MPLS-based VPNs allow service providers to deploy a scalable and cost-effective VPN service that provides a stable and secure path through the network. An enterprise connects to geographically dispersed sites in the Internet service provider's (ISPs) network through use of an MPLS backbone. Sites are interconnected to create an MPLS VPN.

The Remote Access MPLS-VPNs feature allows the service provider to offer a scalable end-to-end VPN service to remote users. The Remote Access MPLS-VPNs feature integrates the MPLS-enabled backbone with broadband access capabilities. By integrating access VPNs with MPLS VPNs, a service provider can:

• Enable remote users and offices to seamlessly access their corporate networks
• Offer equal access to a set of different ISPs or retail service providers
• Integrate their broadband access networks with the MPLS-enabled backbone
• Provide end-to-end VPN service to enterprise customers with remote access (RA) users and offices
• Separate network access and connectivity functions from ISP functions

MPLS VPN architecture enables the service provider to build the MPLS VPN network one time and add VPNs for new customers as needed, including them in the already established network. The elements that comprise the MPLS VPN are:

• Customer edge (CE) routers--The routers to which subscribers in a customer's network connect. The CE router connects to a service provider's edge router (PE router). The CE router initiates the remote access session to the PE router.
• Provider edge (PE) routers--The routers located at the edge of the service provider's MPLS core network. The PE router connects to one or more CE routers and has full knowledge of the routes to the VPNs associated with those CE routers. The PE router does not have knowledge of the routes to VPNs whose associated CE routers are not connected to it.
• Provider (P) routers--The service provider routers that comprise the provider's core network. The P routers do not assign VPN information and they do not have any knowledge of CE routers. Instead, the main focus of the P router is on label switching.

The figure below shows an example of MPLS VPN network architecture.

Figure 1

MPLS VPN Network--Example

The figure below shows the topology of integrated PPP over Ethernet (PPPoE) access to an MPLS VPN.

Figure 2

PPPoE Access to MPLS VPN Topology

In the figure above, the service provider operates an MPLS VPN that interconnects all customer sites. The service provider's core network is an MPLS backbone with VPN service capability. The service provider provides all remote access operations to its customer. The network-side interfaces are tagged interfaces, logically separated into multiple VPNs.

Remote access is provided using a PPPoE connection. In this model, when a remote user attempts to establish a connection with a corporate network, a PPPoE session is initiated and is terminated on the service provider's virtual home gateway (VHG) or PE router. All remote hosts connected to a particular CE router must be part of the VPN to which the CE router is connected.

The PPPoE to MPLS VPN architecture is a flexible architecture with the following characteristics:

• A remote host can create multiple concurrent PPPoE sessions, each to a different VPN.
• If multiple remote hosts exist behind the same CE router, each remote host can log in to a different VPN.
• Any remote host can log in to any VPN at any time because each VHG or PE router has the VRFs for all possible VPNs preinstantiated on it. This configuration requires that the VRF be applied through the RADIUS server, which can cause scalability issues.

The following events occur as the VHG or PE router processes the incoming PPPoE session:

1. A PPPoE session is initiated over the broadband access network.
2. The VHG/PE router accepts and terminates the PPPoE session.
3. The VHG/PE router obtains virtual access interface (VAI) configuration information:
   • The VHG/PE obtains a virtual template interface configuration information, which typically includes VRF mapping for sessions.
   • The VHG/PE sends a separate request to either the customer's or service provider's RADIUS server for the VPN to authenticate the remote user.
   • The VPN's VRF instance is instantiated on the VHG or PE. The VPN's VRF contains a routing table and other information associated with a specific VPN.

Typically, the customer RADIUS server is located within the customer VPN. To ensure that transactions between the VHG/PE router and the customer RADIUS server occur over routes within the customer VPN, the VHG/PE router is assigned at least one IP address that is valid within the VPN.

1. The VHG/PE router forwards accounting records to the service provider's proxy RADIUS server, which in turn logs the accounting records and forwards them to the appropriate customer RADIUS server.
2. The VHG/PE obtains an IP address for the CPE. The address is allocated from one of the following:
   • Local address pool
   • Service provider's RADIUS server, which either specifies the address pool or directly provides the address
   • Service provider's DHCP server
3. The CPE is now connected to the customer VPN. Packets can flow to and from the remote user.

The MPLS core network is configured by enabling label switching of IP packets on interfaces, configuring virtual routing and forwarding instances, associating VRFs and configuring Multiprotocol BGP PE-to-PE routing sessions. For details relating to these activities, see the appropriate section of the Cisco IOS XE Multiprotocol Label Switching Configuration Guide.

• Configuring a Virtual Template Interface
  
• Configuring PPPoE in a Broadband Aggregation Group
  

A Virtual Private Network (VPN) service can be added to your MPLS configuration by configuring VPNs and associating the VPNs with a virtual template interface. For details relating to these activities, see the Configuring MPLS Layer 3 VPNs module.