Home / Vpn

Understanding multi-protocol label switching technology in VPN - 2

Figure 3.1


INTRODUCTION

Along with the trend of globalization, the expansion of international cooperation and exchanges is increasing, business cooperation is not only limited to a district, a province, a country but also expands to the whole world. A company can have branches, business partners in many countries and there is always a need to exchange information with each other. To ensure the confidentiality of the information exchanged, according to the traditional way of communication, people use private channels, but the disadvantage is that it is expensive, causing waste of resources when the data exchanged is not much and not regular. Therefore, people have researched other technologies that can still meet the need for information exchange but are less expensive and more convenient, that is the virtual private network solution.

VPN is defined as a network connecting customer sites that ensures security on a common network infrastructure with access control policies and security assurance like a private network. There have been many VPN implementation options such as: X.25, ATM, Framer Relay, ... However, when implementing these solutions, the cost of purchasing equipment, operating, maintaining, and managing is very high and must be borne by the business while service providers only ensure a private channel for data and are not sure about the security of this private channel.

Organizations and businesses using IP VPN services will save a lot of costs in connecting branch offices together, remotely accessing the internal network, and making VoIP calls. Currently, ADSL has become popular and low cost, so implementing IP VPN becomes very simple and effective because it takes advantage of high-speed Internet connection.

The purpose of this project is to understand the fundamental issues involved in implementing IP-VPN and MPLS – VPN. Evaluate these two technologies.

The project layout includes 3 chapters:

Chapter 1: TCP/IP protocol suite and virtual private network technology on the Internet IP-

VPN


Chapter 2: IPSec Protocol for IP-VPN

Chapter 3: Multiprotocol Label Switching in VPN

Despite receiving a lot of help from her instructor and her efforts,

but the project is not without mistakes so I hope to receive more contributions and opinions from teachers, friends and people interested in this field.


CHAPTER 1: TCP/IP PROTOCOL SUITE AND

VIRTUAL PRIVATE NETWORK TECHNOLOGY ON INTERNET IP-VPN

1.1 Internet concept

In June 1968, an agency of the US Department of Defense, the Advanced Research Projects Agency (ARPA), built a project to connect major research centers across the federal government with the goal of sharing and exchanging information resources, marking the birth of ARPANET - the predecessor of today's Internet. Initially, the communication protocol used in the ARPANET network was NCP (Network Control Protocol), but was later replaced by the TCP/IP protocol suite (Transfer Control Protocol/Internet Protocol) . Protocol suiteTCP/IP is a set of networking standards that specify how computerscommunication with each other, as well as conventions for interconnection and routing for

network.

Previously, people defined “Internet as the network of all networks using

IP protocol”. But today, that is no longer accurate because many networks have

different architectures but thanks to protocol bridges can still connect to each other

Internet and still be able to use full range of Internet services. The Internet is not just a

A collection of interconnected networks, Internetworking also means networks that are interconnected on the basis of mutually agreed conventions that allow computers to communicate with each other, even if the communication path will pass through networks to which they are not directly connected. Thus, Internet technology hides the details

network hardware, and allows computer systems to exchange information independently of each other.

their physical network links.

TCP/IP has the following features that have made it popular:

- Independent of network architecture: TCP/IP can be used in Ethernet, Token Ring architectures, in local area networks (LAN) as well as wide area networks (WAN).

- Open protocol standard: because TCP/IP can be implemented on any hardware or operating system. Therefore, TCP/IP is an ideal protocol set to combine different hardware and software.

- Global addressing scheme: each computer on the TCP/IP network has a unique address. Each data packet sent on the TCP/IP network has a Header that includes the address of the destination computer as well as the address of the source computer.


- Client - Server Framework: TCP/IP is the framework for powerful client - server applications that operate on local and wide area networks.

1.2 TCP/IP protocol suite layered model

The TCP/IP protocol suite is a combination of different protocols at different layers, not just TCP and IP protocols. Each layer has its own function. The TCP/IP model is organized into 4 layers (from the application side down to the physical layer) as follows:

Figure 1.1: TCP/IP protocol suite layered model

Application layer: Controls the details of each specific application. It corresponds to the application layers, presented in the OSI model. It includes high-level protocols, encryption, conversation control ... Application services such as SMTP, FTP, TFTP ... Currently, there are hundreds or even thousands of protocols in this layer. Application programs communicate with protocols in the transport layer to transmit and receive data. Application programs transmit data in the form of requests to the transport layer for processing before transferring it to the Internet layer to find a route.

Transport layer: Responsible for message transmission(message) from one process (a running program) to another. The transport layer ensures that the information arrives at the destination error-free and in order. It has two very different protocols: the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

Internet layer: Provides hardware-independent addressing functionality that allows data to move between subnets with different physical architectures. This layer controls packet forwarding across the network, packet routing. (Supports inter-IP protocol - the concept of internetwork refers to a larger network: a network that connects networks


LAN). The protocols of this layer are IP, ICMP, ARP, RARP.

Network Access Network: Provides interface to the physical network. (Usually this layer includes device drivers in the operating system and corresponding network interface cards in the computer. This layer performs the task of controlling all hardware details or performing physical interface with the cable (or with any medium used)). Provides error control of data distributed over the physical network. This layer does not define any specific protocol, it supports all standard and proprietary protocols. For example: Ethernet, Token Ring, FDDI, X.25, wireless, Async, ATM, SNA…

1.3 Protocols in the TCP/IP model

1.3.1 Internet Protocol

1.3.1.1 General introduction

The purpose of the Internet protocol is to transfer information (data) from source to destination. IP uses datagrams. Each datagram contains a destination address and IP uses this information to route the packet to its destination via the appropriate path. Packets from the same pair of users use different information paths, routing is separate for each packet. The IP protocol does not maintain state, after a datagram is delivered the sender no longer stores any information about it, so there is no way to detect lost packets and can lead to duplicated and out-of-order packets.

1.3.1.2. IPv4 structure

Information received from the transport layer is added to the IP header. This header is 20 to 60 bytes long and travels along the path depending on the optional functions used. The structure of an IPv4 packet is shown in Figure 1.2.

00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31


version

hdr length

Type of service

Total length (bytes)

Identification

Flags

Fragment offset

Time - to - live

Protocol

Header checksum

Source IP address

Destination IP address


Options and padding


Data

Maybe you are interested!


Figure 1.2: IPv4 packet structure

Explanation of the fields:


Version: indicates the version of the IP protocol used to create datagrams, used for the sender, receiver, and routers to agree on the data schema format. Here the version is IPv4.

IP header length: provides information about the length of the datagram header measured in 32-bit words.

Type of service: the 8-bit service type field consists of two parts, the priority field and the service type. The 3-bit priority field is used to assign a priority level to the datagram, providing a mechanism for controlling packets over the network. The remaining bits are used to determine the type of datagram traffic as it travels over the network, such as throughput, delay, and reliability. However, the Internet itself does not guarantee quality of service, so this field is only a requirement, not a requirement for routers.

Total length: this field consists of 16 bits, it is used to determine the length of the entire IP datagram.

Identification: 16-bit identification field. This field is used by the host to detect and group fragmented packets. Routers will fragment datagrams if the packet's maximum transmission unit (MTU) is larger than the MTU of the transmission medium.

Flags: contains 3 bits used for segmentation control, the first bit indicates to the routers to allow or not allow packet segmentation, the 2 low value bits are used for segmentation control, combined with the identification field to identify the packet received after the segmentation process.

Fragment offset: the network information about the number of times a packet is fragmented, the size of the packet depends on the underlying transmission network, that is, the packet length cannot exceed the MTU of the transmission medium.

Time - to - live: is used to prevent packets from looping on the network. It acts as a countdown timer, preventing packets from taking too long on the network. Any packet with a time to live of 0 will be discarded by the router and an error message will be sent to the station that sent the packet.

Protocol: This field is used to identify the next higher layer protocol that is using the IP service in numerical form.

Header checksum: the header checksum field is 16 bits long, calculated


calculated in all fields of the IPv4 header. When a packet passes through routers, the fields in the header may change, so this field needs to be recalculated and updated to ensure the reliability of the routing information.

Source Address - Destination Address: used by routers and gateways to route data units, always accompanying packets from source to destination.

Option and Padding: variable length, used to add selection and filling information to ensure data starts within 32 bits.

1.3.1.3. IP fragmentation and data consolidation

The IP protocol must always have algorithms for dividing and merging data when implemented. Because each datagram is specified with a maximum allowable frame size on a point-to-point connection, called the MTU. When passing through different networks with different MTUs, the packet will be divided according to the MTU value of that network. Determining the MTU of a network depends on the characteristics of the network so that the packet is transmitted at the highest speed.

During the journey from source to destination, a datagram may traverse multiple networks. Each router unpacks the IP datagram from the data frame it receives, processes it, and then encapsulates it in another data frame. The resulting datagrams are numbered for later reassembly. The format and size of the received data frame depend on the protocol of the physical network the data frame travels over. If IP needs to transmit a datagram larger than the MTU, it sends the datagram in fragments, which are reassembled at the receiving end to return to the original state.

When fragmented, most fields are repeated, with only a few changes, and each fragment is further fragmented if it encounters a network with an MTU smaller than its size. Only the destination host has the ability to reassemble the fragments. Since each fragment is processed independently, it can traverse many different networks and nodes to reach its destination.

1.3.1.4. IP Addressing and Routing

Address:Each station in the network is identified by a unique number called an IP address. IP addresses are used in the network layer to route packets through the network. Due to the different organization and size of subnets in the internetwork, IP addresses are divided into classes A, B, C, D, E.


Routing in the Internet:Routing in a packet-switched network refers to the process of selecting a path to send a data packet through the system. A router is a component that performs the routing function. Routing creates a virtual network consisting of multiple physical networks that provide packet delivery services in a connectionless manner. There are many different protocols and software used for routing. The selection of a channel for a packet is based on two criteria: the state of the nodes and links or the distance to the destination (the length or number of hops on the path). Once the distance criterion is selected, other parameters such as: delay, bandwidth or packet loss probability ... are taken into account when selecting a route.

1.3.1.5. IPv6 packet structure

The world is facing a shortage of IP addresses for network devices, the 32-bit address length is not enough to meet the explosion of the network. In addition, IPv4 is an old protocol, not meeting the new requirements of security, flexibility in routing and traffic support. The IPv6 Forum was started in July 1999 by 50 leading Internet service providers with the aim of developing the IPv6 protocol, which is designed to include functions and formats that are more advanced than IPv4 to address the problem of improving the quality and security of the Internet. IPv6 is especially important as mobile computing devices continue to participate in the Internet in the future.

Due to the changing nature of the Internet and commercial networks, the IP internetworking protocol has become obsolete. Previously, the Internet and most TCP networks provided support for relatively simple distributed applications such as file transfer, mail, and remote access TELNET. However, today, the Internet has increasingly become a medium and application-rich environment, led by the World Wide Web (www) service. All of these developments have far surpassed the ability of IP to meet the functions and services. An internetworking environment needs to support real-time traffic, flexible congestion control schemes, and security features that IPv4 currently does not fully meet. Figure 1.3 illustrates the IPv6 packet structure.

Comment


Agree Privacy Policy *