You are on page 1of 27

Virtual Links: VLANs and Tunneling

CS 4251: Computer Networking II Nick Feamster Spring 2008

Why VLANs?
• Layer 2: devices on one VLAN cannot communicate with users on another VLAN without the use of routers and network layer addresses • Advantages
– Help control broadcasts (primarily MAC-layer broadcasts) – Switch table entry scaling – Improve network security – Help logically group network users

• Key feature: Divorced from physical network topology

VLAN basics • VLAN configuration issues: – – – – A switch creates a broadcast domain VLANs help manage broadcast domains VLANs can be defined on port groups. . • VLANs are associated with individual networks. users or protocols LAN switches and network management software provide a mechanism to create VLANs • VLANs help control the size of broadcast domains and localize traffic. • Devices in different VLANs cannot directly communicate without the intervention of a Layer 3 routing device.

1Q trunking protocol is the standard. widely implemented trunking protocol .VLAN Trunking Protocol • VLAN trunking: many VLANs throughout an organization by adding special tags to frames to identify the VLAN to which they belong. or trunk. • IEEE 802. • This tagging allows many VLANs to be carried across a common backbone.

.Trunking: History • An example of this in a communications network is a backbone link between an MDF and an IDF • A backbone is composed of a number of trunks.

VLAN Trunking • Conserve ports when creating a link between two devices implementing VLANs • Trunking will bundle multiple virtual links over one physical link by allowing the traffic for several VLANs to travel over a single cable between the switches. .

Trunking Operation • Manages the transfer of frames from different VLANs on a single physical line • Trunking protocols establish agreement for the distribution of frames to the associated ports at both ends of the trunk • Two mechanisms – frame filtering – frame tagging .

Frame Filtering .

VLAN ID. to the frames – Easier management – Faster delivery of frames .Frame Tagging • A frame tagging mechanism assigns an identifier.

Frame Tagging • Each frame sent on the link is tagged to identify which VLAN it belongs to. • Different tagging schemes exist • Two common schemes for Ethernet frames – 802.1Q: IEEE standard • Encapsulates packet in an additional 4-byte header – ISL – Cisco proprietary Inter-Switch Link protocol • Tagging occurs within the frame itself .

. • Frame tagging places a unique identifier in the header of each frame as it is forwarded throughout the network backbone.VLANs and trunking • VLAN frame tagging is an approach that has been specifically developed for switched communications. • When the frame exits the network backbone. the switch removes the identifier before the frame is transmitted to the target end station. routers. • Frame tagging functions at Layer 2 and requires little processing or administrative overhead. • The identifier is understood and examined by each switch before any broadcasts or transmissions are made to other switches. or end-station devices.

• A trunk carries traffic for multiple VLANs. • For example. • Remember that when a host on one VLAN wants to communicate with a host on another. or a switch to a server with a special NIC installed that supports trunking.Inter-VLAN Routing • If a VLAN spans across multiple devices a trunk is used to interconnect the devices. a switch to the inter-VLAN router. a trunk can connect a switch to another switch. . a router must be involved.

Inter-VLAN Issues and Solutions • Hosts on different VLANs must communicate • Logical connectivity: a single connection. or trunk. from the switch to the router – That trunk can support multiple VLANs – This topology is called a router on a stick because there is a single connection to the router .

the trunk-connected router approach can scale to a much larger number of VLANs than a one-link-per-VLAN design. it can also reduce configuration complexity. .Physical and logical interfaces • The primary advantage of using a trunk link is a reduction in the number of router and switch ports used. • Not only can this save money. • Consequently.

. TS… • Compatibility/Interoperability • Dispersion/Logical grouping/Organization • Reliability – Fast Reroute. Resilient Overlay Networks (Akamai SureRoute) • Stability (“path pinning”) – E. for performance guarantees .g.g.. VPNs • Flexibility – Topology – Protocol • Bypassing local network engineers – Oppressive regimes: China. Pakistan.Why Tunnel? • Security – E.

MPLS Overview • Main idea: Virtual circuit – Packets forwarded based only on circuit identifier Source 1 Destination Source 2 Router can forward traffic to the same destination on different interfaces/paths. .

Circuit Abstraction: Label Swapping D A 1 2 Tag Out New 3 A 2 D • Label-switched paths (LSPs): Paths are “named” by the label at the path’s entry point • At each hop. label determines: – Outgoing interface – New label to attach • Label distribution protocol: responsible for disseminating signalling information .

Layer 3 Virtual Private Networks • Private communications over a public network • A set of sites that are allowed to communicate with each other • Defined by a set of administrative policies – determine both connectivity and QoS among sites – established by VPN customers – One way to implement: BGP/MPLS VPN mechanisms (RFC 2547) .

) • Layer 3 VPNs . etc. integrity.Building Private Networks • Separate physical network – Good security properties – Expensive! • Secure VPNs – Encryption of entire network stack between endpoints • Layer 2 Tunneling Protocol (L2TP) – “PPP over IP” – No encryption Privacy and interconnectivity (not confidentiality.

fewer configuration headaches . Layer 3 VPNs • Layer 2 VPNs can carry traffic for many different protocols. whereas Layer 3 is “IP only” • More complicated to provision a Layer 2 VPN • Layer 3 VPNs: potentially more flexibility.Layer 2 vs.

2/16 VPN B/Site 1 10.1/16 CE B1 P2 2 CE B1 P1 1 CEA2 PE2 CEB2 10.1/16 VPN A/Site 3 10.2/16 VPN B/Site 2 BGP to exchange routes PE1 CEA1 PE3 P3 CEB3 MPLS to forward traffic CEA3 10.3/16 10. shared physical infrastructure • Tunneling: Keeping routes out of the core .4/16 VPN B/Site 3 VPN A/Site 1 • Isolation: Multiple logical networks over a single.Layer 3 BGP/MPLS VPNs VPN A/Site 2 10.

High-Level Overview of Operation • IP packets arrive at PE • Destination IP address is looked up in forwarding table • Datagram sent to customer’s network using tunneling (i.. an MPLS label-switched path) .e.

BGP/MPLS VPN key components • Forwarding in the core: MPLS • Distributing routes between PEs: BGP • Isolation: Keeping different VPNs from routing traffic over one another – Constrained distribution of routing information – Multiple “virtual” forwarding tables • Unique addresses: VPN-IP4 Address extension .

Virtual Routing and Forwarding • Separate tables per customer at each router Customer 1 RD: Blue . Customer 2 10.0/24 RD: Green Customer 1 Customer 2 10.0.

1. Site 1 10.0. etc.0/24 Route target: Green Next-hop: A Site 2 Static route.1. RIP.0.Routing: Constraining Distribution • Performed by Service Provider using route filtering based on BGP Extended Community attribute – BGP Community is attached by ingress PE route filtering based on BGP Community is performed by egress PE BGP RD:10.0/24 A Site 3 .

Forwarding • PE and P routers have BGP next-hop reachability through the backbone IGP • Labels are distributed through LDP (hop-by-hop) corresponding to BGP Next-Hops • Two-Label Stack is used for packet forwarding • Top label indicates Next-Hop (interior label) • Second level label indicates outgoing interface or VRF (exterior label) Corresponds to LSP of BGP next-hop (PE) Corresponds to VRF/interface at exit Layer 2 Header Label 1 Label 2 IP Datagram .

add corresponding LSP (also at site VRF) Label 1 Label 2 IP Datagram .Forwarding in BGP/MPLS VPNs • Step 1: Packet arrives at incoming interface – Site VRF determines BGP next-hop and Label #2 Label 2 IP Datagram • Step 2: BGP next-hop lookup.