3Com MSR 50 Series Configuration Manual page 1479

MPLS L3VPN Overview 1479
Figure 420 Network diagram for sham link
Sham-link
MPLS backbone
PE 1
PE 1
Site 1 Site 2
CE 12 CE 22
OSPF Area 1
OSPF Area 1
Backdoor-link
VPN 1 VPN 1
To solve the problem, you can establish a sham link between the two PEs so that
the routes between them over the MPLS VPN backbone become an intra-area
route.
The sham link acts as an intra-area point-to-point link and is advertised through
the Type 1 LSA. You can select a route between the sham link and backdoor link
by adjusting the metric.
The sham link is considered the link between the two VPN instances with one
endpoint address in each VPN instance. The endpoint address is a loopback
interface address with a 32-bit mask in the VPN address space on the PE. Different
sham links of the same OSPF process can share an endpoint address, but that of
different OSPF processes cannot.
BGP advertises the endpoint addresses of sham links as VPN-IPv4 addresses. A
route across the sham link cannot be redistributed into BGP as a VPN-IPv4 route.
A sham link can be configured in any area. You need to configure it manually. In
addition, the local VPN instance must have a route to the destination of the sham
link.
Multi-VPN-Instance CE
Multiple OSPF instances usually run on PEs. A router on a LAN that runs multiple
OSPF instances is called a multi-VPN-instance CE. Compared with the OSPF
multi-instance on PEs, a multi-VPN-instance CE does not need to support the
BGP/OSPF interoperability.
Multi-VPN-instance CEs are used to solve the security problem of LANs at a lower
cost.
It is hard to implement the complete separation of services on LANs with
traditional routers. Currently, a router supports multiple OSPF processes, which can
belong to the public network or a VPN instance. Therefore, you can run multiple
OSPF processes on a router and bind them to different VPN instances.
In practice, you can create OSPF instances for different services to separate services
and ensure their security.