What is a Layer 2 VPN and How Does it Actually Work?
A Layer 2 Virtual Private Network (L2VPN) is a type of VPN that provides point-to-point or multipoint connections between different sites over a shared infrastructure, while preserving the characteristics of the underlying data link layer.
The OSI Model
To understand how L2VPNs work, it's important to have a basic understanding of the OSI (Open Systems Interconnection) model, which is a conceptual framework that standardizes the functions of a communication system into seven distinct layers.
The OSI model consists of the following layers, from top to bottom:
- Application
- Presentation
- Session
- Transport
- Network
- Data Link
- Physical
L2VPNs operate at the Data Link layer (Layer 2) of the OSI model, which is responsible for the reliable transfer of data frames between two directly connected nodes over a physical medium.
Key Concepts of L2VPNs
L2VPNs provide a virtual point-to-point or multipoint link between two or more sites, allowing them to transparently exchange data as if they were directly connected.
L2VPNs can be implemented using different technologies, such as:
- Virtual LANs (VLANs)
- Virtual Private LAN Services (VPLS)
- Ethernet over MPLS (EoMPLS)
L2VPNs use encapsulation techniques to encapsulate Layer 2 frames within Layer 3 packets, which are then transmitted over the shared infrastructure.
How L2VPNs Work
L2VPNs establish a virtual point-to-point or multipoint link between two or more sites by encapsulating Layer 2 frames within Layer 3 packets, which are then transmitted over the shared infrastructure.
At the edge of the L2VPN network, a device called a Provider Edge (PE) router performs the encapsulation and de-encapsulation of the Layer 2 frames.
The PE router adds a label to the Layer 3 packet, which is used to identify the L2VPN circuit and to forward the packet through the provider network.
When the Layer 3 packet reaches the destination PE router, the label is removed and the Layer 2 frame is de-encapsulated and delivered to the destination device.
Benefits of L2VPNs
L2VPNs offer several benefits, including:
- Transparency: L2VPNs preserve the characteristics of the underlying data link layer, allowing devices to communicate as if they were directly connected.
- Scalability: L2VPNs can easily scale to support a large number of sites and devices.
- Security: L2VPNs provide a secure and private communication channel between sites, protecting against eavesdropping and data theft.
References
- RFC 4026: Layer 2 Virtual Private Networks (L2VPNs)
- RFC 4761: Virtual Private LAN Service (VPLS) Using BGP
- RFC 4384: Ethernet VPN (EVPN)
// Example of L2VPN encapsulation using Ethernet over MPLS (EoMPLS)
// Packet format:
// | Ethernet header | MPLS label stack | Payload (Ethernet frame) |
// Ethernet header:
// | Destination MAC | Source MAC | Ethertype (0x8847 for EoMPLS) |
// MPLS label stack:
// | Label 1 (inner label) | Label 2 (outer label) |
// Payload (Ethernet frame):
// | Ethernet header | Payload (Layer 2 data) |