VPN

InternetConnect: Joining IP and ATM with MPLS

The solution promises to speed up Virtual Private Networks by ensuring that next-hop decisions are made before data is sent, not made while the data is in transit. It could cut bandwidth prices by a factor of ten versus Frame Relay.

Lisa Phifer VP Core Competence, Inc . [January 10, 2001]

Most ISPs are familiar with scalability issues associated with IP routing. In IP networks, route topology is propagated to every member of a routing domain using a protocol like BGP-4 or OSPF [ definition ]. Each router builds an IP-forwarding table to determine the next hop for arriving packets. In large networks, table length grows, increasing lookup time, memory/CPU utilization, and route advertisements. Efficiencies can be gained through route filtering and aggregation. But, ultimately, per-hop decision-making has its limits.

Most ISPs are also familiar with the efficiency (and higher infrastructure cost) of WAN switching. Frame Relay and ATM networks consist of point-to-point links—virtual connections (VCs)—that define paths between ingress and egress switches. When a new VC is created, a label map is configured at each node in the path. When an ATM cell arrives, the switch fabric simply maps the incoming VPI/VCI to the outgoing VPI/VCI, performing a label swap. Label switching is faster than routing because next-hop decisions are not made in the data path.

Multi-Protocol Label Switching (MPLS) integrates label-forwarding with network-layer routing for better price/performance, scalability, and flexibility in IP networks. Providers like AT&T , GlobalOne , and InternetConnect are starting to offer MPLS-based services. Industry analysts anticipate widespread deployment: the Yankee Group estimates a $2.6B market for MPLS IP VPNs by 2005.

InternetConnect VPNplus
To assess the MPLS provider opportunity, we interviewed Robert Staats, Director of Engineering at InternetConnect, a business broadband solutions provider based in Torrance, Calif.

InternetConnect operates a nationwide ATM backbone with POPs in 34 metropolitan markets. InternetConnect leverages its backbone to offer an array of high-speed business services, including dedicated, Frame Relay, and DSL access. In April 2000, InternetConnect launched VPNplus, an IP network service based on MPLS. In August, InternetConnect added VPNplus Remote, providing customers with IPsec and L2TP-based dial access into VPNplus networks.

"VPNPlus takes IP packets and adds MPLS tags to create a private network for each customer," said Staats. "We've combined MPLS with our ATM network to provide IP VPN service across the country."

A brief overview
In effect, MPLS is similar to adding a machine-readable bar code to an address. MPLS edge devices act as both routers and switches—at the ingress side, they accept arriving packets from a routed network and tag them, then switch them across an MPLS backbone. At the egress side, the process is the opposite—accept an arriving packet from the MPLS backbone, strip off the tag, and route the packet onward to its final destination.

MPLS makes it possible to substitute cheaper access routers and connections, saving cost over traditional Frame Relay intranets.

In routing, decisions are made on every hop through a routed network. In switching, decisions are made when the virtual circuit is established. A non-technical analogy might be mailing addresses and postal bar codes. This analogy isn't perfect, but without bar codes, postal workers sort mail by reading the address and putting envelopes in the right bag to move them towards the destination. The address must interpreted at every PO or hub along the way.

But bar codes move mail faster—the address is converted into a single bar code that means something to mechanical handlers that sort and forward mail quickly through the postal system. Only at the destination PO does someone actually have to look at the mailing address again to deliver the envelope to the right home.

An MPLS primer
MPLS transforms IP-based traffic into switched traffic at the network edge. It does so by labeling packets to be transported across the backbone. Labels tell each ATM switch how to process and forward cells. As cells traverse the backbone, label swaps are performed at each node, using a label-forwarding database.

The database is created by a control plane that is cleanly separated from the data plane. In the control plane, MPLS nodes use routed IP to exchange label bindings with each other. In effect, each MPLS node operates as an IP router in the control plane, and a label switch in the data plane. These nodes are generically referred to as Label Switch Routers (LSRs).

An Edge-LSR prepends a label (or stack of labels) to each IP packet entering an MPLS domain, and strips those labels at the far end. In between lie ATM-LSRs: ATM switches that use an MPLS control plane to configure VCs and a switching fabric to forward labeled packets as ATM cells. At backbone ingress and egress points, ATM Edge-LSRs segment and reassemble labeled IP packets into ATM cells. This distinction is architectural: more than one of these functions can be performed by a single device.

InternetConnect's network
To illustrate this architecture, let's examine InternetConnect's MPLS-based approach:

• Customers are connected to POPs by CPE access routers (for example, SDSL routers).
• At POPs, MPLS tagging is done by Cisco 7200 routers and 6400 ATM switch/routers.
• At edge routers, traffic is moved from customer virtual interfaces onto an ATM PVC.
• The backbone consists of Lucent CBX ATM switches, connected by DS3 and OC3 links.
• VPNplus strings ATM PVCs between switches, creating an IP VPN across the backbone.

According to Staats, this approach offers several advantages over traditional Frame Relay "VPNs" and secure IPsec VPNs. "Customers can use relatively inexpensive access routers, because all the intelligence is in the core of the network," said Staats. "Performance is enhanced because there is no overhead of encapsulation or encryption, and because our core provides full-mesh connectivity (not the hub and spoke approach taken by many other VPNs)."

Go to Page 2: Conclusion