Network segmentation in multi-site computer networks

Abstract

This disclosure describes techniques for enabling multiple subnets across multiple fabric sites and associated with multiple network segments (e.g., virtual networks (VNs)) to communicate with each other using a shared network infrastructure, such as a service provider network. In some cases, the techniques described herein include using a common transit VN (e.g., a common transit VN with or without a common firewall) in the shared network infrastructure as well as border devices that enable switching traffic between the common transit VNs and segment VNs (e.g., subscriber VNs) for data transmission to and/or from the common transit VN. In some cases, a border device maintains two types of mapping entries (e.g., map-caches): transit mapping entries and local mapping entries. A transit and a local mapping entry may be configured to represent (e.g., installed to program) forwarding information for packets received on a transit VN and on a segment VN, respectively.