MPLS vs Site-to-Site

scottalanmiller

There are many projects are there in my office.
If I need to check the status of the Desktop or Laptop which is connected to the MPLS or Site-to-Site,how can I check?

Should not matter. They are identical once you are on the network. You don't "connect" to either, they make the sites all appear as one.

Lakshmana

My senior person told me find out the difference between the MPLS and Site-to-Site in one project because I asked him "What is the difference between the MPLS and Site-to-site?"

scottalanmiller

@Lakshmana said:

My senior person told me find out the difference between the MPLS and Site-to-Site in one project because I asked him "What is the difference between the MPLS and Site-to-site?"

Well, that would be because you asked him.

Now you do need to figure out what you mean by "site to site". Do you mean a site to site leased line, a site to site VPN or something else? All you have is the adjective, not the noun.

Lakshmana

I mean Site-to-Site VPN.
My senior said that there is no leased line for the setup

art_of_shred

Site-to-site = 2 locations connected to create a single network
Types of "site-to-site" networks:

MPLS: the ISP provides a priority route between the 2 sites
VPN: tunneling protocol over the standard internet connection to give a private link between the 2 sites
Physical direct connection: an isolated cable/fiber connection actually runs from site 1 to site 2, linking the 2 sites as one local network

scottalanmiller

@Lakshmana said:

I mean Site-to-Site VPN.
My senior said that there is no leased line for the setup

Ah okay, that is quite different. I was explaining a site to site leased line. We normally would say VPN, not site to site. Never use site to site without the word VPN, that would be ambiguous.

MPLS is leased line, so if there is no leased line, how do you have MPLS?

scottalanmiller

And if you need security from the ISP's prying eyes, you can run a VPN over MPLS, of course.

Lakshmana

Ok.I just heard the word but many basic are learnt from you guys.

scottalanmiller

The most common Site to Site VPN technology is IPSec. But you can use others too, OpenVPN's SSL VPN technology can also work well for this, for example. You can make a Site to Site VPN using Hamachi and, I believe, ZeroTier, too.

But it is generally assumed that IPSec will be used and almost always it is handled by a hardware firewall to set up the VPN connections on either end. You can do this with nearly any business class firewall including entry level devices like Netgear ProSafe, DD-WRT devices, Ubiquiti Edge devices, etc.

scottalanmiller

MPLS is a service that you buy from your ISP so you never "see" it in any way. To you it would look identically as if you bought a managed VPN service from the ISP where they kept the VPN gear at their location instead of at yours.

Dashrender

@scottalanmiller said:

MPLS is a service that you buy from your ISP so you never "see" it in any way. To you it would look identically as if you bought a managed VPN service from the ISP where they kept the VPN gear at their location instead of at yours.

I know what you're talking about, but man, if I didn't I could see where this would be confusing.

I'm wondering if I should try to explain it another way.

hubtechagain

okay, i'm good at making things easy cause i'm dumb. so here you go!

MPLS = a service you buy from 1 ISP(same vendor). The ISP provides you with routers, and all of the infrastructure at each location. When it's finished your sites can all talk to eachother.

Site 2 Site VPN - this is where you or someone on your team has to know their stuff. you have to have internet at each location (vendor isn't important). You then will provide your own router/firewall at each location, configured (usually IPSEC) by you or your networking guy. The routers then use the internet and your configuration to create a secure tunnel between the two sites, when you're said and done the sites work together without any more interaction from you.

Benefits
MPLS is managed by someone else, you don't have to muck with it just monitor. this is good and bad. If their customer and quality of service are high this is great. If it's not high...you're gonna be bummed out when/if bad things happen. MPLS will more than likely have lower latency because you've got dedicated copper for the most part.

S2S VPN is usually less expensive, and if your sites are geographicly seperate, you can use different vendors for your internet connection at each site. Just make sure your bandwidth is similar on each end.

Negatives
MPLS is not gonna be cheap, but you're paying for a service that you shouldn't have to manage, configure, etc. and it's a dedicated service

S2S is going to be slower in my experience, you have to manage your routing equipment (not really a negative), more latency in my experience.

I'm tired now

hubtechagain

oh, then there's VPLS

scottalanmiller

@hubtechagain said:

oh, then there's VPLS

Which is part of the VPN family.

Dashrender

Let's not forget that Snowden has basically told us that if we care about privacy, we MUST encrypt anything we send over an MPLS, leased line.

Google had MPLS/leased lines, etc between their datacenters. Google rented these services from whatever companies could provide it. Those companies allowed the NSA to tap into those private lines and see/do anything they wanted with flowing data.

Today, Google/MS, etc all encrypt all data as it leaves their internally controlled network to stop this snooping.

scottalanmiller

Absolutely, you must assume that your ISP is your worst enemy. That's why I don't worry about coffee shops, no different than any other ISP.

Dashrender

@scottalanmiller said:

Absolutely, you must assume that your ISP is your worst enemy. That's why I don't worry about coffee shops, no different than any other ISP.

So do you use a VPN client to use a known entry point to the internet when at a coffee shop? Or just not care about things like ML and other sites that don't use TLS? And for the sites you do care about, of course ensure the TLS connection is live?

I know reading this it might sound flippant, it's not meant to be.

scottalanmiller

@Dashrender said:

So do you use a VPN client to use a known entry point to the internet when at a coffee shop?

Of course, its called a web browser and it is an SSL application specific VPN. Just use HTTPS instead of HTTP and you get a single port, application specific, end to end encrypted VPN.

Dashrender

@scottalanmiller said:

@Dashrender said:

So do you use a VPN client to use a known entry point to the internet when at a coffee shop?

Of course, its called a web browser and it is an SSL application specific VPN. Just use HTTPS instead of HTTP and you get a single port, application specific, end to end encrypted VPN.

LOL of course But then we can't go to places like Mangolassi from the Coffee shop, because it doesn't have HTTPS.

Jason

@art_of_shred said:

@Lakshmana Any site-to-site configuration, whether it is MPLS, VPN, or a cable running between the 2 buildings, should create a single LAN on the user side. You should see anything on the network at the other site just as you would see it if it was on a desk in the next room.

Not quite.. Some of them will be L2 and can be the same subnet.. others will have to be layer 3 with a router in between.