A virtual private network (VPN) is a secure virtual connection over shared infrastructure. It connects geographically separated LANs so they can communicate and share resources as one network, often across a service provider or the public internet. section 16.0 section 16.1.2
MPLS VPNs separate customer traffic with labels and provide two principal service models:
- MPLS Layer 2 VPNs make the provider network transparent to customer-edge routers, forwarding frames like a giant switch. Customer routers form routing-protocol neighbor relationships across the service. section 16.1.2
- MPLS Layer 3 VPNs make provider-edge routers participate in routing. Customer-edge routers form dynamic routing-protocol neighbor relationships with provider-edge routers. section 16.4 section 16.1.2
Customer-edge routers send ordinary IP packets and do not participate directly in MPLS. Provider-edge routers assign and remove labels, while internal provider routers forward labeled packets. Labels isolate customers sharing the same MPLS infrastructure. section 16.1.2
Distributed enterprise sites
A multinational corporation can connect headquarters, manufacturing facilities, and regional offices; a retail chain can integrate stores with centralized inventory, monitoring, and analytics systems. section 16.0
Figure 16.5 Two customers connect their remote sites using a service provider’s MPLS L2VPN service. PE and P routers are not shown.
Visualizes customer sites connected through an MPLS Layer 2 VPN, where the provider network forwards frames between customer-edge routers. section 16.1.2
Figure 16.6 Two customers connect their remote sites using a service provider’s MPLS L3VPN service. CE routers form dynamic routing protocol neighbor relationships with PE routers.
Visualizes an MPLS Layer 3 VPN, where customer-edge routers exchange routing information with provider-edge routers. section 16.4
