System and method of dynamic establishment of virtual private networks using border gateway protocol ethernet virtual private networks technology

Patent metadata

Field	Value
Publication number	US-10469595-B2
Application number	US-201715436670-A
Country	US
Kind code	B2
Filing date	Feb 17, 2017
Priority date	Feb 17, 2017
Publication date	Nov 5, 2019
Grant date	Nov 5, 2019

Abstract

A method and apparatus of a network element that dynamically establishes a first virtual private network (VPN) tunnel is described. In an exemplary embodiment, the network element detects data destined for a first private subnet. In response to the detecting, the network element determines that a next hop for the data does not have an established VPN tunnel that allows access to the first private subnet. The network element further establishes the VPN tunnel and sends the data using the VPN tunnel.

First claim

What is claimed is:

1. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method to dynamically establish a first virtual private network (VPN) tunnel, the method comprising:
detecting, with a first branch network element, data destined for a first private subnet;
in response to the detecting, determining that a next hop for the data does not have an established VPN tunnel that allows access to the first private subnet;
establishing the VPN tunnel from the first branch network element to a second branch network element providing access to the first private subnet, the VPN tunnel bypassing a hub network element; and
sending the data using the VPN tunnel.

2. The machine-readable medium of claim 1 , wherein the VPN tunnel is secure tunnel.

3. The machine-readable medium of claim 2 , wherein the IPSec tunnel uses IPSec transport mode and the data is encapsulated for transport in the Virtual Extended Local Area Network (VXLAN).

4. The machine-readable medium of claim 1 , wherein the VPN tunnel is established between the first and second branch network elements across a public Internet Protocol network.

5. The machine-readable medium of claim 1 , further comprising:
receiving, with the first branch network element, private subnet forwarding information for the first private subnet; and
installing the private subnet forwarding information in a forwarding information base of the first branch network element.

6. The machine-readable medium of claim 5 , wherein first branch network element receives the private subnet forwarding information from a route reflector.

7. The machine-readable medium of claim 5 , wherein the private subnet forwarding information is distributed by Border Gateway Protocol Virtual Extended Local Area Network.

8. The machine-readable medium of claim 5 , further comprising:
establishing a second VPN tunnel between the hub network element and the first branch network element, wherein the first branch network element receives the private subnet forwarding information via the hub network element.

9. The machine-readable medium of claim 6 , further comprising:
sending a second private subnet forwarding information to the hub network element, wherein the first branch network element provides access to a device in a second private subnet.

10. The machine-readable medium of claim 1 , wherein the detecting the data comprises:
detecting that a flow of the data is at or above a threshold.

11. A method to dynamically establish a first virtual private network (VPN) tunnel, the method comprising:
detecting, with a first branch network element, data destined for a first private subnet;
in response to the detecting, determining that a next hop for the data does not have an established VPN tunnel that allows access to the first private subnet;
establishing the VPN tunnel from the first branch network element to a second branch network element providing access to the first private subnet, the VPN tunnel bypassing a hub network element; and
sending the data using the VPN tunnel.

12. The method of claim 11 , wherein the VPN tunnel is secure tunnel.

13. The method of claim 12 , wherein the IPSec tunnel uses IPSec transport mode and the data is encapsulated for transport in the Virtual Extended Local Area Network (VXLAN).

14. The method of claim 11 , wherein the VPN tunnel is established between the first and second branch network elements across a public Internet Protocol network.

15. The method of claim 11 , further comprising:
receiving, with the first branch network element, private subnet forwarding information for the first private subnet; and
installing the private subnet forwarding information in a forwarding information base of the first branch network element.

16. The method of claim 15 , wherein first branch network element receives the private subnet forwarding information from a route reflector.

17. The method of claim 15 , further comprising:
establishing a second VPN tunnel between the hub network element and the first branch network element, wherein the first branch network element receives the private subnet forwarding information via the hub network element; and
sending a second private subnet forwarding information to the hub network element, wherein the first branch network element provides access to a device in a second private subnet.

18. The method of claim 11 , wherein the detecting the data comprises:
detecting that a flow of the data is at or above a threshold.

Assignees

• Arista Networks Inc

Inventors

• Dawani Anoop
• Murphy James Michael
• Srinivasan Udayakumar

Classifications

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title