Subject: RE: FW: VPN solution - White flag ?

From: "Morgan, Richard" <[email-masked]>
Date: Thu, 26 Oct 2000 16:55:37 +0100

Does the Virtual Router soluntion take advantage of the 'hierrachy of
routing knowledge' ie use two labels, one to get the PE and another to
identify the VR - or does it create individual LSP's between each other VR's
and not use the label stack ?

Richard Morgan

> -----Original Message-----
> From: Hamid Ould-Brahim [mailto:[email-masked]]
> Sent: Thursday, October 26, 2000 4:17 PM
> To: Paul Tasillo
> Cc: mpls@UU. net; [email-masked]
> Subject: Re: FW: VPN solution - White flag ?
> 
> 
> Paul,
> 
> Your scalability question is really related to PE's resources 
> (e.g., CPU,
> memory)
> On this respect building vpns with virtual routers is
> no different than any other application
> 
> VPN/PE scalability depends also on factors like the software/hardware
> architecture of the PE and  whether the "virtualization" 
> aspect of VR is
> built in within the PE infrastructure day one.
> 
> However no matter how powerful is the PE, there is always a limit
> on what you can do on it.
> 
> Regards
> Hamid
> 
> 
> Paul Tasillo wrote:
> 
> > Will the overhead of running Virtual Routers impact the 
> scalablity of the
> > draft-ouldbrahim-vpn-vr-01 approach? That is, there must be 
> a limit to the
> > number of VRs a PE can handle and thus a limit to the 
> number of VPNs the PE
> > can handle. Is this true?
> >
> > -Paul (not Paul Doolan)
> > Paul Tasillo
> > Tivoli Systems
> >
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of Jim
> > Guichard
> > Sent: Thursday, October 26, 2000 8:43 AM
> > To: Barry Hass; [email-masked]; Paul Doolan
> > Cc: [email-masked]; [email-masked];
> > [email-masked]; [email-masked]
> > Subject: RE: VPN solution - White flag ?
> >
> > Barry,
> >
> > the answer is no. There are various ways to design Internet 
> connectivity
> > within this environment, one of which is to carry full 
> Internet routes on
> > the PE router. Other options include default routing from 
> VPN sites to a
> > central site that has Internet connectivity, another is to 
> offload the
> > Internet routes from the PE and run direct eBGP sessions 
> from the VPN site
> > to the Internet exit point. Which option is actually taken 
> will depend on
> > the specific design requirements. Jim
> >
> > At 08:37 26/10/2000 -0400, Barry Hass wrote:
> > >Eric,
> > >
> > >Doesn't a PE router have to handle the full Internet routing
> > >table, plus VRFs for whatever VPNs it is supporting? I think
> > >that what some folks are suggesting is that BGP (not "the box",
> > >but BGP specifically) is already bumping up against scaling
> > >limits at 100,000 or so routes, and that burdening it with the
> > >additional responsibility of managing VPNs is not such a great
> > >idea. ("Some folks" please correct me if I'm wrong). Can you
> > >comment on that?
> > >
> > >By the way, I don't have enough information to have an opinion
> > >on this. I'm just trying to steer the discussion back to what
> > >I thought was an interesting technical question before the
> > >insults started to fly.
> > >
> > >> In the  NBVPN routing environment, it is  not true that
> > >> anyone  in the world
> > >> needs to be  able to reach anyone else  in the world.  Each
> > >> VPN  has its own
> > >> inter-connectivity  matrix,  much  smaller  than the
> > >> Internet  connectivity
> > >> matrix.  Now if you add up all the VPN routes, summed over
> > >> all VPNs, you may
> > >> indeed get  a much larger  number than the  number of
> > >> Internet  routes.  But
> > >> there is no one box which needs  to hold them all.  Since an
> > >> instance of BGP
> > >> runs in a particular box, and only  has to deal with the
> > >> routes that need to
> > >> be in that box,  you don't run up against the same  box
> > >> scaling problems you
> > >> run up  against in  the Internet routing  environment.  You
> > >> can  design your
> > >> system to  have a given box  handle as many routes  or as few
> > >>  routes as you
> > >> want.
> > >
> >
> > Jim Guichard CCIE #2069
> > Network Design Consultant EMEA
> > Global Solutions Engineering
> >
> > +44 208 756 8806
> > Mobile: +44 7802 809763
>

---

From: "Hamid Ould-Brahim" <[email-masked]>
Date: Mon, 30 Oct 2000 15:23:11 -0500

Richard,

When deployed over an MPLS infrastructure the VR model
can use a two label approach to forward vpn packets 
transparently over the service provider network. 

Depending on the MPLS deployment scenario, 
the inner label can be bound to the VR or to 
the vpn prefix within the VR context. In the latter case, 
the VR is responsible to distribute the vpn labels attached
to the private reachability information. Each VR may or may
not run MPLS. Both schemes can also be used. As an example,
the per vpn label distribution can be tunneled (with MPLS or not),
where the inner label is bound to the VR. Once it is distributed
to each VPN, the data path will just use the two labels, one
for the vpn prefix (attached in VR context), and the top label
within the PE (or backbone VR). Because each VR is independent
from the others, some VRs may be running MPLS, some may use 
IPSec, etc.

Regards
Hamid  

> "Morgan, Richard" wrote: