04_03_介绍 MPLS VPN架构

2019年7月27日 06:34 作者：金淼淋分类：MPLS  661

MPLS VPN Technology
YES LAB
Introducing MPLS VPN
Architecture
fr%MPLS VPNÆ#J
YES LAB
wwwveslabnet Drawbacks of Traditional
Peer-to-Peer VPNs
— Shared PE router
All customers share the same
YES LAB
(provider-assigned or public) address space.
• High maintenance costs are associated with packet
• Performance is lower—each packet has to pass a packet
filter.
— Dedicated PE router
All customers share the same address space.
• Each customer requires a dedicated router at each POP. MPLS VPN Architecture:
Terminology
Remote
Office
Remote
Office
Customer A
Site #1
Site
CE Router
Customer A
Site #2
Customer
Site
Customer B
Site #1
PE Router
POP-X
P-Network
P Router
PE Route
POP-Y
Note:
PE Router = Edge LSR
P Router = LSR
YES LAB
Customer A
Site #4
Customer B
Site #2
Customer B
Site #3
Customer B
Site #4 Route Distinguishers (Cont
P-Netwqork
Customer A
PE-I
Customer B
YES LAB
A 64-bit RD is prepended to the
customer IPv4 prefix to make
it globally unique, resulting in a
96-bit VPNv4 prefix.
A 96-bit VPNv4 prefix is propagated
via MP-BGP to the other PE router.
96 >LVPNv4
fiffåffüMP-BGP
Customer A
Customer B
The CE router sends an IPv4 routing
update to the PE router.
CEN6 p E % PV4 o
wwwveslabnet Route Distinguishers (Cont
YES LAB
RDbkVPNv4åfJåå
# ff32
The RD is removed from the
VPNv4 prefix, resulting in a
32-bit IPv4 prefix.
P-Network
Customer A
PE-I
Customer B
The PE router sends the resulting
IPv4 prefix to the CE router.
IPv4ÉjfJåÉ0
PE-2
Customer A
Customer B RDs: Usage in an MPLS VP
YES LAB
— The RD has no special meaning.
— The RD is used only to make potentially
overlapping IPv4 addresses globally unique.
— The RD can not be used as a VPN
identifierRD8fiÉhlffvpNbkiR76
wwwveslabnet Example: Connectivity Requirem
YES LAB
VolP VPN
Central Site A
pop-x
VolP Gatewa
POP-Y
VolP Gateway
Central Site B
Customer A
Site A-I
Customer B
Site B-l
wwwveslabnet
Site A-2
Site B-2 RTs: Why Are They Neede
YES LAB
— Some sites have to participate in more than
one VPN.
— The RD cannot identify participation in more than one
VPN.
- UnkRDfrYYVPNfi(JlD,
— RTS were introduced in the MPLS VPN architecture to
support complex VPN topologies.
(GMPLS
A different method is needed in which a set of identifiers can be
attached to a route.
wwwveslabnet RTs: What Are They?
YES LAB
— RTS are additional attributes attached to VPNv4
BGP routes to indicate VPN membership.WlXßfi
— Extended BGP communities are used to encode
these attributes.ffhéfi(JBGP communities
— Any number of RTS can be attached to a single
route.
wwwveslabnet RTs: How Do They Work?
YES LAB
— Export RTs:
• Identifying VPN membership
• Appended to the customer route when it is converted
into a VPNv4 route
— Import RTs:
• Associated with each virtual routingtable
• Select routes to be inserted into the virtual routing
table
wwwveslabnet VPNs Redefined
YES LAB
•With the introduction of complex VPN topologies, VPNs
have had to be redefined:
— A VPN is a collection of sites sharin common routin
information. fi{J
— A site can be part of different VPNs.—+ji1h
+VPN
— A VPN can be seen as a community of interest
(closed user group). —
— Complex VPN topologies are supported by multi levirtual
routin tables on the PE routers.
wwwveslabnet