MPLS VPNs

VPN tunnels using popular technologies like IPSec or GRE have helped a lot of companies securely transport their data across a shared infrastructure over the past several years. However, these tunnels have only two end points. They are particularly useful when an organization only has two geographic sites or their data needs to be transported between only two locations, but for organizations with many endpoints, many tunnels are required. These tunnels quickly become difficult to manage and difficult to troubleshoot.

A solution to the problem of multiple endpoints that is gaining popularity is Multi-protocol Label Switching (MPLS), which offers a secure "any-to-any" VPN service across a shared infrastructure (like your service provider's WAN) by switching packets based on their labels. Although it's not the same, it may help to think of MPLS as a way to make multiple VLANs on your service provider's backbone.

If you're considering MPLS to replace a plethora of tunnels, consider one more thing: VRF Lite. While most sites connecting to a VPN are analogous to one port on a VLAN (that is, they're only connected to one virtual network on the shared backbone), sometimes you want multiple virtual networks at a location to share a single access circuit to the backbone, because access-circuits are one of the most expensive components in your network. VRF Lite is a technology that allows you to extend multiple virtual networks from the MPLS network onto your premise without the expense of actually extending the MPLS network.

Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.