Abstract: Service providers can reduce multiple overlay networks by creating multiple logical service networks (LSNS) on the same physical or optical fiber network. The LSNs are established by the service provider and can be characterized by traffic type, bandwidth, delay, hop count, guaranteed information rates and/or restoration priorities. Once established, the LSNs allow the service provider to deliver a variety of services to customers depending on customer's traffic specifications. Different traffic specifications are serviced on different LSNS, depending on each LSN's characteristics. Such LSNS, once built within a broadband network, can be customized and sold to multiple customers.

Abstract: A transport LAN segment service is provided over a transport network. The transport network will include edge devices configured to support one or more transparent LAN segments. Configuration is simplified by advertising TLS-port-label information, layer 2 address learning, and multicasting when the needed configuration information has not yet been learned or discovered.

Abstract: MPLS labels can be used to tunnel data packets through IP networks. At a start point such as a router or network terminator, the IP destination address is examined and one or more labels are generated which relate to the topology of the network. The labels can include QoS information. The packet is then sent to the destination via a label switched path. At the destination the packet may be sent on via a further label switched path by examining the IP address from the received label and generating one or more fresh labels for the passage of the packet through the further label switched path.

Abstract: A management system manages multiple multi-protocol label switching (MPLS) virtual private networks (VPNs), the VPNs having overlapping IP addresses. The system includes a storage storing a file that associates a host name with an IP address and a route distinguisher. The host name corresponds to a network element within one of the customer VPNs. The system also includes a label obtaining system that obtains at least one label for the host name based upon the associated IP address and route distinguisher. The system also has a packet construction system that creates packets destined for the network element using the obtained label(s).

Abstract: A method and apparatus for routing and forwarding between virtual routers is described. A method in a single network element comprises peering a first virtual router to a second virtual router, wherein the first and second virtual routers have separate address spaces and separate routing tables, distributing a set of one or more routes from the first virtual router to the second virtual router, wherein a first of the set of routes identifies the first virtual router as a next hop of the first route, said first route including a destination, and downloading to a set of one or more forwarding tables, the destination and the next hop.

Abstract: A fibre channel switch element and method for routing fibre channel frames is provided. The switch element includes a receive segment that can add a virtual storage area network (“VSAN”) tagging header to frames that are received by the receive segment; and strip the VSAN tagging header before frames are sent to ports that do not support virtual fabric capability. The receive segment includes a table used for matching fabric extension parameters. An incoming frame's VSAN identity value is compared to a control word entry to generate a value used for routing the incoming frame. The table is used to determine if a frame is part of a virtual fabric. The routing table for each port is used to route frames and the routing table includes entries for supported virtual fabrics.

Abstract: A transport LAN segment service is provided over a transport network. The transport network will include edge devices configured to support one or more transparent LAN segments. Configuration is simplified by advertising TLS-port-label information, layer 2 address learning, and multicasting when the needed configuration information has not yet been learned or discovered.

Abstract: Method for and system validating a network packet is provided. The method includes receiving a network packet at a port of a network device, the packet including a first indicia value and a second indicia value; comparing the first indicia value of the packet with at least a first value stored at the network device; comparing the second indicia value of the packet with at least a second value stored at the network device; and processing the packet if the first indicia value matches with the first value and the second indicia value matches with the second value; wherein the first indicia value is a partition key that restricts communication between a packet source and at least one destination; and the second indicia value is one or more of a source address and a destination address, where a same physical port of a source is assigned more than one source address.

Abstract: A method for processing packets. The method includes receiving a first packet, wherein the first packet is associated with a first protocol, classifying the first packet using a protocol associated with the first packet, sending the first packet to a first receive ring based on the classification, sending the first packet from the first receive ring to a first virtual network interface card (VNIC) based on an operating mode, sending the first packet from the first VNIC to a first protocol specific virtual network stack (VNS), wherein the first protocol specific VNS is configured to only process packets associated with the first protocol, and processing the first packet by the first protocol specific VNS to obtain a first processed packet.

Abstract: A link aggregation function and maintenance function by MPLS OAM. Identical entry information is stored in plural circuits IF which perform a LA setting. In this way, multiplexing to the same LSP is possible even with different IF. The first network IF is assumed to be OAM ACT, and the second network IF is set to OAM SBY (SBY). OAM frame insertion is performed only by an OAM ACT port. In this way, in an opposite MPLS transmission apparatus, it is possible to prevent CV frame reception above a specified number of frames. Further, a switch forwarding table is set to forward frames from the network side to the first network IF of OAM ACT. The second network IF which was set to OAM SBY does not perform fault detection by CV reception. In this way, incorrect detection of faults due to non-reception of OAM can be prevented.

Abstract: A method of providing a network service includes accepting an incoming transmission control protocol/internet protocol (TCP/IP) connection from a user device at a point of presence (POP) proxy server. The TCP/IP connection corresponds to a particular application that is not stored at the POP proxy server. The method also includes relaying the TCP/IP connection from the POP proxy server to a remote application server that stores the particular application via an accelerated network link. Further, the method includes streaming data between the user device and the remote application server after relaying the TCP/IP connection to the remote application server.

Abstract: A method for communication via a ring network that includes a plurality of nodes. The method includes receiving at a first node in the ring network a data packet transmitted over a virtual private LAN service (VPLS), the data packet including an identification of the VPLS. The first node reads the identification from the data packet. Responsively to reading the identification, the first node forwards the data packet to at least one second node in the ring network that is associated with the VPLS.

Abstract: Embodiments of the present invention provide link-local IPv4 addressing across multiple interfaces of a network-node. During operation, the network-node broadcasts an address resolution protocol (ARP) request packet on multiple interfaces which asks for the hardware address of a network node whose link-local IPv4 address is Y. In response, the network-node receives an ARP-reply packet on an interface from a target network-node. If Y is present in the ARP cache and is associated with a different interface, the source network-node chooses a winner interface, and updates the ARP cache so that Y is associated with the winner interface. The network-node sends one or more contention-resolution packets on the loser interface to cause a loser network-node to choose another link-local IPv4 address for itself.

Abstract: A method of handling datagrams in a network device is disclosed. The method includes the steps of receiving an incoming datagram at a port of the network device, determining a type for the incoming datagram based on fields in the incoming datagram and a destination address, adding a tag to the datagram to assist in routing the datagram, obtaining a multiprotocol label switching (MPLS) label when the datagram is a MPLS datagram, processing the datagram based on the MPLS label and the destination address and discarding or forwarding the datagram based upon the processing step. The tag is stripped from the datagram before it is sent from an egress port of the network switch.

Abstract: A technique is provided for managing VPN packet flows over shared access data networks. Each node in the shared access network typically has an identifier or ID associated with it which is used at a Head End of the shared access network to uniquely identify that particular node from the other nodes in the network. According to the technique of the present invention, the node ID may be used at the Head End of the network to identify not only the corresponding node, but also to identify any virtual private networks (VPNs) of which the corresponding node is a member. Using the technique of the present invention, nodes which are members of the same VPN within a shared access network may exchange packets in a manner which does not require the packets to be routed outside the shared access network.

Abstract: Methods and systems for distributing multicast messages in a network are disclosed. The use of such a method or system in an Ethernet network can result in a reduction in the number of flooded multicast messages. One method can involve receiving a companion message, which includes a multicast address, at a network device and extracting the multicast address from the companion message. The multicast address can then be associated with a VLAN and an interface of the network device. Another method involves receiving a join message, which identifies a multicast group being joined, and generating a companion message corresponding to the join message. The companion message includes an address of the multicast group.

Abstract: A method and system for providing network management communication between a plurality of network elements are disclosed. A method includes creating a tunnel configured for transmitting data between the network elements and transmitting network management information over the tunnel using a network management protocol. The tunnel passes through a gateway network element configured to communicate with the network elements utilizing the network management protocol.

Abstract: In one aspect a method for correlating network events in a network comprises correlating the events relating to paths with events relating to links traversed by paths. In another aspect, the method includes correlating the events based on whether paths traversing the network share network resources, such as links. Preferably, the method is implemented in a network where paths traversing the network change dynamically in response to other network events and based on traffic engineering priorities.

Abstract: Certain embodiments of the invention for supporting a plurality of broadband networks and service provider infrastructures may comprise establishing a second communication path that is independent of a first communication path that couples at least two end points via at least a first network. Accordingly, information may be transferred between the two endpoints via the established second communication path. The second communication path may be provisioned for handling various communication functions, for example, operations administration maintenance and provisioning (OAM&P), roaming, user authentication, media transfer, caching, storage management and addressing management. During transfer of the information between the two endpoints via the second communication path, the information may be temporarily stored or cached.

Abstract: A method, system, and computer program product for sharing adapter resources among multiple operating system instances. The present invention provides a mechanism for dynamically allocating virtualized I/O adapter resources. The present invention separates the operation of adapter resource allocation from adapter resource management. Protection attributes within the adapter resource context are used to allow the adapter to enforce access control over the adapter resources. The hypervisor allocates an available adapter resource to a given partition. The adapter is notified of the allocation, and the adapter updates its internal structure to reflect the allocation. The hypervisor may revoke ownership of and reassign adapter resources to another OS instance. In this manner, the allocation described above allows for the simple reassignment of resources from one partition to another.

Abstract: Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment of the present invention, a subscriber connection is created with a virtual router operable within a telecommunications system of a service provider. A connection request is received from a subscriber of multiple subscribers of the service provider at a subscriber manager of the virtual router. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers.

Abstract: A network, network devices, and methods are described for marked packet forwarding. A network device includes a network chip having a number of network ports for receiving and transmitting packets. The network chip includes logic to decapsulate a packet received from a tunnel, mark the packet with a handle associated with an originating network device of the packet using information from an encapsulation header, and forward the marked packet to a checking functionality having a destination address different from an original destination address of the packet.

Abstract: A method, apparatus and computer program product for providing dynamic routing support for Half-Duplex Virtual Routing and Forwarding (HDVRF) environments. The method, apparatus and computer program function to configure a forwarding Virtual Routing and Forwarding (VRF) table for a router with information to forward incoming packets to a central location within a hub and spoke environment. The method, apparatus and computer program also function to populate a routing Virtual Routing and Forwarding (VRF) table for the router with routing information received from ingress interfaces of the router. The method, apparatus and computer program function further forwards packets received on egress interfaces of the router according to the forwarding VRF table.

Abstract: An apparatus and method are provided that enable I/O devices to be shared among multiple operating system domains. The apparatus includes a first plurality of I/O ports, a second I/O port, and a plurality of port initialization logic elements. The first plurality of I/O ports is coupled to a plurality of operating system domains through a load-store fabric. Each of the first plurality of I/O ports routes transactions between the plurality of operating system domains and the switching apparatus. The second I/O port is coupled to a first shared input/output endpoint. The first shared input/output endpoint is configured to request/complete the transactions for each of the plurality of operating system domains. One of the plurality of port initialization logic elements is coupled to the second I/O port and remaining ones of the plurality of port initialization logic elements are each coupled to a corresponding one of the first plurality of I/O ports.

Abstract: A Multicast Listener Discovery (MLD) protocol query and/or report snooping process is modified to appropriately map secondary PVLAN identifiers to corresponding primary PVLAN identifiers, thereby accommodating other system elements that are otherwise unaware of primary/secondary PVLAN distinctions. Special cases are also accommodated where reverse path forwarding (RPF) checks in support of multicast operation might otherwise fail due to primary/secondary PVLAN distinctions. Additional steps are taken to ensure that PVLAN information properly accounts for changes in configuration and/or location of various network hosts.

Abstract: A combined data packing, cipher and multiplexing engine operable to support high speed uplink packet access (HS-UPA) within user equipment (UE) is provided. This combined cipher multiplexing engine includes a master port, a radio link control (RLC) data packer, and a cipher multiplexing processing module. The master port couples to an advanced microprocessor bus architecture (AMBA) high speed buss (AHB) on which control information for the combined cipher and multiplexing engine is provided. The RLC couples to the master port and receives RLC service data units (SDUs) from the AHB. Then the RLC data packer may concatenate or segment RLC SDUs into RLC packet data units (PDUs) which are stored for use by a cipher multiplexing processing module.

Abstract: Techniques are described that allow a network device, such as a router, to dynamically build VLAN interfaces based on subscriber information strings included within packets. In particular, the network device comprises an interface controller and a forwarding controller, where the forwarding controller receives the packet over an Ethernet port and forwards the received packet to the interface controller. The packet includes both Ethernet tagging information and a subscriber information string. The interface controller comprises an Ethernet module that dynamically builds a primary virtual local area network (VLAN) sub-interface (PVS) based on the Ethernet tagging information. The Ethernet module also dynamically builds a subscriber VLAN sub-interface (SVS) based on the subscriber information string. The SVS allows the network device to distinguish between subscribers residing on the same VLAN, and, therefore, to provide subscriber specific services.

Abstract: The present invention establishes reserved paths between nodes in a central packet network and in local networks attached to the central network. Each reserved path has a defined bandwidth and may be implemented as an LSP in an MPLS network or as a PVC in an ATM network. Associated with each reserved path is a virtual trunk group representing the same bandwidth as the virtual path. Telephony calls requiring media flows associated with a channel in the virtual trunk group will transport packets along the reserved path associated with the virtual trunk group. Access to the reserved path is limited to telephony media flows associated with a virtual trunk group to ensure adequate bandwidth at all times for the number of channels associated with the virtual trunk group. Backup reserved paths may be associated with the primary reserved path to provide the necessary redundancy required for voice-based telephony applications.

Abstract: A method and apparatus for learning the identity of VRRP backup router(s) for a VRRP master router enables the identity of VRRP backup routers to be determined quickly on demand, or enables a table of VRRP master and backup routers to be established over time. A VRRP query message type is defined as a type of VRRP message that will enable the routers on the network to be queried to determine which router(s) are VRRP backup routers for a virtual IP address associated with a VRRP master. The VRRP query message may be initiated by the VRRP master, a network management system, or another entity. The VRRP backup routers may respond with a VRRP response message, which is also defined as a type of VRRP message. The VRRP response message may be unicast to the VRRP master or network management system, or broadcast to enable a table of VRRP master/backup routers to be created.

Abstract: A method is provided for maintaining a communication network including a plurality of call processors, a plurality of packet gateways, and a plurality of trunk groups connected to each packet gateway. Queries are transferred to at least one call processor of the plurality of call processors, and responses are received from the one call processor. The responses are processed to associate the one call processor with a packet gateway and to associate the packet gateway with trunk groups connected to the packet gateway. The association of the packet gateway with the trunk groups is displayed, and a user selects one of the trunk groups. Then an instruction is transferred to the one call processor to seize and release the user-selected one of the trunk groups.

Abstract: A system and method for providing identifying numbers for virtual circuits and virtual paths in a network is described. The system and method make use of a predetermined group of identifying numbers such that each number corresponds to a particular communication type and port.

Abstract: A method (400) for managing a data stream (30) encoded according to a digital transmission protocol and configured for broadcasting to a consumer network device (14) within a broadband communications network (10). A message relating to the data stream is encapsulated (402) within a transport layer data packet (502). The packet has a destination port number field. A value associated with a predetermined parameter of the digital transmission protocol is created (404) within the field. Based on the value, the packet is forwarded (406) to the consumer network device according to a network layer protocol. When the forwarded message is received by the consumer network device, the consumer network device processes the data stream based on the message, and establishes an application layer communication socket based on the destination port number value. The socket is usable to receive further messages associated with the predetermined parameter of the digital transmission protocol.

Abstract: Systems and methods for managing interworking protocols are provided. According to one embodiment, a policy-based provisioning methodology is used by a service management system (SMS) to provision subscriber interfaces of service processing switches based upon parameters of a predefined policy. The subscriber interfaces communicate data in accordance with a first protocol. The parameters include a window size, a window timeout, a number of allowed bad events, an event window size and/or a keep-alive interval. Transport network interfaces, which communicate in accordance with a second protocol, are provisioned to provide a transport between the subscriber interfaces. A first-protocol-over-second-protocol (FPoSP) Virtual Private Network (VPN) is created through which the subscriber sites securely exchange data by establishing a virtual router (VR) corresponding to each subscriber interface.

Abstract: In one embodiment, a method includes receiving an IP packet associated with a first virtual partition defined at a session exchange device. The first virtual partition is associated with a first IP address space. The method also includes receiving an IP packet associated with a second virtual partition defined at the session exchange device. The second virtual partition is associated with a second IP address space having a portion that corresponds with the first IP address space. The IP packet associated with the first virtual partition is modified such that the IP packet associated with the first virtual partition has an IP address value from a third IP address space different from the portion of the second IP address space.

Abstract: A network, network devices, and methods are described for marked packet forwarding. A network device includes a network chip having a number of network ports for receiving and transmitting packets. The network chip includes logic to decapsulate a packet received from a tunnel, mark the packet with a handle associated with an originating network device of the packet using information from an encapsulation header, and forward the marked packet to a checking functionality having a destination address different from an original destination address of the packet.

Abstract: A method and apparatus is described that allow the creation of virtual routing domains in an IP network. These virtual routing domains allow individual networks to be configures so that it appears that its routing domain covers the entire IP address space. A network processing system is used to implement the virtual routing domains and to allow network traffic to cross the individual routing domains. The network processing system is able to use application layer information to allow the crossing of virtual routing domain boundaries. By examining application layer information the network processing system is able to look up customer/user information and use that information to determine destination virtual routing domains and route otherwise unroutable addresses between domains.

Abstract: Disclosed are apparatus and methods for discovering topology in a storage area network having a plurality of VSANs in a network fabric is disclosed. The VSANs include a first VSAN having a plurality of network devices. The method includes the following operations: (a) defining a first one of the network devices of the first VSAN as a Topology Update (TU) Owner, wherein the other network devices of the first VSAN are not defined as TU Owners, (b) at the first network device, receiving data that indicates a topology change in the first VSAN, (c) at the first network device, generating or updating one or more TU database(s) for the plurality of VSANs of the network fabric based on the received topology change, and (d) the first network device causing the topology change to be propagated in the form of a Topology Update across the network fabric to network devices in the plurality of VSANs of such network fabric.

Abstract: Embodiments of the present invention provide a method and an apparatus for managing and transmitting fine granularity services. The method includes: increasing the bandwidth of an existing LSP which controls a fine granularity service with the same granularity as that of a new fine granularity service to be established, upon determining that the new fine granularity service shares the same source node and destination node with the existing LSP; and transmitting the new fine granularity service with the increased bandwidth of the existing LSP. The bandwidth utilization rate of optical networks can be obviously increased when transmitting fine granularity services in accordance with the embodiments of the present invention; furthermore, the storage space of each node through which the LSP passes is saved and the recovery performance of fine granularity services is guaranteed.

Abstract: A network node includes a first port and a second port, the second port being operable to carry a first type of data traffic over a main physical interface, the first type of data traffic including Layer 2 services. The second port is operable to simultaneously carry a second type of data traffic over a sub-interface of the main physical interface. The second type of data traffic consisting of Layer 3 services that include point-to-point (P2P), point-to-multipoint (P2MP), and multipoint services.

Abstract: The present invention relates to a method and nodes for managing service bindings over an access domain. For doing so, an access edge node is introduced in the access domain between a plurality of service providers and user domains, and an access node is introduced between the user domains and the access domain. The access edge node creates, modifies and removes service bindings and informs the access node of those creations, modifications and removals. Each service binding binds one of the user domain, the access node and the access edge node on data traffic handling over the access domain between the user domain and the service provider domain. More particularly, the service binding associates the user domain to a Virtual Local Area Network (VLAN) for the service provider domain on the access domain, controlled by the access edge node.

Abstract: A method and apparatus for tunneling protocols are described. In one embodiment, the method comprises broadcasting a message at a repeater to one or more members in a network including a switch, the broadcasted message indicating that the repeater is entering the network, receiving VLAN (virtual local area network) configuration information from the switch in response to the broadcast message, and communicating with the switch using the VLAN configuration information in subsequent communications.

Abstract: Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, subscriber services are modified without requiring a change to the subscriber's first-level profile identifier and without requiring the subscriber to reestablish a connection with the service provider. A database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, explicitly defining subscriber services, and multiple first-level profile identifiers, defining service contexts representing combinations of services available to subscribers by (i) explicitly defining the subscriber services or (ii) referring to one or more of the lower-level profile identifiers, are maintained within a virtual router operable within a telecommunications system of the service provider. Updated service profile information, representing a change to the subscriber's service context, is received.

Abstract: Techniques to store entries so that minimal sequential memory accesses are used to determine all relevant entries. Entries may be grouped into blocks. The order of entries within blocks may be set in a manner so that entry locations can be determined using an input value, such as a destination address. Blocks may be ordered into levels. Blocks of each level may be stored in consecutive storage locations. Accordingly, entry locations may be determined and retrieved with minimal sequential memory accesses by storing entries in a predetermined manner.

Abstract: A system and method is provided for managing access communications between the service edge of a communications service provider and a customer. Access communications are carried in the form of carrier-tagged flows, the communications traffic being appended with carrier tags having significance to handling of the traffic through access network elements. A building aggregation system is provided which couples to customer premise equipment and interfaces customer flows to carrier-tagged flows used in the access network.

Abstract: The invention relates to a method in particular enabling the computer terminal (T_L) of a local network (RES_L), connected to a gateway (PASS_D) of a remote network (RES_D) by an IPsec tunnel in blocking mode, to launch a print job on a printer (E_L) belonging to the local network. To do this, the gateway (PASS_D) stores the correspondence between the public address (AD_1) of the local router (ROUT_L) providing the connection of the terminal to the Internet, and the private address (ad_3) assigned to the terminal (T_L) in the addressing plan of the remote network (RES_D) during the establishment of the tunnel, and sends the print flow to the local router (ROUT_L), which directs it to the local printer (E_L) by a port translation technique.

Abstract: Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes a subscriber manager, a database and a virtual interface. The subscriber manager is operable to receive a connection request from a subscriber of a service provider. The database has stored therein hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers.

Abstract: A method and equipment for obtaining routing data for a data transfer packet is presented. The data transfer packet is associated with information indicating a quality-of-service class of the data transfer packet and is related to protocol data associated with a data transfer protocol being used. The method using the protocol data as an input quantity for reading basic data and a reduction rule that are compatible with a routing table and the protocol data, using the information indicating the quality-of-service class as an input quantity of the reduction rule for obtaining auxiliary routing data, and obtaining the routing data on the basis of the basic data and the auxiliary routing data. The reduction rule connects auxiliary data to each quality-of-service class in such a way that each auxiliary data is associated with at least two different quality-of-service classes in order to reduce the amount of required storage capacity.

Abstract: A computer system includes compute nodes coupled through a switch to shared or non-shared I/O devices. The switch includes a pool of bridge headers and virtual bridges coupling a root port of a compute node to each of one or more shared or non-shared I/O devices. The switch is configured to associate each of the virtual bridges with a respective one of the fixed pool of bridge headers, receive a packet including data identifying the root port and a shared or non-shared I/O device, and route the packet in response to comparing data in the packet to data in the bridge headers associated with the virtual bridges. The virtual bridges comprise a hierarchy of virtual bridges in which one virtual bridge connects the root port to the remaining virtual bridges of the hierarchy. The switch may change the associations between virtual bridges and bridge headers.

Abstract: A system and method for integrating a legacy IP-PBX to a session initiation protocol (SIP) network supporting one or more SIP sets. A SIP-PBX proxy server coupled to the legacy IP-PBX and the SIP network maintains a logical IP set for each SIP set on the SIP network. The logical IP set is configured to maintain IP-based signaling and media connectivity with the legacy IP-PBX. The SIP-PBX proxy server receives media directed to a logical IP set associated with a particular SIP set, and redirects the media to the particular SIP set. In doing so, the SIP-PBX converts messages that adhere to a private, vendor-specific protocol, to messages that adhere to the SIP protocol.

Abstract: A method and apparatus for controlling bandwidth in a Virtual Private Network assigns and allocates transmission bandwidth to packet VPNs for either connectionless or connection-oriented communication. The method creates two views of transmission facilities: a user plane view and a control plane view. In the user plane view, the bandwidth of the transmission facility is split into quantified and identified partitions. In the control plane view, transmission facilities are represented as logical links forming a topology that can be used for the purpose of routing the VPN. The two views are tied together by assigning user plane partitions to VPN control plane links. As a result, the allocation of bandwidth to VPNs becomes a controllable and viewable entity, thereby facilitating management and QoS provisioning in a VPN network.