Senior management wants you to evaluate the risks to your network of offering VPWS, VPLS, GRE, or other tunneling services to your fiber-connected client base. Clients indicate that they prefer to use

VPWS (Virtual Private Wire Service) uses MPLS pseudowires to create point-to-point Layer 2 connections, keeping customer traffic fully encapsulated within the provider MPLS core and away from provider infrastructure. It natively supports Layer 2 switch CEs and provides strong provider-customer separation, meaning a customer broadcast storm or STP event cannot propagate into the provider network.

Standard 802.1Q uses a single shared VLAN namespace between provider and customer, creating risk of VLAN ID conflicts and insufficient isolation between provider and customer networks.

GRE is a Layer 3 tunneling protocol that requires routers as CEs, directly conflicting with the client requirement to use Layer 2 switches as customer edge devices.

VPLS is an MPLS-based multipoint Layer 2 service, but it floods customer broadcast and unknown unicast traffic across all pseudowires and exposes the provider core to customer Spanning Tree BPDUs, creating higher risk than VPWS.

QinQ (802.1ad) double-tagging encapsulates customer 802.1Q frames within an outer provider VLAN tag, completely separating customer and provider VLAN namespaces. This requires no changes to customer Layer 2 switches acting as CEs and limits provider exposure because customer frames are opaque to the provider switching domain.