Layer 2, Layer 3 or L3VPN: choosing how to take nbn
When you buy nbn services from a wholesaler, the most important question isn't the speed tier. It's where the customer's session ends, because that decides what you have to build, whose IP addresses your customers sit on, and how much of the service you actually control.
There are three ways to take it.
Layer 2: you terminate the session
The customer's traffic comes to you as Ethernet, tagged per service, over an NNI. Your BNG authenticates the session, hands out the addresses and routes it.
- Who terminates: you.
- Addressing: yours.
- Handoff: a Layer 2 NNI. On Underlay that's a 10G LR or 100G LR / LR4 port at Equinix SY1–SY4.
- You need: a BNG, RADIUS, your own address space (and CGNAT if your design uses it), transit and somewhere to put it all.
Layer 2 is where you get full control: your contention, your speed tiers, your addressing, your policy. It's also where you take on the most. It makes sense once you have enough services that the margin you're paying someone else is worth more than the network you'd have to run.
Layer 3 internet: we terminate, you sell
The session ends on our network. We authenticate it, address it and route it to the internet over our transit and peering. You don't need an NNI, a BNG or a router at all.
- Who terminates: Underlay.
- Addressing: ours, or your own range announced from our network (BYOIP).
- Handoff: none needed.
- You need: customers, a brand and the retail obligations that come with selling to them.
This is the fast way to start. You don't buy IPv4 to launch, and you don't build a core before you have anyone to put on it. If you later get your own range, it can move onto the same services.
L3VPN: every site, back to your network
The session still ends on our network, but instead of going to the internet it's placed in a private routing instance and delivered to you, over your NNI or to your colocation.
- Who terminates: Underlay.
- Addressing: yours.
- Handoff: L3VPN over your NNI, or to your rack.
- You need: a router to receive the routes, and a reason to bring the traffic home.
This is the one for MSPs and businesses that want every branch, site or client office to land on their own network: their firewall, their security policy, their breakout to the internet.
Choosing
A rough rule:
- Starting out, or selling business internet? Layer 3 internet. Nothing to build.
- Bringing sites back to your own network? L3VPN.
- Enough services that you want your own BNG? Layer 2.
You don't have to pick one forever. A common path is to start on Layer 3 internet, bring your own addresses when you have them, and move to a Layer 2 handoff into your own BNG when the numbers justify it. Moving a batch at a time, with nbn tests to check each one, keeps that migration boring.
The nbn service page has the details of each mode. If you're not sure which fits, send us the outline and an engineer will talk it through.