Layer 2 VPN (L2VPN)
Table of Contents
What is Layer 2 VPN (L2VPN)
A Layer 2 VPN (L2VPN) is a type of Virtual Private Network that connects multiple locations at the data link layer (Layer 2), allowing them to function as if they are part of the same local area network (LAN). Instead of routing only IP packets, an L2VPN carries full Ethernet frames, including MAC addresses, which means it can support both IP and non-IP traffic between distant sites.
In an L2VPN setup, service providers use technologies like MPLS to create virtual tunnels between customer networks. These tunnels transport Layer-2 traffic transparently, so devices in different locations can communicate as if they are connected to the same switch. This makes it possible to extend VLANs and maintain the same network structure across multiple sites.
There are different types of L2VPN technologies. For example, VPWS (Virtual Private Wire Service) provides a point-to-point connection between two sites, while VPLS (Virtual Private LAN Service) connects multiple sites in a single broadcast domain. A more advanced option, EVPN (Ethernet VPN), improves scalability and efficiency by using better control mechanisms for handling network traffic.
One of the main advantages of L2VPN is that it offers LAN-like connectivity over long distances, making it ideal for businesses that need seamless integration between offices. It is also useful for supporting legacy systems and applications that require Layer-2 communication.
However, L2VPN can have some challenges, such as increased broadcast traffic and complexity in large networks. Proper design and management are required to ensure performance and scalability. Overall, L2VPN is widely used in enterprise and service provider networks to extend Ethernet services across geographically separated locations.
The L2VPN is divided into two models or types. One is based on the MPLS core network and the other is based on the IP core.
What is VPWS (Virtual Private Wire Service)?
Definition:
VPWS (Virtual Private Wire Service) is a Layer 2 VPN technology that provides a secure point-to-point Ethernet connection between two geographically separate locations over a service provider’s MPLS network. It makes the two sites appear as if they are connected by a dedicated physical Ethernet cable.looks Like Lan
How It Works:
In a VPWS network, customer traffic enters the service provider’s Provider Edge (PE) router, where it is encapsulated into an MPLS pseudowire. The traffic travels securely across the provider’s MPLS backbone and is delivered to the remote PE router, which removes the encapsulation and forwards the original Ethernet frames to the destination site.
Key Features:
VPWS offers transparent Layer 2 connectivity, low latency, high performance, and secure traffic isolation. Since the provider only transports Ethernet frames, customers maintain full control over their own IP addressing, routing, VLANs, and network policies.
Advantages:
VPWS provides a reliable and scalable solution for connecting two sites without requiring dedicated leased fiber. It is simpler to manage than building a private WAN, offers predictable performance, and allows organizations to extend their existing LAN across distant locations.
Common Use Cases:
Organizations use VPWS to connect headquarters with branch offices, link data centers, support disaster recovery sites, transport storage traffic, and carry voice or video services that
VPWS vs VPLS:
The main difference is that VPWS is designed for point-to-point communication between exactly two sites, while VPLS (Virtual Private LAN Service) supports multipoint communication, allowing multiple sites to share the same virtual LAN.
Example:
Suppose a company has its headquarters in Kolkata and a branch office in Haldia. Instead of installing a dedicated fiber link, the company purchases a VPWS service from an ISP. The ISP transports Ethernet traffic over its MPLS network, making both offices behave as though they are connected by a single Ethernet cable, while the company’s own routers
In VPWS:
- The customer manages routing, IP addresses, VLANs, and firewalls.
- The service provider only transports Layer 2 Ethernet frames between the two sites over its MPLS network.
Step 1: Customer Sends Data
The communication begins when a device at Site A sends an Ethernet frame to a device at Site B. The data passes through the customer’s switch or router and reaches the service provider’s Provider Edge (PE) router. At this stage, the traffic is still in its original Ethernet format.
Step 2: Encapsulation at the Provider Edge
When the Ethernet frame reaches the PE router, the service provider encapsulates it into an MPLS pseudowire. This pseudowire acts as a virtual point-to-point connection between the two customer sites. The customer’s Ethernet frame remains unchanged inside the MPLS tunnel.
Step 3: Transport Across the MPLS Network
The encapsulated traffic travels through the service provider’s MPLS backbone. The Provider (P) routers inside the MPLS network simply forward packets based on MPLS labels. They do not inspect or modify the customer’s IP addresses or Ethernet frames, ensuring fast and efficient forwarding.
Step 4: Decapsulation at the Destination
When the traffic reaches the destination Provider Edge (PE) router, the MPLS labels are removed. The original Ethernet frame is recovered exactly as it was received from the source site, preserving all Layer 2 information.
Step 5: Delivery to the Destination Site
After decapsulation, the destination PE router forwards the Ethernet frame to the customer’s router or switch at Site B. The destination device receives the frame as though it had traveled over a dedicated Ethernet cable.
Result
From the customer’s perspective, both locations appear to be connected by a private physical Ethernet link. Although the traffic actually travels through the service provider’s shared MPLS infrastructure, the communication is isolated, secure, and transparent. The customer retains full control over IP addressing, routing, VLANs, and network security, while the service provider is responsible only for transporting the Layer 2 Ethernet frames between the two sites.
A company has its Head Office in Kolkata and a Branch Office in Haldia. Both offices need to access the same File Server, IP PBX system, CCTV, and internal business applications. Instead of installing a dedicated fiber cable between the two locations, the company purchases a VPWS service from an ISP.
At the Head Office, employees send data to the branch office through their local switch and router. The traffic reaches the ISP’s Provider Edge (PE) router, where it is encapsulated into an MPLS pseudowire. The data is then transported securely across the ISP’s MPLS backbone.
When the traffic reaches the destination Provider Edge (PE) router near the branch office, the MPLS encapsulation is removed. The original Ethernet frame is forwarded to the branch office switch and delivered to the destination device, such as a file server or IP phone.
To the employees, it appears as if the Head Office and Branch Office are connected by a single Ethernet cable. They can access shared folders, print to remote printers, use IP phones, and communicate with servers without knowing that the traffic is traveling through the ISP’s MPLS network.
Head Office (Kolkata)
│
Customer Switch
│
Customer Router
│
PE Router
│
======== MPLS Network ========
│
PE Router
│
Customer Router
│
Customer Switch
│
Branch Office (Haldia)
Shared Services:
• File Server
• IP PBX
• CCTV
• ERP Application
• Database Server
Example Data Flow:
- An employee in Kolkata opens a file stored on the Haldia file server.
- The Ethernet frame reaches the ISP’s PE router.
- The ISP transports the frame through its MPLS network using a VPWS pseudowire.
- The destination PE router removes the MPLS labels.
- The frame is delivered to the Haldia file server.
- The server responds, and the return traffic follows the same VPWS path back to Kolkata.
Result: The company experiences a secure, private, point-to-point Layer 2 connection between the two offices, even though the traffic is carried over the ISP’s shared MPLS infrastructure.
Yes. VPWS uses several identifiers, but they are typically configured by the service provider, not by the customer. Unlike PPPoE, VPWS does not require a username and password.
1. Pseudowire ID (PW ID / VC ID):
The Pseudowire ID (PW ID) is the most important identifier in VPWS. It uniquely identifies the virtual circuit between the two Provider Edge (PE) routers. Both ends of the VPWS connection must use the same PW ID
2. VLAN ID (Optional):
If the VPWS service is delivered over Ethernet VLANs, the provider may assign a VLAN ID (for example, VLAN 100) to identify the customer’s traffic.
3. Service ID or Circuit ID:
Many service providers assign a Service ID or Circuit ID for service management, provisioning, billing,
Example Configuration
Site A (PE Router)
and troubleshooting. This identifier is mainly used by the ISP.
Remote PE IP : 10.10.10.2
PW ID : 100
MPLS Labels : Automatically Assigned
Site B (PE Router)
Remote PE IP : 10.10.10.1
PW ID : 100
MPLS Labels : Automatically Assigned
Both PE routers use PW ID 100, allowing them to establish the same VPWS connection.
Summary:
- VPWS does require identifiers, primarily a Pseudowire ID (PW ID / VC ID).
- The PW ID must match on both ends of the connection.
- Customers do not log in with a username or password.
- The service provider typically configures all required IDs as part of the VPWS service.
1. Dedicated Point-to-Point Connection
VPWS provides a private Layer 2 connection between two sites, making them appear as if they are connected by a dedicated Ethernet cable.
2. High Performance
Traffic is transported over an MPLS backbone, resulting in low latency, low jitter, and reliable performance for business-critical applications.
3. Secure Communication
Customer traffic is isolated from other customers using MPLS pseudowires, providing a secure and private connection.
4. Transparent Ethernet Service
VPWS transports Ethernet frames without modifying them, allowing customers to use their own VLANs, MAC addresses, and network protocols.
5. Customer Control
The customer manages IP addressing, routing, firewalls, VLANs, and network policies, while the service provider only transports Layer 2 traffic.
6. Supports Multiple Applications
It is suitable for file sharing, VoIP, CCTV, ERP systems, database replication, and disaster recovery.
7. Easy to Extend LAN
Organizations can extend their local network (LAN) between two geographically distant offices without changing their existing network design.
1. Only Point-to-Point
VPWS connects only two locations. If multiple branches need to communicate, separate VPWS circuits are required for each connection.
2. Higher Cost for Many Sites
As the number of sites increases, the number of required circuits also increases, making the solution more expensive than multipoint services like VPLS.
3. No Native Multipoint Connectivity
Unlike VPLS, VPWS cannot directly connect multiple branches in a single virtual LAN.
4. Service Provider Dependency
The customer depends on the ISP for MPLS infrastructure, provisioning, maintenance, and troubleshooting.
5. Limited Scalability
Managing many point-to-point connections becomes complex in large enterprise networks with numerous branch offices.
6. Requires MPLS Infrastructure
VPWS can only be delivered by service providers with an MPLS network, so it is not available everywhere.
7. No Built-in Layer 3 Services
VPWS operates at Layer 2 only. Routing between different IP networks must be handled by the customer’s own routers.
Example
- Good choice: A company with Head Office ↔ Branch Office that needs a fast, private Ethernet connection.
- Not ideal: A company with 20 branch offices that all need to communicate with each other. In that case, a multipoint solution such as VPLS or an MPLS Layer 3 VPN is often more practical.
What is VPLS (Virtual Private LAN Service)?
VPLS (Virtual Private LAN Service) is a Layer 2 VPN technology that allows multiple geographically separated sites to communicate as if they are connected to the same Ethernet LAN. It uses a service provider’s MPLS network to create a secure, private, and transparent Ethernet service between all connected locations.
Unlike VPWS, which connects only two sites, VPLS creates a multipoint-to-multipoint network, enabling every site to communicate directly with every other site.
How VPLS Works
Each customer site connects to the service provider’s Provider Edge (PE) router. The PE routers form a virtual Ethernet switch over the MPLS backbone. Ethernet frames received from one site are forwarded to the appropriate remote sites, making all locations appear to be on the same local network.
Real-World Example:
A company has offices in Kolkata, Haldia, Delhi, and Mumbai. Instead of purchasing separate VPWS links between every pair of offices, the company uses VPLS. All four offices become part of the same virtual Ethernet LAN, allowing employees to access shared file servers, IP phones, printers, CCTV systems, and business applications as if they were all in the same office.
In simple terms:
- VPWS = A private Ethernet cable connecting two locations.
- VPLS = A virtual Ethernet switch connecting many locations into the same LAN.
1. Multipoint Connectivity
VPLS allows multiple branch offices to communicate directly with each other over a single virtual Ethernet LAN. There is no need to create separate point-to-point links between every site.
2. LAN Extension
It extends the customer’s Ethernet LAN across geographically separated locations, making all sites appear to be on the same local network.
3. Simplified Network Design
Since all branches are part of one virtual LAN, network management is simpler and fewer WAN connections are required.
4. Transparent Layer 2 Service
VPLS transports Ethernet frames without changing them, allowing customers to use their own VLANs, MAC addresses, and network protocols.
5. Customer Control
Customers retain full control over IP addressing, routing, VLANs, and security policies, while the service provider only transports Layer 2 traffic.
6. Supports Business Applications
VPLS is suitable for file sharing, VoIP, IP PBX, CCTV, ERP systems, database access, and other applications requiring Layer 2 connectivity.
7. Cost-Effective for Multiple Sites
For organizations with many branch offices, VPLS is often more cost-effective than deploying numerous VPWS point-to-point circuits.
1. Broadcast Traffic
Because all sites share the same virtual LAN, broadcast, multicast, and unknown unicast traffic is forwarded across the network, increasing bandwidth usage.
2. More Complex
VPLS is more complex to design, configure, and troubleshoot than VPWS because multiple sites participate in the same Layer 2 domain.
3. Scalability Limitations
As more sites are added, MAC address tables and broadcast traffic grow, which can affect performance in very large networks.
4. Larger Failure Domain
A Layer 2 issue, such as a broadcast storm or switching loop at one site, can impact all sites connected to the VPLS network.
5. Requires MPLS Infrastructure
VPLS depends on an MPLS-enabled service provider, so it is only available where the provider supports the service.
6. Higher Service Cost
For small networks with only two locations, VPLS may cost more than a simple VPWS service.
Best Choice for VPLS:
A company has offices in Kolkata, Haldia, Delhi, and Mumbai. All offices need to share the same file server, IP PBX, CCTV, printers, and ERP system. VPLS allows every office to communicate directly over a single virtual LAN.
Not Ideal for VPLS:
A company has only two offices (Head Office and Branch Office). In this case, VPWS is usually a simpler and more cost-effective solution because only a single point-to-point connection is needed.
What is H-VPLS (Hierarchical Virtual Private LAN Service)?
H-VPLS (Hierarchical Virtual Private LAN Service) is an enhanced version of VPLS that improves scalability, performance, and manageability. It introduces a hierarchical architecture, where User-facing Provider Edge (U-PE) devices aggregate customer traffic and connect to Network-facing Provider Edge (N-PE) devices in the MPLS core.
In a standard VPLS network, every Provider Edge (PE) router must establish a full-mesh pseudowire with every other PE router. As the network grows and more PE routers are added, the number of pseudowire connections increases significantly, making the network more complex to configure, manage, and scale. H-VPLS (Hierarchical VPLS) was introduced to solve this scalability problem by using a hierarchical architecture with User Provider Edge (U-PE) and Network Provider Edge (N-PE) routers, reducing the number of full-mesh connections required in the MPLS core.
Step 1: Customer Connects to U-PE
Each customer site connects to the nearest User Provider Edge (U-PE) router. The U-PE acts as the customer’s access device and receives Ethernet frames from the customer’s LAN.
Step 2: Traffic Aggregation at U-PE
The U-PE collects and aggregates traffic from one or more customer sites. Instead of every customer connecting directly to the MPLS core, the U-PE forwards the aggregated traffic to an N-PE (Network Provider Edge) router.
Step 3: Transport Across the MPLS Core
The N-PE routers are connected through the service provider’s MPLS backbone. They exchange customer traffic using VPLS pseudowires, allowing data to travel securely between different cities or locations.
Step 4: Delivery to the Remote U-PE
When the traffic reaches the destination N-PE, it is forwarded to the appropriate U-PE. The U-PE then removes the encapsulation if necessary and prepares the original Ethernet frame for delivery.
Step 5: Traffic Reaches the Destination Site
Finally, the destination U-PE forwards the Ethernet frame to the customer’s switch or router. The destination site receives the data as if it came from the same local Ethernet network.
Result
By introducing U-PE and N-PE routers, H-VPLS reduces the number of full-mesh connections required in the MPLS core. This makes the network more scalable, easier to manage, and capable of supporting thousands of customer sites while maintaining efficient Layer 2 connectivity.
Advantages:
1. Highly Scalable
Supports a much larger number of customers and sites than traditional VPLS.
2. Reduced Core Complexity
Core N-PE routers maintain fewer customer MAC addresses because aggregation is performed by U-PE routers.
3. Easier Expansion
New customer sites can be added by connecting them to a nearby U-PE without changing the entire VPLS mesh.
4. Better Performance
Traffic aggregation reduces processing requirements in the MPLS core.
5. Lower Operational Cost
Reduces the number of pseudowires and simplifies management in large ISP networks.
Disadvantages:
1. More Complex Architecture
H-VPLS introduces additional devices (U-PE and N-PE), making the design more complex than standard VPLS.
2. Higher Initial Cost
Requires extra routers and more advanced network planning.
3. More Configuration
Deployment and troubleshooting are more involved than VPWS or standard VPLS.
Real-World Example:
An ISP provides Ethernet VPN services to 500 companies across multiple cities. Instead of connecting every customer directly to the MPLS core, the ISP installs U-PE routers in each city. Customer traffic is first aggregated at the U-PE, then sent to the N-PE routers in the MPLS backbone.
This design reduces the number of core connections, improves scalability, and makes it easier to add new customers without redesigning the entire network.
In simple terms:
- VPWS = One virtual Ethernet cable between 2 sites.
- VPLS = One virtual Ethernet switch connecting multiple sites.
- H-VPLS = A scalable version of VPLS that uses hierarchy (U-PE and N-PE) to efficiently support many customers and many sites.
Layer 2 VPN (L2VPN) Protocols
Layer 2 VPN (L2VPN) protocols/technologies are used to extend Layer-2 (Ethernet) connectivity across different locations so multiple sites behave like the same LAN. These solutions carry Ethernet frames (MAC-based traffic) across a provider network, most commonly using MPLS or tunneling methods.
L2VPN Protocols / Technologies:
VPWS (Virtual Private Wire Service) is a point-to-point L2VPN technology that connects two sites with a dedicated virtual link. It works like a leased line and uses MPLS pseudowires to transport Ethernet frames. It is simple and ideal for connecting two locations such as a head office and a branch.
VPLS (Virtual Private LAN Service) is a multipoint-to-multipoint L2VPN that connects multiple sites into a single virtual LAN. It behaves like a distributed switch, performing MAC address learning and forwarding traffic between all connected locations. It is widely used for enterprises with many branches.
EVPN (Ethernet VPN) is an advanced and modern L2VPN technology that improves scalability and efficiency. It uses a control-plane protocol (BGP) for MAC address learning instead of flooding, reducing unnecessary traffic and improving performance. It can support both Layer-2 and Layer-3 services and is commonly used in data centers.
EoMPLS (Ethernet over MPLS) is a method of transporting Ethernet frames over MPLS networks. It is the foundation for services like VPWS and works by encapsulating Ethernet frames into MPLS labels.
Pseudowire (PW) is a virtual Layer-2 connection used in MPLS networks to emulate a physical link. It carries different types of Layer-2 traffic such as Ethernet, Frame Relay, or ATM between two endpoints.
L2TP (Layer 2 Tunneling Protocol) is used to tunnel Layer-2 traffic over IP networks. It does not provide encryption by itself and is usually combined with IPsec for secure communication, mainly in remote access VPNs.
GRE (Generic Routing Encapsulation) is a tunneling protocol that can carry Layer-2 and Layer-3 traffic across networks. It does not provide encryption and is often combined with IPsec for security.
Frame Relay is an older Layer-2 WAN technology that provided virtual circuits between sites. It has mostly been replaced by MPLS-based VPNs in modern networks.
ATM (Asynchronous Transfer Mode) is another legacy Layer-2 technology that used fixed-size cells for data transmission. It is now largely obsolete but was historically used for WAN connectivity.
Short Summary
Modern L2VPN technologies include VPWS, VPLS, and EVPN (MPLS-based). Tunneling protocols like L2TP and GRE can also carry Layer-2 traffic, while older technologies like Frame Relay and ATM are now outdated.
Where L2VPN is Used?
L2VPN Slide
