© 2006 Cisco Systems, Inc. All rights reserved. MPLS v MPLS VPN Technology Introducing MPLS VPN Architecture

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Outline Overview What Are the Drawbacks of Traditional Peer-to-Peer VPNs? What Is the MPLS VPN Architecture? What Is the Architecture of a PE Router in an MPLS VPN? What Are the Methods of Propagating Routing Information Across the P-Network? What Are RDs? Is the RD enough? How Have Complex VPNs Redefined the Meaning of VPNs? What Is the Impact of Complex VPN Topologies on Virtual Routing Tables? Summary

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Drawbacks of Traditional Peer-to-Peer VPNs Shared PE router: –All customers share the same (provider-assigned or public) address space. –High maintenance costs are associated with packet filters. –Performance is lowereach packet has to pass a packet filter. Dedicated PE router: –All customers share the same address space. –Each customer requires a dedicated router at each POP.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v MPLS VPN Architecture An MPLS VPN combines the best features of an overlay VPN and a peer-to-peer VPN: PE routers participate in customer routing, guaranteeing optimum routing between sites and easy provisioning. PE routers carry a separate set of routes for each customer (similar to the dedicated PE router approach). Customers can use overlapping addresses.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v MPLS VPN Architecture: Terminology Note: PE Router = Edge LSR P Router = LSR

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v PE Router Architecture PE router in an MPLS VPN uses virtual routing tables to implement the functionality of customer dedicated PE routers.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Propagation of Routing Information Across the P-Network Question: How will PE routers exchange customer routing information? Option #1: Run a dedicated IGP for each customer across the P-network. This is the wrong answer for these reasons: The solution does not scale. P routers carry all customer routes.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Propagation of Routing Information Across the P-Network (Cont.) Question: How will PE routers exchange customer routing information? Option #2: Run a single routing protocol that will carry all customer routes inside the provider backbone. Better answer, but still not good enough: P routers carry all customer routes.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Propagation of Routing Information Across the P-Network (Cont.) Question: How will PE routers exchange customer routing information? Option #3: Run a single routing protocol that will carry all customer routes between PE routers. Use MPLS labels to exchange packets between PE routers. The best answer: P routers do not carry customer routes; the solution is scalable.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Propagation of Routing Information Across the P-Network (Cont.) Question: Which protocol can be used to carry customer routes between PE routers? Answer: The number of customer routes can be very large. BGP is the only routing protocol that can scale to a very large number of routes. Conclusion: BGP is used to exchange customer routes directly between PE routers.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Propagation of Routing Information Across the P-Network (Cont.) Question: How will information about the overlapping subnetworks of two customers be propagated via a single routing protocol? Answer: Extend the customer addresses to make them unique.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Route Distinguishers The 64-bit route distinguisher is prepended to an IPv4 address to make it globally unique. The resulting address is a VPNv4 address. VPNv4 addresses are exchanged between PE routers via BGP. –BGP that supports address families other than IPv4 addresses is called MP-BGP. A similar process is used in IPv6: –64-bit route distinguisher is prepended to a 16-byte IPv6 address. –The resulting 24-byte address is a unique VPNv6 address.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Route Distinguishers (Cont.)

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Route Distinguishers (Cont.)

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v RDs: Usage in an MPLS VPN The RD has no special meaning. The RD is used only to make potentially overlapping IPv4 addresses globally unique. The RD is used as a VPN identifier, but this design could not support all topologies required by the customers.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Requirements: All sites of one customer need to communicate. Central sites of both customers need to communicate with VoIP gateways and other central sites. Other sites from different customers do not communicate with each other. Is the RD Enough? VoIP Service Sample

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Example: Connectivity Requirements

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v RTs: Why Are They Needed? Some sites have to participate in more than one VPN. The RD cannot identify participation in more than one VPN. RTs were introduced in the MPLS VPN architecture to support complex VPN topologies. –A different method is needed in which a set of identifiers can be attached to a route.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v RTs: What Are They? RTs are additional attributes attached to VPNv4 BGP routes to indicate VPN membership. Extended BGP communities are used to encode these attributes. –Extended communities carry the meaning of the attribute together with its value. Any number of RTs can be attached to a single route.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v RTs: How Do They Work? Export RTs: –Identifying VPN membership –Appended to the customer route when it is converted into a VPNv4 route Import RTs: –Associated with each virtual routing table –Select routes to be inserted into the virtual routing table

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v VPNs Redefined With the introduction of complex VPN topologies, VPNs have had to be redefined: A VPN is a collection of sites sharing common routing information. A site can be part of different VPNs. A VPN can be seen as a community of interest (closed user group). Complex VPN topologies are supported by multiple virtual routing tables on the PE routers.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Impact of Complex VPN Topologies on Virtual Routing Tables A virtual routing table in a PE router can be used only for sites with identical connectivity requirements. Complex VPN topologies require more than one virtual routing table per VPN. As each virtual routing table requires a distinct RD value, the number of RDs in the MPLS VPN network increases.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Impact of Complex VPN Topologies on Virtual Routing Tables (Cont.)

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Summary There are several drawback to traditional peer-to-peer VPNs. MPLS VPN architecture combines the best features of the overlay and peer-to-peer VPN models. The architecture of a PE router in an MPLS VPN uses separate virtual routers containing the routes of each customers inside one physical router. The most scalable method of exchanging customer routes across a provider network is the use of a single BGP routing protocol from PE router to PE router.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v Summary (Cont.) Route distinguishers transform non-unique 32-bit addresses into 96-bit unique addresses. Route targets are used to identify VPN membership in overlapping topologies. VPNs are now considered a collection of sites sharing common routing information. Placing sites with different routing requirements in the same virtual routing table will result in inconsistent routing.

© 2006 Cisco Systems, Inc. All rights reserved. MPLS v