g this were presented at the start of the chapter; however, there are others that are described in RFC 2547 or by De Ghein (2006) and Davie (2000). A layer-3 VPN allows a customer's IP network to peer with a provider's network at the IP layer. This is difficult to achieve using conventional IP because it typically requires complex configuration of many Generic Routing Encapsulation (GRE) tunnels and very careful control over routes advertised between the provider, the customer, and other custo- mer networks. This section shows how MPLS can be a scalable method of providing VPNs. MPLS VPN Architecture The MPLS VPN architecture is shown in Figure 13.15 for one provider and two customers spread over five sites. The goal of the VPN is to provide each customer with connectivity between its sites in such a manner that traffic between that customer's sites cannot (inad- vertently) leak into another customer's network. In other words, it provides a private network but over a common infrastructure. However, with the layer-3 VPN we note that it is possible to allow some (or as much as needed) IP connectivity between customers, the provider, and possibly the Internet. The scenario in Figure 13.15 assumes that each customer site (A, B, C, D, and E) is running a conventional IP network and that the provider is running an IP/MPLS network (there are other options not discussed here). The routers (or LSRs) have terms applied to them depending on their purpose and locations: Customer Edge (CE): This is usually owned and controlled by the customer and is the customer site gateway to the VPN. It will be using the IP address space of the customer on all of its interfaces, which could be globally addressable or a private network address space. Each CE is connected to one or more provider edge LSR. Provider Edge (PE): This is a provider-controlled LSR that supplies IP interfaces to the customer. Each of these interfaces is connected to at most one CE, and each will be using the IP address space of the customer. The PE also has interna