Multi VRF Overview

Multi-VRF CE Overview

MPLS-VPNs provide security and privacy as traffic travels through the provider network. The CE router has no mechanism to guarantee private networks across the traditional LAN network. Traditionally to provide privacy, either a switch needed to be deployed and each client be placed in a separate VLAN or a separate CE router is needed per each client’s organization or IP address grouping attaching to a PE. Figure 5 and 6 shows the traditional solutions for LAN security within an MPLS-VPN network design

 

These solutions are both costly to the customer as additional equipment is needed and requires more network management and provisioning of each client site.

Multi-VRF CE is a feature, that addresses these issues. Multi-VRF CE extends limited PE functionality to a CE router in an MPLS-VPN model. A CE router now has the ability to maintain separate VRF tables in order to extend the privacy and security of an MPLS-VPN down to a branch office rather than just at the PE router node.

CE routers use VRF interfaces to form a VLAN-like configuration on the customer side. Each VRF on the CE router is mapped to a VRF on the PE router. With Multi-VRF CE, the CE router can only configure VRF interfaces and support VRF routing tables. Multi-VRF CE extends SOME of the PE functionality to the CE router—there is no label exchange, there is no LDP adjacency, there is no labeled packet flow between PE and CE. The only PE-like functionality that is supported is the ability to have multiple VRFs on the CE router so that different routing decisions can be made. The packets are sent toward the PE as IP packets.

Benefits of Multi-VRF CE

1. Without the use of cryptographic techniques (IPSec), security on customer’s LAN is equivalent to that supported by existing Layer 2 (ATM or Frame Relay) connections without the use of an additional switch.

2. Only one CE router is needed thus simplifying provisioning and network management rather than a multiple CE router solution.

3. CE router has VRF functionality to provide VPN routing information. Less routing updates to manage.

4. Overlapping Customer address spaces VPN customers often manage their own networks and use private address spaces.

5. No need for NAT to allow support of overlapping IP address space. However, NAT may still be required in order to send traffic to the Internet.