1 00:00:00,000 --> 00:00:02,832 [MUSIC PLAYING] 2 00:00:02,832 --> 00:00:08,029 3 00:00:08,029 --> 00:00:11,750 So let's start off by just getting a general introduction 4 00:00:11,750 --> 00:00:14,600 to MPLS Layer 3 VPN. 5 00:00:14,600 --> 00:00:16,370 What's the general idea? 6 00:00:16,370 --> 00:00:17,850 Why do we want it? 7 00:00:17,850 --> 00:00:19,790 How do the customers and service providers 8 00:00:19,790 --> 00:00:21,200 relate in all of this? 9 00:00:21,200 --> 00:00:25,590 And a little bit about the technical of how it works. 10 00:00:25,590 --> 00:00:27,780 Of course, in the upcoming videos, 11 00:00:27,780 --> 00:00:30,080 we will be going over in great detail, 12 00:00:30,080 --> 00:00:31,650 each of the moving parts. 13 00:00:31,650 --> 00:00:33,230 But for now, let's just start off 14 00:00:33,230 --> 00:00:37,530 with an overall introduction. 15 00:00:37,530 --> 00:00:41,060 So one of the defining factors of the Layer 3 VPN 16 00:00:41,060 --> 00:00:45,650 is that the service provider is actually involved 17 00:00:45,650 --> 00:00:48,870 in the customer's routing. 18 00:00:48,870 --> 00:00:51,450 Being involved in the customer's routing 19 00:00:51,450 --> 00:00:54,150 has both advantages and disadvantages 20 00:00:54,150 --> 00:00:57,390 to both the service provider and the customer. 21 00:00:57,390 --> 00:00:59,700 From the service provider's perspective, 22 00:00:59,700 --> 00:01:02,520 as we're going to see through the rest of this skill, 23 00:01:02,520 --> 00:01:04,110 there's a lot of things that need 24 00:01:04,110 --> 00:01:09,300 to be set up and configured in order to support Layer 3 VPN. 25 00:01:09,300 --> 00:01:14,820 On the flip side of that, Layer 3 VPN is a very popular feature 26 00:01:14,820 --> 00:01:16,570 that customers want. 27 00:01:16,570 --> 00:01:18,630 So therefore, there's a high demand 28 00:01:18,630 --> 00:01:21,180 for this out in the marketplace. 29 00:01:21,180 --> 00:01:25,050 From the customer's perspective, the big advantage 30 00:01:25,050 --> 00:01:30,330 is that they get a full mesh of VPN connectivity. 31 00:01:30,330 --> 00:01:33,450 Since the service provider is involved in the routing, 32 00:01:33,450 --> 00:01:37,260 the service provider knows the best destination 33 00:01:37,260 --> 00:01:39,010 for each network. 34 00:01:39,010 --> 00:01:42,510 So if I'm trying to go from a remote site to a remote site, 35 00:01:42,510 --> 00:01:45,510 there would be no reason that I would, for example, have 36 00:01:45,510 --> 00:01:47,250 to go through the headquarters. 37 00:01:47,250 --> 00:01:50,610 This isn't like a legacy star topology. 38 00:01:50,610 --> 00:01:52,920 It's going to act like a full mesh. 39 00:01:52,920 --> 00:01:56,980 And that is very advantageous to the customer. 40 00:01:56,980 --> 00:02:00,060 The downside for the customer is, 41 00:02:00,060 --> 00:02:02,430 depending on their security posture, 42 00:02:02,430 --> 00:02:05,820 they may not be very excited about the service 43 00:02:05,820 --> 00:02:09,449 provider actually being involved in what's essentially 44 00:02:09,449 --> 00:02:11,350 their internal routing. 45 00:02:11,350 --> 00:02:13,360 So this is a decision, of course, 46 00:02:13,360 --> 00:02:15,450 that the customer's going to have to make, 47 00:02:15,450 --> 00:02:18,900 if they want the advantages, or if they're too worried 48 00:02:18,900 --> 00:02:21,787 about the disadvantages. 49 00:02:21,787 --> 00:02:24,120 So what are some of the things that the service provider 50 00:02:24,120 --> 00:02:25,570 is going to have to do? 51 00:02:25,570 --> 00:02:29,850 Well, first, we're going to be using multi-protocol BGP 52 00:02:29,850 --> 00:02:32,950 as the control plane in the core. 53 00:02:32,950 --> 00:02:35,400 Now, we'll be talking more about this, as far as 54 00:02:35,400 --> 00:02:38,880 why it's multi-protocol and such, as we go through more 55 00:02:38,880 --> 00:02:40,830 detailed information. 56 00:02:40,830 --> 00:02:46,290 Also be aware that Layer 3 VPN does in fact use a label stack, 57 00:02:46,290 --> 00:02:49,020 and it uses two labels. 58 00:02:49,020 --> 00:02:52,710 Much like Layer 2 VPN, we have what's 59 00:02:52,710 --> 00:02:55,020 called the forwarding label. 60 00:02:55,020 --> 00:02:58,290 This is the label generally for the loopback interface 61 00:02:58,290 --> 00:03:00,450 of the egress PE. 62 00:03:00,450 --> 00:03:02,430 Because the loopback of the egress 63 00:03:02,430 --> 00:03:06,180 PE is going to be our BGP next hop. 64 00:03:06,180 --> 00:03:10,500 This label is going to be learned through LDP. 65 00:03:10,500 --> 00:03:12,270 Because this would be the same label 66 00:03:12,270 --> 00:03:16,140 that we would just be using for normal IP forwarding. 67 00:03:16,140 --> 00:03:19,690 The other label is the VPN label. 68 00:03:19,690 --> 00:03:22,620 This is used for the actual customer 69 00:03:22,620 --> 00:03:26,220 route on the egress PE. 70 00:03:26,220 --> 00:03:30,330 This one is learned through multi-protocol BGP. 71 00:03:30,330 --> 00:03:32,400 It's part of the updates that we're getting 72 00:03:32,400 --> 00:03:34,360 through our control plane. 73 00:03:34,360 --> 00:03:37,290 This is the label that ensures that the traffic gets 74 00:03:37,290 --> 00:03:41,280 to the correct customer on the egress PE. 75 00:03:41,280 --> 00:03:43,170 Now, if the service provider is going 76 00:03:43,170 --> 00:03:45,390 to be involved in the customer routing, 77 00:03:45,390 --> 00:03:46,950 this means that the customers are 78 00:03:46,950 --> 00:03:50,670 going to run some form of either a routing protocol 79 00:03:50,670 --> 00:03:52,840 or static routing. 80 00:03:52,840 --> 00:03:56,520 Now, truth is, it would be the service provider that would 81 00:03:56,520 --> 00:03:58,050 be doing the static routing. 82 00:03:58,050 --> 00:04:01,200 Because, ultimately, they would have to take that static route 83 00:04:01,200 --> 00:04:04,320 and put it into BGP in the core. 84 00:04:04,320 --> 00:04:07,230 But usually, the customers are going 85 00:04:07,230 --> 00:04:09,510 to be running a routing protocol. 86 00:04:09,510 --> 00:04:14,880 This is generally referred to as the CE-PE routing protocol 87 00:04:14,880 --> 00:04:17,940 because it's running between the Customer Edge and the Provider 88 00:04:17,940 --> 00:04:18,990 Edge. 89 00:04:18,990 --> 00:04:22,380 And really, all of the protocols are supported for this. 90 00:04:22,380 --> 00:04:24,750 We could run RIP version 2, we can 91 00:04:24,750 --> 00:04:28,710 use EIGRP, BGP, OSPF, IS-IS. 92 00:04:28,710 --> 00:04:31,740 What it really comes down to is, which ones 93 00:04:31,740 --> 00:04:35,710 are going to be allowed by the service provider? 94 00:04:35,710 --> 00:04:38,800 Although it would be advantageous to the customers 95 00:04:38,800 --> 00:04:41,200 to support a lot of protocols here-- 96 00:04:41,200 --> 00:04:44,200 generally speaking, service providers don't. 97 00:04:44,200 --> 00:04:47,200 It would be a lot more work for the service provider 98 00:04:47,200 --> 00:04:50,920 to support all these protocols, particularly more work 99 00:04:50,920 --> 00:04:52,870 on the PE devices. 100 00:04:52,870 --> 00:04:55,120 Where, on the other hand, we could simply say, 101 00:04:55,120 --> 00:04:57,130 we just support BGP. 102 00:04:57,130 --> 00:04:58,250 That's it. 103 00:04:58,250 --> 00:05:01,750 And if the customer doesn't understand necessarily 104 00:05:01,750 --> 00:05:05,230 how to run BGP, then maybe we could offer them 105 00:05:05,230 --> 00:05:08,140 something like managed edge services, where 106 00:05:08,140 --> 00:05:12,070 we would actually operate or manage the CE for them, 107 00:05:12,070 --> 00:05:16,240 and do their redistribution between whatever their core IGP 108 00:05:16,240 --> 00:05:20,560 is, and BGP for them on the CE. 109 00:05:20,560 --> 00:05:22,990 And maybe pick up a little bit of extra revenue 110 00:05:22,990 --> 00:05:25,250 on a monthly basis. 111 00:05:25,250 --> 00:05:28,010 Whichever protocol these routes are learned through, 112 00:05:28,010 --> 00:05:30,620 the service provider will then pass these routes 113 00:05:30,620 --> 00:05:35,580 through the core to the CEs at the customer sites. 114 00:05:35,580 --> 00:05:38,600 So ultimately, we're going to pass them through the core, 115 00:05:38,600 --> 00:05:41,900 and send them out to the CEs on the other end, 116 00:05:41,900 --> 00:05:45,740 once again, using a CE-PE protocol. 117 00:05:45,740 --> 00:05:48,680 Now, since it is going to be passing through BGP 118 00:05:48,680 --> 00:05:51,350 in the middle, something else to keep in mind, 119 00:05:51,350 --> 00:05:54,350 is that CE-PE protocol doesn't necessarily 120 00:05:54,350 --> 00:05:58,170 have to be the same at each remote location. 121 00:05:58,170 --> 00:06:00,500 As I mentioned-- normally, it will be. 122 00:06:00,500 --> 00:06:02,360 Normally, it'll just be BGP. 123 00:06:02,360 --> 00:06:04,550 But it certainly doesn't have to be. 124 00:06:04,550 --> 00:06:08,630 So as we mentioned, the big advantage here for the customer 125 00:06:08,630 --> 00:06:10,760 is, if we have the customer routes, 126 00:06:10,760 --> 00:06:16,400 this allows the service provider to make the best decisions. 127 00:06:16,400 --> 00:06:22,220 Because of this, L3 VPN acts like a full mesh. 128 00:06:22,220 --> 00:06:25,340 Each customer site sends traffic directly 129 00:06:25,340 --> 00:06:27,710 to other customer sites. 130 00:06:27,710 --> 00:06:30,930 That's the big advantage for the customer. 131 00:06:30,930 --> 00:06:34,980 And that's why customers like this feature. 132 00:06:34,980 --> 00:06:37,670 Now, being involved in the customer's routing 133 00:06:37,670 --> 00:06:42,230 does present several problems for the service provider. 134 00:06:42,230 --> 00:06:45,770 And honestly, this is what a lot of our discussion 135 00:06:45,770 --> 00:06:49,640 is going to revolve around with Layer 3 VPN. 136 00:06:49,640 --> 00:06:54,480 The first is that customers expect autonomy. 137 00:06:54,480 --> 00:06:58,400 They don't expect their routes to show up at other customers, 138 00:06:58,400 --> 00:07:00,840 and vise versa. 139 00:07:00,840 --> 00:07:04,950 Truth be told, this problem could actually 140 00:07:04,950 --> 00:07:08,760 be handled just by using things like route filtering, 141 00:07:08,760 --> 00:07:10,630 or access lists. 142 00:07:10,630 --> 00:07:12,540 There's a couple of ways that we could 143 00:07:12,540 --> 00:07:17,370 deal with this issue of keeping customers separate. 144 00:07:17,370 --> 00:07:22,020 The bigger problem is the next point here, where-- 145 00:07:22,020 --> 00:07:23,500 what do we need to do? 146 00:07:23,500 --> 00:07:26,760 We need to support overlapping addresses. 147 00:07:26,760 --> 00:07:30,120 If we're going to support overlapping address spaces, 148 00:07:30,120 --> 00:07:32,190 that means that these routes have 149 00:07:32,190 --> 00:07:35,700 to be separated the whole way through our core. 150 00:07:35,700 --> 00:07:38,400 And again, that's a lot of the infrastructure 151 00:07:38,400 --> 00:07:42,750 that we're going to talk about in the upcoming videos. 152 00:07:42,750 --> 00:07:45,920 Another big factor that we need to discuss, particularly 153 00:07:45,920 --> 00:07:50,360 for scalability, is that customers routes must only 154 00:07:50,360 --> 00:07:52,850 be on the PE. 155 00:07:52,850 --> 00:07:55,670 We do not want these routes to show up 156 00:07:55,670 --> 00:07:58,610 on any of the P routers. 157 00:07:58,610 --> 00:08:02,090 The P routers should be doing label switching. 158 00:08:02,090 --> 00:08:03,840 And that's it. 159 00:08:03,840 --> 00:08:07,340 We do not have customer routes on the PE routers. 160 00:08:07,340 --> 00:08:11,480 That would be totally scalable. 161 00:08:11,480 --> 00:08:13,280 Think about it this way. 162 00:08:13,280 --> 00:08:17,300 The PE routers have to carry the customer routes. 163 00:08:17,300 --> 00:08:20,510 Those are the routers directly interacting with the customer. 164 00:08:20,510 --> 00:08:24,620 And they have to send the routes to the other PE routers. 165 00:08:24,620 --> 00:08:30,890 But the PE routers only have to carry routes for customers 166 00:08:30,890 --> 00:08:33,620 that are connected to that PE. 167 00:08:33,620 --> 00:08:36,890 That's going to be a very, very small subset 168 00:08:36,890 --> 00:08:40,049 of our actual customer base. 169 00:08:40,049 --> 00:08:45,700 The P routers have to carry the traffic for all customers. 170 00:08:45,700 --> 00:08:48,340 So just think about it this way. 171 00:08:48,340 --> 00:08:52,590 If the P routers had to carry all the routes for all 172 00:08:52,590 --> 00:08:58,450 the customers, this could easily get into millions of routes. 173 00:08:58,450 --> 00:09:01,530 We don't want to have to do that on the P routers. 174 00:09:01,530 --> 00:09:05,430 This is one of the main points of Layer 3 VPN. 175 00:09:05,430 --> 00:09:09,840 The P routers do label switching between the loopbacks 176 00:09:09,840 --> 00:09:11,640 of the PEs. 177 00:09:11,640 --> 00:09:15,510 And then the PEs just do label switching through the core. 178 00:09:15,510 --> 00:09:18,810 And they carry the routes for the customers that are directly 179 00:09:18,810 --> 00:09:21,180 connected to that PE. 180 00:09:21,180 --> 00:09:24,100 The P routers know customer routes. 181 00:09:24,100 --> 00:09:26,730 So just keep all of this in mind as we 182 00:09:26,730 --> 00:09:29,220 go through the rest of our videos, talking about all 183 00:09:29,220 --> 00:09:30,660 of these different components. 184 00:09:30,660 --> 00:09:33,180 Because this is very key for how we're 185 00:09:33,180 --> 00:09:36,970 going to scale our MPLS environment. 186 00:09:36,970 --> 00:09:40,890 Now, as we go, we will also talk about some more complex VPN 187 00:09:40,890 --> 00:09:45,690 solutions, also known as overlapping VPNs, 188 00:09:45,690 --> 00:09:49,380 where perhaps we get a situation where two companies want 189 00:09:49,380 --> 00:09:51,720 to be merged together, because maybe they're 190 00:09:51,720 --> 00:09:55,530 business partners, but they only want their headquarters 191 00:09:55,530 --> 00:09:57,930 to exchange routes with each other, not 192 00:09:57,930 --> 00:09:59,410 all the remote sites. 193 00:09:59,410 --> 00:10:02,640 So we can get into more complicated environments, where 194 00:10:02,640 --> 00:10:05,070 we can really set up a lot of pretty cool things 195 00:10:05,070 --> 00:10:07,610 with our VPNs. 196 00:10:07,610 --> 00:10:11,240 And another pretty cool thing that Layer 3 VPN introduces 197 00:10:11,240 --> 00:10:16,580 is the ability to offer what's called Central Service VPNs. 198 00:10:16,580 --> 00:10:21,410 This is essentially a VPN that's available to the customers, 199 00:10:21,410 --> 00:10:24,230 but is run by the service provider. 200 00:10:24,230 --> 00:10:27,740 And this is done to offer some sort of service 201 00:10:27,740 --> 00:10:30,830 to the customers that they may be interested in. 202 00:10:30,830 --> 00:10:34,310 Maybe it's something like an email exchange, or a voice 203 00:10:34,310 --> 00:10:35,330 exchange. 204 00:10:35,330 --> 00:10:38,450 But whatever the service is, the big key 205 00:10:38,450 --> 00:10:44,660 is that we want to have access to this Central Service's VPN, 206 00:10:44,660 --> 00:10:47,540 but we still need to keep the traffic separated 207 00:10:47,540 --> 00:10:50,100 from the other customers. 208 00:10:50,100 --> 00:10:51,620 So this is where we're going to get 209 00:10:51,620 --> 00:10:55,010 a little bit tricky with some of our configuration, 210 00:10:55,010 --> 00:10:58,340 to make sure that the customers can talk to the Central Service 211 00:10:58,340 --> 00:11:01,970 VPN, the Central Service VPN can talk to the customer, 212 00:11:01,970 --> 00:11:04,340 but that doesn't mean that the customers can then 213 00:11:04,340 --> 00:11:05,420 talk to each other. 214 00:11:05,420 --> 00:11:08,940 They still need to be separated. 215 00:11:08,940 --> 00:11:12,470 So in this video, we just got an introduction 216 00:11:12,470 --> 00:11:19,250 to some of the concepts and mechanisms in MPLS Layer 3 VPN. 217 00:11:19,250 --> 00:11:21,050 All of this, of course, we're going 218 00:11:21,050 --> 00:11:23,870 to be talking about in much greater detail 219 00:11:23,870 --> 00:11:26,130 in the upcoming videos. 220 00:11:26,130 --> 00:11:28,730 In fact, in the next video, we're 221 00:11:28,730 --> 00:11:30,770 going to be talking about how we keep 222 00:11:30,770 --> 00:11:34,950 the customer routes separate on the PE router. 223 00:11:34,950 --> 00:11:38,660 So until then, I hope this has been informative for you, 224 00:11:38,660 --> 00:11:41,770 and I'd like to thank you for viewing. 225 00:11:41,770 --> 00:11:46,000