Layer3 Virtual Private Network (L3VPN)

Transcription

1 Next Generation Optical Networks for Broadband European Leadership Layer3 Virtual Private Network (L3VPN) Training course Valerio Martini

2 Summary What is a VPN? VPN (RFC4364). A choice Private Instances of routing (VRFs Table) Multi Protocol BGP A Tunnel A quick view on: VPN Multi Domain VPN QoS and Scalability 2

3 What is a VPN? A Virtual Private Network (VPN) is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy and reservation through the use of tunneling protocols Layer3 VPNs (L3VPN) are based on / networks (cfr. RFC4364 BGP / VPN ) L3 VPN connectivity is provided across Service Provider s networks L3 VPNs are based on address scheme and the relevant virtual connectivity is based on the use of ad hoc forwarding table called VRF (VPN Routing and Forwarding tables) Routers (P-Routers) are unaware of the tunnel and VRF tables but are aware of tunneling protocols Service Provider routers (PE-Routers) are outsourced to corporate network WANs (Sites) to establish L3 VPN 3

4 VPN Terminology P Provider Router PE Provider Edge Router CE Customer Edge Router P GE GE 4

5 VPN Terminology WAN of a corporate network (Site) consists of a network systems placed in geographic proximity VPN area Different Customer Sites BGP - / - OSPF/(RSVP) P GE GE 5

6 VPN Terminology End System An Attachment Circuit is usually considered as a Data Link e.g., a Fast Ethernet () or GE Gigabit Ethernet P GE GE 6

7 VPN Taxonomy A brief classification : Type of customer side Virtual Tunnel Layer 2 VPNs provide Layer 2 connectivity e.g., Native Ethernet LAN Layer 3 VPNs provide Layer 3 connectivity e.g., based on Access Router Type of VPN (in terms of end-point Location) CE-based : VPNs are configured and maintained by customer Provider network is VPN unaware PE-based : Network providers are responsible for VPN configuration and maintenance Type of Architecture possible VPN Layer 3 (e.g., sec) VPN Layer 2 (e.g., VPLS, VPWS) 7

8 Layer2 Vs Layer3 VPN Type of customer payload carried by the Virtual Tunnel Layer3 VPN provides BGP / backbone connectivity: The Layer3 approach to create an /-based VPN offers a routed solution: completely based on Ipv4 address scheme scalable The DE FACTO standard is described in RFC4364 (February 2006) Layer2 VPN provides a native Layer 2 backbone connectivity: The Layer2 approach: offers an encapsulation methods to transport Layer 2 Frames Over Networks. It p: provides a optimization between the Provider s and Customer s network allows PEs to offer services that are INDENDENT of Layer3 protocols The RFC/Draft for describing the establishment of point-to-point connectivity in Layer2 VPN is described in RFC 4906 VPLS provides an L2/L3 Hybrid connectivity: The Virtual Private LAN Service offers an hybrid connectivity based on: Provider-Customer VLAN (Virtual LAN) association on access network BGP / connectivity in the 8

9 CE Vs PE Based Type of endpoint (Location) of the tunnel VPN Customer Edges (CE) are maintained by Customers Customer is responsible for its endpoint Routers maintenance Routing Protocol s configuration VRF s configuration its own security For example: VPLS belongs natively to this category VPN Provider Edge (PE) are maintained by Service Providers Service Provider is responsible for all domain endpoints and must be able to configure all Edge Routers maintain the router provide advanced services operate on point-to-point Security (sec PE-based) For example: VPN L3 belongs natively to this category The Customer network is completely VPN unaware 9

10 BGP / VPN. A choice RFC4364 defines an emerging standard commonly named VPN or more exactly BGP/ VPN Service providers that offer Layer 3 VPN services can take advantage of new, advanced features L3 VPN services allow businesses to outsource their current network core using a private -based service offering from an SP. the most common deployment is an any-to-any topology where any customer device can connect directly to the L3 VPN. Enterprise traffic entering the SP domain is then routed based on the information in the VRF table and encapsulated with labels to ensure proper tunneling and de-multiplexing through the core. The main three steps for the establishment of a VPN over an / backbone: 1. Routing Instance Configuration (VRFs Table and Policy) 2. BGP-MP (MultiProtocol) configuration (it carry VRFs table Among PEs) 3. Configuration 10

11 Private Instances of Routing (Step-1) The Virtual Tunnel Connection is based on Ad-hoc forwarding table called VRF The Address space used by VRF is composed by Prefix Route Distinguisher (RD) Different forwarding table are distinguished by Route Target (RT) Each VPN has its own address space A given address may denote different system in different VPN A given address may denote same system in different VPN (unique address) A new Address Space : VPN - v4 Family 4Byte (Standard Prefix) + 8Byte (Route Distinguisher (RD)) Type Provider s AS Assigned Number 11

12 Private Instances of Routing (Step-1) Full Scenario Key Firewall 12

13 Private Instances of Routing (Step-1) Populate VRF Tables CE Routing Tables CE Routing Tables OSPF OSPF RSVP RSVP BGP-MP BGP-MP Enterprises CE Routing Tables OSPF Domain VRF table for VPN 1 VRF table for VPN 2 VRF table For VPN 3 There are three methods to populate the VRF Statically (by manually configuration) or R OSPF BGP 13

14 Private Instances of Routing (Step-1) Customer Network pkt Customer Network Customer Network Customer Network At Least a VRF Table for Each Attachment Circuit Eventually different VRF for each VPN Routing and Forwarding pkt Label Label VPN pkt 1. Identify VPN VRFs Tables 2. Select VRF entry for this VPN 5. Send out The Route Target is used to distinguish different VRF tables PE Router Composes The Labeled Frame 3. Attach label info Label Label VPN 4. Attach VPN label info pkt 14

15 Private Instances of Routing (Step-1) Label Switched Path PE COMPOSES the packets PE DECOMPOSES the packets Label VPN Label VPN VPN Site VPN Site The Core Routers Are Completely UNAWARE of the label VPN -TAG 15

16 Private Instances of Routing (Step-1) Routers PE Configuration <routing-instances> <instance> <name> <name> vpn-abc </name> <instance-type> VRF VRF </instance-type> <interface> fe-0/3/1.0 </interface> <route-distinguisher> :RD </route-distinguisher> </instance> </routing-instances> Config FIRST the name of routing instance SECOND the type of routing instance THIRD the name of Juniper physical interface FOURTH the VPN v4 family Address 16

17 BGP Multi Protocol (Step-2) Full Scenario Key Firewall 17

18 BGP Multi Protocol (Step-2) Routers PE Configuration <bgp> <bgp> <local-address> </local-address> <local-as> AS AS </local-as> <group> <name>1-2-3</name> <type>internal</type> <neighbor> <name>edge-1</name> <local-address> </local-address> <name>edge-3</name> <local-address> </local-address> RouterId = BGP Group A-B-C Neighbour Neighbour Config VRFs Tables are EXCHANGED FIRST the name of the Local Address of PE SECOND the Autonomous System THIRD the name of BGP group FOURTH the List of the neighbors RouterId = BGP Group A-B-C Neighbour Neighbour RouterId = BGP Group A-B-C Neighbour Neighbour

19 BGP Multi Protocol (Step-2) Routers Route-Reflector Route REFLECTOR RR is a Designated Router RouterId = BGP Group A-B-C Neighbour Neighbour Config VRFs Tables are EXCHANGED RouterId = BGP Group A-B-C Neighbour Neighbour BGP is based over a full mesh refresh n(n-1)/2 Session e.g., 10 Routers 10*(10-1)/2 = 45 BGP Sessions BGP with RR (n-1)+(n-1) Session e.g., 10 Routers 9+9 = 18 BGP Sessions Route REFLECTOR RouterId = BGP Group A-B-C Neighbour Neighbour

20 (LSP-tunnelling) (Step-3) Full Scenario Key Firewall 20

21 (LSP-tunnelling) (Step-3) Config VPN Site Routers PE Configuration <mpls> <mpls> <label-switched-path> <name> <name> to-a to-a </name> <to> <to> </to> </to> <bandwidth> 30m 30m </bandwidth> <install> /24<active/> </install> </label-switched-path> </mpls> VPN Site CR 1 The FIRST the name of the LSP CR 2 Core Router The SECOND the Destination of LSP (EGRESS ROUTER) The THIRD the bandwidth reserved The FOURTH the set of activated CR 3 VPN Site 21

22 Benefits RFC4364 defines an emerging standard commonly named VPN or more exactly BGP/ VPN VPNs use overlapping Address Spaces (VPN v4 Family) Providers use existing protocols (BGP, RSVP, OSPF, ) Provider backbone s routers do not need to have any VPN routing information Providers can get good SLA and QoS support Customers are UNAWARE of (all the work is done by Service Provider) Customers are UNAWARE of security policy Customers are UNAWARE of connectivity and routing VPN management 22

23 Drawback RFC4364 defines an emerging standard commonly named VPN or more exactly BGP/ VPN only L3 VPNs transport only v4 traffic. Non- protocols need to be tunneled through some mechanism (such as GRE) on the CE or C devices The customer is dependent on the SP in regards to Layer 3 features and capabilities Layer 3-based convergence and QoS capabilities are also dependent on the SP offering, and SLAs must be negotiated to manage these requirements Possible difficulties in integration The difficulty of integration from Layer 2 to Layer 3 peering varies greatly depending on the SP offering. If the SP does not offer some service, integration with a different routing protocol, such as ebgp, might require 23

24 VPN Multi-Domain Two sites of a VPN are connected to a different AUTONOMUS SYSTEM (AS) There are 2 methods to implement this features : VRF-to-VRF EBGP (External BGP) AS 2 Directly Connection AS 1 AS 3 Between PE External BGP Protocol 24

25 QoS and Scalability The BGP/ VPN provides Quality of Service (QoS): reserves bandwidth using RSVP Policy used in PE router grooms selected Address over a reserved LSP The BGP/ VPN presents a good scalability: Route Reflector produces less BGP sessions Two levels of labels keep P Routers free of all the VPN routing information PE routers maintain routes information only for VPNs whose sites are directly connected 25

26 References IANA Consideration (Internet Assigned Number Authority) IANA has created a new registry for the Route Distinguisher Type Field Rosen, E., Rekhter, Y., BGP/ Virtual Private Network, RFC 4364 Mertz, C., The Latest in Virtual Private Network, Part I&II, IEEE Internet Computing, June 2004; available at Daugherty, B., and Mertz, C., Multiprotocol Label Switching And, Part I, IEEE Internet Computing, June 2005; available at JUNOS software documentation for M-series and T-series platforms, available at 26