ovisioning in core and transport networks within a given telecom operator net- work domain, while MPLS/BGP [21] can be used as QoS solution for traffic exchange between ASs. With the transition of a telecom operator's network to NGN, the same QoS mecha- nisms in NGN (e.g. used for voice services or IPTV) can be used for VPN services for QoS provisioning, including all types of end-users (not only to business customers, i.e. companies) [22]: Site-to-site VPN. This is used for connecting branch offices of a given company (so virtually they appear as though they are connected to the same network) as well as individual users for the purposes of mutual interest (collaboration, online gaming, etc.). Access VPN. This type is an individual VPN which is used to access corporate network from other networks such as a home network (e.g. work at a distance). Multiservice VPN. This is used for provision of multimedia services (e.g. voice, video, and data) to business users, with QoS support. A VPN framework architecture for fixed and mobile NGN environments is shown in Figure 6.6. VPN functions in the NGN service stratum provide registration, authen- tication, and authorization for VPN service users, support security solutions and QoS provision, as well as management functions (e.g. mobility management in mobile net- works), multicast service control, and VPN membership management (e.g. joining and leaving VPNs). The NGN transport stratum provides functions for VPN admission and resource control (admission of a new VPN and resource reservation, policy manage- ment, etc.). For business VPN services in NGN environments the enterprise network uses trans- port control functions with the NACFs, the RACFs, and the MMCFs; enterprise network attachment functions (e-NAFs), enterprise resource and admission control function (e-RACF), and enterprise management and control function (e-MCF). For the purposes of QoS provisioning and enforcement for VPN tunnels, the VPN SCF trigger RACF or e-RACF aiming to provide QoS to VPN tunnels as the e