA”), programmable logic device (“PLD”), controller, state machine, gated logic, discrete hardware component, any other processing unit, or any combination or multiplex thereof. Processor 2010 may be a single processing unit, multiple processing units, a single processing core, multiple processor cores, dedicated processing cores, coprocessors, or any combination thereof. Processor 2010, together with other components of computing machine 2000, may be a virtualized computing machine executing within one or more other computing machines.

[0119] System memory 2030 may include non-volatile memory, such as read-only memory (“ROM”), programmable read-only memory (“PROM”), erasable programmable read-only memory (“EPROM”), flash memory, or any other device (whether powered or not) capable of storing program instructions or data. System memory 2030 may also include volatile memory, such as random access memory (“RAM”), static random access memory, dynamic random access memory, and synchronous dynamic random access memory (“SDRAM”). Other types of RAM may also be used to implement system memory 2030. System memory 2030 may be implemented using a single memory module or multiple memory modules. Although system memory 2030 is depicted as part of computing machine 2000, those skilled in the art will recognize that system memory 2030 may be separate from computing machine 2000 without departing from the scope of the subject matter. It should also be understood that system memory 2030 may include or operate with non-volatile storage devices (e.g., storage medium 2040).

[0120] Storage medium 2040 may include hard disks, floppy disks, optical disc read-only memories (“CD-ROMs”), digital versatile optical discs (“DVDs”), Blu-ray discs, magnetic tapes, flash memory, other non-volatile storage devices, solid-state drives (“SSDs”), any magnetic storage devices, any optical storage devices, any electrical storage devices, any semiconductor storage devices, any physical storage devices, any other data storage devices, or any combination or multiple thereof. Storage medium 2040 may store one or more operating systems, applications and program modules, such as module 2050, data, or any other information. Storage medium 2040 may be part of or connected to computer machine 2000. Storage medium 2040 may also be part of one or more other computer machines communicating with computer machine 2000, such as servers, database servers, cloud storage, network-attached storage, etc.

[0121] Module 2050 may include one or more hardware or software elements configured to assist computer machine 2000 in performing the various methods and processing functions described herein. Module 2050 may include one or more sequences of instructions stored as software or firmware in association with system memory 2030, storage medium 2040, or both. Storage medium 2040 may therefore represent a machine or computer-readable medium on which instructions or code may be stored for execution by processor 2010. Machine or computer-readable medium may generally refer to any one or more media used to provide instructions to processor 2010. Such machine or computer-readable medium associated with module 2050 may include a computer software product. It should be understood that the computer software product including module 2050 may also be associated with one or more processes or methods for transmitting module 2050 to computer machine 2000 via network 2080, any signal-bearing medium, or any other communication or transmission technology. Module 2050 may also include hardware circuitry or information for configuring hardware circuitry, such as microcode or configuration information for an FPGA or other PLD.

[0122] Input / output (“I / O”) interface 2060 can be configured to couple to one or more external devices to receive data from and send data to one or more external devices. Such external devices, along with various internal devices, can also be referred to as peripheral devices. I / O interface 2060 may include electrical and physical connections for operatively coupling various peripheral devices to computing machine 2000 or processor 2010. I / O interface 2060 can be configured to transfer data, address, and control signals between peripheral devices, computing machine 2000, or processor 2010. I / O interface 2060 can be configured to implement any standard interface, such as Small Computer System Interface (“SCSI”), Serial Attached SCSI (“SAS”), Fibre Channel, Peripheral Component Interconnect (“PCI”), PCI Express (PCIe), serial bus, parallel bus, Advanced Technology Connectivity (“ATA”), Serial ATA (“SATA”), Universal Serial Bus (“USB”), Thunderbolt, FireWire, various video buses, etc. I / O interface 2060 can be configured to implement only one interface or bus technology. Alternatively, I / O interface 2060 may be configured to implement multiple interface or bus technologies. I / O interface 2060 may be configured to operate as part of, in whole of, or with system bus 2020. I / O interface 2060 may include one or more buffers for buffering transfers between one or more external devices, internal devices, computing machine 2000, or processor 2010.

[0123] The I / O interface 2060 can couple the computing machine 2000 to various input devices, including mice, touch screens, scanners, electronic digitizers, sensors, receivers, touchpads, trackballs, cameras, microphones, keyboards, any other clicking devices, or any combination thereof. The I / O interface 2060 can couple the computing machine 2000 to various output devices, including video displays, speakers, printers, projectors, haptic feedback devices, automation controls, robot components, actuators, motors, fans, solenoids, valves, pumps, transmitters, signal transmitters, lights, etc.

[0124] Computer machine 2000 can operate in a network environment using a logical connection to one or more other systems or computers on network 2080 via network interface 2070. Network 2080 may include a WAN, LAN, intranet, Internet, wireless access network, wired network, mobile network, telephone network, optical network, or a combination thereof. Network 2080 can be packet-switched or circuit-switched in any topology and can use any communication protocol. Communication links within network 2080 can involve various digital or analog communication media, such as fiber optic cables, free-space optics, waveguides, electrical conductors, wireless links, antennas, radio frequency communications, etc.

[0125] Processor 2010 can be connected to other components of computing machine 2000 or various peripheral devices discussed herein via system bus 2020. It should be understood that system bus 2020 may be located within processor 2010, outside processor 2010, or both. Processor 2010, other components of computing machine 2000, or any of the various peripheral devices discussed herein can be integrated into a single device, such as a system-on-a-chip (“SOC”), system-on-package (“SOP”), or ASIC device.

[0126] In summary, this technology enables standardized lookup and forwarding of various virtual private networks (VPNs) in multi-site network architecture deployments. A source device on a first Layer 2 site transmits a frame to a destination device on the same subnet but on a second Layer 2 site. The frame is encapsulated and routed to the structure boundary node. The structure boundary node matches the source subnet with the destination subnet and transmits an Address Request Protocol (“ARP”). ​​In response to no reply to the ARP request, the structure boundary node transmits a mapping request to the Layer 3 transport structure control plane node. The control plane node extracts the destination identifier from the mapping request and determines that the destination identifier is a Layer 2 identifier. The control plane node sends a mapping reply to the structure boundary node, where the frame is re-encapsulated and forwarded to the destination device.

[0127] Examples may include computer programs that embody the functions described and illustrated herein, wherein the computer program is implemented in a computer system including instructions stored in a machine-readable medium and a processor that executes the instructions. However, it should be apparent that there are many different ways in which examples can be implemented in computer programming, and these examples should not be construed as limited to any single set of computer program instructions. Furthermore, skilled programmers will be able to write such computer programs to implement the disclosed examples based on the accompanying flowcharts and the relevant descriptions in the application text. Therefore, a specific set of program code instructions does not need to be disclosed in order to fully understand how the examples are made and used. Moreover, those skilled in the art will understand that one or more aspects of the examples described herein can be performed by hardware, software, or a combination thereof, as may be embodied in one or more computing systems. Furthermore, any reference to an action performed by a computer should not be construed as being performed by a single computer, as multiple computers may perform that action.

[0128] The examples described herein can be used with computer hardware and software that perform the methods and processes described herein. The systems, methods, and processes described herein can be embodied in a programmable computer, computer-executable software, or digital circuitry. Software can be stored on a computer-readable medium. Computer-readable media can include floppy disks, RAM, ROM, hard disks, removable media, flash memory, memory sticks, optical media, magneto-optical media, CD-ROMs, etc. Digital circuitry can include integrated circuits, gate arrays, building block logic, field-programmable gate arrays (“FPGAs”), etc.

[0129] The systems, methods, and actions described in the examples given above are illustrative, and alternatively, without departing from the scope and spirit of the various examples, certain actions may be performed in a different order, in parallel with each other, omitted entirely, and / or combined among different examples, and / or certain additional actions may be performed. Therefore, such alternative examples are included within the scope of the appended claims, which will be interpreted in the broadest possible sense to cover such alternative examples.

[0130] Although specific examples have been described in detail above, this description is for illustrative purposes only. Therefore, it should be understood that, unless explicitly stated otherwise, many aspects described above are not intended as fundamental elements. In addition to the aspects described above, those skilled in the art can, from the perspective of the present disclosure, modify the disclosed aspects of the examples and make equivalent components or actions corresponding to these disclosed aspects without departing from the spirit and scope of the examples as defined in the appended claims. The scope should be interpreted in the broadest possible sense to cover such modifications and equivalent structures.

Claims

1. A method for a Virtual Private Network, comprising: The following operations are performed by one or more computing devices on the transmission network: Receive a mapping request associated with a packet from the first network computing device of the first network; Extract the destination identifier from the mapping request; Determine the network type associated with the destination identifier; Generate mapping information associated with the network type, the mapping information including a route from a first network computing device in the first network to a second network computing device in the second network associated with the destination identifier; as well as A mapping response, including the mapping information, is transmitted to the first network computing device of the first network. The transmission network, the first network, and the second network are supported by computing devices located at different network sites, and the first network and the second network have the same subnet address. The transmission network is configured to connect the first network and the second network without extending the virtual network identifier between the first network and the second network.

2. The method according to claim 1, further comprising: The first network computing device performs the following operations: Receive the mapping response from the one or more computing devices, the mapping response including a route from a first network computing device in the first network to a second network computing device in the second network; as well as Based on the mapping response, the packet is transmitted to the second network computing device of the second network.

3. The method according to claim 1 or 2, further comprising: The first network computing device performs the following operations: The packet is received from a first network edge device, the packet including a header and a dataset; Extract the source identifier and the destination identifier from the header; Based on the matching of the source identifier and the destination identifier, it is determined whether the network type is a specific network type; Send an address request to the device in the first network; as well as In response to not receiving a response to the address request, the mapping request is transmitted to the one or more computing devices.

4. The method according to claim 3, wherein, The specific network type is a Layer 2 network.

5. The method according to claim 1 or 2, wherein, The transmission network is a Layer 3 network.

6. The method according to claim 1 or 2, wherein, The group is a Layer 2 frame.

7. The method according to claim 1 or 2, wherein, The first network is a layer 2 network, and the second network is a layer 2 network.

8. The method according to claim 1 or 2, further comprising: The second network computing device performs the following operations: The packet is received from a first network computing device of the first network, the packet including a header and a dataset; Extract the destination address from the header; as well as The dataset is transmitted to the computing device associated with the destination address.

9. A computer program product, comprising: A non-transitory computer-readable medium having computer-readable program instructions embodied thereon, which, when executed by a transport network computer associated with the transport network, cause the transport network computer to perform the following operations: Receive a mapping request associated with a packet from the first network computing device of the first network; Extract the destination identifier from the mapping request; Determine the network type associated with the destination identifier; Generate mapping information associated with the network type, the mapping information including a route from a first network computing device in the first network to a second network computing device in the second network associated with the destination identifier; as well as A mapping response, including the mapping information, is transmitted to the first network computing device of the first network. The transmission network, the first network, and the second network are supported by computing devices located at different network sites, and the first network and the second network have the same subnet address. The transmission network is configured to connect the first network and the second network without extending the virtual network identifier between the first network and the second network.

10. The computer program product according to claim 9, further comprising: A non-transitory computer-readable medium having computer-readable program instructions embodied thereon, which, when executed by the first network computing device, cause the first network computing device to perform the following operations: The mapping response is received from the transmission network computer, the mapping response including a route from a first network computing device in the first network to a second network computing device in the second network; as well as Based on the mapping response, the packet is transmitted to the second network computing device of the second network.

11. The computer program product of claim 10, further comprising computer-readable program instructions for: The packet is received from a first network edge device, the packet including a header and a dataset; Extract the source identifier and the destination identifier from the header; Based on the matching of the source identifier and the destination identifier, it is determined whether the network type is a specific network type; Send an address request to the device in the first network; as well as In response to not receiving a reply to the address request, the mapping request is transmitted to the transport network computer.

12. The computer program product according to claim 11, wherein, The specific network type is a Layer 2 network.

13. The computer program product according to any one of claims 9 to 12, wherein, The transmission network is a Layer 3 network.

14. The computer program product according to any one of claims 9 to 12, wherein, The group is a Layer 2 frame.

15. A system for a Virtual Private Network, comprising: Transmission network storage devices; and A transport network processor, communicatively coupled to the storage device, wherein the transport network processor executes application code instructions stored in the transport network storage device to cause the system to perform the following operations: Receive a mapping request associated with a packet from the first network computing device of the first network; Extract the destination identifier from the mapping request; Determine the network type associated with the destination identifier; Generate mapping information associated with the network type, the mapping information including a route from a first network computing device in the first network to a second network computing device in the second network associated with the destination identifier; and A mapping response, including the mapping information, is transmitted to the first network computing device of the first network. The first network and the second network are supported by computing devices located at different network sites, and the first network and the second network have the same subnet address. The transport network is configured to connect the first network and the second network without extending the virtual network identifier between the first network and the second network.

16. The system of claim 15, further comprising: First network storage device; and A first network processor is communicatively coupled to a first network storage device, wherein the first network processor executes application code instructions stored in the first network storage device to cause the system to perform the following operations: The transmission network processor receives the mapping response, which includes a route from a first network computing device in the first network to a second network computing device in the second network. as well as Based on the mapping response, the packet is transmitted to the second network computing device of the second network.

17. The system of claim 16, further comprising application code instructions for: The packet is received from a first network edge device, the packet including a header and a dataset; Extract the source identifier and the destination identifier from the header; Based on the matching of the source identifier and the destination identifier, it is determined whether the network type is a specific network type; Send an address request to the device in the first network; as well as In response to not receiving a reply to the address request, the mapping request is transmitted to the transport network processor.

18. The system according to claim 17, wherein, The specific network type is a Layer 2 network.

19. The system according to any one of claims 15 to 18, wherein, The group is a Layer 2 frame.

20. An apparatus for a virtual private network, comprising: A module for receiving mapping requests associated with packets from a first network computing device of a first network; A module for extracting the destination identifier from the mapping request; A module for determining the network type associated with the destination identifier; A module for generating mapping information associated with the network type, the mapping information including a route from a first network computing device in the first network to a second network computing device in the second network associated with the destination identifier; as well as A module for transmitting a mapping response, including the mapping information, to a first network computing device in the first network. The transmission network, the first network, and the second network are supported by computing devices located at different network sites, and the first network and the second network have the same subnet address. The transmission network is configured to connect the first network and the second network without extending the virtual network identifier between the first network and the second network.

21. The apparatus of claim 20, further comprising a module for implementing the method of any one of claims 2 to 8.

22. A computer-readable medium having instructions stored thereon, which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 8.

Images