Introducción n a MPLS y MPLS VPN MPLS VPN

Transcription

1 Introducción n a MPLS y MPLS VPN Nelson Muñoz Presentation_ID 200, Cisco Systems, Inc. Agenda Introducción Que es una VPN? IP+ATM Conceptos básicos de MPLS MPLS VPN QoS en MPLS Ventajas de las VPN MPLS 2 Presentation_ID.scr

2 Market Drivers for IP-VPN s Platform Independence Immediate User Competence Dominance of IP Protocol Voice Data 0000 Video Universal Access Telecommuters & Mobile Users Small /Medium & Large Sites Customers/Partners & Public Reduced Capital and Operational Costs Reduced Application Development Time JAN FEB MAR APR MAY JUN JUL 3 Virtual Private Network Services Definition Access VPN Enterprise access Wholesale Intranet VPN Branch offices Extranet VPN Business-to-business Industry groups Service Provider Shared Network VPN Internet, IP, IPsec FR, ATM, MPLS Customer communities deployed on a shared infrastructure with the same policies as a private network 4 Presentation_ID.scr 2

3 Access Enterprise Access VPN Internet Intranet WAN Router VPN Concentrator Wireless HFC DSL Dial ISDN Cable Internet Firewall Appliance Core Site Enterprise WAN Remote Sites 5 Intranet VPN Enterprise Intranet/Extranet VPN Internet Intranet Integrated VPN router w/ BB Access WAN Router VPN Router VPN Access Broadband Access Firewall Appliance Company A Remote Site Extranet VPN Internet Company A Core Site Company B VPN Router Firewall Appliance 6 Presentation_ID.scr 3

4 IP VPN Taxonomy IP VPNs DIAL DEDICATED Client- Initiated NAS- Initiated IP Tunnel Virtual Circuit Network- Based VPNs Security Appliance Router FR ATM RFC 2547 Virtual Router 7 New Applications for VPN 80% VPN Types Implemented by % 40% 73% 64% 20% 0% Individual Remote Access Source: Infonetics April 2000 Site-to-site 27% Extranets 8 Presentation_ID.scr 4

5 Advantages to sourcing IP-VPNs There are multiple reasons for enterprise customers to choose outsourcing over in-house IT solutions Complexity of VPN technology Not enough staff or decrease expenses Want to increase employee productivity Want to improve VPN performance Focus company on core competencies Want to reduce costs of training IT staff Want to decrease hardware expenditures 59% 54% 53% 50% 47% 44% 39% Percent of sourcing Respondents Source: Infonetics April Enterprise Customer Benefits Reduced costs Universal access to IP-based services on global basis Adds, removes, and changes as needs evolve Access to expertise through outsourcing Focus on core competencies 0 Presentation_ID.scr 5

6 US VPN Spending 2500 Yankee Group Predictions for VPN Spending ($US Millions) Infonetics VPN Spend Projections ($US Millions) VPN Services VPN Products Business Perspective Businesses are building on IP Businesses need private IP services IP Intranet IP Extranet Remote Offices Customers Suppliers Partners Telecommuters Mobile Users 2 Presentation_ID.scr 6

7 Business IP: The Untapped Market 8 Connectivity Public IP Flexibility of IP; Privacy and QoS of Frame Relay Business IP ATM/ Frame Relay Privacy/QoS 8 3 The Barriers Carriers customers need IP services: They need connectionless IP services They need more flexible IP quality of service guarantees But they need more privacy than the Internet provides Frame Relay and ATM services are available: They provide connectionoriented service They have inflexible point-topoint bandwidth guarantees But they have good privacy 4 Presentation_ID.scr 7

8 MPLS: The First Complete IP Solution Leased Lines Any-to to-any Connectivity User N 2 Network N 2 QoS Privacy Low Cost Managed Services Frame Relay/ ATM N 2 (logical) N 2 (logical) IP N N MPLS N N MPLS is the first solution that delivers on all the requirements for new world private IP networks. 5 Three Key Technologies. Multiprotocol Label Switching (MPLS) MPLS allows carriers to offer carrier-class IP services on the same infrastructure as older, circuit & virtual circuit services 6 Presentation_ID.scr 8

9 Three Key Technologies 2. Standard IP Routing Protocols MPLS still relies on standard IP routing protocols for finding routes for traffic: Open Shortest Path First (OSPF) or Interior System to Interior System (IS-IS) inside a carrier or ISP network Border Gateway Protocol (BGP) between providers networks 7 Three Key Technologies = 3. Multiprotocol BGP and MPLS Virtual Private Networks The standard Multiprotocol Border Gateway Protocol (BGP) extends MPLS to provide Virtual Private Networks (VPNs). This means that a carrier can provide many private IP networks on one carrier network. 8 Presentation_ID.scr 9

10 Primera version: IP+ATM Presentation_ID 200, Cisco Systems, Inc. 9 Traditional IP over ATM Put routers around the edge of an ATM network Connect routers using Permanent Virtual Circuits This does not provide optimal integration of IP and ATM 20 Presentation_ID.scr 0

11 ATM MPLS MPLS adds IP Routing Control to an ATM Switch MPLS enables ATM switches to also act like routers - Fully support IP, along with Frame Relay and ATM, on shared ATM backbone - Provides optimal IP forwarding capability on an ATM network 2 IP over ATM Integration MPLS: Scalability MPLS gives routing scalability - Limited peerings between routers MPLS gives Internet routing scalability - Full BGP4 support, with all the extras 22 Presentation_ID.scr

12 IP over ATM Integration MPLS: IP Fundamentals MPLS puts IP services directly on ATM switches - ATM switches support IP protocols directly - Avoids complex translations which occur with MPOA Full support for IP CoS, RSVP, IP multicast, future IP services IP Multicast IP CoS RSVP 23 Aspectos Tecnicos de MPLS Presentation_ID 200, Cisco Systems, Inc. 24 Presentation_ID.scr 2

13 At Edge: Classify packets Label them Edge Label Switch Router (ATM Switch or Router) Label Distribution Protocol (LDP) MPLS Concept In Core: Forward using labels (as opposed to IP addr) Label indicates service class and destination Label Switch Router (LSR) Router Enable ATM switches to act as routers Create new IP capabilities via flexible classification ATM switch + Tag Switch Controller 25 MPLS Operation a. Existing routing protocols (e.g. OSPF, IS-IS) establish reachability to destination networks b. Label Distribution Protocol (LDP) establishes label to destination network mappings 4. Edge LSR at egress removes label and delivers packet 2. Ingress Edge LSR receives packet, performs Layer 3 value-added services, and labels packets 3. LSR switches packets using label swapping 26 Presentation_ID.scr 3

14 Non-ATM MPLS Example: Routing Information In Address Prefix I face In Address Prefix I face In Address Prefix I face You can reach and 7.69 through me You can reach through me You can reach 7.69 through me 7.69 (Example shows RIP updates for simplicity: OSPF or IS-IS are more likely. Routing tables for this network will be identical in any case.) 27 Non-ATM MPLS Example: Assigning Labels In Address Prefix I face In Address Prefix I face In Address Prefix I face Use label 4 for and Use label 5 for 7.69 Use label 9 for Label Distribution Protocol (LDP) (Downstream Allocation) Use label 7 for Presentation_ID.scr 4

15 Non-ATM MPLS Example: Forwarding Packets In Address Prefix I face In Address Prefix I face In Address Prefix I face Data Data Data Data Label Switch Forwards Based on Label Encapsulations ATM Cell Header GFC VPI VCI PTI CLP HEC DATA Label PPP Header (Packet over SONET/SDH) PPP Header Label Header Layer 3 Header LAN MAC Label Header MAC Header Label Header Layer 3 Header 30 Presentation_ID.scr 5

16 MPLS Labels Destination and Service Attributes Forwarding based on Labels Labels are applied at the edge of the Network Interoperability of ATM switches and IP routers Labels Indicates Service attributes without per-hop decisions: Label ATM Switch IP Router Data Service Class (QoS) Privacy (VPN) Traffic Engineering Provider MPLS Network 3 Key MPLS Capabilities RSVP IP Multicast IP CoS IP/ATM Integration Traffic Engineering VPN s 32 Presentation_ID.scr 6

17 Provider Provisioned VPNs Presentation_ID 200, Cisco Systems, Inc. 33 Service Provider Benefits of MPLS-Based VPNs VPN A VPN C VPN B VPN C VPN B Multicast Intranet Hosting VPN A VPN A VoIP Extranet VPN B VPN C VPN A VPN B VPN C Overlay VPN Pushes content outside the network Costs scale exponentially Transport dependent Groups endpoints, not groups Complex overlay with QoS, tunnels, IP MPLS-based VPNs Enables content hosting inside the network Flat cost curve Transport independent Easy grouping of users and services Enables QoS inside the VPNs 34 Presentation_ID.scr 7

18 Managed IP Services Scale to Large and Small Customers Separately engineered customer private IP networks Vs. Single carrier network supporting multiple customer IP VPNs BGP/MPLS VPN Network 35 Virtual Private Networks Separately engineered customer private IP networks Vs. Single carrier network supporting multiple customer IP VPNs Build once, Sell once Build once, Sell many BGP+ MPLS Network 36 Presentation_ID.scr 8

19 BGP/MPLS VPNs: Overview Customer sites are in many different Virtual Private Networks. They run ordinary IP, not MPLS or any special VPN functions. Customer sites run RIP, OSPF, BGP or static routing Customer sites are connected by Frame Relay, ATM, serial, PPP, ethernet, xdsl, etc. 37 BGP/MPLS VPNs: Overview 2 Network core runs ordinary MPLS Network core requires no knowledge or state for VPNs: highly scaleable Network core can be an ATM MPLS or router-based MPLS 38 Presentation_ID.scr 9

20 BGP/MPLS VPNs: Overview 3 Edge LSRs have an extra function, Provider Edge function, which deals with VPNs Provider Edge function is based on MPLS plus BGP v4 with Multiprotocol Extensions Multiprotocol BGP is a standards-track document from the IETF, RFC MPLS VPN Routing Architecture Privacy without tunnels VPN_A CE VPN_B CE VPN_A CE VPN_B CE PE PE P P P P PE PE VPN_A CE VPN_A CE Connectionless IP VPNs CE VPN_B Service Provider VPN Aware Network P router = Provider Router (Core LSR ) PE router = Provider Edge router (Edge LSR) knows which VPN each CE belongs to (by sub-interface) CE router = Customer Edge router RD (Route Distinguisher) = uniquely identify a VPN (AS#,VPN_ID) IPv4 Addresses are unique within VPN IPv4 Addresses might overlap across VPN s 40 Presentation_ID.scr 20

21 Si Si Si MPLS-Based IP-VPN Security Cisco MPLS-Based VPNs: Equivalent to the Security of Frame Relay and ATM. Miercom, March 30, Security 4 Validating Cisco MPLS-Based IP-VPN as a Secure Network Miercom Independent Testing Confirmed Cisco MPLS VPN Is Secure Customers network topology is not revealed to the outside world Customers can maintain own addressing plans and the freedom to use either public or private address space Attackers cannot gain access into VPNs or service provider s network Impossible for attacker to insert spoofed label into a Cisco MPLS network and thus gain access to a VPN or the MPLS core LONDON POS 2/0 GSR POS /0 POS / OC3 POS OC3 POS GLASCOW OXFORD POS / POS / POS 2/ OC3 POS SER 5/0:0 ATM /0 Ser 5/0:0 Ser 3/ DOVER POS 2// pvc / T FR OS PF SER /0/:0 T FR dlci T FR dlci 04 ebgp AS72 ATM/0 dlci 0 RIP v ATM2/0/0 OSPF SER /0: SER /0/0:0 Ser 0/ Ser T FR dlci 09 T FR RIP v2 pvc 0/ dlci 0 ebgp AS7 Static Ser 0 ATM/ BLUE-Glascow Ser /0 RED-Glascow BLUE-Oxford BLUE-Dover RED-Dover YELLOW-Oxford YELLOW-Dover Test Network Topology Security 42 Presentation_ID.scr 2

22 QoS en MPLS VPN Presentation_ID 200, Cisco Systems, Inc. 43 Application-Level QoS and Bandwidth Management Differentiated IP Services Real-time Applications Gold Guaranteed: Latency and Delivery Mission Critical, Interactive, Data Applications Traffic Classification Silver Guaranteed Delivery Best effort Data Applications Bronze Best-Effort Delivery Quality of Service 44 Presentation_ID.scr 22

23 Motivation Behind QoS Applications are sensitive to delay, jitter and packet loss There are non-adjustable components (e.g. propagation delay, switching delay, CRC errors) There are adjustable components associated with link congestion (buffering delay and packet loss) Some Congestion is likely in most networks Service provider can manage situation and offer value-added service 45 QoS Building Blocks How does a router implement different qualities of service? Classification Policing Marking Queuing & Dropping Shaping Identify and split traffic into different classes Discard misbehaving traffic to maintain network integrity Mark traffic if necessary Prioritize, protect and isolate traffic Control bursts and conform traffic 46 Presentation_ID.scr 23

24 Using the EXP Bits Diffserv Support Label EXP S TTL Copy of precedence into EXP Mapping of DSCP into EXP Non-MPLS Domain IPv4 Packet MPLS MPLS Domain Hdr Prec: xyz MPLS EXP: xyz Prec: xyz 47 Label-Inferred CoS Diffserv Support Label EXP S TTL DSCP/precedence to label mapping Prec: xyz IPv4 Packet Dest-CoS Label P/p CoS 7 P/p CoS2 22 P/p CoS3 25 P/p CoS Presentation_ID.scr 24

25 MPLS Traffic Engineering with QoS Traffic is routed using explicit and constrainbased routing Aggregate admission control against a particular bandwidth pool Packets are scheduled at every hop according to EXP marking regardless of LSP PE P P PE CE DiffServ DiffServ CE MPLS PE P P PE 49 Ventajas de las MPLS VPN Presentation_ID 200, Cisco Systems, Inc. 50 Presentation_ID.scr 25

26 Key Features No constraints on addressing plans used by VPNs A VPN customer may: Use globally unique and routable/non-routable addresses Use private addresses (RFC98) Security: Basic security is comparable to that provided by FR/ATM-based VPNs without requiring data encryption VPN customer may use IPSec-based mechanisms E.g., CE CE IPSec-based encryption 5 Key Features (Cont.) Quality of Service: Flexible and scaleable support for a CoS-based networks Scalability: Total capacity of the system isn t bounded by the capacity of an individual component Scale to virtually unlimited number of VPNs per VPN Service Provider and scale to thousands of sites per VPN 52 Presentation_ID.scr 26

27 Key Features (Cont.) Connectivity to the Internet: VPN service providers may also provide connectivity to the Internet to its VPN customers Common infrastructure is used for both VPN and the Internet connectivity services Simplifies operations and management for VPN service providers: No need for VPN service providers to set up and manage a separate backbone or virtual backbone for each VPN 53 BGP/MPLS VPN Summary Supports large scale VPN service Increases value add by the VPN service provider Decreases service provider cost of providing VPN services Mechanisms are general enough to enable VPN service provider to support a wide range of VPN customers 54 Presentation_ID.scr 27

28 MPLS as a Foundation for Value-Added Services Provider Provisioned VPNs Traffic Engineering IP+ATM IP+Optical GMPLS Any Transport over MPLS MPLS Network Infrastructure , Cisco Systems, Inc. 56 Presentation_ID.scr 28