US 7,742,479 B1Granted

Method and apparatus for dynamic network address reassignment employing interim network address translation

AssigneeCisco Technology, Inc.

InventorsMurty Subba Rama Chandra Kotha, Richard Manfred Pruss, Matthew Lawrence King

Life of this patent

Estimating the term…

Loading patent…

Abstract

An edge router termed a “service gateway” operates to reassign network addresses such as Internet Protocol (IP) addresses to a subscriber, such as when the subscriber is to be transitioned from a first virtual private network (VPN) to a second VPN. The service gateway obtains a new network address routable in a second VPN and applies dynamic edge network address translation (NAT) on an interim basis to provide instant access to the second VPN (following web-based identification for example), while a prior lease for an initial network address not routable in the second VPN is still in effect. When the subscriber attempts to renew the lease in due course, the renewal request is rejected, which forces the subscriber to re-initiate dynamic host control protocol (DHCP) procedures to obtain a new network address. At this point, the interim NAT mapping is removed and the new network address is assigned directly to the subscriber via DHCP. This approach combines the benefits of DHCP and NAT while minimizing dead time on the network and the processing overhead associated with alternative approaches.

Claims20

Dependent claims

A method of adding a subscriber to a virtual private network (VPN), the subscriber having previously been configured with a first network address that is not routable in the VPN, the method comprising:

(1) during an interim period in which the subscriber attempts to exchange subscriber data packets with the VPN using the first network address:
(a) obtaining, on behalf of the subscriber, a second network address that is routable in the VPN;
and
(b) performing network address translation to translate between the subscriber data packets having the first network address and corresponding network data packets in the VPN, each network data packet including the same information as a corresponding subscriber data packet but identifying the subscriber by the second network address instead of the first network address;
and
(2) upon the subscriber reaching an operating condition in which the subscriber can become configured with a new network address:
(a) providing the second network address to the subscriber for use by the subscriber in exchanging future data packets with the VPN;
and
(b) subsequently permitting direct, non-translated exchange of the future data packets between the subscriber and the VPN,
wherein:
(i) providing the second network address to the subscriber includes providing the second network address as part of a response indicating that the second network address is to be used in a source address field of the subscriber data packets to identify the subscriber in the VPN;
and
(ii) subsequently permitting direct, non-translated exchange of the future data packets between the subscriber and the VPN includes receiving the subscriber data packets from the subscriber which include the second network address in the source address field and refraining from performing the network address translation to the second network address in the source address field of the received subscriber data packets.

10 more elements

A service gateway for adding a subscriber to a virtual private network (VPN), the subscriber having previously been configured with a first network address that is not routable in the VPN, the service gateway comprising:

a plurality of port adapters for interfacing with subscribers and with the VPN;
a switch fabric operative to forward packets from ingress ports to egress ports of the port adapters;
and
a processor operative to:
(1) during an interim period in which the subscriber attempts to exchange subscriber data packets with the VPN using the first network address:
(a) obtain, on behalf of the subscriber, a second network address that is routable in the VPN;
and
(b) perform network address translation to translate between the subscriber data packets having the first network address and corresponding network data packets in the VPN, each network data packet including the same information as a corresponding subscriber data packet but identifying the subscriber by the second network address instead of the first network address;
and
(2) upon the subscriber reaching an operating condition in which the subscriber can become configured with a new network address:
(a) provide the second network address to the subscriber for use by the subscriber in exchanging future data packets with the VPN;
and
(b) subsequently permit direct, non-translated exchange of the future data packets between the subscriber and the VPN,
wherein:
(i) the processor is operative when providing the second network address to the subscriber to provide the second network address as part of a response indicating that the second network address is to be used in a source address field of the subscriber data packets to identify the subscriber in the VPN;
and
(ii) subsequently permitting direct, non-translated exchange of the future data packets between the subscriber and the VPN includes receiving the subscriber data packets from the subscriber which include the second network address in the source address field and refraining from performing the network address translation to the second network address in the source address field of the received subscriber data packets.

14 more elements

means for interfacing with subscribers and with the VPN;
means for forwarding packets from ingress ports to egress ports of the port adapters;
means, operative during an interim period in which the subscriber attempts to exchange subscriber data packets with the VPN using the first network address, for:
(a) obtaining, on behalf of the subscriber, a second network address that is routable in the VPN;
and
(b) performing network address translation to translate between the subscriber data packets having the first network address and corresponding network data packets in the VPN, each network data packet including the same information as a corresponding subscriber data packet but identifying the subscriber by the second network address instead of the first network address;
and
means, operative upon the subscriber reaching an operating condition in which the subscriber can become configured with a new network address, for:
(a) providing the second network address to the subscriber for use by the subscriber in exchanging future data packets with the VPN;
and
(b) subsequently permitting direct, non-translated exchange of the future data packets between the subscriber and the VPN,
wherein:
(i) providing the second network address to the subscriber includes providing the second network address as part of a response indicating that the second network address is to be used in a source address field of the subscriber data packets to identify the subscriber in the VPN;
and
(ii) subsequently permitting direct, non-translated exchange of the future data packets between the subscriber and the VPN includes receiving the subscriber data packets from the subscriber which include the second network address in the source address field and refraining from performing the network address translation to the second network address in the source address field of the received subscriber data packets.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/607,585Filed 1 Dec 2006
Granted: 22 Jun 2010
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 12/4679
Dynamic sharing of VLAN information amongst network nodes: arrangements for the registration or de-registration of VLAN attribute values, e.g.…
H04L 45/50
Routing or path finding of packets in data switching networks: using label swapping, e.g. multi-protocol label switch [MPLS]
H04L 61/2503
Of the same type: translation of Internet protocol [IP] addresses
H04L 61/2592
Translation of Internet protocol [IP] addresses: using tunnelling or encapsulation