Have I desiged correctly my MPLS network?

Question

Here the diagram:

I've been assigned to make a network where 3 headquearters are communicated securely, they must have internet connection and all of them must be able to access to the common servers located in one headquarter.

I've re-done a simply design of my original design so that you can understand easier my idea. I've looked up pretty much about these questions but i don't know if i'm sure about it, so here are my questions:

1. Is it possible to have internet internet connection through MPLS network? I've read that it's possible, but only if am ISP offers this service. I've looked up pretty much all about this, and I found almost nothing. So, if it isn't possible, can I order a second leased line for each headquarters, so that they have MPLS for communicating with other headquarters, and the second line for having an Internet connection?
2. In the diagram, the MPLS router, LER, is the distribution layer router that will route the VLANs. Am I right?
3. For the VLANs, I need VLAN 1 to watch VLANs 2 and 3, but VLAN 2 can't see any other VLAN and VLAN 3 is the same as VLAN 2. My guess is VLAN 1 will have 1 port in trunk mode, and the rest in untagged mode. For VLANs 2 and 3, one port in tagged mode for the VLAN 1 and the rest in untagged mode. Am I right?
4. Are the firewalls correctly placed?
5. Are "Common servers" correctly placed so that they can be accessed from other headquarters through MPLS network?
6. I've looked up info about MPLS and IPsec, but it doesn't appear a lot of info, my question is simple, is it really possible to put IPsec over MPLS?

Every answer is very appreciated :) Thanks

Answer 1

This is quite complex to answer in simple set of questions, but let's try:

1. Yes, it's possible to have internet connectivity by means of MPLS cloud, but it either means you need to self-deploy MPLS L3 VPN for yourself, or your MPLS cloud will be provided by upstream ISPs.

2. Usually, edge routers - the ones running MPLS, are distinct from L3 switches/routers in aggregation layer, specifically, that You also add firewalls to the picture. It's doable, but usually it's better to route at the switching layer not aggregation/edge layer.

3. You're trying to ask very specific configuration question, not specifically technology one. It's possible to separate VLANs by means of various techniques - splitting the access ports to access and trunk is very weak and unsecure method. Please take a look at Private VLANs as one way, the other would be the firewalling segment to take responsibilities of filtering traffic between hosts or networks.

4. Again, hard question. In this specific topology yes, they can be placed this way. Depending on the performance required or features required, they may however be required to be positioned in a different way.

5. "Common servers" availability will be governed by configuration, not topology. We have too little data right now to decide if that's feasible or not. MPLS can be used to transport traffic of different protocols, including IPv4 and IPv6.

6. Yes, it's possible to use IPsec over MPLS. IPsec is IP based, MPLS is transport technology for IP - be it IPv4 or IPv6.

Answer 2

you create a VRF for internet on all the PE ROUTERS direct the traffic towards one particular PE. then the PE router can then be directed to an internet GW router. many vrf can then be created for different services or customers. VLAN be required to segment traffics