Chapter 5. Layer 3 VPNs

In this chapter, we discuss another important application of MPLS, which was mentioned in Chapter 4, "Layer 2 VPNs"namely, Layer 3 VPNs. This is also known as Border Gateway Protocol (BGP) MPLS VPNs. Layer 3 VPNs (commonly referred as RFC 2547 VPNs; the new RFC is RFC 4364) was one of the first applications of MPLS. This is the most common MPLS application and the most widely deployed network-based IP VPN technology. This chapter starts with a technology overview and then discusses how Layer 3 VPNs can be offered as a service. We further discuss value-added services and how these services can be bundled with Layer 3 VPNs for additional revenue for service providers.

IT managers struggle with the question of whether to outsource the corporate wide area network (WAN) to a service provider or to manage the WAN themselves. However, the migration of corporate applications, such as customer relationship management (CRM) and enterprise resource planning (ERP), to IP further prompts these IT managers to consider adopting a managed Layer 3 service offering from a service provider (SP). Many have outsourced the managed Layer 3 service, whereas others have taken the plunge to build it in-house. Many who have outsourced their virtual private networks (VPN) have bought a Layer 3 service from the SP. These services can consist of a tunneling technology, such as generic routing encapsulation (GRE) or IPSec, layered across a Layer 2 data link. Or the services might include the latest network-based IP VPN technology based on MPLS technology as a service foundation.

The GRE or IPSec tunnel-based alternatives provide IP-based connectivity in small networks. They are, however, limited in scalability for large networks because they do not scale well with their requirement of n^2 tunnels to connect sites in full mesh. This means that each customer router maintains a tunnel adjacency with other customer routers despite the routing relationship with provider routers. In the IPSec case, secure/encrypted tunnels are set up over public/private infrastructure. As the number of sites increases in any VPN of size n, to maintain an any-to-any connectivity, n-1 number of tunnels must be established from each site. With MPLS-based L3VPNs, the scale is much better and there is no requirement of setting up n(n-1) tunnels O(n^2) (read as order of n^2) tunnels between sites. The subsequent sections discuss how MPLS VPNs work.