1-27
Cisco IP Solution Center, 3.0: MPLS VPN Management User Guide, 3.0
OL-4344-01
Chapter1 About Cisco IP Solution Center
Security Requirements for MPLS VPNs
From a security point of view, the merged VPNs behave like one logical VPN, and the security
mechanisms described above apply now between the merged VPN and other VPNs. The merged VPN
must have unique address space internally, but further VPNs can use the same address space without
interference. Packets from and to the merged VPNs cannot be routed to other VPNs. All the separation
functions of MPLS apply also for merged VPNs with respect to other VPNs.
If two VPNs are merged in this way, hosts from either part can reach the other part as if the two VPNs
were a common VPN. With the standard MPLS features, there is no separation or firewalling or packet
filtering between the merged VPNs. Also, if a VPN receives Internet routes through MPLS/BGP VPN
mechanisms, firewalling or packet filtering has to be engineered in addition to the MPLS features.
MP-BGP Security Features
Security in ISC MPLS-based networks is delivered through a combination of MP-BGP and IP address
resolution. In addition, service providers can ensure that VPNs are isolated from each other.
Multiprotocol BGP is a routing information distribution protocol that, through employing multiprotocol
extensions and community attributes, defines who can talk to whom. VPN membership depends upon
logical ports entering the VPN, where MP-BGP assigns a unique Route Distinguisher (RD) value (see
“Route Distinguishers and Route Targets” below).
RDs are unknown to end users, making it impossible to enter the network on another access port and
spoof a flow. Only preassigned ports are allowed to participate in the VPN. In an MPLS VPN, MP-BGP
distributes forwarding information base (FIB) tables about VPNs to members of the same VPN only,
providing native security via logical VPN traffic separation. Furthermore, IBGP PE routing peers can
perform TCP segment protection using the MD5 Signature Option when establishing IBGP peering
relationships, further reducing the likelihood of introducing spoofed TCP segments into the IBGP
connection stream among PE routers (for information on the MD5 Signature Option, see RFC 2385).
The service provider, not the customer, associates a specific VPN with each interface when provisioning
the VPN. Users can only participate in an intranet or extranet if they reside on the correct physical or
logical port and have the proper RD. This setup makes a Cisco MPLS VPN virtually impossible to enter.
Within the core, a standard Interior Gateway Protocol (IGP) such as OSPF or IS-IS distributes routing
information. Provider edge routers set up paths among one another using LDP to communicate
label-binding information. Label binding information for external (customer) routes is distributed
among PE routers using MP-BGP multiprotocol extensions instead of LDP, because they easily attach
to VPN IP information already being distributed.
The MP-BGP community attribute constrains the scope of reachability information. MP-BGP maps FIB
tables to provider edge routers belonging to only a particular VPN, instead of upda ting all edge routers
in the service provider network.
Security Through IP Address Resolution
MPLS VPN networks are easier to integrate with IP-based customer networks. Subscribers can
seamlessly interconnect with a provider service without changing their intranet applications because
MPLS-based networks have built-in application awareness. Customers can even transparently use their
existing IP address space without Network Address Translator (NAT) because each VPN has a unique
identifier.
MPLS VPNs remain unaware of one another. Traffic is separated among VPNs using a logically distinct
forwarding table and RD for each VPN. Based on the incoming interface, the PE selects a specific
forwarding table, which lists only valid destinations in the VPN. To create extranets, a provider explicitly
configures reachability among VPNs.