Here the diagram:

enter image description here

I've been assigned to make a network where 3 headquearters are communicated securely, they must have internet connection and all of them must be able to access to the common servers located in one headquarter.

I've re-done a simply design of my original design so that you can understand easier my idea. I've looked up pretty much about these questions but i don't know if i'm sure about it, so here are my questions:

  1. Is it possible to have internet internet connection through MPLS network? I've read that it's possible, but only if am ISP offers this service. I've looked up pretty much all about this, and I found almost nothing. So, if it isn't possible, can I order a second leased line for each headquarters, so that they have MPLS for communicating with other headquarters, and the second line for having an Internet connection?
  2. In the diagram, the MPLS router, LER, is the distribution layer router that will route the VLANs. Am I right?
  3. For the VLANs, I need VLAN 1 to watch VLANs 2 and 3, but VLAN 2 can't see any other VLAN and VLAN 3 is the same as VLAN 2. My guess is VLAN 1 will have 1 port in trunk mode, and the rest in untagged mode. For VLANs 2 and 3, one port in tagged mode for the VLAN 1 and the rest in untagged mode. Am I right?
  4. Are the firewalls correctly placed?
  5. Are "Common servers" correctly placed so that they can be accessed from other headquarters through MPLS network?
  6. I've looked up info about MPLS and IPsec, but it doesn't appear a lot of info, my question is simple, is it really possible to put IPsec over MPLS?

Every answer is very appreciated :) Thanks

  • Are you creating the MPLS cloud, or are you using a provider MPLS cloud? The LER is typically in the provider network, and you would have a CE router.
    – Ron Maupin
    Commented May 24, 2016 at 14:21
  • I use a provider MPLS cloud, so CE router would route VLANs right?. Thanks for the answer
    – Sergio
    Commented May 24, 2016 at 17:01

2 Answers 2


This is quite complex to answer in simple set of questions, but let's try:

  1. Yes, it's possible to have internet connectivity by means of MPLS cloud, but it either means you need to self-deploy MPLS L3 VPN for yourself, or your MPLS cloud will be provided by upstream ISPs.

  2. Usually, edge routers - the ones running MPLS, are distinct from L3 switches/routers in aggregation layer, specifically, that You also add firewalls to the picture. It's doable, but usually it's better to route at the switching layer not aggregation/edge layer.

  3. You're trying to ask very specific configuration question, not specifically technology one. It's possible to separate VLANs by means of various techniques - splitting the access ports to access and trunk is very weak and unsecure method. Please take a look at Private VLANs as one way, the other would be the firewalling segment to take responsibilities of filtering traffic between hosts or networks.

  4. Again, hard question. In this specific topology yes, they can be placed this way. Depending on the performance required or features required, they may however be required to be positioned in a different way.

  5. "Common servers" availability will be governed by configuration, not topology. We have too little data right now to decide if that's feasible or not. MPLS can be used to transport traffic of different protocols, including IPv4 and IPv6.

  6. Yes, it's possible to use IPsec over MPLS. IPsec is IP based, MPLS is transport technology for IP - be it IPv4 or IPv6.


you create a VRF for internet on all the PE ROUTERS direct the traffic towards one particular PE. then the PE router can then be directed to an internet GW router. many vrf can then be created for different services or customers. VLAN be required to segment traffics

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.