Abstract: In one embodiment, a method includes receiving at a first network device in a first virtual private network, a packet destined for a second network device in communication with a second virtual private network, and transmitting the packet over the second network, wherein the packet is encapsulated for transmittal on a tunnel extending from the first network device to the second network device. The first network device is in communication with a system operable to map and encapsulate the packet and provide an overlay that traverses over the second virtual private network. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a method includes receiving at a first network device in a first virtual private network, a packet destined for a second network device in communication with a second virtual private network, and transmitting the packet over the second network, wherein the packet is encapsulated for transmittal on a tunnel extending from the first network device to the second network device. The first network device is in communication with a system operable to map and encapsulate the packet and provide an overlay that traverses over the second virtual private network. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a method includes receiving at a first network device in a first virtual private network, a packet destined for a second network device in communication with a second virtual private network, and transmitting the packet over the second network, wherein the packet is encapsulated for transmittal on a tunnel extending from the first network device to the second network device. The first network device is in communication with a system operable to map and encapsulate the packet and provide an overlay that traverses over the second virtual private network. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a method includes receiving a packet at a first provider edge device in communication with a mapping system comprising mappings of customer routes to provider edge devices, and mappings of customer virtual routing and forwarding (VRF) instances to a service provider VRF instance, mapping a customer route to one of the provider edge devices and mapping a customer VRF instance to the service provider VRF instance, encapsulating the packet at the first provider edge device based on the mappings, and transmitting the packet to the provider edge device. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a method includes receiving from a plurality of customer edge devices, endpoint addresses at a central mapping system operating as a control plane for a provider network in communication with a plurality of customer networks, and mapping the endpoint addresses to provider edge devices in the provider network. Wherein the customer edge devices store customer endpoint routes for active flows and the provider edge devices store customer edge device site locator addresses for use in a mapping and encapsulation overlay in the provider network. An apparatus and logic are also disclosed herein.

Abstract: A system for selectively applying a service to a packet in a network. In a specific embodiment, the system includes a mechanism for encoding service information in a network-compatible packet header and providing encoded data in response thereto. In a more specific embodiment, the network-compatible header includes a Multi-Protocol Label Switching (MPLS) header, a Generic Route Encapsulation (GRE) header, and/or a Layer-2 Tunneling Protocol (L2TP) header.

Abstract: A method includes monitoring outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network. Incoming response packets that originate in the external network and are destined for transmission to the node are also monitored. One or more of the incoming response packets that were not solicited by any of the outgoing request packets are identified responsively to monitoring the outgoing request packets and the incoming response packets. A characteristic that differentiates between the identified incoming response packets and the incoming response packets that were solicited by the outgoing request packets is determined. A guard device in the external network is instructed to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.

Abstract: A method includes monitoring outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network. Incoming response packets that originate in the external network and are destined for transmission to the node are also monitored. One or more of the incoming response packets that were not solicited by any of the outgoing request packets are identified responsively to monitoring the outgoing request packets and the incoming response packets. A characteristic that differentiates between the identified incoming response packets and the incoming response packets that were solicited by the outgoing request packets is determined. A guard device in the external network is instructed to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.

Abstract: A system for selectively applying a service to a packet in a network. In a specific embodiment, the system includes a mechanism for encoding service information in a network-compatible packet header and providing encoded data in response thereto. In a more specific embodiment, the network-compatible header includes a Multi-Protocol Label Switching (MPLS) header, a Generic Route Encapsulation (GRE) header, and/or a Layer-2 Tunneling Protocol (L2TP) header.