Re: [vnrg] Some definitions and way forward

[Andreas Fischer <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Roland,

On 04.08.2011 11:53, Roland Bless wrote:
> Hi Andreas,
> 
> On 04.08.2011 10:57, Andreas Fischer wrote:
>> Aren't VPNs just one kind of link virtualization? VPNs are
>> basically tunnels with added encryption, no? Tunnels, on the other
>> hand, just create a "virtual link" between two arbitrary nodes in a
>> network.
> 
> Yes, but a tunnel is IMHO an overlay technique: it is created between
> the end-points of the underlying layer. Consider an L3-VPN,
> consisting of networks N1 and N2 and a "virtual link" between them.
> 
> /----\                        /----\ |  N1  |--R1==============R4--|
> | |      |  |                |  |  N2  | \----/   +-----R2----R3---+
> \----/
> 
> N1 and N2 are networks that are connected via some provider network. 
> R1 and R4 are their access routers. The tunnel is established
> between the endpoints R1 and R4, i.e., they are source/sink of the
> outer header of the tunnel packets and the tunnel is terminated
> there. R2 and R3 are not and do not have to be aware of the virtual
> link in this case. A non-overlay solution would require awareness in
> R2/R3, e.g., creating and LSP.

Ok, I think I had a slightly different notion of overlay here. If an
overlay is characterized by being transparent to the substrate (except
for the end-points, of course), then I agree with your point.

>> As such, I would also disagree to consider them as kind of an
>> overlay network, as a) They don't build a network, only a link (the
>> 'N' in 'VPN' is misleading, IMHO)
> 
> Hm, but there are other nodes connected by that tunnel, e.g., N1 and
> N2 may have their own routers etc. Especially, they have their own
> addressing scheme and routing inside their VPN.

Depends. If you consider the conglomerate of N1, R1, R4, and N2 as being
the VPN, then there is actually a network. However, then the 'V' and the
'P' are misleading. This network is - for a large part - not virtual,
but real. Moreover, it is not necessarily private - R1 may possibly only
route certain traffic via the tunnel (e.g. only traffic destined for
N2), whereas the rest may be open to the Internet.

Regarding typical implementations (IPSec, OpenVPN, SSH, ...) I would
consider the VPN in your picture consisting of just the tunnel.
Therefore my argument, that it isn't actually a network, just a link
(apologies to Michael - I did not consider multipoint-to-multipoint VPNs
here).

Regards,
Andreas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFOOnixAjz9S4YPAw8RAgXJAJ9fvf/NM/Cwz/c27u6clGPcQmCgVgCeMLwE
tJ3mMZyvem60hZeR0tkADZ0=
=OOYA
-----END PGP SIGNATURE-----