Dynamic, policy based, per-subscriber selection and transfer among virtual private networks

A service gateway maintains forwarding components operative to forward data packets within corresponding VPNs, and also maintains subscriber sessions for subscribers via respective subscriber interfaces. The association between the subscribers and the forwarding components is independent of the subscriber interfaces, such that the subscribers reachable via a given interface are associable with any forwarding component. Upon detecting an appropriate event, such as a service selection action, the service gateway modifies the forwarding components of first and second VPNs to reflect that the subscriber session is active in the second VPN and is not active in the first VPN. The service gateway also effects a change of a network address that identifies the corresponding subscriber from a first network address defined in the first VPN to a second network address defined in the second VPN. Mechanisms for effecting such a change of network address include DHCP, IPCP, RADIUS, and NAT. The service gateway employs control policies to govern the transfer of subscribers among VPNs.