You are on page 1of 27

Virtual Links: VLANs and Tunneling

CS 4251: Computer Networking II Nick Feamster Spring 2008

Why VLANs?
• Layer 2: devices on one VLAN cannot communicate with users on another VLAN without the use of routers and network layer addresses • Advantages
– Help control broadcasts (primarily MAC-layer broadcasts) – Switch table entry scaling – Improve network security – Help logically group network users

• Key feature: Divorced from physical network topology

users or protocols LAN switches and network management software provide a mechanism to create VLANs • VLANs help control the size of broadcast domains and localize traffic. . • Devices in different VLANs cannot directly communicate without the intervention of a Layer 3 routing device. • VLANs are associated with individual networks.VLAN basics • VLAN configuration issues: – – – – A switch creates a broadcast domain VLANs help manage broadcast domains VLANs can be defined on port groups.

VLAN Trunking Protocol • VLAN trunking: many VLANs throughout an organization by adding special tags to frames to identify the VLAN to which they belong. widely implemented trunking protocol . or trunk.1Q trunking protocol is the standard. • IEEE 802. • This tagging allows many VLANs to be carried across a common backbone.

Trunking: History • An example of this in a communications network is a backbone link between an MDF and an IDF • A backbone is composed of a number of trunks. .

.VLAN Trunking • Conserve ports when creating a link between two devices implementing VLANs • Trunking will bundle multiple virtual links over one physical link by allowing the traffic for several VLANs to travel over a single cable between the switches.

Trunking Operation • Manages the transfer of frames from different VLANs on a single physical line • Trunking protocols establish agreement for the distribution of frames to the associated ports at both ends of the trunk • Two mechanisms – frame filtering – frame tagging .

Frame Filtering .

VLAN ID.Frame Tagging • A frame tagging mechanism assigns an identifier. to the frames – Easier management – Faster delivery of frames .

Frame Tagging • Each frame sent on the link is tagged to identify which VLAN it belongs to. • Different tagging schemes exist • Two common schemes for Ethernet frames – 802.1Q: IEEE standard • Encapsulates packet in an additional 4-byte header – ISL – Cisco proprietary Inter-Switch Link protocol • Tagging occurs within the frame itself .

• Frame tagging functions at Layer 2 and requires little processing or administrative overhead.VLANs and trunking • VLAN frame tagging is an approach that has been specifically developed for switched communications. or end-station devices. • Frame tagging places a unique identifier in the header of each frame as it is forwarded throughout the network backbone. • The identifier is understood and examined by each switch before any broadcasts or transmissions are made to other switches. • When the frame exits the network backbone. . the switch removes the identifier before the frame is transmitted to the target end station. routers.

• Remember that when a host on one VLAN wants to communicate with a host on another. . a switch to the inter-VLAN router. a router must be involved. • A trunk carries traffic for multiple VLANs. a trunk can connect a switch to another switch. • For example. or a switch to a server with a special NIC installed that supports trunking.Inter-VLAN Routing • If a VLAN spans across multiple devices a trunk is used to interconnect the devices.

from the switch to the router – That trunk can support multiple VLANs – This topology is called a router on a stick because there is a single connection to the router .Inter-VLAN Issues and Solutions • Hosts on different VLANs must communicate • Logical connectivity: a single connection. or trunk.

• Consequently. the trunk-connected router approach can scale to a much larger number of VLANs than a one-link-per-VLAN design. .Physical and logical interfaces • The primary advantage of using a trunk link is a reduction in the number of router and switch ports used. • Not only can this save money. it can also reduce configuration complexity.

Pakistan.g. TS… • Compatibility/Interoperability • Dispersion/Logical grouping/Organization • Reliability – Fast Reroute.Why Tunnel? • Security – E.g. Resilient Overlay Networks (Akamai SureRoute) • Stability (“path pinning”) – E. VPNs • Flexibility – Topology – Protocol • Bypassing local network engineers – Oppressive regimes: China... for performance guarantees .

MPLS Overview • Main idea: Virtual circuit – Packets forwarded based only on circuit identifier Source 1 Destination Source 2 Router can forward traffic to the same destination on different interfaces/paths. .

label determines: – Outgoing interface – New label to attach • Label distribution protocol: responsible for disseminating signalling information .Circuit Abstraction: Label Swapping D A 1 2 Tag Out New 3 A 2 D • Label-switched paths (LSPs): Paths are “named” by the label at the path’s entry point • At each hop.

Layer 3 Virtual Private Networks • Private communications over a public network • A set of sites that are allowed to communicate with each other • Defined by a set of administrative policies – determine both connectivity and QoS among sites – established by VPN customers – One way to implement: BGP/MPLS VPN mechanisms (RFC 2547) .

etc.Building Private Networks • Separate physical network – Good security properties – Expensive! • Secure VPNs – Encryption of entire network stack between endpoints • Layer 2 Tunneling Protocol (L2TP) – “PPP over IP” – No encryption Privacy and interconnectivity (not confidentiality.) • Layer 3 VPNs . integrity.

fewer configuration headaches .Layer 2 vs. whereas Layer 3 is “IP only” • More complicated to provision a Layer 2 VPN • Layer 3 VPNs: potentially more flexibility. Layer 3 VPNs • Layer 2 VPNs can carry traffic for many different protocols.

2/16 VPN B/Site 2 BGP to exchange routes PE1 CEA1 PE3 P3 CEB3 MPLS to forward traffic CEA3 10.4/16 VPN B/Site 3 VPN A/Site 1 • Isolation: Multiple logical networks over a single.2/16 VPN B/Site 1 10.1/16 VPN A/Site 3 10.Layer 3 BGP/MPLS VPNs VPN A/Site 2 10.3/16 10.1/16 CE B1 P2 2 CE B1 P1 1 CEA2 PE2 CEB2 10. shared physical infrastructure • Tunneling: Keeping routes out of the core .

e.High-Level Overview of Operation • IP packets arrive at PE • Destination IP address is looked up in forwarding table • Datagram sent to customer’s network using tunneling (i. an MPLS label-switched path) ..

BGP/MPLS VPN key components • Forwarding in the core: MPLS • Distributing routes between PEs: BGP • Isolation: Keeping different VPNs from routing traffic over one another – Constrained distribution of routing information – Multiple “virtual” forwarding tables • Unique addresses: VPN-IP4 Address extension .

1.0/24 RD: Green Customer 1 Customer 2 10.0/24 RD: Blue .0.0/24 10.0.1.0/24 Customer 2 10.1.0.1.Virtual Routing and Forwarding • Separate tables per customer at each router Customer 1 10.0.

1.0/24 Route target: Green Next-hop: A Site 2 Static route. etc.0.0. RIP. Site 1 10.0/24 A Site 3 .1.Routing: Constraining Distribution • Performed by Service Provider using route filtering based on BGP Extended Community attribute – BGP Community is attached by ingress PE route filtering based on BGP Community is performed by egress PE BGP RD:10.

Forwarding • PE and P routers have BGP next-hop reachability through the backbone IGP • Labels are distributed through LDP (hop-by-hop) corresponding to BGP Next-Hops • Two-Label Stack is used for packet forwarding • Top label indicates Next-Hop (interior label) • Second level label indicates outgoing interface or VRF (exterior label) Corresponds to LSP of BGP next-hop (PE) Corresponds to VRF/interface at exit Layer 2 Header Label 1 Label 2 IP Datagram .

add corresponding LSP (also at site VRF) Label 1 Label 2 IP Datagram .Forwarding in BGP/MPLS VPNs • Step 1: Packet arrives at incoming interface – Site VRF determines BGP next-hop and Label #2 Label 2 IP Datagram • Step 2: BGP next-hop lookup.