KR100382143B1 - Method for Providing Extranet VPN Service in MPLS Network - Google Patents

Abstract

The present invention relates to a method for providing an extranet VPN service in a multi-protocol label switching network (MPLS) network and a functional configuration of an apparatus therefor. To provide an extranet VPN service, the extranetnet function is distributed to one or more MPLS LER devices, and the extranetnet function controls the distribution of route information and packet access filtering for the extranet. To improve the scalability and increase the reliability of traffic growth, VPN routing can be simultaneously provided to simultaneously provide the Internet / Extranet VPN service without affecting the existing MPLS VPN Intranet service provisioning mechanism. Route target information and VPN label information used in the hierarchical structure are used.

Description

How to provide extranet virtual private network service in MPS network {Method for Providing Extranet VPN Service in MPLS Network}

The present invention relates to a method for providing a virtual private network (VPN) service over a public network, and more particularly, to a method for providing an extranet virtual private network service capable of improving scalability and reliability in an MPLS network (Multi Protocol Label Sitching Network). will be.

In the existing MPLS virtual private network service providing method, the routing and forwarding information can be configured to configure a closed user group for each virtual private network group in the MPLS LER system, and the virtual private network packet is forwarded to the destination using the routing and forwarding information. Function is provided. In general, an intranet service is provided to support an unlimited connection between sites belonging to the same virtual private network group, and an extranet service is not supported.

An object of the present invention for solving the above problems is to utilize the route target and the virtual private network label variable used in the existing MPLS virtual private network interlannet service without affecting the existing service providing mechanism, the intranet / extranet virtual private network The present invention provides a method of providing an extranet network private network service in an MPS network that can simultaneously provide a service.

In addition, the present invention reduces the configuration complexity of the LER system and expands the service by distributing and deploying the extranet gateway function in one or more LER systems in the public network, and controlling the distribution of the route information for the extranet in the extranet gateway function. The purpose is to provide a way to provide an Xtralan virtual private network service in the MPS network that can guarantee performance and reliability.

Accordingly, an object of the present invention is to provide a virtual private network service in an MPLS-based network to provide not only an intranet service but also an extranet service, improving the scalability and reliability of the service, and interoperating with an existing interlannet service providing mechanism. It is to realize how to have.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a diagram showing a configuration example of an MPLS extranet service system.

2A and 2B are diagrams for explaining a transmission path of an intranet and an extranet packet.

3 is a structure diagram of route target information for supporting an extranet service;

4 is a structural diagram of VPN label information for supporting an extranet service according to the present invention;

5A and 5B are flowcharts illustrating the generation and delivery process of the extranet route information of the shared server side and the extranet gateway side LER using the VPN label information and the route target information shown in FIG.

Fig. 6 is a flowchart for explaining a process of processing an extranet packet of the LER of the extranet gateway side.

Fig. 7 is a block diagram of a virtual private network service function block of an LER of an extranet gateway side.

In order to achieve the above object, the present invention provides a method for providing an extranet virtual private network service in an MPLS-based service network, wherein the shared server side PE corresponds to an extranet among route target values of route information transmitted from the shared server. A first step of confirming whether the value has a value of? In the first step, when the server has an extranet route, the address information of the extranet / gateway side PE is determined from the set route target value, and an egress output process may be performed on the packet going to the shared server side. A second step of newly assigning a specific virtual private network label so as to be assigned; A third step of recording the virtual private network label and the shared server side output interface information allocated in the second step, generating route information for the shared server, and transmitting the generated route information to the identified externalnet gateway side PE; step; A fourth step of receiving, by the extranet gateway side PE, the route information of the third step, and determining whether it is an extranet route by examining a route class field of a route target value included in the route information; A fifth step of searching for the corresponding extranet group site information by referring to the route index information of the route target value in the case of the extranet path in the fourth step; A sixth step of newly assigning a virtual private network label to allow the extranet gateway forwarding process for the access right check on the extranet gateway side; A seventh step of recording the virtual private network label and the received route information allocated in the sixth step and updating the virtual private network label value of the received route information and "Next Hop" information to be transmitted to the extranet site side PE; And an eighth step of receiving the route information of the seventh step by the extranet site-side PE and processing the same as the intranet route information.

The above object and various advantages of the present invention will become more apparent from the preferred embodiments of the present invention described below with reference to the accompanying drawings by those skilled in the art.

First, the technical concept to be applied in the present invention and the technical background to which the present invention is applied will be briefly described.

In general, MPLS virtual private network service is a service that supports connection between sites belonging to the same virtual private network group through Internet service provider (ISP) without restriction. In order to provide MPLS virtual private network service, MPLS edge device is generally used. In addition to the MPLS LER function, it has two additional functions: a closed user group configuration function for each virtual private network group, and a forwarding processing function for the virtual private network packet.

The CUG configuration function for each virtual private network group is a function of constructing a virtual private network routing and forwarding table (VRFT) having limited routing and forwarding information of virtual private network sites belonging to each virtual private network group.

MPLS transfers routing information for each virtual private network site by using BGP4 extended routing protocol to configure virtual private network routing and forwarding table (VRFT) for each virtual private network group. In this case, destination address and prefix which are generally delivered routing information In addition to the Prefix and Next Hop information, the virtual private network label and route target information are additionally delivered for the virtual private network service.

The virtual private network label information is information for determining the output interface of the destination virtual private network site at the output terminal LER, and the route target information is route filtering information for restricting distribution and reflection of routing information only between the virtual private network sites belonging to the same group. Used. The forwarding processing function for the virtual private network packet recognizes the virtual private network packet for the traffic coming from a specific virtual private network site, and looks up the virtual private network routing and forwarding table (VRFT) that is made in advance, and looks up the LSP for the backbone at the input terminal LER. After the virtual private network label is inserted and delivered to the backbone LSP, the transit LSR forwards the output terminal LER through MPLS label swapping in the same way as a general label packet.

The output LER determines the destination output interface according to the virtual private network label in the packet and delivers it to the final destination virtual private network site. In general, the MPLS virtual private network service provides an intranet service supporting an unlimited connection between virtual private network sites belonging to the same virtual private network group.

But. In recent years, as the "business-to-business" application has become more common, the use of the Internet has led to the generalization of the establishment of business cooperative systems among organizations such as suppliers, customers, and communities. The demand for services is growing.

Therefore, there is a need for a method of supporting an extranet network service configuration allowing limited access to external sites to some shared servers belonging to the virtual private network site in the MPLS virtual private network.

In this case, two functions are greatly required to provide an extranet service in the MPLS virtual private network. First, the access authority control function to control access authority to the extranet sharing server should be provided as a public network service. In other words, a kind of public firewall system (hereinafter, "extranet gateway") should be installed in the public network device.

The second is to control the forwarding path of extranet packets so that packets for the extranet can be passed through the extraterrestrial gateway system to access the specific extranet shared server and then forwarded to the final destination extranet shared server. Function.

To do this, hosts that are allowed to access the Internet and the Internet simultaneously must provide two different route information to the remote sites. That is, BMP4 extension path information for general MPLS-Virtual Private Network can be distributed directly to remote LERs for sites belonging to the intranet, and indirectly routed through the extranet gateway function for sites belonging to the extranet. Should be distributed to LERs.

In other words, in order to support the extranet service, each LER system needs to independently generate configuration information for the extranet sites and generate and distribute separate path information for the internet and extranet sites. The extranet service configuration of the system becomes very complicated and the problem is that it is not easy to change. In addition, the extranet gateway function is installed in a fixed LER location in the network, which causes a single point performance bottleneck in case of extranet traffic increase or failure of the extranet gateway function.

Accordingly, the present invention relates to a functional configuration of a method and apparatus for providing an extranet virtual private network service in an MPLS-based network, and in particular, by utilizing a route target and a virtual private network label variable used in an existing MPLS virtual private network interlannet service. It is intended to enable the provision of an Extranet virtual private network service with improved scalability and reliability without affecting an existing service provision mechanism. The present invention is broadly constructed as follows.

To improve service scalability and reliability, and to reduce the complexity of the functions, an extranet gateway function is distributed in one or more LER systems within the network. Each extranet gateway function distributes routing information for a specific group of extranets. Responsible for filtering extranet packets.

The LER system connected to the extranet sharing server sends the route information for the extranet sharing server to the responsible extranet gateway system, and the extranet information is sent to the corresponding extranet group configuration information. It relays to remote LER systems with reference.

In order to do this, the LER system connected to the extranet sharing server must first determine its own extranet gateway system, which is configured to automatically know using the route target information set at the site.

Second, the route control should be performed so that the extranet network packet can be delivered to the destination LER via the extranet gateway function. For this, the existing virtual private network label information is used. That is, the LER system receiving the extranet packet can determine the packet processing process at the node by examining the virtual private network label value included in the packet.

That is, the processing of egress forwarding to the final output interface, packet forwarding to the external LAN gateway for access authority checking, and relay forwarding for relaying packets to the final output LER after the access right checking are completed can be performed. Assign a virtual private network label value to the configuration.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration and an operation example of an extranet MPLS service system to which the present invention is applied.

In FIG. 1, "Pink" denoted by reference numeral 102 on the MPLS network 101 for the operator is independently configured and operated by the intranet virtual private network of the company "Blue" denoted by the reference numeral 103. Assume

In this situation, if the two organizations need "business-to-business" to have a business partnership, then refer to the shared server 132 on the first pink site, referred to as 121, to configure the extranet. This is the case when you need to allow access to Bluesites, which are numbered 123 and 124.

At this time, the MPLS network 101 is composed of the LER system (111 ~ 114) and LSR (115). The LER system 111 to 114 has a CUG configuration for the virtual private network service and a forwarding function of the virtual private network packet, and the LSR system 115 has a packet switching function by general label swapping.

In addition, the virtual private network 102 of the "Pink" company is a CUG group composed of the first pink site 121 and the second pink site 122, the virtual private network 103 of the "Blue" company is the first A CUG group consisting of a bluesite 123 and a second bluesite 124, which are connected to a logical private network by LSPs 116 and 117 on an MPLS network.

Accordingly, each of the virtual private network sites 121, 122, 123, and 124 is configured as a single host, a router, or a switch system, and the subscriber terminal device does not have a separate function for the virtual private network service.

The terminal equipment of each site transmits route information about the site to the network through LER devices 111 to 114, which are network side edge devices, and general routing protocol or manual configuration.

A configuration and an operation procedure for a general intranet service configured as shown in FIG. 1 are as follows.

The LER systems 111 to 114 exchange virtual private network routing information by using the same LER system (hereinafter referred to as PE) and BGP4 extension protocol to configure routing and forwarding information for CUG for each virtual private network group. do. That is, the first PE 111 exchanges routing information about the second PE 112 with the first pink site 121 and the second pink site 122, and based on this, VRFT: P1 referred to as reference numerals 141 and 142. And VRFT: P2.

At this time, each VRFT records information necessary for forwarding a packet to each virtual private network site (DA, Prefix, Next Hop, Top label, virtual private network label, port and interface information, and route target). When an intranet packet directed from the first pink site 121 to the second pink site 122 is input to the first PE 111, the first PE 111 looks up a preconfigured VRFT: P1 141 to display the second PE (141). It finds the Top label 117 and the virtual private network label for the LSP directed to 112, inserts it into the virtual private network packet, and forwards it to the LSP referred to by reference number 117.

The virtual private network packet arrives at the second PE 112 via the LSP 117. The second PE 112 searches for the VRFT: P2 142 using the virtual private network label information carried in the virtual private network packet to find the output interface directed to the second pink site 122 to forward the packet to the final destination. .

Accordingly, the configuration and operation procedure of the system for providing an extranet service in FIG. 1 are as follows.

The intranet / extranet shared server 132 is connected to the first PE 111, and the extranet gateway function 131 having the route information transfer control and the access authority control function for the extranet is a third party LER. Assume that the system is mounted on the third PE 114, which is a system.

As the network grows, the extranet gateway functionality may be distributed across one or more LER systems. When the route information for the shared server 132 is transmitted to the first PE 111 node, the route information is transmitted from the route target value recorded in the VRFT: P1 141 at the first PE 111 node. It will be recognized that it should be delivered to the site.

The route information transmission to the intranet site side is transferred to the second PE 112 node through the general virtual private network IPv4 route transmission process described above, and recorded in the VRFT: P2 142. The route information delivery for the extranet site is not delivered to the fourth PE 113, but to the third PE 114, which is the third PE 114 having the extranet gateway 131 in the route target value. By including address information for the node, it can be recognized automatically.

Accordingly, when the third PE 114 receives the address information of the shared server from the first PE 111 node, it determines that the route information for the extranet is from the virtual private network label and the route target value included in the route information. Query 131 to determine the extranet site information to be relayed and re-deliver it to the fourth PE 113 node to which the second bluesite 124 is connected, and the information is transmitted to the second blue node. Is recorded in VRFT: B2 144 at site 124.

In addition, when delivering route information, a virtual private network label is assigned and delivered together. First, when the first PE 111 transmits route information to the third PE 114, a virtual interface for determining an interface capable of forwarding an extranet packet destined for the shared server 132 from the first PE 111 may be determined. The private network first label is assigned and forwarded to the third PE 114 when the route information is transmitted, and this information is recorded in the VRFT: Ex 145 table for the extranet of the "Blue" company in the third PE 114. do.

Similarly, when the route information is transmitted from the 3PE 114 to the 4PE 113 side, the virtual private network second label is allocated to forward the extranet packet to the extranet gateway in the 3PE 114 side. When delivered, it is delivered to the 4PE 113 side together, and this information is recorded in the VRFT: B2 144 table in the 4PE 113.

Thereafter, the processing of the packet connecting the shared server 132 located in the first pink site 121 in the second blue site 124 is as follows.

The fourth PE 113 node looks up the VRFT: B2 144 when a packet destined for the shared server 132 from the second blue site 124 is introduced. In the VRFT: B2 144, "Next Hop" is the third PE 114 in the case of a packet destined for the shared server 132, and a virtual private network second label value is registered.

Therefore, once this information is inserted into the packet and sent to the third PE 114 node, the third PE 114 recognizes that the packet is an extranet packet from the virtual private network second label value contained in the packet. This is sent to the extranet gateway 131 function.

The extranet checks the access rights of the source and destination address information and the protocol information of the packet. If the access right is violated, the packet is discarded. If not, the packet is discarded and the packet is relayed to the first PE 111 node as the final destination by changing to the first label value assigned to the virtual private network.

The first PE 111 node searches for the VRFT: P1 141 to determine the output interface corresponding to the first label of the virtual private network and forwards the packet to the first pinksite 121 packet.

2A and 2B are diagrams illustrating transmission paths of an intranet packet and an extranet packet in the system configuration shown in FIG.

FIG. 2A is a forwarding path of an intranet packet, in which a packet connected to a shared server 203 located at a first pink site 202 in a second pink site 201 among a virtual private network that is the same virtual private network group is a preset direct LSP. Is passed through the ingress LER 211 and via the LSRs 212 and 213 to the egress LER 214 where the final output interface is determined and sent to the first pink site 202. Lose. Of course, the path is determined by looking up the above-described VRFT and virtual private network label values.

In addition, FIG. 2B is a route for transmitting an extranet packet, which is a packet connected to the shared server 223 located at the first pink site 222 by the third blue site 221 of the virtual private network, which is an extranet virtual private network group. The node is relayed to the Egress LER 236 node via the PE3 233 node where the extranet gateway is located, and for this purpose, the packet is forwarded along two LSPs.

The ingress LER 231 forwards the packet to the LSP1 paths 231, 232, and 233 to the extranet gateway side, checks the packet access authority at the extranet gateway, and then passes the passthrough LSR 235 again. Egress is sent to the LER 236, where the final output interface is determined and sent to the first pink site 222. Of course, the path is determined by looking up the above-described VRFT and virtual private network label values.

The same reference numerals are given to the same names among the above-mentioned contents, which are for distinguishing each drawing, and are not different from each other and generally follow the configuration of FIG. 1.

3 is a structural diagram of route target information for supporting an MPLS extranet service.

The route target value is a filter index for controlling distribution of routing information, and one or more values are set by the operator for each virtual private network site.

If the routing information of the local virtual private network site is changed and needs to be notified to the remote LERs, the route target value of the routing information is filtered to be known only to the same LERs, and the routing information for the virtual private network site from the remote LER is likewise updated. Also, when it receives, it filters with reference to the route target value.

Therefore, in the present invention, the Internet / Extranet service is simultaneously supported, and the extranet routing information includes the address information of the LER device equipped with the corresponding externalnet gateway so that the service scalability and operation management can be simplified. Have an enemy structure.

In this case, the route target value is composed of 8 bytes. The route target value is composed of a hierarchical structure of a router manager ID referred to by reference numeral 301 and a router ID referred to by reference numeral 302 in order to distinguish between the intranet and the extranet route target. The router ID 302 is composed of a 2-bit route class of reference number 303 and a 14-bit route index of reference number 304 indicating the type of the intranet / extranet path.

In addition, the router manager ID 301 has 4 bytes, and in the case of an extranet route, the router manager ID 301 is an Ipv4 address of the LER equipped with the responsible extranet gateway that manages the distribution of the corresponding route information. It consists of LER's IPv4 address information.

4 is a structural diagram of virtual private network label information for supporting an extranet service, and a process of processing a virtual private network packet at an MPLS terminal apparatus is mainly performed by forwarding processing to an subscriber site (egress forwarding) and an extra-gate (extra-gate). The forwarding process (extra-gate forwarding) for access filtering at the gate side PE and the relay forwarding process to the destination PE at the extra-gate side PE should be distinguished.

In order to effectively distinguish this, the virtual private network label is composed of a 2-bit label type separator 401 and 18-bit label index information 402. The label type separator 401 indicates a forwarding scheme, and the index information 402 indicates an index for a table for output IF or access filtering. When the Xtranet gateway and egress LER receives a virtual private network packet, it knows what procedure to perform by examining the virtual private network label value contained in the packet.

5A and 5B show a procedure of generating and transferring extranet route information, FIG. 5A illustrates a process performed by a shared server side PE, and FIG. 5B illustrates a process performed by an extranet gateway side PE.

That is, in the shared server side PE (reference numeral 111 of FIG. 1), different route information should be configured and provided to the remote sites for the route information for hosts that allow simultaneous access to the internet and the extranet. . To this end, in the shared server side PE (reference numeral 111 of FIG. 1 attached), the method for distinguishing between the intranet / extranet route information and the extranet for the route information received from the shared server (reference numeral 132 of FIG. 1 attached). There is a need for a method for generating and delivering route information.

In FIG. 5A, the shared server side PE (111 in FIG. 1) receives route information from the shared server (132 in FIG. 1) and then determines whether the host address should be distributed to the extranet. The determination may be made by examining whether the route target value set for the interface has a value corresponding to the extranet.

If it does not have an extranet route, the general intranet route information distribution procedure continues (503). In the case of having an extranet route, Ipv4 address information of the extranet-gateway side PE (114 in FIG. 1) is read from the set route target value (504).

A virtual private network label having the configuration of FIG. 4 is newly assigned to allow an egress output process for a packet going to the shared server side (505). The virtual private network label and the shared server side output interface information are then recorded in the VRFT (141 in FIG. 1) (506). This information is used for exit output processing when packets destined for the first pink site (121 in FIG. 1) from other virtual private network sites arrive.

Then, an extranet route route information for the shared server is generated (507), and a route update message is sent to the extranet gateway side LER (114 in FIG. 1) obtained in step 504 (508). At this time, route target and virtual private network label information are sent together using the extended BGP4 routing protocol.

In addition, in FIG. 5B, the extranet gateway side PE (114 in FIG. 1) receives the extranet route information from the shared server side PE (111 in FIG. 1), and then the route target value loaded in the route information (511). The route class field of the terminal is examined to determine whether it is an extranet route (512). If it is not the extranet route, the general internetwork route processing process continues (513).

In the case of the extranet route, the corresponding extranet group site information is searched for by referring to the route index information of the route target value (514). A virtual private network label having the configuration of FIG. 4 is newly assigned to allow the extranet gateway forwarding process for the access right check on the extranet gateway side (515).

Subsequently, the newly allocated virtual private network label and the route information received in step 511 are recorded in the VRFT (145 in FIG. 1) (516). This information is used to relay packets that have been forwarded and checked for access rights to the Extranet gateway to the final destination when an extranet packet arrives from another virtual private network site to the first pink site (121 in FIG. 1). Used as route information.

Subsequently, the virtual private network label value and the "Next Hop" information of the route information received in step 511 are newly modified and sent to the external network site side LER (113 in FIG. 1) (518). At this time, as described above, the route target and the virtual private network label information are sent together using the extended BGP4 routing protocol. When the route information is received from the extranet gateway side PE (114 of FIG. 1), the extranet site side (113 in FIG. 1) is processed in the same manner as the general internet route information. That is, the extended path information is simply stored in the VRFT.

6 is a flowchart illustrating processing of an extranet packet at the LER of the extranet gateway side.

In the external LAN gateway side LER (114 in FIG. 1), the received packet is divided and filtered for the shared server access authority in the case of the extranet packet, and then the shared server side LER as the destination for the packets allowed to access. Relay to (111 in FIG. 1).

When the packet arrives from another MPLS system (601), the LER (114 in FIG. 1) examines the second label carried in the packet first (602). If the second label is empty, it is not a virtual private network packet, and thus the general packet processing procedure is continued (603). In the case of the virtual private network packet, an execution procedure is determined by examining the label class (401 of FIG. 4) field of the virtual private network label (631, 611, 621).

If the label class (401 in FIG. 4) field value is the virtual private network "Filtering" label (401 in FIG. 4), filtering on the access rights of the shared server is performed. Therefore, the packet is forwarded to the extranet gateway function block. (611).

In the extranet gateway function block, the label index field value (401 in FIG. 4) is used to determine the group of the extranet virtual private network to be searched and the access authority is examined using the values (source, destination, protocol) and the like. (612). If the access right is violated, the packet is discarded (613).

If there is no problem with the access right, after changing the value of the label class (401 in FIG. 4) field of the virtual private network label of the packet to the virtual private network relay label (401 in FIG. 4), the virtual private network packet forwarding Transfer to the functional block (615).

If the label class (401 in FIG. 4) field value is the virtual private network extranet relay label (401 in FIG. 4), the VRFT: Ex (145 in FIG. 1) is searched using the label index value and the shared server side as the final destination. Search for route information to go to LER (111 in FIG. 1), find new backbone LSP and virtual private network label value (621), change it in packet (622), and forward forward to shared server side LER (111 in FIG. 1). (623).

If the label class (401 in FIG. 4) field value is the virtual private network exit label (401 in FIG. 4), the general VRFT is searched using the label index value (631) and forwarded to the corresponding output interface (632).

FIG. 7 is a block diagram illustrating the function of the virtual private network service function block of the LER of the extranet gateway side, and the LER (114 in FIG. 1) of the external internet gateway side is largely divided into a VPN_RF_Manager 701 to provide an intranet / extranet virtual private network service. The VPN_Pkt_Handler 702, the VPN_Srv_Manager 703, the extranet_gateway 704, and the virtual private network operation management command processing block 704 functions.

The VPN_RF_Manager 701 collects routing information between virtual private network sites (711), configures routing and forwarding information tables for CUG groups for each virtual private network group (713), generates and transmits routing information for an extranet. 712, a process of creating, assigning and retrieving a virtual private network label is processed (714). Collection of routing information between virtual private network sites uses BGP4 extension protocol, and VRFT for each CUG group created in VRFT_Master is lowered to VPN_Pkt_Handler (702) block and used in actual virtual private network packet forwarding process.

In addition, the VPN_Pkt_Handler 702 analyzes the packet input from the other MPLS node or the subscriber site to determine whether the packet is a virtual private network packet (721), and in the case of the virtual private network packet, an Ingress forwarding process (723) according to the required procedure. An egress forwarding process 724 handles packet forwarding and relay delivery 725 to the extranet gateway side when access filtering is required as an extranet packet.

The VRFT_Slave 722 processes addition, deletion, and change of forwarding entry information of the VRFT 726 under the control of the VRFT_Master 713. VRFT 726 is a table that stores routing and forwarding entry information for each virtual private network group, and includes the virtual private network site (destination address, next hop address, prefix, backbone LSP label, virtual private network label, route target, and port information). It consists of.

In addition, VPN_Srv_Manager 703 is a management function block for the introduction and operation management of the virtual private network service, the contract for the virtual private network service (732), the configuration management for the group, site, connection for the virtual private network service (731), virtual It performs monitoring function of the private network service operation performance and state (733).

The function of the extranet gateway 704 also includes configuration management and path distribution management 741 for the extranet network private network group and access right filtering 742 for each extranet group.

Finally, the virtual private network operation management command processing block 705 processes operator commands for contract, configuration management, state management, etc. for the virtual private network service.

While the invention has been shown and described in connection with specific embodiments thereof, it is well known in the art that various modifications and changes can be made without departing from the spirit and scope of the invention as indicated by the claims. Anyone who owns it can easily find out.

Provided a method and apparatus for providing an extranet network private network service in an MPS network according to the present invention operating as described above, without affecting the existing MPLS virtual private network internetwork service provision mechanism, To provide net virtual private network service at the same time.

In addition, the extranet gateway function is distributed to one or more MPLS LER devices, and the extranet gateway function controls the distribution of the extranet information and the packet access filtering, thereby improving the scalability of the extranet service traffic. To ensure reliability.

Claims (6)

(delete) A method for providing an extranet virtual private network service in an MPLS-based service network, A first step of confirming whether the shared server side PE 111 has a value corresponding to an extranet among the route target values of the route information transmitted from the shared server 132; In the case of having the extranet route in the first step, the address information of the extranet-gateway side PE 114 is determined from the set route target value, and an egress output process is performed on the packet going to the shared server side. A second step of newly assigning a specific virtual private network label so as to make it possible; A third step of recording the virtual private network label and the shared server side output interface information allocated in the second step, generating route information for the shared server, and transmitting the generated route information to the identified externalnet gateway side PE; step; A fourth step of receiving, by the extranet gateway side PE 114, the route information of the third step, and determining whether it is an extranet route by examining a route class field of a route target value carried in the route information; A fifth step of searching for the corresponding extranet group site information by referring to the route index information of the route target value in the case of the extranet path in the fourth step; A sixth step of newly assigning a virtual private network label to allow the extranet gateway forwarding process for the access right check on the extranet gateway side; Recording the virtual private network label and the received route information allocated in the sixth step, updating the virtual private network label value of the received route information and "Next Hop" information, and transmitting the updated private network label value and "Next Hop" information to the external internet site side PE 113; 7 steps; And And an eighth step of receiving the route information of the seventh step and processing the same as the internet route information by the external internet site-side PE 113. How to Provide. (delete) (delete) The method of claim 2, The route target is, Include router manager IDs and router IDs to distinguish between intranet and extranet route targets. The router ID includes a 2-bit route class and a 14-bit route index indicating the type of the intranet / extranet path. The router manager ID has 4 bytes in total, and in the case of an extranet route, the router manager ID is the Ipv4 address of the LER equipped with the responsible extranet gateway that manages the distribution of the corresponding route information. A method for providing an extranet virtual private network service in an MPLS network comprising information. The method of claim 2, The virtual private network label, A 2-bit label type separator for distinguishing packet processing; 18. A method for providing an external LAN private network service in an MPLS network, comprising an 18-bit label index representing an index to an table for output IF or access filtering.