ed to the provider backbone by means of a connection between a customer edge device-which can be one or more hosts and/or routers-and a virtual router. Customer edge devices are preconfigured to connect to one or more virtual routers. Multiple virtual rout- ers may coexist on the same service provider edge device or provider edge. Cus- tomer edge devices can be attached to virtual routers over any type of access link (e.g., ATM, Frame Relay, Ethernet, PPP) or IP tunneling mechanisms (e.g., IPsec, L2TP, or GRE tunnels). Customer edge sites can be statically connected to the pro- vider network via dedicated circuits or can use dialup links. Routing tables associ- ated with each virtual router define the site-to-site reachability for each VPN. The internal backbone provider routers are not VPN aware and do not keep VPN state. In general, the backbone is a shared network infrastructure that represents either a Layer 2, ATM, or Frame Relay network; an IP network; or an MPLS net- work. Not all VPNs existing on the same provider edge are necessarily connected Chapter 9 IP Services Virtual Router (VR) to VR L3 Tunnel PE Device VR to VR L2 Link VR of Router VPN 1 VPN 1 PE Device Router VR of Provider Backbone Router VPN 1 VPN 1 FR, ATM, IP, MPLS VR of PE Device VPN 2 VR of VPN 1 VPN 2 Access Router VR of VPN 2 Connection VPN 2 PE = Provider Edge CE-VR Exchange CE = Customer Edge Any Routing Protocol Figure 9.24 Virtual router VPNs via the same backbone, SO a single provider edge can be connected to multiple backbones. Individual virtual routers on the provider edge may also connect to multiple backbones. Thus, a single VPN can be built from multiple transport tech- nologies in the virtual router architecture. Virtual routers have independent IP routing and forwarding tables, and they are isolated from each other. This means that two virtual routers on a provider edge can serve two different VPNs that may have overlapping address space. The addresses need only be unique within a VPN domain. A virtual router has two main fu