This document discusses security concerns regarding MPLS VPN configurations and proposes methods to check MPLS VPN configurations for errors and compliance. Key points that should be checked include VPN access points, VRF configurations, route distinguishers (RD), route targets (RT), routes, and administrative/service VPN configurations. A tool is proposed to collect configuration data from provider edge (PE) routers periodically and check for obvious errors, inconsistencies, and non-compliance between actual and allocated configurations across all VPNs in the network. Results would be provided to both network operators and VPN owners.

1. MPLS VPN Security assessment C. Anselme-Moizan [email_address]

4. MPLS VPN vs. FR full mesh MPLS VPN security assessment

6. MPLS : label distribution (LDP) MPLS VPN security assessment PE PE PE CE CE P 1 1 0 128.89 171.69 Label 7 for 171.69 Label 9 for 128.89 Label 4 for 128.89 Label 5 for 171.69 0 In Tag Prefix Out Iface Out Tag - 128.89 1 4 - 171.69 1 5 … .. … .. … .. … . In Tag Prefix Out Iface Out Tag 4 128.89 0 9 5 171.69 1 7 … .. … .. … .. … . In Tag Prefix Out Iface Out Tag 9 128.89 0 - … .. … .. … .. … .

7. MPLS : label switching (no VPN) MPLS VPN security assessment PE PE PE CE CE P 1 1 0 128.89 171.69 CE 128.89.25.4 data 128.89.25.4 data 128.89.25.4 data 0 4 128.89.25.4 data 9 In Tag Prefix Out Iface Out Tag - 128.89 1 4 - 171.69 1 5 … .. … .. … .. … . In Tag Prefix Out Iface Out Tag 4 128.89 0 9 5 171.69 1 7 … .. … .. … .. … . In Tag Prefix Out Iface Out Tag 9 128.89 0 - … .. … .. … .. … .

16. Admin/Service VPN MPLS VPN security assessment 9999:0001 9999:0002 9999:20000 9999:20000 9999:30000 9999:30000 Management Green Red

27. MPLS VPN security assessment

28. MPLS VPN security assessment

29. MPLS VPN security assessment

30. MPLS VPN security assessment