Abstract: In one embodiment, software code in a respective computer system such as one or more data communication devices establishes multiple layer 2 network links between a first data communication device and a second data communication device. The first data communication device and the second data communication device include corresponding layer 3 interfaces enabling layer 3 network communications over each of the multiple layer 2 network links. The first and second data communication devices route traffic over one (e.g., a primary layer 2 link) of the multiple layer 2 network links using the layer 3 network communications. The private links are media independent. Upon detection of a failure associated with the primary layer 2 link, the data communication devices can automatically switch to sending traffic over a backup link of the multiple layer 2 network links without disrupting publicly advertised routing topology information.

Abstract: A method and apparatus for configuring a network interface to support a virtual private network includes storing configuration data at a server on a host computer on the provider network. It is determined without human intervention whether conditions are satisfied for sending the configuration data to a particular node at an edge of the provider network without receiving a request message from the particular node. If it is determined that conditions are satisfied, then the configuration data is sent to the particular node to cause the particular node to configure a particular interface for supporting a virtual private network over the provider network based on the configuration data. The particular node is different from the host. These techniques allow changes in configuration data to be pushed to provider edge nodes without human intervention.

Abstract: In one embodiment, a method includes establishing a control channel across a wide area network (WAN) from a first gateway that has a first public internetwork layer (L3) address to a second gateway that has a second public L3 address. Each gateway connects a local area network (LAN) to the WAN. Negotiations over the control channel establish a first set of private L3 addresses for the first LAN and a non-overlapping second set for the second LAN. A different address from the first set is provided for each different node in the first LAN. A discovery packet is received from the first LAN. The discovery packet is encapsulated in a tunnel packet directed to the second public L3 address. The tunnel packet is sent over the WAN to the second gateway which extracts the discovery packet. The second gateway sends the discovery packet over the second LAN.

Abstract: A method, apparatus, computer product and structure is presented for representing and managing large amounts of information concerning networks of elements. While being useful for communication networks, it can be also usefully deployed in the context of other networks such as distribution and transportation networks. The method uses a hierarchical construct called “catalog”—a set of elements (which could be “atomic” elements or catalogs themselves)—to organize information about physical or abstract entities relevant for modeling the network. A matrix construct whose rows and columns constitute such elements are used to model connections at different levels of abstraction. A common framework and representation provided using these two constructs is shown to be useful for visualization, administration, configuration, modeling, monitoring and manipulation of the network.

Abstract: A method and system for verifying the availability of a back-up virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a backup tunnel verification test message to the second network element over the back-up secure tunnel upon receipt of a backup tunnel verification test command. The back-up secure tunnel includes two unidirectional tunnels. The second network element receives the back-up tunnel verification test message over the first back-up unidirectional secure tunnel and transmits a response back to the first network element over the second back-up unidirectional secure tunnel.

Abstract: A method and system for determining the connectivity of a virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a connectivity test message to the second network element over the secure tunnel upon receipt of an initiate connectivity test command. The secure tunnel includes two unidirectional tunnels. The second network element receives the connectivity test message over the first unidirectional secure tunnel and transmits a response back to the first network element over the second unidirectional secure tunnel. The number of successful responses received from the second network element are accumulated and the results are reported back to the source of the connectivity test command.

Abstract: A method and system for monitoring the status of an active secure tunnel between a pair of network elements in a communications network. The first network element originates and transmits an Internet Protocol Security (IPSec) test message to a second network element using a first unidirectional secure tunnel in response to the receipt of an active tunnel monitor command. The second network element receives the IPSec test message and transmits a response back to the first network element using a second unidirectional secure tunnel. The number of times that second network element failed to return a response to an IPSec test message is accumulated during a predetermined time interval and then compared with a threshold value to determine if the active secure tunnel has become disabled.

Abstract: A computer, and particularly a mobile client computer system, in which flexibility in use of the system is enhanced by a capability of receiving and dynamically recognizing a variety of what are here called docking options. Docking options are peripheral devices, such as radio transceivers, which can be selectively connected to and used with a mobile client system. A docked option is identified by an exchange of signals between the system and the option, accomplished through a plurality of input/output ports which together define an interface to the option.