Implement VPN on MPLS

The concept of VPN service has been put forward for a long time. The Traditional VPN is a covered VPN service provided by telecom carriers on the transmission network. Telecom operators do not care about users' leased lines, what routing protocols are used at the upper layer, and how routes are routed. The advantage of using this leased line to build a VPN is security, but it is expensive and the line resources are wasted heavily. With the full spread of IP networks, operators began to try to provide cheaper VPN services under the pressure of competition. By providing an IP platform for users, users can use the Encapsulation Format of IPOverIP to tunnel over the public network, and also provide encryption and other security protection. The number of such VPN users on the current network is still quite large. However, this type of VPN service is not very satisfactory because of a lot of encryption work and the low forwarding efficiency of traditional Routers Based on the destination IP address headers.
The emergence of MPLS technology and the improvement of corresponding routing protocols provide us with another method to implement VPN. Next we will analyze how to implement VPN on MPLS.
Multi-Protocol Label Switched MPLS network 

MPLS networks consist of EdgeLSR, LSR, and LDP ).
The label distribution protocol is a protocol that defines the label between all label exchange devices in the MPLS network based on the in-network routing protocol. A tag is a field defined in a common data packet. Different physical networks are marked in different forms. The label distributes network-based topology instead of actual data packets. Meanwhile, the label is valid only locally on each link of the network. In a basic MPLS network, the label generally indicates the route information. But in an advanced MPLS network, different tags can also be used to indicate different service levels, different VPNs, or different forwarding paths.
Data packets in non-MPLS networks do not contain labeled information. Edge tag exchange routers are responsible for marking and removing packets at the edge of MPLS networks. When a data packet enters the MPLS network, the edge tag exchange router processes the data packet according to the network topology, and adds the packet to the MPLS network according to the tag defined by the label distribution protocol. When a packet leaves the MPLS network, the edge label switches the router to perform the opposite action, removing the packet label from the non-MPLS network.
A tag exchange router is a core device that forwards labeled data packets based on the tag exchange table calculated in advance by the tag distribution protocol. The tag exchange router only supports tag forwarding. Therefore, this device can be a vswitch or a vro. In an ATM network, the parameters VPI and VCI are marked as ATM. If an ATM switch supports the Label Distribution Protocol and forwards an ATM packet accordingly, it can also be used as a label exchange router for the MPLS network.
The MPLS network combines the layer-2 switching and layer-3 routing technologies, and combines the advantages of the switching network and the IP network to achieve the privacy and service level of the switching network, it can also achieve the flexibility and scalability of the IP network. On this basis, MPLS networks also bring more applications to carriers, including MPLSVPN L2 and L3), MPLS Traffic Engineering, and MPLS service levels.
Layer 2 passthrough -- AToM

AToM is built on the infrastructure of the MPLS network and provides high-speed Layer-2 passthrough between one pair of ports of the two routers. This technology can be used to provide two-layer VPN, or to upgrade the traditional network. AToM consists of a PE router, a label distribution protocol (LDP), and an MPLS Label Switching tunnel (LSPTunnel ). The PE router owns and maintains the layer-2 passthrough link information directly connected to it. The PE router is responsible for marking and removing the common packets of VPN customers. Therefore, the PE router must be an edge label exchange router.
The two ports that implement layer-2 passthrough between two PE routers must be of the same type, such as Ethernet, VLAN, ATMVC, Frame Relay VC, HDLC, or PPP. Each pair of such ports is represented by a unique virtual link mark VCID.
The LSP tunnel between the two PE routers must be defined to pass through the MPLS network. The LSP tunnel provides the tunnel mark TunnelLabel) and transmits data transparently between the two PE routers. At the same time, a direct tag Distribution Protocol process must be defined between two PE routers to transmit information about the virtual link. The most important thing is to distribute the virtual link tag VCLabel by matching the VCID ).
When a second-layer passthrough port has a packet entering the PE router, the PE router finds the corresponding tunnel mark and virtual link mark by matching the VCID. The PE router marks the packet with two layers, with the outer layer marked as the tunnel mark indicating the path from the PE router to the destination PE router. The inner layer marked as the virtual link mark, indicates the vro port corresponding to the VCID on the target PE router.
It is worth mentioning that the PE router needs to monitor the status of the Layer 2 protocol on its respective ports, such as frame transfer (LMS) or atm ilmi. When a fault occurs, the virtual link flag is canceled by marking the Distribution Protocol process, thus disconnecting the layer-2 passthrough to avoid one-way useless data flow.
This MPLS-based L2 passthrough method changes the limitations that traditional L2 links must implement through the switched network. It fundamentally forms a "One Network, multiple businesses" business model, this allows carriers to provide both layer-2 and layer-3 services in an MPLS network.
The layer-2 passthrough technology is based on the layer-2 VPN. Currently, the two-layer VPN standards are in the IETF drafting phase, mainly including the Virtual Private Line Service VPWS for point-to-point services) and virtual private LAN Service VPLS for multi-point services ). Both L2 VPNs adopt the AToM-based data layer and provide multiple functions such as automatic discovery and configuration at the control layer.
3 layer VPN--MPLSVPN

A layer-3 VPN is specially designed for VPN. It is built on the infrastructure of the MPLS network, that is, the VPN-aware network. The main components of a layer-3 VPN Network include PE router, P router, and Gateway Router Protocol BGP ).
The PE router owns and maintains the route information of the VPN directly connected to it. The PE router is responsible for marking and removing the common packets of VPN customers. Therefore, the PE router must be an edge label exchange router.
On a PE router, a virtual route forwarding table (VRF) is set for each VPN. Only route information of the VPN is processed. The PE router can use any dynamic routing protocol to exchange routing information with VPN users only through the Virtual route forwarding table ). At the same time, the PE router also has a global route table to maintain the route information required by the MPLS backbone network. Route forwarding tables are isolated from each other. Each port, including physical and logical, can belong to only one route forwarding table, ensuring the privacy of VPN users.
Each virtual route forwarding table uses a route differentiation RD) to distinguish between each other routing, 64-bit RD plus 32-bit common IP address constitute 96-bit all-network unique VPN-IPv4 address. In this way, the layer-3 VPN allows different VPNs to adopt the same IP address without affecting each other.
PE routers transmit MP-BGP addresses through the Multi-Protocol extended Gateway Routing Protocol VPN-IPv4 defined by RFC2283) while participating in the transfer are also the extended BGP attributes and VPN tags that correspond to the address. One of the extended BGP attributes is the route destination RT), which is used to control the inbound and outbound relationship between route information and the virtual route forwarding table. When a VPN user's data packet enters the PE router through any port, the PE router only calls the vro forwarding table corresponding to this port to process the data packet. The PE router marks the packet with two layers, with the outer layer marked as IGP, indicating the path from the PE router to the destination PE router, and the inner layer marked as VPN tag, indicates the information of the VPN to which the target PE router belongs.
The P router is a label exchange router of the MPLS network and is forwarded based on the label completely. Because the P router does not need to read the original data packet information to make the forwarding decision, the P router does not need to have the VPN route information, so the P router only participates in the backbone IGP route.
This three-layer VPN has fundamentally changed the traditional point-to-point VPN implementation mode. It uses the flexibility and diversity marked in the MPLS network, and uses each VPN as a logical network, attached to the MPLS backbone network, each user node can form a specific VPN network by simply joining or exiting.