H3C Technologies H3C S7500E Series Switches - Manual (Page 17)

1-5
An S7500E switch with MCE enabled can solve this problem. By binding the VLAN interfaces to the
VPNs in a network on an S7500E switch of this kind, you can create and maintain a routing table for
each of the VPNs. In this way, packets of different VPNs in the private network can be isolated.
Moreover, with the cooperation of the PE, the routes of each VPN can be advertised to the
corresponding remote PE properly, so that packets of each VPN in the private network can be
transmitted securely through the public network.
How MCE Works
Figure 1-3 illustrates how MCE creates and maintains routing entries of multiple VPNs and how the
MCE exchanges VPN routes with PEs.
Figure 1-3 How MCE works
In Figure 1-3 , the two VPN sites on the left side (Site 1 and Site 2) are connected to the backbone
network through an MCE device. Two VPN tunnels are expected between them and the remote
VPNs at Site 2 and Site 1.
With MCE enabled, routing tables can be created for VPN 1 and VPN 2 individually, VLAN-interface
2 can be bound to VPN 1, and VLAN-interface 3 can be bound to VPN 2. When receiving a piece of
routing information, MCE determines the source of the routing information according to the number
of the interface receiving the information and then maintains the corresponding routing table
accordingly.
You need to also to bind the interfaces to the VPNs on PE 1 in the same way as those on the MCE
device. The MCE device is connected to PE 1 through a trunk, which permits packets of VLAN 2 and
VLAN 3 with VLAN tags carried. In this way, PE 1 can determine the VPN a received packet belongs
to according to the VLAN tag of the packet and passes the packet to the corresponding tunnel.
Routing Information Exchange for MCE
Interface-to-VPN-instance binding enables MCEs and PEs to determine the sources of received
packets and then forward the packets according to the routing information concerning the
corresponding VPNs. The following sections describe the way how MCE transmits the private
routing information of multiple VPNs to PEs properly.