Subject: AW: How to integrate MPLS and IPSec in IP VPN

From: Hummel Heinrich <[email-masked]>
Date: Tue, 6 Mar 2001 14:21:03 +0100

Hi Cheng,
All  of the current models depend on full mesh inter-site connectivity. But watch out for my contribution draft-hummel-ppvpn-tunnel-systems-00.txt.
It deals with computing, establishing,testing, tearing down minimal VPN-tunnel systems,  which e.g. form trees (without roots), rings, meshy graphs.
Hereby it is assumed that any tunnel (PE-to-PE / CE-to-CE) may also be used as transit tunnel.

I can show you  a simulation where in a network of 300 nodes and 550 links 100 site-nodes are interconnected either by a tree/ring system of 99/100 bidirectional tunnels
which consume 160/213 LSP-hops or however by 100 Dijkstra trees whereby each of them comprises 200 links in average.

IMHO, only physical full mesh is still worse than virtual full mesh. But 100x200 = 20,000 LSP-hops is still too much compared with 160 or 213 LSP-hops.
And this is only for one such VPN. Some service provider will have more than one customer.
When I presented a similar contribution to ITU-T SG 13 Q11 it became obvious that I am aiming for a new VPN model, whereby the cost savings are worth the effort.

Furthermore, the tunnels may be CE-to-CE  as well.
I hope that the MPLS Forum (which meets right now in New Orleans) is adopting a MPLS UNI initiative, so that a user (here the CE) will soon be enabled
to request a CE-to-CE MPLS-layer-2 tunnel across the service provider network. This will promote secured, customer-based  VPNs  ! 

Best Regards,
Heinrich Hummel

Siemens 

> -----Urspr> üngliche Nachricht-----
> Von:	chengguangdong [SMTP:[email-masked]]
> Gesendet am:	Dienstag, 6. März 2001 10:23
> An:	[email-masked]; [email-masked]
> Betreff:	How to integrate MPLS and IPSec in IP VPN
> 
> Hi All,
> Our customer want to build VPN based MPLS but he needs the traffic must be  encrypted before they go to PE routers. In order to provide confidentiality  and any to any connection, the CE routers must be IPSec full meshed , this would be nightmare for a VPN with hundreds CE routers  and conflicts with the advantage of MPLS VPN----simple provisioning.
> So what are the solutions. I will be very appreciated  if  I can get your answer.
> 
> Best Regards,
> Cheng Guang Dong

---

From: [email-masked]
Date: Tue, 6 Mar 2001 13:52:23 -0500

---------------------- Forwarded by Jane Jiang/HQ/Yurie on 03/06/2001 01:55
PM ---------------------------

Jane Jiang
03/06/2001 08:34 AM

To:   "chengguangdong" <[email-masked]>
cc:
Subject:  Re: How to integrate MPLS and IPSec in IP VPN  (Document link:
      Jane Jiang)

Hi Cheng Guang Dong,

MPLS VPN and IPsec are two different things.  They should not conflict with
each other.  If you do IPsec in tunnel mode, i.e., fully hide your
customer's traffic at the CPE routers and then do MPLS forwarding based on
the CPE router addresses, then you should be able to achieve MPLS VPN and
IPsec at the same time.

Regards,
Jane D. Jiang

"chengguangdong" <[email-masked]>@UU.NET on 03/06/2001 04:23:01
AM

Sent by:  [email-masked]

To:   <[email-masked]>, <[email-masked]>
cc:
Subject:  How to integrate MPLS and IPSec in IP VPN

Hi All,
Our customer want to build VPN based MPLS but he needs the traffic must be
encrypted before they go to PE routers. In order to provide confidentiality
and any to any connection, the CE routers must be IPSec full meshed , this
would be nightmare for a VPN with hundreds CE routers  and conflicts with
the advantage of MPLS VPN----simple provisioning.
So what are the solutions. I will be very appreciated  if  I can get your
answer.

Best Regards,
Cheng Guang Dong

---

From: "Tissa Senevirathne" <[email-masked]>
Date: Tue, 06 Mar 2001 18:46:33 -0800

You are bringing up an very appropriate point. The moment you start
discussing many-to-many inter-connections, no longer IPSec unicast is
applicable. True you can have seperate SA for each site, but that is not
going to scale. What you really neeed is Group SA that is being worked out
at multicast security working group.

I am going to speak on this exact topic in the upcoming IETF (if I am given
an oppertunity). Most importantly if you require protocol agnostic VPN
services, IPSec is no longer applicabale

We havve published some work related to Secure MPLS, may be that helps for
now if you need encryption of MPLS payloads.
(http://www.mplsrc.com/drafts.shtml - see under secure MPLS) Coupled this
with Group SA provides an answer to your problem. Which I am sure many
would come across very soon

Let me know if you need any further information

Thanks 
Tissa

408-565-2571

>Our customer want to build VPN based MPLS but he needs the traffic must be
 encrypted before they go to PE routers. In order to provide
confidentiality  and any to any connection, the CE routers must be IPSec
full meshed , this would be nightmare for a VPN with hundreds CE routers
and conflicts with the advantage of MPLS VPN----simple provisioning.
answer.