Patent Grant
7023879
This application is related to the following:
The present invention relates to the field of data communications. More particularly, the present invention relates to a system and method for dynamic multi-hop ingress to egress L2TP tunnel mapping.
Computer networking capabilities of a home personal computer (PC) are typically provided by telephone companies (Telcos) or commercial Internet Service Providers (ISPs) who operate network access points along the information superhighway. It is through these network access points that the user is able to connect with public domains, such as the Internet, and private domains, such as an intra-company computer network of the user's employer.
In the wholesale Internet access environment, the network access provider (NAP) and the network service provider (NSP) are not necessarily the same entity. Telcos and other wholesale ISPs are typical NAPs, who operate gateways (network access servers, access routers, or the like) in their points of presence (PoPs), and provide local loop access services to PCs. NSPs are typically the customers of NAPs, who are allowed to use the NAP's gateways to provide their Internet Protocol (IP)-based services, such as Internet access, network access, or voice over IP (VoIP) services to the PCs.
The LNS 115 is a termination point of the L2TP tunnel 125. The LNS 115 accepts L2TP frames, strips the L2TP encapsulation, and processes the incoming PPP frames for the appropriate interface. The PPP frames are processed and passed to higher layer protocols, i.e., the PPP session is terminated at the LNS 115. The PPP session termination requires and includes user authentication via a Remote Authentication Dial-In User Service (RADIUS) or other means. An authenticated PPP client then receives an IP address, a Domain Name System (DNS) address, and IP-based services that the client contracted. These are forwarded back to the client over the L2TP tunnel 125 through the LAC 110.
The L2TP passes protocol-level (or Data Link-level) packets through the virtual tunnel between the endpoints of a point-to-point connection, i.e., the client's PC 100 and the LNS 115. The L2TP is suitable for virtual private networking (VPN), in which users can dial into a NAP's network access server and join a private (typically corporate) network that is remote from the NAP's PoP.
A typical service level agreement (SLA) specifies a minimum bandwidth to be provided during specified times of the day or week together with pricing information for the provision of such services. As shown in
NSPs typically aggregate a relatively high number of ingress tunnels from NAPs to a relatively low number of tunnels to a remote domain, and egress LACs are statically allocated to particular remote domains based upon expected network usage. As shown in
This approach has a number of drawbacks. First, placing all L2TP sessions for a particular remote domain on a single egress tunnel accords the same level of service to all sessions using that egress tunnel, regardless of any SLAs. Second, tying particular egress LACs to particular remote domains reduces scalability by requiring manual reconfiguration whenever an egress LAC becomes overutilized. Third, static configuration may allow some egress LACs to be underutilized while simultaneously allowing other egress LACs to be overutilized, resulting in a relatively inefficient utilization of resources.
What is needed is a solution that enables differentiated service for sessions using an egress tunnel. A further need exists for such a solution that minimizes the amount of network engineering required by NAPs and NSPs. Yet another need exists for such a solution that allows a service provider to share the same egress LAC across multiple remote domains while maintaining SLAs, providing relatively efficient utilization of resources.
A method for dynamic ingress to egress tunnel mapping from a first communication network to a second communication network includes receiving a tunneled communication from a subscriber using the first communication network, determining egress tunnel selection criteria for the tunneled communication, selecting one of at least one egress tunnel based on the egress tunnel selection criteria and forwarding the tunneled communication on the selected egress tunnel. The egress tunnel selection criteria indicate the basis for selecting one of the egress tunnels. An apparatus for dynamic ingress to egress tunnel mapping from a first communication network to a second communication network includes a receiving interface to receive a tunneled communication from a subscriber using the first communication network, an egress tunnel selection criteria determiner to determine egress tunnel selection criteria for the tunneled communication, an egress tunnel selector to select one of at least one egress tunnel based on the egress tunnel selection criteria and a session forwarder to forward the tunneled communication on the selected egress tunnel. In one aspect of the invention, tunnel mapping is performed between Layer 2 Tunneling Protocol (L2TP) ingress and egress tunnels.
The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more embodiments of the present invention and, together with the detailed description, serve to explain the principles and implementations of the invention.
In the drawings:
Embodiments of the present invention are described herein in the context of a system and method for dynamic multi-hop ingress to egress L2TP tunnel mapping. Those of ordinary skill in the art will realize that the following detailed description of the present invention is illustrative only and is not intended to be in any way limiting. Other embodiments of the present invention will readily suggest themselves to such skilled persons having the benefit of this disclosure. Reference will now be made in detail to implementations of the present invention as illustrated in the accompanying drawings. The same reference indicators will be used throughout the drawings and the following detailed description to refer to the same or like parts.
In the interest of clarity, not all of the routine features of the implementations described herein are shown and described. It will, of course, be appreciated that in the development of any such actual implementation, numerous implementation-specific decisions must be made in order to achieve the developer's specific goals, such as compliance with application- and business-related constraints, and that these specific goals will vary from one implementation to another and from one developer to another. Moreover, it will be appreciated that such a development effort might be complex and time-consuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art having the benefit of this disclosure.
In the context of the present invention, the term “network” includes local area networks, wide area networks, the Internet, cable television systems, telephone systems, wireless telecommunications systems, fiber optic networks, ATM networks, frame relay networks, satellite communications systems, and the like. Such networks are well known in the art and consequently are not further described here.
In accordance with one embodiment of the present invention, the components, processes and/or data structures may be implemented using C or C++ programs running on high performance computers (such as an Enterprise 2000™ server running Sun Solaris™ as its operating system. The Enterprise 2000™ server and Sun Solaris™ operating system are products available from Sun Microsystems, Inc. of Mountain View, Calif.). Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, firmware, computer languages and/or general purpose machines. In addition, those of ordinary skill in the art will recognize that devices of a less general purpose nature, such as hardwired devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herein.
The authentication, authorization and accounting (AAA) service performs user authentication, user authorization and user accounting functions. It may be a Cisco ACS™ product such as Cisco Secure™, available from Cisco Systems, Inc. of San Jose, Calif., or an equivalent product. In accordance with a presently preferred embodiment of the present invention, the Remote Authentication Dial-In User Service (RADIUS) protocol is used as the communication protocol for carrying AAA information. RADIUS is an Internet standard track protocol for carrying authentication, authorization, accounting and configuration information between devices that desire to authenticate their links and a shared AAA or AAA proxy service. Those of ordinary skill in the art will realize that other authentication protocols such as TACACS+ or DIAMETER can be used as acceptable authentication communications links between the various communications devices that encompass the data communication network and still be within the inventive concepts disclosed herein.
According to embodiments of the present invention, a network tunnel switch such as an Egress LAC or multi-hop node maps sessions in ingress tunnels to a particular egress tunnel that terminates at a remote domain. Egress tunnel selection may be based on a static tunnel-mapping algorithm, in which a session in an ingress tunnel is allocated to an egress tunnel without regard to the current capacity of each egress tunnel to the remote domain. Alternatively, a load factor for available egress tunnels to the remote domain may be considered in determining which egress tunnel to use. The load factor may be based upon parameters such as ingress tunnel ID, subscriber domain, time of day, day of week, quality of service level and subscribed network bandwidth.
Turning now to
The tunnel selection criteria determiner 405 determines the criteria to apply in selecting a tunnel received by receiving interface 435. For example, the egress tunnel selection criteria determiner 405 may indicate that egress tunnels should be selected to evenly distribute sessions regardless of an egress tunnel's available bandwidth, or to select an egress tunnel having the most available bandwidth. The available egress tunnel ascertainer 410 determines which egress tunnels to a particular remote domain are available. The tunnel data request generator 415 generates one or more tunnel data requests to obtain the information requested by the available egress tunnel ascertainer 410. The tunnel database 420 stores parameters for each tunnel originating with LAC 400. The tunnel database 420 also stores tunnel selection criteria for each remote domain. Alternatively, tunnel parameters and tunnel selection criteria may be stored in separate databases. The egress tunnel selector 425 selects one of the egress tunnels leading to the remote domain and session forwarder 430 forwards the session received by receiving interface 435 to the remote domain via the egress tunnel selected by egress tunnel selector 425.
In operation, receiving interface 435 receives a session from a first communication network 440 and forwards the session to tunnel selection criteria determiner 405. The tunnel selection criteria determiner 405 determines the criteria to use in selecting a tunnel. According to a preferred embodiment, the selection criteria for a particular domain is obtained from a database upon receiving a first session destined for the remote domain. If the tunnel selection criteria are independent of tunnel loading, the egress tunnel selector 425 selects the tunnel indicated by the selection criteria determiner 405. If the tunnel selection determiner 405 requires tunnel-loading parameters, available egress tunnel ascertainer 410 ascertains the available egress tunnels to the remote domain. Egress tunnel selector 425 selects one of the tunnels to the remote domain by applying the tunnel selection criteria to the tunnel parameters and session forwarder 430 forwards the session received by receiving interface 435 to the remote domain via the tunnel selected by egress tunnel selector 425.
Turning now to
Turning now to
Referring again to
As mentioned above, the egress tunnel selection criteria may indicate that egress tunnels should be selected pseudo-randomly, or with a weighted random selection so that those with more available capacity are selected more often, or with any other suitable selection algorithm as will now be apparent to those of ordinary skill in the art. More examples of selection criteria are presented below with reference to
In accordance with one embodiment of the present invention, an ingress tunnel ID is used to select an egress tunnel for a session. This is illustrated in
In accordance with another embodiment of the present invention, a subscriber domain associated with the received session is used to select an egress tunnel for a session. This is illustrated in
In accordance with one embodiment of the present invention, the three Precedence bits (the three highest order or most significant bits of the 8-bit Type of Service (ToS)/Differentiated Services Field of the IP packet header) are used to select an egress tunnel for a session. This is illustrated in
Those of ordinary skill in the art will realize that the particular bits used are not particularly critical, for example, the CoS (Class of Services) bits of an IEEE 802.1q frame could be used as could the CoS bits in an Inter-Switch Link (ISL) frame. Other bits or fields could also be designated to carry the type of service information. A 3-bit ToS permits up to 8 levels of service. Larger bit fields would be used if desired.
According to another embodiment of the present invention, egress tunnel selection is based upon a VPI/VCI pair associated with the received session. This is illustrated in
According to another embodiment of the present invention, an egress tunnel is selected based upon a pseudo-random process. This is illustrated in
According to another embodiment of the present invention, the time at which a session is received is used to select an egress tunnel. A remote domain may have multiple LNSs in various parts of the world. The workload for each LNS may vary depending upon the time of day, the day of the week, or both. Thus, allocating a session to an egress tunnel associated with a LNS at an “off-hours” site results in a relatively efficient utilization of resources. This embodiment is described below in more detail with reference to
Turning now to
According to embodiments of the present invention, the available bandwidth of egress tunnels and associated interfaces is used either alone or in combination with other parameters to dynamically select an egress tunnel. The selection criteria are applied to the various egress tunnel parameters to create a loading factor. The egress tunnel with the best loading factor is selected. These embodiments are illustrated below with reference to
According to one embodiment of the present invention, the available bandwidth of all egress tunnels going to a remote domain is used to select an egress tunnel. This is illustrated in
The load factor information may be of a number of types, but essentially is an indicator of the available capacity of the particular egress tunnel, weighted by various egress tunnel parameters. In this manner it is now relatively straightforward to program an egress LAC to load balance among the multiple instances of egress tunnels for a remote domain given in the database.
For example, one way to implement the system illustrated in
According to one embodiment of the present invention, the available bandwidth is weighted by the processing capacity of the LNS CPU. For example, suppose egress tunnel A is currently handling 10 sessions and is associated with a remote domain LNS having a relatively high capacity CPU. Suppose also that egress tunnel B is currently handling the same number of sessions and is associated with a remote domain LNS having a relatively low capacity CPU. In this case, egress tunnel A is better equipped to handle an additional session than egress tunnel B. This information is accounted for in the egress tunnel parameters for egress tunnel A and egress tunnel B.
According to another embodiment of the present invention, an egress tunnel is selected based upon available bandwidth and an ingress tunnel QoS. This is illustrated in
According to one embodiment of the present invention, an egress tunnel is selected based upon available bandwidth and IP header ToS bits. This is illustrated in
Similarly, a VPI/VCI pair may also be used in conjunction with available bandwidth to select an egress tunnel in accordance with another embodiment of the present invention. Referring to
According to another embodiment of the present invention, an egress tunnel is selected to provide a relatively even distribution of sessions among egress tunnels, regardless of egress tunnel capacity. This is illustrated in
According to another embodiment of the present invention, an ingress LAC is instructed to route incomming sessions on a tunnel to an alternate egress LAC when a primary egress LAC exceeds a predetermined loading level. This is illustrated below with reference to
Turning now to
A LAC having the capabilities described above can be further used to allow the NSP to behave in a fundamentally different manner than before. Now the NSP can differentiate among computer users. For example, in the case of Joe@ISP.net who is an authorized user of CorpA, the NSP can identify the user at the time the NSP receives his session, look up the details of the SLA with that user, and determine which egress tunnel to the remote domain can best service the session given the requirements of the SLA.
An example of this mode of operation is now presented with reference to
Dynamically mapping ingress tunnels to egress tunnels in accordance with embodiments of the present invention also increases scalability by allowing a NSP to share an egress LAC among multiple remote domains without manually reconfiguring the network.
While embodiments and applications of this invention have been shown and described, it would be apparent to those skilled in the art having the benefit of this disclosure that many more modifications than mentioned above are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the appended claims.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4644532 | George et al. | Feb 1987 | A |
| 4669113 | Ash et al. | May 1987 | A |
| 4896319 | Lidinsky et al. | Jan 1990 | A |
| 4995074 | Goldman et al. | Feb 1991 | A |
| 5014265 | Hahne et al. | May 1991 | A |
| 5115427 | Johnson, Jr. et al. | May 1992 | A |
| 5159592 | Perkins | Oct 1992 | A |
| 5239537 | Sakauchi | Aug 1993 | A |
| 5265245 | Nordstrom et al. | Nov 1993 | A |
| 5274634 | Babiarz | Dec 1993 | A |
| 5274643 | Fisk | Dec 1993 | A |
| 5280470 | Buhrke et al. | Jan 1994 | A |
| 5305311 | Lyles | Apr 1994 | A |
| 5347511 | Gun | Sep 1994 | A |
| 5371852 | Attanasio et al. | Dec 1994 | A |
| 5406643 | Burke et al. | Apr 1995 | A |
| 5408469 | Opher et al. | Apr 1995 | A |
| 5416842 | Aziz | May 1995 | A |
| 5422882 | Hiller et al. | Jun 1995 | A |
| 5426636 | Hiller et al. | Jun 1995 | A |
| 5428607 | Hiller et al. | Jun 1995 | A |
| 5430715 | Corbalis et al. | Jul 1995 | A |
| 5437013 | Rubin et al. | Jul 1995 | A |
| 5452297 | Hiller et al. | Sep 1995 | A |
| 5461624 | Mazzola | Oct 1995 | A |
| 5469556 | Clifton | Nov 1995 | A |
| 5510777 | Pilc et al. | Apr 1996 | A |
| 5539884 | Robrock, II | Jul 1996 | A |
| 5555244 | Gupta et al. | Sep 1996 | A |
| 5570361 | Norizuki et al. | Oct 1996 | A |
| 5578955 | Matsue et al. | Nov 1996 | A |
| 5583862 | Callon | Dec 1996 | A |
| 5588003 | Ohba et al. | Dec 1996 | A |
| 5602918 | Chen et al. | Feb 1997 | A |
| 5604803 | Aziz | Feb 1997 | A |
| 5617417 | Sathe et al. | Apr 1997 | A |
| 5621721 | Vatuone | Apr 1997 | A |
| 5623605 | Keshav et al. | Apr 1997 | A |
| 5631897 | Pacheco et al. | May 1997 | A |
| 5642515 | Jones et al. | Jun 1997 | A |
| 5649108 | Spiegel et al. | Jul 1997 | A |
| 5655077 | Jones et al. | Aug 1997 | A |
| 5671354 | Ito et al. | Sep 1997 | A |
| 5673265 | Gupta et al. | Sep 1997 | A |
| 5684950 | Dare et al. | Nov 1997 | A |
| 5689566 | Nguyen | Nov 1997 | A |
| 5708812 | Van Dyke et al. | Jan 1998 | A |
| 5715399 | Bezos | Feb 1998 | A |
| 5717690 | Peirce, Jr. et al. | Feb 1998 | A |
| 5734654 | Shirai et al. | Mar 1998 | A |
| 5740171 | Mazzola et al. | Apr 1998 | A |
| 5740176 | Gupta et al. | Apr 1998 | A |
| 5740371 | Wallis | Apr 1998 | A |
| 5742604 | Edsall et al. | Apr 1998 | A |
| 5745708 | Weppler et al. | Apr 1998 | A |
| 5764636 | Edsall | Jun 1998 | A |
| 5768519 | Swift et al. | Jun 1998 | A |
| 5796732 | Mazzola et al. | Aug 1998 | A |
| 5802290 | Casselman | Sep 1998 | A |
| 5815665 | Teper et al. | Sep 1998 | A |
| 5852607 | Chin | Dec 1998 | A |
| 5864542 | Gupta et al. | Jan 1999 | A |
| 5918019 | Valencia | Jun 1999 | A |
| 5944824 | He | Aug 1999 | A |
| 5949755 | Uphadya et al. | Sep 1999 | A |
| 5991828 | Horie et al. | Nov 1999 | A |
| 5999514 | Kato | Dec 1999 | A |
| 5999518 | Nattkemper et al. | Dec 1999 | A |
| 6009103 | Woundy | Dec 1999 | A |
| 6011910 | Chau et al. | Jan 2000 | A |
| 6021496 | Dutcher et al. | Feb 2000 | A |
| 6023474 | Gardner | Feb 2000 | A |
| 6026441 | Ronen | Feb 2000 | A |
| 6044402 | Jacobson et al. | Mar 2000 | A |
| 6047376 | Hosoe | Apr 2000 | A |
| 6061650 | Malkin et al. | May 2000 | A |
| 6069895 | Ayandeh | May 2000 | A |
| 6078957 | Adelman et al. | Jun 2000 | A |
| 6081508 | West et al. | Jun 2000 | A |
| 6081518 | Bowman-Amuah | Jun 2000 | A |
| 6084892 | Benash et al. | Jul 2000 | A |
| 6091951 | Sturniolo et al. | Jul 2000 | A |
| 6092178 | Jindal et al. | Jul 2000 | A |
| 6092196 | Reiche | Jul 2000 | A |
| 6094437 | Loehndorf, Jr. et al. | Jul 2000 | A |
| 6108708 | Iwata | Aug 2000 | A |
| 6115468 | De Nicolo | Sep 2000 | A |
| 6118785 | Araujo et al. | Sep 2000 | A |
| 6119160 | Zhang et al. | Sep 2000 | A |
| 6134666 | De Nicolo | Oct 2000 | A |
| 6154775 | Coss et al. | Nov 2000 | A |
| 6212561 | Sitaraman et al. | Apr 2001 | B1 |
| 6236655 | Caldara et al. | May 2001 | B1 |
| 6252878 | Locklear, Jr. et al. | Jun 2001 | B1 |
| 6298043 | Mauger et al. | Oct 2001 | B1 |
| 6301229 | Araujo et al. | Oct 2001 | B1 |
| 6308213 | Valencia | Oct 2001 | B1 |
| 6396838 | Palnati | May 2002 | B1 |
| 6400716 | Munakata et al. | Jun 2002 | B1 |
| 6408336 | Schneider et al. | Jun 2002 | B1 |
| 6412003 | Melen | Jun 2002 | B1 |
| 6415313 | Yamada et al. | Jul 2002 | B1 |
| 6430152 | Jones et al. | Aug 2002 | B1 |
| 6434156 | Yeh | Aug 2002 | B1 |
| 6438612 | Ylonen et al. | Aug 2002 | B1 |
| 6446200 | Ball et al. | Sep 2002 | B1 |
| 6456623 | Kobayasi et al. | Sep 2002 | B1 |
| 6463475 | Calhoun | Oct 2002 | B1 |
| 6466976 | Alles et al. | Oct 2002 | B1 |
| 6498845 | Martz et al. | Dec 2002 | B1 |
| 6507577 | Mauger et al. | Jan 2003 | B1 |
| 6519254 | Chuah et al. | Feb 2003 | B1 |
| 6522627 | Mauger | Feb 2003 | B1 |
| 6526033 | Wang et al. | Feb 2003 | B1 |
| 6542919 | Wendorf et al. | Apr 2003 | B1 |
| 6597689 | Chiu et al. | Jul 2003 | B1 |
| 6609153 | Salkewicz | Aug 2003 | B1 |
| 6614809 | Verma et al. | Sep 2003 | B1 |
| 6615358 | Dowd et al. | Sep 2003 | B1 |
| 6651096 | Gai et al. | Nov 2003 | B1 |
| 6654792 | Verma et al. | Nov 2003 | B1 |
| 6665273 | Goguen et al. | Dec 2003 | B1 |
| 6665305 | Weismann | Dec 2003 | B1 |
| 6717944 | Bryden et al. | Apr 2004 | B1 |
| 6741599 | Dunn et al. | May 2004 | B1 |
| 6785228 | Vandette et al. | Aug 2004 | B1 |
| 20020116501 | Ho et al. | Aug 2002 | A1 |
| Number | Date | Country |
|---|---|---|
| 9923852 | May 1999 | WO |
