VPN Advantage#

A VPN is a network where private network services are provided to one or more customers over a public network, Internet, or a private network. 

A VPN consists of one or more VPN tunnels! 

VPN connects sites of a same customer together.  A set of “policies” determine which sites communicate with each other and which not;  

In one scenario, the customer itself defines and implements them, in collaboration with the SP. The customer may for example want to force traffic from site S1 to traverse site S2, because the latter has a firewall installation. 

The customer may also require that every site communicate with every other site, which translates in a full mesh topology  of VPN tunnels over the SP network 

In another scenario, the SP presents these communication policies as part of his service offering, but the customer has no authority to “rewrite” them. 

For each communication between two sites on the public network – or even Internet – using VPN technology, a tunnel must be instantiated between the two sites for the duration of the communication then torn down. If there were no service provider offering VPN services in the middle, the customer would have the responsibility to instantiate and decommission the tunnel himself. 

  • -> In this case, the more the number of sites, the more VPN tunnels must be created 

    • e.g. a customer network with 100 sites that need full mesh communication: for each device I need to configure 99 tunnels -> total number of VPN tunnels required for N sites = N (N-1)/2 

      •  -> does not scale well 

-> a better approach is to leverage service providers’ MPLS VPN offerings, where the provisioning, and decommissioning of VPN tunnels is managed by the provider’s equipment. 

A site can attach to one or more VPNs [i.e. site 1’s and site 2’s users connect to the Outlook server of site 4 over VPN_A, and site 1’s database server connects to site 3’s database server over VPN_B for data synchronization; VPN_A and VPN_B are distinct]. However, each site is associated usually to only one VRF –> a VRF can contain the IP addressing space of one or more VPN [tunnels]. 

IP VPNs always have non-overlapping IP addressing space, because even if two customers have identical IP addressing schemes, they belong to different VPNs 

  • Two IP VPNs V1 and V2 –associated to a same site S- can however have overlapping IP address spaces, as long as systems on V1 and V2 do not communicate with each other.

MPLS VPN#

Keyterms#

Customer site MPLS switching MPLS label aka VPN label VPN communities VRF export list of route target attributes VRF import list of route target attributes the attributes are aka communities, extended community values, extended community attributes. BGP extended community attributes

Device Classification#

CE device PE device C device P device

#QA Is MPLS VPN configured on the MPLS core network, core and edge or edge only?

Basic Definitions#

First I define a customer as an organization that has two or more sites. Each site has one or more locations. 

The locations can or can not have geographical proximity; but the concept of site is topological. Each location can have its own CE device. 

MPLS L3VPN brings new concepts to the world: 

  • C devices: customer devices 

  • CE (Customer Edge) devices:  

    • Any devices like servers, switches, routers, etc. that attaches to both the customer network and the provider edge devices 

    • Are either the property of the customer or of the provider 

    • Are either managed by the customer or the provider 

    • Attach to one (single-homed) or more (multi-homed) PE devices, whether the PEs belong to one provider or to different providers 

  • PE (Provider Edge) devices:  

    • exchange routing updates with CE devices 

    • attach to both the provider core MPLS network and the customer edge devices 

    • Are the property of the service provider 

    • establish network-layer peering relationships with CE devices - CE routers do not peer with each other- . That’s why I say that the MPLS L3VPN is based on a peering model. 

    • Given a pair of PEs, there could be one or more MPLS label Switched Paths LSP 

    • On the PE device, there is: 

      • The default routing table 

      • One or more VPN Routing and Forwarding tables, VRFs 

  • P devices: Provider devices in the provider core MPLS network 

  • MPLS switching: routed packets within the core MPLS network are switched from one device to another; MPLS labels are untouched within the core.

Ingress PE and Egress PE#

Packet’s ingress PE: the PE that a packet encounters at the site originating the communication 

Packet’s egress PE: the PE that a packet lands on at the other site [the site that is receiving the packet]. 

MPLS L3VPNs imply by definition in most cases BGP as the routing protocol between PEs. 

MPLS L3VPN is aka MPLS IP VPN, because the IP header is examined by the PE before encapsulating the packet into a VPN tunnel 

  • [The sum total of the VPN tunnels that belong to the same IP addressing space form a VPN. E.g. with a customer consisting of three sites in full mesh logical topology, the VPN consists of 3x(3-1)/2 = 03 tunnels] 

  • Two VPNs [VPN networks, not VPN tunnels] that have identical IP subnets still have distinct IP addressing spaces! 

  • L3VPN tunnels are established over an MPLS core network -> customer packets are tunneled through the provider infrastructure –> that’s how a same physical network – the SP network - can support multiple distinct customer networks – even if the customer networks have identical subnets- thus providing value. 

    • All of C, CE and P devices are not aware of the tunnels; VPN tunnels are established between PE devices only. 

      • -> Adding another customer site has no implementation impact on the customer; configuration change is required only on the PE devices. 

BGP MPLS L3VPN provides an overlay networking service: the L3VPNs are the [[Overlay Networks]]; the MPLS core is the underlay.

  • The IP packet entering a MPLS L3VPN will get encapsulated into the MPLS transport network at the source PE, and decapsulated on the destination PE 

  • In a SP network, MP-BGP is used to transport NLRI between PEs for each customer

Transit VPN and Stub VPN#

When a CE device redistributes routes from another domain into the CE/PE attachment circuit, the VPN that the PE establishes is called transit VPN. Otherwise - i.e. when routes are generated from the CE itself and advertised to PE, which is the most common scenario – the VPN is called stub VPN.

open topics#

#QA What is the definition of a VPN route-target community? 

#QA How are VPN route targets configured on a router that is part of a VPN community? 

#QA Difference between VPN route targets and VRF import and export lists of route target attributes? 

#QA In which cases does a neighbor use MPLS switching and not BGP ipv4 unicast address family?

References and Links#

MPLS: Layer 3 VPN configuration guide, Cisco IOS Release 15S: Multiprotocol BGP MPLS VPN 

  • Second pass needed + practice the IOS configuration commands. 
  • RFC 4364 
  • IOS Basic Config: cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/13733-mpls-vpn-basic.html