 to the service provider's core network, which is based on the use of Frame Relay or ATM. To differentiate Frame Relay- and ATM- based VPNs from IP-based VPNs, service providers stress that multiple protocols are supported and that they rely on the use of virtual circuits or MPLS labels to facilitate the proper path, thereby ensuring better performance and providing traf- fic management capabilities. To further differentiate Frame Relay- or ATM-based VPNs from regular Frame Relay or ATM services, additional functions-such as packet classification and traf- fic isolation, the capability to handle multiple separate packet-forwarding tables and instances of routing protocols for each customer-reside at the edge. IP VPNs Whereas Internet-based VPNs tend to involve numerous ISPs, IP-based VPNs tend to involve IP backbones that are under the control of a given service pro- vider or a customer-owned enterprise network. An IP VPN is basically a private, or restricted, communications network constructed over shared IP-based networks, usually serviced on the providers' backbones, but with connections to the public Internet. IP-based VPNs have traditionally been referred to as networks of secure links over a public IP infrastructure. However, today an IP VPN is likely to be an MPLS- based infrastructure. (BGP MPLS VPNs are discussed later in this chapter.) However, as far as the user is concerned, the experience is the same, regardless of the technique. IP VPN services provide secure access for connecting intranets to other intranets, sup- port mobile and teleworker access to their enterprise intranets, and provide for the connection of extranets to private enterprise, education, and government networks. As discussed later in this chapter, there are two broad categories of IP VPNs: Network-based VPNs-With a network-based VPN, all the routing intelli- gence and VPN topology for the VPN are provided on the carrier's provider edge. Network-based IP VPNs make life much easier for users: Because all of the VPN topology is stored