H3C Technologies H3C SR8800 - Manual (Page 246)

235
Figure 66 Scenario where the Level 2 carrier is an MPLS L3VPN service provider
CAUTION:
If equal cost routes exist between the Level 1 carrier and the Level 2 carrier, H3C recommends establishing
equal cost LSPs between them.
Nested VPN
Background
In an MPLS L3VPN network, generally a service provider runs an MPLS L3VPN backbone and provides
VPN services through PEs. Different sites of a VPN customer are connected to the PEs through CEs to
implement communication. In this scenario, a customer’s networks are ordinary IP networks and cannot
be further divided into sub-VPNs.
However, in actual applications, customer networks can be dramatically different in form and complexity,
and a customer network may need to use VPNs to further group its users. The traditional solution to this
request is to implement internal VPN configuration on the service provider’s PEs. This solution is easy to
deploy, but it increases the network operation cost and brings issues on management and security
because:
• The number of VPNs that PEs must support will increase sharply.
• Any modification of an internal VPN must be done through the service provider.
The nested VPN technology offers a better solution. It exchanges VPNv4 routes between PEs and CEs of
the ISP MPLS L3VPN and allows a customer to manage its own internal VPNs. Figure 67 depicts a nested
VPN network. On the service provider’s MPLS VPN network, there is a customer VPN named VPN A. The
customer VPN contains two sub-VPNs, VPN A-1 and VPN A-2. The service provider PEs treat the
customer’s network as a common VPN user and do not join any sub-VPNs. The customer’s CE devices
(CE 1, CE 2, CE 7 and CE 8) exchange VPNv4 routes that carry the sub-VPN routing information with the
service provider PEs, implementing the propagation of the sub-VPN routing information throughout the
customer network.
Level 1 carrier
MP-IBGP
PE 1 PE 2
CE 2 CE 1
PE 3
PE 4
Level 2 carrier Level 2 carrier
MP-IBGP
IGP/LDP IGP/LDP
IGP/LDP/Labeled BGP