Scalability implications of virtual private networks

Abstract

This article gives an overview of the most promising technologies for service providers to offer virtual private network services. The focus of this article is on the analysis of the scalability implications of these virtual private network mechanisms on existing service provider backbone networks. Very often, when deploying VPN services, service providers will be confronted with a trade-off between scalability and security. VPNs that require site-to-site interconnectivity without strong (cryptographic) security can be deployed in a scalable way based on the network-based VPN model, as long as the interaction between the customer and provider routing dynamics are controlled. VPNs that require strong (end-to-end) cryptographic security should be deployed according to the CPE-based VPN model, using the available IPsec protocol suite.

Fairness-oriented Overlay VPN topology construction

“…According to this strategy, a node n that aims to join the VPN retrieves information about the current overlay topology 2 and derives the distance-matrix M(i,j), measured in number of overlay hops, between any node i and node j. After that, the joining node sequentially selects the best k neighbors by "selfishly" operating as follows [5].…”

“…However, our goal is here limited to show that such type of distance-based selection strategy is affected by fairness issues, and for this reason the above outlined one-at-a-time approach allows us to readily raise this issue. 2 This is in practice accomplished by having the joining node contacting the VPN through a bootstrap node. The bootstrap node forwards to the joiningnode the link-state messages of the routing protocol; hence, after some time, the joining node retrieves the overlay topology [4].…”

“…The value of fc(p) (fairness-cost) is reported in Eq (2), where N is the number of nodes that are already in the VPN. This component of the cost function drives the neighborselection toward the achievement of a fair overlay, i.e.…”

“…The price to pay is the signaling, processing and memory consumption overhead associated to the creation and maintenance of the full-mesh, a burden which basically rules out this topology for networks over just a few tens of nodes. Indeed, each VPN link has to be protected through a secure tunneling protocol, and this involves state maintenance for each security association, computationally heavy VPN join procedures (every new joining node must deploy as many asymmetric cryptographic handshakes -RSA-based key transfers or Diffie-Hellman-based key agreements -as the number of remaining network nodes), rekeying overhead, etc [2]. This paper addresses the issue of creating and maintaining suitable VPN topologies [3] where a node has an overlay link with a (possibly small) subset of other nodes [4] [5].…”

Considerations in Designing DCI (Data Centre Interconnect) in Full Mesh VPLS/ Multicast Enable WAN over OTV Tunne

“…In essence, a VPLS glues several individual LANs together across a packet-switched network provided by scalable-shared IP/MPLS backbone to appear and function as a single LAN. The underlying MPLS can provide Traffic Engineering (TE) functionality, which includes the Quality of Service (QoS) guarantees [3], resource optimization, and fast failure recovery. Each service router has a VPLS service instance (also referred as a Virtual Switching Instance, or VSI) [4].…”