David Meyer wrote:
On Fri, Mar 05, 2004 at 10:02:10AM -0800, Yakov Rekhter wrote:
Dave,
Hey Suki,
On Thu, Mar 04, 2004 at 02:14:20PM -0800, sonet twister wrote:
Hello,
i heard there is a way to run MPLS for layer3 VPN(2547) service without needing to run label switching in the core(LDP/TDP/RSVP) but straight IP (aka iMPLS).
ftp://ftp.ietf.org/internet-drafts/draft-townsley-l2tpv3-mpls-01.txt
See also Mark's talk from the last NANOG
That requires to run L2TP. An alternative is to run GRE (or even plain IP). The latter (GRE) is implemented by quite a few vendors (and is known to be interoperable among multiple vendors).
The only multi-vendor interoperable mode of GRE that I am aware of requires manual provisioning of point-to-point GRE tunnels between MPLS networks and to each and every IP-only reachable PE. The BGP extension defined in the draft below allows "iMPLS" for 2547 VPN support without requiring any manually provisioned tunnels (and works for "mGRE" or L2TPv3). http://www.watersprings.org/pub/id/draft-nalawade-kapoor-tunnel-safi-01.txt Note that "mGRE" (multipoint GRE) is *not* the same as the point-to-point GRE method that Yakov is referring to. Same header, different usage. Enabling MPLS over any type of IP tunnel changes the security characteristics of your 2547 deployment, in particular with respect to packet spoofing attacks. The L2TPv3 encapsulation used with the extension defined above provides anti-spoofing protection for blind attacks (e.g., the kind that a script kiddie could launch fairly easily) with miniscule operational overhead vs. GRE which relies on IPsec. - Mark
The spec is draft-ietf-l3vpn-gre-ip-2547-01.txt.
Yep, you are correct. Sorry not to cite that one too.
Dave