VPN SID Distribution in SRv6 for Route Convergence Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In segment routing over internet protocol version 6 (SRv6) networks, intermediate nodes cannot sense the virtual private network segment identifier (VPN SID) of the egress node, preventing VPN route convergence and service-level control.
Innovation Solution
The egress node diffuses the VPN SID to all nodes in the network, enabling each node to store and associate it with forwarding entries, allowing the ingress and intermediate nodes to guide packet forwarding based on the locally stored VPN SID.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the egress node sends the VPN SID to the ingress node for packet forwarding, then the ingress node can forward packets to the egress node, but the intermediate nodes cannot sense the VPN SID and cannot implement VPN route convergence
Solution Approach 1:
The patent segments the VPN SID distribution process into two phases: first, the egress node sends the VPN SID to the ingress node through a control protocol (RTP); second, the ingress node injects the VPN SID into data packets at the network edge. This segmentation allows intermediate nodes to receive and store the VPN SID information without requiring full VPN SID propagation through the entire network, thereby achieving VPN route convergence while managing information loss.
Solution Approach 2:
The ingress node acts as an intermediary between the egress node and intermediate nodes. It receives the VPN SID from the egress node via control protocols and then injects it into data packets that traverse through intermediate nodes. This intermediary mechanism ensures that intermediate nodes can sense and store the VPN SID information without requiring direct communication with the egress node, solving the information loss problem.
2Ease of operation
If intermediate nodes rely on summary routes for packet forwarding, then packet forwarding can be implemented, but VPN service-level control cannot be achieved
Solution Approach 1:
The patent applies preliminary action by having the ingress node inject the VPN SID into data packets before they reach intermediate nodes. This preliminary injection of VPN SID information allows intermediate nodes to perform accurate packet forwarding based on VPN service-level control rather than relying solely on summary routes, thereby achieving both ease of operation and adaptability.
Solution Approach 2:
The patent changes the parameter of packet header information by injecting the VPN SID into the data packet header at the ingress node. This parameter change enables intermediate nodes to use the VPN SID for precise packet forwarding and service-level control, transforming the packet forwarding mechanism from summary route-based to VPN SID-based, thus achieving VPN service-level control while maintaining operational ease.
3Device complexity
If the VPN SID is not sensed by intermediate nodes, then the network structure remains simple, but VPN service-level control and route convergence cannot be implemented
Solution Approach 1:
The patent extracts the VPN SID injection function from the core network and places it at the network edge (ingress node). By taking out the VPN SID distribution responsibility from intermediate nodes and placing it at the ingress node, the network structure remains relatively simple while still enabling intermediate nodes to sense and use the VPN SID for service-level control, thus resolving the contradiction between simplicity and control capability.
Data Source
AI summary
Embodiments of this application disclose a method and an apparatus for transmitting a virtual private network segment identifier (VPN SID), and a network device. An egress node sends a VPN SID corresponding to the egress node to each node in a network, and indicates to each node to store the VPN SID of the egress node. In this way, both an ingress node and each intermediate node can sense and store the VPN SID. When a VPN service needs to be provisioned, because each node stores the VPN SID of the egress node, it is possible for each node to associate the VPN SID with a forwarding entry of the VPN service to be provisioned in a forwarding table, to implement VPN route convergence. In addition, for a of a VPN corresponding to the VPN SID and that is sent by a user side, both the ingress node and the intermediate node can guide forwarding of the packet based on a locally stored VPN SID, to implement VPN service-level control.