
130 Chapter 4: Secure MPLS VPN Designs
Therefore, if anything underneath the top label is faked, it can only affect the VPN of the
ISP itself. So the security of the CsC architecture is equivalent to the security of a standard
RFC 2547 network, even though labeled packets are exchanged at the edge.
Because the security of CsC is very good, this solution can also be considered to extend
MPLS to the customer site. Often, this requirement is stated as a “PE at the customer site.”
It is not recommended to position a PE at a customer site. The reason is that if the PE gets
compromised, all VPNs of that MPLS core can be intruded. A PE router must be ...