Extranets

For the purposes of this section, extranets are defined as the intersection of the subscriber network with networks outside the subscriber network that have been merged into the subscriber VPN.

Extranets are very useful to meet specific communications requirements. For example, large corporations (such as Acme) with many subsidiaries frequently view MPLS networks as an opportunity to take advantage of economy of scale. By combining their network purchasing power into a single network with a single service provider, companies can realize significant savings. The parent corporation gains economy of scale in contracting with the service provider, and each of the subsidiaries retains autonomy over its own VPN.

Although each subsidiary is autonomous, they all have requirements to communicate with the parent corporation and, to a lesser degree, with other subsidiaries. Extranets enable this communication with no additional infrastructure requirements for any of the subsidiaries. Acquisitions and mergers can also be integrated into the corporate communications infrastructure initially through extranets. Over time they can be migrated to the appropriate industry subsidiary VPN or retain their own VPN.

A more limited application of extranets is enabling e-commerce by interconnecting suppliers, vendors, and customers for electronic exchange of ordering, billing, and other supply-chain transactions.

Extranets in Layer 3 require security design considerations similar to extranets in an existing network. An extranet connection between a supplier and a customer in an existing network would be "fenced in" with firewalls and other security measures to ensure that access is limited to the hosts and applications required by the partner for business transactions.

Although extranet access is limited by the extranet Layer 3 VPN routing construct, similar security precautions are required in a Layer 3 extranet. Firewalls and security measures are required to isolate the hosts and applications and to limit the business partner's access.