cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
310
Views
0
Helpful
4
Replies

MPLS vs IPsec VPN?

Robk13
Level 1
Level 1

Hello! 

I'm starting to learn MPLS and had a question regarding it's use. 

Is MPLS used as a way to connect branch offices to a main office? Is it also sometimes used as a method for internet access for a single office? 

If mainly just used as connecting sites together, why not use IPsec VPNs which would be cheaper? 

Thank you! 

2 Accepted Solutions

Accepted Solutions

Cristian Matei
VIP Alumni
VIP Alumni

Hi,

   Usually MPLS technology is used by your service provider / ISP, within MPLS cloud packets being label switched forwarded rather than IP routed forwarded; MPLS is a technology used by ISP's to provide services to their customers (layer2 or layer 3 private VPN's offering connectivity between same customer sites, layer 2 or layer 3 private VPN's offering connectivity between same customer sites and a service offered by provider, layer 3 public VPN offering Internet access to customers); not that term VPN does not include any technologies used to offer security services to packets (e.g. IPsec). When ISP offers you a layer 3 MPLS service to connect your sites, MPLS cloud looks like one big router from customer perspective (IP packets enter with TTL x and exit with TTL x-1); when ISP offers you a layer 2 MPLS service yo connect your sites, MPLS cloud looks like a patch-panel or like a switch (as there are two types of layer 2 services; IP packets enter with TTL x and exit with TTL x).

   Large customers networks also happen to use MPLS nowadays, their core network practically becoming an MPLS cloud, while network edges becoming MPLS customers.

Best,

Cristian.

View solution in original post

Joseph W. Doherty
Hall of Fame
Hall of Fame

"Is MPLS used as a way to connect branch offices to a main office?"

Possibly.

"Is it also sometimes used as a method for internet access for a single office?"

Also possibly.

"If mainly just used as connecting sites together, why not use IPsec VPNs which would be cheaper?"

Hmm, suspect you don't fully understand MPLS, especially as you note you're still learning about it.

MPLS supports many things way beyond an IPSec VPN.

As @Cristian Matei correctly noted, MPLS is (usually) used by service providers, that provide MAN/WAN services to customers, in different ways.  In many, in not most, of these usages, MPLS is "invisible" to the customer.  If customer wants a p2p L2 link or L3 link between sites, the same physical SP infrastructure can provide either or both.  If customer wants a "cloud" L2 or L3 between sites, again on the same physical SP infrastructure, either or both can be provided.  If customer wants both p2p and "cloud" L2/L3, MPLS can provide that too.  If customer wants "real" MPLS (i.e. they want to use MPLS "natively"), their MPLS infrastructure can provide that too.  MPLS has more tricks up its sleeve, too.

Yes, IP VPN, across the Internet (probably also running using MPLS underneath it too) is generally (sometime much) less expensive than MAN/WAN service than a "dedicated" service link, but the "dedicated" link often comes with various service guarantees, and possibly QoS support, while the Internet service, hosting a IP VPN, guarantees nothing.

In other words, once you work with any kind of service provider, the underlying technology is likely the same for everything offered, but the "expensive" services come with SLAs, that's what you're paying extra for.

If you're doing bulk data transfers, across the Internet, using an IP VPN, and if how long it takes to complete doesn't matter, IP VPN is probably an ideal choice.

If you're doing VoIP, across the Internet, an IP VPN, may work great sometimes, and may work terrible other times.  Whether that's acceptable for your VoIP, would be up to you.

As a side note, my last networking job, from which I retired, was a rather large SP.  One of the most critical parts of their SP network, that "could not fail" (because of our network) was the portion supporting public cell phones supporting cell towers.  Why "could not fail"?  911 calls!

The same physical network, supported cellular phone traffic, Internet, and other various MAN/WAN services.  A key part of this infrastructure was MPLS.

Oh, and the company's network was initially designed to support cable TV, digitally.  All the other services were added as adjunct services because they had a network with excess capacity.

View solution in original post

4 Replies 4

You dont use mpls' the SP use mpls in it core and you as customer use any IGP to connect to SP (with mpls core).

For IPsec if ypu have ISP (internet service provider) then first thing ypu need is send data secure through internet' and this need encrypt data' so here mandatory need IPsec or flexvpn.

MHM

Cristian Matei
VIP Alumni
VIP Alumni

Hi,

   Usually MPLS technology is used by your service provider / ISP, within MPLS cloud packets being label switched forwarded rather than IP routed forwarded; MPLS is a technology used by ISP's to provide services to their customers (layer2 or layer 3 private VPN's offering connectivity between same customer sites, layer 2 or layer 3 private VPN's offering connectivity between same customer sites and a service offered by provider, layer 3 public VPN offering Internet access to customers); not that term VPN does not include any technologies used to offer security services to packets (e.g. IPsec). When ISP offers you a layer 3 MPLS service to connect your sites, MPLS cloud looks like one big router from customer perspective (IP packets enter with TTL x and exit with TTL x-1); when ISP offers you a layer 2 MPLS service yo connect your sites, MPLS cloud looks like a patch-panel or like a switch (as there are two types of layer 2 services; IP packets enter with TTL x and exit with TTL x).

   Large customers networks also happen to use MPLS nowadays, their core network practically becoming an MPLS cloud, while network edges becoming MPLS customers.

Best,

Cristian.

Joseph W. Doherty
Hall of Fame
Hall of Fame

"Is MPLS used as a way to connect branch offices to a main office?"

Possibly.

"Is it also sometimes used as a method for internet access for a single office?"

Also possibly.

"If mainly just used as connecting sites together, why not use IPsec VPNs which would be cheaper?"

Hmm, suspect you don't fully understand MPLS, especially as you note you're still learning about it.

MPLS supports many things way beyond an IPSec VPN.

As @Cristian Matei correctly noted, MPLS is (usually) used by service providers, that provide MAN/WAN services to customers, in different ways.  In many, in not most, of these usages, MPLS is "invisible" to the customer.  If customer wants a p2p L2 link or L3 link between sites, the same physical SP infrastructure can provide either or both.  If customer wants a "cloud" L2 or L3 between sites, again on the same physical SP infrastructure, either or both can be provided.  If customer wants both p2p and "cloud" L2/L3, MPLS can provide that too.  If customer wants "real" MPLS (i.e. they want to use MPLS "natively"), their MPLS infrastructure can provide that too.  MPLS has more tricks up its sleeve, too.

Yes, IP VPN, across the Internet (probably also running using MPLS underneath it too) is generally (sometime much) less expensive than MAN/WAN service than a "dedicated" service link, but the "dedicated" link often comes with various service guarantees, and possibly QoS support, while the Internet service, hosting a IP VPN, guarantees nothing.

In other words, once you work with any kind of service provider, the underlying technology is likely the same for everything offered, but the "expensive" services come with SLAs, that's what you're paying extra for.

If you're doing bulk data transfers, across the Internet, using an IP VPN, and if how long it takes to complete doesn't matter, IP VPN is probably an ideal choice.

If you're doing VoIP, across the Internet, an IP VPN, may work great sometimes, and may work terrible other times.  Whether that's acceptable for your VoIP, would be up to you.

As a side note, my last networking job, from which I retired, was a rather large SP.  One of the most critical parts of their SP network, that "could not fail" (because of our network) was the portion supporting public cell phones supporting cell towers.  Why "could not fail"?  911 calls!

The same physical network, supported cellular phone traffic, Internet, and other various MAN/WAN services.  A key part of this infrastructure was MPLS.

Oh, and the company's network was initially designed to support cable TV, digitally.  All the other services were added as adjunct services because they had a network with excess capacity.

Robk13
Level 1
Level 1

Thank you all very much for the detailed explanations. I understand it much better now. 

Review Cisco Networking for a $25 gift card