Supported Platforms
Understanding Using MPLS-Based Layer 2 and Layer 3 VPNs on EX Series Switches
On EX8200 and EX4500 switches, you can use MPLS-based Layer 2 and Layer 3 virtual private networks (VPNs) or MPLS Layer 2 circuits, allowing you to securely connect geographically diverse sites across an MPLS network. MPLS services can be used to connect various sites to a backbone network and to ensure better performance for low-latency applications such as voice over IP (VoIP) and other business-critical functions.
A VPN uses a public telecommunications infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization’s network. VPNs are designed to provide the same level of performance and security as privately owned or leased networks but without the attendant costs.
This topic describes:
MPLS-Based Layer 2 VPNs
In an MPLS-based Layer 2 VPN, traffic is forwarded by the customer’s customer edge (CE) switch (or router) to the service provider’s provider edge (PE) switch in a Layer 2 format. It is carried by MPLS over the service provider’s network and then converted back to Layer 2 format at the receiving site.
On a Layer 2 VPN, routing occurs on the customer’s switches, typically on the CE switch. The CE switch connected to a service provider on a Layer 2 VPN must select the appropriate circuit on which to send traffic. The PE switch receiving the traffic sends it across the service provider’s network to the PE switch connected to the receiving site. The PE switches do not store or process the customer’s routes; the switches must be configured to send data to the appropriate tunnel.
For a Layer 2 VPN, customers must configure their own switches to carry all Layer 3 traffic. The service provider must detect only how much traffic the Layer 2 VPN will need to carry. The service provider’s switches carry traffic between the customer’s sites using Layer 2 VPN interfaces. The VPN topology is determined by policies configured on the PE switches.
Customers must know only which VPN interfaces connect to which of their own sites. Figure 1 illustrates a full-mesh Layer 2 VPN in which each site has a VPN interface linked to each of the other customer sites. In a full-mesh topology between all three sites, each site requires two logical interfaces (one for each of the other CE routers or switches), although only one physical link is needed to connect each PE switch to each CE router or switch.
Figure 1: Layer 2 VPN Connecting CE Switches
Layer 2 Circuits
A Layer 2 circuit is a point-to-point Layer 2 connection that uses MPLS or another tunneling technology on the service provider’s network. A Layer 2 circuit is similar to a circuit cross-connect (CCC), except that multiple Layer 2 circuits can be transported over a single label-switched path (LSP) tunnel between two provider edge (PE) switches. In contrast, each CCC requires a dedicated LSP.
The Junos OS implementation of Layer 2 circuits supports only the remote form of a Layer 2 circuit; that is, a connection from a local customer edge (CE) switch to a remote CE switch.
Packets are sent to the remote CE switch by means of an egress virtual private network (VPN) label advertised by the remote PE switch. The VPN label transits over either an RSVP or an LDP LSP (or other type) tunnel to the remote PE switch connected to the remote CE switch. LDP is the signaling protocol used for advertising VPN labels.
Return traffic sent from the remote CE switch to the local CE switch uses an ingress VPN label advertised by the local PE switch.
MPLS-Based Layer 3 VPNs
In a Layer 3 VPN, the routing occurs on the service provider’s routers. Therefore, Layer 3 VPNs require more configuration on the part of the service provider, because the service provider’s PE routers must store and process the customer’s routes.
In the Junos OS, Layer 3 VPNs are based on RFC 4364, BGP/MPLS IP Virtual Private Networks. This RFC defines a mechanism by which service providers can use their IP backbones to provide Layer 3 VPN services to their customers. The sites that make up a Layer 3 VPN are connected over a provider’s existing public Internet backbone.
VPNs based on RFC 4364 are also known as BGP/MPLS VPNs because BGP is used to distribute VPN routing information across the provider’s backbone, and MPLS is used to forward VPN traffic across the backbone to remote VPN sites.
Customer networks, because they are private, can use either public addresses or private addresses, as defined in RFC 1918, Address Allocation for Private Internets. When customer networks that use private addresses connect to the public Internet infrastructure, the private addresses might overlap with the private addresses used by other network users. BGP/MPLS VPNs solve this problem by prefixing a VPN identifier to each address from a particular VPN site, thereby creating an address that is unique both within the VPN and within the public Internet.
In addition, each VPN has its own VPN-specific routing table that contains the routing information for that VPN only. Two different VPNs can use overlapping addresses. Each route within a VPN is assigned an MPLS label (for example, MPLS-ARCH, MPLS-BGP, or MPLS-ENCAPS). When BGP distributes a VPN route, it also distributes an MPLS label for that route. Before a customer data packet travels across the service provider’s backbone, it is encapsulated along with the MPLS label that corresponds to the route within the customer’s VPN that is the best match based on the packet’s destination address. This MPLS packet is further encapsulated with another MPLS label or with an IP, so that it gets tunneled across the backbone to the egress provider edge (PE) switch. Thus, the backbone core switches do not need to know the VPN routes.
Comparing an MPLS-Based Layer 2 VPN and an MPLS-Based Layer 3 VPN
The differences between Layer 2 VPNs and Laer 3 VPNS are summarized in Table 1
Table 1: Comparing an MPLS-Based Layer 2 VPN and an MPLS-Based Layer 3 VPN
| Layer 2 VPN | Layer 3 VPN |
|---|---|
Customer sites appear to be on the same LAN even if geographically dispersed. | Service provider’s technical expertise ensures efficient site-to-site routing. Service providers can provide additional value-added services through network convergence that encompasses voice, video, and data. |
The service provider does not require information about the customer’s network topology, policies, routing information, etc. The customer has complete control over policies and routing. | Customers must share information about their network topology. The service provider determines the policies and routing. |
The CE switch forwards traffic to the service provider’s PE switch in Layer 2 format. | The customer’s CE switch must be configured to use BGP or OSPF to communicate with the service provider’s PE switch to carry IP prefixes across the network. Other protocol packets are not supported. |
