ASBR VPNv4 Route Limiting for Inter-AS Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Inter-Autonomous System (AS) BGP frameworks do not adequately protect one VPN from being compromised by another, leading to potential loss of routing information across ASs, as they lack the ability to make intelligent route limiting decisions due to the absence of VPN Routing/Forwarding instances (VRFs) at Autonomous System Border Routers (ASBRs).
Innovation Solution
Implementing a mechanism at ASBRs to define and enforce a limit on the number of VPNv4 routes per VPN, sending a soft notification to neighboring ASBRs when the limit is exceeded, and discarding excess routes while maintaining the BGP session, thereby isolating misbehaving VPNs and preserving routing information for other VPNs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If aggregate VPNv4 prefix limiting is implemented at ASBRs, then router resource protection is improved, but individual VPN route protection deteriorates (one VPN can still compromise others)
Solution Approach 1:
The patent segments the aggregate VPNv4 prefix limit into individual VPN-specific limits by introducing per-VPN route counting mechanisms at ASBRs. Each VPN is tracked separately using VRF instances and route distinction techniques, allowing the system to enforce multiple fine-grained limits instead of a single coarse limit. This segmentation enables isolation of misbehaving VPNs while protecting overall router resources.
Solution Approach 2:
The patent applies local quality by implementing differentiated limiting policies for different VPNs at the ASBR. Instead of uniform treatment, each VPN can have its own configured limit based on service level agreements or policy requirements. The ASBR examines route attributes (such as RD values) to identify which VPN a route belongs to and applies the appropriate limit, enabling localized control over route admission.
2Object-affected harmful factors
If per-VPN route limiting is implemented, then VPN isolation and security are improved, but device complexity at ASBRs increases
Solution Approach 1:
The patent enables self-service by allowing the ASBR to automatically identify and classify incoming routes into different VPNs using route attributes (such as Route Distinguisher values) carried in the BGP updates. The system autonomously counts routes per-VPN, compares against configured limits, and enforces limiting decisions without requiring manual configuration of complex per-VPN tracking structures. This automation reduces operational complexity while maintaining per-VPN isolation.
3Loss of information
If strict per-VPN limits are enforced, then routing information protection is improved, but BGP session stability may deteriorate
Solution Approach 1:
The patent implements feedback mechanisms where the ASBR monitors the number of received routes per VPN in real-time and provides feedback to the routing decision-making process. When a per-VPN limit is approached or exceeded, the system feeds back this information to trigger route rejection decisions. This continuous feedback loop enables dynamic adaptation to changing route conditions while maintaining session stability, as the BGP session itself remains intact even when individual routes are limited.
Data Source
AI summary
A method, apparatus and computer program product for limiting Virtual Private Network (VPNv4) prefixes per VPN in an inter-autonomous system environment are presented. A limit on the number of VPNv4 routes per VPN for a Route Distributor (RD) or a group of RDs associated with a VPN is defined, at an Autonomous System Border Router (ASBR). When the number of received routes at the ASBR exceeds the limit, then a soft notification is sent to a neighboring ASBR and routes exceeding the limit are discarded at the ASBR.