Method and apparatus for self-learning of VPNS from combinations of unidirectional tunnels in MPLS/VPN networks
AssigneeCisco Technology, Inc.
InventorsOfer Weill, Assi Abramovitz
Life of this patent
Estimating the term…
Abstract
In one embodiment, a data packet is received at a network device. A layer-2 identification (L2ID) value is identified for the received data packet based on a destination address and a label stack of the received data packet. The L2ID value is specific to an application associated with the data packet. A 6-tuple is created that includes the L2ID value. The received data packet is classified using the 6-tuple. Deep packet inspection (DPI) services are performed based on the classification of the received data packet. The DPI services apply a set of one or more application-level policies to the received data packet. The received data packet is forwarded from the network device toward a destination.
Claims20
A method comprising:
- monitoring, at a network device, unidirectional channels for a predetermined set of provider edge (PE) devices in a network;
- identifying a layer-2 identification (L2ID) value for a data packet in the unidirectional channels based on a destination media access control (MAC) address and a label stack of the data packet, the L2ID value specific to an application associated with the data packet, the L2ID value distinct from any MAC address and any virtual private network (VPN) label included in the label stack of the data packet;
- creating a 6-tuple that includes the L2ID value, wherein the creating includes
- generating a 5-tuple that includes a protocol identifier, a source internet protocol (IP) address, a destination IP address, a source port number, and a destination port number, and
- combining the generated 5-tuple with the L2ID;
- classifying the data packet using the 6-tuple;
- and
- performing deep packet inspection (DPI) services based on the classification of the data packet, the DPI services applying a set of one or more application-level policies to the data packet.
An apparatus comprising:
- a data path unit configured to identify a layer-2 identification (L21 D) value for a data packet in unidirectional channels of a network based on a destination media access control (MAC) address and a label stack of the data packet, the L2ID value specific to an application associated with the data packet, the L2ID value distinct from any MAC address and any virtual private network (VPN) label included in the label stack of the data packet, wherein the unidirectional channels are for a predetermined set of provider edge (PE) devices in the network;
- a classifier configured to create a 6-tuple that comprises the L2ID value and a 5-tuple that includes a protocol identifier, a source internet protocol (IP) address, a destination IP address, a source port number and a destination port number, and further configured to classify the data packet using the 6-tuple;
- and
- a packet processor configured to apply a set of one or more application-level policies to the data packet based on the classification of the data packet.
A non-transitory computer-readable storage medium storing instructions for performing deep packet inspection (DPI) services, the instructions when executed by a processor causing the processor to:
- monitor unidirectional channels for a predetermined set of provider edge (PE) devices in a network;
- identify a layer-2 identification (L2ID) value for a data packet in the unidirectional channels based on a destination media access control (MAC) address and a label stack of the data packet, the L21D value specific to an application associated with the data packet, the L2ID value distinct from any MAC address and any virtual private network (VPN) label included in the label stack of the data packet;
- create a 6-tuple that includes the L2ID value, wherein the 6-tuple is created by
- generating a 5-tuple that includes a protocol identifier, a source internet protocol (IP) address, a destination IP address, a source port number, and a destination port number, and
- combining the generated 5-tuple with the L2ID;
- classify the data packet using the 6-tuple;
- and
- perform the DPI services based on the classification of the data packet, the DPI services applying a set of one or more application-level policies to the data packet.
Dependencies are inferred from the claim text.