Directory Probably the most flexible method for discovering VPN peer sites in C#

Reading PDF417 in C# Directory Probably the most flexible method for discovering VPN peer sites

is to read this information from an X500 or Lightweight Directory Access Protocol (LDAP) directory Each service provider edge LSR is configured with just the VPN IDs of the VPNs to which it belongs The LSR can then read the topology of all VPN LSP tunnels it is required to set up directly from the directory, together with the routes associated with each tunnel A directory-based VPN solution can be used for any type of VPN The directory can also be used to hold other VPN-based data that needs to be synchronized across all service provider LSRs that support the VPN, such as the mapping of DSCPs from the VPN into the DSCPs used across the network core, the encryption of sensitive data based on the Primary Key Interface (PKI), or the setup and holding priority to be used for each VPN tunnel Without the use of a directory, all this information would have to be configured at each service provider edge LSR A VPN directory schema has yet to be defined and standardized However, once this is in place, directory-based VPN peer identification will provide an excellent method for discovering VPN peer sites This technique can be implemented without any modification to routing protocols In many implementations, the speed of update to a directory is slow This means that a directory is well suited to storing information that changes infrequently, such as the set of VPN customers served by each service provider edge router In contrast, a directory is ill suited to holding dynamically changing information, such as the precise routing of an LSP tunnel across the network If inner labels are to be stored in a directory, they must be essentially static

control the VPN routes that are accessible from each customer site For example, a customer may require that all of his or her satellite offices connect to a central location that routes between the sites, rather than allowing direct connectivity between the satellite offices If all of the customer s satellite offices were allowed to learn the routes advertised by every other site, this topology would be impossible to set up Manual configuration or use of a central directory allows explicit control over the routes known to each VPN site However, if an ELAN or a routing protocol overlay is used, one of the following techniques must be used:

Each subset of the VPN in which all routes should be made accessible to all sites can be assigned a separate VPN ID In the example of the single central office, however, this requires a separate VPN ID per satellite office, which is very wasteful of VPN IDs If a separate VR is instantiated for each VPN ID, this is also very profligate in its use of router resources It can still be useful to split a single customer s network into several logical VPNs (for example, separate manufacturing and accounts networks), but this technique should not be used for fine-grained control of route availability If the VPN is implemented using a routing protocol overlay, such as in RFC 2547, each VPN-specific route can be assigned a set of route target discriminator fields Each VPN site is also configured with the route target discriminators that it can import, thus giving control over the VPN-specific routes visible to each customer site If the VPN is based on VRs, the full set of configuration tools available for the routing protocol used by the VRs can be utilized to control the routes exported and imported by each VR This technique has the advantage of using tools that may already be familiar to the service provider or customer network administrators See the section MPLS VPN Implementation Models for more details on VRs