You are on page 1of 7

See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/228998947

Layer 2 VPN Architectures and Operation

Article · January 2004

CITATIONS READS

0 2,494

4 authors:

José Manuel Arco Antonio Garcia


University of Alcalá University of Alcalá
24 PUBLICATIONS   105 CITATIONS    22 PUBLICATIONS   52 CITATIONS   

SEE PROFILE SEE PROFILE

Juan A. Carral Alvaro Paricio


University of Alcalá University of Alcalá
36 PUBLICATIONS   168 CITATIONS    6 PUBLICATIONS   70 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

MEDIANET View project

TRASGO. Detección precoz de TRAStornos de desarrollo mediante el uso de juGuetes y Objetos cotidianos Ministerio de Ciencia e Innovación (RTI2018-101962-B-I00)
View project

All content following this page was uploaded by Alvaro Paricio on 17 May 2014.

The user has requested enhancement of the downloaded file.


LAYER 2 VPN ARCHITECTURES AND OPERATION
J. M. Arco, A. García, J. A. Carral, A. Paricio
Departamento de Automática Universidad de Alcalá
Escuela Politécnica 28871 Alcalá de Henares
Teléfono: +34 91 8856627
{jmarco, antonio, jac, aparicio@aut.uah.es}

Abstract Label Switching (MPLS) routers. The IEEE 802.1ad


Users need high speed and low latency transmission for group is defining the necessary extensions to Ethernet
new applications. Since Ethernet is the dominant LAN bridges [1] while the IETF is working with MPLS [2].
technology, service providers wish to offer new Ethernet There are two basic Ethernet services: point to point and
services as Layer 2 Virtual Private Network (L2VPN), to multipoint services [3][4]. These are the basic services of
meet the requirements of these applications. a Layer 2 Virtual Private Network (L2VPN) and also
MultiProtocol Label Switching (MPLS) is one of the most know as a Virtual Private LAN Service (VPLS).
suitable technologies to deploy L3VPN and can also be A Virtual LAN (VLAN) is a logical representation of an
used to realize L2VPN. Ethernet technology has reached Ethernet network, where only members of the VLAN can
the ability to meet MAN and WAN requirements. interchange traffic. A VLAN can also be considered as a
This article presents a review of both Ethernet and MPLS broadcast domain where the broadcast1 traffic is limited to
technologies to deploy L2VPN and compares both the ports member of the VLAN. From the point of view of
approaches. a service provider a service instance is a Customer’s
VLAN (C-VLAN). The VLAN is based on the IEEE
Key Words 802.1Q standard [5]. A Q-tag is added/dropped in the
L2VPN, IEEE bridges, VPLS, MPLS, H-VPLS, Ethernet. Ethernet frames exchanged between Ethernet switches,
there is no change at the final systems, figure 2.
1. Introduction
MAC DA
Enterprises are using new applications that require high EtherType (2bytes)
speed and low latency transmission to increase MAC SA
User Priority (3bit)
productivity and reduce costs. Ethernet is the dominant VLAN Tag
CFI=0 (1 bit)
LAN technology because of its simplicity, low equipment EtherType
cost and high speed. Ethernet technology has greatly VLAN ID (2 bits)
Payload
evolved in terms of bandwidth (up to 10 Gbps), and it
spanning across metropolitan area networks MAN and Figure 2. VLAN frame format
wide area networks WAN. Service providers wish to offer
new Ethernet services such as LAN transparent services, To effectively deploy the provider network with Ethernet
switches some issues must be addressed:
to meet the requirements of the new applications. Service
providers have also recognizing the benefits of the • MAC addresses table explosion.
Ethernet technology. As Ethernet is an available • The limited number of C-VLANs, 4096 (12 bits).
technology to deploy MAN and WAN networks, it is a • QoS support.
logical option to use it to interconnect LANs, figure 1. Within MPLS technology the open issues are:
• Loops avoidance.
SP Core • QoS support.
SP Access SP Access
Enterprise Network
Network
Network Enterprise • Security.
Site 1 Site 2 The article is divided in two parts. In the first part, we
Tradicional ATM, IP study three Ethernet technologies to deploy provider’s
Ethernet Frame Relay Frame Relay Ethernet
WAN MPLS network. In the second part, we study MPLS technology
to deploy LAN services, based on VPLS. There are two
Ethernet Ethernet ATM, IP, MPLS, Ethernet types of VPLS, the flat VPLS and the hierarchical VPLS
Ethernet Ethernet
WAN MPLS Ethernet MPLS
(H-VPLS), and we introduce both of them. The H-VPLS
can be realized with two architectures, Ethernet Edge
Figure 1. LAN and WAN technologies.
We consider the service providers network can be
1
deployed as Ethernet bridges network or MultiProtocol Consider broadcast, as broadcast, multicast or destination
unknown
Hierarchical VPLS (EE-H-VPLS) and MPLS Edge user’s network provider’s network user’s network
Hierarchical VPLS (ME-H-VPLS) and we study their PE2’s table
PE1’s table
forwarding and their loop avoidance mechanisms. Finally,
we present the conclusions of the paper. :E2 :B1, :B2, :B3
:E1 :A1, :A2, :A3
:E1 :E2
PE1 PE2
2. IEEE solutions
We considerer three technologies for provider’s Ethernet
switches. All the solutions insert additional tags or fields :A1 :A3 :B1
in the customer Ethernet frames at the ingress node (the :A2 :B2
first node of provider’s network) and are stripped off at :B3
the egress node (the last node of provider’s network).
:B2 :A2 Type Payload :B2 :A2 Type Payload
2.1. QiQ encapsulation
In a Q-tag in Q-tag (QiQ) network, the service provider :E2 :E1 :B2 :A2 Type Payload
assigns a Provider-VLAN Tag (P-VLAN Tag) for each
service instance [1], figure 3. The subscriber’s C-VLAN Figure 4. MAS operation.
Tags are preserved. The P-VLAN is used by the provider
The provider network switches the users frames based on
Ethernet switches to identify the C-LAN across the core
the provider edge nodes’ MAC addresses. The MAC
network. This has a limitation, there are only 4096
address table of a provider ingress node, associate all the
different services instances or clients. To overtaking this
end users’ MAC addresses of a site, with the MAC
limit there are two approaches, one is to combine both the
address of its provider ingress node, figure 4. This
C-LAN and P-LAN fields in one field. Other solution can
reduces the MAC address table size. The MAS is
be to extend the VLAN ID field [6]. Both of the two
independent of the Q-tag schemes used and can be
approaches are not standard [7].
supported by existing switches with only a few
C-MAC DA
extensions.
P-EtherType
C-MAC SA
P-VLAN CoS 2.3. MiM encapsulation
P-VLAN Tag
P-CFI QiQ and MAS can be combined and is equivalent to
C-VLAN Tag
P-VLAN ID MAC in MAC (MiM) scheme. MiM provides capabilities
C-EtherType that address the QiQ technology limitations, including
C-Payload subscriber/provider MAC address separation and
scalability. MiM also enables QoS capabilities. MiM
Figure 3. QiQ frame format prepends a Provider source and destination MAC address,
a Provider P-VLAN Tag (with 3 priority bits for QoS) and
One problem of QiQ is that provider’s and subscriber’s a Provider Service Label to the user’s Ethernet frame,
MAC addresses are visible to all networks. figure 5.
The Spanning Tree Protocol (STP) provides loop-free
connectivity across Ethernet bridges network [8]. Other P-MAC DA
problem is the of Bridge Protocol Data Units (BPDUs) P-MAC SA P-EtherType
used with STP. These frames have no VLAN tag and the P-VLAN CoS
P-EtherType
multicast destination MAC address 01:80:C2:00:00:00. P-CFI
QiQ cannot provide differentiation between subscriber P-VLAN Tag
P-VLAN ID
and provider BPDUs because each entity’s BPDUs have P-Serv.Label
the same MAC address. QiQ is aeffective option if the C-MAC DA P-EtherType
service is point to point, and there are no BPDUs [9][6].
C-MAC SA Service ID
2.2. MAS encapsulation C-VLAN Tag

The MAC Address Stacking (MAS) prevent the table C-EtherType


MAC address explosion. The ingress node insert two C-Payload
additional fields source and destination MAC addresses of
the provider edge nodes figure 4. Figure 5. MiM encapsulation
P-VLAN Tag identifies the Provider VLAN over which
the subscribers’ service frames are transported. The
Service ID identifies the service instance in the provider’s
network. MiM provides up to 16 million service
instances. The provider switches traffic based on the
provider’s MAC addresses. The subscribers’ frames are
tunneled by MiM and are not used by the provider’s This draft proposes two architectures flat VPLS and
network switches, so the subscriber and provider hierarchical VPLS.
networks are separate and isolated.
The users’ BPDUs are tunnelled through the provider’s 3.1. Flat VPLS
network. There is not interaction between the STP of
Lasserre propose a VPLS architecture using Pseudo-
provider’s and users’ networks.
Wires (PW) as virtual Ethernet wires to connect virtual
Most of the above Ethernet technologies are currently
Ethernet switches or Virtual Switch Instances (VSI). The
being investigated by the standardization bodies and are
key of VPLS technology was the definition of Ethernet
applicable to a bridged provider network [1][6]. These
over MPLS using draft-martini encapsulation [14] that
technologies can be also combined into an hierarchical
describes a mechanism whereby Ethernet can be
network to improved the providers networks performance
encapsulated within a MPLS LSP for transport.
[10][11].
Conceptually, VPLS can be thought of as an emulated
Ethernet switch where a VSI is analogous to a Virtual
3. VPLS solutions LAN.
Two MPLS labels are added onto the customer Ethernet To reduce the complexity of VPLS architecture, Lasserre
frames based on destination MAC address/port/VLAN propose a flat architecture whereby all VSIs within a
information at the ingress node, figure 6. service instance is interconnected using a full mesh of
MPLS LSPs figure 7. To avoid loops among VSIs is
VC label needed to implement a mechanism that could be STP.
VC label
Encapsulation fields Lasserre propose an easer technique known as split
Tunnel label
Tunnel label horizon forwarding. With split horizon, a packet received
MAC
MACDADA on an interface should never be forwarded back out of the
MAC SA same interface. The client’s BPDU are tunnelled although
MAC SA this is not desirable due to the scalability of the STP.
VLAN Tag The forwarding operation follows the same rules than
VLAN Tag
Original Customer frame Ethernet bridges, self learns source MAC address to port
Original
EtherType
EtherType and use this association to forward frames efficiently. If a
DATA destination MAC address is unknown, broadcast or
DATA
multicast, floods that frame. The address learning is
CRC
CRC considerate to be a date plane function.
Figure 6. MPLS layer 2 encapsulation
Discovery and signaling mechanisms
The tunnel label is inserted at the top of the stack, which
is then used by the MPLS network to reach the egress Autodiscovery allows PE devices to automatically
node. The VC label is introduced at the bottom of the discover other PE devices that belong to the same VPLS
stack is used by the egress node to deliver the frame to the service instance. Lasserre does not propose any specific
destination network. discovery mechanisms. The service provider is free to
The VPLS network has similar elements as layer 3 VPN choose one mechanism for its particular requirements.
network [12][10]. One of the elements of the VPLS is the There are different discovery methods with their own
Provider Edge router (PE) that is responsible for MAC attributes. Some of the mechanisms that can be used are:
learning, interaction with customer STP and associating static configuration, DNS, Radius, LDP and BGP [15]. In
the MAC address and VLAN customer with forwarding order to choose the most convenient discovery
Label Switch Path (LSP). mechanism, it should be take into account scalability,
In a rough comparison between VPLS and Ethernet security and the ability to signal other attributes, e.g. QoS
technologies, the VC label can be seen as the Q-tag and profiles.
the tunnel label as MAS. After a PE knows the other PE with the same VPLS
The layer 2 VPN networks must resolve some questions: service instance, each PE needs to set up a PW between
• How the Ethernet frames are encapsulated in them and bind the PWs to the particular VSI. Within the
MPLS tunnels. IETF there are two signaling solutions, BGP [16] and
• How new customer sites are added/dropped, using LDP. BGP broadcast set up information to all PE
(discovery mechanisms). members of the VLPS, even though the information can
be specific to a single PW. Not all the PWs will have the
• How tunnels (LSPs) are set up, using (signaling
same characteristics between each PE associated with a
mechanisms).
VPLS. To signal point to point PW attributes is better to
Several VPLS drafts have been proposed, but, because
use a peer to peer signaling protocol such as LDP [17].
they use different discovery and signaling mechanisms,
Furthermore, Martini [18] is one of the most used method
they are mutually exclusive. One of the most important
to set up PW and encapsulate packets, and propose LDP
draft is the draft-ietf-l2vpn-vpls-ldp-00.txt that we
as signaling protocol.
reference as Lasserre, the first author of the draft [13].
Security is also an important issue. There are some attacks
that layer 2 switched are vulnerable (DoS, MAC flooding, Hierarchical VPLS (ME-H-VPLS). They differ in the
ARP and DNS spoofing, etc)[19]. Lasserre does not give edge network, the first one is an IEEE bridged network
any recommendation about security. while the last one is a MPLS network.
There must be a full mesh of PWs and targeted LDP
sessions for VPLS discovery and signalling. This is a 3.2.1 Redundancy and loop avoidance in ME-
scale issue. If there are m MAC addresses by service H-VPLS
instance; s, service instances; n, PE routers; the following
These problems in the ME-H-VPLS architecture can be
scaling figures can be calculated:
studied in two different networks, the edge network and
Total number of MAC addresses = m*s
the core network. The split horizon could be used within
Number of LDP session per PE= n-1
the edge domain to prevent loops, but would increase the
Total number of LDP session= (n-1)*n
cost and functionality of the U-PE devices. We consider a
Total number of LSP tunnel= n*(n-1)/2
full mesh network (figure 7) with of PWs between the U-
The total number of LDP sessions, LSP tunnels and the PE and N-PE devices. An U-PE simply forms PW
size of the MAC address table can be also an issue. The adjacencies with its associated N-PEs. Once the PWs
PE ingress device must replicate each frame n times for have been established between the U-PE and N-PEs and
broadcast traffic and if n is large, there is an inefficient bound to the particular VSI, the U-PE must block the
user of network bandwidth and system resources, this is a transmission and reception of packets on all of the PWs
drawback of flat VPLS. but one (the higher IP address, for instance).
A frame is flooded to all PWs associated within the VSI,
3.2. Hierarchical VPLS except the PW the frame was received on. This is slightly
Hierarchical VPLS has been proposed to resolve the different to flat VPLS in that in flat VPLS, does not
scaling limitation of the flat VPLS. H-VPLS employs a forward frames received on a PW to other PWs associated
distributed switching architecture made up of edge with a VSI (it is due to all VSI are connected by a full
domains formed by User PE (U-PE) connected to mesh and only one forwarding is done). This rule is
Network PE (N-PE)[13]. The PE functions are distributed broken within ME-H-VPLS networks, where several
between the U-PE, that is responsible for Ethernet forwarding steps are needed.
bridging (MAC learning and interaction with customer
STP) and the N-PE, that is responsible for associating the 3.2.2 Redundancy and loop avoidance in EE-
MAC address and VLAN customer with forwarding LSP. H-VPLS
The edge domains are inter-connected using a MPLS
core, figure 7 (there is only one service instance). The The EE-H-VPLS topology can be formed of point to point
edge network topology can be a star or a ring while the Ethernet connections, or Ethernet rings using a STP to
core network is a full mesh. provide loop avoidance, figure 8 (there is only one service
instance).
U-PE 1 N-PE 1 N-PE 2 U-PE 3
F B U-PE A N-PE 1 N-PE 2
B F F F
Full mesh F
MPLS network B F F F F U-PE C
F B
B F F F F F B
U-PE 2 N-PE 3 N-PE 4 U-PE 4 B
F
F
User Access Core Access User
U-PE B N-PE 3 N-PE 4
Figure 7. ME-H-VPLS loop avoidance.
Lets calculate the number of LSP tunnel if there are U U- Local STP MPLS Clouds Local STP
Domain No BPDUs Passed Domain
PE routes, N N-PE routes, and if U=N*K, where K is the
ratio between them and if there is only one LSP between a Figure 8. Loops in a EE-H-VPLS architecture.
U-PE and a N-PE, then:
By limiting the extent of a STP to a particular edge
U2
Total numbers of LSP tunnel = N * ( N − 1) + U ≈ N = 2 2 domain, the topology of the spanning tree can be
K simplified and will be faster to recover from failures. This
The number of the needed LSP tunnels is reduced by a K2 model uses Ethernet mechanisms such as STP to provide
factor. loop avoidance at the edge and retains split horizon
Lasserre proposed two different architectures, Ethernet forwarding for the core network.
Edge Hierarchical VPLS (EE-H-VPLS) and MPLS Edge It can be seen in figure 8 that a loop exists between N-
PE1 and N-PE3. There are two active PWs between them, In the third solution, the pseudo-N-PE is achieved by
one is on the direct Ethernet link (for redundant configuring each redundant pair of N-PEs with the same
connectivity) and the other one is on MPLS core. If a IP address that is used for LDP peering purposes [20].
broadcast frame is forwarded from U-PE A, N-PE1 will There is only one PW between the pseudo-N-PE in the
forward the frame to all ports associated with the VSI. MPLS network, figure 11. The rest of N-PES do not
Two copies of the broadcast frame will then be received receive o transmit any traffic to the MPLS network. We
by N-PE3, one on the direct link and another on the PW change the MPLS network topology from full mesh to
across the MPLS network. The frame received by the PW point to point.
is then forwarded on the Ethernet ports and the frame The BPDUs cannot be forwarded across MPLS network
received by direct trunk is forwarded to the rest of the and the STP is autonomous in each access network. If a
ports and PW associated with the VSI. Although this MPLS interface fails the LDP sessions will be re-
sounds like a violation of the split horizon, it conforms to established with the standby N-PE, figure 12. The
the rule as the broadcast is received on two different drawback is that the standby N-PE cannot be active at the
interfaces. This operation causes two loops. There are also same time.
two similar loops between N-PE2 and N-PE4, figure 8.
The loop avoidance characteristics of EE-H-VPLS are
complicated by the different mechanism used at edge and N-PE 1 N-PE 2
core networks and their interactions. In order to break the U-PE A (root) (root)
loops within the network there are three solutions that F F
may be considered: F
F U-PE C
1. Disable the STP at the N-PEs and forward BPDUs F F F F
frames transparently.
2. Use the STP and packet filtering to constrain data F F F F F
traffic. F
B F
3. Use IP addressing and routing protocol policies to
constrain the forwarding topology. U-PE B N-PE 3 N-PE 4
The first option has the disadvantage of extending the
spanning tree topologies and reducing the scalability of Local STP MPLS Clouds Local STP
the VPLS network, so is not considered. Domain No BPDUs Passed Domain

The second solution filter frames on direct Ethernet link, Figure 10. Loops with direct link in a EE-H-VPLS
figure 9. However, as spanning tree will still be required
to block U-PE interfaces (and so as not to introduce Directed LDP
another loop), BPDUs must be allowed across the direct Session
Pseudo
link. Pseudo
n-PE 1 N-PE 1 N-PE 2 n-PE 2
Filter everything U-PE A root root
N-PE 1 N-PE 2 but BPDUs
U-PE A (root) (root) F F F F
F
F F F U-PE C
B F F F
F
B F F F F U-PE C
F F F F B
F F F F B F
B F
B
F
F
U-PE B N-PE 3 N-PE 4
U-PE B N-PE 3 N-PE 4
Local STP MPLS core Local STP
Local STP MPLS Clouds Local STP Domain No BPDUs Passed Domain
Domain No BPDUs Passed Domain
Figure 11. EE-H-VPLS Pseudo-N-PE redundacy.
Figure 9. Filtering solution in a EE-H-VPLS architecture.

If a U-PE loses its primary link to N-PE1, the U-PE will


unblock it’s previously blocked port and normal
forwarding will follow. The drawback of this solution is
that the direct link must always be active and forwarding
or a loop will occur via one of the U-PE edge devices,
figure 10.
Directed LDP References
Session
Pseudo [1] IEEE 802 LAN/MAN Standards Committee “Virtual
N-PE 1 N-PE 2 Pseudo
n-PE 1
n-PE 2
Bridged Local Area Networks: Provider Bridges”,
U-PE A root root IEEE 802.1ad.
F F [2] Layer 2 Virtual Private Networks (l2vpn), IETF
F working group,
B F F F F U-PE C
F http://www.ietf.org/html.charters/l2vpn-charter.html
[3] Metro Ethernet Services- A Technical Overview,
F B http://www.metroethernetforum.org.
F F F F

B
F [4] L. Zier, W. Fischer, F. Brockners “Ethernet-Based
F
Public Communication Services: Challenge and
U-PE B N-PE 3 N-PE 4 Opportunity”, IEEE Communication Magazine,
March 2004.
Local STP MPLS core Local STP
Domain No BPDUs Passed Domain [5] IEEE 802 LAN/MAN Standards Committee “Virtual
bridged local area networks” IEEE 802.1Q
Figure 12. Fail at the core network in EE-H-VPLS Pseudo- [6] M. Holness, “Bridging Solution for the MAN:
N-PE.
Service Separation,
EE-H-VPLS described within [13] is compatible with the www.ieee802.org/1/files/public/docs2002
proposed architecture and operation of IEEE 802.1ad [7] G. Chiruvolu et al., “Issues and Approaches on
bridges. Extending Ethernet Beyond LANs”. IEEE
H-VPLS comparation Communication Magazine, March 2004.
In a ME-H-VPLS, the U-PE must support, label [8] IEEE 802 LAN/MAN Standards Committee “Media
operations, LSP setup, IP routing protocol, autodiscovery. Access Control (MAC) bridges” IEEE 802.1D.
In the EE-H-VPLS, the edge device can be a standard [9] Nortel Networks “Service delivery technologies for
Ethernet switch (VLAN, STP, 802.1x security Metro Ethernet” White Paper.
authentication, traffic policing and buffer management) [10] A. Sodder “Hierarchical LAN services”,
that allow the Ethernet handle transport characteristics, www.802.org, January 2003.
such as redundancy, QoS and security. The Ethernet [11] Cisco System “Metro Ethernet WAN Services and
switch option is cheaper than U-PE due to productions Arquitectures”. White paper 2002.
cost and the cost to support MPLS and associated MPLS [12] V. Alwayn, “Advanced MPLS Design and
signalling. Implementation”. Cisco Press, September 2001.
[13] M. Lasserre et al., “Virtual Private LAN Services
over MPLS”http://www.ietf.org/html.charters/l2vpn-
Conclusions charter.html June, 2003.
In this article we have discussed several provider network [14] L. Martini et al., “Encapsulation Methods for
architectures to offer L2VPN services. Initially, two kind Transport of Layer 2 Frames Over IP and MPLS
of network architectures can be distinguished. One based Networks” www.ietf.org/internet-drafts/ draft-
on Ethernet bridges technology and other based on MPLS martini-l2circuit-encap-mpls-05.txt, April 2003.
technology. [15] Cisco System “Virtual Private LAN Service
Most of the Ethernet technologies are currently being Architectures and Operation”. White paper 2004.
investigated by the standardization bodies and are [16] H. Ould-Brahim, et al., “Using BGP as an Auto-
applicable to a bridged provider network. These Discovery Mechanism for Layer-3 and Layer-2
technologies can also be combined in a hierarchical VPNs” draft-ietf-l3vpn-bgpvpn-auto-04.txt March
network to improve its performance. 2004.
We have studied MPLS technology to deploy LAN [17] Andersson et al. "Label Distribution Protocol
services, based on VPLS. Several drafts have been Specification", RFC 3036. January 2001
proposed to the IETF that deliver VPLS capabilities, [18] L. Martini et al., “Transport of Layer 2 Frames Over
although some of them are not compatible. We have MPLS” www.ietf.org/internet-drafts/draft-martini-
presented the Lasserre draft that has most vendor support. l2circuit-trans-mpls-11.txt, April 2003.
Lassarre describe a flat VPLS architecture, and two [19] dsniff, http://naughty.monkey.org/~dugsong/dsniff/
hierarchical VPLS architectures, one uses an access [20] F. Brockners, N. Finn, S. Philips, “Metro Ethernet-
network based on IEEE bridges network while the other Deploying the extended Campus using Ethernet
one is based on a MPLS network. We have also studied Technology”, (LCN’03) 2003.
their forwarding and loop avoidance mechanisms.
In the near future most of these technologies may coexist,
so interworking issues must also be studied.

View publication stats

You might also like