Chapter 5. Infrastructure Segmentation Architectures: Theory

This chapter brings together the technologies introduced in Chapter 4, "A Virtualization Technologies Primer: Theory," in several architectures to deliver virtual private network (VPN) functionality. This chapter examines how you can use alternative protocols for the different architectures and explains the ratio of scalability and complexity of the different solutions. In other words, if Chapter 4 is about ingredients, this chapter lists recipes. We are still in the realm of theory because we are not ready to look at how different architectures best fit real-world scenarios. We do that starting in Chapter 6, "Infrastructure Segmentation Architectures: Practice." This section is a necessary preparation to understand the design trade-offs we make in the practice sections.

The chapter starts with simple hop-by-hop architectures. It then covers how you can overlay tunnels to build Layer 2 and Layer 3 VPNs, with the different solutions for pure point-to-point (p2p) and, where they exist, point-to-multipoint (p2mp), or multipoint-multipoint (mp2mp) setups. The chapter introduces the RFC 2547 model as an alternative to overlay topologies and again iterates through several different implementations, using Multiprotocol Label Switching (MPLS), obviously, but also Layer 2 Tunnel Protocol Version 3 (L2TPv3) and generic routing encapsulation (GRE). We conclude with a look at architectures and solutions, some of which are fairly recent, to build hierarchies of VPNs.

One final introductory word about scale. Here, we define scale as the property that allows an infrastructure to efficiently support large numbers of virtual networks. Specifically, an increase in the number of virtual networks should not produce a related (linear or worse) load on the underlying infrastructure, whether that load be in terms of CPU used by the control plane, throughput used by the data plane, or time spent by the operations staff.

Note

This chapter discusses technology commonly used to provide VPN services. The next chapter shows how to assemble these technologies into what we refer to as Virtual Networks (VN). A VN is an end-to-end virtualized network which may rely on a combination of the technologies discusses here.