 on the carrier's provider edge, the provider has the responsibility of managing all the complexity of the VPN topology. All the customer needs is a single connection from the CPE to the provider edge. CPE-based VPNs-In the case of CPE-based VPNs, which are most often based on IPsec, the network topology is defined at the customer's edge router. Obviously, with large or highly meshed networks, the management of SO many tunnels and VPN rules can be overwhelming and can severely affect the capabilities of customers' edge routers. IP VPNs are discussed in detail later in this chapter. VPN Tunneling The goal of a VPN is to provide connectivity over a shared infrastructure that is as secure and cost-effective as a dedicated private network such as a Frame Relay or ATM network. In addition, a VPN solution must be scalable, highly available, and easy to manage. And of course, QoS is a required feature. A VPN works by using the shared public infrastructure while maintaining privacy through security proce- dures and tunneling protocols, such as Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), Generic Routing Encapsulation (GRE), and IP Security (IPsec). In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a tunnel that cannot be entered by data that is not properly encrypted. An additional level of security involves encrypting not only the data but also the originating and receiving network addresses. Tunnel- ing is the transmission of data intended for use only within a private, usually enter- prise, network through a public network in such a way that the routing nodes in the public network are unaware that the transmission is part of a private network. As shown in Figure 9.15, tunneling is generally done by encapsulating the pri- vate network data and protocol information within the public network transmission units so that the private network protocol information appears to the public net- work as data. Tunneling allows