:: [vpn] Survey of Tunneling techniques for VPN's (GRE, IP-in-IP, IPsec, MPLS ) ::
HOME


[Date Prev][Date Next][Date Index]

[vpn] Survey of Tunneling techniques for VPN's (GRE, IP-in-IP, IPsec, MPLS )


4.3.6 Survey of tunneling techniques

   Tunneling mechanisms provide isolated communication between two CE-PE
   devices.  Available tunneling mechanisms include (but are not limited
   to): GRE [RFC2784] [RFC2890], IP-in-IP encapsulation [RFC2003]
   [RFC2473], IPsec [RFC2401] [RFC2402], and MPLS [RFC3031] [RFC3035].

   Note that the following subsections address tunnel overhead to
   clarify the risk of fragmentation.  Some SP networks contain layer 2
   switches that enforce the standard/default MTU of 1500 bytes.  In
   this case, any encapsulation whatsoever creates a significant risk of
   fragmentation.  However, layer 2 switch vendors are in general aware
   of IP tunneling as well as stacked VLAN overhead, thus many switches
   practically allow an MTU of approximately 1512 bytes now.  In this
   case, up to 12 bytes of encapsulation can be used before there is any
   risk of fragmentation.  Furthermore, to improve TCP and NFS
   performance, switches that support 9K bytes "jumbo frames" are also
   on the market.  In this case, there is no risk of fragmentation.

4.3.6.1 GRE [RFC2784] [RFC2890]

   Generic Routing Encapsulation (GRE) specifies a protocol for
   encapsulating an arbitrary payload protocol over an arbitrary
   delivery protocol [RFC2784].  In particular, it can be used where
   both the payload and the delivery protocol are IP as is the case in
   layer 3 VPNs.  A GRE tunnel is a tunnel whose packets are
   encapsulated by GRE.

   o Multiplexing

     The GRE specification [RFC2784] does not explicitly support
     multiplexing.  But the key field extension to GRE is specified in
     [RFC2890] and it may be used as a multiplexing field.
   o QoS/SLA

     GRE itself does not have intrinsic QoS/SLA capabilities, but it
     inherits whatever capabilities exist in the delivery protocol (IP).
     Additional mechanisms, such as Diffserv or RSVP extensions
     [RFC2746], can be applied.

   o Tunnel setup and maintenance

     There is no standard signaling protocol for setting up and
     maintaining GRE tunnels.

   o Large MTUs and minimization of tunnel overhead

     When GRE encapsulation is used, the resulting packet consists of a
     delivery protocol header, followed by a GRE header, followed by the
     payload packet.  When the delivery protocol is IPv4, and if the key
     field is not present, GRE encapsulation adds at least 28 bytes of
     overhead (36 bytes if key field extension is used.)

   o Security

     GRE encapsulation does not provide any significant security.  The
     optional key field can be used as a clear text password to aid in
     the detection of misconfigurations, but it does not provide
     integrity or authentication.  An SP network which supports VPNs
     must do extensive IP address filtering at its borders to prevent
     spoofed packets from penetrating the VPNs.  If multi-provider VPNs
     are being supported, it may be difficult to set up these filters.

4.3.6.2 IP-in-IP encapsulation [RFC2003] [RFC2473]

   IP-in-IP specifies the format and procedures for IP-in-IP
   encapsulation.  This allows an IP datagram to be encapsulated within
   another IP datagram.  That is, the resulting packet consists of an
   outer IP header, followed immediately by the payload packet.  There
   is no intermediate header as in GRE.  [RFC2003] and [RFC2473] specify
   IPv4 and IPv6 encapsulations respectively.  Once the encapsulated
   datagram arrives at the intermediate destination (as specified in the
   outer IP header), it is decapsulated, yielding the original IP
   datagram, which is then delivered to the destination indicated by the
   original destination address field.

   o Multiplexing

     The IP-in-IP specifications don't explicitly support multiplexing.
     But if a different IP address is used for every VPN then the IP
     address field can be used for this purpose.  (See section 4.3.2 for
     detail).

   o QoS/SLA

     IP-in-IP itself does not have intrinsic QoS/SLA capabilities, but
     of course it inherits whatever capabilities exist for IP.
     Additional mechanisms, such as RSVP extensions [RFC2764] or
     DiffServ extensions [RFC2983], may be used with it.

   o Tunnel setup and maintenance

     There is no standard setup and maintenance protocol for IP-in-IP.

   o Large MTUs and minimization of tunnel overhead

     When the delivery protocol is IPv4, IP-in-IP adds at least 20 bytes
     of overhead.

   o Security

     IP-in-IP encapsulation does not provide any significant security.
     An SP network which supports VPNs must do extensive IP address
     filtering at its borders to prevent spoofed packets from
     penetrating the VPNs.  An SP network which supports VPNs must do
     extensive IP address filtering at its borders to prevent spoofed
     packets from penetrating the VPNs.  If multi-provider VPNs are
     being supported, it may be difficult to set up these filters.

4.3.6.3 IPsec [RFC2401] [RFC2402] [RFC2406] [RFC2409]

   IP Security (IPsec) provides security services at the IP layer
   [RFC2401].  It comprises authentication header (AH) protocol
   [RFC2402], encapsulating security payload (ESP) protocol [RFC2406],
   and Internet key exchange (IKE) protocol [RFC2409].  AH protocol
   provides data integrity, data origin authentication, and an anti-
   replay service.  ESP protocol provides data confidentiality and
   limited traffic flow confidentiality.  It may also provide data
   integrity, data origin authentication, and an anti-replay service.
   AH and ESP may be used in combination.

   IPsec may be employed in either transport or tunnel mode.  In
   transport mode, either an AH or ESP header is inserted immediately
   after the payload packet's IP header.  In tunnel mode, an IP packet
   is encapsulated with an outer IP packet header.  Either an AH or ESP
   header is inserted between them.  AH and ESP establish a
   unidirectional secure communication path between two endpoints, which
   is called a security association.  In tunnel mode, PE-PE tunnel (or a
   CE-CE tunnel) consists of a pair of unidirectional security
   associations.  The IPsec and IKE protocols are used for setting up
   IPsec tunnels.

   o Multiplexing

     The SPI field of AH and ESP is used to multiplex security
     associations (or tunnels) between two peer devices.

   o QoS/SLA

     IPsec itself does not have intrinsic QoS/SLA capabilities, but it
     inherits whatever mechanisms exist for IP.  Other mechanisms such
     as "RSVP Extensions for IPsec Data Flows" [RFC2207] or DiffServ
     extensions [RFC2983] may be used with it.

   o Tunnel setup and maintenance

     The IPsec and IKE protocols are used for the setup and maintenance
     of tunnels.

   o Large MTUs and minimization of tunnel overhead

     IPsec transport mode adds at least 8 bytes of overhead.  IPsec
     tunnel mode adds at least 28 bytes of overhead.  IPsec transport
     mode adds minimal overhead.  In PE-based PPVPNs, the processing
     overhead of IPsec (due to its cryptography) may limit the PE's
     performance, especially if privacy is being provided; this is not
     generally an issue in CE-based PPVPNs.

   o Security

     When IPsec tunneling is used in conjunction with IPsec's
     cryptographic capabilities, excellent authentication and integrity
     functions can be provided.  Privacy can also be optionally
     provided.

4.3.6.4 MPLS [RFC3031] [RFC3032] [RFC3035]

   Multiprotocol Label Switching (MPLS) is a method for forwarding
   packets through a network.  Routers at the edge of a network apply
   simple labels to packets.  A label may be inserted between the data
   link and network headers, or may be carried in the data link header
   (e.g., the VPI/VCI field in an ATM header).  Routers in the network
   switch packets according to the labels, with minimal lookup overhead.
   A path, or a tunnel in the PPVPN, is called a "label switched path
   (LSP)."
   o Multiplexing

     LSPs may be multiplexed within other LSPs.

   o QoS/SLA

     MPLS does not have intrinsic QoS or SLA management mechanisms, but
     bandwidth may be allocated to LSPs, and their routing may be
     explicitly controlled.  Additional techniques such as DiffServ and
     DiffServ aware traffic engineering may be used with it [RFC3270]
     [MPLS-DIFF-TE].  QoS capabilities from IP may be inherited.

   o Tunnel setup and maintenance

     LSPs are set up and maintained by LDP (Label Distribution
     Protocol), RSVP (Resource Reservation Protocol) [RFC3209], or BGP.

   o Large MTUs and minimization of tunnel overhead.

     MPLS encapsulation adds four bytes per label.  [VPN-2547BIS]
     approach uses at least two labels for encapsulation and adds
     minimal overhead.

   o Encapsulation

     MPLS packets may optionally be encapsulated in IP or GRE, for cases
     where it is desirable to carry MPLS packets over an IP-only
     infrastructure.

   o Security

     MPLS encapsulation does not provide any significant security.  An
     SP which is providing VPN service can refuse to accept MPLS packets
     from outside its borders.  This provides the same level of
     assurance as would be obtained via IP address filtering when IP-
     based encapsulations are used.  If a VPN is jointly provided by
     multiple SPs, care should be taken to ensure that a labeled packet
     is accepted from a neighboring router in another SP only if its top
     label is one which was actually distributed to that router.

   o Applicability

     MPLS is the only one of the encapsulation techniques that cannot be
     guaranteed to run over any IP network.  Hence it would not be
     applicable when transparency to the Internet is a requirement.

     If the VPN backbone consists of several cooperating SP networks
     which support MPLS, then the adjacent networks may support MPLS at
     their interconnects.  If two cooperating SP networks which support
     MPLS are separated by a third which does not support MPLS, then
     MPLS-in-IP or MPLS-in-IPsec tunneling may be done between them.

Regards
Shashank
http://mia.ece.uic.edu/~papers