c security characteristics-derived directly from the strengths of MPLS and MPLS VPN-related standards (e.g., RFC 4364): Containment: Traffic (and routing information) sent between CE routers on the same VPN always stay within that specific VPN-no spillover or "leakage" can occur. Isolation: No customer's VPN can in any way materially affect or influence the content or privacy of another customer's VPN. Availability: Aside from the basic security-related attributes of MPLS and MPLS VPNs, service providers carefully engineer shared resources to meet the highest levels of avail- ability and mitigate potential denial of service activities through additional methods such as access control lists (ACLs), route filters, turning off unnecessary services, and other infrastructure-hardening techniques. Simplicity: MPLS networks allow for simplified provisioning in both the customer and service provider domains (and hence can help to avoid security-related configuration mis- takes). First, MPLS VPNs are much simpler for customers to configure than legacy layer 1 (e.g., private line), layer 2 (e.g., frame relay or ATM) point-to-point solutions, or layer (e.g., Internet Protocol Security [IPSec] VPNs). Second, MPLS VPNs allow for much more scalable service provider architectures, unlike some other VPN solutions (e.g., L2TP) based on ACLs and separating customer address space. A service provider network using ACLs or separate IP spaces as the primary method to create VPN separation has a very difficult task to manage. In this scenario, every new site or route that is added can poten- tially require a change on every other router in the network to ensure security. This is not a scalable solution and can lead to errors in configuration and potential security breaches. Lastly, additional requirements are imposed on the data plane to support traffic prioritization SO that service-level agreements (SLAs) can be achieved for different voice, video, and data applica- tions. This requires deep packet inspection (DPI) SO that forwarding