How it works: Layer 2 VPNs

With Multi-protocol Label Switching Layer 2 VPNs based on the Martini approach, a customer's Layer 2 traffic is encapsulated when it reaches the edge of the service provider network, mapped onto a label-switched path, and carried across a network.

This Layer 2 VPN technique takes advantage of MPLS label stacking, whereby more than one label is used to forward traffic across an MPLS infrastructure. Specifically, two labels are used to support MPLS Layer 2 VPNs: One label represents a point-to-point virtual circuit, while a second label represents the tunnel across the network.

The current Martini drafts define encapsulations for Ethernet (port-based and virtual LANs [VLAN]), ATM (ATM Adoption Layer Type 5 and cell formats), Frame Relay, Point-to-Point Protocol and High-level Data Link Control.

Other drafts are being developed that fine-tune support for specific traffic types. The Fischer draft (which vendors such as Alcatel and Nortel support) provides an alternative encapsulation for ATM.

Once traffic is encapsulated, the ingress Label Switch Router (LSR) assigns it a virtual circuit label. This label identifies the VPN, VLAN or connection end point (equivalent to a Frame Relay Data Link Connection Identifier, for example); the egress LSR uses the virtual circuit label to determine how to process the frame. Control protocols, including the MPLS Label Distribution Protocol and Border Gateway Protocol, are used to set up the emulated virtual circuits.

For its part, the tunnel label determines the path a packet takes through the network -- that is, LSRs in the network core use the tunnel label for packet forwarding. Numerous emulated virtual circuits can be carried in a single tunnel, which aids in scalability.

Vendors are supporting a variety of MPLS protocols, including Label Distribution Protocol and Resource Reservation Protocol-Tunneling Extension, for tunnel setup.

Back to main story: The promised LAN

Variations on a VPN theme
A new breed of VPN based on Multi-protocol Label Switching is emerging as an alternative to traditional VPNs based on IP Security. Network World, 04/08/02.

VPN audio primer
. In this 6-minute primer you'll learn how VPNs work as well as if they are right for your remote access needs. Network World Fusion.

VPN e-mail newsletter
A twice-weekly look at VPN technologies and trends. Network World Fusion.