No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search


To have a better experience, please upgrade your IE browser.


Configuration Guide - VPN

S9300, S9300E, and S9300X V200R010C00

This document describes the VPN configuration procedures and provides configuration examples.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
VPN Tunnel Policy

VPN Tunnel Policy

Introduction to VPN Tunnels

VPN data is transmitted over tunnels, including LSP tunnels and Traffic Engineering (TE) tunnels. TE tunnels are constraint-based routed label switched path (CR-LSP) tunnels. The following describes VPN tunnels:
  • LSP

    An LSP forwards packets through label switching and is often used in BGP/MPLS IP VPN. If LSPs are used as public network tunnels, only PE devices need to analyze IP packet headers. This reduces VPN packet processing time and packet transmission delay. MPLS labels are also supported by all link layers. An LSP is similar to an ATM virtual circuit (VC) or FR VC in terms of functions and security. If devices on the backbone network support MPLS, it is recommended that LSP tunnels or MPLS TE tunnels be used as public network tunnels.

    For details about LSPs, see MPLS LDP Configuration in the S9300, S9300E, and S9300X V200R010C00 Configuration Guide - MPLS.

  • MPLS TE tunnel

    MPLS TE tunnels combine MPLS and TE technologies. MPLS TE balances network traffic by establishing LSPs along specified nodes and steering traffic away from congested nodes. LSPs in MPLS TE are called MPLS TE tunnels, which are also widely used in BGP/MPLS IP VPN.

    MPLS TE tunnels are also capable of handling network congestion. MPLS TE tunnels, allow SPs to fully utilize existing network resources to provide diversified services. MPLS TE tunnels also allow SPs to optimize and manage network resources.

    Carriers are usually required to provide VPN users with end-to-end QoS for various services, such as voice, video, key-data services, and Internet access. MPLS TE tunnels offer users QoS guarantees.

    MPLS TE tunnels allow carriers to also provide the required QoS service guarantees for different VPN users based on policies.

    For details about MPLS TE, see MPLS TE Configuration in the S9300, S9300E, and S9300X V200R010C00 Configuration Guide - MPLS.

Tunnel Policy

VPN services are transmitted over tunnels. LSPs are preferred in VPN service transmission by default, and only one LSP serves one VPN service.

When VPN services need to be transmitted over a specified TE tunnel or when load balancing needs to be performed among multiple tunnels to fully use network resources, tunnel policies need to be applied. Tunnel policies are classified into two types, tunnel type prioritization policy and tunnel binding policy. Both policies cannot be configured simultaneously. The following describes the two types of tunnel policies.

  • Tunnel type prioritization policy:

    Specifies the sequence in which each type of tunnel is selected and the number of tunnels participating in load balancing. Tunnels defined in a tunnel type prioritization policy are selected in sequence. The tunnels selected first are those listed earlier and in the Up state regardless of whether the tunnels are in use. Tunnels listed later are not selected unless load balancing is required or the tunnels specified first are all Down.

    For example, a tunnel policy defines the following rules:

    • Both CR-LSPs and LSPs can be used
    • CR-LSPs are prior to LSPs
    • Three tunnels participate in load balancing

    Tunnels are selected according to the following:

    • CR-LSPs in Up state are preferred.
    • If three or more CR-LSPs are Up, the three CR-LSPs listed earlier are selected.
    • If fewer than three CR-LSPs are Up, LSPs are selected. For example, if only one CR-LSP is Up, two LSP tunnels can be selected.
    • If only one LSP or none are Up, the existing tunnels in Up state are used. If more than two LSPs are Up, only the first two LSPs are selected.
    • If a protection group is configured for a TE tunnel (CR-LSP), the protection tunnel cannot be selected.
    • If a TE tunnel is reserved for tunnel binding, the TE tunnel cannot be selected.

    The tunnel type prioritization policy cannot specify the desired tunnels to use when multiple tunnels of the same type are available.

  • Tunnel binding policy:

    Specifies TE tunnels for carrying VPN services. Multiple TE tunnels to the same destination can be specified for load balancing. You can also determine whether or not to use other tunnels to prevent traffic interruption when all specified tunnels are unavailable.

    The rules for tunnel selection are as follows:
    • Specified TE tunnels in the Up state are selected to perform load balancing.
    • If all the specified TE tunnels are unavailable, no other tunnel is selected by default. An available tunnel LSP or CR-LSP if no LSP is available can be selected based on actual needs.

    A tunnel binding policy specifies accurate TE tunnels over which VPN services are transmitted. TE tunnels have high reliability and guaranteed bandwidth so tunnel binding policies can be used for VPN services requiring QoS guarantee.

    Figure 2-31 shows an example of typical VPN tunnel binding.

    Figure 2-31  VPN tunnel binding

    In Figure 2-31, the network has two MPLS TE tunnels and Tunnel1 and Tunnel2, are established between PE1 and PE3.

    If VPN A binds to Tunnel1 and VPN B binds to Tunnel2, VPN A and VPN B use different TE tunnels. Tunnel1 only serves VPN A, and Tunnel2 only serves VPN B. VPN A and VPN B services are isolated from each other and also from other services. VPN A and VPN B bandwidths are ensured, facilitating subsequent QoS deployment.

Tunnel Selector

In HVPN or inter-AS VPN Option B, SPE devices or ASBRs accept VPNv4 routes from all the UPE or PE devices. Currently, PE devices iterate LSP tunnels for VPNv4 routes. Sometimes, TE tunnels need to be iterated for VPNv4 routes to provide guaranteed bandwidth; the PE devices cannot provide this function by default.

Tunnel selector addresses this issue.

The tunnel selector can filter VPNv4 routes or BGP-IPv4 labeled routes and apply a tunnel policy to the routes that pass the filtering criteria. In this way, expected tunnels can be selected based on the tunnel policy.

Updated: 2019-08-21

Document ID: EDOC1000142068

Views: 120585

Downloads: 214

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Previous Next