Sci.Int.

(Lahore),27(3),2113-2119,2015

ISSN 1013-5316; CODEN: SINTE 8

2113

AN IMPLEMENTATION OF MULTIPROTOCOL LABEL SWITCHING VIRTUAL

PRIVATE NETWORKS AND INTERNET PROTOCOL SECURITY USING
GRAPHICAL NETWORK SIMULATOR 3 AS AN EDUCATIONAL TOOL
Bilal Ashfaq Ahmed1, Yasir Saleem2, Saima Waseem1
1

The University of Lahore, Lahore, Pakistan

University of Engineering and Technology, Lahore, Pakistan
Email:bilal.ashfaq@ee.uol.edu.pk, ysaleem@gmail.com sw_vision24@yahoo.com
2

ABSTRACT- Graphical network simulator (GNS) 3 is an excellent complementary tool that allows simulation of
complex networks like implementation of real labs for network engineers, administrators, and researchers. The primary
objective of this paper is to evaluate GNS3 as an educational tool by implementing Multiprotocol Label Switching (MPLS)
Virtual private Networks (VPN) and Internet Protocol Security (IPsec) VPN. A Client Server model is created using FileZilla
Server and Client, then a file of 11,057,507 bytes is transferred and monitored by network tool OpManager. The result
obtained shows that Round-trip time (RTT) value is high for both protocols in GNS3 as compare to real networks. So it is
concluded that network topology used can be implemented in GNS3, and could be used as an educational tool, but it requires a system like
Intel Core 2 Duo or higher processor, having at least 4GB of RAM, as it utilizes considerable system resources.
Index Terms: Graphical Network Simulator (GNS3), Multiprotocol Label Switching (MPLS), Virtual Private
Network (VPN), Internet Protocol Security (IPsec), Round-trip Time (RTT).

1. INTRODUCTION
IT and Telecommunication industry has shown immense
progress over the years as different changes are occurring at a
very fast pace in this sector. It may be due to the demands of
the users, to improve and remove the technological
constraints that may exist like bugs and software up gradation
that are required by system with the passage of time.
Therefore, it is important to conduct different experiments,
tests and research work before launching any brand new
technology into the market and furthermore to ensure that the
fresh technology, application, or software will achieve the
desire results.
Simulators and emulators are used for analysis of existing
methods, new systems, for training and experimentation
purposes. These are cost efficient compared to the physical
equipment and tools used in labs. Furthermore, it needs less
time and resources for set-up of distinctive simulators and
emulators. They are robust for running distinct experiments
and research work. Creation and testing of many applications,
protocols, and network designs used these simulators. The
simulation-based knowledge helps students to develop
updated skills in creative and critical thinking and find out
new problem-solving techniques [1].
GNS3 is an open-source emulator, but it requires Cisco IOS
images for running different routers and Private Internet
Exchange (PIX) firewall, etc. According to Fuszner [2], by
using GNS3 and Cisco Internetwork Operating System (IOS)
emulation of complex networks would be carried out. Cisco
IOS runs in a virtual environment on a laptop and personal
computers. GNS3 is the graphical front end to Dynagen that
runs on top of Dynamips which is the core program that
makes Cisco IOS emulation possible and provides userfriendly text based interface [14]. GNS3 provides graphical
environment. GNS3 is used for preparation of such as Cisco
CCNA, CCNP, CCIP and CCIE as well as Juniper JNCIA,
JNCIS and JNCIE. Thanks to Virtual Box integration, now
even system engineers and administrators can take advantage
of GNS3 to make labs and study for Red hat (RHCE, RHCT),

Microsoft (MSCE, MSCA), Novell (CLP), and many other

vendor certifications and for training of students at different
institutions. As GNS3 uses Cisco real IOS, command
supported by that particular IOS version can be used and
configured in GNS3. However, the command supported by
other simulators (e.g. Router Sim, Packet tracer and Boson
router simulator) depends upon the developer that decides
how many commands are chosen and included in the
simulator [3]. GNS3 has another interesting feature i.e.
packets or traffic would be captured, monitored and analysed
using Wire shark.
It is worth mentioning that MPLS has become an essential
network technology that has been implemented by many
service providers. MPLS has addressed the Scalability,
Quality of Service and Traffic Engineering issues etc. Next
generation networks have been deployed by different service
providers to provide different services using unified
infrastructure [4].
2. MULTIPROTOCOL LABEL SWITCHING
MPLS is a standard defined by IETF. Instead of making
decision on traditional IP addressing, a new forwarding
mechanism in which packets are forwarded based on labels is
used. These Labels may correspond to IP destination
networks (equal to traditional IP forwarding). They can also
correspond to other parameters, such as quality of service
(QoS), source address or support forwarding of other
protocols as well [5].
MPLS uses a 32-bit label field that is inserted between Layer
2 and Layer 3 headers as shown in Figure 1. MPLS label is 4
Bytes long in which 20 bits are used for label, 3 bits for
experimental Class of Service and 1 bit for bottom of stack
indicator and 8 bits for Time to live (TTL).

May-June

2114

ISSN 1013-5316; CODEN: SINTE 8

Sci.Int.(Lahore),27(3),2113-2119,2015

2.2 PEER TO PEER VPN ARCHITECTURE

In this network model the Service Provider routers will
facilitate and transport the data and routing information
through its network. It will form routing peer with customer
routers at layer 3. According to Badran [8] routing protocol
adjacency will be formed between customer edge and the
provider edge router.
Figure 1: MPLS Structure

According to Morgan and Levering [6],MPLS network

converges dynamically and supports multiple routing
protocols. MPLS has benefits like integrated network
infrastructure, Border Gateway Protocol (BGP) free core,
optimal traffic flow and traffic engineering. MPLS is used by
Service Providers for separation of each customers routing
information from other customers information within the
cloud, so MPLS networks are called MPLS Virtual Private
Network (VPN). Telecom Operators or Providers uses two
VPN models for providing VPN services to their customers
namely Overlay and Peer to Peer VPN model.
2.1 OVERLAY VPN ARCHITECTURE
In this network model Point to Point connection or VC is
provided by the Telecom Operators/Service Providers
between the customer routers. Routing peer will be created
between the customer routers instead of between customer
and Provider router. So the Service Provider routers do not
notice the customer routes. This Point to Point connection
would be layer 1, layer 2 or layer 3 [7].
Figure 2 shows an example of Overlay VPN build on Frame
relay network. Frame relay switches are installed in the
service Provider network and customer routers are connected
to these frame relay switches. Routing peer means that the
customer routers are directly connected to each other as
depicted in the Figure-1. Generic Routing Encapsulation
(GRE) tunnels are used for making layer 3 Overlay VPN
network. Advantage of GRE tunnels is that the traffic other
than Internet Protocol (IP) would also be routed through it
and by using Internet Protocol Security (IPsec) in conjunction
with GRE tunnel it is possible to secure the data travelling
through it

Figure 2: Overlay Virtual Private Networks where the Service

provider provides virtual point-to-point links between customer
sites.

Figure 3: Peer-to-Peer Virtual Private Networks where the

Service Provider participates in the customer routing

Figure 3 describes the concept of isolated routing information

between different VPNs. When a customer router is added, it
requires routing peer to be formed with a single Provider
edge (PE) router. Service Provider does not need to create
virtual circuits as with the overlay models or configuring
packet filters or route filters with old Peer to Peer VPN
design. It is an advantage for Service Providers by using
MPLS VPN technology.
2.2 INTERNET PROTOCOL SECURITY VPN
IPsec VPN tunnel is a feasible solution for data protection
between two remote sites which are connected through
internet. Internet Protocol security (IPsec) is a protocol suite
which provides
1. Data authentication
2. Data Integrity
3. Data Confidentiality
4. Anti-Reply
IPsec VPN protects the data travelling from source to the
destination with help of different protocols namely Internet
Key Exchange (IKE), Encapsulating Security Payload (ESP)
and Authentication Header (AH).
IPsec has two modes of operation which defines the extent
of protection offered by IPsec. These are transport and tunnel
mode. The original IP header is unprotected in transport
mode and only the upper layer data is protected. On other
hand in tunnel mode the original IP header and transport layer
both are protected. Original IP header is replaced with new IP
header. Azam et al. [9] reveals the network performance will
be affected due to variation in number of overhead bytes.
This variation in number of overhead bytes occurs by using
different protocols, file sizes and different algorithms. Figure
4 describes different IPsec modes.

May-June

Sci.Int.(Lahore),27(3),2113-2119,2015

ISSN 1013-5316; CODEN: SINTE 8

Figure 4: IPsec Transport Mode and Tunnel Mode

3. SIMULATION SCENARIO AND TOOLS

Simulator may be defined as the one that imitates an existing
or proposes system and applications that will produce results
approximating the actual conditions [10]. There are different
systems, for example, nuclear reactions and warfare, which
are dangerous to be conducted for analysis and
experimentation purposes, so simulations will be a good
option for these systems. According to Smith [11]
Simulation is a process of making model of a real or
imaginary system and conducting tests with this model. It is
a very vast field, and models may be made for any
imaginable system. Simulators may be used for
telecommunication field, computer networks, integrated
circuits, highway systems, flight training system and many
more. Simulators are cost efficient, faster and less dangerous
as compare to the real systems. Now a days simulations are
utilized by every engineering and scientific field. Simulations
are either discrete or continuous event. It depends upon how
the state variables will change. In a discrete event, the
variable values will change instantly at different points of
time. On the other hand, in a continuous event the value of
the variables will change continuously.
3.1 TOPOLOGY SCENARIO AND COMPONENTS USED
The topology scenario is designed considering simplicity and
minimum hardware resources to be used. Figure 5 shows the
implemented topology using GNS3 to simulate MPLS VPN
and IPsec VPN. Five routers are used in this network design;
two of these router are used as Customer Edge (CE) and other
three routers for Service Provider (SP) named as Provider
Edge(PE) and Provider (P) .Cisco 3700 ISO images are used
with serial links in between. PC or VMware Machine are
connected using cloud symbol. For serial link 1.544
Mbits/sec and for Fast Ethernet 100 Mbits/sec bandwidth is
used.

2115

and VMware Machine. Traffic and packets are captured.

Wire shack packet analyser tool. For calculation of various
results parameter OpManager network monitoring tool is
used. In the test given below Layer 3 MPLS VPN (Peer to
Peer VPN) and IPsec VPN is implemented in GNS3. Same
file is downloaded from FileZilla server and time is
calculated for comparison between the two technologies.
RTT value for both technologies is noted for comparison.
Table 1 shows the devices and applications that are used for
conducting this test.
On Personal Computer (PC) GNS3 emulator package is
installed having Wireshark Packet analyzing tool with it. The
topology scenario is designed in GNS3 and FileZilla FTP
Server and Client Model is developed with Laptop having
Virtual Box VMware machine installed on it. The network
monitoring tool Op Manager is installed on PC which is used
for monitoring of file transfer rate and incoming and outgoing
traffic in the network and Round trip time. Packet analyzing
is done using Wireshark. All the above feature is only
available in GNS3 that live traffic is captured and monitored
using network interfaces, other software tools like Packet
Tracer and Boson NetSim dont have these capabilities.
Table 1: Hardware and Software Used for Peer to Peer and IPsec VPN
Devices /
Description
Application
Personal
Intel Core 2 Duo CPU, 2.93 GHZ, 4GB
Computer (PC)
RAM
Intel Core 2 Duo CPU T6500, 2.1
Laptop
GHz,2GB RAM
Ethernet Cross
Cross cables
Cable
Emulator used for implementation of
GNS3
MPLS
Virtual Player
VMware Machine
1.544 Mbits/sec connections between
Serial links
routers
Two 100Mbits/sec connections are used,
Full duplex Fast
one for connecting an external PC to the
Ethernet
CE1 router and the other for connectivity of
connections
VMware machine with CE2 router.
Protocols Used
MPLS VPN and Ipsec VPN
Wireshark
Packet analyzing tool
OpManager
Network Monitoring tool
FileZilla
FTP Server and Client

A file having size of 11,057,507 bytes are transferred from

Server to Client using FileZilla Server and Client between PC

Figure 5: Topology of the experimental network prototype

May-June

2116

ISSN 1013-5316; CODEN: SINTE 8

4 RESULT ANALYSIS
In this Section we have discussed the layer 3 MPLS VPN
& IPsec VPN, there configuration and results analysis.
4.1 CONFIGURATION OF LAYER 3 MPLS VPN
Configuration of each router as shown in topology scenario
.4.1.1 CUSTOMER EDGE ROUTER
IP addresses are assigned to both serial and Fast Ethernet
interfaces of CE routers. Bandwidth of 1.544 Mbits/sec is
used on the serial interfaces and clock rate is not set on theses
interfaces as these are DTE ends. Routing Information
Protocol IP (version 2) routing protocol is used for
advertising the networks of CE routers.
4.1.2 PROVIDER EDGE ROUTER
Clock rate of 64 kbps is configured on the DCE ends of CE.
MPLS and Label distribution protocol (LDP) are configured
P router interfaces. Open Shortest Path First (OSPF) routing
protocol is used to advertise all networks and RIP (V2)
protocol is used on PE routers loopback interface and serial
interface attached to CE routers. Ipvrf command is used to
configure Virtual Routing and Forwarding (VRF) on PE
routers. PE routers have VRF instances for each attached
VPN. Route Distinguisher (RD) is used to keep the customer
routing information separate from other customers,. Border
Gateway Protocol (BGP) is configured on both PE routers.
RD combines with IPv4 prefix to make vpnv4 prefix which is
transported by IBGP between PE routers. In order to make
aware of different routes RIP is redistributed into BGP and
vice-versa.
4.1.3 PROVIDER INTERNAL ROUTER
Bandwidth 1.544 Mbits/sec and clock rate of 64 Kbps is
configured on both serial interfaces. MPLS and LDP are
configured on serial interfaces. OSPF routing protocol is
configured for dynamic routing.
4.2 RESULTS OF LAYER3 MPLS VPN
Trace route command is used on CE2 router to check the
route to fast Ethernet interface of CE1 router. Output shows
that four devices (Labeled 1, 2, 3 & 4) are involved in
reaching the interface as depicted in Table 2. This is different
from overlay VPN network.
Routing Table of CE2 router shown in Table 3 shows all the
connected interfaces and the routes advertise by MP-BGP. In
Peer to Peer VPN technology, CE2 router includes the route
information of both CE1 and PE2 routers. The routing peer is
established between customer edge and provider edge routers.
File is downloaded from FileZilla server and time is noted as
shown in the Table 4, minimum and maximum time for
downloading the file is 140 (2.33 minutes) and 268 seconds
(4.46 minutes)respectively. Average time taken for file
transfer is 218.14 seconds (3.6 minutes) and Standard
deviation is 55.19. There is variation in file transfer time; it is
due to variation in the number of processes that are running
in Windows operating system and load on the CPU.

Sci.Int.(Lahore),27(3),2113-2119,2015

Table 2: Output of Trace route Command (Peer to Peer VPN)

Table 3: Out of Show ip route command (Peer to Peer VPN)

Table 4: File Transfer Time in Layer 3 MPLS VPN Network

Status:
Status:
Status:
Status:
Status:
Status:

File transfer successful, transferred 11,057,507 bytes in 180

seconds
File transfer successful, transferred 11,057,507 bytes in 259
seconds
File transfer successful, transferred 11,057,507 bytes in 265
seconds
File transfer successful, transferred 11,057,507 bytes in 140
seconds
File transfer successful, transferred 11,057,507 bytes in 162
seconds
File transfer successful, transferred 11,057,507 bytes in 253
seconds

Figure 6 shows alternative representation of file transfer time

of file transferred through FileZilla server and client.
Wireshark captures the data travelling through MPLS VPN
network. Frame #15 is shown in Figure 7; the total length of
the frame is 1512 bytes which includes 1460 bytes of data, 4
bytes Cisco HDLC, 8 bytes MPLS labels, 20 bytes IP and 20
bytes TCP overhead.

Figure 6: Graph for File Transfer Time in MPLS VPN

May-June

Sci.Int.(Lahore),27(3),2113-2119,2015

ISSN 1013-5316; CODEN: SINTE 8

Figure 7: Frame Captured on the Serial interface in MPLS VPN

2117

4.3.3 PROVIDER INTERNAL ROUTER

Clock rate of 64 kbps is configured on both serial interfaces;
bandwidth of 1.544 Mbits/sec is used on the serial interfaces.
Similarly RIP (Version 2) protocol is configured on P router.
4.4 RESULTS OF LAYER3 MPLS VPN
Table 6 shows crypto iskamp sa is used to check all the IKE
security associations (SAs). Output shows that ISKAMP is in
idle state (quiescent state). It gives detail about the source and
destination and status of IKE security associations.
Table 7 shows crypto IPsec sa command result that provides
information regarding the current settings used by security
associations. It gives information about the encapsulated,
encrypted and digested packets etc.
Table 6: Output of crypto isakmp sa command (IPsec VPN)

Figure 8: Round Trip Time history report in MPLS VPN

Figure 8 shows RTT history report, the average value of RTT

is high as compare to the normal threshold value of 100 msec
(default value in OpManager). It is reported as an alarm by
the traffic monitoring tool.

Table 7: Output of Show crypto ipsec sa command

4.3 CONFIGURATION OF LAYER 3 IPSEC VPN

Configuration of each router as shown in topology scenario.
4.3.1 CUSTOMER EDGE ROUTER
IP addresses are assigned to the interfaces and bandwidth of
1.544 Mbits/sec is used on serial interface. Default gateway is
defined on CE routers. First step is ISAKMP policy is
configured on CE routers. It is IKE phase 1. This phase
includes
configuration
of
encryption
algorithm,
authentication algorithm, Pre-shared key, and DiffieHellman version1, 2 or 5 and tunnel lifetime. Second step is
configuring the IPsec transform set, it is IKE phase 2. Third
step is configuring Crypto access list, access list is configured
so that the interesting traffic will travel through the IPsec
tunnel for secure data transport. Fourth step is configuring
crypto map, it is IKE phase 2. Fifth step is applying crypto
map to the interface. Some important configurations of CE1
are shown in the Table 5.
4.3.2 PROVIDER EDGE ROUTER
Clock rate of 64 Kbps is set on the DCE end. Default
bandwidth is used on the serial interfaces and RIP (Version 2)
protocol is configured for dynamic routing on PE routers.

Status:

Table 5: Configuration of CE1 Router (IPsec VPN)

Status:

Table 8: File Transfer Time in IPsec VPN Network

Status:
Status:
Status:
Status:
Status:

File transfer successful, transferred 11,057,507 bytes in 254

seconds
File transfer successful, transferred 11,057,507 bytes in 209
seconds
File transfer successful, transferred 11,057,507 bytes in 198
seconds
File transfer successful, transferred 11,057,507 bytes in 235
seconds
File transfer successful, transferred 11,057,507 bytes in 270
seconds
File transfer successful, transferred 11,057,507 bytes in 243
seconds
File transfer successful, transferred 11,057,507 bytes in 233
seconds

File is downloaded from its FileZilla server to its client using

IPsec VPN, minimum and maximum file transfer time is 198
seconds (3.3 minutes) and 270 seconds (4.5 minutes).
Average time for file transfer in this experiment is 234.57

May-June

2118

ISSN 1013-5316; CODEN: SINTE 8

seconds (3.9 minutes) and standard deviation is 24.82 as

shown in Table 8.
Figure 9 shows the average file transfer time. Average File
transfer time in IPsec VPN is more as compare to MPLS
VPN network.
Figure 10 shows frame captured by Wire shark shows that
1500 bytes of data is available on the link. Instead of showing
the IP addresses of end devices i.e. source address
192.168.3.3 and destination address 192.168.4.2, IPsec tunnel
mode presents the IP addresses of the tunnel end points. IPsec
appends more overhead as compare to MPLS VPN; in tunnel
mode the overhead imposed by IPsec is 50 to 57 bytes or 58
to 73 bytes depending upon which encryption algorithm is
used.

Figure 9: Graph for File Transfer Time in IPsec VPN

Figure 10: Frame Captured on the Serial interface

Figure 11: Round Trip Time history report

Figure 11 shows RTT history report. Serial interface of CE1

is source and destination is the serial interface of CE2 router.
RTT report shows an average RTT value of 546 milliseconds.

Sci.Int.(Lahore),27(3),2113-2119,2015

5. CONCLUSION
Simulators and emulators are playing vital role in different
fields of science and technology. Simulators are admired by
researchers and students due to the fact that, either access to
the equipment is not available or time and finance is required
for establishing the lab. So therefore they are used for
research work and getting hands on experience in different
technologies. MPLS VPN and IPsec VPN are implemented
with the objective to generate traffic in GNS3 for comparison
between the two techniques. Both techniques are successfully
implemented. Average file download time in MPLS and
IPsec VPN is 218.14 seconds and 234.57 seconds
respectively. IPsec appends more overhead as compare to
MPLS so due to this reason the time taken for file transfer in
IPsec VPN network is more than the MPLS VPN
implementation. Finally according to OpManager report, the
RTT average value is higher in IPsec VPN as compare to
MPLS VPN, because IPsec provides security but it adds more
overhead which may affect the network performance. The
main drawback of GNS3 is that it utilizes a lot of system
resources, for all the technologies implemented in this paper,
the CPU usage was 100 % as reported by Windows task
manager.
REFERENCES
[1]
Khadijah Wan Mohd Ghazali, Rosilah Hassan,
Zulkarnain Md. Ali, Simulation tool for active learning
of introductory computer network subjects, 1st
National Conference on Active Learning, NCAL,
pp.119, 122, 2011.
[2]
GNS3 Documentation (21, March 14).[Online].
Available: http:// www.gns3.net
[3]
Nogueira, Antnio, and Paulo Salvador. "Teaching
Networking: A Hands-on Approach that Relies on
Emulation-based Projects." INFOCOMP 2014, The
Fourth International Conference on Advanced
Communications and Computation. 2014.
[4]
K. N. Rao, N. T. Rao, M. Sitharam, K. A. Vardhan and
P. K. Routhu, "A Study on Performance Analysis of
IPSec VPN and MPLS VPN," International Journal of
Futuristic Science and Technology, vol. 1, no. 3, pp.
184-190, 2013.
[5]
Luc De Ghein, MPLS Fundamentals, Cisco Press,
2007.
[6]
Morgan, B., Lovering, N. CCNP ISCW Official Exam
Certification Guide, Cisco Press, 2007.
[7]
Lancy Lobo, Umesh Lakshman, MPLS Configuration
on Cisco IOS, Cisco Press, 2005.
[8]
Badran,
H.F.,
"Service
provider
networking
infrastructures with MPLS,"
Computers and
Communications, 2001. Proceedings. Sixth IEEE
Symposium on, vol., no., pp.312,318, 2001.
[9]
Azam, M.A.; Zaka-Ul-Mustafa; Tahir, U.; Ahsan, S.M.;
Naseem, M.A.;Rashid, I.; Adeel, M., "Overhead
analysis of security implementation using IPSec,"
Information and Communication Technologies, 2009.
ICICT '09. International Conference on, vol., no.,
pp.70, 76, 15-16 Aug. 2009.
[10]

May-June

Sci.Int.(Lahore),27(3),2113-2119,2015

ISSN 1013-5316; CODEN: SINTE 8

Burney, S.M. Documentation [Online]. Available:

http://www.drburney.net
[12] Smith, R. D. Simulation Documentation [Online].
Available:www.modelbenders.com/encyclopedia/encycl
opedia.html
[11]

May-June

2119