Systems, methods, and devices for smart mapping and VPN policy enforcement

One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to implement a mapping system that provides a single policy control point for Virtual Private Networks (VPNs), the instructions operable when executed to:

• program, via a northbound interface, directly into a mapping database at the mapping system (i) VPN policies including Locator/ID Separation Protocol (LISP)-based source-destination mappings between endpoint identifiers (EIDs) and corresponding routing locators (RLOCs) for routers, (ii) segment routing (SR) policies including, in an SR field of the mapping database, indications of routers to be used as intermediate path hops between source routers and destination routers in connection with a forwarding policy;
• (iii) network service header (NSH) policies for which at least some of the source-destination mappings include corresponding NSHs identifying service chains of service functions;
• and (iv) encryption policies to be applied to the VPNs;
• receive, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first tunneling router compliant with the LISP, the mapping request comprising an RLOC tuple that includes a source identifier and a destination identifier, wherein the source identifier is located in a first portion of the RLOC tuple;
• identify a first endpoint identifier for a destination using a longest match algorithm based, at least in part, on the source identifier and the destination identifier of the RLOC tuple, and identify an indication of an intermediate path hop from the indications of routers corresponding to the first endpoint identifier;
• and
• transmit the first endpoint identifier and the indication of the intermediate path hop to the first tunneling router.

A method comprising:

• implementing a mapping system that provides a single policy control point for Virtual Private Networks (VPNs), the implementing including programming, via a northbound interface, directly into a mapping database at the mapping system (i) VPN policies including Locator/ID Separation Protocol (LISP)-based source-destination mappings between endpoint identifiers (EIDs) and corresponding routing locators (RLOCs) for routers, (ii) segment routing (SR) policies including, in an SR field of the mapping database, indications of routers to be used as intermediate path hops between source routers and destination routers in connection with a forwarding policy;
• (iii) network service header (NSH) policies for which at least some of the source-destination mappings include corresponding NSHs identifying service chains of service functions;
• and (iv) encryption policies to be applied to the VPNs;
• receiving, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first tunneling router compliant with the LISP, the mapping request comprising an endpoint identifier (EID) tuple that includes a source identifier and a destination identifier, wherein the source identifier is located in a first portion of the EID tuple;
• identifying a first RLOC using a longest match algorithm based, at least in part, on the source identifier and the destination identifier of the EID tuple, and identifying an indication of an intermediate path hop from the indications of routers corresponding to the first RLOC;
• and
• transmitting the first RLOC and the indication of the intermediate path hops to the first tunneling router.

A method comprising:

• implementing a mapping system that provides a single policy control point for Virtual Private Networks (VPNs), the implementing including programming, via a northbound interface, directly into a mapping database at the mapping system (i) VPN policies including Locator/ID Separation Protocol (LISP)-based source-destination mappings between endpoint identifiers (EIDs) and corresponding routing locators (RLOCs) for routers, (ii) segment routing (SR) policies including, in an SR field of the mapping database, indications of routers to be used as intermediate path hops between source routers and destination routers in connection with a forwarding policy;
• (iii) network service header (NSH) policies for which at least some of the source-destination mappings include corresponding NSHs identifying service chains of service functions;
• and (iv) encryption policies to be applied to the VPNs;
• receiving, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first tunneling router compliant with the LISP, the mapping request comprising an RLOC tuple that includes a source identifier and a destination identifier, wherein the source identifier is located in a second portion of the RLOC tuple;
• identifying a first endpoint identifier for a destination using a longest match algorithm based, at least in part, on the source identifier and the destination identifier of the RLOC tuple, and identifying an indication of an intermediate path hop from the indications of routers corresponding to the first endpoint identifier;
• and
• transmitting the first endpoint identifier and the indication of the intermediate path hop to the first tunneling router.

An apparatus comprising:

• a processor;
• and
• a memory configured to store instructions executable by the processor, wherein the processor is configured to implement a mapping system that provides a single policy control point for Virtual Private Networks (VPNs), wherein the processor is further configured to:
• program, via a northbound interface, directly into a mapping database at the mapping system (i) VPN policies including Locator/ID Separation Protocol (LISP)-based source-destination mappings between endpoint identifiers (EIDs) and corresponding routing locators (RLOCs) for routers, (ii) segment routing (SR) policies including, in an SR field of the mapping database, indications of routers to be used as intermediate path hops between source routers and destination routers in connection with a forwarding policy;
• (iii) network service header (NSH) policies for which at least some of the source-destination mappings include corresponding NSHs identifying service chains of service functions;
• and (iv) encryption policies to be applied to the VPNs;
• receive, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first tunneling router compliant with the LISP, the mapping request comprising an EID tuple that includes a source identifier and a destination identifier, wherein the source identifier is located in a second portion of the EID tuple;
• identify a first RLOC using a longest match algorithm based, at least in part, on the source identifier and the destination identifier of the EID tuple from the mapping database, and identify an indication of an intermediate path hop from the indications of routers corresponding to the first RLOC;
• and
• transmit the first RLOC and the indication of the intermediate path hop to the first tunneling router.

An apparatus comprising:

• a processor;
• and
• a memory configured to store instructions executable by the processor, wherein the processor is configured to implement a mapping system that provides a single policy control point for Virtual Private Networks (VPNs), wherein the processor is further configured to:
• program, via a northbound interface, directly into a mapping database at the mapping system (i) VPN policies including Locator/ID Separation Protocol (LISP)-based source-destination mappings between endpoint identifiers (EIDs) and corresponding routing locators (RLOCs) for routers, (ii) segment routing (SR) policies including, in an SR field of the mapping database, indications of routers to be used as intermediate path hops between source routers and destination routers in connection with a forwarding policy;
• (iii) network service header (NSH) policies for which at least some of the source-destination mappings include corresponding NSHs identifying service chains of service functions;
• and (iv) encryption policies to be applied to the VPNs;
• receive, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first tunneling router compliant with the LISP, the mapping request comprising an RLOC tuple that includes a source identifier and a destination identifier, wherein the source identifier is located in a second portion of the RLOC tuple;
• identify a first endpoint identifier for a destination using a longest match algorithm based, at least in part, on the source identifier and the destination identifier of the RLOC tuple, and identify an indication of an intermediate path hop from the indications of routers corresponding to the first endpoint identifier;
• and
• transmit the first endpoint identifier and the indication of the intermediate path hop to the first tunneling router.