Principle and Construction of MPLS VPN

[Acalapati]

Hi all,

Traditional VPN typically based on ATM / DDN / FR-line, with the large-scale deployment of IP networks and ATM technology decline, in the IP Internet provide VPN service is considered a very economical way, with the emergence of MPLS technology , based on MPLS VPN technology is developing rapidly and has been commercially available. I wabt to know that Principle and Construction of MPLS VPN. Please update. Thanks in advance.

[Steve123]

MPLS routers only support structure and the traditional route hop-by-router structure is different, MPLS label switching router in (LSR) structure, solid line for the traditional router part, dashed line for the increase in part of the LSR, LSR is divided into modules and forwarding the routing module, routing module may be OSPF routing protocol, or IS-IS, they can also be extended based on traffic engineering, MPLS signaling could be RSVP or CR-LDP, Label packet forwarding module according to the label forwarding table in exchange for labels, IP forwarding for traditional third layer-by-hop routing to find. MPLS commonly used topology-driven approach, the router according to the routing table entry to create a LSP. Check and reply.

[Shen]

MPLS VPN in the router there are three: P routers, PE routers and CE routers. P router for carrier backbone routers, VPN group is responsible for the outer label switching; PE router for operators and boundary router, he stored VRF table and the global routing table, VRF stored in the VPN routing, global routing table stored in the operator's intra-domain routing; CE router for the client router, by the customer is responsible for maintenance. When the CE router to a VPN packet forwarding entry PE router, PE in the VPN router to find the corresponding VRF, a VPN from a VRF to get the export label and next hop address of PE routers, VPN label as the inner label to play in the VPN packet on the basis of exports of the next hop PE router's address can be found in the global routing table to reach the PE router should be marked with the label of the intra-domain routing, namely, the outer label, so VPN packets are marked with two layers of labels, backbone of the P VPN router to forward packets according to the outer tag. check and reply.

[Big Fish]

MP-iBGP protocol based on the MPLS VPN system, there are two levels of routing, namely, routing and VPN routing domain. All the PE routers and the P router to run the backbone of the intra-domain routing (OSPF or IS-IS, etc.), the resulting routing table will trigger the establishment of LSP backbone network (topology-driven approach), through the CR-LDP or RSVP letters, etc. make the agreement to establish LSP, the label created for the VPN packet forwarding outer label switching. Check and reply.

[Zachary]

As Running MP-iBGP protocol between the PE routers must constitute a full-mesh network session (because of running iBGP routers can not forward received iBGP routing, such a mechanism for avoiding routing loops), so in large-scale network application scalability problem exists, the solution is to use route reflectors or routing domain joint, route reflector allows the router to forward received iBGP routes to avoid the full mesh of the conversation; can be combined with routing domain Routing Domain divided into multiple regions, so that only the router needs within the region constitute a full-mesh connectivity, reducing the area adjacent to the number of iBGP router, of course, the joint use of the routing domain to consider the planning of cross-domain connections. All the best.

[Big Fish]

As the VPN is huge and quite a number of VPN users reluctant to change their IPv4 addresses, it is necessary to allow different VPN clients use the same IPv4 address, the same for different VPN address, RD can be achieved with the reuse of IPv4 addresses. PE router through the MP-iBGP routing protocol circular site, it will also carry the routing RD, about IPv4 addresses into VPN-IPv4 addresses, PE router, the receipt of notice of the MP-iBGP route, it will view the route of the RD, then the VPN-IPv4 addresses into IPv4 addresses, the RD will address removed its import into the appropriate VRF. VPN has been isolated due to different VRF, so different from the same VPN in IPv4 addresses, will be imported in a different VRF. In the same VPN, the address must be unique; when the need for mutual communication between multiple VPN (for example, there is a public site), they are required to be in a number of VPN address is unique, this time over VPN can only use the same RD. All the best.