Layer 2 VPNs

There is a broad taxonomy for Layer 2 transport consisting of the following components:

• L2 Transport Provides point-to-point Layer 2 connectivity.

• L2VPNs Use Layer 2 transport as a building block to build a Layer 2 VPN service that includes autoconfiguration, management, QoS, and so on. A concept of pseudowires to emulate a Layer 2 service is a key attribute for a Layer 2 VPN over MPLS.

• Virtual private wire service (VPWS) Has a characteristic of a fixed relationship between an attachment-virtual circuit and an emulated virtual circuit. VPWS-based services are point-to-point (for example, Frame-Relay/ATM/Ethernet services over IP/MPLS).

• Virtual private LAN switching service (VPLS) It's fundamentally an end-to-end service. It is "virtual" because multiple instances of this service share the same physical infrastructure; it is "private" because each instance of the service is independent and isolated from the others. It is "LAN service" because it tries to provide a multipoint connectivity among the participant endpoints that looks like a LAN. A dynamic relationship (learned) exists between an attachment-virtual circuit and emulated virtual circuits that is determined by customer MAC address. An example of a VPLS-based service is an Ethernet multipoint service.

• IP LAN services (IPLS) A service similar to VPLS, in that all LAN interfaces are implemented in promiscuous mode and frames are forwarded based on their MAC destination addresses. However, the maintenance of the MAC forwarding tables is done via signaling rather than via the MAC address learning procedures of IEEE 802.1D. Further, the Address Resolution Protocol (ARP) messages are proxied, rather than carried transparently. You could use routers and a single MAC address rather than the more complex bridging of customer LANs. IPLS is currently an IETF draft.

Figure 3-24 summarizes the Layer 2 taxonomy.

Figure 3-24. L2 VPN Service Taxonomy: VPWS and VPLS

A Layer 2 transport over MPLS is referred to as Any Transport over MPLS (AToM) by Cisco. Any transport over MPLS is required to support several services, such as Layer 2 transport over packet-based infrastructure. ATM and Frame Relay service is popular, and the provisioning of these services is easily understood. Currently, VPNs are built using either IPSec tunnels or PVCs with ATM or Frame Relay.

Layer 3 VPNs are available to offer branch office connectivity; however, this connectivity is limited to IP-based services and other protocols must be encapsulated in IP. First, encapsulating everything in IP might not always be possible. Second, service requirements, such as ATM cell transport, IGP trunking, and non-IP transport, are also needed. This trunking of Layer 2 frames can be done with Any Transport over MPLS in MPLS IP networks.

While deploying IP core, the trunking of Layer 2 can be considered because there might be existing revenue generating services for service providers or service providers might want to offer services similar to point-to-point virtual leased lines to their customers. Service providers are used to build Layer 2 services. These services are attractive in terms of revenue because the provider is not required to participate in any customer routing information. Because MPLS can transport both Layer 2 and Layer 3, it offers a viable alternative and convergence point for diverse infrastructures. Moreover, specific services, such as transparent LAN connectivity, extension of broadcast domain, virtual leased line, and voice trunking, can be easily built when AToM functionality is combined with MPLS QoS and traffic engineering.

An AToM overview is depicted in Figure 3-25.

Figure 3-25. Any Transport over MPLS (AToM)

Layer 2 transport options include Frame Relay, ATM AAL5 and ATM Cell Relay, Ethernet, 802.1q (VLAN), Packet Over Sonet (POS), TDM, and Cisco HDLC and PPP. The architectural elements of AToM consist of the following: a control connection performed by directed LDP, a transport component called a tunnel header or tunnel label, a tunnelling component that consists of a demultiplexer field or virtual circuit label, and a Layer 2 protocol data unit (PDU) that provides an emulated virtual circuit encapsulation via the control word attribute. Figure 3-26 summarizes the AToM architectural elements.

Figure 3-26. Layer 2 Transport Across MPLS

AToM is used for the point-to-point transport of Layer 2 PDUs across an MPLS-enabled core via directed LDP sessions to negotiate virtual circuit labels between participating peers. AToM can use a control word to preserve relevant information in transported PDUs (for instance, Frame Relay BECN, FECN, or DE). AToM can also interwork with native service management protocols, such as ILMI/LMI, to indicate the local circuit status to remote peers. Layer 2 service interworking enables the interconnection of different encapsulations to offer hybrid Layer 2 services (for example, Ethernet to Frame Relay Interworking) over an IP/MPLS core and can facilitate the convergence of existing services. The Layer 2 service interworking construct is shown in Figure 3-27.

Figure 3-27. Layer 2 Service Interworking

Layer 2 and Layer 3 VPNs are summarized as follows:

Layer 3 VPNs are concerned primarily with looking at the Layer 3 information and making forwarding decisions. MPLS VPNs require a CE-to-provider edge routing process plus PE-to-PE signaling via mutiprotocol BGP. With Layer 2 VPNs, the information used to make forwarding decisions is based on Layer 2 informationfor instance, via a MAC address, via a VLAN ID, on DLCI information, or on an input interface for lease line connectivity. Figure 3-28 provides a comparison between Layer 3 and Layer 2 VPNs. Figure 3-29 depicts the L2VPN constructs as has been discussed.

Figure 3-28. Layer 3 and Layer 2 VPN Comparison

Figure 3-29. L2VPN Constructs

Layer 2 VPNS are further discussed in Chapter 4.