VPLS LAB 1 - Example

Before you configure VPLS, you need to ensure that IP routing and MPLS forwarding are configured properly and that the minimal Layer 2 VPN connectivity requirements

Every PE router has a loopback interface that is configured with an IP address and a /32 network mask >  Router ID in LDP signaling for the PE router.

PE routers have IP connectivity to each other >  LDP Neighborship

PE routers have MPLS label switched paths (LSPs) for those host route > Activate MPLS Routing


Attachment circuits that are used in VPLS can be Layer 2 switch-port interfaces, Gigabit Ethernet interfaces on intelligent line cards, or other interfaces with bridged encapsulation.

Before going into the configuration steps for Layer 2 switchport interface, it is necessary to explain the difference and the correlation between a service-delimiting VLAN tag and an internal VLAN tag


Service providers use service-delimiting VLAN tags to identify different types of customer traffic. Because a service-delimiting VLAN tag usually has only local significance, it is removed at the ingress PE router. The egress PE router might have a different service-delimiting VLAN tag, which is added to the packets that are sending to a CE router.


An internal VLAN tag identifies a bridge domain on a PE router. In the context of VPLS, it is the virtual switch.
 Conceptually, service-delimiting VLAN tags and internal VLAN tags are two independent entities.

A port can operate in 3 different modes as:

Access :The interface sends and accepts untagged Ethernet packets only. Tagged Ethernet VLAN packets are dropped.

interface FastEthernet4/3
 no ip address
 switchport
 switchport access vlan 2
 switchport mode access


 Trunk : The interface sends and receives tagged Ethernet VLAN packets and native VLAN packets.

 interface FastEthernet4/3
 no ip address
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 2-10
 switchport mode trunk
 

Dot1q Tunnel : Any packet, tagged or untagged, is forwarded through a QinQ tunnel. A QinQ tunnel is identified by the access VLAN tag that is configured on the Layer 2 switchport interface. The access VLAN tag is added to the packet at the ingress tunnel interface and removed at the egress tunnel interface, which means that the VLAN tags must be identical at both interfaces for a given QinQ tunnel.

QinQ tunneling is an Ethernet native tunneling mechanism that stacks VLAN tags together in a similar fashion to the MPLS labels. The outer VLAN tag that is added at the tunnel ingress interface is the access VLAN tag that is configured on the Layer 2 switchport interface. The purpose of the outer VLAN tag is similar to that of the tunnel label in an MPLS-encapsulated pseudowire packet. The outer VLAN tag is to forward the packet from the ingress tunnel endpoint to the egress tunnel endpoint and hide the inner VLAN tag from the transit network.
In VPLS, the transit network is an MPLS network, and a tunnel label is used to move packets from the LSP ingress endpoint to the egress endpoint. Because the function of an outer VLAN tag is effectively replaced by an MPLS tunnel label, the outer VLAN tag is no longer added to the Ethernet header when the Layer 2 switchport interface is configured as dot1q-tunnel mode. That is the main difference in the way dot1q-tunnel mode operates in VPLS versus normal bridging.

The main difference is dot1q tunneling and VPLS mechanism is ;
the outer VLAN tag is replaced with MPLS Tunnel Labels !!!!! 


 interface FastEthernet4/3
 no ip address
 switchport
 switchport access vlan 2
 switchport mode dot1q-tunnel


Configuring VFI : 

We need mapping mechanisim like ( Frame Relay = DLCI, ATM= PVC etc)

In this case;

VPLS = VFI
Also VFI needs some VPN ID.

l2 vfi blue manual
 vpn id 100
 neighbor 10.0.0.2 encapsulation mpls
 neighbor 10.0.0.3 encapsulation mpls
 neighbor 10.0.0.4 encapsulation mpls


Associating Attachment Circuits to the VFI:

The final step is building the many-to-many mapping involves how to associate attachment circuits to a VFI in configuration.


 Step 1.
  VPLS-PE1(config)#interface vlan 2


Note that the VLAN ID needs to be identical to the service-delimiting VLAN tag when using Layer 2 switchport trunk mode. Otherwise, it can be the tag value of an unused VLAN.

Step 2.
Attach the VFI to the VLAN interface:

  VPLS-PE1(config-if)#xconnect vfi blue




CE1 sends and receives untagged Ethernet packets, null service-delimiting VLAN tags.
PE1 configures the switchport mode as dot1q-tunnel to forward packets that have an unmodified Ethernet header. 


The internal VLAN that is associated with the switchport is 2.


CE2 sends and receives tagged Ethernet VLAN packets of which the service-delimiting VLAN tag is 4. PE2 configures the switchport mode as a trunk to remove or add the service-delimiting VLAN tag accordingly. The internal VLAN that is associated with the switchport is 4.

CE3 sends and receives untagged Ethernet packets that, null service-delimiting VLAN tags. PE3 configures the switchport mode as access to forward all untagged packets. The internal VLAN that is associated with the switchport is 8.

CE4 sends and receives tagged Ethernet VLAN packets of which the service-delimiting VLAN tag is 10. PE4 configures the switchport mode as a trunk to remove or add the service-delimiting VLAN tag accordingly. The internal VLAN that is associated with the switchport is 10.



hostname PE1
!
mpls label protocol ldp
mpls ldp logging neighbor-changes
mpls ldp router-id Loopback0
!
l2 vfi l2vpn manual
 vpn id 1
 neighbor 10.0.0.2 encapsulation mpls
 neighbor 10.0.0.3 encapsulation mpls
 neighbor 10.0.0.4 encapsulation mpls
!
interface Loopback0
 ip address 10.0.0.1 255.255.255.255
!
interface POS3/1
 ip address 10.0.1.1 255.255.255.252
 mpls ip
!
interface FastEthernet4/2
 no ip address
 switchport
 switchport access vlan 2
 switchport mode dot1q-tunnel
!
interface Vlan2
 no ip address
 xconnect vfi l2vpn

PE2 --

hostname PE2
!
mpls label protocol ldp
mpls ldp logging neighbor-changes
mpls ldp router-id Loopback0
!
l2 vfi l2vpn manual
 vpn id 1
 neighbor 10.0.0.1 encapsulation mpls
 neighbor 10.0.0.3 encapsulation mpls
 neighbor 10.0.0.4 encapsulation mpls
!
interface Loopback0
 ip address 10.0.0.2 255.255.255.255
!
interface POS3/1
 ip address 10.0.2.1 255.255.255.252
 mpls ip
!
interface FastEthernet4/2
 no ip address
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 4
 switchport mode trunk
!
interface Vlan4
 no ip address
 xconnect vfi l2vpn

PE3

hostname PE3
!
mpls label protocol ldp
mpls ldp logging neighbor-changes
mpls ldp router-id Loopback0
!
l2 vfi l2vpn manual
 vpn id 1
 neighbor 10.0.0.1 encapsulation mpls
 neighbor 10.0.0.2 encapsulation mpls
 neighbor 10.0.0.4 encapsulation mpls
!
interface Loopback0
 ip address 10.0.0.3 255.255.255.255
!
interface POS3/1
 ip address 10.0.3.1 255.255.255.252
 mpls ip
!
interface FastEthernet4/2
 no ip address
 switchport
 switchport access vlan 8
 switchport mode access
!
interface Vlan8
 no ip address
 xconnect vfi l2vpn

Example 15-8 shows the configuration on PE4.

Example 15-8. PE4 Configuration

hostname PE4
!
mpls label protocol ldp
mpls ldp logging neighbor-changes
mpls ldp router-id Loopback0
!
l2 vfi l2vpn manual
 vpn id 1
 neighbor 10.0.0.1 encapsulation mpls
 neighbor 10.0.0.2 encapsulation mpls
 neighbor 10.0.0.3 encapsulation mpls
!
interface Loopback0
 ip address 10.0.0.4 255.255.255.255
!
interface POS3/1
 ip address 10.0.4.1 255.255.255.252
 mpls ip
!
interface FastEthernet4/2
 no ip address
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10
 switchport mode trunk
!
interface Vlan10
 no ip address
 xconnect vfi l2vpn
After full connectivity is established among all CE routers, every PE router should learn all MAC addresses from the CE routers.
 

VPLS

Hi FOLKS!

Currently , I am reading Cisco Press Book- Layer 2 VPN Architecture which it includes good context and full of cool examples.

Here are the parts that I want to share ;





The inherent broadcast nature of Ethernet makes it easy for networked devices to discover one another.

 VPLS extends that broadcast capability to the reach that is possible only with a WAN infrastructure.

In VPLS, end users perceive that the network devices are connected directly to a common LAN segment, which is in fact an emulated LAN created by VPLS, also known as aVPLS domain.


As a multipoint architecture, VPLS allows a single physical or logical CE-PE link to be used for transmitting Ethernet packets to multiple remote CE routers.

With VPLS, packets are no longer forwarded based on the one-to-one mapping between an attachment circuit and a pseudowire on a PE router.
Rather, a PE router uses a Layer 2 forwarding table to determine the outgoing paths based on the destination MAC addresses

 A Layer 2 forwarding table is populated dynamicallywith MAC addresses and next-hop interfaces through the learning process. 


Service Definitions

VPLS offers two types of service:

TLS

Ethernet Virtual Connection Service (EVCS)



 TLS:






The services are differentiated by the way that MAC addresses are learned and the way that bridging protocol data units (BPDU) are processed. 


TLS performs unqualified learning, in which all customer VLANs of a Layer 2 VPN are treated as if they were in the same broadcast domain.

Source MAC addresses are learned and forwarding entries are populated in the same Layer 2 forwarding table regardless of whether they are tagged or untagged.







This means that MAC addresses have to be unique among all customer VLANs.
!!Overlapping MAC addresses can cause confusion in the Layer 2 forwarding table and result in loss of customer packets.

Besides tagged and untagged Ethernet packets, a PE router that provides TLS also forwards BPDUs that it receives from the CE-facing interface to other interfaces or pseudowires without processing.

 Such transparency in BPDU forwarding makes the CE routers perceive that they are connected directly through an Ethernet hub instead of through a series of virtual switches,

EVCS:






For customers who want to keep a separate broadcast domain for each VLAN, EVCS is a more appropriate choice.


In EVCS, the outer VLAN tag on the Ethernet packet differentiates one customer VLAN instance from another.


Each VLAN has its own MAC address space, which allows qualified learning.


EVCS keeps the broadcast domain on a per-VLAN basis and does not extend the spanning tree across the MPLS network.
BPDU packets from CE routers are dropped or processed at PE routers.
In such cases, CE routers do not see each other directly in the spanning tree.

Suppose that a VPLS customer has four sites that form two separate broadcast domains.

 CE1 and CE2 connect to the same PE router but belong to different broadcast domains.
802.1q VLAN encapsulation is used between the CE routers and PE router to separate the traffic of different broadcast domains.


Virtual Switch

 
 Each service that is defined in the previous section is offered by a virtual switch inside a PE router.

When provisioned to support multiple VPLS customers, the PE router effectively is partitioned into multiple virtual switches.

A given PE router has at most one virtual switch for every VPLS domain.

A virtual switch consists of a bridge module, an emulated LAN interface, and a virtual forwarding instance (VFI)


The bridge module in a virtual switch has the equivalent role of that in a physical Ethernet switch. It makes no distinction between the emulated LAN interface and any physical LAN interface in terms of bridging functions, such as MAC address learning and aging, and packet flooding.

 Besides the bridge module maintaining a forwarding table that maps MAC addresses to attachment circuits, it can run spanning-tree protocols on them.

A VFI has similar functionality to a bridge but performs bridging operations on pseudowires instead of attachment circuits. It maintains a forwarding table that maps MAC addresses to pseudowires. The forwarding table is populated through the MAC address learning process based on packets it receives on pseudowires. It never learns the MAC addresses of the packets it receives on attachment circuits.

Hierarchical VPLS


Aiming at having the benefits of both basic topologic models while mitigating their problems, a hybrid between the full-mesh and hub-and-spoke models is now available, known as hierarchical VPLS.
Depending on the type of network that is deployed at the bottom tier, hierarchical VPLS comes in two forms:

Hierarchical VPLS with MPLS access network

Hierarchical VPLS with QinQ access network

 

Hierarchical VPLS with MPLS Access NetworkAs shown in Figure 15-5, for a given VPLS domain, virtual switches in the top tier are fully meshed through pseudowires. Each virtual switch in the bottom tier has exactly one pseudowire that connects to a top-tier virtual switch, which is effectively a hub-and-spoke model. This form of hierarchical VPLS is known as hierarchical VPLS with MPLS access. 




PE routers in the top tier and bottom tier are also known as network-facing PE (N-PE) routers and user-facing PE (U-PE) routers, respectively. To ensure loop-free forwarding, an N-PE router must enable Layer 2 split horizon on all pseudowires that connect to other N-PE routers and disable split horizon on all pseudowires that connect to U-PE routers. 

Hierarchical VPLS with QinQ Access Network

Hierarchical VPLS has an alternate form that uses Ethernet QinQ tunnels between U-PE and N-PE routers, as depicted in Figure 15-6. It is also known as hierarchical VPLS with QinQ access. Instead of a pseudowire, you can use an Ethernet QinQ tunnel between a U-PE router and an N-PE router. 

 



Despite the absence of pseudowires in the bottom tier, the overall bridging architecture is still based on two logically separated layers, where an N-PE router forwards packets to pseudowires that connect to other N-PE routers only if they arrive on QinQ tunnels that connect to U-PE routers.  



VPLS Redundancyn the hierarchical VPLS model, an N-PE router can still be a single point of failure for attached U-PE routers. To solve this problem, each U-PE can connect to multiple N-PE routers through redundant pseudowires or QinQ tunnels.
 This method for providing redundancy is also known as multihoming. 

In this case, Layer 2 split horizon alone is no longer sufficient for providing loop-free forwarding. You need to enable spanning-tree protocols between U-PE and N-PE routers. 
 
When a U-PE router multihomes with N-PE routers, you must enable spanning-tree protocols on the U-PE router for all the pseudowires or QinQ tunnels that exist between the U-PE and N-PE routers.

However, an N-PE router can choose whether to participate in spanning-tree protocols.


If it does, it behaves like an Ethernet bridge that exchanges and processes BPDUs with U-PE and other N-PE routers of the same island. 

If it does not, it acts as an Ethernet hub that simply relays BPDUs without processing.

FoMPLS - ATOM

I will share a basic example of pseudo-wire frame relay config on MPLS medium ;

It is so similar to EoMPLS, just additional few new syntax with frame-relay stuff.

PS :
PE1-P-PE2 same OSPF Domain (don't advertise the networks towards the customer side)
PE1-P-PE2 run MPLS

Store :

interface Serial1/0
 ip address 172.16.15.1 255.255.255.0
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay interface-dlci 105

Pe1:

frame-relay switching

interface Serial2/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay intf-type dce
!

connect PE1-PE2 Serial2/0 105 l2transport
 xconnect 4.4.4.4 15 encapsulation mpls
!

PS :

This Layer 2 VPN runs on MPLS, so we can obviously see local LDP bindings in LFIB for CE side prefixes.

Label 19 Local

More Layer 2 VPN - EoMPLS

Have you ever wondered why we are currently using this technology on various service providers?



 


- Allows service providers to have single infrastructure for both IP and legacy services. 



 
Layer 2 VPNs are complementary to Layer 3 VPN's !!!!!

 

VPLS > MPLS Based

Ethernet Pseudo Wires (EoMPLS)  > MPLS Based

L2TP > IP Based

ATOM > MPLS Based

 

So we can call the pseudo-wire connections is a kind of tunneling mechanisim between PE and PEdevices which connectets different network circuits.

Interworking

Interworking is actually a transforming function that is required to interconnect two heterogeneous ACs, by providing the translation between the different L2 encapsulations.  
Later, I will share an example for Interworking ...


Difference between VPLS and EoMPLS is

  - VPLS is point-to-multipoint
  - EoMPLS is Point to Point


We use xconnect on EoMpls as l2tp configuration.

VPLS use different syntax that I will share an example.

Another difference is ;

The VPLS configuration creates a (integrated routing bridging) bridge in the PE router and adds the created pseudowire to the bridge

EoMPLS does not include such bridge.



So, VPLS uses a bridge to join the pseudowires and the physical interface


EoMPLS uses a xconnect to join a single pseudowire and the physical interface.


PS :

Like QinQ tunneling (802.1q tunneling of switched traffic), EoMPLS just takes the frame that comes in a port (somehow), transports it across the middle, and spits it out the paired port on the other end. There is no examination of MAC address, no learning of source MAC address, in short, no switching logic applied.










EoMPLS LAB :

R8 customer wants to communicate with R9 in same vlan domain (currently 234)

You have MPLS backbone ! and you are going to bind just 2 customer ; the secret answer is
EoMPLS indeed !!!!

EoMPLS sometimes is called like ATOM ( Any Type over MPLS = could be ethernet , FR, ATM .. )
I just like to call it as

Pseudowire Ethernet over MPLS 

 

pe1#
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ip ospf network point-to-point
!
interface GigabitEthernet0/0
 ip address 10.0.0.7 255.255.255.252
 mpls label protocol ldp
 mpls ip
!
router ospf 1
 router-id 2.2.2.2
 network 2.2.2.2 0.0.0.0 area 0
 network 10.0.0.0 0.0.0.3 area 0
!
mpls ldp router-id Loopback0 force
!
interface GigabitEthernet0/1.234
 encapsulation dot1Q 234
 xconnect 4.4.4.4 234 encapsulation mpls

pe2#
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
 ip ospf network point-to-point
!
interface GigabitEthernet0/0
 ip address 10.0.0.12 255.255.255.252
 mpls label protocol ldp
 mpls ip

router ospf 1
 router-id 4.4.4.4
 network 4.4.4.4 0.0.0.0 area 0
 network 10.0.0.0 0.0.0.3 area 0
!
mpls ldp router-id Loopback0 force
!
interface GigabitEthernet0/1.234
 encapsulation dot1Q 234
 xconnect 2.2.2.2 234 encapsulation mpls