Understanding “Virtual” Networks J.J. Ekstrom Fall 2011

Understanding VLANs, Tunnels and VPNs Dest MAC0x8100Source Mac Payload Ether CRCDest MAC Old Ether type Source Mac Ethernet II packet packet Len < 1500 Payload Ether CRCDest MAC Ether type > 1500 Source Mac Pad 802.1p/Q packet Ether CRC VLAN Tag 4bits priority 12 bits VLAN # Payload Pad Link to: IANA EtherType List VLAN Tag VLANs separate Traffic, but access to wire gives access to data.

VPN not Necessarily Secure Payload Ether CRC Dest MACIPSource Mac LTTP packet (Layer 2 Tunneling Protocol) IP Header/ UDP Payload Ether CRCDest MAC Ether type > 1500 Source Mac Pad Payload Ether CRC Dest MACIPSource Mac LTTP packet (Layer 2 Tunneling Protocol) IP Header/ UDP Payload Ether CRCDest MAC Ether type > 1500 Source Mac Pad However payload can be encrypted which reveals pipe but not the contents

MPLS: VLANS on the WAN Ethernet II packet Payload Ether CRCDest MAC Ether type > 1500 Source Mac Pad MPLS Label Edge Router Label Switch Router Label Switch Router Label Switch Router Label Switch Router Label Switch Router Label Switch Router Label Switch Router Label Switch Router Puts on Label Takes off Label and decrypts if necessary Just uses Label Can encrypt for security

MPLS Mappings VLAN tag to MPLS Label IP subnet to MPLS Label IP Destination subnet to MPLS Label Can be different depending on content. ◦ Encrypt some packets not others.

Tunneling (SSL) Treating a stream like a wire. SSL (Secure Sockets Layer) ◦ OpenSSL has tunneling built in. ◦ In on local port tunneled to destination IP and port. ◦ Travels through a virtual wire on port 80 ◦ Looks like http traffic

Virtual Private Networks Typically Encrypted Encapsulate a packet in another protocol’s payload.

Generalizations VPN, VLANs, MPLS, L2TP are all variations on a theme of “tunnel” Tunnels can be used for various things: ◦ Routing simplification ◦ Encryption ◦ Traffic management ◦ …