CLI-based Configuration Guide - VPN

A multi-VPN-instance CE (MCE) device uses routing multi-instance to isolate services or users of IPv6.

BGP/MPLS IP VPN uses tunnels to transmit data of private networks on a public network. In the traditional BGP/MPLS IP VPN architecture, each VPN instance must use a CE device to connect to a PE device, as shown in Figure 8-1.

Figure 8-1  Networking without an MCE device

In may cases, a private network must be divided into multiple VPNs to realize fine-grained service management and enhance security. Services of users in different VPNs must be completely isolated. Deploying a CE device for each VPN increases the cost of device procurement and maintenance. If multiple VPNs share one CE device, data security cannot be ensured because all the VPNs use the same routing and forwarding table.

The MCE technology ensures data security between different VPNs while reducing network construction and maintenance costs. Figure 8-2 shows the MCE deployment.

Figure 8-2  Networking with an MCE device

An MCE device has some PE functions. By binding each VPN instance to a different interface, an MCE device creates and maintains an independent VRF for each VPN. This application is also called multi-VRF application. The MCE device isolates forwarding paths of different VPNs on a private network and advertises routes of each VPN to the peer PE device, ensuring that VPN packets are correctly transmitted on the public network.