ve one or more virtual networks. Each virtual network is isolated from all the other virtual networks unless explicitly allowed by security policy. By using virtual networks configured by the SDN local controller, networking of VMs and virtual services is no longer a manual process. Cloud infrastructure virtual networks can be connected to (and extended across) external physi- cal networks via MPLS/BGP layer-3 VPNs using gateway routers. Virtual networks are also used to implement service chaining of VNFs. VNFs are modeled in the local SDN controller system as "service-instance" and may be implemented by one or more VMs. An example of NFV insertion is shown in Figure 14.19. The traffic is forwarded from network A to 20.0.0.1 via one or more VNFs. Service instances present routing information in network A such that subnet 20.0.0.0/24 is routed through the VNFs. 14.4.2.3.2 Connectivity to Mobility VPN and Mobility Legacy Networks The cloud infrastructure data centers must interconnect with the existing data centers and the out- side world. The approach to realizing this integration is shown in Figure 14.20. This figure lays the foundation for building the mobility network in a virtual EPC. Connectivity to networks outside of the cloud is accomplished via a pair of the IP-edge routers performing SDN gateway functions for the local SDN controller. When an overlay network that needs to communicate with networks in a different data center is created, a route target gets assigned to that network in the local SDN control- ler (route_targets parameter in OS::Contrail: Virtual Networks Heat resource). In this manner, a predefined set of route targets is established between local SDN control nodes and the IP-Edge routers. The IP-edge routers are preconfigured to import any prefixes tagged with route targets into the corresponding routing instances-which in turn are mapped into the net- work backbone VPNs. Connectivity to existing networks is shown in Figure 14.20 as a pair of network network routing 20.0.0.0/24 FIGURE 14.19