250
Figure 76 Scenario where the Level 2 carrier is an MPLS L3VPN service provider
NOTE:
As a best practice, establish equal cost LSPs between the Level 1 carrier and the Level 2 carrier if
equal cost routes exist between them.
Nested VPN
In an MPLS L3VPN network, generally a service provider runs an MPLS L3VPN backbone and
provides VPN services through PEs. Different sites of a VPN customer are connected to the PEs
through CEs to implement communication. In this scenario, a customer's networks are ordinary IP
networks and cannot be further divided into sub-VPNs.
However, in actual applications, customer networks can be dramatically different in form and
complexity, and a customer network may need to use VPNs to further group its users. The traditional
solution to this request is to implement internal VPN configuration on the service provider's PEs. This
solution is easy to deploy, but it increases the network operation cost and brings issues on
management and security because of the following:
•
The number of VPNs that PEs must support increases sharply.
•
Any modification of an internal VPN must be done through the service provider.
The nested VPN technology offers a better solution. It exchanges VPNv4 routes between PEs and
CEs of the ISP MPLS L3VPN and allows a customer to manage its own internal VPNs.
depicts a nested VPN network. On the service provider's MPLS VPN network, there is a customer
VPN named VPN A. The customer VPN contains two sub-VPNs, VPN A-1 and VPN A-2. The service
provider PEs treat the customer's network as a common VPN user and do not join any sub-VPNs.
The customer's CE devices (CE 1, CE 2, CE 7 and CE 8) exchange VPNv4 routes that carry the
sub-VPN routing information with the service provider PEs, implementing the propagation of the
sub-VPN routing information throughout the customer network.