MPLS VPN Technology

2000, Cisco Systems, Inc.

VPN Terminology

Customer site

Large customer site

Pro(i'er Networ !P"Networ #$ the Ser(ice Pro(i'er in&rastructure use' to %ro(i'e VPN ser(ices Customer Networ !C"Networ #$ the %art o& the networ still un'er customer control Customer Site$ a contiguous %art o& customer networ !can encom%ass many %hysical locations#
2000, Cisco Systems, Inc.

www.cisco.com

Page2

VPN Terminology

Customer site

Large customer site

Ser(ice Pro(i'er Networ

Pro(i'er *'ge !P*# 'e(ice$ the 'e(ice in the P"networ to which the C*"'e(ices are connecte' Pro(i'er core !P# 'e(ice$ the 'e(ice in the P"networ with no customer connecti(ity Customer *'ge !C*# 'e(ice$ the 'e(ice in the C"networ with lin into P"networ . +lso calle' Customer Premises *,ui%ment !CP*#
www.cisco.com

2000, Cisco Systems, Inc.

Page)

VPN Im%lementation Technologies

VPN ser(ices can .e o&&ere' .ase' on two ma/or %ara'igms$
0(erlay Virtual Pri(ate Networ s where the Ser(ice Pro(i'er %ro(i'es (irtual %oint"to" %oint lin s .etween customer sites Peer"to"Peer Virtual Pri(ate Networ s where the Ser(ice Pro(i'er %artici%ates in the customer routing

2000, Cisco Systems, Inc.

www.cisco.com

Page-

0(erlay VPN Im%lementation !2rame 3elay *4am%le#

Customer Site Virtual Circuit !VC# 72 Customer Site

3outer + Customer Site !VC# 78 Pro(i'er *'ge 6e(ice !2rame 3elay Switch# 2rame 3elay *'ge Switch

3outer C Customer Site

3outer 5 2rame 3elay *'ge Switch 2rame 3elay *'ge Switch

3outer 6

Virtual Circuit !VC# 7)

Ser(ice Pro(i'er Networ

2000, Cisco Systems, Inc.

www.cisco.com

Page1

Layer") routing in 0(erlay VPN im%lementation

3outer +

3outer 5

3outer C

3outer 6

Ser(ice Pro(i'er in&rastructure a%%ears as %oint"to" %oint lin s to customer routes 3outing %rotocols run 'irectly .etween customer routers Ser(ice Pro(i'er 'oes not see customer routes an' is res%onsi.le only &or %ro(i'ing %oint"to"%oint trans%ort o& customer 'ata
2000, Cisco Systems, Inc.

www.cisco.com

Page9

0(erlay VPN Layer"8 Im%lementation

IP PPP ;6LC

IS6N

*8, T8, 6S0

S6;, S0N*T

This is the tra'itional T6M solution$ Ser(ice Pro(i'er esta.lishes %hysical"layer connecti(ity .etween customer sites Customer ta es res%onsi.ility &or all higher layers

2000, Cisco Systems, Inc.

www.cisco.com

Page:

0(erlay VPN Layer"2 Im%lementation

IP

>.21

2rame 3elay

+TM

This is the tra'itional Switche' =+N solution$ Ser(ice Pro(i'er esta.lishes layer"2 (irtual circuits .etween customer sites Customer ta es res%onsi.ility &or all higher layers

2000, Cisco Systems, Inc.

www.cisco.com

Page<

0(erlay VPN IP Tunneling

Internet Protocol !IP#

@eneric 3oute *nca%sulation !@3*#

IP Security !IPSec#

Internet Protocol !IP#

VPN is im%lemente' with IP"o(er"IP tunnels Tunnels are esta.lishe' with @3* or IPSec @3* is sim%ler !an' ,uic er#, IPSec %ro(i'es authentication an' security

2000, Cisco Systems, Inc.

www.cisco.com

Page?

0(erlay VPN Layer"2 2orwar'ing

Internet Protocol !IP# Point"to"Point Protocol !PPP# Layer"2 Trans%ort Protocol !L2TP# Layer"2 2orwar'ing !L22# Internet Protocol !IP# Point"to"Point Tunneling !PPTP#

VPN is im%lemente' with PPP"o(er"IP tunnels Asually use' in access en(ironments !'ial"u%, 6SL#

2000, Cisco Systems, Inc.

www.cisco.com

Page80

Peer"to"Peer VPN Conce%t

3outing in&ormation is e4change' .etween customer an' ser(ice"%ro(i'er routers
Customer Site

Ser(ice Pro(i'er Networ

Customer Site

3outer + Customer Site Pro(i'er *'ge !P*# 3outer !P*# 3outer

3outer C Customer Site

3outer 5 !P*# 3outer !P*# 3outer

3outer 6

Ser(ice Pro(i'er routers e4change customer routes through the core networ 2inally, the customer routes %ro%agate' through the ser(ice"%ro(i'er networ are sent to other customer routers
2000, Cisco Systems, Inc.

www.cisco.com

Page88

Peer"to"Peer VPN with Pac et 2ilters

Customer A Site #1 Service provider network Point-of-Presence Shared router

Customer A Site #2

P0P router carries all customer routes Isolation .etween customers is achie(e' with %ac et &ilters on P*"C* inter&aces

Customer B Site #1

2000, Cisco Systems, Inc.

www.cisco.com

Page82

MPLS VPN +rchitecture

MPLS VPN com.ines the .est &eatures o& o(erlay VPN an' %eer"to"%eer VPN
P* routers %artici%ate in customer routing, guaranteeing o%timum routing .etween sites an' easy %ro(isioning P* routers carry a se%arate sets o& routes &or each customer !similar to 'e'icate' P* router a%%roach# Customers can use o(erla%%ing a''resses

2000, Cisco Systems, Inc.

www.cisco.com

Page8)

MPLS VPN Terminology

Customer A Site #1
!emote "ffice Site #1 CE router

P"Networ

!emote "ffice

Customer A Site #

Customer A Site #2

P*"3outer P0P">

P"3outer

P*"3outer P0P"B

Customer B Site #2

Customer A Site #3

Customer B Site #3

Customer B Site #1

Customer B Site #

2000, Cisco Systems, Inc.

www.cisco.com

Page8-

3outing In&ormation Pro%agation +cross P"Networ

#$P for Customer A #$P for Customer A #$P for Customer B #$P for Customer C

Customer +

#$P for Customer B #$P for Customer C

Customer 5

Customer 5

P*"3outer">

P"3outer

P*"3outer"B

Customer C

Customer C

P"Networ

Customer +

C$ ;ow will P* routers e4change customer routing in&ormationD +8$ 3un a 'e'icate' I@P &or each customer across P"networ . =rong answer$ The solution 'oes not scale. P"routers carry all customer routers.
2000, Cisco Systems, Inc.

www.cisco.com

Page81

3outing In&ormation Pro%agation +cross P"Networ

+ 'e'icate' routing %rotocol use' to carry customer routes
Customer + Customer 5

Customer 5

P*"3outer">

P"3outer

P*"3outer"B

Customer C

Customer C

P"Networ

Customer +

C$ ;ow will P* routers e4change customer routing in&ormationD +2$ 3un a single routing %rotocol that will carry all customer routes insi'e the %ro(i'er .ac .one. 5etter answer, .ut still not goo' enough P"routers carry all customer routers.
2000, Cisco Systems, Inc.

www.cisco.com

Page89

3outing In&ormation Pro%agation +cross P"Networ

+ 'e'icate' routing %rotocol use' to carry customer routes .etween P* routers
Customer + Customer 5

Customer 5

P*"3outer">

P"3outer

P*"3outer"B

Customer C

Customer C

P"Networ

Customer +

C$ ;ow will P* routers e4change customer routing in&ormationD +)$ 3un a single routing %rotocol that will carry all customer routes .etween P* routers. Ase MPLS la.els to e4change %ac ets .etween P* routers. The .est answer P"routers 'o not carry customer routes, the solution is scala.le.
2000, Cisco Systems, Inc.

www.cisco.com

Page8:

3outing In&ormation Pro%agation +cross P"Networ

+ 'e'icate' routing %rotocol use' to carry customer routes .etween P* routers
Customer + Customer 5

Customer 5

P*"3outer">

P"3outer

P*"3outer"B

Customer C

Customer C

P"Networ

Customer +

C$ =hich %rotocol can .e use' to carry customer routes .etween P*"routersD +$ The num.er o& customer routes can .e (ery large. 5@P is the only routing %rotocol that can scale to a (ery large num.er o& routes. Conclusion$ 5@P is use' to e4change customer routes 'irectly .etween P* routers.
2000, Cisco Systems, Inc.

www.cisco.com

Page8<

3outing In&ormation Pro%agation +cross P"Networ

+ 'e'icate' routing %rotocol use' to carry customer routes .etween P* routers
Customer + Customer 5

Customer 5

P*"3outer">

P"3outer

P*"3outer"B

Customer C

Customer C

P"Networ

Customer +

C$ Customers can ha(e o(erla%%ing a''ress s%ace. ;ow will you %ro%agate in&ormation a.out the same su.net o& two customers (ia a single routing %rotocolD +$ Customer a''resses are e4ten'e' with 9-".it %re&i4 !3oute 6istinguisherE36# to ma e them uni,ue. Ani,ue ?9".it a''resses are e4change' .etween P*"routers.
2000, Cisco Systems, Inc.

www.cisco.com

Page8?

3oute 6istinguisher
3oute 6istinguisher !36# is a 9-".it ,uantity %re%en'e' to an IP(- a''ress to ma e it glo.ally uni,ue The resulting ?9".it a''ress is calle' VPN(a''ress VPN(- a''resses are only e4change' (ia 5@P .etween P* routers
5@P su%%orting other a''ress &amilies than IP(- a''resses is calle' multi"%rotocol 5@P

2000, Cisco Systems, Inc.

www.cisco.com

Page20

3oute 6istinguisher Asage in MPLS VPN

9-".it 3oute 6istinguisher is %re%en'e' to the customer IP(%re&i4 to ma e it glo.ally uni,ue, resulting in ?9".it VPN(- %re&i4 ?9".it VPN(- %re&i4 is %ro%agate' (ia 5@P to the other P* router

P-network
Customer-A

Customer-A

PE-1 Customer-B

PE-2 Customer-B

C*"router sen's an IP(- routing u%'ate to the P*"router

2000, Cisco Systems, Inc.

www.cisco.com

Page28

3oute 6istinguisher Asage in MPLS VPN

3oute 6istinguisher is remo(e' &rom the VPN(- %re&i4, resulting in )2".it IP(- %re&i4

P-network
Customer-A Customer-A

PE-1 Customer-B

PE-2 Customer-B

P* router sen's the resulting IP(- %re&i4 to the C* router

2000, Cisco Systems, Inc.

www.cisco.com

Page22

3oute 6istinguisher Asage in MPLS VPN

36 has no s%ecial meaningEit is only use' to ma e %otentially o(erla%%ing IP(- a''resses glo.ally uni,ue Sim%le VPN to%ologies re,uire one 36 %er customer 36 coul' ser(e as VPN i'enti&ier &or sim%le VPN to%ologies, .ut this 'esign coul' not su%%ort all to%ologies re,uire' .y the customers
2000, Cisco Systems, Inc.

www.cisco.com

Page2)

3oute Targets
Some sites ha(e to %artici%ate in more than one VPNEroute 'istinguisher cannot i'enti&y %artici%ation in VPN + 'i&&erent metho' is nee'e' where a set o& i'enti&iers can .e attache' to a route 3oute Targets were intro'uce' in the MPLS VPN architecture to su%%ort com%le4 VPN to%ologies
2000, Cisco Systems, Inc.

www.cisco.com

Page2-

=hat are 3oute TargetsD

3oute Targets are a''itional attri.utes attache' to VPN(- 5@P routes to in'icate VPN mem.ershi% *4ten'e' 5@P communities are use' to enco'e these attri.utes
*4ten'e' communities carry the meaning o& the attri.ute together with its (alue

+ny num.er o& route targets can .e attache' to a single route

2000, Cisco Systems, Inc.

www.cisco.com

Page21

;ow 'o 3oute Targets =or D

*4%ort route targets i'enti&ying VPN mem.ershi% are a%%en'e' to customer route when it is con(erte' into VPN(- route *ach (irtual routing ta.le has a set o& associate' im%ort route targets that select routes to .e inserte' into the (irtual routing ta.le 3oute targets usually i'enti&y VPN mem.ershi%, .ut can also .e use' in more com%le4 scenarios

2000, Cisco Systems, Inc.

www.cisco.com

Page29

Im%act o& Com%le4 VPN To%ologies on Virtual 3outing Ta.les + (irtual routing ta.le in a P* router can only .e use' &or sites with i'entical connecti(ity re,uirements Com%le4 VPN to%ologies re,uire more than one (irtual routing ta.le %er VPN +s each (irtual routing ta.le re,uires a 'istinct 36 (alue, the num.er o& 36s in the MPLS VPN networ increases
2000, Cisco Systems, Inc.

www.cisco.com

Page2:

MPLS VPN 3outing C*"3outer Pers%ecti(e

MPLS VPN 5ac .one C*"router P*"router C*"router

Customer routers run stan'ar' IP routing so&tware an' e4change routing u%'ates with the P*"router

*5@P, 0SP2, 3IP(2 or static routes are su%%orte'

P*"router a%%ears as another router in the customerFs networ
2000, Cisco Systems, Inc.

www.cisco.com

Page2<

MPLS VPN 3outing 0(erall Customer Pers%ecti(e

5@P .ac .one

P*"router

P*"router

C*"router

Site I@P

Site I@P

Site I@P

P*"routers a%%ear as core routers connecte' (ia a 5@P .ac .one to the customer Asual 5@PGI@P 'esign rules a%%ly P"routers are hi''en &rom the customer
2000, Cisco Systems, Inc.

www.cisco.com

Page2?

MPLS VPN 3outing P"3outer Pers%ecti(e

MPLS VPN 5ac .one

P*"router

P"router

P*"router

P"routers 'o not %artici%ate in MPLS VPN routing an' 'o not carry VPN routes P"routers run .ac .one I@P with the P*"routers an' e4change in&ormation a.out glo.al su.nets !core lin s an' loo%.ac s#

2000, Cisco Systems, Inc.

www.cisco.com

Page)0

MPLS VPN 3outing P*"3outer Pers%ecti(e

MPLS VPN 5ac .one C*"router
VPN routing MP"5@P

C*"router P*"router
VPN routing

P*"router

P"router

Core I@P

Core I@P

C*"router

C*"router

P*"routers$
*4change VPN routes with C*"routers (ia %er"VPN routing %rotocols *4change core routes with P"routers an' P*"routers (ia core I@P *4change VPN(- routes with other P*"routers (ia multi" %rotocol I5@P sessions
2000, Cisco Systems, Inc.

www.cisco.com

Page)8

MPLS VPN Su%%ort &or Internet 3outing

MPLS VPN 5ac .one C*"router
IP(- 5@P &or Internet

C*"router P*"router C*"router

P*"router C*"router

P"router

Core I@P

Core I@P

P*"routers can run stan'ar' IP(- 5@P in the glo.al routing ta.le
*4change Internet routes with other P* routers C*"routers 'o not %artici%ate in Internet routing P"routers 'o not nee' to %artici%ate in Internet routing

2000, Cisco Systems, Inc.

www.cisco.com

Page)2

3outing ta.les on P*"3outers

MPLS VPN 5ac .one C*"routerVPN routing P*"router C*"router
MP"5@P VPN routing C*"router

P"router
IP(- 5@P &or Internet

P*"router C*"router

Core I@P

Core I@P

P*"routers contain a num.er o& routing ta.les$

@lo.al routing ta.le that contains core routes !&ille' with core I@P# an' Internet routes !&ille' with IP(- 5@P# Virtual 3outing an' 2orwar'ing !V32# ta.les &or sets o& sites with i'entical routing re,uirements V32s are &ille' with in&ormation &rom C*"routers an' MP"5@P in&ormation &rom other P*"routers
2000, Cisco Systems, Inc.

www.cisco.com

Page))

MPLS VPN *n'"to"*n' 3outing In&ormation 2low !8G)#

MPLS VPN 5ac .one C*"router C*"router P*"router P"router P*"router C*"router

IP(- u%'ate
C*"router

P*"routers recei(e IP(- routing u%'ates &rom C*"routers an' install them in the a%%ro%riate Virtual 3outing an' 2orwar'ing !V32# ta.le

2000, Cisco Systems, Inc.

www.cisco.com

Page)-

MP"5@P A%'ate VPN(- a''ress

VPN"IPV- a''ress contains$ 3oute 6istinguisher
9- .its Ma es the IP(- route glo.ally uni,ue 36 is con&igure' in the P* &or each V32 36 may or may not .e relate' to a site or a VPN

IP(- a''ress !)2.its#

2000, Cisco Systems, Inc.

www.cisco.com

Page)1

MP"5@P A%'ate *4ten'e' Communities

9-".it long attri.ute attache' to a route + set o& communities can .e attache' to a single route ;igh"or'er 89 .its i'enti&y e4ten'e' community ty%e
3oute"target !3T#$ i'enti&ies the set o& sites the route has to .e a'(ertise' to Site o& 0rigin !S00#$ i'enti&ies the originating site 0SP2 3oute Ty%e$ i'enti&ies the LS+ ty%e o& 0SP2 route re'istri.ute' into MP"5@P

2000, Cisco Systems, Inc.

www.cisco.com

Page)9

*4ten'e' 5@P Community 6is%lay 2ormat

Two 'is%lay &ormats are su%%orte'
H89.its ty%eI$H+SNI$H)2 .it num.erI Ases registere' +S num.er H89.its ty%eI$HIP a''ressI$H89 .it num.erI Ases registere' IP a''ress

2000, Cisco Systems, Inc.

www.cisco.com

Page):

MPLS VPN *n'"to"*n' 3outing In&ormation 2low !)G)#

MPLS VPN 5ac .one C*"router C*"router

MP"5@P u%'ate
P*"router C*"router P"router P*"router C*"router

3ecei(ing P*"router im%orts incoming VPN(- routes into the a%%ro%riate V32 .ase' on route targets attache' to the routes 3outes installe' in V32 are %ro%agate' to C*"routers

2000, Cisco Systems, Inc.

www.cisco.com

Page)<

3oute 6istri.ution to C*"routers

3oute 'istri.ution to sites is 'ri(en .y the Site o& 0rigin an' 3oute"target e4ten'e' 5@P communities + route is installe' in the site V32 that matches the 3oute"target attri.ute
+ P* which connects sites .elonging to multi%le VPNs will install the route into the site V32 i& the 3oute"target attri.ute contains one or more VPNs to which the site is associate'

2000, Cisco Systems, Inc.

www.cisco.com

Page)?

VPN Pac et 2orwar'ing +cross MPLS VPN 5ac .one

MPLS VPN 5ac .one C*"router
#P #P

C*"router P"router P"router *gress"P* C*"router

Ingress"P*

C*"router

C$ ;ow will P* routers &orwar' VPN %ac ets across MPLS VPN .ac .oneD +8$ Just &orwar' %ure IP %ac ets. =rong answer$ P"routers 'o not ha(e VPN routes, %ac et is 'ro%%e' on IP loo u%. ;ow a.out using MPLS &or %ac et %ro%agation across .ac .oneD

2000, Cisco Systems, Inc.

www.cisco.com

Page-0

VPN Pac et 2orwar'ing +cross MPLS VPN 5ac .one

MPLS VPN 5ac .one C*"router
#P #P %1 #P %2 #P %3

C*"router

Ingress"P*

P"router

P"router

*gress"P* C*"router

C*"router

C$ ;ow will P* routers &orwar' VPN %ac ets across MPLS VPN .ac .oneD +2$ La.el VPN %ac ets with L6P la.el &or egress P*"router, &orwar' la.ele' %ac ets across MPLS .ac .one. 5etter answer$ P"routers %er&orm la.el switching, %ac et reaches egress P*"router. ;owe(er, egress P*"router 'oes not now which V32 to use &or %ac et loo u%E%ac et is 'ro%%e'. ;ow a.out using a la.el stac D
2000, Cisco Systems, Inc.

www.cisco.com

Page-8

VPN Pac et 2orwar'ing +cross MPLS VPN 5ac .one

MPLS VPN 5ac .one C*"router
#P #P & %1 #P & %2 #P & %3

C*"router
#P

Ingress"P*

P"router

P"router

*gress"P* C*"router

C*"router

C$ ;ow will P* routers &orwar' VPN %ac ets across MPLS VPN .ac .oneD +)$ La.el VPN %ac ets with a la.el stac . Ase L6P la.el &or egress P*"router as the to% la.el, VPN la.el assigne' .y egress P*"router as the secon' la.el in the stac . Correct answer$ P"routers %er&orm la.el switching, %ac et reaches egress P*"router. *gress P*"router %er&orms loo u% on the VPN la.el an' &orwar's the %ac et towar' the C*"router.
2000, Cisco Systems, Inc.

www.cisco.com

Page-2

VPN Pac et 2orwar'ing Penultimate ;o% Po%%ing

MPLS VPN 5ac .one C*"router
#P #P & %1 #P & %2 #P &

C*"router
#P

Ingress"P*

P"router

P"router

*gress"P* C*"router

C*"router

Penultimate ho% %o%%ing on the L6P la.el can .e %er&orme' on the last P"router *gress P*"router %er&orms only la.el loo u% on VPN la.el, resulting in &aster an' sim%ler la.el loo u% IP loo u% is %er&orme' only onceEin ingress P* router
2000, Cisco Systems, Inc.

www.cisco.com

Page-)

VPN La.el Pro%agation

MPLS VPN 5ac .one C*"router Ingress"P* C*"router P"router P"router *gress"P* C*"router C*"router

C$ ;ow will the ingress P*"router get the secon' la.el in the la.el stac &rom the egress P*"routerD +$ La.els are %ro%agate' in MP"5@P VPN(- routing u%'ates.

2000, Cisco Systems, Inc.

www.cisco.com

Page--

VPN La.el Pro%agation

MPLS VPN 5ac .one C*"router Ingress"P* C*"router P"router P"router *gress"P* C*"router C*"router

Ste% 78$ VPN la.el is assigne' to e(ery VPN route .y the egress P* router
Egress-PE#show tag-switching forwarding vrf SiteA2 Local Outgoing Prefix Bytes tag Outgoing tag tag or "# or $unnel %d switched interface 2& Aggregate '()*'*+'*+&,+)-". ) +/ 0ntagged 2)+*'*2*',+2-". ) Se',)*2) +1 0ntagged 2)+*'*2)*),22-". ) Se',)*2)
2000, Cisco Systems, Inc.

Next

o!

!oint2!oint !oint2!oint
Page-1

www.cisco.com

VPN La.el Pro%agation

MPLS VPN 5ac .one C*"router Ingress"P* C*"router P"router P"router *gress"P* C*"router C*"router

Ste% 72$ VPN la.el is a'(ertise' to all other P*"routers in MP"5@P u%'ate
%ngress-PE#show i! 3g! v!nv2 all tags Networ4 Next o! %n tag,Out tag 5oute 6istinguisher7 '))7' 8vrf'9 '2*)*)*) ')*2)*)*&) 2&,notag ')*2)*)*&) 2&,notag 2)+*'*2)*) ')*'(*)*'( notag,+1
2000, Cisco Systems, Inc.

www.cisco.com

Page-9

VPN La.el Pro%agation

MPLS VPN 5ac .one C*"router Ingress"P* C*"router P"router P"router *gress"P* C*"router C*"router

Ste% 7)$ La.el stac is .uilt in Virtual 2orwar'ing ta.le

%ngress-PE#show i! cef vrf "rf' 2)+*'*2)*) detail 2)+*'*2)*),22: version (/: cached ad;acency to Serial',)*2 ) !ac4ets: ) 3ytes tag infor<ation set local tag7 "PN-route-head fast tag rewrite with Se',)*2: !oint2!oint: tags i<!osed7 =2& +1> via '?2*'&1*+*')+: ) de!endencies: recursive next ho! '?2*'&1*+*'): Serial',)*2 via '?2*'&1*+*')+,+2 valid cached ad;acency tag rewrite with Se',)*2: !oint2!oint: tags i<!osed7 =2& +1>
2000, Cisco Systems, Inc.

www.cisco.com

Page-:

Peer to Peer VPN Conce%t

Sli'e not +(aila.le

2000, Cisco Systems, Inc.

www.cisco.com

Page-<