How does a Layer 2 MPLS VPN work? (2024)

MPLS is a technique that allows routers to forward packets based on labels, rather than IP addresses. A label is a short identifier that is attached to each packet at the ingress router and removed at the egress router. The label tells the router which path to take, without looking at the packet's content. This way, MPLS can speed up the routing process and support different protocols and services, such as quality of service (QoS), traffic engineering, and VPNs.

A Layer 2 VPN is a VPN that operates at the data link layer of the OSI model, which means that it preserves the original layer 2 frames of the customer's network. For example, if the customer uses Ethernet, the VPN will carry Ethernet frames across the provider's network. A Layer 2 VPN can also support different layer 2 protocols, such as ATM, Frame Relay, or PPP. A Layer 2 VPN allows the customer to have full control over the routing and addressing of their network, as well as to extend their LAN across multiple sites.

A Layer 2 MPLS VPN works by creating virtual circuits (VCs) between CE devices and PE devices. A VC is a logical connection that carries layer 2 frames over an MPLS network. Each VC has a unique identifier, called a VC label, that is assigned by the PE device. The PE device also assigns a tunnel label, which is used to route the VC over the MPLS network. The CE device does not need to know anything about MPLS or VPNs, it just sends and receives layer 2 frames as usual. The PE device encapsulates the layer 2 frames with the VC label and the tunnel label, and forwards them to the next hop router. The next hop router swaps the tunnel label with a new one, according to its MPLS forwarding table, and sends the packet to the next router. This process continues until the packet reaches the destination PE device, which removes the labels and delivers the layer 2 frame to the destination CE device.

There are two main types of Layer 2 MPLS VPNs: point-to-point and multipoint. A point-to-point VPN connects two CE devices over a single VC, which is also called a pseudowire. A multipoint VPN connects multiple CE devices over a shared VC, which is also called a virtual private LAN service (VPLS). A point-to-point VPN is simpler and more efficient, but it does not support broadcast or multicast traffic. A multipoint VPN is more complex and requires more resources, but it supports broadcast and multicast traffic and provides LAN-like connectivity.

Layer 2 MPLS VPNs offer several advantages over other VPN solutions, such as Layer 3 MPLS VPNs or IPsec VPNs. These advantages include protocol-agnosticism, transparency, scalability, and flexibility. Protocol-agnosticism allows for any layer 2 protocol and any layer 3 protocol to be supported. Transparency ensures that customer traffic is not modified or inspected, and that routing or addressing schemes are not interfered with. Scalability enables the support of a large number of VPNs and VCs with minimal overhead and configuration. Flexibility offers different service levels and QoS parameters for different VPNs and VCs.

Layer 2 MPLS VPNs have some disadvantages that need to be taken into account when choosing them as a VPN solution. These include a lack of encryption or authentication for customer traffic, which relies on the provider's network security. Additionally, Layer 2 MPLS VPNs are less manageable, as they do not provide visibility or monitoring of customer traffic and require the customer to manage their own routing and addressing. Furthermore, they may not work well with other VPN technologies or providers and can require vendor-specific equipment and standards.

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Telecommunications Engineering

+ Follow

Thanks for your feedback

Your feedback is private. Like or react to bring the conversation to your network.