A typical VPN has the following layers:
Access layer
The devices on the access layer provide access services for users. These devices do not need to implement many functions, but must provide many access interfaces. For metropolitan area networks (MANs) in big cities, the access layer needs to provide more functions besides the access function.
Generally, a CE is dual-homed or multi-homed to access nodes on the access layer. Dual homing can be either physical or logical. In physical dual homing, a CE accesses two nodes over two physical links; in logical dual homing, a CE accesses two nodes that reside on a ring.
Convergence layer
The convergence layer has either a mesh topology or a ring topology.
Backbone layer
The backbone layer must have a full-mesh topology and multi-level backup. The devices on the backbone layer are generally connected through high-speed interfaces.