3Com Switch 8800 Configuration Guide Chapter 37 BGP/MPLS VPN Configuration
37-3
VPNs. These disadvantages not only increase the network operating cost, but also
bring relevant management and security issues.
The nested VPN is a better solution. Its main idea is to transfer VPNv4 route between
PE and CE of common BGP MPLS/VPN such that user themselves can manage their
internal VPN division, and the service provider can be saved from participating into
users' internal VPN management.
The following figure shows the network model for nested VPN:
VPN3
VPN2
VPN1
VPN1
provider PE provider PE
customer PE
CE1 CE2 CE3 CE4
VPN2
VPN1
CE5
VPN3
CE6
customer VPN
CE7
P
customer PE
customer VPN
Figure 37-2 Network model for nested BGP/MPLS VPN
III. Basic concepts in BGP/MPLS VPN 1) vpn-instance
vpn-instance is an important concept in VPN routing in MPLS. In an MPLS VPN
implementation, each site corresponds to a specific vpn-instance on PE (their
association is implemented by binding vpn-instance to the VALN interface). If
subscribers on one site belong to multiple VPNs, then the corresponding vpn-instance
includes information about all these VPNs.
Specifically, such information should be included in vpn-instance: label forwarding table,
IP routing table, the interfaces bound with vpn-instance, and the management
information (RD, route filtering policy, member interface list, and so on). It includes the
VPN membership and routing rules of this site.
PE is responsible for updating and maintaining the relationship between vpn-instance
and VPN. To avoid data leakage from the VPN and illegal data entering into the VPN,
each vpn-instance on the PE has an independent set of routing table and label
forwarding table, in which the forwarding information of the message is saved
2) MBGP
MBGP (multiprotocol extensions for BGP-4, see RFC2283) propagates VPN
membership information and routes between PE routers. It features backward