This paper describes the specification of a management architecture allowing virtual private network (VPN) customers to dynamically modify the configuration of their VPN. The specification has been structured according to the ODP viewpoints. A special emphasis has been laid on how changes in the logical VPN configuration affect or are reflected in the underlying physical networks. As a result, an informational and a computational VPN configuration management architecture have been developed illustrating how processing and data can be distributed between the different layers and domains composing the architecture.