Hierarchy Of VPN – HoVPN

Hierarchical Model and Plane Model

• PEs ensure the access for users, and thus require a great number of interfaces.
• PEs manage and advertise VPN routes, and process user packets. Thus, the PEs require large-capacity memory and high forwarding capabilities.

HoVPN

Advantages of HoVPN

• A BGP/MPLS IP VPN can be divided into different hierarchies. If the performance of an underlayer PE (UPE) does not satisfy the requirements, a superstratum PE (SPE) can be added, and the UPE accesses the new SPE. When the service access capabilities of the SPE is insufficient, UPEs can be added to the SPE.
• Label forwarding is performed between UPEs and SPEs. Thus, a UPE and an SPE need be connected through only a pair of interfaces or sub-interfaces. Thus, interface resources are saved.
• If UPEs and SPEs are separated by an IP or MPLS network, GRE or LSP tunnels are set up to connect the UPEs and SPEs. A layered MPLS VPN features excellent scalability.
• The UPEs need maintain only the local VPN routes. All the remote routes are represented by a default or aggregated route. This lightens the burden on the UPEs.
• SPEs and UPEs exchange routes and advertise labels through the Multi-protocol Extensions for Border Gateway Protocol (MP-BGP). Each UPE sets up only one MP-BGP peer. Thus, the protocol cost is low and the configuration load is little.

Architecture of an HoVPN

• The UPEs provide the access service for users. The UPEs maintain the routes of the directly connected VPN sites. The UPEs do not maintain the routes of the remote VPN sites, or only maintain their aggregation routes. The UPEs assign inner labels to the routes of the directly connected sites, and advertise the labels with the VPN routes to the SPE through MP-BGP.
• The SPE mainly manages and advertises VPN routes. The SPE maintains all the routes of the VPN sites connected through the UPEs, including the routes of the local and the remote sites. Instead of advertising routes of the remote sites to the UPEs, the SPE advertises the default routes of VPN instances that carry labels to the UPEs.
• Label forwarding is adopted between the UPEs and the SPE. Thus, only one interface of the SPE is required to connect to a UPE. The SPE does not need to provide many interfaces for access users. The interface that connects the UPEs and the SPE can be a physical interface, a sub-interface such as VLAN and Permanent Virtual Circuit (PVC), or a tunnel interface such as GRE and LSP. If a tunnel interface is used, and an IP network or an MPLS network resides between the SPE and the UPEs, the SPE and the UPEs can communicate. Labeled packets are transmitted through the tunnel. If the tunnel is a GRE tunnel, it must support the MPLS encapsulation.

SPE-UPE

Embedding and Extension of an HoVPN

• An HoPE can function as a UPE, and compose a new HoPE with an SPE.
• An HoPE can function as an SPE, and compose a new HoPE with multiple UPEs.
• An HoPE can be embedded recursively in the preceding two modes.

 NOTE:

The MPE does not actually exist in an HoVPN model. The concept is introduced just for the convenience of description.

Networking Applications

• HoVPN extension
  If an MPLS VPN spans a country, the VPN is generally of a flat structure, that is, the MPLS VPN services are provided through the backbone network. In the flat structure, the PEs of the backbone network are generally deployed in the central cities. The CEs are converged to a PE through one link respectively, as shown in Figure 3.
  
  Figure 3 Networking diagram of a non-HoVPN
  In this networking mode, a lot of resources of WAN links are consumed when the remote CEs access the central cities. The scale of the backbone network is limited, which leads to the poor scalability and limited coverage of the VPN.
  On the contrary, if the HoVPN model is adopted, UPEs can be deployed even in counties, and the VPN users access the adjacent UPEs before being converged to the central cities, as shown in Figure 4. The coverage of the VPN can be extended. The services can be smoothly upgraded and the network can be extended as required. The SPEs and UPEs can reside within an AS or serve as joints between ASs.
  
  Figure 4 Networking diagram of an HoVPN
• UPE connected to multiple SPEs
  The networking mode in which a UPE is connected to multiple SPEs is called multi-homed UPE. In this networking mode, the multiple SPEs advertise the VRF default routes to the UPE. The UPE selects one of the routes as the optimal route, or selects multiple routes to perform load balancing.
  The UPE advertises all the VPN routes to the multiple SPEs, or just part of routes to each SPE to implement load balancing.
• HoVPN of an inter-AS VPN
  • As shown in Figure 5, the backbone network and the MANs belong to different ASs. The SPEs are deployed in the backbone network; the UPEs are deployed in the MANs. The UPEs advertise all the MAN routes to the SPEs; the SPEs advertise only the default routes of the VPN instances to the UPEs. Thus, the MANs need only maintain the routes of the internal VPN sites instead of the routes of sites outside the MANs. The backbone network must maintain the routes of all the VPN sites.
  • In an inter-AS scheme, MP-EBGP or multi-hop EBGP can be adopted between SPEs and UPEs.
  • In an inter-AS HoVPN, the high-level network, namely, the backbone network handles the global services; the low-level network, namely, the MAN need deal with only the local services. Thus, the global VPN service development does not challenge the capacity and extension of the low-level network.
  
  Figure 5 Inter-AS HoVPN