Scaling virtual private networks using service insertion architecture

摘要

In one embodiment, service routers may register their serviced VPNs with a service directory/broker (SDB), and edge routers may register their attached VPNs. The SDB may then return service headers, each corresponding to a particular VPN, and also returns an address of a service router corresponding to each service header to the edge routers. An edge router may then push an appropriate service header onto a received packet, and forward the packet to the corresponding service router, which forwards the packet based on a maintained VRF for a VPN according to the service header (e.g., thus the edge routers need only maintain limited/reduced VRFs). Also, services provided by the service routers may be distinguished using service headers accordingly. In this manner, the edge routers may forward packets requiring one or more desired services to service routers configured to perform such services.