8.6 VPN-IP Addresses

So far we have described the mechanisms that allow us to control intersite connectivity on a per-VPN basis. But these mechanisms use BGP, and BGP, in turn, makes certain assumptions about IP addresses. Specifically, BGP assumes that IP addresses are unique. That assumption is clearly incorrect in the VPN service provider environment, where the same block of IP addresses (e.g., private addresses as defined in RFC 1918) could be simultaneously used by multiple VPN customers. So, in order to use BGP-based mechanisms, we need to figure out how to use BGP in an environment where IP addresses are no longer unique. An obvious solution to this problem would be to turn nonunique addresses into unique addresses. How? By creating a new type of address, which we call the VPN-IP address, and making sure that these addresses are unique.

By definition, a VPN-IP address is constructed by concatenating a fixed-length field, called a Route Distinguisher, with a plain IP address. What makes such addresses unique is the Route Distinguisher. A Route Distinguisher is structured in such a way as to allow each VPN service provider to create unique Route Distinguishers on its own, without the risk of the same Route Distinguisher being assigned by some other provider. By definition, a Route Distinguisher consists of three fields: Type (2 octets), Autonomous System Number (2 octets), and Assigned Number (4 octets). The Autonomous System Number field contains the Autonomous System Number of the VPN service provider. The assignment of the...