A Review Paper on MPLS VPN Architecture
Total Page:16
File Type:pdf, Size:1020Kb
International Journal of Engineering Technology, Management and Applied Sciences www.ijetmas.com May 2015, Volume 3, Issue 5, ISSN 2349-4476 A Review Paper on MPLS VPN Architecture Tejender Singh Rawat1, Manoj Kumar Pandey2, *Upendra Kumar3 1, 2, 3 - Assistant Professor, ECE Department, ASET, Amity University Haryana Abstract A Virtual Private Network (VPN) provides private network connections over a publicly accessible shared network like internet, instead of using leased lines. A number of VPN technologies have been outlined, among which IPSec VPN and SSL VPN are the most commonly used. In this paper we will discuss the integration of Virtual Private Network (VPN) with other technology like MPLS (i.e. Multiprotocol Label Switching). This integration of MPLS with VPN has been receiving much attention from industries and standards bodies as it enables service providers to provide IP services with key benefits like qos, traffic engineering and optimal routing over a shared MPLS backbone. This paper will focus on the integration of providing VPN services in an MPLS environment. 1. Introduction The IP-based VPN technology is rapidly becoming the foundation for the delivery of future Internet services and many service providers are offering value-added applications on top of their VPN transport networks [1]. Using MPLS, the service providers can deliver the IP VPN services that businesses demand across either switched or routed networks [2, 3]. MPLS is the enabling technology that protects today's rapidly growing VPN revenue sources, while paving the way for tomorrow's value added services portfolio [4]. This paper provides an overview of the MPLS VPN technology and compares it with other types of VPN. An implementation of VRF over MPLS using MP-BGP [5] protocol is presented that discusses the key benefits of MPLS-VPN. 2. VPN Structure or Models A virtual private network (VPN) can be defined loosely as a network in which customer connectivity amongs the multiple sites is deployed on a shared infrastructure that utilizes the same security, management, and qos policies that are applied in a private network. VPN services can be offered based on two major paradigms: 1. Overlay VPNs, whereby the service provider furnishes virtual point-to-point links between customer sites. 2. Peer-to-Peer VPNs, whereby the service provider participates in customer routing. 2.1. The overlay model: Tunnel-based VPNs The traditional approach for service providers has been to provide Tunnel-based managed VPN service, by setting up secure, end-to-end connections, often emulating leased lines or virtual circuits, over public networks, according to the “overlay” model. A tunnel has two end points where the security service is both negotiated and rendered. Tunnels can exist at several protocol layers. 2.1.1 Layer 2 tunnels. They carry point-to-point data link connections between tunnel endpoints in remote access VPN. Two layer 2 tunneling protocols are commonly used today. The Point to-Point Tunnel Protocol (PPTP) [6] provides authenticated and encrypted access from Windows desktops to Microsoft or third-party remote access servers with a double encapsulation of the network layer datagram with PPP and a modified version of generic routing encapsulation (GRE) [7]. The IETF standard Layer 2 Tunneling Protocol (L2TP) [8] also provides authenticated tunneling by creating 32 Tejender Singh Rawat, Manoj Kumar Pandey, Upendra Kumar International Journal of Engineering Technology, Management and Applied Sciences www.ijetmas.com May 2015, Volume 3, Issue 5, ISSN 2349-4476 Layer 2 tunnels across a variety of networks (e.g. IP, ATM). Recently, Cisco has pioneered the new L2TPv3 protocol, based on optimized extensions to L2TP standard that includes signaling enhancements, a new encapsulation header, and a protocol identifier to support the end-to-end transportation of multiple Layer 2 protocols such as ATM and Ethernet. 2.1.2. Layer 3 tunnels. They provide IP-based virtual connection and in this approach normal IP packets are routed between tunnel endpoints that are separated by any intervening network topology. These facilities are now provided by the IPSec protocol suite. IPSec provides three basic communication necessities: confidentiality, secure communications and authentication and data integrity and between parties. At the core of the IPSec architecture [9] is the concept of security association (SA), specifying security services that should be applied to the traffic. The IKE (Internet Key Exchange) Protocol enables the automatic negotiation of SAs between two IPSec entities. Data security and integrity are provided with many encryption/hashing algorithms (e.g. MD5, SHA1 and 3DES). 2.2. The peer model: Network-Based VPNs. As said before, the peer model is based on a Layer 3 connectionless architecture offering the advantages of a highly scalable VPN solution in which some or all VPN capabilities are deployed within the service provider's network. A customer site is required to "peer" with only one router located at the service provider's points of presence (POPs), as opposed to all other VPN terminators or customer routers in the same VPN. Actually the most promising approach to “peer model” VPN is based on the Multi-Protocol Label Switching (MPLS) technology that is rapidly emerging as a core technology for next generation networks, in particular optical networks. MPLS is essentially a hybrid routing and forwarding strategy, streamlining the backbone switching of IP packets between the network (Layer 3) and transport (Layer 2) mainly focused on improving Internet scalability through better Traffic Engineering practices and qos provisioning. 2.2.1. Layer 3 (or IP-based) MPLS VPNs. It leverages the BGP routing protocol already in use at the edge of ISP networks to propagate MPLS VPN information across the network. In more detail, MPLS is used to forward packets while BGP is used to distribute VPN routes over the backbone. The information about MPLS VPNs can be propagated via BGP on the Internet's backbone routers between different ISPs and Autonomous Systems by encoding customer IPv4 address prefixes into unique VPN-IPv4 NLRIs (Network layer reachability information). In this context, an NLRI is a prefix associated to a VPN route. Furthermore, through the use of the Extended BGP community attribute, the PE routers are able to control the distribution of these routes within the MPLS-VPN domain and between different AS. The interior of an MPLS VPN network is made up of MPLS-aware provider (P) router devices forming the MPLS core that are not directly connect to any VPN terminating router. Provider edge (PE) routers that surround the core devices enable the VPN functions of an MPLS VPN network. MPLS core and PE routers work as label switch routers (LSR) that are devices capable of switching packets based on their MPLS-imposed labels. The VPN-terminating router is referred to as a customer edge router (CE) and thus a VPN consists of a group of CE routers connected to the MPLS backbone PE routers [11]. Only the PE routers are aware of the VPN. The CE routers are not aware of the underlying network and perceive that they are connected via a true private network. Each RFC2547 MPLS VPN is associated with a VPN routing/forwarding instance (VRF). A VRF defines the VPN membership of a customer site attached to a PE router. 33 Tejender Singh Rawat, Manoj Kumar Pandey, Upendra Kumar International Journal of Engineering Technology, Management and Applied Sciences www.ijetmas.com May 2015, Volume 3, Issue 5, ISSN 2349-4476 A separate set of routing and forwarding tables is maintained for each VRF preventing information from being forwarded outside a VPN and also preventing packets that are outside a VPN from being forwarded to a router within the VPN. This is the mechanism that allows the VPN traffic to be kept in separate contexts. Within each VPN, there is any-to-any connectivity: each site can send IP packets directly to any other site in the VPN, without having to go through a central site. In an MPLS VPN, the customer sites run ordinary IP. They do not need to run MPLS, IPSec or any other special VPN functions. A route distinguisher (RD) identifies each individual VPN. It is used to prefix the IP addresses involved in the different VPNs giving us a way to tell duplicate private addresses apart, to distinguish them. The RD is configured at the PE router as part of the VPN setup and is not visible to the customer. MPLS-VPN enforces traffic separation between customers because forwarding within the MPLS backbone is based on stacked labels. The MPLS LSPs setup begins and terminates at the PE routers while the CE routers perform normal routing. The incoming interface on the PE is used to determine which forwarding table to use when handling a packet because each incoming interface on a PE router is associated with a particular VPN. 2.2.2 Layer 2 MPLS VPN. AToM is a framework for encapsulating and transporting Layer 2 frames across the MPLS network, fully supporting Layer 2 services such as ATM VPNs, while aggregating and integrating transport technologies and taking advantage of proven MPLS quality of service (QoS) and scalability. It can transport ATM AAL5, Ethernet, Frame Relay, PPP, and Cisco HDLC packets. Currently, AToM only provides "like-to-like" transfers across the IP/MPLS backbone not allowing any kind of interworking between distinct layer 2 technologies. Actually, the ATOM technology is still under definition/development and not yet matures for performance analysis, so the layer 2 VPN paradigm will not be exploited in our evaluation. 3. VPN performance and scalability Issues The operational challenge of managing many separate highly meshed VPNs has served to highlight the performance and scalability limitations of traditional VPN technology based on the overlay model.