Domain isolation through virtual network machines

A single network device, comprising:

• a set of one or more processors;
• communications hardware to transmit and receive packets to and from a plurality of end stations;
• and
• a non-transitory computer-readable medium having stored therein a set of instructions that, when executed by the set of processors, cause the single network device to,
• create a plurality of virtual routers that will share a set of physical resources of the single network device, wherein each of the plurality of virtual routers is to belong to a different one of a plurality of virtual private networks,
• authenticate, using an authentication, authorization and accounting (AAA) protocol, users based upon a plurality of records, wherein the plurality of users utilize the plurality of end stations communicatively coupled with the single network device, wherein each of the plurality of records is to comprise information to indicate which of the plurality of virtual routers the respective end station is to be coupled to, and
• communicatively couple, within the single network device, different ones of the plurality of end stations with different ones of the virtual routers based on the information that is to be obtained using the AAA protocol during said authenticating.

A network, comprising:

• an Authentication, Authorization, and Accounting (AAA) server that stores a plurality of records, wherein each of the plurality of records is to comprise information to indicate which of a plurality of virtual routers a respective end station of a plurality of end stations is to be coupled to;
• and
• a single network device coupled to the AAA server, wherein the single network device includes,
• a set of one or more processors,
• communications hardware that transmits and receives packets to and from the plurality of end stations, and
• a non-transitory computer-readable medium having stored therein a set of instructions, that, when executed by the set of processors, cause the single network device to,
• create the plurality of virtual routers that will share a set of physical resources of the single network device, wherein each of the plurality of virtual routers is to belong to a different one of a plurality of virtual private networks,
• authenticate, using an authentication, authorization and accounting (AAA) protocol and the AAA server, the plurality of users based upon the plurality of records, wherein the plurality of users utilize the plurality of end stations communicatively coupled with the single network device, and
• communicatively couple, within the single network device, different ones of the plurality of end stations with different ones of the virtual routers based on the information that is to be obtained using the AAA protocol during said authenticating.

A single network device to implement a plurality of virtual routers that share a set of physical resources of the single network device, wherein each of the plurality of virtual routers belongs to a different one of a plurality of virtual private networks, the single network device comprising:

• a set of one or more processors;
• communications hardware to transmit and receive packets to and from a plurality of end stations;
• and
• a non-transitory computer-readable medium having stored therein a set of instructions that, when executed by the set of processors, cause the single network device to,
• responsive to an initial communication with an end station of the plurality of end stations that is to be utilized by a user, authenticate the user with an Authentication, Authorization, and Accounting (AAA) server to determine information that identifies a virtual router of a plurality of virtual routers that the end station of the user is to be coupled to, wherein said authentication is to utilize a Remote Authentication Dial-In User Service (RADIUS) protocol, and
• communicatively couple, within the single network device through a binding data structure, the end station of the user with the identified virtual router of the plurality of virtual routers based on said determined information.

A network, comprising:

• an Authentication, Authorization, and Accounting (AAA) server that stores a plurality of records, wherein each of the plurality of records comprises information to indicate which virtual router of a plurality of virtual routers a respective end station of a plurality of end stations is to be coupled to;
• and
• a single network device coupled to the AAA server, wherein the single network device implements the plurality of virtual routers that share a set of physical resources of the single network device, wherein each of the plurality of virtual routers belongs to a different one of a plurality of virtual private networks, wherein the single network device includes,
• a set of one or more processors,
• communications hardware that transmits and receives packets to and from the plurality of end stations, and
• a non-transitory computer-readable medium having stored therein a set of instructions that, when executed by the set of processors, cause the single network device to,
• responsive to an initial communication with an end station of the plurality of end stations that is to be utilized by a user, authenticate the user with the AAA server to determine information that identifies a virtual router of the plurality of virtual routers that the end station of the user is to be coupled to, wherein said authentication is to utilize a Remote Authentication Dial-In User Service (RADIUS) protocol, and
• communicatively couple, within the single network device through a binding data structure, the end station of the user with the identified virtual router of the plurality of virtual routers based on said determined information.

A single network device to implement a plurality of virtual routers that share a set of physical resources of the single network device, wherein each of the plurality of virtual routers belongs to a different one of a plurality of virtual private networks, the single network device comprising:

• a set of one or more processors;
• communications hardware to transmit and receive packets to and from a plurality of end stations;
• and
• a non-transitory computer-readable medium having stored therein a set of instructions that, when executed by the set of processors, cause the single network device to,
• responsive to an initial communication with an end station of the plurality of end stations that is to be utilized by a user, receive authentication and authorization information about the user from an Authentication, Authorization, and Accounting (AAA) server that identifies a virtual router of the plurality of virtual routers that the end station of the user is to be coupled to, wherein said AAA server utilizes a Remote Authentication Dial-In User Service (RADIUS) protocol, and
• communicatively couple, within the single network device through a binding data structure, the end station of the user with the identified virtual router of the plurality of virtual routers based on said authentication and authorization information.