[MUSIC PLAYING]
So let's start off by just getting a general introduction
to MPLS Layer 3 VPN.
What's the general idea?
Why do we want it?
How do the customers and service providers
relate in all of this?
And a little bit about the technical of how it works.
Of course, in the upcoming videos,
we will be going over in great detail,
each of the moving parts.
But for now, let's just start off
with an overall introduction.
So one of the defining factors of the Layer 3 VPN
is that the service provider is actually involved
in the customer's routing.
Being involved in the customer's routing
has both advantages and disadvantages
to both the service provider and the customer.
From the service provider's perspective,
as we're going to see through the rest of this skill,
there's a lot of things that need
to be set up and configured in order to support Layer 3 VPN.
On the flip side of that, Layer 3 VPN is a very popular feature
that customers want.
So therefore, there's a high demand
for this out in the marketplace.
From the customer's perspective, the big advantage
is that they get a full mesh of VPN connectivity.
Since the service provider is involved in the routing,
the service provider knows the best destination
for each network.
So if I'm trying to go from a remote site to a remote site,
there would be no reason that I would, for example, have
to go through the headquarters.
This isn't like a legacy star topology.
It's going to act like a full mesh.
And that is very advantageous to the customer.
The downside for the customer is,
depending on their security posture,
they may not be very excited about the service
provider actually being involved in what's essentially
their internal routing.
So this is a decision, of course,
that the customer's going to have to make,
if they want the advantages, or if they're too worried
about the disadvantages.
So what are some of the things that the service provider
is going to have to do?
Well, first, we're going to be using multi-protocol BGP
as the control plane in the core.
Now, we'll be talking more about this, as far as
why it's multi-protocol and such, as we go through more
detailed information.
Also be aware that Layer 3 VPN does in fact use a label stack,
and it uses two labels.
Much like Layer 2 VPN, we have what's
called the forwarding label.
This is the label generally for the loopback interface
of the egress PE.
Because the loopback of the egress
PE is going to be our BGP next hop.
This label is going to be learned through LDP.
Because this would be the same label
that we would just be using for normal IP forwarding.
The other label is the VPN label.
This is used for the actual customer
route on the egress PE.
This one is learned through multi-protocol BGP.
It's part of the updates that we're getting
through our control plane.
This is the label that ensures that the traffic gets
to the correct customer on the egress PE.
Now, if the service provider is going
to be involved in the customer routing,
this means that the customers are
going to run some form of either a routing protocol
or static routing.
Now, truth is, it would be the service provider that would
be doing the static routing.
Because, ultimately, they would have to take that static route
and put it into BGP in the core.
But usually, the customers are going
to be running a routing protocol.
This is generally referred to as the CE-PE routing protocol
because it's running between the Customer Edge and the Provider
Edge.
And really, all of the protocols are supported for this.
We could run RIP version 2, we can
use EIGRP, BGP, OSPF, IS-IS.
What it really comes down to is, which ones
are going to be allowed by the service provider?
Although it would be advantageous to the customers
to support a lot of protocols here--
generally speaking, service providers don't.
It would be a lot more work for the service provider
to support all these protocols, particularly more work
on the PE devices.
Where, on the other hand, we could simply say,
we just support BGP.
That's it.
And if the customer doesn't understand necessarily
how to run BGP, then maybe we could offer them
something like managed edge services, where
we would actually operate or manage the CE for them,
and do their redistribution between whatever their core IGP
is, and BGP for them on the CE.
And maybe pick up a little bit of extra revenue
on a monthly basis.
Whichever protocol these routes are learned through,
the service provider will then pass these routes
through the core to the CEs at the customer sites.
So ultimately, we're going to pass them through the core,
and send them out to the CEs on the other end,
once again, using a CE-PE protocol.
Now, since it is going to be passing through BGP
in the middle, something else to keep in mind,
is that CE-PE protocol doesn't necessarily
have to be the same at each remote location.
As I mentioned-- normally, it will be.
Normally, it'll just be BGP.
But it certainly doesn't have to be.
So as we mentioned, the big advantage here for the customer
is, if we have the customer routes,
this allows the service provider to make the best decisions.
Because of this, L3 VPN acts like a full mesh.
Each customer site sends traffic directly
to other customer sites.
That's the big advantage for the customer.
And that's why customers like this feature.
Now, being involved in the customer's routing
does present several problems for the service provider.
And honestly, this is what a lot of our discussion
is going to revolve around with Layer 3 VPN.
The first is that customers expect autonomy.
They don't expect their routes to show up at other customers,
and vise versa.
Truth be told, this problem could actually
be handled just by using things like route filtering,
or access lists.
There's a couple of ways that we could
deal with this issue of keeping customers separate.
The bigger problem is the next point here, where--
what do we need to do?
We need to support overlapping addresses.
If we're going to support overlapping address spaces,
that means that these routes have
to be separated the whole way through our core.
And again, that's a lot of the infrastructure
that we're going to talk about in the upcoming videos.
Another big factor that we need to discuss, particularly
for scalability, is that customers routes must only
be on the PE.
We do not want these routes to show up
on any of the P routers.
The P routers should be doing label switching.
And that's it.
We do not have customer routes on the PE routers.
That would be totally scalable.
Think about it this way.
The PE routers have to carry the customer routes.
Those are the routers directly interacting with the customer.
And they have to send the routes to the other PE routers.
But the PE routers only have to carry routes for customers
that are connected to that PE.
That's going to be a very, very small subset
of our actual customer base.
The P routers have to carry the traffic for all customers.
So just think about it this way.
If the P routers had to carry all the routes for all
the customers, this could easily get into millions of routes.
We don't want to have to do that on the P routers.
This is one of the main points of Layer 3 VPN.
The P routers do label switching between the loopbacks
of the PEs.
And then the PEs just do label switching through the core.
And they carry the routes for the customers that are directly
connected to that PE.
The P routers know customer routes.
So just keep all of this in mind as we
go through the rest of our videos, talking about all
of these different components.
Because this is very key for how we're
going to scale our MPLS environment.
Now, as we go, we will also talk about some more complex VPN
solutions, also known as overlapping VPNs,
where perhaps we get a situation where two companies want
to be merged together, because maybe they're
business partners, but they only want their headquarters
to exchange routes with each other, not
all the remote sites.
So we can get into more complicated environments, where
we can really set up a lot of pretty cool things
with our VPNs.
And another pretty cool thing that Layer 3 VPN introduces
is the ability to offer what's called Central Service VPNs.
This is essentially a VPN that's available to the customers,
but is run by the service provider.
And this is done to offer some sort of service
to the customers that they may be interested in.
Maybe it's something like an email exchange, or a voice
exchange.
But whatever the service is, the big key
is that we want to have access to this Central Service's VPN,
but we still need to keep the traffic separated
from the other customers.
So this is where we're going to get
a little bit tricky with some of our configuration,
to make sure that the customers can talk to the Central Service
VPN, the Central Service VPN can talk to the customer,
but that doesn't mean that the customers can then
talk to each other.
They still need to be separated.
So in this video, we just got an introduction
to some of the concepts and mechanisms in MPLS Layer 3 VPN.
All of this, of course, we're going
to be talking about in much greater detail
in the upcoming videos.
In fact, in the next video, we're
going to be talking about how we keep
the customer routes separate on the PE router.
So until then, I hope this has been informative for you,
and I'd like to thank you for viewing.