In this review of MPLS VPN basics, discover the differences between MPLS VPNs and traditional virtual private networks, as well as the advantages and disadvantages of the latest in service provider offerings. While an MPLS VPN can simplify the design of your wide area network (WAN),
MPLS VPN basics: What is an MPLS VPN?
An MPLS VPN is a virtual private network built on top of a service provider’s MPLS network to deliver connectivity between enterprise locations. Available in layer 2 or layer 3 options, the VPN leverages the multiprotocol and labeling capabilities of MPLS to deliver a flat, peer-to-peer network to link all of an organization’s remote sites into a common network. In most cases, MPLS VPN services are sold without encryption, typically relying on the fact that each customer is isolated from the others on his own private network. But for those customers that require it, encryption schemes such as IPsec can be added on top of the VPN configuration.
MPLS VPN basics: Comparing MPLS VPNs with other types of VPNs
What is the difference between MPLS and MPLS VPN? The distinction between MPLS and MPLS VPN is actually straightforward, but marketing of the services, as well as customers themselves, blur the differences. When referring to MPLS services, many customers are often actually referring to an MPLS VPN service. Multiprotocol Label Switching (MPLS) is the underlining technology that enables service providers to offer customers high-speed private networks. The service provider provisions virtual circuits for each customer, insulating one customer’s data from another’s, even though both customers are on the same physical telecom gear. To the customer, an MPLS network appears similar to a leased line service, delivering a private network to link multiple corporate sites. Depending on the customer requirements, MPLS can deliver connectivity to an enterprise at either a layer 2 Ethernet level or layer 3 IP level.
What is the difference between traditional VPN and MPLS VPN services? Most VPN services
create a one-to-one link between two network endpoints (referred to as a point-to-point solution).
While the VPN appliance at the head end may support multiple inbound links, each link is unique,
with an encrypted tunnel created between each enterprise remote site and headquarters, for example.
In the point-to-point model, dedicated hardware or software is used to encrypt the traffic between
the two points. For data traffic travelling between two remote sites, this scenario creates an
In order to reach another remote site, traffic from one site has to traverse the VPN tunnel to the
headquarters, then route through another tunnel to its final destination. This additional stop at
the hub not only adds latency in routing these packets but also requires that the hub in this
configuration be equipped with enough bandwidth to handle the load from multiple remote locations.
This type of VPN service is designed to create secure, encrypted links over public networks,
including Internet broadband links.
MPLS VPN services, on the other hand, are designed as a multipoint technology by design, making specific VPN tunneling unnecessary. When data moves from one site to another, it looks up the site in the routing table, adds a tag for that site, and sends the packet to the next router. This approach not only reduces the latency of inter-site transfers, it also flattens the wide area network design, simplifying the approach WAN engineers can take when delivering services between sites. This approach does, however, require all remote sites to be connected to the MPLS network.
What is the difference between L2 and L3 MPLS VPNs? As the names suggest, MPLS VPNs can be provisioned as a layer 2 connection, such as Ethernet, ATM or frame relay, or at layer 3 as an IP-based network. While the majority of customers opt for the IP-based option, customers with particular security or infrastructure needs may choose the layer 2 option, handling the network layer themselves. MPLS enables service providers to offer a range of options to meet their customers’ specific requirements.
MPLS VPN basics: Pros and cons
What are the advantages of an MPLS VPN? High performance and ease of deployment are often cited as the advantages of an MPLS VPN over other solutions. Unlike traditional VPNs, which presume that corporate data is being transmitted on public networks, MPLS VPNs use an isolated private network, making the need to encrypt data between sites an optional feature, based on the organization’s level of trust that the service provider can effectively segregate its customers’ networks.
What are the disadvantages of an MPLS VPN? Like any managed service, an MPLS VPN solution ultimately requires a leap of faith for both the organization and the wide area network (WAN) engineers themselves. Unlike typical point-to-point VPN solutions, which usually have been managed and maintained in-house, using MPLS requires outsourcing your VPN. While relinquishing control of the VPN can take the workload off the WAN engineer, the organization is still at the mercy of the service provider for any moves, adds or changes that need to occur. For many, having to submit a request to the service provider to have configuration changes made, instead of simply making the changes themselves, could be a significant culture shock.
→ To learn more, see SearchEnterpriseWAN.com's MPLS VPN tutorial.
This was first published in September 2010