 having the same root and the same destination, but no other net- work resources in common. They can be used either exploiting one of them to route traffic them and leaving the other as a backup or using the so-called traffic balancing, consisting in sharing among the two tunnels the traffic load of a single tunnel. When one of the FRR tunnels fails, all the traffic is automatically switched on the other tunnel. Due to the initial association between the FRR, this operation is very fast, generally below the 50 ms target typical of SDH/SONET protection mechanisms. Finally, MPLS can implement virtual private networks (VPN). This is a key point for a carrier that wants to offer business-related services with a packet network [40]. In order to correctly implement VPNs, the address spaces of the MPLS core and all VPNs on the same shared network must be independent SO that each customer can use the same address space without interfering with other (the same requirement already considered for carrier Class Ethernet carrying customers LANs). That is, every VPN cus- tomer and the core itself must be able to use the entire IPv4 address range completely independently. Similarly, data traffic from each VPN must remain separate, never flowing to another VPN. A related requirement is that routing information for one VPN instance must be independent from any other VPN instance and from the core. To achieve this separation, each VPN is assigned to a virtual routing and forwarding (VRF) instance. Every core LSR maintains a separate VRF instance for each connected VPN. Each VRF on the LER is populated with routes from one VPN, either through stati- cally configured routes or through routing protocols that run between the carrier LER and the customer LER. Because every VPN is associated with a separate VRF, there is no interference among the VPNs on the carrier LER. To maintain routing separation across the core unique VPN identifiers are added to the MPLS header and route distinguishers are added to the BGP header. VPN routes are 