MPLS-based Layer 2 VPNs. Kireeti Kompella Juniper Networks

Transcription

1 MPLS-based Layer 2 VPNs Kireeti Kompella Juniper Networks

2 Agenda! Introduction " Traditional Layer 2 VPNs " MPLS-based Layer 2 VPNs " Layer 3 VPNs! Details " Provisioning " Transport " Carrying non-address information 17/01/01 Juniper Networks, Inc. Copyright

3 Co-Authors! Service Providers " Javier Achirica " Ronald Bonica " Chris Liljenstolpe " Eduard Metz! Vendors " Manoj Leelanivas " Chandramouli Sargor " Vijay Srinivasan " Quaizar Vohra 17/01/01 Juniper Networks, Inc. Copyright

4 Traditional (Layer 2) VPNs Router Frame Relay/ ATM Switch 17/01/01 Juniper Networks, Inc. Copyright

5 Traditional (Layer 2) VPNs! Provider network technology dictated by VPN services " Frame switches? ATM switches?! Provisioning complex for provider! Topology dictated by cost rather than traffic patterns! Multiple networks adds to provider s administrative burden 17/01/01 Juniper Networks, Inc. Copyright

6 MPLS-Based Layer 2 VPNs! Traditional Layer 2 VPN from customer s point-of-view " Layer 3 independent " Provider not responsible for routing! MPLS transport in provider network " Isolation between edge and core technologies! Auto-provisioning VPN! Single network architecture for both Internet traffic and VPN traffic 17/01/01 Juniper Networks, Inc. Copyright

7 MPLS-Based Layer 2 VPNs Router CE A CE B CE C PE 1 PE 2 PE 3 PE 4 CE G CE F CE E CE D 17/01/01 Juniper Networks, Inc. Copyright

8 Privacy Security! Encryption is a must if you want security! Where s the weak point?! CE-to-CE " Use IPSec! " Not PP VPN! PE-to-PE " Per VPN " Per PE-to-PE session 17/01/01 Juniper Networks, Inc. Copyright

9 Layer 3 VPNs! SP participates in customers routing " Out-sourced routing " Added SP responsibilities " Value-added service ~ cost structure! BGP MPLS VPNs " QoS/CoS, Carrier of Carriers, inter-sp VPNs! Virtual routers! Migration may take some work 17/01/01 Juniper Networks, Inc. Copyright

10 Provisioning the Network! PE-to-PE MPLS LSPs " Key: signaling " LDP LSPs " RSVP-TE LSPs " LDP over RSVP tunneling!fully-meshed Traffic Engineered core! Edge-to-edge LDP LSPs! Used for all services IP, L2 VPNs, L3 VPNs, differentiated services! Provisioned independent of Layer 2 VPNs! 17/01/01 Juniper Networks, Inc. Copyright

11 Provisioning a VPN! Key: signaling " Auto-discovery of members, auto-assignment of inter-member circuits " Flexible VPN topology " Signaling using LDP or BGP! O(N) configuration for the whole VPN " Could be more for complex topologies! O(1) configuration to add a site " Overprovision DLCIs at customer sites 17/01/01 Juniper Networks, Inc. Copyright

12 Provisioning Customer Sites! List of DLCIs, one for each other site, some spare (over-provisioning)! DLCIs independently numbered at each site! LMI, inverse ARP and/or routing protocols for auto-discovery and learning addresses! No changes as VPN membership changes (until over-provisioning runs out) 17/01/01 Juniper Networks, Inc. Copyright

13 VPN Transport Router CE A CE B CE C PE 1 PE 2 PE 3 PE 4 CE G CE F CE E CE D 17/01/01 Juniper Networks, Inc. Copyright

14 VPN Transport CE list: G DLCI list: 53, 66 CE A CE B dlci 53 L1 /L2 77 CE list: - E - C DLCI list: 65, 77, 88, 94 dlci 94 PE 1 L1/L2 Label L2 to CE C Label L1 to PE 2 Label L2 to CE G Label L1 to PE 3 L1 /L2 to PE4/CE E Label L1 To PE 4 17/01/01 Juniper Networks, Inc. Copyright

15 Virtual Network CE B DLCI 94 DLCI 111 CE C DLCI 77 DLCI 89 DLCI 63 DLCI 101 CE E 17/01/01 Juniper Networks, Inc. Copyright

16 Signaling! Compact representation of mapping of layer 2 address to inner label! Signaling through either BGP or LDP! Arbitrary topologies possible; common ones such as full mesh and hub-and-spoke easy to configure 17/01/01 Juniper Networks, Inc. Copyright

17 Packet Format (1) Packet format from customer: <dlci><ui><proto><layer 3 packet> Remove DLCI; add two labels Packet format in network: <MPLS encap><outer label><inner label> <UI><proto><layer 3 packet> In the example, outer label = L1, inner = L2 17/01/01 Juniper Networks, Inc. Copyright

18 Packet Format (2) At destination PE: remove MPLS encap and label(s), add new DLCI to get: <dlci ><UI><proto><layer 3 packet>! Effectively, the SP network acts as a big Frame Relay switch for this VPN 17/01/01 Juniper Networks, Inc. Copyright

19 Non-address Information! What about F/B ECN, DE, C/R,? " Use experimental bits to carry this info " Can t squeeze 4 bits into 3, so use twice the number of labels if needed! Not for preferential treatment in the core! " For this, use MPLS with Diff-Serv " Different DLCIs mapped to different PE-to-PE LSPs (L-LSPs) or different EXP bits (E-LSPs) " DE/not DE mapped to different EXP bits 17/01/01 Juniper Networks, Inc. Copyright

20 Summary! MPLS-based Layer 2 VPNs identical to Layer 2 VPNs from customers perspective " Familiar paradigm " Easy to migrate! Benefits " Single network infrastructure " Auto-provisioning " Layer 3 and routing independent! Drawbacks " Layer 2 dependent 17/01/01 Juniper Networks, Inc. Copyright

21 Future Work! MPLS as layer 2 to CE " CE needs to be MPLS-aware! Secure MPLS! VLANs as layer 2 to CE! Carrier of carriers model, inter-sp VPNs! CoS support 17/01/01 Juniper Networks, Inc. Copyright

22 Thank you!