Chapter 12 - Virtual Private Networks

Abstract

The virtual private networks (VPNs) enable two companies to connect their private networks across the Internet. One of the options provided by a VPN is that the addresses within the private networks may be kept private. This allows the companies to use identical address spaces, and lets each have hosts that have the same addresses. IPsec is essentially a tunneling protocol devised to securely transport IP across a public network. IPsec has considerable potential in VPN implementation because it offers a full suite of security features from encryption and authentication to protection against replay. MPLS can be used to set up tunnels through an MPLS capable network. These tunnels can be used to establish layer 2 VPNs in ATM, Frame Relay, or other MPLS-capable networks. Each tunnel provides a virtual wire between source and destination to connect different parts of the VPN. Alternatively, MPLS packets can be encapsulated in some other tunneling mechanism to allow them to be transported across the IP core network. A hybrid VPN solution that utilizes both BGP and MPLS is described in RFC 2547 and is being further developed within the IETF. This solution is scalable and flexible. BGP is used to advertise which edge nodes provide access to which VPNs, the reachability information for addresses in each VPN at each edge node, and an MPLS label used to identify which VPN is targeted.