Juniper Networks, Inc. Copyright © L2 MPLS VPNs Hector Avalos Technical Director-Southern Europe

Juniper Networks, Inc. Copyright © Agenda: L2 MPLS VPNs  VPNs Overview  Provider-provisioned L2 MPLS VPNs  Taxonomy  Operational Model  Conclusion

Juniper Networks, Inc. Copyright © What is a VPN?  A private network constructed over a shared infrastructure  Virtual: not a separate physical network  Private: separate addressing and routing  Network: a collection of devices that communicate  Policies are key—global connectivity is not the goal Shared Infrastructure Shared Infrastructure Mobile Users and Telecommuters Remote Access Branch Office Corporate Headquarters Suppliers, Partners and Customers Intranet Extranet

Juniper Networks, Inc. Copyright © Deploying VPNs in the 1990s  Operational model  PVCs overlay the shared infrastructure (ATM/Frame Relay)  Routing occurs at customer premise  Benefits  Mature technologies  Relatively “secure”  Service commitments (bandwidth, availability, and more)  Limitations  Scalability, provisioning and management  Not a fully integrated IP solution Provider Frame Relay Network CPE DLCI FR Switch DLCI FR Switch

Juniper Networks, Inc. Copyright © Traditional (Layer 2) VPNs Router Frame Relay/ ATM Switch

Juniper Networks, Inc. Copyright © Improving Traditional Layer 2 VPNs  Decouple edge (customer-facing) technology from core technology  Have a single network infrastructure for all desired services  Internet  L3 MPLS VPNs  L2 MPLS VPNs  Simplify provisioning  Appropriate signaling mechanisms for VPN auto- provisioning

Juniper Networks, Inc. Copyright © VPN Classification Model  Customer-managed VPN solutions (CPE-VPNs)  Layer 2: L2TP and PPTP  Layer 3: IPSec  Provider-provisioned VPN solutions (PP-VPNs)  Layer 3: MPLS-Based VPNs (RFC 2547bis)  Layer 3: Non-MPLS-Based VPNs (Virtual Routers)  Layer2: MPLS VPNs PE CPE Subscriber Site 3 PP-VPN Subscriber Site 2 CPE PE VPN Tunnel CPE PE CPE CPE-VPN VPN Tunnel Subscriber Site 1 Subscriber Site 3 Subscriber Site 2 VPN Tunnel VPN Tunnel Subscriber Site 1

Juniper Networks, Inc. Copyright © PP-VPNs: Layer 2 Classification  Service Provider delivers Layer 2 circuit IDs (DLCI, VPI/VCI, 802.1q vlan) to the customer  One for each reachable site  Customer maps their own routing architecture to the circuit mesh  Provider router maps the circuit ID to a Label Switched Path (LSP) to traverse the provider core  Customer routes are transparent to provider routers  Provider-provisioned L2 MPLS VPN Internet drafts  draft-kompella-mpls-l2vpn-02.txt  draft-martini-l2circuit-encap-mpls-01.txt

Juniper Networks, Inc. Copyright © Agenda: L2 MPLS VPNs  Overview of VPNs  Provider-provisioned L2 MPLS VPNs  Taxonomy  Operational Model  Conclusion

Juniper Networks, Inc. Copyright © Customer Edge Routers  Customer Edge (CE) routers  Router or switch device located at customer premises providing access to the service provider network  Layer 2 (FR, ATM, Ethernet) and Layer 3 (IP, IPX, SNA …) independence of the service provider network  CEs within a VPN, uses the same L2 technology to access the service provider network  Requires a sub-interface per CE it needs to interconnect to within the VPN  Maintains routing adjacencies with other CEs within the VPN CE P P PECE Customer Edge CE PE VPN A VPN B PE ATM FR ATM FR VPN Site

Juniper Networks, Inc. Copyright © Provider Edge Routers  Provider Edge (PE) routers  Maintain site-specific VPN Forwarding Tables  Exchange VPN Connection Tables with other PE routers using MP-IBGP or LDP  Use MPLS LSPs to forward VPN traffic CE P P PECE PE VPN A VPN B PE Provider Edge ATM FR ATM FR

Juniper Networks, Inc. Copyright © CE P P PECE PE VPN A VPN B PE Provider Routers  Provider (P) routers  Forward data traffic transparently over established LSPs  Do not maintain VPN-specific forwarding information Provider Routers ATM FR ATM FR

Juniper Networks, Inc. Copyright © VPN Forwarding Tables (VFT) P P P PE 2 VPN A Site 3 VPN A Site 1 VPN B Site2 VPN B Site 1 PE 1 PE 3 VPN A Site2 CE–A1 CE–B1 CE–A3 CE–A2 CE–B2 P A VFT is created for each site connected to the PE OSPF ATM  Each VFT is populated with:  The forwarding information provisioned for the local CE sites  VPN Connection Tables received from other PEs via iBGP or LDP

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 VPN Connection Tables (VCT) PE-2 CE-4 PE-1 CE-2 CE-1 VFT  The VCT is a subset of information hold by the VFT  VCTs are distributed by the PEs via iBGP or LDP A VCT is distributed for each VPN site to PEs MP-iBGP session / LDP

Juniper Networks, Inc. Copyright © L2 VPN Provisioning  Provisioning the network  Provisioning the CEs  Provisioning the VPN (PEs)  VPN Connection Table Distribution Assumption: access technology is Frame Relay (other cases are similar)

Juniper Networks, Inc. Copyright © Provisioning the Network P P P PE 2 VPN A Site 3 VPN A Site 1 VPN B Site2 VPN B Site 1 PE 1 PE 3 VPN A Site2 CE–A1 CE–B1 CE–A3 CE–A2 CE–B2 P OSPF ATM  PE-to-PE LSPs pre-established via  RSVP-TE  LDP  LDP over RSPV-TE tunneling  LSPs used for many services: IP, L2 VPN, L3 VPN, …  Provisioned independent of Layer 2 VPNs

Juniper Networks, Inc. Copyright © Provisioning Customer Sites  List of DLCIs: one for each site, some spare for over-provisioning  DLCIs independently numbered at each site  LMI, inverse ARP and/or routing protocols for auto-discovery and learning addresses  No changes as VPN membership changes  Until over-provisioning runs out CE-4 DLCIs CE-4 Routing Table InOut DLCI 63 10/8 DLCI 7520/8 DLCI 8230/8 DLCI 94-

Juniper Networks, Inc. Copyright © Provisioning CE’s at the PE  A VFT is provisioned at each PE for each CE  VPN-ID : unique value within the service provider network  CE-ID : unique value in the context of a VPN  CE Range : maximum number of CEs that it can connect to  Sub-interface list : set of local sub-interface IDs assigned for the CE-PE connection CE 4 VFT VPN ID CE ID RED VPN 4 CE Range 4 Sub-int IDs

Juniper Networks, Inc. Copyright © Provisioning CE’s at the PE  A VFT is provisioned at each PE for each CE  VPN-ID : unique value within the service provider network  CE-ID : unique value in the context of a VPN  CE Range : maximum number of CEs that it can connect to  Sub-interface list : set of local sub-interface IDs assigned for the CE-PE connection  Label-base : Label assigned to the first sub-interface ID  The PE reserves N contiguous labels, where N is the CE Range CE 4 VFT VPN ID CE ID RED VPN 4 CE Range Label Base Sub-int IDs CE 4 VCT

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Provisioning CE’s at the PE PE-2 CE-4 PE-1 CE-2 CE-1 VFT CE 4 VFT VPN ID CE ID RED VPN 4 CE Range Label base 4 Sub-int IDs Label used by CE 1 to reach CE Label used by CE 2 to reach CE Label used by CE 0 to reach CE FR CE 4 ‘s DLCI to CE 0 63 CE 4 ‘s DLCI to CE 1 75 CE 4 ‘s DLCI to CE 2 82 CE 4 ‘s DLCI to CE 3 94  PE-2 is configured with the CE4 VFT Label used by CE 3 to reach CE

Juniper Networks, Inc. Copyright © Distributing VCTs  Key: signalling using LDP or MP-iBGP  Auto-discovery of members  Auto-assignment of inter-member circuits  Flexible VPN topology  O(N) configuration for the whole VPN  Could be more for complex topologies  O(1) configuration to add a site  “Overprovision” DLCIs (sub-interfaces) at customer sites

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Distributing VCTs  PE-1 accepts PE-2’s CE 4 VCT PE-2 CE-4 PE-1 CE-2 CE-1 VFT FR Label used by CE 2 to reach CE MP-iBGP session / LDP CE 4 VCT update VPN ID CE ID RED VPN 4 CE Range Label base CE 4 VCT update VPN ID CE ID RED VPN 4 CE Range Label base

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Updating VFTs  PE-1 update its CE 2 VFT PE-2 CE-4 PE-1 CE-2 CE-1 VFT FR DLCI 82 FR DLCI 414 CE 2 VFT CE ID Inner Label Sub-int IDs Label used to reach CE

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Updating VFTs  PE-1 update its CE 2 VFT PE-2 CE-4 PE-1 CE-2 CE-1 VFT CE 2 VFT CE ID Inner Label Sub-int IDs LSP to PE Outer Label FR DLCI 82 FR DLCI 414

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Data Flow  The CE-2 sends packets to the PE via the DLCI which connects to CE-4 (414) PE-2 CE-4 PE-1 CE-2 CE-1 VFT DLCI 82 DLCI 414 packet DLCI 414

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Data Flow  The DLCI number is removed by the ingress PE  Two labels are derived from the VFT sub-interface lookup and “pushed” onto the packet  Outer IGP label  Identifies the LSP to egress PE router  Derived from core’s IGP and distributed by RSVP or LDP  Inner site label  Identifies outgoing sub-interface from egress PE to CE  Derived from MP-IBGP/LDP VCT distributed by egress PE PE-2 CP-4 PE-1 CE-2 CE-1 PE-1 1) Lookup DLCI in Red VFT 2) Push VPN label (1002) 3) Push IGP label (500) VFT DLCI 82 Packet site label (1002) IGP label (500)

Juniper Networks, Inc. Copyright © Site 1 Site /16 Site 1 Site 2 Data Flow  After packets exit the ingress PE, the outer label is used to traverse the LSP  P routers are not VPN-aware PE-2 CPE-4 PE-1 CE-2 CE-1 VFT Packet site label (1002) IGP label (z) DLCI 82 DLCI 414

Juniper Networks, Inc. Copyright © Site 1 Site /16 Site 1 Site 2 Data Flow  The outer label is removed through penultimate hop popping (before reaching the egress PE) PE-2 CE-4 PE-1 CE-2 CE-1 Penultimate Pop top label VFT Packet site label (1002) DLCI 82 DLCI 414

Juniper Networks, Inc. Copyright © Site 1 Site 2 Site 1 Site 2 Data Flow  The inner label is removed at the egress PE  The egress PE does a label lookup to find the corresponding DLCI value  The native Frame Relay packet is sent to the corresponding outbound sub-interface PE-2 CE-4 PE-1 CE-2 CE-1 VFT DLCI 82 DLCI 414 packet DLCI 82

Juniper Networks, Inc. Copyright © VPN Topologies  Arbitrary topologies are possible:  full mesh  hub-and-spoke  BGP communities are used to configure VPN topologies when using BGP signaling  “Connectivity” parameter serves similar purpose in LDP signaling

Juniper Networks, Inc. Copyright © Conclusions

Juniper Networks, Inc. Copyright © A Range of VPN Solutions  Each customer has different  Security requirements  Staff expertise  Tolerance for outsourcing  Customer networks vary by size and traffic volume  Providers also have different preferences concerning  Extensive policy management  Inclusion of customer routes in backbone routers  Approaches to managed service

Juniper Networks, Inc. Copyright © MPLS-Based Layer 2 VPNs  MPLS-based Layer 2 VPNs are identical to Layer 2 VPNs from customers’ perspective  Familiar paradigm  Layer 3 independent  Provider not responsible for routing  No hacks for OSPF  Rely on SP only for connectivity  MPLS transport in provider network  Decouples edge and core Layer 2 technologies  Multiple services over single infrastructure  Single network architecture for both Internet and VPN services  Label stacking  Provision once, and use same LSP for multiple purposes  Auto-provisioning VPN

Juniper Networks, Inc. Copyright © MPLS-based Layer 2 VPNs: Advantages  Subscriber  Outsourced WAN infrastructure  Easy migration from existing Layer 2 fabric  Can maintain routing control, or opt for managed service  Supports any Layer 3 protocol  Supports multicast  Provider  Complements RFC 2547bis  Operates over the same core, using the same outer LSP  Existing Frame Relay and ATM VPNs can be collapsed onto a single IP/MPLS infrastructure  Label stacking allows multiple services over a single LSP  No scalability problems associated with storing numerous customer VPN routes  Simpler than the extensive policy-based configuration used with 2547

Juniper Networks, Inc. Copyright © MPLS-based Layer 2 VPNs: Disadvantages  Circuit type (ATM/FR) to each VPN site must be uniform  Managed network service required for provider revenue opportunity  Customer must have routing expertise (or opt for managed service)

Juniper Networks, Inc. Copyright © Layer 2 MPLS-based VPNs Application  Customer profile  High degree of IP expertise  Desire to control their own routing infrastructure  Prefer to outsource tunneling  Large number of users and sites  Provider profile  MPLS deployed in the core  Migrating an existing ATM or Frame Relay network  Offers CPE managed service, or  Provisions only the layer 2 circuits at a premium cost  Layer 2 MPLS-based VPNs are ideal for this customer profile

Juniper Networks, Inc. Copyright © Thank you!