l (EIGRP), and BGP. As shown in Figure 9.22, the provider edge devices that implement the VPN functionalities implement a set of per-VPN virtual forwarding instances (VFIs). A VFI is a logical entity that resides at a provider edge that includes the router infor- mation base and forwarding information base for a VPN instance. A separate Chapter 9 IP Services PE Device PE Device Router Router BGP/MPLS Backbone Router PE Device VPN Tunnels Router Access Connection L2 Link or L3 Tunnel Packet-Switched Network Tunnel Router PE = Provider Edge Access Connection CE = Customer Edge L2 Link or L3 Tunnel Figure 9.22 The provider edge-based Layer 3 reference model forwarding or switching instance is dedicated to one specific VPN. Customer edge- sourced packets are forwarded across the provider backbone in a tunnel based on a per-VPN VFI lookup of destination customer Layer 3 addresses. VFIs make for- warding decisions based on the VPN customer packet Layer 3 information (i.e., the packet destination IP address). VFI entities implemented in different provider edge devices on the same ser- vice provider network and belonging to the same VPN are interconnected via VPN tunnels. As mentioned earlier in this chapter, a VPN tunnel is a virtual link between two entities that belong to the same VPN. This virtual link is implemented by means of adding an encapsulation header to each forwarded packet, and that header is understood by the packet-switched network backbone in such a way that the encapsulated traffic can be forwarded from the packet-switched network source entity to the packet-switched network destination entity. The source entity is responsible for adding the encapsulation header, and the destination entity is responsible for removing it. Multiple VPN tunnels established between the same two provider edge devices are often multiplexed in a provider edge-to-provider edge packet-switched network tunnel and transparently carried over the packet- switched network's provider core devices. The customer site is a local private