13.3 VPN Physical Topologies

When building networks to support VPNs, various physical topologies can be used, including hub-and-spoke, full-mesh, and partial-mesh . These topologies used for VPNs are very similar to those that would normally be seen in Frame Relay or ATM networks. A quick overview of each will be given. The hub-and-spoke is a configuration with several remote sites all having connections to one central site. With VPN implementations these connections can exist between CE routers and PE routers. Figure 13-4 examines a VPN hub-and-spoke topology; Washington D.C. and San Francisco are the CE spokes with connections through the provider net work to CE hub Dallas. Notice that in the VPN deployment there are two hub-and-spoke configurations. One type of VPN implementation uses the provider's equipment and another uses the customer's equipment for connectivity.

Figure 13-4. Hub-and-Spoke Topology

The full-mesh topology provides a connection from every site to every site, allowing greater redundancy in the event of a failure. In a majority of environments, the hub-and-spoke topology is chosen due the large number of VCs required to implement a full-mesh, which can drastically increase on the amount of money required to implement the full-mesh solution, as well as the administrative burden of managing the network. With all of that said, this solution might be necessary in some environments that may require that additional level of redundancy and resiliency. The partial-mesh may be more suitable for the global company that finds it more economical to exchange information between sites within the same country, as opposed to paying for long-haul cross-ocean links from a central site to all of the remote sites.

Figure 13-5. Full-Mesh Topology