Beruflich Dokumente
Kultur Dokumente
Mitrabh Shukla
National IP Manager
Agenda
VPN Concepts
Terminology
VPN Connection model
Forwarding Example
VPN Topologies
What is an MPLS-VPN?
An IP network infrastructure delivering private network services
over a public infrastructure
Use a layer 3 backbone
Scalability, easy provisioning
Global as well as non-unique private address space
QoS
Controlled access
Easy configuration for customers
VPN Models
There are two basic types of design models that deliver VPN
functionality
Overlay Model
Peer Model
Site-4
Site-1
VPN-C
VPN-A
Site-3
Site-2
VPN-B
CE
PE
ELSR
P
LSR
PE
LSR
LSR
LSR
P Network
(Provider Control)
ELSR
ELSR
ELSR
C Network
(Customer Control)
CE
C Network
(Customer Control)
PE-CE Routing
CE1
PE
CE2
PE-CE routing
Routing
processes
BGP
RIP
Static
Routing processes run within
specific routing contexts
Routing
contexts
BGP
1
BGP
BGP
RIP
RIP
VRF Routing
tables
VRF Forwarding
tables
VRF
VRF
VRF
Site A
Site B
Site C
Routing
processes
OSPF
OSPF
OSPF
With OSPF there is a single
process per VRF
Routing
contexts
VRF Routing
tables
VRF Forwarding
tables
VRF
Site A
VRF
Site B
VRF
Site C
Routing Tables
CE1
VRF
PE
CE2
PE-CE routing
CE1
P1
PE1
P2
CE3
PE2
CE2
CE4
LFIB for P1
LFIB for P2
Dest
Next Hop
IN
OUT
Dest
Next Hop
IN
OUT
Dest
Next Hop
IN
OUT
Dest
Next Hop
IN
OUT
PE2
P1
17
50
PE2
P2
50
34
PE2
P1
34
POP
P1
P2
44
38
P2
P1
18
65
P2
E0/2
65
POP
P1
E0/1
38
POP
P2
P2
36
65
P1
S0/0
19
POP
PE1
S3/0
67
POP
PE1
P1
39
67
PE1
P2
18
39
CE1
PE1
P1
P2
CE2
PE2
CE3
CE4
MP-iBGP session
CE1
PE1
P1
P2
CE2
PE2
CE3
CE4
MP-iBGP session
CE1
PE1
P1
P2
CE2
PE2
CE3
CE4
MP-iBGP session
CE1
PE1
P1
P2
CE2
PE2
CE3
CE4
MP-iBGP session
CE1
update X
P1
PE1
P2
PE2
CE2
CE3
CE4
x
MP-iBGP session
update X
update X
VPN-IPv4 update:
RD1:X, Next-hop=PE1
RT=RED, Label=10
VPN-IPv4 update:
RD2:X, Next-hop=PE1
RT=ORANGE, Label=12
CE1
update X
P1
PE1
P2
PE2
CE2
CE3
CE4
x
MP-iBGP session
update X
update X
VPN-IPv4 update:
RD1:X, Next-hop=PE1
RT=RED, Label=10
VPN-IPv4 update:
RD2:X, Next-hop=PE1
RT=ORANGE, Label=12
Multi-Protocol BGP
Propagates VPN routing information
Customer routes held in VPN Routing and Forwarding tables
(VRFs)
Only runs on Provider Edge
P routers are not aware of VPNs only labels
PEs are fully meshed
Using Route Reflectors or direct peerings between PE routers
OSPF/IS-IS
Used as IGP provides reachability between all Label
Switch Routers (PE <-> P <-> PE)
TDP/LDP
Distributes label information for IP destinations in core
MP-BGP4
Used to distribute VPN routing information between PEs
RIPv2/BGP/OSPF/eiGRP/ISIS/Static
Can be used to route between PE and CE
VPN Components
VRF Tables
Hold customer routes at PE
Route-Distinguisher
Allows MP-BGP to distinguish between identical
customer routes that are in different VPNs
Route-Targets
Used to import and export routes between different VRF
tables (creates Intranets and Extranets)
Route-maps
Allows finer granularity and control of importing
exporting routes between VRFs instead of just using
route-target
For internal use
26
Nokia Siemens Networks
= RT?
RD +
RD +
VPN labels, RTs
PE
P
RR
Si
RD +
CE
PE
PE
RD +
RD +
VPN labels, RTs
CE-PE dynamic routing (or static) populate the VRF routing tables
MP-BGP between PE router to distribute routes between VPNs
CE
Si
RR
PE
= RT?
CE
L2 Header
For internal use
28
Nokia Siemens Networks
Label 1
Label 2
L3 Header
Data
CE
CE
PE
PE
P
CE
Si
P
CE
Si
PE
PE
F FF
FF F
Finance
Site 1
Finance
Site 2
MPLS Core
F FF
FF F
F FF
FF F
VRF
DA
DA EB
E DA
EB
E
EA
E
EB
E EA
E
Engineering
Site A (EA)
E E
Design
Site A (DA)
MPLS Core
Design
Site B (DB)
D
D
D D
VRF
EB
EB D EB
D
D
D D
Basic Extranet
Routes can be imported directly into corresponding VRF
NAT may be necessary if Enterprise have overlapping addressing
Import granularity can be very fine
Single host address can be imported as Extranet route
For internal use
31
Nokia Siemens Networks
BGP/OSPF/RIP
routing
VRF
Spoke OUT
S3 S1h
X S2h
S3
S2h
S1h S3h
S1 S2 S3
X
MPLS Core
Bank
Branch 2
S2
Optional
Firewall
NAT to X
Hub IN
S2 S1h
X S3h
VRF
BGP/OSPF/RIP
routing
S1 S2h
X S3h
Central
HQ
VRF
Bank
Branch 1
S1
Legal
VRF
L L L
L D3
D3
Internet
Legal Only
Internet
Legal/Sales &
Marketing Backup
Internet
Sales and
Marketing
Gateway 3
Sales
S
S
S
S D1
MPLS Core
S M
D2
Gateway 2
Marketing
M M
M D
S M1
DI
Gateway 1
CC
S1 C
S2 C C S3
Site 1
Site 2
CC
S1 C
S2 C C S3
VRF
S1 C
CC
Site 3
MPLS Core
S3 C
CC
S2 C
CC
BBB B
POP 2
AS100
P1
P2 P3
iBGP session
iBGP session
BBB B
P1
P2 P3
VRF
P1
P2 P3
Import/Export IGP
routes
MPLS Core
POP 1
AS100
iBGP session
P1
P2 P3
P1
P2 P3
P1
P2 P3
POP 3
AS100
BBB B
ISP Backup
Interne
t
Backup Gateway
BGP Routes in
Internet Gateway
Loopback is L1
Interne
t
Internet Gateway
Primary Internet Path
Loopback is L2
Tier 3 ISP
T L1T T
B BB B
AS
17897
VRF
T T L2
T L1 D
T TL2
T L1 D
MPLS Core
VRF
VRF
T TL2
T L1D
T L2T T
BBB B
AS
12701
Loopback is L1