This connectionless architecture allows the creation of VPNs in Layer 3, eliminating the need for Layer 2 tunnels or virtual circuits. Members of each VPN are identified as belonging to a closed user group through the use of MPLS labels. These labels carry next-hop switching information for packet forwarding as well as a VPN identifier to keep communications within a VPN private. The richness of MPLS lies in the labels. The labeling paradigm decouples packet forwarding from the content of IP headers, providing the mechanism for how MPLS confers Layer 3 services into Layer 2 infrastructures.
Labels can indicate packet routes, user group, and service attributes.
The core devices merely forward packets based on labels, replacing traditional switching or routing tables. MPLS separates traffic and provides privacy without Layer 2 tunneling protocols or encryption by putting information into the MPLS label. Further, all MPLS functionality resides in the provider network, requiring no configuration at the customer premise. A Word about Security Connectionless MPLS VPNs offer the same level of security as connection-oriented VPNs. In addition, across the backbone VPN, traffic is kept separate among user groups.