1

A VPN results, when two physically separate networks become virtually one bigger network.

But Frame Relay, ATM and MPLS don't do that, they just connect two network, but they don't unify them.

So why are those technologies called "Layer-2 VPN"? When they don't really represent a VPN?

Is it because they don't represent a real "bigger" network (as this would be Layer-3 as I described it) but just unify them on Layer-2?

Improve this question
6
  • "A VPN results, when two physically separate networks become virtually one bigger network." Can you quote a source for that? That is a rather strange definition of a VPN - if not entirely false. To my understanding, and the way I've been building VPNs of different flavours (MPLS-VPN, IPSec, SSL/RemoteAccess) , a VPN results when the opposite of that statement occurs: a VPN is a closed-off/restricted subset of a larger network.
    – Marc 'netztier' Luethi
    Jun 14, 2018 at 11:20
  • But what does the name "virtual private network" mean then, if not a virtual private network? :P When setting up a site-to-site VPN (with for instance IPsec), two networks normally form one big unit (on Layer-3), as I understand it. And I have no source for that, as it was my understanding of what VPNs are for. (Of course you are allowed to correct me as I am still new with this topic :D)
    – watchme
    Jun 14, 2018 at 11:24
  • (continued) So, a customer's service on the carrier's MPLS network (as L3-VPN with VRFs, or as Ethernet-over-MPLS L2-Links, or as VPLS), as PVCs or SVCs on ATM or Frame Relay Infrastructure, or even as set of IKE/IPSec Tunnels over the Internet, these are closed-off/restricted subsets on a larger underlying network: VPNs.
    – Marc 'netztier' Luethi
    Jun 14, 2018 at 11:26
  • 2
    A VPN is a tunnel. Basically, a logical point-to-point link, usually encrypted.
    – Ron Maupin ♦
    Jun 14, 2018 at 11:30
  • Looking at the example case of the Site-to-Site VPN: Let site A and site B be true private networks, for "true" as in: own campus LAN infrastructure. Interconnecting them with "true" private connectivity (e.g. fiber) may be prohibitively expensive - or impossible. Connecting the sites across the open internet might be undesirable or impossible (e.g. public IP address space, firewalling and NAT difficulties). Enter the VIRTUAL private network across the Internet: an IPsec Tunnel between the border routers emulates a single (virtually) private link across an unterlying larger network.
    – Marc 'netztier' Luethi
    Jun 14, 2018 at 11:37

1 Answer 1

Reset to default
4

Anything which joins a layer 2 network to another through a shared medium could be considered a layer 2 VPN.

Consider an office building where I rent rooms 1 and 101 and you rent 2 and 102. The building management gives me ethernet sockets on a single broadcast domain in both my rooms. Your sockets connect yours.

If it's done with a piece of Cat 5 at a patch panel we'd just call that a private ethernet. If we partition a shared thing, it's virtual. If the rooms are close it might be done with VLANs and trunks which would be entirely invisible to you and me. If far perhaps with MPLS or whatever.

Per your question: we're joining smaller pieces of a private network into a larger one, through a shared medium we want (at least) addressing privacy from. Per netztier's comment, you can also take the building management's point of view: we're partitioning off private portions of a shared, larger, thing.

(In layer 3 VPNs it's usual for the closing off to be done by the "client", but your can certainly buy virtual point-to-point links from lot of ISPs.)

In essence the "virtual private" part describes that there is a medium which is shared in a way which is invisible to us, at least from inside the border equipment.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.