Virtual Private Networks Identifier
Extracted elements (10)
A non-IP-dependent VPN-ID format was required to support layer 2 VPNs, hence the use of an IEEE OUI rather than an IP-address-based identifier.
The OUI-based VPN authority field serves a dual purpose: it provides global uniqueness via the IEEE registry and identifies the VPN authority responsible for coordinating connectivity and services for the VPN, which may be the private network administrator or primary service provider.
The VPN-ID format must not force assumptions about the shared network(s) nor prohibit use of shared network features, enabling the same VPN-ID format and value to apply at multiple layers (e.g., both ATM and IP layers) of the same shared network.
The same VPN-ID format and value should apply at different layers of the same shared network (e.g., ATM and IP layers), enabling consistent identification of a VPN across heterogeneous infrastructure.
The VPN-ID may be used explicitly (e.g., included in an encapsulation header per RFC 2684) or implicitly (e.g., included in ATM signalling exchange per ATM Forum af-mpoa-0129.000) to associate a data packet with a VPN.
The VPN Identifier format must provide a globally unique VPN Identifier usable across multiple Service Providers.
The VPN Index (4 octets) identifies a particular VPN serviced by the VPN authority identified in the OUI portion of the VPN-ID.
The VPN OUI (3 octets) identifies the VPN authority — the organization or service provider responsible for administering the VPN. It is an IEEE 802-1990 Organizationally Unique Identifier.
Misconfiguration or deliberate forging of a VPN identifier may result in security breaches including the interconnection of different VPNs. Standard security procedures must be used with any specified usage of the VPN-ID.
The global VPN Identifier is a 7-octet field: a 3-octet IEEE 802 OUI (VPN authority Organizationally Unique Identifier) followed by a 4-octet VPN Index identifying the specific VPN under that authority.