Cisco 3845 Software Guide - Page 784

Understanding MPLS VPNs Chapter 34 Configuring MPLS, MPLS VPN, MPLS OAM, and EoMPLS Understanding MPLS VPNs Using MPLS virtual private networks (VPNs) provides the capability to deploy and administer scalable Layer 3 VPN backbone services to business customers. A VPN is a secure IP-based network that shares resources on one or more physical networks. A VPN contains geographically dispersed sites that can communicate securely over a shared backbone. VPN routes are distributed over the MPLS network by using multiprotocol BGP (MP-BGP), which also distributes the labels associated with each VPN route. MPLS VPN depends on VPN routing and forwarding (VRF) support to isolate the routing domains from each other. When routes are learned over an MPLS VPN, the switch learns the new route as a normal VRF route, except that the destination MAC address for the next hop is not the real address, but a specially formed address that contains an identifier that is allocated for the route. When an MPLS-VPN packet is received on a port, the switch looks up the labels in the routing table to determine what to do with the packet. Each VPN is associated with one or more VPN VRF instances. A VRF includes routing and forwarding tables and rules that define the VPN membership of customer devices attached to the customer-edge (CE) device. A customer site can be a member of multiple VPNs; however, a site can associate with only one VRF. A VRF has these elements: • An IP routing table • A Cisco Express Forwarding table • A set of interfaces that use the forwarding table • A set of rules and routing protocol parameters to control the information in the routing tables A customer-site VRF contains all the routes available to the site from the VPNs to which it belongs. VPN routing information is stored in the IP routing table and the Cisco Express Forwarding table for each VRF. A separate set of tables is maintained for each VRF, which prevents information from being forwarded outside a VPN and prevents packets that are outside a VPN from being forwarded to a router within the VPN. Based on the routing information stored in the VRF IP routing table and the VRF Cisco Express Forwarding table, packets are forwarded to their destinations. A provider-edge router binds a label to each customer prefix that is learned from a CE device and includes the label in the network reachability information for the prefix that it advertises to other (PE) routers. When a PE router forwards a packet that is received from a CE device across the provider network, it labels the packet with the label learned from the destination PE router. When the destination PE router receives the labeled packet, it examines the label and uses it to direct the packet to the correct CE device. A customer data-packet carries two levels of labels when traversing the backbone: • The top label directs the packet to the correct PE router. • The second label defines how that PE router should forward the packet to the CE device. VPN Benefits MPLS VPNs allow service providers to deploy scalable VPNs and build the foundation to deliver value-added services, including: • Connectionless service-MPLS VPNs are connectionless, which means that no prior action is required to establish communication between hosts. A connectionless VPN does not require tunnels and encryption for network privacy. • Centralized service-MPLS VPNs are seen as private intranets, which allows delivery of targeted IP services to a group of users represented by a VPN. 34-4 Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01