8.5 Multiple Forwarding Tables

Constrained distribution of routing information is clearly necessary, but not sufficient, to control connectivity. This is because a given PE router may have sites from different VPNs attached to it. If that PE router has just one forwarding table, then this table would have to contain all the routes for all these VPNs, therefore preventing per-VPN segregation of routing information. It would thus be possible for packets to be forwarded from one VPN to another, which is clearly not acceptable.

A solution to this problem is to require each PE router to maintain not one, but multiple forwarding tables. It is a combination of multiple forwarding tables and route filtering that allows per-VPN segregation of routing information and therefore control over intersite connectivity on a per-VPN basis.

In an extreme case, each site attached to a PE router would have its own forwarding table. That would happen, for example, when each site connected to a given PE is in its own VPN. However, when a PE router has several sites with common VPN membership (e.g., a set of sites that are in the same VPN), all such sites could share the same forwarding table.

A PE router uses its multiple forwarding tables to handle packets it receives from its directly attached sites. In the most simple case each customer port on the PE router is associated at provisioning time with a particular forwarding table. At forwarding time, the incoming port on the PE router determines which...