RFC 2685

Network Working Group RFC 2685 💖

okay so this is RFC 2685, called Virtual Private Networks Identifier 🦋 It's a Standards Track doc from September 1999 and it's written by Barbara A. Fox (Lucent Technologies) and Bryan Gleeson (Nortel Networks), both from the Network Working Group. The header doesn't list anything it obsoletes or updates, so it's standing on its own, bestie ✨

---

Status of this Memo

this is an Internet standards track protocol for the Internet community, and it's literally asking people to discuss it and suggest improvements 🫶 If you want the official standardization state, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸

Copyright Notice

Copyright (C) The Internet Society (1999). All Rights Reserved. 💜

Abstract

okay so Virtual Private IP networks can span multiple Autonomous Systems or Service Providers 🌈 That means we need a globally unique VPN identifier so we can point at one specific VPN (see section 6.1.1 of [1]). This document proposes a format for exactly that 🧚

1. Introduction ✨

the Public Internet is expanding its infrastructure everywhere, so everyone is obsessed with IP based Virtual Private Networks 😭 A VPN basically copies a private IP network on top of public or shared infrastructure. It's a win for both the Service Provider and its customers 💅 For customers, a VPN can stretch a corporate site's IP stuff out to remote offices and/or users, with intranet, extranet, and dialup services. The vibe is lower cost, with savings in capital equipment, operations, and services 🤑 The Service Provider gets to make better use of its infrastructure and its network admin skills by offering IP VPN connectivity and/or services to customers 🔥

there are loads of ways to build IP VPN services. The IP based VPN framework document [1] names four types of VPN to support: Virtual Leased Lines, Virtual Private Routed Networks, Virtual Private Dial Networks, and Virtual Private LAN Segments 🎀 There are also a bunch of drafts and white papers describing how Service Providers and/or their customers can do this. Solutions can be customer based or network based. Network based ones can give connectivity and services at layer 2 and/or layer 3. The gear involved can be Customer Premises Equipment (CPE), Service Provider Edge equipment, Service Provider Core equipment, or some mix of those 💖

while everyone's still debating the different ways to build VPN service, there are two things everyone agrees on 👑

• Because a VPN is private, it may use a private address space which may overlap with the address space of another VPN or the Public Internet.
• A VPN may span multiple IP Autonomous Systems (AS) or Service Providers.

the first point means an IP address only makes sense inside the VPN it lives in 🍓 So we need a way to identify the VPN where a particular IP address has meaning, which is its "scope" 🦋

the second point means several VPN methods might be used together to serve one VPN. Different providers pick different strategies based on their infrastructure and expertise 💅 It would be super useful to identify any particular VPN at any layer and at any location where it exists, using the same VPN identifier 🌈

2. Global VPN Identifier ✨

a VPN-ID exists to identify a VPN 💜 How you use it depends on how you implement the VPN service. For example, the VPN-ID may be included:

• In a MIB to configure attributes to a VPN, or to assign a physical or logical access interface to a particular VPN.
• In a control or data packet, to identify the "scope" of a private IP address and the VPN to which the data belongs.

it's necessary to be able to tell which VPN a data packet belongs to 🙈 The VPN-ID can make that link either explicitly (e.g. by including the VPN-ID in an encapsulation header [2]) or implicitly (e.g. by including the VPN-ID in an ATM signalling exchange [3]). Using the VPN-ID in other contexts needs to be carefully evaluated, so don't just wing it 💀

the VPN identifier can also do another really important job 👑 It can define the "VPN authority", which is the one responsible for coordinating the connectivity and services that the VPN uses. The VPN authority might be the Private Network administrator or the primary Service Provider. It administers the VPN and is the main point of contact for it 🫶 The authority can outsource some functions and connectivity, set up contracts with the different Service Providers involved, and coordinate configuration, performance, and fault management 🔥

all of this needs a VPN that's global in scope and usable across different solutions 🌸 To be truly global, the format can't force assumptions about the shared network(s). But on the flip side, the format shouldn't be defined in a way that stops you from using features of the shared network. It's also worth noting that the same VPN might be identified at different layers of the same shared network, e.g. ATM and IP layers. The same VPN-ID format and value should apply at both layers 🧚

how you use VPN-IDs is outside the scope of this memo 🍓

3. Global VPN Identifier Format Requirements 🎀

the VPN Identifier format should meet these requirements:

• Provide a globally unique VPN Identifier usable across multiple Service Providers.
• Enable support of a non-IP dependent VPN-ID for use in layer 2 VPNs.
• Identify the VPN Authority within the VPN Identifier.

4. Global VPN Identifier Format 💅

the global VPN Identifier format is 🌈

   3 octet VPN authority Organizationally Unique Identifier [4]

   followed by

   4 octet VPN index identifying VPN according to OUI

and the layout looks like this 🦋

   0 1 2 3 4 5 6 7 8
   +-+-+-+-+-+-+-+-+
   | VPN OUI (MSB) |
   +-+-+-+-+-+-+-+-+
   |   VPN OUI     |
   +-+-+-+-+-+-+-+-+
   | VPN OUI (LSB) |
   +-+-+-+-+-+-+-+-+
   |VPN Index (MSB)|
   +-+-+-+-+-+-+-+-+
   |  VPN Index    |
   +-+-+-+-+-+-+-+-+
   |  VPN Index    |
   +-+-+-+-+-+-+-+-+
   |VPN Index (LSB)|
   +-+-+-+-+-+-+-+-+

the VPN OUI (IEEE 802-1990 Organizationally Unique Identifier) [4] identifies the VPN authority 💖 That authority is the primary VPN administrator. It can be the company or organization the VPN belongs to, or a Service Provider that runs the underlying infrastructure over its own and/or other providers' shared networks ✨ The 4 octet VPN Index then picks out a particular VPN that the VPN authority serves 👑

5. Security Considerations 💀

okay this part is important, bestie 🚨 This document defines the format of the global VPN identifier without specifying how it's used. But attaching particular characteristics and capabilities to a VPN identifier means you need standard security procedures for whatever usage you pick 🔒 Misconfiguration or deliberate forging of a VPN identifier may result in different security breaches, including the interconnection of different VPNs 😭 Not cute, so take it seriously 🫶

6. References 🌈

[1] Gleeson, Heinanen, Lin, Armitage, Malis, "A Framework for IP Based Virtual Private Networks", Work in Progress.

[2] Grossman, D. and J. Heinanen, "Multiprotocol Encapsulation over ATM Adaptation Layer 5", RFC 2684, September 1999.

[3] "MPOA v1.1 Addendum on VPN Support", ATM Forum, af-mpoa-0129.000, August, 1999, Bernhard Petri, editor, final ballot document.

[4] http://standards.ieee.org/regauth/oui/index.html

7. Authors' Addresses 🧚

Barbara A. Fox
Lucent Technologies
300 Baker Ave, Suite 100
Concord, MA  01742-2168

Phone: +1-978-287-2843
EMail: barbarafox@lucent.com


Bryan Gleeson
Nortel Networks
4500 Great America Parkway,
Santa Clara, CA  95054

Phone: +1-408-855-3711
EMail: bgleeson@shastanets.com

8. Full Copyright Statement 💜

Copyright (C) The Internet Society (1999). All Rights Reserved. 🌸

you're allowed to copy and share this document, and to make derivative works that comment on it, explain it, or help implement it. You can publish and distribute them, in whole or in part, with no restrictions, as long as the copyright notice and this paragraph are on every copy and derivative work 🫶 But the document itself can't be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. The exception is when you need it for developing Internet standards, which has to follow the copyright procedures in the Internet Standards process, or when you're translating it into a language other than English 🦋

the permissions above last forever and won't be revoked by the Internet Society or its successors or assigns 💖

this document and the info in it is provided on an "AS IS" basis, and the Internet Society and the Internet Engineering Task Force say this, no cap 💅

THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement ✨

funding for the RFC Editor function is currently provided by the Internet Society 🎀