the disclosure of u . s . provisional patent application no . 60 / 264 , 088 filed jan . 25 , 2001 , is hereby incorporated by reference herein . [ 0025 ] fig1 shows a network in which a wide - area routed network 10 is utilized to carry traffic for a number of virtual private routed networks ( vprns ). each vprn includes corresponding vprn subnetworks 12 . in fig1 vprns numbered 1 through 3 are shown , with each including corresponding subnetworks 12 - 1 , 12 - 2 and 12 - 3 . the wide - area routed network 10 includes a number of routers 14 . each router 14 has connections to access links 16 that connect the router 14 to local vprn subnetworks 12 , and has connections to backbone links 18 that connect the router 14 to other routers 14 in the wide - area routed network 10 . an example of the wide - area routed network 10 is a global network such as the internet . in general , the wide - area routed network 10 has a given network address space and a defined set of communications protocols , including routing protocols . for example , the wide - area routed network 10 may employ the internet protocol ( ip ) with ip version 4 ( ipv 4 ) addressing , and employ routing protocols such as border gateway protocol ( bgp ), open shortest path first ( ospf ), routing information protocol ( rip ), etc . each vprn , which is made up of a corresponding set of vprn subnetworks 12 , is a routed network having its own network address space and network communications protocols , including a routing protocol . nodes within a vprn are generally not assigned addresses in the address space of the wide - area routed network 10 , nor do the routers 14 carry traffic on their specific behalf . rather , as described in more detail below , the routers 14 utilize the address space and routing protocols of the wide - area routed network 10 on behalf of the vprn subnetworks 12 as entities . the vprn subnetworks 12 , in turn , utilize their respective private address spaces and routing protocols for internal routing of data traffic among specific computers or other types of network sources and destinations . fundamentally , the wide - area routed network 10 and routers 14 serve to provide dedicated virtual connections among the vprn subnetworks 12 to form the various larger - scale vprns . [ 0028 ] fig2 shows an exemplary organization of a router 14 . several “ virtual access routers ” ( vars ) 20 are associated with respective customers and connected to the respective customers &# 39 ; access links 16 . these are described in more detail below . a provider “ virtual backbone router ” ( vbr ) 22 is connected to the backbone links 18 of the wide area routed network 10 of fig1 . the vbr 22 uses ip addresses from the address space of the wide area routed network 10 , which is separate from the address spaces of the vprns . the vbr 22 provides a tunneling service to vars 20 that is used in constructing the vprns . a signaling protocol such as the resource reservation protocol ( rsvp ) is used to set up the tunnels . the vbr 22 may also provide direct access to the wide area routed network 10 for customers desiring such service , such as customer d in fig2 . the vbr 22 participates in the full routing for the wide - area routed network 10 . in the case of the internet , the vbr 22 generally maintains a full bgp routing table . each var 20 has its own routing table and runs its own instances of the routing protocols used in the corresponding vprn . the network addresses ( e . g ., ip addresses ) of a var 20 are taken from the address space of the vprn to which the var belongs . different vars 20 can use overlapping sets of addresses , i . e ., the same address may appear in different sets , even though the different instances of the address belong to different nodes in different vprns . there is generally no direct connection , in the sense of an ip routing adjacency , between different vars 20 within a router 14 or between a var 20 and the vbr 22 . as mentioned , rsvp signaling is used to create tunnels within the wide - area routed network 10 to connect vars 20 residing in different routers 14 . this signaling is accomplished through the use of virtual tunnel adapters ( vtas ) 24 . these devices resemble ip hosts residing in the wide - area routed network 10 . each vta 24 has a signaling interface via which the vta 24 is instructed to establish a tunnel connection between a local var 20 and a remote var 20 residing on another router 14 ( not shown in fig2 ). [ 0031 ] fig3 shows a more detailed view of a router 14 . the vars 20 are associated with virtual interfaces ( vis ) 30 , which in turn are associated with mpls label switched paths ( lsps ) on the backbone links 18 of the wide area routed network 10 . lsps are established to form the tunnels through the wide area routed network 10 that link the various vprn subnetworks 12 . as shown , a two - level hierarchy of lsps is used . an “ inner ” lsp 32 carries traffic specifically associated with a given vi 30 . an “ outer ” lsp 34 carries a group of inner lsps 32 . a different outer lsp 34 is defined between each pair of routers 14 in the wide - area routed network 10 . the router 14 also includes various additional functional entities such as a vpn agent 36 , quality of service ( qos ) manager 38 , lsp manager 40 , mpls signaling function 42 , and line control processor ( lcp ) interface 44 . the vpn agent 36 coordinates the configuration of the vprns . the vpn agent 36 instantiates vars 20 and vis 30 , interacts with the lsp manager 40 to coordinate the use of labels , and passes qos information to the lsp manager 40 for dynamically configured labels . the qos manager 38 handles the qos aspect of the setting up of lsps , which includes interpreting the qos parameters of rsvp . the lsp manager 40 coordinates all aspects of lsps , including the creation and deletion of lsps and the maintenance of label information . it interfaces with the vpn agent 36 and the mpls signaling function 42 in the creation , monitoring , and deletion of lsps . the mpls signaling function 42 implements rsvp signaling for mpls . at an ingress node for an lsp , the mpls signaling function 42 signals downstream to obtain a label . at an egress node , the mpls signaling function 42 passes labels upstream . at a transit node , the mpls signaling function 42 interfaces with upstream and downstream routers to distribute labels . the mpls signaling function 42 also interfaces with routing code to obtain next hop information , and passes label information to the lsp manager 40 . the lcp interface 44 passes forwarding information from the software - implemented functions of fig3 such as the vars 20 and vis 30 , to hardware forwarding engines residing on line cards ( not shown ) within the router 14 . the forwarding information falls into four categories : next hop routing information , mpls label information , packet classification information , and qos information . [ 0037 ] fig4 shows a high - level software and hardware organization for the routers 14 . a number of physical interfaces ( pis ) 50 connect to the access links 16 and backbone links 18 of fig1 - 3 . examples of such interfaces include ethernet interfaces , sonet interfaces , etc . a layer - 2 protocol such as atm may also be used . each pi 50 is also connected to a virtual interface ( vi ) subsystem 52 , which includes all of the vis in the router 14 , such as the vis 30 of fig3 . the vi subsystem 52 has a number of connections to a virtual router ( vr ) subsystem 54 , which includes all the virtual routers such as the vars 20 and vbr 22 of fig3 . the pis 50 , vi subsystem 52 , and vr subsystem 54 are coupled to a collection of other functional elements labeled in fig4 as a management subsystem 56 . the management subsystem 56 includes the vpn agent 36 , qos manager 38 , lsp manager 40 , mpls signaling function 42 and lcp interface 44 of fig3 . the virtual routers ( vrs ) within the vr subsystem 54 generally consist of processes and associated data that behave as a number of separate , distinct routers . each vr is associated with a different vprn . a given router 14 may include a few or many such vrs in accordance with the number of vprns having traffic flowing through the router 14 . subject to hardware constraints of a given platform , such as processing power and memory capacity , a router 14 may be configured with as many as hundreds or potentially thousands of such vrs . the vi subsystem 52 provides a special function within the router 14 . a conventional router generally includes a routing subsystem tied directly to physical interfaces , without an intermediate subsystem such as the vi subsystem 52 shown in fig4 . accordingly , changes to the underlying physical network result in the need to change routing tables and other data structures in the routing subsystem . examples of such changes to the physical network include manual reconfigurations and automatic protection switching . when the routing subsystem has a very large routing data structure , as is the case for the vr subsystem 54 , it is difficult and inefficient to maintain physical - layer information within it . the arrangement of fig4 addresses these problems by “ virtualizing ” the interfaces from the perspective of the virtual routers in the vr subsystem 54 . each virtual router employs static , generic interface identifiers , and the vi subsystem 52 handles the translation between these interface identifiers and details of underlying physical interfaces , which in general are subject to dynamic change . [ 0040 ] fig5 shows the vr subsystem 54 . a collection of routing processes or tasks such as ospf tasks 60 - 0 , bgp tasks 60 - b , and rip tasks 60 - r are coupled to a memory 62 via context selection logic 64 . the memory 62 is divided into a number of context areas , shown as ctxt 1 , ctxt 2 , . . . ctxt m , for m distinct vrs . each context area contains a routing table and other operating state information for a different vr . the tasks 60 are independent processes that are time - shared among the various vrs . the time - sharing is accomplished in part via the context selection logic 64 . as events occur that require action for a given vr ( most such events being associated with the sending and receiving of routing protocol messages or packets ), the context selection logic 64 couples the appropriate task 60 to the context area ctxt for that vr . the task 60 then executes using the data from that context area ctxt . this processing continues to completion before a subsequent event is permitted to activate another vr , at which time the same or a different task 60 becomes coupled to a context area ctxt for the other vr . as an example , let it be assumed that a vr identified as vr # 134 is part of a vprn in which the ospf routing protocol is used . context area ctxt 134 of the memory 62 contains the routing table and other operating state for this vr . upon receipt of a routing protocol packet on a vi associated with vr # 134 , an ospf task 60 - 0 is activated , and the context selection logic 64 connects the ospf task 60 - 0 to context area ctxt 134 . the ospf task 60 - 0 performs operations in accordance with the received packet , which may include updating the routing table and initiating the transmission of one or more routing protocol packets to other routers in the vprn . once the processing associated with the received routing protocol packet is complete , the context selection logic 64 is free to break the connection between the ospf task 60 and context area ctxt 134 in favor of a new connection , which will generally involve a different context area ctxt of the memory 62 and may involve a different task 60 as well . in the illustrated embodiment , the context selection logic 64 employs an inner - lsp label appearing in encapsulated protocol packets to identify which context area 62 to select for processing the packet . a mapping table ( not shown ) within the context selection logic 64 maps the label to a base address of the associated context area 62 . the inner - lsp label appearing in the encapsulated protocol packets is likewise mapped to the generic interface identifiers used in the routing table that resides in the selected context area 62 . the number of tasks 60 can vary in accordance with the routing protocols being used by the active vprns and the processing resources available in the router 14 . there must be at least one active task 60 for each different routing protocol used by any of the vprns supported by the router 14 . thus , if all of the active vprns are using either ospf or bgp routing , for example , then the minimum set of tasks 60 is one ospf task 60 - 0 and one bgp task 60 - b . in general , one task 60 can support a number of vprns of the same type ( i . e ., using the same routing protocol ), depending on the processing resources allocated to the task 60 and the demand from the vprns . if there are a large number of active vprns using a given protocol , it may be desirable that there be multiple tasks 60 of the same type . these tasks may time - share the same physical processor ( s ), or may be distributed in a parallel fashion among different processors if such hardware processing resources are available in the router 14 . similarly , the memory 62 may be a single memory containing all the context areas ctxt for all vrs of the router 14 , or it may be a system having multiple independent memories , each containing some subset of the context areas ctxt . the context selection logic 64 is generally designed to exploit parallelism in order to maximize performance . if the hardware platform is capable of running multiple tasks 60 simultaneously and accessing multiple context areas ctxt of the memory 62 simultaneously , then preferably the context selection logic 64 looks for opportunities to activate two or more vrs simultaneously . the connections 66 shown in fig5 represent logical connections between each vr and the vi subsystem 52 of fig4 . in general , there are multiple such logical connections between each vr and the vi subsystem 52 , with each logical connection corresponding to a different interface identifier . some vrs may have as few as two associated vis , whereas other vrs may have many . [ 0046 ] fig6 shows the vi subsystem 52 . as previously indicated , the vis implement a translation between the vrs and the pis 50 of fig4 . as shown in fig6 this translation is generally multi - layered . a number of mpls vis 70 interface to vrs in the vr subsystem 54 . the mpls vis define label - switched paths ( lsps ) that serve as vprn - specific tunnels in the wide - area routed network 10 . channel vis 72 define abstract channels , some of which are associated with the mpls vis and others associated directly with vrs in the vr subsystem 54 . a subset of the channel vis 72 are associated with automatic protection switching ( aps ) vis 74 . the channel vis 72 and aps vis 74 are further associated with media vis 76 , which in turn are associated with corresponding pis 50 of fig4 via combined logical / physical connections 78 . each of these classes of vis is described in turn below . a connection between a given pi 50 of fig4 and a given vr is made through a linked set of vis in the vi subsystem 52 . such a set generally includes at least one media vi 76 and one channel vi 72 , and may include an mpls vi 70 or an aps vi 74 as well . outbound messages generated by a vr that appear on a given connection 66 are processed within the vi subsystem 52 in accordance with information from the associated mpls vi 70 ( if any ), channel vi 72 , aps vi 74 ( if any ), and media vi 76 . similarly , inbound messages received from the pis 50 at the connections 78 are processed in accordance with corresponding sets of vis . the vi subsystem 52 forms a database having a potentially large number of such connected sets of vis . [ 0048 ] fig7 shows a first example of a set of linked vis in the vi subsystem 52 . this set is used to form a transmit interface for a vr on an access link 16 . the interface identifier within the vr points to a channel vi 72 - a , which in turn points to a media vi 76 - a . as indicated , the media vi 76 - a is generally shared with other channel vis ( not shown ). the channel vi 72 - a contains information about the individual channel , such as the type of channel ( vlan , mpls , etc . ), the channelization value ( e . g . vlan tag ), and channel resources ( bandwidth ). the media vi 76 - a contains information about the physical interfaces , such as interface type , encapsulation type , etc . [ 0049 ] fig8 shows an example set of linked vis for a backbone link 18 . here , a channel vi 72 - b is associated with an aps vi 74 - b , which in turn is associated with two media vis 76 - bl and 76 - b 2 . the aps vi 76 - b contains information indicating which media vi 76 - bl or 76 - b 2 is the “ working ” instance and which is the “ protect ” instance , and further includes state information for each media vi such as “ factive ”, “ standby ”, “ operative ”, “ inoperative ”, etc . [ 0050 ] fig9 shows an example of a linked set of vis forming the interface within one var 20 via which another var 20 of the same vprn is reached through the wide - area routed network 10 . a first mpls vi 70 - cl contains the label and other information for an inner lsp , and a second mpls vi 70 - c 2 contains the label and other information for an outer lsp . because there are typically multiple inner lsps for each outer lsp , the outer mpls vi 70 - c 2 is generally shared with other inner mpls vis like mpls vi 70 - cl . the outer mpls vi 70 - c 2 points to a channel vi 72 - c , which in turn points to a media vi 76 - c . these mpls vis include mpls path information along with resource and policy information ( e . g ., set - up priority , hold priority ). [ 0051 ] fig1 shows an example of a set of vis used when mpls redundancy is employed . an inner mpls vi 70 - d 1 points to a “ redundancy ” mpls vi 70 - d 2 . the redundancy mpls vi 70 - d 2 is similar to the aps vi 74 - b of fig8 in that it contains information identifying working and protect paths and associated state information . in contrast to aps , however , each packet is sent over only one of a redundant pair of mpls paths . the redundancy mpls vi 70 - d 2 points to two outer mpls vis 70 - d 3 and 70 - d 4 . these in turn point to respective channel vis 72 - d 1 and 72 - d 2 , which point to respective media vis 76 - d 1 and 76 - d 2 . [ 0052 ] fig1 shows another example that is used to support load balanced mpls operation . inner mpls vis 70 - e 1 and 70 - e 2 of different vrs point to respective redundant mpls vis 70 - e 3 and 70 - e 4 , both of which point to the same set of outer mpls vis 70 - e 5 and 70 - e 6 . the outer mpls vis 70 - e 5 and 70 - e 6 point to respective channel vis 72 - e 1 and 72 - e 2 , which in turn point to respective media vis 76 - e 1 and 76 - e 2 . this configuration provides for load balancing when both outer lsps are operational , and also provides for redundant fail - over when one of the outer lsps fails . it will be apparent to those skilled in the art that modifications to and variations of the above - described techniques are possible without departing from the inventive concepts disclosed herein . accordingly , the invention should be viewed as limited solely by the scope and spirit of the appended claims .