MPLS Peter Raedler Systems Engineer 2001, Cisco Systems, Inc. Agenda Overview of MPLS Business Opportunities Security

(1)

1

MPLS

Peter Raedler

Systems Engineer

[email protected]

Agenda

• Overview of MPLS

• Business Opportunities

• Security

(2)

3

GP_09/2001

• Lower equipment cost

• Lower operational cost

• Simplified architecture

• Scalable network

capacity

Traditional

Model

Optical

Internetworking

Optical Optical IP Router IP Router Optical Optical SONET /SDH

Big Optical

Pipe

IP Services

ATM/ FR ATM/ FR IP IP

Optical Internetworking

Eliminating the overhead

4

Overview of MPLS

4

(3)

5

GP_09/2001

Standardisation Status

M

ulti

P

rotocol

L

abel

S

witching

• IETF industry standard defined by the MPLS Working

Group started end 1997 with the following objectives:

Scalability

of network layer routing

,

, Greater

flexibility

in

delivering routing services

,

, Increased

performance

performance,

Simplify

integration

of routers with cell switching based technologies

• Multiprotocol Label Switching Architecture

http://www.ietf.org/internet-drafts/draft-ietf-mpls-arch-06.txt

• LDP Specification

http://www.ietf.org/internet-drafts/draft-ietf-mpls-ldp-06.txt

•

• RFC 3031

RFC 3031–

–3038 (MBGP/VPN 2547)

3038 (MBGP/VPN 2547)

Multi

-

Protocol:

Both Above and Below

Possibly several ways to set up Routing/Control Single Forwarding Paradigm

based on Label Switching Can run over different Link Layer technologies

IPv6 IPv4 IPX Network Layer

Protocols

Ethernet FDDI ATM Frame Relay Point-to-Point

Link Layer Protocols Label Switching

(4)

7

GP_09/2001

Provider MPLS Network

ATM Switch

Router

Service Class (QoS)

Privacy (VPN)

Label

Data

MPLS Labels: Destination

and

Service Attributes

• Labels are the key

• Interoperability of

switches and routers

• Indicates service

attributes without

per-hop decisions:

Service Class

QoS

Privacy (VPN)

Switching

traffic engineered paths

8

GP_09/2001

Encapsulations

Label Header PPP Header

PPP Header Layer 3 HeaderLayer 3 Header

PPP Header

(Packet over SONET/SDH)

ATM Cell Header

HECHEC

Label DATA DATA CLP CLP PTI PTI VCI VCI GFC GFC VPIVPI Label Header MAC Header

MAC Header Layer 3 HeaderLayer 3 Header

LAN MAC Label Header

(5)

9

GP_09/2001

LSRs

and Labels

Label = 20 bits

Exp = Experimental, 3 bits

S = Bottom of stack, 1bit

TTL = Time to live, 8 bits

0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

Label | Exp|S| TTL

Label Stacking

• IGP Labels – Used for routing packets

• BGP Labels – Used for assigning end

users/communities

• RSVP Labels – Used for TE tunnels

• If more than one service is used

Then multiple labels are required – TE and FRR

In some cases a single service requires the use

(6)

11

GP_09/2001

Label Stacking

–

how?

• Arrange Labels in a stack

• Inner labels can be used to designate

services/FECs etc

E.g VPNs, Fast Re-route

• Outer label used to route/switch the MPLS

packets in the network

• Allows building services such as

MPLS VPNs – Basic & Advanced - CSC

Traffic Engineering and Fast Re-route

VPNs over Traffic Engineered core

Any Transport over MPLS

TE Label IGP Label VPN Label Inner Label Outer Label IP Header 12

GP_09/2001

MPLS Terminology

Label Switch Router (LSR)

- Router

- ATM switch + Label Switch Controller

Label Distribution

Protocol (LDP)

Edge Label Switch Router

(E-LSR)

(7)

13

GP_09/2001

How MPLS Works

1a. Existing Routing Protocols (e.g. OSPF, IS-IS) Establish Reachability to Destination Networks 1b. Label Distribution Protocol (LDP)

Establishes Label to Destination Network Mappings 4. Edge LSR at Egress Removes Label and Delivers Packet 3. LSR Switches Packets Using Label Swapping 2. Ingress Edge LSR Receives Packet,

Performs Layer 3 Value-Added Services, and Labels Packets

LSP LSP

MPLS Example:

Routing Information

128.89 171.69 1 0 1 0

You can reach 171.69 through me You can reach 128.89and

171.69through me

Routing Updates (OSPF, EIGRP, …)

You can reach 128.89 through me In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 171.69 171.69 ... ... Out I’face Out I’face 0 0 1 1 ... ... Out Lbl Out Lbl In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 171.69 171.69 ... ... Out I’face Out I’face 1 1 1 1 ... ... Out Lbl Out Lbl In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 ... ... Out I’face Out I’face 0 0 ... ... Out Lbl Out Lbl

(8)

15

GP_09/2001

MPLS Example:

Assigning Labels

1 0 1 0 Use Lbl 7 for 171.69 Use Lbl 4 for 128.89and

Use Lbl 5 for 171.69 Label Distribution Protocol (LDP) (Downstream Allocation) Use Lbl 9 for 128.89 128.89 171.69 In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 171.69 171.69 ... ... Out I’face Out I’face 0 0 1 1 ... ... Out Lbl Out Lbl In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 171.69 171.69 ... ... Out I’face Out I’face 1 1 1 1 ... ... Out Lbl Out Lbl In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 ... ... Out I’face Out I’face 0 0 ... ... Out Lbl Out Lbl -4 4 5 5 4 4 5 5 9 9 7 7 9 9 - -16

GP_09/2001

MPLS Example:

Forwarding Packets

128.89 171.69 1 0 1 128.89.25.4 Data 4 4 128.89.25.4 128.89.25.4Data 128.89.25.4 Data 128.89.25.4Data 9 9 0

Label Switch Forwards

Based on Label

In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 171.69 171.69 ... ... Out I’face Out I’face 0 0 1 1 ... ... Out Lbl Out Lbl In Lbl In Lbl Address Prefix Address Prefix 171.69 171.69 ... ... Out I’face Out I’face 1 1 1 1 ... ... Out TLbl Out TLbl In Lbl In Lbl Address Prefix Address Prefix 128.89 128.89 ... ... Out I’face Out I’face 0 0 ... ... -4 4 5 5 55 9 9 7 7 -4 4 99 128.89 128.89 Out Lbl Out Lbl

(9)

17

GP_09/2001

Advantages of MPLS Features

Benefits of MPLS

•Shared Backbone for Economies of Scale •Reduced Complexity for Lower Operational Cost •Faster Time to Market for IP Services => More Revenue •Use Best Technology => Lower Costs

•Traffic Eng. for Lower Trunk Costs and Higher Reliability •Fast Reroute for Protection and Resiliency

•Guaranteed Bandwidth for Hard QoS Guarantees

•Traffic Eng. for Lower Trunk Costs and Higher Reliability •Fast Reroute for Protection and Resiliency

•Guaranteed Bandwidth for Hard QoS Guarantees

•New Revenue Opportunities for SPs

•Scalability for Lower Operational Costs and Faster Rollout •L2 Privacy and Performance for IP

•New Revenue Opportunities for SPs

•Scalability for Lower Operational Costs and Faster Rollout •L2 Privacy and Performance for IP

IP+ATM

Integration

IP+ATM

Integration

Traffic

Engineering

Traffic

Engineering

MPLS

VPNs

Growing MPLS Capabilities

MPLS with LDP MPLS with LDP MPLS MPLS IP + ATM IP + ATM = Deployed Today = Deployed Today --33''- -Advanced VPN Advanced VPN Capabilities Capabilities MPLS MPLS QoS QoS Common Common Base Base Deployment Deployment Options Options MPLS MPLS L2 L2 integ integ.. --22''- -Layer 2 Layer 2 VPNs VPNs MPLS MPLS VPN VPN (L3) (L3) MPLS MPLS TE TE MPLS MPLS DS DS--TETE InterAS InterAS,, CSC, CSC, Dial Dial AToM AToM MPLS MPLS L2 L2 VPN VPN Advanced Advanced TE TE Guaranteed Guaranteed Bandwidth Bandwidth Services Services --11-- --44''--Advanced Advanced Traffic Traffic Engineering Engineering

(10)

19

GP_09/2001

MPLS Features ...

• That’s all nice but ...

How can your CUSTOMERS make

money with it?

20

Business Opportunities

Enabled by

MPLS Features

20

(11)

21

GP_09/2001

Current Business Opportunities

• VPN Services

• Premium Class Services

• Virtual Leased Lines

• Voice Trunking &

Toll Bypass Service

• Carrier Backbone Service/

Alternate Carrier Service

Virtual Networks

Virtual Private Networks Virtual Dial-Up Networks Virtual LANs

Overlay VPN Network-based VPN Access Lists (Shared Router) Split Routing (Dedicated Router) RFC 2547 MPLS VPN

X.25 F/R ATM GRE IPSec VR

Virtual Network Models

(12)

23

GP_09/2001

Customer communities

deployed on a

shared infrastructure

with the same policies as a private network

AGIS.net Shared Network

Virtual Private Network

Services Definition

• Access VPN

• Intranet VPN

• Extranet VPN

• Internet VPN

VPN VPN

Internet, IP, IPsec FR, ATM, MPLS

24

GP_09/2001

Benefits of MPLS VPNs

• Private, connectionless

IP VPNs

• Outstanding scalability

• Customer IP

addressing freedom

• Multiple QoS classes

• Secure support for

intranets and extranets

• Simplified VPN

Provisioning

• Support over any

access or backbone

technology

VPN C VPN A VPN B VPN C VPN A VPN B VPN C VPN A VPN B VPN C VPN A VPN B Connection-Oriented VPN Topology VPN C VPN A VPN B VPN C VPN A VPN B VPN C VPN A VPN B VPN C VPN A VPN B Connectionless VPN Topology

MPLS

-

based

VPN

(13)

25

GP_09/2001

Offering VPN Services

Is Easier with MPLS

• Update traffic matrix

• Add (n-1) PVCs to connect

new CPE

• Resize full PVC mesh

• Update OSPF design

• Reconfigure each CPE for new

L3 topology

• Configure new CPE

• Update edge LSR

Overlay VPN

MPLS

-

based VPN

How it works

• VPNs work as scaleable

“L3 VLANs”

• Can be extended over WAN/MAN

• Uses nested MPLS Labels & BGP4(+Extensions)

• Local Subnets (L2-VLANs)

terminate into VPN-LER (PE) (Sub)Interface

(14)

27

GP_09/2001

Cisco MPLS VPN

Customer

• Customer sites are in many different Virtual Private Networks.

• They run ordinary IP, not MPLS or any special VPN functions.

• Customer sites are connected by Frame Relay, ATM, serial,

PPP, Ethernet, xDSL and other options.

28

GP_09/2001

MPLS VPN Packet Forwarding

• Forwarding based on

extended (VPN-IP)

addresses

• MPLS binds VPN-IP

routes to label

switched paths

• Logically separate

forwarding tables for

each VPN

IP PKT Fwd Tables 1. identify VPN 3. apply label and select egress port IP PKT Label Label Provider edge LSR

VPN-IP route label info

2. bind route to MPLS label label info label info (multiple QOS service classes)

(15)

29

GP_09/2001

MPLS VPNs with a Cisco IP Core

• Service menu:

High-speed Internet

services

Business quality

IP-VPN services

Application hosting

services

• Benefits:

Improved bandwidth

utilization

Layer 3 traffic engineering

Service consolidation

IP QoS guarantees

GSR Core CPE CPE CPE CPE Internet Services Internet Services VPN B VPN A VPN A VPN B Business Quality IP-VPN Services Business Quality IP-VPN Services LER LER LER LER Intranet VPN 1 Intranet VPN 1 Intranet VPN 2 Intranet VPN 2 Secure MPLS Intranet or Extranet VPN

VLAN

-

VPN Mapping

Intranet VPN 3 Intranet VPN 3 L2 VLAN Trunk 802.1Q Mapping VPN VLAN VLAN Switch

(16)

31

GP_09/2001 VPN_B VPN_A Public Edge LSR VLAN Switch Cache Firewall WEB Hosting Intranet VPN 1 Intranet VPN 1 Intranet VPN 2 Intranet VPN 2 Secure MPLS Intranet or Extranet VPN Public Internet Public Internet Application Hosting Services

Application Hosting Services

Across MPLS VPNs

•Green VPN customers access to Green Server only

•There may be “public” servers in a common public “VPN”

•Server IPv4 address is advertised only in the VPN it belongs to.

•VLAN are used to isolate per VPN servers, in the “server farm”

32

GP_09/2001

Current Business Opportunities

• VPN Services

• Premium Class Services

• Virtual Leased Lines

• Voice Trunking &

Toll Bypass Service

• Carrier Backbone Service/

(17)

33

GP_09/2001

Application

-

Level QoS and

Bandwidth Management

Differentiated IP Services Bronze Bronze Silver Silver

Gold Guaranteed: Latency _{and Delivery}

Best-Effort Delivery Guaranteed Delivery Voice, SNA

E-Mail, Web Browsing

E-Commerce TrafficTraffic

Classification

Keep Billing Simple

Current Business Opportunities

• VPN Services

• Premium Class Services

• Virtual Leased Lines

• Voice Trunking &

Toll Bypass Service

• Carrier Backbone Service/

(18)

35

GP_09/2001

MPLS Traffic Engineering

Application

• Protection solution

Similar to SONET’s automatic protection switching

• Fast reroute

Goal is to match SONET restoral times—50 ms

Locally patch around lost facilities

Locally re-route around failed links/nodes

Strategies

Alternate tunnel (1->1 mapping) or tunnel within tunnel (n->1 mapping)

How is this done?

Locally re-route traffic onto backup paths when informed by lower layers (SONET etc.)

The backup paths are pre-established—however, bandwidth needn’t be double counted

36

GP_09/2001

Node and Link Protection with

Fast Reroute

R8 R2 R6 R3 R4 R7 R1 R5 R9

• Multiple hops can be by-passed. R2 swaps the label which R4

expects before pushing the label for R6

• R2 locally patches traffic onto the link with R6

• Multiple hops can be by-passed. R2 swaps the

label

which R4

expects before pushing the label for R6

(19)

37

GP_09/2001

Current Business Opportunities

• VPN Services

• Premium Class Services

• Virtual Leased Lines

• Voice Trunking &

Toll Bypass Service

• Carrier Backbone Service/

Alternate Carrier Service

DiffServ Aware TE

Virtual Leased line

PE

Central Office Central

Office Traditional _Telephony

Traditional Telephony Toll Bypass PE GB Tunnel VoIP

Gateway _GatewayVoIP

MPLS Network PE _{Regular TE} PE Tunnel CE Enterprise LAN CE Enterprise LAN PE _PE Voice Trunking VPN Service

Internet Service Enterprise LAN

Internet Access Router Internet Access Router Enterprise LAN PSTN – Traditional TDM Network Class 5 legacy switches Legend GB-TE Tunnel Regular TE Tunnel

(20)

39

GP_09/2001

Current Business Opportunities

• VPN Services

• Premium Class Services

• Virtual Leased Lines

• Voice Trunking &

Toll Bypass Service

• Carrier Backbone Service/

Alternate Carrier Service

40

GP_09/2001

Carrier Supporting Carrier

& Inter

-

Provider Access

Carrier Supporting Carrier • Hierarchical relationship • Opportunity: Offer

backbone services to peer or smaller carriers

Inter-Provider Access • Peer relationship • Opportunity: Provide

carrier services on behalf of other carriers Backbone Carrier Customer Carriers Carrier A Carrier B

(21)

41

MPLS L2 Transport

AToM

:

AnyThing

over MPLS

41

Universal Transport

• ATM AAL5 PDU

• FR PDU

• ATM cells (non AAL5 mode)

• Ethernet

• 802.1Q (Ethernet VLAN)

• Cisco-HDLC

• PPP

draft-martini-l2circuit-trans-mpls-05.txt draft-martini-l2circuit-encap-mpls-01.txt

(22)

43

GP_09/2001

MPLS L2 Tunnel

PE MPLS Backbone PE MPLS Labeled Switch Path (LSP) CE CE

Tunnel (E1, E2, key)

Port Pi Port Po

E1 _E2

• Initiates the “MPLS Path” between E1 and E2

at least one is needed, several can be configured

• By default, MPLS-encapsulated tunnel packets follow the

same path as IP packets between E1 and E2

44

IETF Update

(23)

45

GP_09/2001

IETF Update

• MPLS Workgroup Status

• IETF/MPLS Reorganization

MPLS Status

• Base MPLS Technology Specifications are

complete

• 10 MPLS WG RFCs

• 11 More drafts awaiting publication

• Available at:

http://www.ietf.org/html.charters/mpls-charter.html

• RFC2547 – MPLS/BGP VPNs

(24)

47

GP_09/2001

MPLS RFCs

Requirements for Traffic EngineeringOver MPLS (RFC 2702) Multiprotocol Label Switching Architecture(RFC 3031) MPLS Label StackEncoding (RFC 3032)

Use of Label Switching on Frame Relay Networks Specification (RFC 3034)

MPLS using LDP and ATMVC Switching (RFC 3035) LDPSpecification (RFC 3036)

LDP Applicability (RFC 3037)

VCID Notification over ATM link for LDP (RFC 3038)

The Assignment of the Information Field and Protocol Identifier in the Q.2941 Generic Identifier and Q.2957 User-to-user Signaling for the Internet Protocol (RFC 3033)

MPLS Loop Prevention Mechanism (RFC 3063)

48

GP_09/2001

Near RFC Publication

Carrying Label Information in BGP-4

RSVP-TE: Extensions to RSVP for LSP Tunnels

Applicability Statement for Extensions to RSVP for LSP-Tunnels Constraint-Based LSPSetup using LDP

LSP Modification Using CR-LDP Applicability Statement for CR-LDP LDP State Machine

Definitions of Managed Objects for the Multiprotocol Label Switching, Label Distribution Protocol (LDP)

MPLS Support of Differentiated Services Framework for IP Multicast in MPLS

(25)

49

GP_09/2001

Reorganization of MPLS

• Original charter is complete

• Focus has moved in two directions

Applications – VPNs, DS-TE, L2

Transport

Generalization of the MPLS-TE control

plane to optical and circuit technologies

Generalized MPLS

• Really a generalization of the Traffic

Engineering Application of MPLS

• Originally applied to setting up

light-paths and called MPLambdaS

• Now includes SONET, port switching

(26)

51

GP_09/2001

MPLampS

52

Summary

52

(27)

53

GP_09/2001

Literature

MPLS and VPN Architectures

Ivan Pepelnjak Jim Guichard ISBN 1-58705-002-1

Understanding MPLS/VPN

Security Issues

(28)

55

GP_09/2001

Agenda

• Analysis of MPLS/VPN

Security

• Security Recommendations

• MPLS Security Architectures

Internet Access

Firewalling Options

• Attacking an MPLS Network

• IPsec and MPLS

• Summary

56

GP_09/2001

The Principle: A “Virtual Router”

!

ip vrf Customer_A

rd 100:110

route-target export 100:1000

route-target import 100:1000

!

interface Serial0/1

ip vrf forwarding Customer_A

!

Virtual Routing and

Forwarding Instance

Route Distinguisher:

Makes VPN routes unique

Export this VRF with

community 100:1000

Import routes from

other VRFs with

community 100:1000

Assign Interface to

(29)

57

GP_09/2001

General VPN Security

Requirements

• Address Space and Routing

Separation

• Hiding of the MPLS Core Structure

• Resistance to Attacks

• Impossibility of VPN Spoofing

Working assumption: The core (PE+P) is secure

Address Space Separation

Route Distinguisher IPv4 Address

VPN IPv4 Address

64 bits 32 bits

Within the MPLS core all addresses are

unique due to the Route Distinguisher

(30)

59

GP_09/2001

Routing Separation

• Each (sub-) interface is assigned to a

VRF

• Each VRF has a RD (route

distinguisher)

• Routing instance: within one RD

-> within one VRF

-> Routing Separation

60

GP_09/2001

Visible Address Space

Hiding of the

MPLS Core Structure

• VRF contains MPLS IPv4 addresses

• Only peering Interface (on PE) exposed (->

CE)!

-> ACL or unnumbered

PE MPLS core IP(PE; l0) P CE2

IP(CE2) IP(PE; fa1)

VRF CE2 CE1

IP(CE1) IP(PE; fa0)

VRF CE1

P

(31)

61

GP_09/2001

Resistance to Attacks:

Where and How?

• Where can you attack?

Address and Routing Separation, thus:

Only Attack point: peering PE

• How?

- Intrusions

(telnet, SNMP, …, routing protocol)

- DoS

Secure

with ACLs

Secure

with MD5

See ISP Essentials

Label Spoofing

• PE router expects IP packet from CE

• Labelled packets will be dropped

(32)

63

GP_09/2001

Comparison with ATM / FR

ATM/FR MPLS

Address space separation

yes

Routing separation

yes

Resistance to attacks

yes

Resistance to Label

Spoofing

yes

Direct CE-CE

Authentication (layer 3)

yes

with

IPsec

64

GP_09/2001

Agenda

• Analysis of MPLS/VPN

Security

• Security Recommendations

• MPLS Security Architectures

Internet Access

Firewalling Options

• Attacking an MPLS Network

• IPsec and MPLS

• Summary

(33)

65

GP_09/2001

Security Recommendations for

ISPs

• Secure devices (PE, P): They are trusted!

• CE-PE interface: Secure with ACLs

• Static PE-CE routing where possible

• If routing: Use authentication (MD5)

• Separation of CE-PE links where possible

(Internet / VPN)

• LDP authentication (MD5)

• VRF: Define maximum number of routes

Note: Overall security depends on weakest

link!

In order of security preference:

1. Static

: If no dynamic routing required

(no security implications)

2. BGP

: For redundancy and dynamic

updates

(many security features)

3. RIPv2

: If BGP not supported

(limited security features)

PE

(34)

67

GP_09/2001

ACL and secure routing

Securing the MPLS Core

MPLS core Internet VPN VPN PE CE CE CE CE CE CE PE PE PE PE P P P VPN VPN VPN BGP Route Reflector BGP peering with MD5 authentic. LDP with MD5 68

GP_09/2001

Agenda

• Analysis of MPLS/VPN

Security

• Security Recommendations

• MPLS Security Architectures

Internet Access

Firewalling Options

• Attacking an MPLS Network

• IPsec and MPLS

• Summary

(35)

69

GP_09/2001

MPLS Internet Architectures:

Principles

• Core supports VPNs and Internet

• VPNs remain separated

• Internet as an option for a VPN

• Essential: Firewalling

Separate VPN and Internet

Access

• Separation:

+++

• DoS resistance: +++

PE1 MPLS core P CE2 CE1 PE2 Customer LAN Firewall / NAT To Internet To VPN VRF Internet VRF VPN IDS

(36)

71

GP_09/2001

Separate Access Lines + CEs, one

PE

PE1 MPLS core P CE2 CE1 Customer LAN Firewall / NAT To Internet To VPN VRF Internet VRF VPN

• Separation:

+++

• DoS resistance:

++

(DoS might impact VPN on PE)

• Cost:

$$

(Two lines, but only one PE) IDS

72

GP_09/2001

Using a Single Access Line

Requirements to share a line:

• PE requires separate sub-interfaces

• CE requires separate sub-interfaces

(37)

73

GP_09/2001

Shared Access Line, Frame Relay

PE1 MPLS core P VPN CE Internet CE Customer LAN Firewall / NAT

FR logical links

VRF Internet VRF VPN

• Separation:

+++

• DoS resistance:

+

(DoS might affect VPN on PE, line, CE)

• Cost:

$

IDS

Shared Access Line, Policy

Routing

PE1 MPLS core P VPN CE Internet CE Customer LAN Firewall / NAT

FR logical links

PR VRF Internet VRF VPN

• Separation:

+++

• DoS resistance:

+

(DoS might affect VPN on PE, line, CE) IDS

(38)

75

GP_09/2001

Shared Access Line, CE with

VRFs

PE1 MPLS core P Internet CE Customer LAN Firewall / NAT

FR logical links

VRF Internet VRF VPN VRF Internet

• Separation:

+++

• DoS resistance:

+

(DoS might affect VPN on PE, line, CE)

• Cost:

$

IDS

76

GP_09/2001 m b e h r i n g PE1 MPLS core VPN CE Internet CE PE2 Hub Site Firewall NAT VRF Internet

Hub

-

and

-

Spoke VPN with Internet

Access

Internet

Spoke 1 Spoke 2 Spoke 3

VPN VPN To VPN VPN VRF VPN PEs CEs To Internet --> IDS

(39)

77

GP_09/2001

Alternative Topologies

• Full VPN mesh, one Internet Access

• Internet access at several sites

-> Several firewalls needed

-> More complex

• Internet Access from all sites

-> Complex, one firewall per site

Central

Firewalling

:

Option 1: Stacking Firewalls

+

Central Management

+

Strong firewalls

+

Customer can

choose firewall

+

Different policies per

customer possible

+

CEs not touched

-

One firewall per

customer

MPLS core VPN VPN VPN PEs CEs VPN Internet SP Domain NAT and Firewalling

(40)

79

GP_09/2001

Central

Firewalling

:

Option 2: NAT on CE, one central

FW

+

Central Management

+

One strong firewall

+

Easy to deploy

-

Customer cannot

pick his firewall

-

CEs need config

MPLS core VPN VPN VPN PEs Customer 1 Customer 2 Customer 3 VPN Internet SP Domain Firewalling

NAT NAT NAT

e.g PIX 535

CEs

80

GP_09/2001

Central

Firewalling

:

Option 3: IOS Firewall on CE

+

Economic

+

One firewall per

customer

+

No central devices

-

Management more

difficult

-

CEs need config

MPLS core VPN VPN VPN PEs CEs Customer 1 Customer 2 Customer 3 VPN Internet SP Domain NAT and firewall NAT and firewall NAT and firewall

(41)

81

GP_09/2001

A Word on Carrier’s Carrier

• Same principles as in normal MPLS

• Customer trusts carrier who trusts carrier

Carrier’s Carrier

Cust. Carrier Carrier Cust.

CE _CE PE PE PE PE PE PE IP label label data IP data label IP data label IP data IP data