{"id":16989,"date":"2017-06-26T13:07:46","date_gmt":"2017-06-26T11:07:46","guid":{"rendered":"https:\/\/www.savecall.de\/encryption-of-mpls\/"},"modified":"2026-07-30T11:14:59","modified_gmt":"2026-07-30T09:14:59","slug":"encryption-of-mpls","status":"publish","type":"post","link":"https:\/\/www.savecall.de\/en\/encryption-of-mpls\/","title":{"rendered":"Encryption of MPLS"},"content":{"rendered":"\n

\n

\n

Encryption of MPLS<\/h1>\n<\/div>\n\n\n\n

Trusted Advisor for IT & Telecommunications Sourcing<\/h3>\n<\/div>\n\n\n\n
\n
\n
\n
Encryption of MPLS networks<\/h2>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
How companies make their MPLS secure<\/h3>\n\n\n\n
<\/div>\n\n\n\n
MPLS<\/a> is considered a closed system, but the attack surface increases with cloud connections and external access. The encryption of MPLS data<\/a> is therefore becoming increasingly relevant. The decisive factor is at which point in the network the encryption takes place and which type of transport is used.<\/p>\n\n\n\n
<\/div>\n\n\n\n
In a nutshell:<\/strong><\/p>\n\n\n\n
\n
Basic protection: MPLS is fundamentally secure, but requires additional encryption for external interfaces<\/li>\n\n\n\n
Ethernet via MPLS: Data is transported via the Ethernet header and can be encrypted on layer 2<\/li>\n\n\n\n
Transport and frame mode: Selection of the encryption type depending on the structure of the network and position of the secure switch<\/li>\n\n\n\n
MPLS Interconnect: Connection of multiple MPLS clouds requires customized frame formats and payload encryption<\/li>\n\n\n\n
IPSec integration: Useful for pure IP networks, but not sufficient for Carrier Ethernet structures<\/li>\n<\/ul>\n\n\n\n
The right encryption solution protects connections, applications and data from physical access, manipulation and DDoS attacks<\/a>.<\/p>\n\n\n\n
The question:<\/strong> How secure is your MPLS network against unauthorized access and data loss?<\/p>\n<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Table of contents<\/h3>\n\n\n\n
\n
Ethernet via MPLS \/ VPLS<\/a><\/li>\n\n\n\n
MPLS Interconnect<\/a><\/li>\n\n\n\n
Between MPLS clouds<\/a><\/li>\n\n\n\n
IPSec as MPLS encryption<\/a><\/li>\n\n\n\n
FAQ<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Encryption in MPLS networks is a sensitive issue and is becoming increasingly important. The otherwise closed MPLS networks have more and more points of contact with the Internet, be it through external employees, cloud connections or others. We briefly present various encryption mechanisms here. Basically, an MPLS network is secure. Why? It is a self-contained network operated by a provider and usually only has one point of contact with the public internet. This is usually either in the data center or in the company headquarters. However, even closed networks can become insecure due to physical access to computers or nodes. Encrypting MPLS traffic creates more security here. MPLS processes and transports a variety of different data. This also includes IP packets and Ethernet frames. Ethernet encryptors should support MPLS, but depending on the location of the encryptor, different support may be required.<\/p>\n\n\n\n
Ethernet via MPLS \/ VPLS<\/h3>\n\n\n\n
If Ethernet frames are transported via MPLS, the encryptor must leave the Ethernet header unencrypted, as the MPLS relies on the header information (MPLS header). Here, the requirements for MPLS are met in both transport and tunnel mode. Direct support is not necessary, only transparency. Two transport variants of Ethernet via MPLS can be used:<\/p>\n\n\n\n
\n
The original frame is encapsulated by the MPLS and the MPLS tag is placed in front of the payload (for different Layer 2 networks)<\/li>\n\n\n\n
The MPLS tag is placed between the Ethernet header and the payload (only for a continuous Ethernet network)<\/li>\n<\/ul>\n\n\n\n
MPLS Interconnect<\/h3>\n\n\n\n
When encrypting the connection of local MPLS clouds via a WAN, the secure switch (encryptor) must adapt to the frame format. Two frame variants are possible:<\/p>\n\n\n\n
\n
Ethernet frame with MPLS tag<\/li>\n\n\n\n
Ethernet frame with MPLS tag, whereby the “original” frame is encapsulated and transmitted as payload<\/li>\n<\/ul>\n\n\n\n
Between MPLS clouds<\/h3>\n\n\n\n
If you want to encrypt the connection between two local MPLS clouds via a provider MPLS cloud, it is necessary that the encryptor only encrypts the payload consisting of the encapsulated original frame. The exact requirements for the encryptor vary depending on the scenario and topology. An optimal solution for multipoint topologies is difficult to achieve.<\/p>\n\n\n\n
IPSec as MPLS encryption<\/h3>\n\n\n\n
Securing with IPSec is also possible. However, this only makes sense if it is a pure IP network. If it is a Carrier Ethernet network solution<\/a>, it does not offer sufficient security, as there is no encryption below Layer 3. Do you need advice on your MPLS network? Get in touch with us! Our experts will be happy to help you.<\/p>\n<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
$\"Frank$ <\/figure>\n<\/div>\n\n\n\n
\n
Written by<\/p>\n\n\n\n
Frank Frommknecht<\/h3>\n\n\n\n
Key Account Consultant, SAVECALL<\/strong><\/p>\n\n\n\n
Has supported companies for over 20 years in selecting and optimizing their networking solutions. His focus: making complex telecommunications understandable from the customer’s perspective and finding the right strategic solution.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Why<\/h2>\n\n\n\n
$\"\"$ <\/figure>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
Telecom & IT sourcing. Worldwide. Carrier-independent.<\/h3>\n\n\n\n
<\/div>\n\n\n\n
Selection & operation of worldwide connectivity & cloud infrastructure. Without vendor risk & unnecessary costs.<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
80+ carriers worldwide<\/li>\n\n\n\n
One point of contact<\/li>\n\n\n\n
One SLA<\/li>\n\n\n\n
One portal: mySAVECALL<\/li>\n\n\n\n
Min. 20% savings<\/li>\n<\/ul>\n<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
\n
25+
years of experience<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
40+
Employees<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
80+
Partner<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
1400+ Clients<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Sources<\/h3>\n\n\n\n
\n
IETF RFC 5920: Security Framework for MPLS and GMPLS Networks<\/a><\/li>\n\n\n\n
With kind permission of Mr. Christoph Jaggi, original publication not linked in the source article<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Frequently Asked Questions About MPLS Encryption<\/h2>\n<\/div>\n<\/div>\n\n\n\n
Frequently Asked Questions About MPLS Encryption<\/h3>\n\n\n\n
Is an MPLS network secure by itself?<\/strong>
Generally yes: MPLS is a self-contained network operated by a provider, usually with only one point of contact with the public internet, typically in the data center or company headquarters. Still, physical access to computers or nodes can make the network vulnerable, additional encryption creates more security here.<\/p> <\/div>
How does encryption of Ethernet over MPLS work?<\/strong>
The encryptor must leave the Ethernet header unencrypted, since MPLS relies on its information. This satisfies the requirements for both transport and tunnel mode, direct support is not necessary, only transparency towards the MPLS header.<\/p> <\/div>
What needs to be considered for MPLS interconnect between multiple clouds?<\/strong>
When local MPLS clouds are connected over a WAN, the secure switch must adapt to the respective frame format. Options are an Ethernet frame with an MPLS tag, or an Ethernet frame with an MPLS tag where the original frame is encapsulated and transmitted as payload.<\/p> <\/div>
Is IPSec alone sufficient as MPLS encryption?<\/strong>
IPSec works well for pure IP networks. For a Carrier Ethernet network solution, however, IPSec alone does not provide sufficient security, since encryption below Layer 3 is missing. Adapted Layer 2 encryption mechanisms are needed here.<\/p> <\/div>
What does encrypting MPLS data specifically protect against?<\/strong>
A suitable encryption solution protects connections, applications and data from physical access, manipulation and DDoS attacks, especially at points where the MPLS network touches external access or cloud connections.<\/p> <\/div>
How does SAVECALL help secure MPLS networks?<\/strong>
SAVECALL provides vendor-neutral advice on where in the network encryption makes sense and which transport type and encryption mechanisms fit your existing MPLS and Ethernet structure, tailored to cloud connections, external access and your individual network topology.<\/p> <\/div> <\/div>\n\n\n\n
\n
\n
Articles that may also interest you<\/h2>\n<\/div>\n\n\n\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"\"$ <\/div>\r\n
The company<\/p>\r\n <\/div>\r\n\r\n
\r\n
Savecall at leat con 2026<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL at the 2026 Colt Charity Bike Ride<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Globale Internet-Beschaffung: Warum Inhouse-Sourcing oft teurer wird als gedacht<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-security-service-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-costs-site-connectivity<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-monitoring-visibility-operation<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-sla-mttr-what-counts<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
cloud-phone-system-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Mobile radio management<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Mobile Provider Comparison 2026<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Internet Connection Which Provider Fits<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Consulting<\/p>\r\n <\/div>\r\n\r\n
\r\n
why-vendor-sprawl-destroys-agility<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
AI-Enabled Networks: Why Bandwidth Alone Isn’t Enough\u2014and What CIOs Really Need to Focus On<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Global Connectivity from a Single Source<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
nis2-telecom-infrastructure<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"WAN$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-sd-wan-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
sase-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
Why cloud security is important<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Savecall$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
Second acquisition in twelve months: Savecall takes over landline customers from Bluestring<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
What and where are the challenges for the network infrastructure of most companies?<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL Holding GmbH founded: Clear structure. Strong foundation. Long-term partnership.<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n <\/div>\r\n\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n\r\n