WO2005031527A2

WO2005031527A2 - Model-based method and apparatus for determining virtual private network topologies

Info

Publication number: WO2005031527A2
Application number: PCT/US2004/031355
Authority: WO
Inventors: Shai Benjamin
Original assignee: System Management Arts, Inc.
Priority date: 2003-09-25
Filing date: 2004-09-24
Publication date: 2005-04-07
Also published as: WO2005031532A2; US7441023B2; US7783778B2; WO2005031533A2; WO2005031532A3; WO2005031533A3; WO2005031527A3; US20050071681A1; US20050071130A1; WO2005031532A9

Abstract

A method and apparatus for determining and identifying types of Virtual Private Networks (100) is disclosed. The method comprises the steps of representing the network by a model (200) containing a plurality of object classes, evaluating an import/export relationship of a first one and a second one of the object classes and identifying the network type based on the evaluated relationship.

Description

MODEL-BASED METHOD AND APPARATUS FOR DETERMINING VIRTUAL PRIVATE NETWORK TOPOLOGIES

Claim of Priority

[0001] This application claims the benefit, pursuant to 35 USC § 119(e), of the earlier filing date of the Provisional Patent Application Serial No. 60/505,802, entitled "Model- Based Discovery of Multi-Protocol Label Switching Virtual Private Networks, filed on September 25, 2003, the contents of which are incorporated by reference herein.

Related Applications

[0002] This application is related to concurrently-filed:

US Patent Application Serial Number , entitled "Model-Based Method and Apparatus for Determining MPLS Network Properties;" and

[0003] US Patent Application Serial Number , entitled "Method and

Apparatus for Modeling and Analyzing MPLS and Virtual Private Networks," the contents of both of which are incorporated by reference herein.

Field of the Invention

[0004] The invention relates generally to computer networks, and more specifically to systems and methods for modeling and identifying Virtual Private Network (VPN) topologies, memberships and member roles.

Background of the Invention

[0005] The concepts, terms, and acronyms of Virtual Private Network (VPN) are well-known in the art. For example, the memorandum entitled BGP/MPLS VPNs, E. Rosen and Y. Rekhter, RFC 2547, March 1999, internet Engineering Task Force (IETF), is an example of the literature regarding VPNs.

[0006] The ability to analyze VPNs has been limited by the network models that have been employed. For example, one model uses a Common Information Model (CIM) that defined objects and relationships, (see Common Information Model: Implementing the Object Model for Enterprise Management, Bumpus, et al, John Wiley & Sons, December 1999, ISBN: B00007FY8X). This model is limited by the pre-defined and standard objects and relationships defined in the Common Information Model (CIM). For example, one cannot easily capture the relationship between a VPN Routing and Forwarding Table (VRF) and a RouteTarget (RT). (See, for example, BGP MPLS VPNs, E. Rosen and Y. Rekhter, RFC2547bis, IETF, July 2000.)

[0007] In a second model, the definition of MPLS and VPN Management Information

Bases (MIBs) are established. (See, for example, SNMP, SNMPv2. SNMPv3, and RMON 1 and 2 (3rd Edition), William Stallings, Addison- Wesley Pub Co, December 1998, pages 71- 162 ISBN: 0201485346). However, MJJBs typically do not capture relationships between objects. For example the MPLS end-to-end Label-Switched Path (LSP) is difficult to represent explicitly in a MIB.

[0008] The lack of a systematic model specifically suited for the MPLS and/or VPN objects and relationships limits several forms of important analysis. For example, it is difficult to determine the members of each VPN; what is the role of each VPN member; what is the type of each VPN or sub-set of the VPN.

[0009] Hence there is a need in the industry for a method and system for analyzing

VPN systems that overcomes known deficiencies in identifying VPN components and the VPN topology.

Summary of The Invention

[0010] A method and apparatus for determining and identifying types of Virtual

Private Networks is disclosed. The method comprises the steps of representing the network by a model containing a plurality of object classes, evaluating an import/export relationship of a first one and a second one of the object classes and identifying the network type based on the evaluated relationship.

Detailed Description of the Figures

[0011] Figure 1 illustrates a logical view of a conventional VPN network;

[0012] Figure 2 illustrates a model representation of VPNs in accordance with the principles of the invention;

[0013] Figures 3 illustrates an example of a model-ed representation of a VPN; [0014] Figures 4a-4d illustrate examples of model-ed representations of VPN topologies;

[0015] Figure 5 illustrates an example of identifying VPN topologies in accordance with the principles of the invention;

[0016] Figures 6a-6d illustrate an example of the application of the VPN model with regard to a physical network in accordance with the principles of the invention; and

[0017] Figure 7 illustrates a system for implementing the processing shown herein.

[0018] It is to be understood that these drawings are solely for purposes of illustrating the concepts of the invention and are not intended as a definition of the limits of the invention. The embodiments shown in the figures herein and described in the accompanying detailed description are to be used as illustrative embodiments and should not be construed as the only manner of practicing the invention. Also, the same reference numerals, possibly supplemented with reference characters where appropriate, have been used to identify similar elements.

Detailed Description

[0019] Figure la illustrates an exemplary representation of a virtual private network

100 composed of components, referred to as provider edge routers (PE), 110, 160 and 180 that represent the means for providing information items to, and receiving information items from, network 100, Also shown are Customer Edge (CE). nodes or routers 115, 165, 167 and 185, which are in communication with corresponding provider edge nodes 110, 160 and 180. The CE nodes 115, 165, 167 and 185 represent components or routers located at the customer premises that are directly connected, at either a network Layer 2 or Layer 3 level (of the OS I stack) to the ingress and egress provider edge routers 110, 160 and 180. Internal routers, which are not shown, are responsible for converting the packet or frame structure from the one used to communicate with CE routers 115, 165, 167, and 185 to the packet or frame structure used internally by an associated private network.

[0020] A CE router or node is typically connected to only one provider edge router or node. However, as shown in this illustrative case, provider edge router 160 is connected to CE router 165 and CE router 167. Hence, CE router 185, for example, may communicate privately with CE router 165 and/or 167. The communication between the CE nodes and the PE nodes may take place using any Layer 2 or Layer 3 network protocol. [0021] VPN routing and addressing structures are created for each customer in the PE and internal nodes (not shown), and designate the path assigned to the customer. VPN Routing and Forwarding Tables (VRFs) are a well-known means for creating virtual private networks. The VRFs exchange routes using, for example, Multiprotocol Border Gateway Protocol (MP-BGP). The typical attributes of a VRF instance include a name, associated interfaces, route-distinguisher, import route-targets, export route-targets, and a routing table. RouteTargets (RTs) are identifiers associated with a set of routes through the network 100. The identifiers are used by the VRFs to control the importing or the exporting of routes to other VRFs. Each VRF, thus, can export or import routes or paths via a list of export or import RTs. In this illustrative case, CE 115 for example, may communicate privately with CE 167 by the appropriate selection of VRFs in each edge router or node and the not shown internal routers or nodes. In one aspect of the invention, a Route-Distinguisher may also be specified that provides a distinguishing characteristic for the specific route. This distinguishing characteristic is used when duplicate addresses are encountered. [0022] Figure 2 illustrates an exemplary abstract model 200 of a VPN network in accordance with the principles of the invention. The VPN model shown is an extension of a known network models 210, such as the SMARTS® InCharge™ Common Information Model (ICJJVI), or similarly defined or pre-existing CIM-based model. SMARTS and Incharge are trademarks of System Management ARTs, Inc., having a principle place of business in White Plains, NY, USA. CIM models are known to represent selected ones of the physical network components, e.g., nodes, routers, computer systems, disk drives, etc., and or logical network components, e.g., software, application software, ports, disk drive designation, etc., by defining object classes, which are a representation of the component. Those network components that are selected for representation in the model are hereinafter referred to as managed components. The representation of the managed components includes aspects or properties of the component. Similarly, the relationships between the managed components are also represented and contained in the model. [0023] With regard to the ICTM, this model defines object classes such as

ServiceConnection 210.1, NetworkService 210.2, and LogicalNetwork 210.3 that are representative of generic concepts or components of service connections, network services, and logical networks, respectively.

[0024] In accordance with the principles of the invention with regard to modeling

VPNs, object class RouteTargets 220.1 is selected as a type of service connection, VRF 220.2 is designated as a type of network service, and VPN 220.3 is designated as a type of logical network. Object classes RouteTargets, VRF, VPN are hereinafter referred to as RouteTargets, VRF, VPN unnecessary technical terminology. Those skilled in the art would recognize that such references refer to the respective object classes. Furthermore, the terms RouteTarget and RouteTargets may also refer to an element(s) or instances of the object class RouteTargets. Similar terminology is also used with regard to VRF, VRFs, VPN and VPNs. [0025] The VPN model shown further illustrates the relationship between

RouteTargets 210.1 and VRFs 220.2, which are represented with the classes Imported By/Imports and Exported by/Exports. Similarly, the relationship between VRFs and the VPN may be expressed as Hubsof/Hubs and SpokesOf/Spokes.

[0026] It would be recognized by those skilled in the art that the information to populate or determine instances of the object classes, i.e., representation of components, and the relationship between components, i.e., representation of component relationships, of the models defined herein may be pre-loaded or predetermined or may be determined dynamically by importation, discovery or provided by one or more sources of such information, e.g., Simple Network Management Protocol (SNMP) MIBs, MPLS-LSR-MJJB, MPLS forwarding tables, MPLS-VPN-MIB. Similarly, manual commands such as Command Line Interface (CLI) at network devices, Show commands that retrieve and display information regarding forwarding-table, VRFs, BGP and MBGP sessions, may be used to provide information to populate the object classes shown. Each of these sources of information are representative of communications that may occur dynamically over the physical network that the model overlays, i.e., layered over, and should not be considered the only methods to dynamically populate the object classes shown.

[0027] Figure 3 illustrates an example of an import export relationship between VRFs and RouteTargets for a VPN in accordance with the principles of the invention. In this illustrated example, VRFs 305, 307, 309 have importfexport relationships with RTs 301 and 303 that are tabulated in Table 1.

Table 1

[0028] The ImportedBy/Imports and the ExportBy/Exports relationships shown in

Figure 3 may be expressed as:

ϊm(Rι) is the set {V₂}-, [1]

Ex(Rι) is the set { Vi, V₂} ; [2]

Im(R₂) is the set {V₂,V₃}; and [3]

Ex(R₂) is the set {V_1;V₃} [4]

Where Im(R_x) is the set of VRFs that import the RouteTarget R_x; and Ex(R_x ) is the set of VRFs that export the RouteTarget R_x. [0029] Figure 4a illustrates a representation 400 of the relationship between VRFs and RTs in a Full-Mesh (FM) topology in accordance with an aspect of the principles of the invention. A Full-Mesh topology allows routing of packets from any node in the VPN to any other node in the VPN. Hence, in accordance with the principles of the invention, in an FM topology Route Target (RT) 405 is such that it is both imported and exported by the VRF 410. This may be expressed as:

Im(R) = Ex(R) [5]

[0030] Figures 4b-4d illustrate graphic representations of the relationship between

VRFs and RTs in Hub-and-Spoke (H-S) topologies in accordance with the principles of the invention. In an H-S topology, hub VRFs may communicate with either hub or spoke VRFs, whereas spoke VRFs can only communicate with hub VRFs. An H-S VPN topology may be determined when one of the following configurations is satisfied:

1. Hub VRFs export R₂ and both import and export Ri while spoke VRFs import R₂ and export Ri. See Figure 4b;

2. Hub VRFs both import and export R₂ and import Ri while spoke VRFs import R₂ and export Ri. See Figure 4c; or

3. Hub VRFs both import and export R₂ and both import and export Ri while spoke VRFs import R₂ and export _t. See Figure 4d.

[0031] Accordingly, an H-S topology may be determined when, for an ordered pair of

Route Targets, denoted as Ri and R₂, the following conditions are satisfied:

1. The import set of Ri is identical to the export set of R₂; and

2. The set of VRFs that export Ri but do not import Ri is identical to the set of VRFs that import R₂ but do not export R₂; and

3. The export set of Ri is not identical to the import set of R₂, or there is at least one VRF that both imports and exports Ri.

[0032] These criteria may be expressed as: l-mCR = Ex(R₂); and [6]

Ex(Rι) \ IM(Rι) = rnι(R₂) \ Ex(R₂); and [7]

Ex(Ri) ≠ Im(R₂) OR Ex(Rι) n Im(Rι) ≠ Empty set [8]

[0033] In another aspect of the invention, the members of an H-S topology may then be determined as those members of the union of the import and the export sets of Ri. In this aspect of the invention, the spoke members may be determined as those members of the set of VRFs that export but do not import Ri, and the remaining members of the VPN are hub members.

[0034] Figure 5 illustrates a VRF-RT model used as an example for determining VPN topologies, and element members, in accordance with the principles of the present invention. In this illustrative example, the ImportedBy/Imports and ExportedBy/Exports relationships between RTs 510-550, i.e., R₁-R₅, and VRFs 560-576, i.e., V V₉, are graphically illustrated using an arrow notation wherein the arrowhead denotes importing/exporting. Utilizing the notation discussed previously, RouteTarget 520 (R₂), for example, imports VRF 564 (V₃), VRF 574(V₈) and VRF 576 (V₉) and exports VRF 566 (V₄) and VRF 568 (V₅). The import and export sets with respect to Route Targets R₁-R₅ may be determined as shown in Table 2 as:

Table 2

[0035] In this case, the import set and the export set associated with Ri are identical and, hence, satisfy the conditions of equation 1. Thus, VRFs 960, 962, 972 (i.e., V₁.V₂.V₇) constitute a VPN of a Full-Mesh topology.

[0036] A Hub-and-Spoke topology may be determined between Route Target 920 and

930 (i.e, R₂ and R₄, respectively) as the following conditions are satisfied: Im(R₂) = {V4,V₅} = Ex(R₄); Ex(R₂) \ Im(R₂) = {V₃,V₈,V₉}\{ V₄,V₅} = { V₃,V₈,V₉} and Im(R4) \Ex(R4) = {V₃,V₄,V₅,V₈,V₉}\{V₄,V₅} = {V₃,V₈,V₉}; and Ex(R₂) = {V₃,V₈,V₉} ≠ {V₃,V₄,V₅,V₈,V₉}= Im(R₄).

[0037] Accordingly, VRFs 964, 966, 968, 974, 976 (i.e., V₃, V₄, V₅, V₈ and V₉) constitute a Hub-and-Spoke topology. In a similar manner, it may be determined that the ordered pair of Route Targets 950, 920 (R₅, R ) also constitute a Hub-and-Spoke topology. [0038] The spoke members of a H-S topology may be determined as those members of the set of VRFs that export but do not import the first Route Target of the ordered pair of Route Targets and the remaining members of the H - S topology VPN are then deemed hub VRFs.

Ex(R_x) \ Im(R_x) [9] where R_x is the first RT of the ordered pair

[0039] Thus, in the H-S topology determined from the ordered pair of Route Targets

920, 940 (R₂, R₄), the spoke members may be determined to be VRFs V_3> V₈ and V₉ and the hub members are VRFs V₃ and V₄. Similarly, in the H-S VPN topology determined from the ordered pair of Route Targets R₅, R₂ , the spoke members are VRFs V₄ and V₇ and the hub member is VRF V₆.

[0040] In another aspect of the invention, not all pairings of Route Targets need be tested. In this aspect of the invention, the pairing of Route Targets may be reduced by considering the following criteria;. . . ..

1. Route Targets that define a Full-Mesh VPN need not be evaluated; or

2. For a selected RouteTarget, only RouteTargets that are exported by some VRF that is in the import set of the given RouteTarget need be evaluated.

[0041] In accordance with this aspect of the invention with regard to the above example, Ri need not be evaluated with regard to the remaining RTs as Ri was determined to be in a Full-Mesh network. Similarly, R₃ and need not be evaluated with regard to each other as they fail to satisfy condition 2.

[0042] Figures 6a-6d illustrate an application of the present invention with regard to a physical network. Figure 6a illustrates an example of two MPLS VPNs 600 and 650 wherein VPN 600 is in a Full Mesh configuration and VPN 650 is in a Hub-and-Spoke configuration. And will be determining in accordance with the principles of the invention. Figure 6a illustrates that VPN 600 communicates, through provider edge nodes 610-640, to customer edge nodes 612, 622, 632 and 642, respectively, and VPN 650 communicates, through provider edge nodes 610-640, to consumer edge nodes 612, 622, 634 and 644, respectively. [0043] Table 3 tabulates the imports and exports of the RTs for each VRF shown in

Figure 6a. This information is stored at the respective provider edge node where the VRFs reside.

Table 3

[0044] Figures 6b and 6c illustrate the ImportedBy/Imports and ExportedBy/Exports relationships of VRFs with respect to RTs in the exemplary VPNs 600 and 650 shown in Figure 6a. Figure 6b illustrates that RTIA is imported by each VRFl in each provider edge node 610-640 (PEι-PE₄), while RTIB is imported by VRFl at provider edge nodes 620 and 640 (i.e., PE₂ and PE₄). Similarly, RT2 is imported by VRF2 at each provider edge node 610-640 (PEι-PE₄). Figure 6c illustrates that RTIA is exported by VRFl at provider edge nodes 620 and 640, while RTIB is exported by VRFl at provider edge nodes 610 and 630. RT2, on the other hand, is exported by each VRF2 at each provider edge node 610-640. Table 4 tabulates the Imported By and Exported By relationships, wherein y represents the instantiation of VRFi at PEj.

[0045] Evaluating the entries shown in Table 4, utilizing the criteria shown in equations 5-8, it may be determined that VPN 600 is an FM-type VPN as RT2 is imported and exported by all VRF2s. Further, VPN 650 may be determined to be a H-S type VPN. It may further be determined that PEi 610 and PE₃ 630 are spoke VRFs and PE₂, 620 and PE₄, 640 are be hub VRFs. Figure 6d illustrates the YOFs associated with the determined VPN types.

[0046] Figure 7 illustrates an exemplary embodiment of a system 700 that may be used for implementing the principles of the present invention. System 700 may contain one or more input/output devices 702, processors 703 and memories 704. I O devices 702 may access or receive information from one or more sources or devices 701. Sources or devices 701 may be devices such as routers, servers, computers, notebook computer, PDAs, cells phones or other devices suitable for transmitting and receiving information responsive to the processes shown herein. Devices 701 may have access over one or more network connections 750 via, for example, a wireless wide area network, a wireless metropolitan area network, a wireless local area network, a terrestrial broadcast system (Radio, TV), a satellite network, a cell phone or a wireless telephone network, or similar wired networks, such as POTS, INTERNET, LAN, WAN and/or private networks, e.g., INTRANET, as well as portions or combinations of these and other types of networks.

[0047] Input/output devices 702, processors 703 and memories 704 may communicate over a communication medium 725. Communication medium 725 may represent, for example, a bus, a communication network, one or more internal connections of a circuit, circuit card or other apparatus, as well as portions and combinations of these and other communication media. Input data from the client devices 701 is processed in accordance with one or more programs that may be stored in memories 704 and executed by processors 703. Memories 704 may be any magnetic, optical or semiconductor medium that is loadable and retains information either permanently, e.g. PROM, or non-permanenty, e.g., RAM. Processors 703 may be any means, such as general purpose or special purpose computing system, such as a laptop computer, desktop computer, a server, handheld computer, or may be a hardware configuration, such as dedicated logic circuit, or integrated circuit. Processors 703 may also be Programmable Array Logic (PAL), or Application Specific Integrated Circuit (ASIC), etc., which may be "programmed" to include software instructions or code that provides a known output in response to known inputs. In one aspect, hardware circuitry may be used in place of, or in combination with, software instructions to implement the invention. The elements illustrated herein may also be implemented as discrete hardware elements that are operable to perform the operations shown using coded logical operations or by executing hardware executable code.

[0048] In a one aspect, the processes shown herein may be represented by computer readable code stored on a computer readable medium. The code may also be stored in the memory 704. The code may be read or downloaded from a memory medium 783, an I/O device 785 or magnetic or optical media, such as a floppy disk, a CD-ROM or a DVD, 787 and then stored in memory 704.

[0049] Information from device 701 received by I O device 702, after processing in accordance with one or more software programs operable to perform the functions illustrated herein, may also be transmitted over network 780 to one or more output devices represented as display 785, reporting device 790 or second processing system 795. [0050] As one skilled in the art would recognize, the term computer or computer system may represent one or more processing units in communication with one or more memory units and other devices, e.g., peripherals, connected electronically to and communicating with the at least one processing unit. Furthermore, the devices may be electronically connected to the one or more processing units via internal busses, e.g., ISA bus, microchannel bus, PCI bus, PCMCIA bus, etc., or one or more internal connections of a circuit, circuit card or other device, as well as portions and combinations of these and other communication media or an external network, e.g., the Internet and Intranet. [0051] While there has been shown, described, and pointed out fundamental novel features of the present invention as applied to preferred embodiments thereof, it will be understood that various omissions and substitutions and changes in the apparatus described, in the form and details of the devices disclosed, and in their operation, may be made by those skilled in the art without departing from the spirit of the present invention. It is expressly intended that all combinations of those elements that perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Substitutions of elements from one described embodiment to another are also fully intended and contemplated. For example, although the present invention has been disclosed with regard to VPNs of the Full Mesh and Hub-and-Spoke topologies, the techniques described herein are not limited to the topologies shown. For example, Partial Mesh topologies are known in the art as being Hub-and-Spoke topologies with multiple hubs. In addition, Spoke-and-Spoke topologies may similarly be determined. Accordingly, it would be within the knowledge of those skilled in the art to expand the teachings described herein to other topologies, which have been contemplated and are considered within the scope of the invention. Similarly, the invention described herein describes a generic modeling approach for VPNs. However, the invention is not limited by the model discussed, and used as an example, or the specific proposed modeling approach described herein.

Claims

Claims What is claimed is:

1. A method for determining a type of Virtual Private Network (VPN) comprising the steps of: representing the network by a model containing a plurality of object classes; evaluating an import/export relationship of a first one and a second one of the object classes; and identifying the network type based on the evaluated relationship.

2. The method as recited in claim 1, wherein the VPN network object classes are selected from the group consisting of: configuration non-specific representation of types of managed components associated with elements of the network and configuration non-specific representations of relationships among the types of managed components.

3. The method as recited in claim 2, wherein the first and second object classes are configuration non specific representations of types of managed components.

4. The method as recited in claim 3, wherein the configuration non-specific representations of types of managed components are selected from the group consisting of: RouteTarget, VRF, and VPN.

5. The method as recited in claim 2, wherein the relationships amongst the types of managed components is selected from the and consisting of: ImportedBy/Imports, ExportedBy/Exports, VPNPeer, HubsOf, SpokesOf, SendsTo ReceivesFrom.

6. The method as recited in claim 1, wherein the type of VPN is selected from the group consisting of: Full-Mesh, Partial-Mesh, Hub-and-Spoke, and Spoke-and-Spoke.

7. The method as recited in claim 1, wherein the step of evaluating an import export relationship comprises the step of: determining;

Jm(R) = Ex(R) wherein: Im(R) is the set of second object classes imported by the first object class; and

Ex(R) is the set of second object classes exported by the first object class.

8. The method as recited in claim 1, wherein the first object class is a RouteTarget.

9. The method as recited in claim 8, wherein the step of evaluating an import/export relationship comprises the step of: determining

Im(Rι) = Ex(R₂); and

Ex(Rι) \ Im (RO = Im(R₂) \ Ex(R₂); and

Ex(R ≠Im(R₂) OR

Ex(R 0 Im(Ri) ≠ Empty set

10. The method as recited in claim 9, further comprising the step of determining spoke elements, wherein said step of determining spoke elements comprises the step of: determining

Ex(R₁) \Im (R₁)

11. The method as recited in claim 10, wherein the VPN hub elements are the remaining members of the set of second managed components.

12. The method as recited in claim 1, further comprising the step of: storing the determined type of network.

13. The method as recited in claim 1, further comprising the step of: displaying the type of network.

14. The method as recited in claim 13, further comprising the step of: displaying members of the network type.

15. The method as recited in claim 9, wherein the step of evaluating an import export relationship further comprises the step of: excluding from evaluation RouteTargets associated with a Full-Mesh Network.

16. The method as recited in claim 9, wherein the step of evaluating an import/export relationship further comprises the step of: evaluating only RouteTargets that are exported by at least one second object class that is in the import set of a selected RouteTarget.

17. An apparatus for determining a type of Virtual Private Network (VPN) represented by a model containing a plurality of object classes, the apparatus comprising: a processor in communication with a memory, said processor executing code for: evaluating an import/export relationship of a first one and a second one of the object classes; and identifying the network type based on the evaluated relationship.

18. The apparatus as recited in claim 17, wherein the VPN network object classes are selected from the group consisting of: configuration non-specific representation of types of managed components associated with elements of the network and configuration non-specific representations of relationships among the types of managed components.

19. The apparatus as recited in claim 18, wherein the first and second object classes are configuration non specific representations of types of managed components.

20. The apparatus as recited in claim 19, wherein the configuration non-specific representations of types of managed components are selected from the group consisting of: RouteTarget, VRF, and VPN.

21. The apparatus as recited in claim 18, wherein the relationships amongst the types of managed components is selected from the group consisting of: ImportedBy/Imports, ExportedBy/Exports, VPNPeer, HubsOf, SpokesOf, and SendsTo ReceivesFrom.

22. The apparatus as recited in claim 17, wherein the type of VPN is selected from the group consisting of: Full-Mesh, Partial-Mesh, Hub-and-Spoke, and Spoke-and-Spoke.

23. The apparatus as recited in claim 17, wherein said processor further executing code for determining:

Im(R) = Ex(R) wherein: Im(R) is the set of second object classes imported by the first object class; and

Ex(R) is the set of second object classes exported by the first tioject class.

24: The apparatus as recited in claim 17, wherein the first object class is a RouteTarget.

25. The apparatus as recited in claim 24, wherein the processor further executirig code for determining:

Im(Rι) = Ex(R₂); and

Ex(Rι) \ Im (Ri) = Im(R₂) \ Ex(R₂); and

Ex(R,) ≠Im(R₂) OR

Ex(Rι) n irn(Rι) ≠ Null Set

26. The apparatus as recited in claim 25, wherein the processor further executing code for determining:

Ex R Mm CR

27. The apparatus as recited in claim 26, wherein the VPN hub elements are the remaining members of the set of second managed components.

28. The apparatus as recited in claim 17, wherein the processor further executing code for: storing the determined type of network.

29. The apparatus as recited in claim 17, wherein the processor further executing code for: displaying the type of network.

30. The apparatus as recited in claim 17, wherein the processor further executing code for: displaying members of the network type.

31. The apparatus as recited in claim 24, wherein the processor further executing code for: excluding from evaluation RouteTargets associated with a Full-Mesh Network.

32. The apparatus as recited in claim 24, wherein the processor further executing code for: evaluating only RouteTargets that are exported by at least one second managed component that is in the imported set of a selected RouteTarget.

33. The apparatus as recited in claim 17, further comprising an: input/output device in communication with the processor and the memory.

34. The apparatus as recited in claim 17, wherein the code is stored in the memory.

35. A computer-read medium contain code thereon, the code suitable for determining a type of Virtual Private Network (VPN), which is represented as a model containing a plurality of object classes, by providing instructions to a computing system for executing the steps of: evaluating an import/export relationship of a first one and a second one of the object classes; and identifying the network type based on the evaluated relationship.

36. The computer-read medium as recited in claim 35, wherein the VPN network object classes are selected from the group consisting of: configuration non-specific representation of types of managed components associated with elements of the network and configuration non-specific representations of relationships among the types of managed components.

37. The computer-read medium as recited in claim 36, wherein the first and second object classes are configuration non specific representations of types of managed components.

38. The computer-read medium as recited in claim 37, wherein the configuration non-specific representations of types of managed components are selected from the group consisting of: RouteTargets, VRF, and VPN.

39. The computer-read medium as recited in claim 36, wherein the relationships amongst the types of managed components is selected from the group consisting of: ImportedBy/Imports, ExportedBy/Exports, VPNPeer, HubsOf, SpokesOf, and SendsTo/ReceivesFrom.

40. The computer-read medium as recited in claim 35, wherein the type of VPN is selected from the group consisting of: Full-Mesh, Partial-Mesh, Hub-and-Spoke, and Spoke-and- Spoke.

41. The computer-read medium as recited in claim 35, wherein the code further providing . instructions to a computing system for executing the step of: determining

Im(R) =Ex(R) wherein: Im(R) is the set of second object classes imported by the first object class; and

Ex(R) is the set of second object classes exported by the first object class.

42. The computer-read medium as recited in claim 35, wherein the first object class is a RouteTargets.

43. The computer-read medium as recited in claim 42, wherein the code further providing instructions to a computing system for executing the step of: determining

Im(Rι) = Ex(R₂); and

Ex(R \ Im (RO = rm(R₂) \ Ex(R₂); and

ExCR Imfϊ^ OR

Ex(Rι) PI Im(Rι) ≠ Empty set

44. The computer-read medium as recited in claim 43, wherein the code further providing instructions to a computing system for executing the step of: determining

Ex(Rι) \ Im (Ri)

45. The computer-read medium as recited in claim 43, wherein the VPN hub elements are the remaining members of the set of second managed components.

46. The computer-read medium as recited in claim 35, wherein the code further providing instructions to a computing system for executing the step of: storing the determined type of network.

47. The computer-read medium as recited in claim 35, wherein the code further providing instructions to a computing system for executing the step of: displaying the type of network.

48. The computer-read medium as recited in claim 35, wherein the code further providing instructions to a computing system for executing the step of: displaying members of the network type.

49. The computer-read medium as recited in claim 43, wherein the code further providing instructions to a computing system for executing the step of: excluding from evaluation RouteTargets associated with a Full-Mesh Network.

50. The computer-read medium as recited in claim 43, wherein the code further providing instructions to a computing system for executing the step of: evaluating only RouteTargets that are exported by at least one second object class that is in the imported set of a selected RouteTarget.