Interdomain VPLS and deployment experiences

Virtual Private LAN Services (VPLS) is an Ethernet based VPN (Virtual Private Network) service which provides protocol independent and high speed multipoint-to-multipoint connectivity. In this article, we discuss the possibility to use emerging networks concepts such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) to improve the performance, flexibility and adaptability of VPLS networks. SDN and NFV based VPLS (SoftVPLS) architectures offer new features such as centralized control, network programmability and abstraction to improve the performance, flexibility and automation of traffic, security and network management functions for future VPLS networks.

Virtual Private LAN Services (VPLS) is a widely utilized Layer 2 (L2) Virtual Private Network (VPN) architecture in industrial networks. In the last few years, VPLS networks gained an immense popularity as an ideal network architecture to interconnect industrial legacy SCADA (Supervisory Control and Data Acquisition) and process control devices over a shared network. However, legacy VPLS architectures are highly vulnerable to security threats which are initiated at the insecure shared network segment. Thus, secure VPLS architectures are becoming popular among industrial enterprises. In this article, we provide an overview of existing secure VPLS architectures with a performance evaluation. We evaluate the performance penalty of security on throughput, latency and jitter in a real world testbed. From these experiments, we seek to highlight the drawbacks of existing secure VPLS architectures after implementing them in a real networking environment. Moreover, we try to underscore future research questions that will help to improve the performance of secure VPLS networks.

Virtual private LAN service (VPLS) is a Layer 2 virtual private network technique that has gained enormous popularity in industrial networks. However, the deployment of legacy VPLS architectures in large-scale networks is challenging due to unresolved security and scalability issues. In this paper, we propose a novel hierarchical VPLS architecture based on host identity protocol. The proposed architecture tackles both security and scalability issues in legacy VPLS architectures. It secures the VPLS network by delivering vital security features such as authentication, confidentiality, integrity, availability, and secured control protocol. The security analysis and simulation results confirm that the proposed architecture is protected from various IP-based attacks as well. Theoretical analysis and simulation results have also verified that the proposed architecture provides scalability in control, forwarding, and security planes. Finally, the data plane performance of the proposed architecture is measured in a real-world testbed implementation.

The paper proposes a multi-path routing algorithm to guarantee the bandwidth QoS requirements of point to multipoint (P2MP) virtual private LAN services (VPLS). The probability to find a single feasible path which satisfies a VPLS bandwidth requirement is low for connection requests with large bandwidth constraint requirements or when the network is congested Thus, the proposed algorithm divides the required constraint into sub-constraints and finds the minimum number of optimum P2MP paths that meet the sub-constraint requirement. Most of the work in the area of multi-path routing is focused on partitioning the traffic among multiple point to point (P2P) paths. The traffic is partitioned to reduce the network congestion or to adaptively balance the load among multiple paths based on the network status. The novelty of the proposed algorithm is that the algorithm finds the minimum number of paths that satisfy certain bandwidth QoS constraint. Additionally, the multi-path route is calculated to avoid the critical links of other ingress routers and balances the load by choosing paths with maximum residual bandwidth. The proposed algorithm performance is validated using extensive simulation. The results show that the algorithm is capable of increasing the number of admitted requests and improve the network resource utilization by avoiding critical links and choosing paths with maximum residual bandwidth.

The exponential growth in internet technology has challenged service providers to provide multicast based services like broadcast TV, video on demand and streaming music services over the broadband access infrastructure to their end clients. To meet these requirements, service providers are making use of multi-protocol label switching (MPLS) to better provision and support these bandwidth demanding applications for their end clients. This article presents a performance analysis for the transport of multicast services across MPLS infrastructure networks. Multicast flows are carried using Virtual Private LAN Services (VPLS) as transport media. We further investigate the reliability of multicasting over VPLS and compare it with PIM interms of jitter and delay experimentally using our Optical Networks Research Lab (ONRL) testbed.

Enterprises are increasingly using virtual private networks to interconnect remote sites. Traditionally, service providers have used ATM core networks to deliver layer 2 services such as frame relay, ATM, or TDM private lines, which enterprise customers have then used to build their corporate network infrastructure. Such services account for the majority of data service revenues today. However, pressure has increased on service providers to combine increased flexibility with reduced costs in the context of a highly dynamic telecommunications market. Service providers also need to generate new revenues from their IP network infrastructure, through new opportunities such as IP VPNs and virtual private LAN services, while simultaneously achieving operational efficiencies through the convergence of all of their services on a common MPLS backbone. New access and metro network technologies, such as Ethernet, are also emerging that can be used to deliver these new services to enterprise customers alongside ATM and frame relay access. This must be achieved while also supporting existing technologies such as ATM, which continue to deliver highly profitable services. This article discusses the technical challenges in meeting the often conflicting requirements of delivering both traditional layer 2 services and new layer 3 services on a converged MPLS network. We show how both network and service interworking are required, and how these must operate at the user, control, and management planes to enable profitable services to be delivered over the new converged network. The different solutions being defined in the standards bodies are described, and the distinct scenarios they address are explained.

Chapter 59 - Virtual Private Networks

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

Feature Issue on ConvergenceWe describe a solution based on resilient packet rings (RPR) for the distribution of broadcast video and video-on-demand (VoD) content over a packet-aware transport network. The proposed solution is based on our experience in the design and deployment of nationwide Triple Play networks and relies on technologies such as RPR, multiprotocol label switching (MPLS), and virtual private LAN service (VPLS) to provide the most efficient solution in terms of utilization, scalability, and availability.

Multipoint Ethernet services and virtual private LAN services are an active field of both research and standardization today. A high degree of automation and reduced customer-provider interaction, together with efficient resource management schemes and a guaranteed QoS level are key requirements for these new services, which constitute challenging problems to service providers. Especially the integration into future (G)MPLS networks is an urging need to many operators. In this article, we evaluate VPN resource management schemes under realistic constraints with respect to their applicability to present service developments for (G)MPLS networks. Based on this evaluation, we propose and discuss a new dynamic hose model-based capacity management scheme, which explicitly targets at keeping signaling load and measurement complexity low. Finally, we prove the applicability of the novel approach by means of simulation in a representative case study.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

Hose-model virtual private networks (VPNs) provide customers with more flexibility in specifying bandwidth requirements than pipe-model VPNs. Many hose-model VPN provisioning algorithms have been proposed, and they focus on the bandwidth efficiency in the construction of a single hose-model VPN. In practice, however, VPNs come and go and the dynamics will affect the performance of these VPN provisioning algorithms. If the frequency of adding and deleting VPNs is high, these algorithms will have a scalability problem. We propose in this paper a new network architecture for dynamic VPN construction. In the proposed architecture, adding a new VPN is much simpler and faster, and all that is required is to check if the edge routers have enough bandwidth. There is no need to check the bandwidth left on each internal link because the architecture guarantees that as long as the edge routers have enough capacities to accept the VPN, the internal links will never experience overflow caused by adding the new VPN. We present a linear programming formulation for finding the optimal routing that maximizes the amount of admissible VPN traffic in the network. We then exploit the underlying network flow structure and convert the linear programming problem into a subgradient iterative search problem. The resulting solution is significantly faster than the linear programming approach.

This document updates the meaning of the Control Flags field in the Layer2 Info Extended Community used for BGP-VPLS NLRI as defined in RFC4761. This document updates RFC4761.

This paper discusses some modes of signal transmission for corporate systems using the technology of virtual private networks VPN. A very important property of tunnels is the ability to differentiate different types of traffic and assign them the necessary service priorities. In this work, research has been carried out and comparative characteristics of signal transmission modes using virtual networks have been obtained to identify the effectiveness of the network in various modes of organizing a virtual network, and to optimize a virtual network in order to identify an effective method for organizing a VPN. Also, the work analyzes the specifics of the work of corporate information systems and networks intended for their maintenance, showed that for building a corporate network it is advisable to use virtual private network (VPN) technology, which makes it possible to ensure the fulfillment of the basic requirements for the security and quality of customer service and applications and the current state and direction of development of VPN technology when creating new generation corporate networks, while highlighting the main tasks that need to be addressed when creating a network. Some features of setting up an IPSec VPN server for corporate networks are considered.

The idea of using a low-cost public network such as the Internet to build a private network is intriguing. In this article, we will focus on virtual private networks (VPNs), which leverage the Internet to provide cost-effective, secure communications. We will discuss the challenges of implementing VPNs based on the Internet Engineering Task Force (IETF) Internet protocol security (IPSec) standards. We will cover various aspects including encryption, authentication, Internet key exchange (IKE), and public key infrastructure (PKI) as they relate to IPSec-based VPNs. We will discuss the major issues facing enterprises, service providers, and end-users in implementing intranets, extranets, and remote access VPNs. We will elaborate by discussing how the Lucent VPN firewall handles the various issues and scenarios described here, and how customers in implementing robust VPNs, use it in practice. We also will touch on other VPN solutions and product architectures, and briefly mention other Lucent VPN products. In closing, we will discuss future VPN challenges, including the impact of Internet protocol version 6 (IPv6).3