Abstract: Methods, computer-readable media and devices are disclosed for generating a security decision for network management traffic for a virtual provider edge router of a network. For example, a processor may receive a security policy of the network, receive an assignment to a virtual provider edge router in the network, receive network management traffic for the virtual provider edge router, generate a security decision for the network management traffic based upon the security policy, and perform a task in response to the security decision.

Abstract: Methods, computer-readable media and devices are disclosed for generating a security decision for network management traffic for a virtual provider edge router of a network. For example, a processor may receive a security policy of the network, receive an assignment to a virtual provider edge router in the network, receive network management traffic for the virtual provider edge router, generate a security decision for the network management traffic based upon the security policy, and perform a task in response to the security decision.

Abstract: In a network service provider environment, the service provider infrastructure is protected by separating internet routing from the default context and placing it within a virtual private network context. Packets received from the public internet are encapsulated for transit through the service provider infrastructure based on the packet source being the public internet. MPLS VPN technology may be used in the encapsulation technique. The architecture removes the public part of the underlay network and tunnels it through a new overlay. The result is that internet traffic is contained in a separate routing domain, hiding the network infrastructure from that untrusted service traffic that transits the network.