MPLS vs Encrypted VPNs - traffic security?

Question

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no one evesdrop on the traffic?

Answer 1

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question.

Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs.

Is MPLS secure?

Ultimately the question of security comes down to one unasked question, which is "Who do you trust with your business-critical data?"

• If the answer is "nobody", then you must overlay your data through an encrypted VPN
• If you trust your MPLS VPN provider, then there is no need to encrypt your data

Why not run a VPN over MPLS too?

By most common usage, MPLS is a VPN, but it's an unencrypted VPN. I assume you mean an encrypted VPN, such as PPTP, IPSec, or SSL VPN when you mention "VPN". However, if you need strong encryption, data integrity, or Authentication inside the VPN, rfc4381 MPLS VPN Security, Section 5.2 recommends encrypting inside MPLS VPN.

However, encrypted VPNs are not without problems themselves; they generally suffer from:

• Additional expenses for the infrastructure
• Throughput / scalability limitations (due to complexities in HW encryption)
• Additional expenses for personnel / training
• Increased Mean Time to Repair when debugging problems through the encrypted VPN
• Increased management overhead (i.e. maintaining PKI)
• Technical difficulties, such as lower TCP MSS, and often problems with PMTUD
• Less efficient links, because you have the encapsulation overhead of the encrypted VPN (which is already inside the overhead from the MPLS VPN)

Can no one evesdrop on the traffic?

Yes, evesdropping is quite possible, regardless of whether you think you can trust your provider. I will quote from rfc4381 MPLS VPN Security, Section 7:

As far as attacks from within the MPLS core are concerned, all [unencrypted] VPN classes (BGP/MPLS, FR, ATM) have the same problem: If an attacker can install a sniffer, he can read information in all VPNs, and if the attacker has access to the core devices, he can execute a large number of attacks, from packet spoofing to introducing new peer routers. There are a number of precautionary measures outlined above that a service provider can use to tighten security of the core, but the security of the BGP/MPLS IP VPN architecture depends on the security of the service provider. If the service provider is not trusted, the only way to fully secure a VPN against attacks from the "inside" of the VPN service is to run IPsec on top, from the CE devices or beyond.

---

I'll mention a final point, which is just a practical question. One might argue that there is no point in using an MPLS VPN, if you're going to use an encrypted VPN over basic internet service; I would disagree with that notion. The advantages of an encrypted VPN through MPLS VPN are working with one provider:

• While you troubleshoot issues (end to end)
• To guarantee quality of service
• To provision services

Answer 2

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so it's a private network but not authenticated and encrypted like IPSEC. If someone has physical access to your network they could sniff packets.

With the regular VPN I assume you mean IPSEC. IPSEC is authenticated and encrypted depending on which mode you are running. So if someone gets hold of the packets they should still not be able to read them.

Answer 3

"VPN" in the most common definition doesn't necessarily imply security. The same goes for MPLS, and the two terms are often combined (see "MPLS VPN") because certain aspects of MPLS can provide similar functionality to a traditional VPN (AToMPLS, EoMPLS, TDMoMPLS, etc).

It's entirely possible to run MPLS over an encrypted VPN tunnel, and to run encrypted VPN traffic over an MPLS circuit. MPLS itself is not "secure" but again it's primarily used for transport services, where the underlying protocols can be secure.

Typically the scenario you describe could result from an organization wanting diverse connectivity from two separate providers, and one of those providers does not offer MPLS services.