RFC 2764
A Framework for IP Based Virtual Private Networks
RFC 2764: A Framework for IP Based Virtual Private Networks 🎀
- Series: Network Working Group 🌸
- Authors: B. Gleeson and A. Lin (Nortel Networks), J. Heinanen (Telia Finland), G. Armitage and A. Malis (Lucent Technologies) 👑
- Category: Informational 💅
- Date: February 2000 🍓
- Obsoletes / Updates: The header doesn't list anything this one obsoletes or updates ✨
Status of this Memo 🧚
okay so this memo is purely informational 💅 It's here to inform the Internet community, and it does not specify an Internet standard of any kind. Distribution of this memo is unlimited, so share it with your whole group chat 💖
Copyright Notice 🌈
Copyright (C) The Internet Society (2000). All Rights Reserved. 🔒
IESG Note 🫶
bestie, this document is not the product of an IETF Working Group 🙈 The IETF doesn't currently have any effort underway to standardize a specific VPN framework, so this is more of a big-picture map than a finished rulebook 🗺️
Abstract 🦋
this doc is a framework for Virtual Private Networks (VPNs) running across IP backbones ✨ It talks through the different kinds of VPNs, what each one needs, and some specific mechanisms that could build each type using existing or proposed specs 🔧 The whole goal is to act as a framework for future protocol work, so the full set of specs needed for widespread, interoperable VPN solutions can actually get built 🌟
Table of Contents 💜
1.0 Introduction ................................................ 4
2.0 VPN Application and Implementation Requirements ............. 5
2.1 General VPN Requirements .................................... 5
2.1.1 Opaque Packet Transport: ................................. 6
2.1.2 Data Security ............................................. 7
2.1.3 Quality of Service Guarantees ............................. 7
2.1.4 Tunneling Mechanism ....................................... 8
2.2 CPE and Network Based VPNs .................................. 8
2.3 VPNs and Extranets .......................................... 9
3.0 VPN Tunneling ............................................... 10
3.1 Tunneling Protocol Requirements for VPNs .................... 11
3.1.1 Multiplexing .............................................. 11
3.1.2 Signalling Protocol ....................................... 12
3.1.3 Data Security ............................................. 13
3.1.4 Multiprotocol Transport ................................... 14
3.1.5 Frame Sequencing .......................................... 14
3.1.6 Tunnel Maintenance ........................................ 15
3.1.7 Large MTUs ................................................ 16
3.1.8 Minimization of Tunnel Overhead ........................... 16
3.1.9 Flow and congestion control ............................... 17
3.1.10 QoS / Traffic Management ................................. 17
3.2 Recommendations ............................................. 18
4.0 VPN Types: Virtual Leased Lines ............................ 18
5.0 VPN Types: Virtual Private Routed Networks ................. 20
5.1 VPRN Characteristics ........................................ 20
5.1.1 Topology .................................................. 23
5.1.2 Addressing ................................................ 24
5.1.3 Forwarding ................................................ 24
5.1.4 Multiple concurrent VPRN connectivity ..................... 24
5.2 VPRN Related Work ........................................... 24
5.3 VPRN Generic Requirements ................................... 25
5.3.1 VPN Identifier ............................................ 26
5.3.2 VPN Membership Information Configuration .................. 27
5.3.2.1 Directory Lookup ........................................ 27
5.3.2.2 Explicit Management Configuration ....................... 28
5.3.2.3 Piggybacking in Routing Protocols ....................... 28
5.3.3 Stub Link Reachability Information ........................ 30
5.3.3.1 Stub Link Connectivity Scenarios ........................ 30
5.3.3.1.1 Dual VPRN and Internet Connectivity ................... 30
5.3.3.1.2 VPRN Connectivity Only ................................ 30
5.3.3.1.3 Multihomed Connectivity ............................... 31
5.3.3.1.4 Backdoor Links ........................................ 31
5.3.3.1 Routing Protocol Instance ............................... 31
5.3.3.2 Configuration ........................................... 33
5.3.3.3 ISP Administered Addresses .............................. 33
5.3.3.4 MPLS Label Distribution Protocol ........................ 33
5.3.4 Intra-VPN Reachability Information ........................ 34
5.3.4.1 Directory Lookup ........................................ 34
5.3.4.2 Explicit Configuration .................................. 34
5.3.4.3 Local Intra-VPRN Routing Instantiations ................. 34
5.3.4.4 Link Reachability Protocol .............................. 35
5.3.4.5 Piggybacking in IP Backbone Routing Protocols ........... 36
5.3.5 Tunneling Mechanisms ...................................... 36
5.4 Multihomed Stub Routers ..................................... 37
5.5 Multicast Support ........................................... 38
5.5.1 Edge Replication .......................................... 38
5.5.2 Native Multicast Support .................................. 39
5.6 Recommendations ............................................. 40
6.0 VPN Types: Virtual Private Dial Networks ................... 41
6.1 L2TP protocol characteristics ............................... 41
6.1.1 Multiplexing .............................................. 41
6.1.2 Signalling ................................................ 42
6.1.3 Data Security ............................................. 42
6.1.4 Multiprotocol Transport ................................... 42
6.1.5 Sequencing ................................................ 42
6.1.6 Tunnel Maintenance ........................................ 43
6.1.7 Large MTUs ................................................ 43
6.1.8 Tunnel Overhead ........................................... 43
6.1.9 Flow and Congestion Control ............................... 43
6.1.10 QoS / Traffic Management ................................. 43
6.1.11 Miscellaneous ............................................ 44
6.2 Compulsory Tunneling ........................................ 44
6.3 Voluntary Tunnels ........................................... 46
6.3.1 Issues with Use of L2TP for Voluntary Tunnels ............. 46
6.3.2 Issues with Use of IPSec for Voluntary Tunnels ............ 48
6.4 Networked Host Support ...................................... 49
6.4.1 Extension of PPP to Hosts Through L2TP .................... 49
6.4.2 Extension of PPP Directly to Hosts: ...................... 49
6.4.3 Use of IPSec .............................................. 50
6.5 Recommendations ............................................. 50
7.0 VPN Types: Virtual Private LAN Segment ..................... 50
7.1 VPLS Requirements ........................................... 51
7.1.1 Tunneling Protocols ....................................... 51
7.1.2 Multicast and Broadcast Support ........................... 52
7.1.3 VPLS Membership Configuration and Topology ................ 52
7.1.4 CPE Stub Node Types ....................................... 52
7.1.5 Stub Link Packet Encapsulation ............................ 53
7.1.5.1 Bridge CPE .............................................. 53
7.1.5.2 Router CPE .............................................. 53
7.1.6 CPE Addressing and Address Resolution ..................... 53
7.1.6.1 Bridge CPE .............................................. 53
7.1.6.2 Router CPE .............................................. 54
7.1.7 VPLS Edge Node Forwarding and Reachability Mechanisms ..... 54
7.1.7.1 Bridge CPE .............................................. 54
7.1.7.2 Router CPE .............................................. 54
7.2 Recommendations ............................................. 55
8.0 Summary of Recommendations .................................. 55
9.0 Security Considerations ..................................... 56
10.0 Acknowledgements ........................................... 56
11.0 References ................................................. 56
12.0 Author Information ......................................... 61
13.0 Full Copyright Statement ................................... 621.0 Introduction ✨
okay so bestie, this doc is a framework for VPNs (virtual private networks) running across IP backbones 🦋 It breaks down the different types of VPNs, what each one needs, and proposes specific mechanisms to build each type using specs that already exist or are being proposed. The goal is to set up the protocol work so we can get the full set of specs needed for VPNs that are widely deployed AND interoperable 💅
So there's huge interest in running VPNs across IP backbone facilities, right? But the widespread deployment has been held back by a lack of interoperable implementations 😭 And that comes from two things: nobody has agreed on what a VPN actually is and what it covers, and there's a whole pile of different solutions that all get called "VPN." Here, a VPN is simply defined as the 'emulation of a private Wide Area Network (WAN) facility using IP facilities' (including the public Internet, or private IP backbones) 🌐 And honestly? That's why the confusion is so real. There are as many types of VPNs as there are types of WANs, so no wonder everyone's talking past each other 💀
In this document, a VPN is modeled as a connectivity object. Hosts can attach to a VPN, and VPNs can be interconnected together, the same way hosts attach to physical networks and physical networks get interconnected (e.g., via bridges or routers) 🧚 Addressing, forwarding mechanism, learning and advertising reachability, quality of service (QoS), security, and firewalling all have common solutions across both physical and virtual networks. A ton of the issues you hit with VPNs have direct analogues in physical networks too. Introducing VPNs does not mean reinventing networking or inventing brand new paradigms with no physical-network equivalent. The move is to look at how a problem gets handled in a physical network first, then apply that same principle to an environment that has both virtual and physical networks, and build extensions and enhancements only when they're actually needed ✨ Having shared mechanisms across both worlds makes it way easier to bring VPNs into existing networks, and it cuts down on the effort for standards and product development because existing solutions can be leveraged 🫶
This framework document lays out a taxonomy of a specific set of VPN types, showing what each one is used for, what it requires, and what kinds of mechanisms are most appropriate to implement it 🎀 The whole point is to be a framework that guides a coherent conversation about which changes to existing IP mechanisms might be needed to build a full range of interoperable VPN solutions 💖
The doc starts by looking at what customers will probably expect from any type of VPN, and what those expectations mean for how VPNs get implemented. It also looks at the difference between Customer Premises Equipment (CPE) based solutions and network based solutions 🌸 After that, it presents the taxonomy of VPN types and their requirements. Finally, it outlines suggested approaches to implementing them, which points to areas for future standardization 🔥
Also, this document only covers VPN implementations across IP backbones, whether those are private IP networks or the public Internet 🌈 The models and mechanisms here are meant to apply to both IPV4 and IPV6 backbones. It specifically does not cover building VPNs with native mappings onto switched backbones, e.g., VPNs built using the LAN Emulation over ATM (LANE) [1] or Multiprotocol over ATM (MPOA) [2] protocols running over ATM backbones 🙈 Where IP backbones are built using those protocols by interconnecting routers over the switched backbone, the VPNs discussed here run on top of that IP network, and they don't directly use the native mechanisms of the underlying backbone. Native VPNs are limited to the scope of their underlying backbone, while IP based VPNs can stretch as far as IP reachability goes ⭐ Native VPN protocols are clearly outside the scope of the IETF and could be tackled by bodies like the ATM Forum 💜
2.0 VPN Application and Implementation Requirements
2.1 General VPN Requirements
There's a growing interest in using IP VPNs as a more cost effective way to build and deploy private communication networks for multi-site communication than the existing approaches 💅
Existing private networks generally fall into two types 🧚 The first is dedicated WANs, which permanently connect multiple sites together. The second is dial networks, which allow on-demand connections through the Public Switched Telephone Network (PSTN) to one or more sites in the private network.
WANs are typically built with leased lines or dedicated circuits between the multiple sites, like Frame Relay or ATM connections 🦋 CPE routers or switches at the various sites connect these dedicated facilities together and allow connectivity across the network. Because dedicated facilities cost a lot and are complicated, and because CPE device configuration is complicated too, these networks are usually not fully meshed. They tend to have some form of hierarchical topology instead. For example, remote offices could connect directly to the nearest regional office, and the regional offices could be connected together in some form of full or partial mesh 🌸
Private dial networks let remote users connect into an enterprise network using PSTN or Integrated Services Digital Network (ISDN) links 📞 Usually this is done by deploying Network Access Servers (NASs) at one or more central sites. Users dial into those NASs, which work with Authentication, Authorization, and Accounting (AAA) servers to verify who the user is and what set of services they're authorized to receive 🔐
Lately, as more businesses need high speed Internet connections to their private corporate networks, there's been serious interest in deploying CPE based VPNs running across the Internet 🔥 This is mostly driven by how ubiquitous Internet services are and how their pricing doesn't depend on distance, which can make it significantly cheaper than typical dedicated or leased line services 💸
The idea of using the Internet for private communications isn't new 🙈 Plenty of techniques, like controlled route leaking, have been used for this purpose [3]. But only recently have the appropriate IP mechanisms needed to meet customer requirements for VPNs all come together. Those requirements include the following 👑
2.1.1 Opaque Packet Transport:
The traffic carried within a VPN may have no relation to the traffic on the IP backbone 🎀 That can happen either because the traffic is multiprotocol, or because the customer's IP network uses IP addressing that's unrelated to the addressing of the IP backbone the traffic is transported over. In particular, the customer's IP network may use non-unique, private IP addressing [4] 🫶
2.1.2 Data Security
Customers using VPNs generally need some form of data security, and there are different trust models for how VPNs get used 🔒 In one model, the customer doesn't trust the service provider to provide any form of security. Instead, the customer builds the VPN using CPE devices that implement firewall functionality and that are connected together using secure tunnels. In this case, the service provider is used purely for IP packet transport 🚚
The alternative model is where the customer trusts the service provider to provide a secure managed VPN service 💖 This is kind of like the trust involved when a customer uses a public switched Frame Relay or ATM service. The customer trusts that packets won't be misdirected, injected into the network in an unauthorized manner, snooped on, modified in transit, or subjected to traffic analysis by unauthorized parties 👀
With this model, providing firewall functionality and secure packet transport is the service provider's job 💅 Different levels of security may be needed within the provider backbone, depending on the deployment scenario. If the VPN traffic is contained within a single provider's IP backbone, then strong security mechanisms, such as those provided by the IP Security protocol suite (IPSec) [5], may not be necessary for tunnels between backbone nodes. If the VPN traffic traverses networks or equipment owned by multiple administrations, then strong security mechanisms may be appropriate. A provider may also apply a strong level of security to customer traffic to address a customer perception that IP networks, and particularly the Internet, are insecure. Whether or not that perception is correct, it's one that the VPN implementation must address 😭
2.1.3 Quality of Service Guarantees
Beyond communication privacy, existing private networking techniques, which build on physical or link layer mechanisms, also offer various types of quality of service guarantees ⭐ Leased and dial up lines offer both bandwidth and latency guarantees, and dedicated connection technologies like ATM and Frame Relay have extensive mechanisms for similar guarantees 🌈 As IP based VPNs get more widely deployed, there will be market demand for similar guarantees, so that end to end application transparency is maintained 🦋 The ability of IP based VPNs to offer those guarantees depends heavily on the matching capabilities of the underlying IP backbones. Still, a VPN framework also has to address how VPN systems can use those capabilities as they evolve 🧚
2.1.4 Tunneling Mechanism
Taken together, the first two requirements listed above imply that VPNs must be implemented through some form of IP tunneling mechanism 🎀 In that setup, the packet formats and/or the addressing used within the VPN can be unrelated to the addressing used to route the tunneled packets across the IP backbone. Depending on their form, such tunnels can provide some level of intrinsic data security, or that security can be enhanced using other mechanisms (e.g., IPSec) 🔐
As discussed later, tunneling mechanisms can also be mapped into evolving IP traffic management mechanisms 💜 There are already a large number of IP tunneling mechanisms defined, and some of them are well suited to VPN applications, as discussed in section 3.0 ✨
Keep going, next up is Section 3.0! 🌈
2.2 CPE and Network Based VPNs 💅
okay so most VPNs you've ever touched are CPE based 🎀, meaning the VPN lives on the customer premises equipment. VPN features are getting baked into all kinds of CPE gear, from firewalls to WAN edge routers to super specialized VPN termination boxes 🧚. Customers can buy and deploy this stuff themselves, or service providers can deploy it (and often remotely manage it) as an outsourcing service 🫶.
Then there's the network based VPN era 🌈, where the whole VPN operation gets outsourced to an Internet Service Provider (ISP) and runs inside the network instead of on CPE gear. Literally everyone is obsessed with this: customers want to cut their support costs, and ISPs are hunting for new revenue ✨. Doing VPNs in the network means you can use certain mechanisms that are super efficient and cost effective, since the common equipment and operations support gets amortized across tons of customers 🔥.
Most of the mechanisms we're about to talk about can apply to either CPE based or network based VPNs 🦋. Lowkey though, some mechanisms will only be applicable to the network based ones, because they use tools (e.g., piggybacking on routing protocols) that only ISPs can access. Customers basically never get those tools, and they're not even going to be hosted on ISP owned and operated CPE, because it's messy trying to co-manage that gear between the ISP and the customer 💀. This doc will flag which techniques are likely to apply only to network based VPNs 💜.
2.3 VPNs and Extranets 🌸
An extranet is when two or more companies get networked access to a limited chunk of each other's corporate data 🍓. For example, a manufacturing company might let its suppliers query databases for the pricing and availability of components, and then order and track the status of outstanding orders 📦. Another example is joint software development: company A lets one development group within company B access its operating system source code, and company B lets one development group in company A access its security software 👩💻. The access policies can get arbitrarily complex 🙈. For example, company B may internally restrict access to its security software to groups in certain geographic locations to comply with export control laws, for example.
So the big feature of an extranet is controlling who can access what data, and that's essentially a policy decision 👑. Policy decisions are typically enforced today at the interconnection points between different domains, like between a private network and the Internet, or between a software test lab and the rest of the company network 🔒. The enforcement can be done via a firewall, a router with access list functionality, an application gateway, or any similar device capable of applying policy to transit traffic 🛡️. Policy controls can also be implemented within a corporate network, not just between corporate networks 💅. The interconnections can be a set of bilateral links, or a separate network perhaps maintained by an industry consortium, and that separate network could itself be a VPN or a physical network 🌐.
Introducing VPNs into a network doesn't change this model at all ✨. Policy can be enforced between two VPNs, or between a VPN and the Internet, in exactly the same way it's done today without VPNs 🫶. For example, two VPNs could be interconnected, with each administration locally imposing its own policy controls via a firewall on all traffic that enters its VPN from the outside, whether from another VPN or from the Internet 🔥.
This model of a VPN separates policy from the underlying mode of packet transport used 👑. For example, a router may direct voice traffic to ATM Virtual Channel Connections (VCCs) for guaranteed QoS, non-local internal company traffic to secure tunnels, and other traffic to a link to the Internet 🎀. Back in the past, the secure tunnels may have been frame relay circuits, but now they may also be secure IP tunnels or MPLS Label Switched Paths (LSPs) 🦋.
Other models of a VPN are also possible 💖. For example, there's a model where a set of application flows is mapped into a VPN. Since the policy rules a network administrator imposes can get quite complex, the number of distinct sets of application flows used in the policy rulebase (and therefore the number of VPNs) can grow quite large, and there can be multiple overlapping VPNs 😭. But there's honestly little to be gained by introducing that kind of new complexity into a network 🙅. Instead, a VPN should be viewed as a direct analogue to a physical network 💜, because that lets you leverage existing protocols and procedures, plus the current expertise and skill sets of network administrators and customers 🧚.
3.0 VPN Tunneling 🌈
As noted above in section 2.1, VPNs must be implemented using some form of tunneling mechanism 🔥. This section looks at the generic requirements for such VPN tunneling mechanisms 👀. A number of characteristics and aspects common to any link layer protocol are taken and compared with the features offered by existing tunneling protocols 💅. This provides a basis for comparing different protocols, and it's also useful for highlighting areas where existing tunneling protocols could level up with extensions to better support their operation in a VPN environment 🚀.
An IP tunnel connecting two VPN endpoints is a basic building block from which a variety of VPN services can be constructed 🧱. An IP tunnel operates as an overlay across the IP backbone, and the traffic sent through the tunnel is opaque to that backbone 🙈. In effect, the IP backbone is being used as a link layer technology, and the tunnel forms a point-to-point link 🔗.
A VPN device may terminate multiple IP tunnels and forward packets between these tunnels and other network interfaces in different ways 🦋. In the discussion of different types of VPNs in later sections, the primary thing that distinguishes these types is the manner in which packets are forwarded between interfaces (e.g., bridged or routed) ✨. There's a direct analogy with how existing networking devices are characterized today 💜. A two-port repeater just forwards packets between its ports and doesn't examine the contents of the packet 🔁. A bridge forwards packets using Media Access Control (MAC) layer information contained in the packet, while a router forwards packets using layer 3 addressing information contained in the packet 🗺️. Each of these three scenarios has a direct VPN analogue, as discussed later 🎀. Note that an IP tunnel is viewed as just another sort of link, which can be concatenated with another link, bound to a bridge forwarding table, or bound to an IP forwarding table, depending on the type of VPN 💖.
The following sections look at the requirements for a generic IP tunneling protocol that can be used as a basic building block to construct different types of VPNs 🧁.
3.1 Tunneling Protocol Requirements for VPNs 🍓
There are numerous IP tunneling mechanisms, including IP/IP [6], Generic Routing Encapsulation (GRE) tunnels [7], Layer 2 Tunneling Protocol (L2TP) [8], IPSec [5], and Multiprotocol Label Switching (MPLS) [9] 🧚. Note that while some of these protocols aren't often thought of as tunneling protocols, they do each allow for opaque transport of frames as packet payload across an IP network, with forwarding disjoint from the address fields of the encapsulated packets 🫶.
There's one significant distinction between each of the IP tunneling protocols mentioned above and MPLS though 👑. MPLS can be viewed as a specific link layer for IP, insofar as MPLS specific mechanisms only apply within the scope of an MPLS network, whereas IP based mechanisms extend to the extent of IP reachability 🌐. So VPN mechanisms built directly upon MPLS tunneling mechanisms can't, by definition, extend outside the scope of MPLS networks 😭, any more than ATM based mechanisms such as LANE can extend outside of ATM networks. Note however that an MPLS network can span many different link layer technologies, so like an IP network, its scope isn't limited by the specific link layers used 💅. A number of proposals for defining a set of mechanisms to allow for interoperable VPNs specifically over MPLS networks have also been produced ([10] [11] [12] [13], [14] and [15]) ✨.
There are a number of desirable requirements for a VPN tunneling mechanism, though, and they aren't all met by the existing tunneling mechanisms 🙈. These requirements include:
3.1.1 Multiplexing 🦋
There are cases where multiple VPN tunnels may be needed between the same two IP endpoints 💖. This may be needed, for instance, when the VPNs are network based and each endpoint supports multiple customers 🏢. Traffic for different customers travels over separate tunnels between the same two physical devices 👯. A multiplexing field is needed to distinguish which packets belong to which tunnel 🔑. Sharing a tunnel in this manner may also reduce the latency and processing burden of tunnel setup ⚡. Of the existing IP tunneling mechanisms, L2TP (via the tunnel-id and session-id fields), MPLS (via the label) and IPSec (via the Security Parameter Index (SPI) field) have a multiplexing mechanism 🎀. Strictly speaking, GRE does not have a multiplexing field 🤓. However, the key field, which was intended to be used for authenticating the source of a packet, has sometimes been used as a multiplexing field 😳. IP/IP does not have a multiplexing field 💀.
The IETF [16] and the ATM Forum [17] have standardized on a single format for a globally unique identifier used to identify a VPN (a VPN-ID) 🌍. A VPN-ID can be used in the control plane, to bind a tunnel to a VPN at tunnel establishment time, or in the data plane, to identify the VPN associated with a packet on a per-packet basis 🧭. In the data plane, a VPN encapsulation header can be used by MPLS, MPOA and other tunneling mechanisms to aggregate packets for different VPNs over a single tunnel 📦. In this case, an explicit indication of VPN-ID is included with every packet, and no use is made of any tunnel specific multiplexing field 🙅. In the control plane, a VPN-ID field can be included in any tunnel establishment signalling protocol to allow for the association of a tunnel (e.g., as identified by the SPI field) with a VPN 🤝. In this case, there's no need for a VPN-ID to be included with every data packet 🥳. This is discussed further in section 5.3.1 🦋.
3.1.2 Signalling Protocol ✨
Okay so, before a tunnel can even exist, each end point needs some setup info already in hand 📝. That means the IP address of the remote end point and any tunnel attributes it needs, like how much security it wants 🔐. Once you've got that info, the tunnel can actually get built in one of two ways: a management operation, or a signalling protocol that sets tunnels up dynamically 🦋.
An example of a management operation is using an SNMP Management Information Base (MIB) to configure the tunneling parameters 🛠️. Think MPLS labels, source addresses for IP/IP or GRE tunnels, L2TP tunnel-ids and session-ids, or security association parameters for IPSec. Very organized, very manual 💅.
A signalling protocol, though, can seriously lower the management burden 🙌. It needs less configuration and way less coordination when a VPN spans multiple administrative domains. Like, the multiplexing field we talked about earlier is local to whichever node assigns the value, and it can stay local when it's handed out by a signalling protocol 🌸. You don't have to configure it into a management station first and then push it out to every node. A signalling protocol is also a lifesaver for nodes that are mobile or only connect now and then, because they can set up tunnels on demand 🧚. It's essential in lots of deployment scenarios, bestie 💖.
When you're in a VPN environment, a signalling protocol should be able to carry a VPN-ID, so the resulting tunnel gets tied to one specific VPN 👑. It should also let tunnel attributes get exchanged or negotiated, like whether frame sequencing is used or whether multiprotocol transport is used 🎀. But here's the key bit: the signalling protocol only needs to negotiate tunnel attributes. It doesn't need to carry info about how the tunnel gets used, like whether the frames inside should be forwarded at layer 2 or layer 3 🙅♀️. This is basically how Q.2931 ATM signalling works. The same signalling protocol sets up Classical IP logical subnetworks and LANE emulated LANs too 🦄.
Of the IP tunneling protocols, a few have a signalling protocol that could be adapted for this job: L2TP (through the L2TP control protocol), IPSec (through the Internet Key Exchange (IKE) protocol [18]), and GRE (as used with mobile-ip tunneling [19]) 🌈. There are also two MPLS signalling protocols for setting up LSP tunnels. One extends the MPLS Label Distribution Protocol (LDP) [20] and is called Constraint-Based Routing LDP (CR-LDP) [21]. The other extends the Resource Reservation Protocol (RSVP) for LSP tunnels [22] ✨.
3.1.3 Data Security 🔒
Obviously a VPN tunneling protocol has to support mechanisms so customers can get whatever level of security they want 💜. That includes authentication and/or encryption, in various strengths. Here's the tea: none of the tunneling mechanisms we discussed have intrinsic security, except IPSec 🙈. Everything else just leans on the security of the underlying IP backbone. MPLS, for example, relies on the explicit labeling of label switched paths so packets can't get misdirected. The rest can all be secured by running IPSec on top 🫶. For VPNs running over non-IP backbones (like MPOA, Frame Relay, or ATM virtual circuits), data security comes implicitly from the layer two switch infrastructure 💅.
Overall VPN security isn't just about the tunnels, though. You have to look at how packets get forwarded onto those tunnels too 👀. With VPRNs built on virtual routers, separate routing and forwarding table instances keep traffic isolated between VPNs. Packets from one VPN can't get misrouted into a tunnel on a second VPN, because that tunnel just isn't visible to the first VPN's forwarding table 🔥.
If a VPN end point uses some kind of signalling mechanism to dynamically set up a tunnel with another endpoint, then the party trying to set up that tunnel has to be authenticated. Full stop, no exceptions 🚨. IPSec has a whole bunch of schemes for this. For example, authentication can be based on pre-shared keys, or it can use digital signatures and certificates 🎀. Other tunneling schemes have weaker authentication. Sometimes no authentication is needed at all, like if the tunnels are provisioned instead of dynamically established, or if the trust model in use doesn't require it 🌸.
Right now, the IPSec Encapsulating Security Payload (ESP) protocol [23] can set up SAs that do encryption, authentication, or both. The catch is that the protocol spec doesn't allow an SA where neither encryption nor authentication is used 😭. In a VPN environment though, that "null/null" option is actually useful, because other parts of the protocol (like tunneling and multiplexing support) might be all you need 🧚. Honestly, you can think of "null/null" as just another level of data security 🦋.
3.1.4 Multiprotocol Transport 🌍
In lots of VPN applications, the VPN might carry opaque, multiprotocol traffic. So the tunneling protocol used has to support multiprotocol transport too 🌈. L2TP is designed to carry Point-to-Point Protocol (PPP) [24] packets, and since PPP is itself multiprotocol, L2TP can carry multiprotocol traffic ✨. GRE also identifies the protocol being tunneled. IP/IP and IPSec tunnels don't have a protocol identification field, because the traffic inside is assumed to be IP 🙃.
IPSec can be extended to carry multiprotocol packets. For example, you could extend IKE, the signalling part of IPSec, so it indicates the protocol type of the tunneled traffic 🛠️. Or you could carry a packet multiplexing header (like an LLC/SNAP header or a GRE header) with each tunneled packet 💜. This is kind of like what ATM networks do. There, signalling indicates the encapsulation used on the VCC, and packets on the VCC can either use an LLC/SNAP header or go straight into the AAL5 payload. That second option is called VC-multiplexing (see [25]) 💅.
3.1.5 Frame Sequencing 🎀
One quality of service attribute a VPN customer might want is frame sequencing. It matches what you get from physical leased lines or dedicated connections 💖. Sequencing can be needed for particular end to end protocols or applications to run efficiently 🦋. To do frame sequencing, the tunneling mechanism has to support a sequencing field. L2TP and GRE both have one. IPSec has a sequence number field too, but a receiver uses it to do an anti-replay check, not to guarantee in-order delivery 😬.
IPSec can be extended so the existing sequence field guarantees in-order delivery of packets ✨. For instance, IKE can negotiate whether sequencing is used at all, and define an end point behaviour that preserves packet sequencing 👑.
3.1.6 Tunnel Maintenance 🔧
VPN end points have to keep an eye on their tunnels 👀. They need to make sure connectivity hasn't dropped, and take action (like route recalculation) if something fails 🚦.
There are two ways to do this. The first is for the tunneling protocol itself to check in-band, on a regular basis, for lost connectivity, and then explicitly report a failure. L2TP, for example, has an optional keep-alive mechanism to detect non-operational tunnels 💓. The second way doesn't rely on the tunneling protocol at all. Instead, it uses some out-of-band mechanism to figure out that connectivity is gone 🧚. For example, if a routing protocol like Routing Information Protocol (RIP) [26] or Open Shortest Path First (OSPF) [27] runs over a tunnel mesh, then not hearing from a neighbor within a certain time means the routing protocol declares the tunnel down 🛑. Another out-of-band option is running regular ICMP pings with a peer. That's usually enough assurance the tunnel is working, since the tunnel runs across the same IP backbone 🌸.
When tunnels get set up dynamically, you need to tell apart the static and dynamic tunnel info 🧠. Before a tunnel can be set up, a node needs some static info, like the identity of the remote end point and the attributes of the tunnel to propose and accept. That's usually put in place by a configuration operation 📋. Then, once the signalling exchange sets up a tunnel, some dynamic state gets created at each end point, like the value of the multiplexing field or the keys to use 🔑. With IPSec, for example, setting up a Security Association (SA) puts the keys in place for the whole lifetime of that SA 🔐.
There are different policies for when to trigger a dynamic tunnel. One approach is data-driven: trigger tunnel establishment whenever there's data to transfer, and time the tunnel out after inactivity 💨. This is especially handy if resources for the tunnel are being allocated in the network for QoS purposes 🎀. The other approach is to trigger tunnel establishment as soon as the static tunnel configuration is installed, and then try to keep the tunnel up all the time 🌞.
3.1.7 Large MTUs 📦
An IP tunnel has an associated Maximum Transmission Unit (MTU), just like a regular link does 📏. It's totally possible that this MTU is bigger than the MTU of one or more individual hops along the path between tunnel endpoints 😳. If that happens, some form of frame fragmentation is going to be needed inside the tunnel 🧩.
If the frame gets mapped into one IP datagram, normal IP fragmentation kicks in when that datagram hits a hop with a smaller MTU than the IP tunnel's MTU 😩. That can be really bad for performance at the router doing that mid-tunnel fragmentation 🥲.
A better idea is for the tunneling protocol itself to have a segmentation and reassembly capability that works at the tunnel level 🪄. It could use the tunnel sequence number and some kind of end-of-message marker to do this. (Fun fact: multilink PPP fragments packets with a similar mechanism 🤓.) This way, you avoid IP level fragmentation inside the tunnel itself. Honestly though, none of the existing tunneling protocols support this mechanism 💀.
3.1.8 Minimization of Tunnel Overhead ✨
okay so tunnels add overhead, and every extra byte matters 🥺 minimizing it is basically always the goal, and it's especially important for jitter and latency sensitive stuff like packetized voice and video 📞🎥
BUT security also comes with its own overhead (hi, IPSec 👋), so the real goal is to keep the overhead on top of what security needs as small as possible. and tunnels where security isn't mandatory shouldn't get stuck carrying unnecessary overhead 🙅♀️
one place the overhead can really hurt is voluntary tunneling for dial-up remote clients connecting to a VPN. dial-up links are usually super low bandwidth, so every byte counts 🐌 more on this in section 6.3 💅
3.1.9 Flow and congestion control 🌊
so L2TP actually did develop flow and congestion control procedures. these were needed mainly to get decent performance over lossy networks when PPP compression is in use. unlike IP Payload Compression Protocol (IPComp) [28], PPP compression is stateful across packets, so it gets messy 😵💫 the other motivation was devices with very little buffering, like the ones that terminate low speed dial-up lines.
plot twist though: the flow and congestion control mechanisms in the final version of the L2TP spec are only used for the control channels, NOT the data traffic 🙃
in general, layering multiple flow and congestion control schemes on top of each other can get really complex. and since most traffic today is TCP, which already has its own end-to-end flow and congestion control, it's not clear that tunneling protocols gain much by doing the same thing again 🤷♀️ good schemes that adapt to all kinds of network conditions and deployments are hard to build and test, both on their own and in terms of how they interact with other schemes running in parallel. 😩
there might be some benefit in two things: letting a sender shape its traffic to match what a receiver can handle, and giving a receiver a way to signal its capabilities to the sender. this is an area that could use more study 📚
also, peep the Performance Implications of Link Characteristics (PILC) working group of the IETF. they're looking at how the properties of different network links affect the performance of Internet protocols running over those links 👀
3.1.10 QoS / Traffic Management
as mentioned above, customers may want VPNs to behave like physical leased lines or dedicated connections when it comes to QoS stuff like loss rates, jitter, latency and bandwidth guarantees 💼 how those guarantees get delivered depends on the traffic management of the VPN nodes themselves, plus the access and backbone networks they're connected across 🛣️
a full QoS and VPN discussion is out of scope for this doc, but here's the big idea: if you model a VPN tunnel as just another type of link layer, a lot of the existing QoS mechanisms for physical links can be applied too 🧠 for example, at a VPN node you can use policing, marking, queuing, shaping and scheduling on VPN traffic, just like on non-VPN traffic, with VPN-specific parameters, queues and interfaces. the techniques built for Diffserv, Intserv, and traffic engineering in MPLS also apply. see [29] for more on QoS and VPNs 💖
but heads up: this model of tunnel operation isn't necessarily consistent with how specific tunneling protocols are currently modeled 🙈 a model is a great aid to understanding, but it's NOT part of a protocol spec. having different models can make conversations confusing, especially if someone mistakes a model for part of the protocol spec or thinks it limits how you can implement things. for example, IPSec tunnel processing can be modeled as an interface and as an attribute of a particular packet flow. two valid ways, no drama 🫶
3.2 Recommendations
okay bestie, the big one: IPSec is needed whenever you need strong encryption or strong authentication 🔐 it also supports multiplexing and a signalling protocol, which is IKE. BUT extending the IPSec protocol suite to cover the following areas would be super beneficial for better supporting VPN tunneling needs 💅
- the transport of a VPN-ID when establishing an SA (3.1.2)
- a null encryption and null authentication option (3.1.3)
- multiprotocol operation (3.1.4)
- frame sequencing (3.1.5)
and here's the thing about L2TP: it gives you no data security on its own, and any PPP security mechanisms don't apply to the L2TP protocol itself. so if you want strong security, L2TP has to run over IPSec 🛡️ defining specific modes of operation for IPSec when it's supporting L2TP traffic will help interoperability (aka everyone's stuff actually works together 🥰). this is currently a work item for the proposed L2TP working group 📝
4.0 VPN Types: Virtual Leased Lines 🎀
the simplest kind of VPN is a 'Virtual Leased Line' (VLL) service 🧚 basically you give a customer a point-to-point link connecting two CPE devices. the link layer type used to hook the CPE devices up to the ISP nodes can be any link layer type, like an ATM VCC or a Frame Relay circuit. and the CPE devices can be routers, bridges or hosts. so many options 🙌
both ISP nodes are connected to an IP network, and an IP tunnel gets set up between them. each ISP node is configured to bind the stub link and the IP tunnel together at layer 2 (for example, an ATM VCC and the IP tunnel). frames get relayed between the two links. like, the ATM Adaptation Layer 5 (AAL5) payload gets taken and encapsulated in an IPSec tunnel, and vice versa. the contents of the AAL5 payload are opaque to the ISP node, so it never looks inside 👀🚫
+--------+ ----------- +--------+
+---+ | ISP | ( IP ) | ISP | +---+
|CPE|------| edge |-----( backbone ) -----| edge |------|CPE|
+---+ ATM | node | ( ) | node | ATM +---+
VCC +--------+ ----------- +--------+ VCC
<--------- IP Tunnel -------->
10.1.1.5 subnet = 10.1.1.4/30 10.1.1.6
Addressing used by customer (transparent to provider)
Figure 4.1: VLL Exampleto the customer, it looks exactly like a single ATM VCC or Frame Relay circuit is connecting their CPE devices 🤯 the customer could be totally unaware that part of the circuit is actually running over an IP backbone. this can be useful when a provider wants to offer a LAN interconnect service using ATM as the network interface, but doesn't have an ATM network that directly connects every customer site 🏢
the two links connecting the CPE devices to the ISP nodes don't have to be the same media type. BUT if they're different, the ISP nodes can't treat the traffic opaquely anymore, as we just talked about 😬 instead, the ISP nodes must act as an interworking device between the two media types (e.g., ATM and Frame Relay). that means doing things like LLC/SNAP to NLPID conversion, mapping between ARP protocol variants, and any media specific processing the CPE devices might expect (e.g., ATM OAM cell handling or Frame Relay XID exchanges). it's a lot, but ISPs can handle it 💪
the IP tunneling protocol used must support multiprotocol operation, and it may need to support sequencing too, if that matters for the customer's traffic 🔢 if the tunnels get established using a signalling protocol, they can be set up in a data driven way (when a frame comes in from a customer link and no tunnel exists yet). or the tunnels can be established at provisioning time and kept up permanently 🕰️
quick heads up on terminology: the term 'VLL' in this doc is different from how the Diffserv Expedited Forwarding Per Hop Behaviour (EF-PHB) [30] uses it 🙃 there, a VLL means a low latency, low jitter, assured bandwidth path that the described PHB can provide. so that focus is mostly on temporal link characteristics (timing stuff). in THIS doc, VLL doesn't imply any specific QoS mechanism, Diffserv or otherwise. instead, the focus is on topological link characteristics, like building a link that includes an IP tunnel as one segment. 🗺️ and for a truly complete emulation of a link layer, you have to account for both the temporal and topological aspects. both matter, periodt 💅✨
5.0 VPN Types: Virtual Private Routed Networks 🌐
5.1 VPRN Characteristics ✨
okay so a Virtual Private Routed Network (VPRN) is basically the emulation of a multi-site wide area routed network using IP facilities 🌐 this section looks at how a network-based VPRN service can be provided 💅 CPE-based VPRNs are also possible but we're not really getting into those here 🙈 with network-based VPRNs, a lot of the issues are about configuration and operations, and they have to account for the split in administrative responsibility between the service provider and the service user 🫶
the thing that makes a VPRN different from other VPN types is that packet forwarding happens at the network layer 🔥 a VPRN is a mesh of IP tunnels between ISP routers, plus the routing needed to forward traffic that hits each VPRN node to the right destination site 🦋 the ISP routers have CPE routers attached through one or more links called 'stub' links 🎀 each ISP router that has VPRN members connected gets its own VPRN-specific forwarding table 💜 traffic moves between ISP routers, and between ISP routers and customer sites, using those tables, and they hold network layer reachability information 🧚 (this is the opposite of a Virtual Private LAN Segment type of VPN (VPLS), where the tables hold MAC layer reachability information instead, see section 7.0 ✨)
here's an example VPRN in the diagram below 👑 it has 3 ISP edge routers connected by a full mesh of IP tunnels, and those interconnect 4 CPE routers 🌸 one of the CPE routers is multihomed to the ISP network 😭 in the multihomed case all stub links can be active, or (like in the diagram) there can be one primary link and one or more backup links that kick in if the primary fails 🍓 the term 'backdoor' link refers to a link between two customer sites that does not go through the ISP network 💀
10.1.1.0/30 +--------+ +--------+ 10.2.2.0/30
+---+ | ISP | IP tunnel | ISP | +---+
|CPE|-------| edge |<--------------------->| edge |-------|CPE|
+---+ stub | router | 10.9.9.4/30 | router | stub +---+
link +--------+ +--------+ link :
| ^ | | ^ :
| | | --------------- | | :
| | +----( )----+ | :
| | ( IP BACKBONE ) | :
| | ( ) | :
| | --------------- | :
| | | | :
| |IP tunnel +--------+ IP tunnel| :
| | | ISP | | :
| +---------->| edge |<----------+ :
| 10.9.9.8/30 | router | 10.9.9.12/30 :
backup| +--------+ backdoor:
link | | | link :
| stub link | | stub link :
| | | :
| +---+ +---+ :
+-------------|CPE| |CPE|.......................:
10.3.3.0/30 +---+ +---+ 10.4.4.0/30Figure 5.1: VPRN Example 🎀
the big win with a VPRN is that the complexity and configuration of the CPE routers gets minimized 🥹 from a CPE router's point of view, the ISP edge router is just a neighbor router in the customer's network, and it sends all traffic to it using a default route 🌷 the tunnel mesh is set up between the ISP edge routers, not the CPE routers 💖 so basically the work of setting up and maintaining tunnels and the routing config gets outsourced to the ISP 🙌 other VPN services, like a firewall or QoS processing, can also be handled by a small number of ISP edge routers instead of a big pile of potentially different CPE devices 🫧 rolling out and managing new services is easier too, because it can happen without upgrading any CPE equipment 🔥 this matters a lot when there are huge numbers of residential subscribers using VPN services to reach private corporate networks 😤 it's kind of like telephony, where new features (call waiting, for example) show up with no change to the subscriber's equipment 📞✨
the VPRN type is different from a setup where the tunnel mesh reaches the CPE routers and the ISP network only gives you layer 2 connectivity 🦋 that second setup can be done either as a set of VLLs between CPE routers (see section 4.0), where the ISP network provides layer 2 point-to-point links, or as a VPLS (see section 7.0), where the ISP network emulates a multiaccess LAN segment 🌈 with these options the customer gets more flexibility (for example, any IGP or any protocol can run across all the customer sites) but that usually costs them a more complicated configuration 🤓 so depending on what the customer needs, a VPRN or a VPLS might be the better fit 💅
because a VPRN forwards at the network layer, a single VPRN only directly supports a single network layer protocol 🙈 if you need multiprotocol support, you can run a separate VPRN for each network layer protocol, or you can tunnel one protocol over another (like non-IP protocols tunneled over an IP VPRN) 🧚 or the ISP network can just provide layer 2 connectivity only, like with the VPLS we mentioned above 💜
the issues that need addressing for VPRNs include: initial configuration; the ISP edge router working out which links are in each VPRN, which other routers have members in the VPRN, and which IP address prefixes are reachable via each stub link; the CPE router working out which IP address prefixes should be forwarded to an ISP edge router; the mechanism for spreading stub reachability information to the right set of ISP routers; and setting up and using the tunnels that carry the data traffic 🫶 also, even though we're talking about VPRNs first, a lot of these issues apply to the VPLS scenario too, just with link layer addresses swapped in for network layer addresses 🌸
VPRN operation is decoupled from the mechanisms the customer sites use to get onto the Internet 🌐 a typical setup is for the ISP edge router to give a customer site both VPRN and Internet connectivity 👑 in that case the CPE router just has a default route pointing at the ISP edge router, and the edge router is responsible for steering private traffic into the VPRN and everything else out to the Internet, and for providing firewall functionality between the two domains 🔥 another option is for a customer site to get Internet connectivity through an ISP router that isn't involved in the VPRN, or even through a completely different ISP 🍓 in that case the CPE device is the one that splits traffic into the two domains and provides the firewall functionality 🛡️✨
5.1.1 Topology 🗺️
the topology of a VPRN can be a full mesh of tunnels between each VPRN node, or it can be an arbitrary topology 💖 for example, a set of remote offices connected to their nearest regional site, with those regional sites connected together by a full or partial mesh 🌷 with VPRNs using IP tunnels, full meshing costs a lot less than in cases where physical resources (like a leased line) have to be allocated for each connected pair of sites, or where the tunneling method needs resources allocated in the devices that interconnect the edge routers (like Frame Relay DLCIs) 🦋 a full mesh gives optimal routing, since it means traffic between two sites never has to go through a third one 😌 another nice thing about a full mesh is that you don't need to configure any topology information for the VPRN 🧚 given the member routers of a VPRN, the topology is implicit 🫧
BUT, if the number of ISP edge routers in a VPRN is very large, a full mesh might not be appropriate because of scaling issues 😬 for example, the number of tunnels needed grows fast between sites (for n sites it's n(n-1)/2), and so does the number of routing peers per router 📈 network policy can also lead to non-full-mesh topologies 🤓 for instance, an administrator might want traffic between two remote sites to pass through a central site instead of going directly between them 🙃 and there's also the case where there's only partial connectivity across the IP backbone under certain error conditions (e.g., A can reach B, and B can reach C, but A cannot reach C directly), which can happen if policy routing is being used 💀 so yeah, that's something you have to deal with too 😭
for a network-based VPRN, the assumption is that each customer site CPE router connects to an ISP edge router through one or more point-to-point stub links (e.g., leased lines, ATM or Frame Relay connections) 🎀 the ISP routers are responsible for learning and sharing reachability information among themselves 💜 the CPE routers still have to learn the set of destinations reachable via each stub link, though this can be as simple as a default route 🌈
the stub links can be dedicated links that get set up through provisioning, or they can be dynamic links that get set up on demand, for example using PPP, voluntary tunneling (see section 6.3), or ATM signalling 🦋 with dynamic links, the subscriber has to be authenticated, and the authorized resources the subscriber can access have to be determined (e.g., which VPRNs the subscriber may join) 🔐 apart from how the subscriber gets initially bound to the VPRN (which can involve extra stuff like dynamic IP address assignment 🙈), the rest of the VPRN mechanisms and services can be used for both types of subscribers in exactly the same way 🫶✨
5.1.2 Addressing 🏠
the addressing used inside a VPRN can have no relation at all to the addressing used on the IP backbone the VPRN runs over 🧚 in particular, non-unique private IP addressing may be used [4] 💅 multiple VPRNs can run over the same set of physical devices, and they can use the same or overlapping address spaces 👑 it's giving "everybody gets their own vibe" energy 🌸💖
5.1.3 Forwarding ✨
okay so for a VPRN the tunnel mesh is basically an overlay network sitting on top of an IP backbone 🫶 Inside each ISP edge router there has to be VPN specific forwarding state. It handles two directions: ingress traffic (packets coming in from stub links) gets sent to the right next hop router, and egress traffic (packets coming from the core) gets sent out to the right stub link 🧚
Now here's the lowkey tricky bit 👀 If one ISP edge router handles several stub links from the same VPRN, the tunnels can terminate on the edge router itself or on a stub link, and that's a local call the operator makes. If they terminate on the edge router, you need a VPN specific forwarding table for egress traffic. If they terminate on a stub link, you don't. A VPN specific forwarding table is generally needed in the ingress direction though, since it's what steers traffic from a stub link onto the correct IP tunnel heading to the core 💅
Also, a VPRN works at the internetwork layer, so IP packets sent over a tunnel get their Time to Live (TTL) field decremented in the normal way. That's the thing that stops packets from circling forever if there's a routing loop inside the VPRN 🔁 iconic safety feature, no notes 💖
5.1.4 Multiple concurrent VPRN connectivity 🌸
ngl this one is a whole vibe. A single customer site can belong to multiple VPRNs at the same time, and it might want to send traffic into one or more of those VPRNs and out to the default Internet over the same stub link 🙈 There are a few possible ways to handle that, but they're outside the scope of this document, so we're leaving them for another day 🎀
5.2 VPRN Related Work 📚
VPRN requirements and mechanisms have already been talked about in a bunch of different documents. One of the earliest was [10], which showed how the same VPN functionality could be built over both MPLS and non-MPLS networks. A few others are briefly covered below 🦋
So there are two main variants for how the mechanisms handle VPRN membership and reachability: overlay and piggybacking. We go deeper on these in sections 5.3.2, 5.3.3 and 5.3.4 below 👑
The overlay model shows up in [14], which provides VPRN functionality using a separate per-VPN routing protocol instance plus route and forwarding table instantiation. This is also known as virtual routing. Every VPN routing instance is isolated from every other VPN routing instance, and also from the routing used across the backbone 🔒 Because of that, any routing protocol (e.g. OSPF, RIP2, IS-IS) can run on any VPRN, totally independent of the protocols used in other VPRNs or in the backbone itself 🫧 The VPN model in [12] is also an overlay VPRN model that uses virtual routing. That document is specifically geared towards VPRN functionality over MPLS backbones. It describes how VPRN membership dissemination can be automated over an MPLS backbone, by doing VPN neighbor discovery over the base MPLS tunnel mesh 🧠 Then [31] extends the virtual routing model to include VPN areas, plus VPN border routers that route between those areas. VPN areas can be defined for administrative or technical reasons, like different underlying network infrastructures (e.g. ATM, MPLS, IP) 🌈
In contrast, [15] describes VPN functionality using a piggybacking approach for membership and reachability dissemination. This info gets piggybacked in Border Gateway Protocol 4 (BGP) [32] packets. VPNs are built using BGP policies, which control which sites can communicate with each other 🤝 [13] also uses BGP for piggybacking membership information, and it piggybacks reachability information on the protocol used to establish MPLS LSPs (CR-LDP or extended RSVP). Unlike the other proposals though, this one requires the CPE router to implement the VPN functionality 🙃
5.3 VPRN Generic Requirements 💜
There are a number of common requirements that any network-based VPRN solution has to address, and there are a bunch of different mechanisms that can meet them. These generic issues are:
- The use of a globally unique VPN identifier in order to be able to refer to a particular VPN.
- VPRN membership determination. An edge router must learn of the local stub links that are in each VPRN, and must learn of the set of other routers that have members in that VPRN.
- Stub link reachability information. An edge router must learn the set of addresses and address prefixes reachable via each stub link.
- Intra-VPRN reachability information. Once an edge router has determined the set of address prefixes associated with each of its stub links, this information must be disseminated to each other edge router in the VPRN.
- Tunneling mechanism. An edge router must construct the necessary tunnels to other routers that have members in the VPRN, and must perform the encapsulation and decapsulation necessary to send and receive packets over the tunnels.
5.3.1 VPN Identifier 🪪
The IETF [16] and the ATM Forum [17] have both standardized on a single format for a globally unique identifier used to identify a VPN, called a VPN-ID. Only the format of the VPN-ID has been defined, not its semantics or usage 🎀 The aim is to allow its use for a wide variety of purposes, and to let the same identifier be used with different technologies and mechanisms. For example, a VPN-ID can be included in a MIB to identify a VPN for management purposes. A VPN-ID can be used in a control plane protocol, for example to bind a tunnel to a VPN at tunnel establishment time, and then all packets that traverse the tunnel are implicitly associated with the identified VPN 🚇 A VPN-ID can also be used in a data plane encapsulation, which allows an explicit per-packet identification of the VPN that the packet belongs to. If a VPN is implemented using different technologies (e.g., IP and ATM) in a network, the same identifier can identify the VPN across all of them. And if a VPN spans multiple administrative domains, the same identifier can be used everywhere 🌍
Most of the VPN schemes developed (e.g. [11], [12], [13], [14]) require a VPN-ID that is carried in control and/or data packets, and it's used to associate the packet with a particular VPN. This is super common, but it's not universal 👀 [15] describes a scheme with no protocol field that identifies a VPN this way. In that scheme, VPNs as understood by a user are administrative constructs built using BGP policies. There are a number of attributes associated with VPN routes, such as a route distinguisher, and origin and target "VPN", which the underlying protocol mechanisms use for disambiguation and scoping. The BGP policy mechanism also uses these when building VPNs, but there's nothing that corresponds to the VPN-ID as used in the other documents 🫠
Also, note that [33] defines a multiprotocol encapsulation for use over ATM AAL5 that uses the standard VPN-ID format 💅
5.3.2 VPN Membership Information Configuration and Dissemination 🗂️
To set up a VPRN, or to add new customer sites into an established VPRN, an ISP edge router has to figure out which stub links are associated with which VPRN. For static links (e.g. an ATM VCC), this info must be configured into the edge router, because the edge router can't infer those bindings by itself 😩 An SNMP MIB that allows bindings between local stub links and VPN identities is one solution.
For subscribers that attach dynamically (e.g. using PPP or voluntary tunneling), it's possible to make the stub link to VPRN association as part of the end user authentication processing that has to happen with those dynamic links 🔐 For example, the VPRN a user should be bound to may be derived from the domain name used as part of PPP authentication. If the user is successfully authenticated (e.g. using a Radius server), then the newly created dynamic link can be bound to the correct VPRN. Note that static configuration info is still needed, for example to maintain the list of authorized subscribers for each VPRN, but that static info could live on an external authentication server instead of on an ISP edge router 🖥️ Whether the link was created statically or dynamically, a VPN-ID can be associated with that link to signify which VPRN it's bound to 💖
After learning which stub links are bound to which VPRN, each edge router has to learn either the identity of, or at least the route to, each other edge router that supports other stub links in that same VPRN. This implies there's some mechanism that lets the configured edge routers use this router and/or stub link identity info to set up the appropriate tunnels between them 🚇 The problem of VPRN member dissemination between participating edge routers can be solved in a variety of ways, which we'll go over below ✨
5.3.2.1 Directory Lookup 📒
The members of a particular VPRN (the identity of the edge routers supporting stub links in the VPRN, and the set of static stub links bound to the VPRN per edge router) could be configured into a directory. Edge routers could query that directory using some defined mechanism (e.g. Lightweight Directory Access Protocol (LDAP) [34]) upon startup 📂
Using a directory allows either a full mesh topology or an arbitrary topology to be configured. For a full mesh, the full list of member routers in a VPRN is distributed everywhere. For an arbitrary topology, different routers may receive different member lists 🕸️
Using a directory also allows for authorization checking before VPRN membership info gets disseminated, which may be desirable where VPRNs span multiple administrative domains. In that case, directory to directory protocol mechanisms could also be used to propagate authorized VPRN membership info between the directory systems of the multiple administrative domains 🤓
There also needs to be some form of database synchronization mechanism (e.g. triggered or regular polling of the directory by edge routers, or active pushing of update information to the edge routers by the directory). This lets all edge routers learn the identity of newly configured sites inserted into an active VPRN, and also learn of sites removed from a VPRN 🔄
5.3.2.2 Explicit Management Configuration
Okay bestie, so a VPRN MIB could be defined 🧚 that lets a central management system configure each edge router with the identities of every other participating edge router, plus the identity of each static stub link bound to the VPRN 💖. Just like the directory approach, this lets you set up both full mesh and arbitrary topologies ✨. Another centralized option is a policy server that uses the Common Open Policy Service (COPS) protocol [35] to hand out VPRN membership and policy info, like the tunnel attributes to use when setting up a tunnel, as described in [36] 🎀.
Note that this lets the management station impose strict authorization control 💅. On the flip side, it may be harder to configure edge routers that sit outside the scope of the management system 🙈. The management configuration model can also be seen as a subset of the directory method, since management directories could use MIBs to push VPRN membership info to participating edge routers, either after or as part of the local stub link configuration process 🫶.
5.3.2.3 Piggybacking in Routing Protocols
VPRN membership info could be piggybacked into the routing protocols each edge router runs across the IP backbone 🦋. It's an efficient way to automatically spread info around the network to other participating edge routers 🔥. Specifically, each route advertisement from each edge router could include, at a minimum, the set of VPN identifiers associated with that edge router, plus enough info for other edge routers to work out the identity of that edge router and/or the route to it 💜.
Other edge routers would look through received route advertisements to see if anything in them is relevant to a supported (i.e., configured) VPRN 👑. They could do this by looking for a VPN identifier that matches a locally configured VPN. The nature of the piggybacked info, plus related stuff like scoping and how the nodes advertising particular VPN memberships get identified, will generally depend on both the routing protocol and the nature of the underlying transport 🌈.
Using this method, all the routers in the network have the same view of the VPRN membership info, so a full mesh topology is easily supported 🌸. Supporting an arbitrary topology is harder, though, since some form of pruning would seem to be needed 😭.
The upside of piggybacking is that it allows for efficient info dissemination. The catch is that it does require all nodes in the path, not just the participating edge routers, to be able to accept these modified route advertisements 🍓. The downside is that significant administrative complexity may be needed to configure scoping mechanisms that both permit and constrain the dissemination of the piggybacked advertisements. That alone can be a real config burden, especially if the VPRN spans multiple routing domains (e.g. different autonomous systems / ISPs) 💀.
Security heads-up: unless some security mechanism is used for routing updates so as to permit only all relevant edge routers to read the piggybacked advertisements, this scheme generally implies a trust model where all routers in the path must perforce be authorized to know this information. 🔐
Depending on the nature of the routing protocol, piggybacking may also require intermediate routers, particularly autonomous system (AS) border routers, to cache these advertisements and potentially re-distribute them between multiple routing protocols 🧠.
Each of the schemes described above has merit in particular situations 💖. Note that, in practice, there will almost always be some centralized directory or management system maintaining VPRN membership info. That could be the set of edge routers allowed to support a certain VPRN, the bindings of static stub links to VPRNs, or authentication and authorization info for users that access the network via dynamics links. This info needs to be configured and stored in some form of database, so the extra steps to get it into edge routers, and/or to let edge routers access it, may not be excessively onerous 🥺.
5.3.3 Stub Link Reachability Information
There are two aspects to stub site reachability. The first is the means by which VPRN edge routers determine the set of VPRN addresses and address prefixes reachable at each stub site. The second is the means by which the CPE routers learn the destinations reachable via each stub link. A number of common scenarios are outlined below. In each case the info the ISP edge router needs is the same (the set of VPRN addresses reachable at the customer site), but the info the CPE router needs differs 🗺️.
5.3.3.1 Stub Link Connectivity Scenarios
5.3.3.1.1 Dual VPRN and Internet Connectivity
The CPE router is connected via one link to an ISP edge router, which provides both VPRN and Internet connectivity 🌐.
This is the simplest case for the CPE router, since it just needs a default route pointing to the ISP edge router 😌.
5.3.3.1.2 VPRN Connectivity Only
The CPE router is connected via one link to an ISP edge router, which provides VPRN, but not Internet, connectivity 🙅♀️.
The CPE router must know the set of non-local VPRN destinations reachable via that link. This may be a single prefix, or it may be a number of disjoint prefixes 🧩. The CPE router may be either statically configured with this info, or it may learn it dynamically by running an instance of an Interior Gateway Protocol (IGP). For simplicity it is assumed that the IGP used for this purpose is RIP, though it could be any IGP 🎀. The ISP edge router will inject into this instance of RIP the VRPN routes which it learns by means of one of the intra-VPRN reachability mechanisms described in section 5.3.4. Note that the instance of RIP run to the CPE, and any instance of a routing protocol used to learn intra-VPRN reachability (even if also RIP), are separate. The ISP edge router redistributes the routes from one instance to another 🔁.
5.3.3.1.3 Multihomed Connectivity
The CPE router is multihomed to the ISP network, which provides VPRN connectivity 🏠.
In this case all the ISP edge routers could advertise the same VPRN routes to the CPE router, which then sees all VPRN prefixes as equally reachable via all links 🤝. More specific route redistribution is also possible, whereby each ISP edge router advertises a different set of prefixes to the CPE router 🎯.
5.3.3.1.4 Backdoor Links
The CPE router is connected to the ISP network, which provides VPRN connectivity, but also has a backdoor link to another customer site 🚪.
In this case the ISP edge router will advertise VPRN routes as in case 2 to the CPE device. However, now the same destination is reachable via both the ISP edge router and the backdoor link 😬. If the CPE routers connected to the backdoor link are running the customer's IGP, then the backdoor link may always be the favored link, since it will appear as an 'internal' path. The destination as injected via the ISP edge router will appear as an 'external' path (to the customer's IGP). To avoid this problem, assuming the customer wants the traffic to traverse the ISP network, a separate instance of RIP should be run between the CPE routers at both ends of the backdoor link. This is done in the same manner as an instance of RIP is run on a stub or backup link between a CPE router and an ISP edge router. This will then also make the backdoor link appear as an external path. By adjusting the link costs appropriately, the ISP path can always be favored, unless it goes down, at which point the backdoor link is then used 🛟.
The description of the above scenarios covers what reachability info is needed by the ISP edge routers and the CPE routers, and discusses some of the mechanisms used to convey this info. The sections below look at these mechanisms in more detail 🦋.
5.3.3.1 Routing Protocol Instance
okay so 💖 a routing protocol can be run between the CPE edge router and the ISP edge router to swap reachability info 🦋. This lets an ISP edge router learn which VPRN prefixes are reachable at a customer site, and lets a CPE router learn the destinations reachable via the provider network ✨.
The routing domain for this protocol instance is generally just the ISP edge router and the CPE router 🎀. But if the customer site runs the same protocol as its IGP, then the domain may stretch into the customer site 🌸. If the customer site runs a different routing protocol, the CPE router redistributes the routes between the instance running toward the ISP edge router and the instance running into the customer site 💅.
Since this routing instance has such a restricted scope, a simple protocol will generally suffice 🧚. RIP is likely to be the most common choice 🍓, though any routing protocol could also work, such as OSPF, or BGP run in internal mode (IBGP) 🌈.
Note that the stub link routing protocol instance is different from any instance of a routing protocol used for intra-VPRN reachability 🙈. For example, if the ISP edge router uses routing protocol piggybacking to spread VPRN membership and reachability information across the core, then it may redistribute suitably labeled routes from the CPE routing instance into the core routing instance. The routing protocols for each instance are decoupled, and any suitable protocol can be used in each case 🔥. There is no requirement that the same protocol, or even the same stub link reachability information gathering mechanism, be run between each CPE router and its associated ISP edge router in a particular VPRN, since this is a purely local matter 💜.
This decoupling is so iconic 👑 because it lets ISPs deploy a common intra-VPRN reachability mechanism (common across all VPRNs) and a common stub link reachability mechanism, with each one isolated from the other and from the particular IGP used in a customer network 🫶. In the first case, the IGP-IGP boundary on the ISP edge router means the ISP can insulate the intra-VPRN reachability mechanism from misbehaving stub link protocol instances 🛡️. In the second case, the ISP does not need to be aware of the particular IGP running in a customer site 💅. Other scenarios are possible, where the ISP edge routers run a routing protocol in the same instance as the customer's IGP, but these are unlikely to be practical, since they defeat the whole point of a VPRN simplifying CPE router configuration 😭. When a customer wants to run an IGP across multiple sites, a VPLS solution is the better fit ✨.
Note that if a particular customer site belongs to multiple VPRNs at once (or wants to talk to both a VPRN and the Internet at the same time), then the ISP edge router must have some way of unambiguously mapping stub link address prefixes to particular VPRNs 🦋. A simple way is to have multiple stub links, one per VPRN. It is also possible to run multiple VPRNs over one stub link. This could be done either by making sure (and configuring the ISP edge router to know) that particular disjoint address prefixes map into separate VPRNs, or by tagging the routing advertisements from the CPE router with the appropriate VPN identifier 🎀. For example, if MPLS is being used to convey stub link reachability information, different MPLS labels would be used to tell apart the disjoint prefixes assigned to particular VPRNs 🌈. Either way, some administrative procedure would be required for this coordination 📋.
5.3.3.2 Configuration
The reachability information across each stub link could be manually configured 🍓, which may be appropriate if the set of addresses or prefixes is small and static 🌸.
5.3.3.3 ISP Administered Addresses
The set of addresses used by each stub site could be administered and allocated via the VPRN edge router 🧚. This may be appropriate for small customer sites, typically containing either a single host or a single subnet 💖. Address allocation can be carried out using protocols such as PPP or DHCP [37]. For example, the edge router could act as a Radius client and retrieve the customer's IP address to use from a Radius server, or it could act as a DHCP relay and examine the DHCP reply message as it is relayed to the customer site 🦋. This way, the edge router can build up a table of stub link reachability information ✨. Although these address assignment mechanisms are typically used to assign an address to a single host, some vendors have added extensions where an address prefix can be assigned. In some cases, the CPE device acts as a "mini-DHCP" server and assigns addresses for the hosts in the customer site 🙈.
Note that with these schemes, it is the responsibility of the address allocation server to make sure each site in the VPN receives a disjoint address space 🔥. Also note that an ISP would typically only use this mechanism for small stub sites, which are unlikely to have backdoor links 💅.
5.3.3.4 MPLS Label Distribution Protocol
In cases where the CPE router runs MPLS, LDP can be used to convey the set of prefixes at a stub site to a VPRN edge router 🌈. Using the downstream unsolicited mode of label distribution, the CPE router can distribute a label for each route in the stub site 💜. Note however that the processing the edge router does in this case is more than just the normal LDP processing 👑. That's because it is learning new routes via LDP, rather than the usual case of learning labels for existing routes it has already learned through standard routing mechanisms 🫶.
5.3.4 Intra-VPN Reachability Information
Once an edge router has worked out the set of prefixes associated with each of its stub links, this information must be disseminated to each other edge router in the VPRN ✨. Note also that there is an implicit requirement that the set of reachable addresses within the VPRN be locally unique. That is, each VPRN stub link (not performing load sharing) maintains an address space disjoint from any other, so routing stays unambiguous 🔒. In practical terms, it is also generally desirable, though not required, that this address space be well partitioned. That means specific, disjoint address prefixes per edge router, so there's no need to maintain and disseminate large numbers of host routes 🎀.
The problem of intra-VPN reachability information dissemination can be solved in a number of ways 🦋. Some of them include the following:
5.3.4.1 Directory Lookup
Along with VPRN membership information, a central directory could maintain a listing of the address prefixes associated with each customer site 📇. The server could obtain such information through protocol interactions with each edge router 🧚. Note that the same directory synchronization issues discussed above in section 5.3.2 also apply in this case 🙈.
5.3.4.2 Explicit Configuration
The address spaces associated with each edge router could be explicitly configured into each other router 💅. This is clearly a non-scalable solution, especially when arbitrary topologies are used 😬. It also raises the question of how the management system learns such information in the first place 🤔.
5.3.4.3 Local Intra-VPRN Routing Instantiations
In this approach, each edge router runs an instance of a routing protocol (a 'virtual router') per VPRN, running across the VPRN tunnels to each peer edge router, to disseminate intra-VPRN reachability information 🌈. Both full-mesh and arbitrary VPRN topologies can be supported easily, since the routing protocol itself can run over any topology 🫶. The intra-VPRN routing advertisements could be told apart from normal tunnel data packets either by being addressed directly to the peer edge router, or by a tunnel-specific mechanism 💜.
Note that this intra-VPRN routing protocol need have no relationship with either the IGP of any customer site or the routing protocols operated by the ISPs in the IP backbone 👑. Depending on the size and scale of the VPRNs to be supported, either a simple protocol like RIP or a more sophisticated protocol like OSPF could be used ✨. Because the intra-VPRN routing protocol operates as an overlay over the IP backbone, it is completely transparent to any intermediate routers, and to any edge routers not within the VPRN 🦋. This also means such routing information can stay opaque to those routers, which may be a necessary security requirement in some cases 🔐. Also note that if the routing protocol runs directly over the same tunnels as the data traffic, then it inherits the same level of security as the data traffic gets, for example strong encryption and authentication 🛡️.
If the tunnels an intra-VPRN routing protocol runs over are dedicated to a specific VPN (for example, a different multiplexing field is used for each VPN), then no changes are needed to the routing protocol itself 🎀. On the other hand, if shared tunnels are used, then the routing protocol must be extended to allow a VPN-ID field to be included in routing update packets 🙈. That way, sets of prefixes can be associated with a particular VPN 💖.
5.3.4.4 Link Reachability Protocol
By link reachability protocol, we mean a protocol that allows two nodes connected via a point-to-point link to exchange reachability information 🔗. Given a full mesh topology, each edge router could run a link reachability protocol across the tunnel to each peer edge router in the VPRN. For instance, some variation of MPLS CR-LDP could be used 🌸. The protocol carries the VPN-ID and the reachability information of each VPRN running across the tunnel between the two edge routers 🧚. If VPRN membership information has already been distributed to an edge router, the neighbor discovery aspects of a traditional routing protocol aren't needed, since the set of neighbors is already known 💅. TCP connections can be used to interconnect the neighbors, to provide reliability 🫶. This approach may reduce the processing burden of running routing protocol instances per VPRN, and it may be especially useful where a shared tunnel mechanism is used to connect a set of edge routers supporting multiple VPRNs 🔥.
Another approach to developing a link reachability protocol would be to base it on IBGP ✨. The problem a link reachability protocol needs to solve is very similar to the one IBGP solves: conveying address prefixes reliably between edge routers 💜.
Using a link reachability protocol, it is straightforward to support a full mesh topology. Each edge router conveys its own local reachability information to all other routers, but does not redistribute information received from any other router 🦋. However, once an arbitrary topology needs to be supported, the link reachability protocol needs to grow into a full routing protocol, because mechanisms are needed to avoid loops 🌀. There would seem to be little benefit in reinventing another routing protocol to deal with this 🙄. Some reasons why partially connected meshes may be needed, even in a tunneled environment, are discussed in section 5.1.1 🌈.
5.3.4.5 Piggybacking in IP Backbone Routing Protocols
okay so, just like with VPRN membership 💅, the set of address prefixes tied to each stub interface can also get piggybacked onto the routing advertisements from each edge router and spread through the network 🦋. Other edge routers pull this info out of the route advertisements they receive, the same way they grab VPRN membership info (which here is implicit in who the source of each route advertisement is) ✨. ngl, this scheme may require, depending on which routing protocols are involved, that intermediate routers like border routers cache intra-VPRN routing information so they can pass it further along 🫶. This also has implications for the trust model and for how secure intra-VPRN routing information can possibly be 😭.
Also, in any of the cases above, an edge router gets to choose whether it disseminates its stub link prefixes so that remote edge routers can tunnel directly to the egress stub links 🎀. Or it can announce all those prefixes as belonging to the edge router itself, not to specific stub links 💜. If it does that, the edge router would need a VPN specific forwarding mechanism for egress traffic to figure out the correct egress stub link 🙈. The upside? It may significantly cut down on the number of distinct tunnels or tunnel label info that need to be built and maintained 👑. Note that this choice is purely a local matter and is not visible to remote edge routers 🌸.
5.3.5 Tunneling Mechanisms
Once VPRN membership info has been spread around 📣, the tunnels making up the VPRN core can finally get built 🧚.
One approach to setting up the tunnel mesh is point-to-point IP tunnels. The requirements and issues for these were discussed in section 3.0 📚. Manual configuration can set up tunnels, but it's clearly not likely to be a scalable solution because of the O(n^2) problem of meshed links 🙈. So tunnel setup should use some form of signalling protocol that lets two nodes build a tunnel to each other knowing only each other's identity 💖.
Another approach is to use the multipoint to point 'tunnels' provided by MPLS. As noted in [38], MPLS can be considered a form of IP tunneling, since MPLS labels let routing decisions be decoupled from the packets' own addressing info 🌈. MPLS label distribution mechanisms can associate specific sets of MPLS labels with particular VPRN address prefixes supported on particular egress points (i.e., stub links of edge routers). That way, other edge routers can explicitly label and route traffic to particular VPRN stub links 🦋.
One attraction of MPLS as a tunneling mechanism is that it may require less processing within each edge router than alternative tunneling mechanisms ⚡. This is because data security within an MPLS network is implicit in the explicit label binding, kinda like a connection oriented network such as Frame Relay 💅. This may hence lessen customer concerns about data security and hence require less processor intensive security mechanisms (e.g., IPSec). However, there are other potential security concerns with MPLS 😬. There is no direct support for security features like authentication, confidentiality, and non-repudiation, and the trust model for MPLS means that intermediate routers (which may belong to different administrative domains) through which membership and prefix reachability info is conveyed must be trusted, not just the edge routers themselves 💀.
5.4 Multihomed Stub Routers
Okay, so the discussion so far has implicitly assumed that stub routers hook up to one and only one VPRN edge router 🍓. In general, this should be capable of being relaxed without changing VPRN operation at all, given the market's interest in multihoming for reliability and other reasons 🌸. Specifically, if the stub router has multiple redundant links with only one operational at a time, whether those links go to the same VPRN edge router or to two or more different ones, then the stub link reachability mechanisms will both detect the loss of an active link and the activation of a backup link 🔥. In the former case, the previously connected edge router stops advertising reachability to the stub node, while the edge router with the now active link starts advertising, restoring connectivity ✨.
An alternative is where the stub node has multiple active links using some form of load sharing algorithm 🎀. Then multiple VPRN edge routers may have active paths to the stub node and may advertise that across the VPRN 🦋. This should not cause problems with reachability across the VPRN, as long as the intra-VPRN reachability mechanism can handle multiple paths to the same prefix and has appropriate mechanisms to preclude looping, for instance distance vector metrics associated with each advertised prefix 💜.
5.5 Multicast Support
Multicast and broadcast traffic can be supported across VPRNs either by edge replication or by native multicast support in the backbone 📡. These two cases are discussed below 👀.
5.5.1 Edge Replication
This is where each VPRN edge router replicates multicast traffic for transmission across each link in the VPRN 🐣. Note that this is the same operation that CPE routers terminating actual physical links or dedicated connections would perform 🫶. Like CPE routers, multicast routing protocols could also be run on each VPRN edge router to determine the distribution tree for multicast traffic, and hence reduce unnecessary flood traffic 🌊. This could be done by running instances of standard multicast routing protocols, e.g., Protocol Independent Multicast (PIM) [39] or Distance Vector Multicast Routing Protocol (DVMRP) [40], on and between each VPRN edge router, through the VPRN tunnels. It works the same way unicast routing protocols might run at each VPRN edge router to determine intra-VPN unicast reachability, as discussed in section 5.3.4 🧠. Alternatively, if a link reachability protocol ran across the VPRN tunnels for intra-VPRN reachability, it could also be augmented so VPRN edge routers indicate both the particular multicast groups requested for reception at each edge node and the multicast sources at each edge site 💖.
In either case, there would need to be some mechanism for VPRN edge routers to figure out which multicast groups were requested at each site and which sources were present at each site 🕵️. How this gets done depends on the capabilities of the CPE stub routers at each site 🎀. If they run multicast routing protocols, they can interact directly with the equivalent protocols on each VPRN edge router 🫶. If the CPE device doesn't run a multicast routing protocol, then in the absence of Internet Group Management Protocol (IGMP) proxying [41], the customer site would be limited to a single subnet connected to the VPRN edge router via a bridging device, since the scope of an IGMP message is limited to one subnet 😭. However, using IGMP proxying, the CPE router can engage in multicast forwarding without running a multicast routing protocol, in constrained topologies ✨. On its interfaces into the customer site, the CPE router performs the router functions of IGMP, and on its interface to the VPRN edge router, it performs the host functions of IGMP 🧚.
5.5.2 Native Multicast Support
This is where VPRN edge routers map intra-VPRN multicast traffic onto a native IP multicast distribution mechanism across the backbone 🌐. Note that intra-VPRN multicast has the same requirements for isolation from general backbone traffic as intra-VPRN unicast traffic 🔒. Currently, the only IP tunneling mechanism with native multicast support is MPLS 💜. On the other hand, while MPLS supports native transport of IP multicast packets, additional mechanisms would be needed to leverage that for intra-VPRN multicast support 🙃.
For instance, each VPRN router could prefix multicast group addresses within each VPRN with the VPN-ID of that VPRN, and then redistribute these, treating this VPN-ID/intra-VPRN multicast address tuple as a normal multicast address within the backbone multicast routing protocols, the same as with unicast reachability, as discussed previously 🦋. The MPLS multicast label distribution mechanisms could then be used to set up the appropriate multicast LSPs to interconnect those sites within each VPRN supporting particular multicast group addresses 🛤️. Note, however, that this would require each of the intermediate LSRs to not only be aware of each intra-VPRN multicast group, but also to have the capability of interpreting these modified advertisements 🤓. Alternatively, mechanisms could be defined to map intra-VPRN multicast groups into backbone multicast groups ✨.
Other IP tunneling mechanisms do not have native multicast support 😤. It may prove feasible to extend such tunneling mechanisms by allocating IP multicast group addresses to the VPRN as a whole, and hence distributing intra-VPRN multicast traffic encapsulated within backbone multicast packets 🎁. Edge VPRN routers could filter out unwanted multicast groups 🚫. Alternatively, mechanisms could also be defined to allow for allocation of backbone multicast group addresses for particular intra-VPRN multicast groups, and to then utilize these, through backbone multicast protocols, as discussed above, to limit forwarding of intra-VPRN multicast traffic only to those nodes within the group 🫧.
A particular issue with the use of native multicast support is the provision of security for such multicast traffic 🚨. Unlike the case of edge replication, which inherits the security characteristics of the underlying tunnel, native multicast mechanisms will need to use some form of secure multicast mechanism 🔐. The development of architectures and solutions for secure multicast is an active research area; for example, see [42] and [43] 🧪. The Secure Multicast Group (SMuG) of the IRTF has been set up to develop prototype solutions, which would then be passed to the IETF IPSec working group for standardization 👑.
However considerably more development is needed before scalable secure native multicast mechanisms can be generally deployed 💅.
5.6 Recommendations ✨
okay so the VPRN proposals out there basically fall into two camps 💅 one camp is the router piggybacking crew, who hitch VPN membership and/or reachability info onto routing stuff ([13],[15]), and the other is the virtual routing crew ([12],[14]). fr, some of these mechanisms lean on a particular infrastructure (e.g. MPLS) instead of just IP 🫶
Within the virtual routing vibe, it could be super useful to build a membership distribution protocol based on a directory or MIB 📖 Pair that with the protocol extensions for IP tunneling protocols from section 3.2 and you get a full set of protocols and mechanisms for interoperable VPRNs that span multiple administrations over an IP backbone 🌈 The other big piece, learning and distributing customer reachability info, can be handled by instances of standard routing protocols, no protocol extensions needed ✨ (iykyk, routing just works 🙈)
For the constrained full mesh case, a link reachability protocol could be examined 🦋 but the limitations and scalability issues with this topology may make it not worth building something specific, since standard routing will just work 💖
Extending routing protocols to carry a VPN-ID in routing update packets could also be examined too 🎀 It's not necessary if VPN specific tunnels are used though.
6.0 VPN Types: Virtual Private Dial Networks 📞
okay bestie, so a Virtual Private Dial Network (VPDN) lets a remote user connect on demand through an ad hoc tunnel into another site 🌸 The user hooks up to a public IP network over a dial-up PSTN or ISDN link, and their packets get tunneled across the public network to the desired site, so it feels like they're directly plugged into that site 😭 A key thing about these ad hoc connections is that user authentication is a prime requirement, because anyone could potentially try to get into that site over a switched dial network 🔥
Today, plenty of corporate networks let remote users dial in through the PSTN, with users setting up PPP connections across an access network to a network access server. At that point, the PPP sessions get authenticated using AAA systems running standard protocols like Radius [44]. Since these systems are everywhere, any VPDN system has to, in practice, allow for near transparent re-use of them 💅
The IETF developed the Layer 2 Tunneling Protocol (L2TP) [8], which extends user PPP sessions from an L2TP Access Concentrator (LAC) to a remote L2TP Network Server (LNS) 🦋 L2TP was built on two earlier protocols, the Layer 2 Forwarding protocol (L2F) [45] and the Point-to-Point Tunneling Protocol (PPTP) [46], and you can see that in the two pretty different scenarios L2TP supports: compulsory tunneling and voluntary tunneling, which get discussed further below in sections 6.2 and 6.3 🌈
This document focuses on L2TP over an IP network (using UDP), but L2TP can also run directly over other protocols like ATM or Frame Relay ✨ Issues specific to running L2TP over non-IP networks, like how to secure such tunnels, are not addressed here 🙈
6.1 L2TP protocol characteristics 🎀
this section looks at L2TP's characteristics using the categories from section 3.0 💖
6.1.1 Multiplexing
L2TP has built-in support for multiplexing multiple calls from different users over a single link 🫶 Between the same two IP endpoints, there can be multiple L2TP tunnels, each identified by a tunnel-id, and multiple sessions within a tunnel, each identified by a session-id 🧚
6.1.2 Signalling
This is handled by the inbuilt control connection protocol, which lets both tunnels and sessions get set up dynamically ⭐
6.1.3 Data Security
Since L2TP transparently extends PPP from the user, through the LAC, to the LNS, it lets you use whatever security mechanisms normal PPP connections use, for both connection setup and data transfer 🔐 Hmm, but ngl this does not secure the L2TP control protocol itself 💀 To fix that, L2TP could be further secured by running it together with IPSec through IP backbones [47], [48], or by related mechanisms on non-IP backbones [49] 🛡️
heads up, bestie: the control protocol is NOT protected by the PPP security stuff. you have to bring in IPSec or a related mechanism for that 🚨
The way L2TP interacts with AAA systems for user authentication and authorization depends on the specific way L2TP is being used, plus the nature of the devices supporting the LAC and the LNS 🧠 These issues get discussed in depth in [50] 📚
How the host figures out which LAC to connect to, how the LAC decides which users to tunnel further, and the LNS parameters for each user are all outside the scope of VPDN operation 🙃 They might get addressed by evolving Internet roaming specifications [51], though 🌍
6.1.4 Multiprotocol Transport
L2TP transports PPP packets (and only PPP packets), so it can carry multiprotocol traffic, because PPP itself is multiprotocol 🌈
6.1.5 Sequencing
L2TP supports sequenced delivery of packets 🔢 This can be negotiated at session establishment, and an LNS can turn it on and off during a session. The sequence number field in L2TP can also indicate dropped packets, which various PPP compression algorithms need in order to work correctly 🗜️ If no compression is in use, and the LNS determines that the protocols in use (as shown by the PPP NCP negotiations) can deal with out of sequence packets (e.g. IP), then it may disable sequencing 🙌
6.1.6 Tunnel Maintenance
L2TP uses a keepalive protocol so it can tell a tunnel outage apart from prolonged periods of tunnel inactivity 💓
6.1.7 Large MTUs
L2TP itself has no built-in support for segmentation and reassembly 🧩 but when it runs over UDP/IP, IP fragmentation will happen if necessary 🪓 A LAC or LNS may adjust the Maximum Receive Unit (MRU) negotiated via PPP to avoid fragmentation, if it knows the MTU used on the path between the LAC and LNS 📏 There's also a proposal to allow MTU discovery for cases where the L2TP tunnel carries IP frames [52] 🔍
6.1.8 Tunnel Overhead
L2TP over IP networks runs over UDP and must be used to carry PPP traffic 🎁 That adds a lot of overhead, both in the data plane (UDP, L2TP and PPP headers) and in the control plane (the L2TP and PPP control protocols) 😩 This is discussed further in section 6.3.
6.1.9 Flow and Congestion Control
L2TP supports flow and congestion control mechanisms for the control protocol, but not for data traffic 🚦 See section 3.1.9 for more details 📖
6.1.10 QoS / Traffic Management
An L2TP header has a 1-bit priority field, which can be set for packets that may need preferential treatment (e.g. keepalives) during local queuing and transmission ⚡ Also, by transparently extending PPP, L2TP has built-in support for PPP mechanisms like multi-link PPP [53] and its associated control protocols [54], which allow bandwidth on demand to meet user requirements 📶
L2TP calls can also be mapped into whatever underlying traffic management mechanisms exist in the network 🛣️ and there are proposals to let L2TP signalling request specific differentiated services behaviors [55] 🎯
6.1.11 Miscellaneous
Since L2TP is designed to transparently extend PPP, it doesn't try to replace the normal address assignment mechanisms that come with PPP 🏠 So, generally speaking, the host that starts the PPP session gets an address from the LNS using PPP procedures 🪪 That address may have no relation to the addressing used between the LAC and LNS 🤷♀️ The LNS will also need to support whatever forwarding mechanisms are needed to route traffic to and from the remote host 🚀
6.2 Compulsory Tunneling 💅
okay bestie, compulsory tunneling is when a network node (think a dial or network access server) acting as a LAC extends a PPP session across a backbone using L2TP to a remote LNS 🌐. the user dialing in to the LAC has no clue it's happening, and that's the whole vibe 🫶. this lets the location and/or ownership of the modem pools used to answer dial calls be split off from the site people actually get access to 🦋. fun fact: supporting this was the original goal of the L2F spec, which L2TP was built on 🎀
there are lots of ways this can be set up ✨. one example (see the diagram below) is a subscriber host dialing into a NAS acting as a LAC, then getting tunneled across an IP network like the Internet to a gateway acting as an LNS 🌸. that gateway gives access to a corporate network, and it could either be a device inside the corporate network itself, or an ISP edge router, if a customer has outsourced maintaining their LNS functionality to an ISP 💼. another scenario is an ISP using L2TP to give a subscriber access to the Internet. the subscriber host dials into a NAS acting as a LAC and gets tunneled across an access network to an ISP edge router acting as an LNS. that edge router then feeds the subscriber traffic into the Internet 🌈. and yet more scenarios have an ISP using L2TP to give a subscriber access to a VPRN, or concurrent access to both a VPRN and the Internet 👑
a VPDN, whether it's compulsory or voluntary tunneling, can be seen as just another type of access method for subscriber traffic 💜. so it can be used to connect to different kinds of networks, like a corporate network, the Internet, or a VPRN 🧚. that last scenario is also an example of how a VPN service given to a customer can be built from a mix of different types of VPN 🔥
10.0.0.1
+----+
|Host|----- LAC ------------- LNS 10.0.0.0/8
+----+ / +-----+ ( ) +-----+ ---------
/----| NAS |---( IP Backbone )---| GW |----( Corp. )
dial +-----+ ( ) +-----+ ( Network )
connection ------------- ---------
<------- L2TP Tunnel ------->
<--------------------- PPP Session ------->
Figure 6.1: Compulsory Tunneling Examplecompulsory tunneling was originally meant for network access servers doing wholesale dial services 📞. it lets remote users dial in through shared facilities to an enterprise site, without the enterprise needing to run its own dial servers 🙌. another example: an ISP outsources its dial connectivity to an access network provider (like a Local Exchange Carrier (LEC) in the USA), so the ISP doesn't have to maintain its own dial servers, and the LEC can serve multiple ISPs at once 💅. more recently, compulsory tunneling mechanisms have also been proposed for evolving Digital Subscriber Line (DSL) services [56], [57], which also aim to make use of the existing AAA infrastructure 🦋
call routing for compulsory tunnels needs some part of the initial PPP call setup to let the LAC figure out who the LNS is 🗺️. as noted in [50], those clues can include the user identity (figured out from something in the access network, like the calling party number), or some attribute of the called party, like the Fully Qualified Domain Name (FQDN) of the identity claimed during PPP authentication 🔍
it's also possible to chain two L2TP tunnels together 🔗. a LAC starts a tunnel to an intermediate relay device, which acts as an LNS to this first LAC and as a LAC to the final LNS. this might be needed in some cases because of administrative, organizational or regulatory issues around splitting things between the access network provider, the IP backbone provider and the enterprise customer 🫠
6.3 Voluntary Tunnels 🌸
voluntary tunneling is when an individual host connects to a remote site using a tunnel that starts on the host itself, with no help from intermediate network nodes (see below) 🙋♀️. the PPTP spec, parts of which got folded into L2TP, was built on this voluntary tunneling model 💖
just like compulsory tunneling, there are different deployment scenarios ✨. the diagram below shows a subscriber host accessing a corporate network where either L2TP or IPSec is the voluntary tunneling mechanism 🔐. another scenario is voluntary tunneling used to give a subscriber access to a VPRN 🎀
6.3.1 Issues with Use of L2TP for Voluntary Tunnels 🙈
the L2TP spec does support voluntary tunneling, in the sense that the LAC can be located on a host instead of only on a network node 💻. but heads up, such a host has two IP addresses: one for the LAC-LNS IP tunnel, and another (usually given out via PPP) for the network it's connecting to 👯♀️. the upside of using L2TP for voluntary tunneling is that PPP's existing authentication and address assignment mechanisms can be reused without changes 🥰. for example, an LNS could also include a Radius client, and talk to a Radius server to authenticate a PPP PAP or CHAP exchange and grab configuration info for the host, like its IP address and a list of DNS servers to use 📋. that info can then be handed to the host through the PPP IPCP protocol 🧚
10.0.0.1
+----+
|Host|----- ------------- 10.0.0.0/8
+----+ / +-----+ ( ) +-----+ ---------
/----| NAS |---( IP Backbone )---| GW |----( Corp. )
dial +-----+ ( ) +-----+ ( Network )
connection ------------- ---------
<-------------- L2TP Tunnel -------------->
with LAC on host
<-------------- PPP Session --------------> LNS on gateway
or
<-------------- IPSEC Tunnel -------------->
Figure 6.2: Voluntary Tunneling ExampleBUT (and it's a big but 😭) this whole setup has costs. there's a LOT of overhead with this protocol stack, especially when IPSec is needed for security too, and especially if the host is on a low-bandwidth dial-up link 🐌. that overhead shows up as extra headers in the data plane and extra control protocols in the control plane 📦. so when L2TP is used for voluntary tunneling and secured with IPSec, a web app, for example, would run over this stack:
HTTP/TCP/IP/PPP/L2TP/UDP/ESP/IP/PPP/AHDLC[58] proposes using IPSec alone for voluntary tunnels to cut down on overhead, with this stack instead:
HTTP/TCP/IP/ESP/IP/PPP/AHDLCin that case IPSec is used in tunnel mode, and the tunnel ends either on an IPSec edge device at the enterprise site, or on the provider edge router connected to the enterprise site 🏢. there are two ways the host can handle IP addressing. one is to use two IP addresses, similar to the L2TP case. the other is for the host to use a single public IP address as the source in both inner and outer IP headers, with the gateway doing Network Address Translation (NAT) before forwarding traffic into the enterprise network 🌍. to other hosts in the enterprise network, the host looks like it has an 'internal' IP address 🕵️♀️. using NAT does come with some limitations and restrictions, which [58] also points out ⚠️
another area of potential trouble with PPP is that a link layer run through an L2TP tunnel over an IP backbone is really different from a link layer running over a serial line, as the L2TP spec itself discusses 🧐. for example, badly chosen PPP parameters may lead to frequent resets and timeouts, especially if compression is in use 😵. that's because an L2TP tunnel may misorder packets and may silently drop packets, and neither of those normally happens on serial lines 💀. the general packet loss rate could also be a lot higher because of network congestion 📉. using the sequence number field in an L2TP header fixes the misordering issue. and in cases where the LAC and LNS are coincident with the PPP endpoints, like in voluntary tunneling, the sequence number field can also be used to detect a dropped packet and pass a suitable indication to any compression entity in use 🧠. that matters because compression entities typically need that knowledge to keep their compression histories in sync at both ends ✨. (honestly this is more of an issue with compulsory tunneling, since the LAC may have to deliberately send a corrupted frame to the PPP host to signal packet loss, and some hardware may not allow that 🙃)
6.3.2. Issues with Use of IPSec for Voluntary Tunnels ✨
okay so if you use IPSec for voluntary tunneling, you still need to do the jobs PPP handled for L2TP: user authentication and host configuration 🫶 there's a difference between machine authentication and user authentication, and it matters. Two factor auth means checking something the user has (like a machine or a smartcard with a digital certificate) AND something the user knows (like a password) 🔐 think of getting cash from a bank ATM: you need the card and the PIN. A lot of the legacy user auth schemes people still use are asymmetric, and IKE doesn't support them 💀 for remote access, the usual setup is PPP between the user and the access server, with RADIUS between the access server and the authentication server. The auth exchanges there (like PAP or CHAP) are asymmetric too. CHAP also lets the network re-check the user at any point after the session starts, so you know it's still the same person who started it 👀
IKE is super strong for machine auth, but for user auth it's pretty limited and has zero support for asymmetric user auth 😤 you can derive a key from a user password and use it as a preshared key, but that doesn't work with IKE Main Mode in a remote access setup, because the user won't have a fixed IP address. Aggressive Mode works instead, but it gives up identity protection, so it's not the vibe 🙅♀️ that's why people have proposed a bunch of ways to support legacy asymmetric user auth over IPSec. [59] defines a new IKE message exchange, the transaction exchange, which supports both Request/Reply and Set/Acknowledge message sequences, and it also has attributes for client IP stack configuration 🎀 [60] and [61] use the transaction exchange (or a series of them), run between the IKE Phase 1 and Phase 2 exchanges, to do user auth ✨ and [62] goes a different route that doesn't touch IKE itself: the user sets up a Phase 1 SA with a security gateway, then a Phase 2 SA to that gateway, and runs an existing auth protocol over it. The gateway acts as a proxy and relays the messages to an authentication server 🦋
There are also proposals for giving the remote host its IP address and other config over IPSec 🌸 for example, [63] has the remote host set up a Phase 1 SA with a security gateway, then a Phase 2 SA to the gateway, and run DHCP over that. The gateway proxies and relays the messages to the DHCP server. Like [62], this one doesn't change IKE either 💅
Another PPP feature you might need is multiprotocol operation 🌈 you may need to carry network layer protocols other than IP, and even link layer protocols (like ethernet), so you can do bridging over IPSec. This is covered in section 3.1.4 💜
The ways to support legacy user auth and host config in remote access setups are still being discussed in the IPSec working group 🧚
6.4. Networked Host Support 🍓
The current PPP dial model assumes a host is plugged directly into a connection-oriented dial access network. New access techs like DSL have tried to copy that model [57] so existing AAA systems can keep being reused ✨ but personal computers, printers, and other network appliances are showing up everywhere in homes and small businesses, and networking keeps getting cheaper, so the directly connected host model is getting shaken up 😭 most hosts are going to reach the Internet through small local area networks, usually Ethernet ones.
So there's interest in fitting the existing AAA infrastructure inside service providers while also supporting several networked hosts at each customer site 🫶 the big complication is supporting the login dialogue, which is where the right AAA info gets exchanged. A few proposals have tried to solve this:
6.4.1. Extension of PPP to Hosts Through L2TP 🦋
A number of proposals (e.g. [56]) extend L2TP over Ethernet so PPP sessions can run from networked hosts out to the network, pretty much the same way a directly attached host does it 👑
6.4.2. Extension of PPP Directly to Hosts: 🎀
There's also a spec for mapping PPP directly onto Ethernet (PPPOE) [64]. It uses a broadcast mechanism so hosts can find access servers to connect to 🔍 those servers can then tunnel the PPP sessions further, if needed, using L2TP or something similar 🌸
6.4.3. Use of IPSec 🔐
The IPSec voluntary tunneling mechanisms we just talked about can be used with either networked or directly connected hosts ✨
Heads up: all of these methods need extra host software, which implements LAC, PPPOE client, or IPSec client functionality. Don't skip it!
6.5. Recommendations 👑
The L2TP spec is finalized and it's going to be widely used for compulsory tunneling 🎉 like we covered in section 3.2, defining specific modes of operation for IPSec when it's used to secure L2TP would be a real win 💜
For voluntary tunneling with IPSec, finishing the work on these areas would also be useful 🌈
- asymmetric / legacy user authentication (6.3)
- host address assignment and configuration (6.3)
along with any other issues specifically tied to supporting remote hosts. Right now there are lots of different non-interoperable proprietary solutions in this space, and that's a mess 😭
7.0. VPN Types: Virtual Private LAN Segment 🌸
A Virtual Private LAN Segment (VPLS) emulates a LAN segment using Internet facilities 🦋 it can give you what's sometimes called a Transparent LAN Service (TLS), which lets you connect several stub CPE nodes (bridges or routers) in a protocol-transparent way 💅 a VPLS emulates a LAN segment over IP the same way protocols like LANE emulate one over ATM. The big perks are complete protocol transparency, which can matter for multiprotocol transport and also for regulatory reasons in certain service provider contexts 🫶
10.1.1.1 +--------+ +--------+ 10.1.1.2
+---+ | ISP | IP tunnel | ISP | +---+
|CPE|-------| edge |-----------------------| edge |-------|CPE|
+---+ stub | node | | node | stub +---+
link +--------+ +--------+ link
^ | | ^
| | --------------- | |
| | ( ) | |
| +----( IP BACKBONE )----+ |
| ( ) |
| --------------- |
| | |
|IP tunnel +--------+ IP tunnel|
| | ISP | |
+-----------| edge |-----------+
| node |
+--------+ subnet = 10.1.1.0/24
|
stub link |
|
+---+
|CPE| 10.1.1.3
+---+
Figure 7.1: VPLS Example7.1. VPLS Requirements 💖
Topologically and operationally, a VPLS is basically the same as a VPRN, except every VPLS edge node does link layer bridging instead of network layer forwarding 🧚 so most of the VPRN tunneling and config mechanisms from before also work for a VPLS, with changes to handle link layer packets and addressing instead of network layer ones. The next sections cover the main VPRN operation changes needed to support VPLSs ✨
7.1.1. Tunneling Protocols 🎀
The tunneling protocols in a VPLS can be exactly the same as the ones in a VPRN, as long as the protocol can carry multiprotocol traffic, and that's what we're assuming below 💜
7.1.2. Multicast and Broadcast Support 📡
A VPLS needs broadcast capability 📣 that covers broadcast frames and also link layer packet flooding, where a unicast frame gets flooded because the path to its destination link layer address is unknown. Address resolution protocols over a bridged network usually use broadcast frames (ARP is the classic example) 🙈 the same multicast tunneling options we talked about for VPRNs also apply to a VPLS, but since broadcast shows up more often in VPLSs, there's extra pressure for native multicast support that cuts down on the replication work on VPLS edge nodes, for instance 🔥
7.1.3. VPLS Membership Configuration and Topology 🌈
Configuring VPLS membership works like it does for VPRNs, because it usually just needs the local VPN link assignments at each VPLS edge node, plus the identity of (or route to) the other edge nodes in the VPLS. Config like this doesn't depend on how forwarding works at each VPN edge node 🫶 so any membership configuration and dissemination mechanism we covered for VPRNs can be used for VPLS config too. Also like VPRNs, you could easily manipulate the VPLS topology by controlling the peer config at each VPLS edge node, as long as the membership dissemination mechanism allows it 💅 typical VPLSs are probably going to be fully meshed 🕸️ that way traffic between two VPLS nodes never has to transit through another VPLS node, which would otherwise require the Spanning Tree protocol [65] for loop prevention 😭
7.1.4 CPE Stub Node Types 🧚
okay so a VPLS can support either bridges or routers as the CPE device 🎀
CPE routers would peer transparently across a VPLS with each other, and they wouldn't need any router peering with any nodes inside the VPLS 🦋 The same scalability issues that apply to a full mesh topology for VPRNs also apply here. The only difference is that the number of peering routers could be way bigger, since the ISP edge device isn't acting as an aggregation point anymore 💀
With CPE bridge devices, the broadcast domain covers all the CPE sites and the VPLS itself 🫶 That's a big scalability problem because of the need for packet flooding, and because any topology change in the bridged domain isn't localized. It's visible everywhere in the domain. So this setup is generally only suited for supporting non-routable protocols 🙈
The nature of the CPE affects the encapsulation, addressing, forwarding and reachability protocols inside the VPLS. We'll talk about each of those separately below 💅
7.1.5 Stub Link Packet Encapsulation ✨
7.1.5.1 Bridge CPE
In this case, packets sent to and from the VPLS across stub links are link layer frames, with a suitable access link encapsulation. The most common case is likely to be ethernet frames, using an encapsulation that fits the particular access technology (such as ATM) to connect the CPE bridges to the VPLS edge nodes. Those frames are then forwarded at layer 2 onto a tunnel used in the VPLS. As we said before, this does mandate using an IP tunneling protocol that can transport link layer frames 🚇 Note that this doesn't necessarily mandate a protocol identification field in each tunnel packet, though, since the nature of the encapsulated traffic (e.g. ethernet frames) could be indicated at tunnel setup 🧠
7.1.5.2 Router CPE
In this case, typically, CPE routers send link layer packets to and from the VPLS across stub links, destined to the link layer addresses of their peer CPE routers. Other types of encapsulations might also be feasible here 👀 The relatively constrained addressing space needed for a VPLS where only router CPE are connected could allow for alternative encapsulations, as we'll discuss further below.
7.1.6 CPE Addressing and Address Resolution 🍓
7.1.6.1 Bridge CPE
Since a VPLS operates at the link layer, all hosts within all stub sites will typically be in the same network layer subnet when you're using bridge CPE 🏠 (Multinetting, where multiple subnets operate over the same LAN segment, is possible, but way less common.) Frames are forwarded across and within the VPLS based on the link layer addresses (e.g. IEEE MAC addresses) associated with the individual hosts. The VPLS needs to support broadcast traffic, like the traffic typically used for the address resolution mechanism that maps host network addresses to their respective link addresses 📡 The VPLS forwarding and reachability algorithms also need to be able to handle flooded traffic, no cap 🌊
7.1.6.2 Router CPE
A single network layer subnet is generally used to interconnect router CPE devices across a VPLS. Behind each CPE router, though, are hosts in different network layer subnets 🌈 CPE routers transfer packets across the VPLS by mapping next hop network layer addresses to the link layer addresses of a router peer. A link layer encapsulation is used, most commonly ethernet, same as the bridge case 🎀
As we noted above, though, when all of the CPE nodes connected to the VPLS are routers, it might be possible, thanks to the constrained addressing space of the VPLS, to use encapsulations with a different address space than normal MAC addressing 🧚♀️ For instance, see [11], which proposes a mechanism for VPLSs over MPLS networks. It builds on earlier work on VPRN support over MPLS [38] and proposes MPLS as the tunneling mechanism, with locally assigned MPLS labels as the link layer addressing scheme to identify the CPE LSR routers connected to the VPLS 💜
7.1.7 VPLS Edge Node Forwarding and Reachability Mechanisms 🦋
7.1.7.1 Bridge CPE
The only practical VPLS edge node forwarding mechanism in this case is likely to be standard link layer packet flooding and MAC address learning, as per [65] 🫧 So no explicit intra-VPLS reachability protocol will be needed. There will still be a need for broadcast mechanisms to flood traffic, as we talked about above 📣 In general, it may not be necessary to also implement the Spanning Tree protocol between VPLS edge nodes, if the VPLS topology is such that no VPLS edge node is used for transit traffic between any other VPLS edge nodes. In other words, that's where there's both full mesh connectivity and transit is explicitly precluded 🙅♀️ On the other hand, the CPE bridges may well implement the spanning tree protocol to safeguard against 'backdoor' paths that bypass connectivity through the VPLS 🚧
7.1.7.2 Router CPE
Standard bridging techniques can also be used in this case 🌸 In addition, the smaller link layer address space of such a VPLS may also permit other techniques, with explicit link layer routes between CPE routers. For instance, [11] proposes that MPLS LSPs be set up, whenever any new CPE router is inserted into the VPLS, between all CPE LSRs. That then precludes the need for packet flooding 🙌 In the more general case, if stub link reachability mechanisms were used to configure VPLS edge nodes with the link layer addresses of the CPE routers connected to them, then modifications of any of the intra-VPN reachability mechanisms discussed for VPRNs could be used to propagate this information to each other VPLS edge node. That would then allow for packet forwarding across the VPLS without flooding 💅
Mechanisms could also be developed to further propagate the link layer addresses of peer CPE routers, and their corresponding network layer addresses, across the stub links to the CPE routers. That info could be inserted into the CPE router's address resolution tables, which would then also preclude the need for broadcast address resolution protocols across the VPLS 🎉
Clearly there would be no need for spanning tree protocols if explicit link layer routes were determined across the VPLS 🧃 If normal flooding mechanisms were used, though, spanning tree would only be required if full mesh connectivity wasn't available, and VPLS nodes therefore had to carry transit traffic 🌷
7.2 Recommendations 💌
There is significant commonality between VPRNs and VPLSs, and where possible, this similarity should be exploited to reduce development and configuration complexity 🧩 In particular, VPLSs should utilize the same tunneling and membership configuration mechanisms, with changes only to reflect the specific characteristics of VPLSs 💖
8.0 Summary of Recommendations 🏁
In this document we've looked at different types of VPNs individually. But there are many common requirements and mechanisms that apply to all types of VPNs, and many networks will contain a mix of different VPN types 🌈 It's super useful to have as much commonality as possible across these different VPN types. In particular, by standardizing a relatively small number of mechanisms, it's possible to allow a wide variety of VPNs to be implemented ✨
The benefits of adding support for the following mechanisms should be carefully examined 🔍
For IKE/IPSec:
- the transport of a VPN-ID when establishing an SA (3.1.2)
- a null encryption and null authentication option (3.1.3)
- multiprotocol operation (3.1.4)
- frame sequencing (3.1.5)
- asymmetric / legacy user authentication (6.3)
- host address assignment and configuration (6.3)
For L2TP:
- defining modes of operation of IPSec when used to support L2TP (3.2)
For VPNs generally:
- defining a VPN membership information configuration and dissemination mechanism, that uses some form of directory or MIB (5.3.2)
- ensure that solutions developed, as far as possible, are applicable to different types of VPNs, rather than being specific to a single type of VPN
9.0 Security Considerations 🔐
Security considerations are an integral part of any VPN mechanisms, and these are discussed in the sections describing those mechanisms 🛡️
10.0 Acknowledgements 🫶
Thanks to Anthony Alles, of Nortel Networks, for his invaluable assistance with the generation of this document, and who developed much of the material on which early versions of this document were based 👑 Thanks also to Joel Halpern for his helpful review comments 💜
11.0 References 📚✨
okay bestie, this is the bibliography, aka the list of every doc this one is built on 📚 it's giving research paper energy, and some of these are still "Work in Progress" drafts, which is so fun because they were literally still cooking when this went out 🍳
[1] ATM Forum. "LAN Emulation over ATM 1.0", af-lane-0021.000, January 1995.
[2] ATM Forum. "Multi-Protocol Over ATM Specification v1.0", af-mpoa-0087.000, June 1997.
[3] Ferguson, P. and Huston, G. "What is a VPN?", Revision 1, April 1 1998; http://www.employees.org/~ferguson/vpn.pdf.
[4] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, February 1996.
[5] Kent, S. and R. Atkinson, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.
[6] Perkins, C., "IP Encapsulation within IP", RFC 2003, October 1996.
[7] Hanks, S., Li, T., Farinacci, D. and P. Traina, "Generic Routing Encapsulation (GRE)", RFC 1701, October 1994.
[8] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2661, August 1999.
[9] Rosen, E., et al., "Multiprotocol Label Switching Architecture", Work in Progress.
[10] Heinanen, J., et al., "MPLS Mappings of Generic VPN Mechanisms", Work in Progress.
[11] Jamieson, D., et al., "MPLS VPN Architecture", Work in Progress.
[12] Casey, L., et al., "IP VPN Realization using MPLS Tunnels", Work in Progress.
[13] Li, T. "CPE based VPNs using MPLS", Work in Progress.
[14] Muthukrishnan, K. and A. Malis, "Core MPLS IP VPN Architecture", Work in Progress.
[15] Rosen, E. and Y. Rekhter, "BGP/MPLS VPNs", RFC 2547, March 1999.
[16] Fox, B. and B. Gleeson, "Virtual Private Networks Identifier", RFC 2685, September 1999.
[17] Petri, B. (editor) "MPOA v1.1 Addendum on VPN support", ATM Forum, af-mpoa-0129.000.
[18] Harkins, D. and C. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.
[19] Calhoun, P., et al., "Tunnel Establishment Protocol", Work in Progress.
[20] Andersson, L., et al., "LDP Specification", Work in Progress.
[21] Jamoussi, B., et al., "Constraint-Based LSP Setup using LDP" Work in Progress.
[22] Awduche, D., et al., "Extensions to RSVP for LSP Tunnels", Work in Progress.
[23] Kent, S. and R. Atkinson, "IP Encapsulating Security Protocol (ESP)", RFC 2406, November 1998.
[24] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, July 1994.
[25] Perez, M., Liaw, F., Mankin, A., Hoffman, E., Grossman, D. and A. Malis, "ATM Signalling Support for IP over ATM", RFC 1755, February 1995.
[26] Malkin, G. "RIP Version 2 Carrying Additional Information", RFC 1723, November 1994.
[27] Moy, J., "OSPF Version 2", STD 54, RFC 2328, April 1998.
[28] Shacham, A., Monsour, R., Pereira, R. and M. Thomas, "IP Payload Compression Protocol (IPComp)", RFC 2393, December 1998.
[29] Duffield N., et al., "A Performance Oriented Service Interface for Virtual Private Networks", Work in Progress.
[30] Jacobson, V., Nichols, K. and B. Poduri, "An Expedited Forwarding PHB", RFC 2598, June 1999.
[31] Casey, L., "An extended IP VPN Architecture", Work in Progress.
[32] Rekhter, Y., and T. Li, "A Border Gateway Protocol 4 (BGP-4)," RFC 1771, March 1995.
[33] Grossman, D. and J. Heinanen, "Multiprotocol Encapsulation over ATM Adaptation Layer 5", RFC 2684, September 1999.
[34] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997.
[35] Boyle, J., et al., "The COPS (Common Open Policy Service) Protocol", RFC 2748, January 2000.
[36] MacRae, M. and S. Ayandeh, "Using COPS for VPN Connectivity" Work in Progress.
[37] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997.
[38] Heinanen, J. and E. Rosen, "VPN Support with MPLS", Work in Progress.
[39] Estrin, D., Farinacci, D., Helmy, A., Thaler, D., Deering, S., Handley, M., Jacobson, V., Liu, C., Sharma, P. and L. Wei, "Protocol Independent Multicast-Sparse Mode (PIM-SM): Protocol Specification", RFC 2362, June 1998.
[40] Waitzman, D., Partridge, C., and S. Deering, "Distance Vector Multicast Routing Protocol", RFC 1075, November 1988.
[41] Fenner, W., "IGMP-based Multicast Forwarding (IGMP Proxying)", Work in Progress.
[42] Wallner, D., Harder, E. and R. Agee, "Key Management for Multicast: Issues and Architectures", RFC 2627, June 1999.
[43] Hardjono, T., et al., "Secure IP Multicast: Problem areas, Framework, and Building Blocks", Work in Progress.
[44] Rigney, C., Rubens, A., Simpson, W. and S. Willens, "Remote Authentication Dial In User Service (RADIUS)", RFC 2138, April 1997.
[45] Valencia, A., Littlewood, M. and T. Kolar, "Cisco Layer Two Forwarding (Protocol) "L2F"", RFC 2341, May 1998.
[46] Hamzeh, K., Pall, G., Verthein, W., Taarud, J., Little, W. and G. Zorn, "Point-to-Point Tunneling Protocol (PPTP)", RFC 2637, July 1999.
[47] Patel, B., et al., "Securing L2TP using IPSEC", Work in Progress.
[48] Srisuresh, P., "Secure Remote Access with L2TP", Work in Progress.
[49] Calhoun, P., et al., "Layer Two Tunneling Protocol "L2TP" Security Extensions for Non-IP networks", Work in Progress.
[50] Aboba, B. and Zorn, G. "Implementation of PPTP/L2TP Compulsory Tunneling via RADIUS", Work in progress.
[51] Aboba, B. and G. Zorn, "Criteria for Evaluating Roaming Protocols", RFC 2477, January 1999.
[52] Shea, R., "L2TP-over-IP Path MTU Discovery (L2TPMTU)", Work in Progress.
[53] Sklower, K., Lloyd, B., McGregor, G., Carr, D. and T. Coradetti, "The PPP Multilink Protocol (MP)", RFC 1990, August 1996.
[54] Richards, C. and K. Smith, "The PPP Bandwidth Allocation Protocol (BAP) The PPP Bandwidth Allocation Control Protocol (BACP)", RFC 2125, March 1997.
[55] Calhoun, P. and K. Peirce, "Layer Two Tunneling Protocol "L2TP" IP Differential Services Extension", Work in Progress.
[56] ADSL Forum. "An Interoperable End-to-end Broadband Service Architecture over ADSL Systems (Version 3.0)", ADSL Forum 97-215.
[57] ADSL Forum. "Core Network Architectures for ADSL Access Systems (Version 1.01)", ADSL Forum 98-017.
[58] Gupta, V., "Secure, Remote Access over the Internet using IPSec", Work in Progress.
[59] Pereira, R., et al., "The ISAKMP Configuration Method", Work in Progress.
[60] Pereira, R. and S. Beaulieu, "Extended Authentication Within ISAKMP/Oakley", Work in Progress.
[61] Litvin, M., et al., "A Hybrid Authentication Mode for IKE", Work in Progress.
[62] Kelly, S., et al., "User-level Authentication Mechanisms for IPsec", Work in Progress.
[63] Patel, B., et al., "DHCP Configuration of IPSEC Tunnel Mode", Work in Progress.
[64] Mamakos, L., Lidl, K., Evarts, J., Carrel, D., Simone, D. and R. Wheeler, "A Method for Transmitting PPP Over Ethernet (PPPoE)", RFC 2516, February 1999.
[65] ANSI/IEEE - 10038: 1993 (ISO/IEC) Information technology - Telecommunications and information exchange between systems - Local area networks - Media access control (MAC) bridges, ANSI/IEEE Std 802.1D, 1993 Edition.
12.0 Author Information 🫶
these are the people who wrote it, with their contact details, so you know exactly who to slide into the DMs about it 💌 (email is the vibe here, not a spam invite 🙈)
Bryan Gleeson
Nortel Networks
4500 Great America Parkway
Santa Clara CA 95054
USA
Phone: +1 (408) 548 3711
EMail: bgleeson@shastanets.comJuha Heinanen
Telia Finland, Inc.
Myyrmaentie 2
01600 VANTAA
Finland
Phone: +358 303 944 808
EMail: jh@telia.fiArthur Lin
Nortel Networks
4500 Great America Parkway
Santa Clara CA 95054
USA
Phone: +1 (408) 548 3788
EMail: alin@shastanets.comGrenville Armitage
Bell Labs Research Silicon Valley
Lucent Technologies
3180 Porter Drive,
Palo Alto, CA 94304
USA
EMail: gja@lucent.comAndrew G. Malis
Lucent Technologies
1 Robbins Road
Westford, MA 01886
USA
Phone: +1 978 952 7414
EMail: amalis@lucent.com13.0 Full Copyright Statement ⚖️
okay the legal part, and I'm not gonna pretend it's the most thrilling read 💀 but it matters, so here's the full thing with every single bit kept 🩷
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 💜
funding for the RFC Editor function is currently provided by the Internet Society 🌈 and that's the whole doc, bestie, we made it through all 15 parts 👑🎀
📦 where this page comes from
- ietf: rfc2764 2000-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms