 network-that is, a set of communication devices that do not use a shared backbone to communicate with each other. The edge devices of a site, the customer edge routers, are connected to one of the ser- vice provider's provider edge devices via an access connection or attachment circuit through the access network. An access connection in this context is a dedicated Layer 2 connection, such as an ATM virtual circuit, a Frame Relay data link con- nection identifier (DLCI), a PPP connection, an Ethernet interface, or a virtual LAN. It could also be a Layer 3 tunnel, such as an IPsec security association over the Internet. The customer edge-to-provider edge access connection is configured to be associated with the specific VFI in the provider edge, depending on which VPN the site belongs to. Layer 3 VPNs are implemented in two ways: RFC 2547 (BGP MPLS) VPNs-RFC 2547 is an IETF informational docu- ment that describes BGP MPLS. RFC 2547bis-the second version of RFC 2547-is an Internet Draft. RFC 2547bis VPNs are also known as BGP MPLS VPNs because BGP is used to distribute VPN routing information across the provider's backbone and MPLS is used to forward VPN traffic from one VPN site to another. RFC 2547bis multiplexes many VPN routes through a single BGP system. In this approach, customer routing is termi- nated at the provider edge. Virtual router VPNs-With these types of VPNs, each virtual router runs an instance of a routing protocol that is responsible for disseminating VPN reachability information between virtual routers. In this model, customer routing is extended across the provider network. The following sections describe these two types of Layer 3 VPNs in detail. RFC 2547 (BGP MPLS) VPNs IP VPNs based on RFC 2547 are becoming increasingly popular. As shown in Figure 9.23, they use a combination of BGP and MPLS to pass IP traffic through an MPLS core. Offering this type of VPNs requires a provider to configure MPLS on all core and edge routers. Furthermore, all pro- vider edge routers need to have Multiprotoco