15

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no one evesdrop on the traffic?

  • To clarify, when I said VPN I was alluding to the private network being encrypted and authenticated as well. Thank you all for clarifying that. – Yon Oct 29 '13 at 10:08
  • Most likely party to sniff you is your operator, illegally for some employee personal gain or by court mandate. Also any WAN connection goes to numerous places which are completely unguarded and easily available for general public for physical MITM. Having said that, most companies actually have 0 information worth stealing and security should not cost more than realized risk, usually you'd only want as much security as contractually/legally required. – ytti Oct 31 '13 at 7:33
20

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question.

Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs.

Is MPLS secure?

Ultimately the question of security comes down to one unasked question, which is "Who do you trust with your business-critical data?"

  • If the answer is "nobody", then you must overlay your data through an encrypted VPN
  • If you trust your MPLS VPN provider, then there is no need to encrypt your data

Why not run a VPN over MPLS too?

By most common usage, MPLS is a VPN, but it's an unencrypted VPN. I assume you mean an encrypted VPN, such as PPTP, IPSec, or SSL VPN when you mention "VPN". However, if you need strong encryption, data integrity, or Authentication inside the VPN, rfc4381 MPLS VPN Security, Section 5.2 recommends encrypting inside MPLS VPN.

However, encrypted VPNs are not without problems themselves; they generally suffer from:

  • Additional expenses for the infrastructure
  • Throughput / scalability limitations (due to complexities in HW encryption)
  • Additional expenses for personnel / training
  • Increased Mean Time to Repair when debugging problems through the encrypted VPN
  • Increased management overhead (i.e. maintaining PKI)
  • Technical difficulties, such as lower TCP MSS, and often problems with PMTUD
  • Less efficient links, because you have the encapsulation overhead of the encrypted VPN (which is already inside the overhead from the MPLS VPN)

Can no one evesdrop on the traffic?

Yes, evesdropping is quite possible, regardless of whether you think you can trust your provider. I will quote from rfc4381 MPLS VPN Security, Section 7:

As far as attacks from within the MPLS core are concerned, all [unencrypted] VPN classes (BGP/MPLS, FR, ATM) have the same problem: If an attacker can install a sniffer, he can read information in all VPNs, and if the attacker has access to the core devices, he can execute a large number of attacks, from packet spoofing to introducing new peer routers. There are a number of precautionary measures outlined above that a service provider can use to tighten security of the core, but the security of the BGP/MPLS IP VPN architecture depends on the security of the service provider. If the service provider is not trusted, the only way to fully secure a VPN against attacks from the "inside" of the VPN service is to run IPsec on top, from the CE devices or beyond.


I'll mention a final point, which is just a practical question. One might argue that there is no point in using an MPLS VPN, if you're going to use an encrypted VPN over basic internet service; I would disagree with that notion. The advantages of an encrypted VPN through MPLS VPN are working with one provider:

  • While you troubleshoot issues (end to end)
  • To guarantee quality of service
  • To provision services
  • Thank you. All answers helped but this was by far the one that helped the most and provided answers to followup questions I was about to ask. – Yon Oct 29 '13 at 10:09
9

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so it's a private network but not authenticated and encrypted like IPSEC. If someone has physical access to your network they could sniff packets.

With the regular VPN I assume you mean IPSEC. IPSEC is authenticated and encrypted depending on which mode you are running. So if someone gets hold of the packets they should still not be able to read them.

  • 3
    How can MPLSVPN be "secure" with "no encryption"? If the packets aren't being scrambled, then anyone along the path can peek at the data. Just like any physical connection. – Ricky Beam Oct 28 '13 at 23:29
  • Good point. What I meant to say was that it's more secure than a regular Internet connection. – Daniel Dib Oct 29 '13 at 6:24
  • I think even that is a misnomer, MPLS labels can be alikened to VLANs, they offer no security at all. They are about logical seperate of traffic flows. Anyone can push-pop-swap MPLS labels just they can VLAN tags and hop between MPLS L2/L3 VPNs. – jwbensley Feb 5 '16 at 14:48
6

"VPN" in the most common definition doesn't necessarily imply security. The same goes for MPLS, and the two terms are often combined (see "MPLS VPN") because certain aspects of MPLS can provide similar functionality to a traditional VPN (AToMPLS, EoMPLS, TDMoMPLS, etc).

It's entirely possible to run MPLS over an encrypted VPN tunnel, and to run encrypted VPN traffic over an MPLS circuit. MPLS itself is not "secure" but again it's primarily used for transport services, where the underlying protocols can be secure.

Typically the scenario you describe could result from an organization wanting diverse connectivity from two separate providers, and one of those providers does not offer MPLS services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.