Subject: VPN based VR or VPN based RFC2547bis ?

From: Marcel Cavalcanti De Castro <[email-masked]>
Date: Thu, 10 Oct 2002 09:35:46 -0300 (EST)

HI
	I´m trying to do a comparison between VPN based VR and VPN based
RFC2547bis, but I have two  basic questions:
	
	- What was the motivation to create the VPN based VR instead of
trying to work only with VPN  based RFC2547bis?(Is it a
commercial or scalability issue?)
	Because I read some documents and I supposed that the main 
   difference between the two architectures resides in the model used 
   to achieve VPN reachability and membership functions. Are there more
differences?

	- Do we can choose one of this architecture when we talk about the
scalability point of view?

	I'd appreciate any comments

  @>
/()\
-^^---------------------------------------------------------
              Marcel Cavalcanti de Castro
            Departamento de Telemática - DT
       Universidade Estadual de Campinas - UNICAMP
             www.dt.fee.unicamp.br/~castro
                   ICQ: 131702293
-----------------------------------------------------------

---

From: [email-masked]
Date: Thu, 10 Oct 2002 14:57:45 +0200

Check the applicability statements (as) drafts on the ppvpn web page.

yacine

---

From: "Brijesh Kumar" <[email-masked]>
Date: Thu, 10 Oct 2002 13:46:56 -0700

----- Original Message -----
From: "Marcel Cavalcanti De Castro" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
>   to achieve VPN reachability and membership functions. Are there more

Marcel,

These are two different approaches to solve the problem - each with its own
merits and demerits with regards to various features including scalability.
And, that means that there is no clear cut winner here, and each vendor and
the carrier has their own preference (including political alignments).

The scalability of a VR model implementation is limited by the ability to
run multiple logical instances of an intra-domain routing protocol such as
ospf, is-is or RIP on the available control processor. Some vendors
implement VRs by modifying one routing task and multiplexing routing
contexts, while others may create as many routing task instances as VRs. No
matter which approach you use for implementation, there is a limit on how
much control traffic your control processor(s) can handle in the system.
Maintaining huge number of IGP adjacencies requires quite lot of work and
the available processor may not be able to keep the pace with the amount of
work required (N VRs with M adjacencies lead to MN adjacencies). This will
result in the system loosing adjacencies or unable to maiantain them for
long time (hello time outs). That, alongwith available on-board memory,
defines the limit of scalability for the VR model. If your processor(s) can
keep pace with the control packets, then implementation is very clean and
full VPN isolation is maintained between various VR instances. This model
integrates very well with many other IPServices such as Firewall, NAT and
providing Internet Access. And, of course you run secure IPSEC tunnels
between VRs to create VPNs.

BGP-MPLS model, on the other hand, extended BGP to multiplex routing and VPN
membership information within its multi-protocol attribute. BGP doesn't
scale without off-loading  a lot of the filtering and processing to one or
more Route Refelectors, and also requires many VPN specific extensions to
BGP and route reflector processing. Since, too many things are being
multiplexed over a BGP session (something for which it wasn't originally
designed) the implementation of model is quite complex compared to VR model.
In the case of BGP/MPLS VPNs, you may not have as many IGP control packets
to maintain routing adjacencies as in the VR model, but you have to now
process much more complex  multiplexed  routing and membership information
over less number of BGP sessions. Given BGPs route computation and policy
application requirements, this computation for large number of VRs requires
quite a lot of computation in your system's control path.  So, it also runs
into the same problem as a VR model as the number of VRFs and the number of
VPN sites increase. And, also it is somewhat less cleaner way to implement
isolation between VRs (if you need to run IGP like ospf between multiple VPN
sites - this model may be made to work, but you would require  distribution
and redistribution of routes between IGP and BGP at the VPN routers. And
also some other restrictions how ospf areas can be configured etc.). Also,
integration with other IP services such firewall etc. is somewhat less
elegent (in addition to that you need mpls - yet another headache to develop
or maintain for some). All said and done, the implementation works fine and
many carriers find is as good and secure as the  VR model.

> scalability point of view?

I don't think there is a definite answer to this. It depends on how smartly
a particular vendor implemented and how much processing power a VPN router
packs in it.

Cheers,

--brijesh