Bgp / Mpls Vpn Ipsec-based Research And Design

Virtual Private Network is one of the hot fields in network research in recent years. With the appearance of VPN, private network can almost extend to everywhere on the earth unlimitedly. This consequently builds the foundation for the all-inclusive applications with security and cheap network. Because of the tremendous commercial value and developmental potential, VPN has become to one of the most active fields currently.VPN service aims not only at providing network connection to its users on the basis of the shared public network, but also at providing the same communication experience as the private network. Reasonable and practical VPN solution should be capable of resisting illegal intrusion, avoiding network block, and delivering user's important data in security and timely. And, it should be administrable all right in realizing these functions.According to these basic principia, we analyze and compare the two main provider provisioned VPN solutions on OSI/RM layer three that exist currently. According to their shortcomings and advantages, we put forward a solution named IPSec based BGP/MPLS VPN, which has higher security comparing the solutions exist currently. This solution extends the thinking of IETF l3vpn working group in enhancing the security of BGP/MPLS VPN. Before the normal IP packet is transmitted through the backbone network, it should be encapsulated with inner MPLS label, IPSec and outer MPLS label in turn. The inner MPLS label acts as the VPN label, the IPSec encapsulation ensures the security of the data when being transmitted through the backbone network, and the outer MPLS label acts as the backbone label.At the same time, a kind of service provider provided, centralized authentication and distributed access mechanism is put forward to ensure the security of the mobile access.At last, we analyze the design of the IPSec based BGP/MPLS VPN, and discuss the prospect of the IPSec based BGP/MPLS VPN.