Use the ethernet evc evc-id global configuration command to create an EVC. The evc-id or name is a text string from 1 to 100 bytes. Using this command moves the device into service configuration mode (config-srv) where you configure all parameters that are common to an EVC.

In this mode you can use these commands:

• default —Sets a command to its defaults
• exit —Exits EVC configuration mode
• no — Negates a command or sets its defaults
• oam —Specifies the OAM Protocol
• uni —Configures a count UNI under EVC

Configuring a service instance on a Layer 2 port or EtherChannel creates an EFP on which you configure EVC features. Each service instance has a unique number per interface, but you can use the same number on different interfaces because service instances on different ports are not related.

If you have defined an EVC by using the ethernet evc evc-id global configuration command, you can associate the EVC with the service instance (optional). There is no default behavior for a service instance. You can configure a service instance on an EtherChannel group.

Use the service instance number ethernet [name ] interface configuration command to create an EFP on a Layer 2 interface or EtherChannel and to enter service instance configuration mode. You should use service instance configuration mode to configure all management and control date plane attributes and parameters that apply to the service instance on a per-interface basis.

• The service instance number is the EFP identifier, an integer from 1 to 8000.
• The optional ethernet name is the name of a previously configured EVC. You do not need to enter an EVC name , but you must enter ethernet . Different EFPs can share the same name when they correspond to the same EVC. EFPs are tied to a global EVC through the common name.

When you enter service instance configuration mode, you can configure these options:

• default —Sets a command to its defaults
• description —Adds a service instance specific description
• encapsulation —Configures Ethernet frame match criteria
• ethernet —Configures Ethernet-lmi parameters
• exit — Exits from service instance configuration mode
• no —Negates a command or sets its defaults
• service-policy —Attaches a policy-map to an EFP
• shutdown —Takes the service instance out of service

Enter the [no ] shutdown service-instance configuration mode to shut down or bring up a service instance.

Encapsulation defines the matching criteria that maps a VLAN, a range of VLANs, Ethertype, or a combination of these to a service instance. Configure encapsulation in the service instance configuration mode. You must configure one encapsulation command per EFP (service instance).

Use the encapsulation command in service-instance configuration mode to set the encapsulation criteria. Different types of encapsulations are dot1q, dot1ad, and untagged. Valid Ethertype is IPv4.

Note	Cisco ASR 901 router does not support dot1ad encapsulation on Layer 3 service.

Encapsulation classification options also include:

• outer tag VLAN
• inner tag VLAN

After you enter an encapsulation method, these keyword options are available in service instance configuration mode:

• bridge-domain —Configures a bridge domain
• rewrite —Configures Ethernet rewrite criteria

If a packet entering or leaving a port does not match any of the encapsulations on that port, the packet is dropped, resulting in filtering on ingress. The encapsulation must match the packet on the wire to determine filtering criteria. On the wire refers to packets ingressing the router before any rewrites and to packets egressing the router after all rewrites.

Cisco ASR 901 supports counters for Switch Virtual Interface (SVI) Statistics.

A service instance must be attached to a bridge domain. Flooding and communication behavior of a bridge domain is similar to that of a VLAN domain. Bridge-domain membership is determined by which service instances have joined it (based on encapsulation criteria), while VLAN domain membership is determined by the VLAN tag in the packet.

Note	You must configure encapsulation before you can configure the bridge domain.

Use the bridge-domain bridge-id service-instance command in the configuration mode to bind the EFP to a bridge domain instance. The bridge-id is the identifier for the bridge domain instance, a number ranging from 1 to 4094.

The DHCP client retrieves the host information from the DHCP server and configures the SVI interface of the Cisco ASR 901 router. If the DHCP server is unable to provide the requested configuration parameters from its database to the DHCP client, it forwards the request to one or more secondary DHCP servers defined by the network administrator. DHCP helps you to dynamically assign reusable IP addresses to clients.

Hosts are connected to secondary VLANs, and the DHCP server assigns them IP addresses from the block of addresses assigned to the primary VLAN. When new devices are added, the DHCP server assigns them the next available address from a large pool of subnet addresses. In Cisco ASR 901 router, the DHCP client is supported only on SVI interfaces and for IPv4 addresses.

The split-horizon feature allows service instances in a bridge domain to join groups. Service instances in the same bridge domain and split-horizon group cannot forward data between each other, but can forward data between other service instances that are in the same bridge domain, but not in the same split-horizon group.

Service instances do not have to be in a split-horizon group. If a service instance does not belong to a group, it can send and receive from all ports within the bridge domain. A service instance cannot join more than one split-horizon group.

Use the bridge-domain bridge-id split-horizon group group_id service-instance command in the configuration mode to configure a split-horizon group. The group_id is a number from 0 to31. All members of the bridge-domain configured with the same group_id are part of the same split-horizon group. EFPs that are not configured with an explicit group_id do not belong to any group.

You can configure no more than 12 service instances per bridge domain. When a bridge domain contains a service instance that is part of a split-horizon group, this decreases the number of service instances allowed to be configured in that split-horizon group. The router supports up to 32 split-horizon groups plus the default (no group).

If a service instance joins split-horizon group, it can have no more than 12 members in split horizon group in the same bridge domain. We recommend that you add split horizon groups in numerical order to maximize the number of service instances that can belong to a group.

Use the rewrite command to modify packet VLAN tags. You can also use this command to emulate traditional 802.1Q tagging, where packets enter a router on the native VLAN and VLAN tagging properties are added on egress. You can also use the rewrite command to facilitate VLAN translation and QinQ.

Use the rewrite ingress tag pop 1symmetric service-instance configuration mode command to specify the encapsulation adjustment to be performed on the frame ingress to the EFP. Entering pop 1 pops (removes) the outermost tag.

Note	The symmetric keyword is required to complete the rewrite configuration.

When you enter the symmetric keyword, the egress counterpart performs the inverse action and pushes (adds) the encapsulation VLAN. You can use the symmetric keyword only with ingress rewrites and only when single VLANs are configured in encapsulation. If you configure a list of VLANs or a VLAN range or encapsulation default , the symmetric keyword is not accepted for rewrite operations.

The Cisco ASR 901 router supports only the following rewrite commands.

• rewrite ingress tag pop 1 symmetric

• rewrite ingress tag pop 2 symmetric

The router does not support rewrite commands for ingress push and translate in this release. However, you can use the rewrite ingress tag pop symmetric command to achieve translation. Possible translation combinations are 1-to-1, 1-to-2, and 2-to-1.

The Cisco ASR 901 Series Aggregation Services Router does not support egress rewrite operations beyond the second VLAN that a packet carries into a router. See the Configuring Other Features on EFPs.

DHCP snooping is a DHCP security feature that determines whether traffic sources are trusted or untrusted. By intercepting all the DHCP messages bridging within the Layer 2 VLAN domain, DHCP snooping acts as mini security firewall between clients and the DHCP server. It provides a mechanism to differentiate untrusted port of a switch connected to an end user (client) from the trusted port of a switch connected to a server or another switch or router.

DHCP snooping is one of the features that is supported on the Cisco ASR 901 Routers when these routers function as Layer 2 switches.

The DHCP relay agent, which runs at Layer 3, forwards DHCP queries in subnets where DHCP servers located. DHCP relay agent would function exclusive of DHCP snooping functioning in Layer 2 switch mode.

For more information on the DHCP Snooping feature, see the Configuring DHCP Snooping document at: http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/15S/configuration/guide/7600_15_0s_book/snoodhcp.html

Note	DHCP relay with DHCP Authentication is not supported.

The Cisco DHCP Client FORCERENEW Message feature provides entity authentication and message authentication, in accordance with RFC 3118, by which Dynamic Host Configuration Protocol (DHCP) clients and servers authenticate the identity of other DHCP entities and verify that the content of a DHCP message has not been changed during delivery through the network.

The message authentication mechanism allows servers to determine whether a request for DHCP information comes from a client that is authorized to use the network. It also allows clients to verify that a DHCP server can be trusted to provide valid configuration.

The Cisco DHCP Client FORCERENEW Message feature requires authentication, and all client-server exchanges must be authenticated. The ip dhcp client authentication mode and key chain commands must be configured.

When the client gets a FORCERENEW message, the client does the following:

• Authenticates the message according to the authentication mode specified in the ip dhcp client authentication mode command. The Cisco DHCP Client FORCERENEW Message feature supports both token-based and message digest algorithm 5 (MD5)-based authentication:
  • Token-based authentication is useful only for basic protection against inadvertently instantiated DHCP servers. Tokens are transmitted in plain text; they provide weak authentication and do not provide message authentication.
  • MD5-based authentication provides better message and entity authentication because it contains a single-use value generated by the source as a message authentication code.
• Changes its state to RENEW.
• Tries to renew its lease according to normal DHCP procedures.

The client discards any multicast FORCERENEW message or message that fails authentication.

Cisco IOS Release 15.3(2)S introduces support for EVC default encapsulation on the Cisco ASR 901 routers. This feature matches and forwards all the ingress traffic on the port. The default service instance on a port is configured using the encapsulation default command.

All traffic coming to the interface with default encapsulation is matched and forwarded. This includes untagged, single tagged, and double tagged traffic. For example, when an untagged EFP is configured, all the traffic except the untagged traffic matches the default EFP.

All Layer 2 features are supported on the default EVC.

Note	Before Cisco IOS Release 15.3(2)S, EFPs or service instances or bridge domains were not configured.

• You can configure up to 4000 bridge domains on the Cisco ASR 901 Router.
• You must configure encapsulation on a service instance before configuring bridge domain.
• ISL trunk encapsulation is not supported.
• The router does not support overlapping configurations on the same interface and same bridge domain. If you have configured a VLAN range encapsulation, or encapsulation default on service instance 1, you cannot configure any other encapsulations that also match previous encapsulations in the same interface and bridge domain.
• Default encapsulation is supported only on the physical interface and port channel interface.
• If default encapsulation EVC is configured on the interface, only the untagged encapsulation is accepted and all other encapsulation commands are rejected.
• Default EFP under xconnect and untagged EFP under bridge-domain on the same interface is not supported.
• The rewrite command on encapsulation default EVC is rejected.
• Supports only untagged EFPs on the port with default encapsulation.
• Egress filtering is not supported. All unlearned traffic ingresses on the default encapsulation interface is flooded to other interfaces that are part of the same bridge-domain.
• Layer 3 routing is not supported only under default encapsulation. Layer 2 VPN is supported on the default encapsulation EFP.
• QinQ configuration for Layer3 is not possible with pop1 rewrite. However pop2 configured routed QinQ is supported.
• Default xconnect MTU is 9216.

• The traffic packets more than 1522 are classified as Giant packets.

• For interoperability with other routers for an xconnect session, ensure that the MTU on both PE routers is same before the xconnect session is established.
• MPLS is not supported over routed QinQ.
• VLAN IDs 4093, 4094, and 4095 are reserved for internal usage.
• Traffic with tag protocol identifier (TPID) value of 9200 will pass through Xconnect and BD irrespective of the TPID value configured on them.
• Effective with Cisco IOS Release 15.4(3)S, you can configure both single-tag and priority-tag EFP with the rewrite option, on the same bridge domain.

• As untagged EFP does not support CoS, remember to set CoS value as 0 in IP SLA configuration.

• Xconnect over priority tagged EVC configuration is not supported.

• The bandwidth command on PoCH interface is not supported.

• Maximum 8 VLAN per interface and 128 VLAN per box are supported in Cisco ASR 901 Router.

To verify the configuration of EVC default encapsulation with bridge-domain, use the show command shown below.

Router# show running-config interface gigabitEthernet 0/9
Building configuration...
Current configuration : 210 bytes
!
interface GigabitEthernet0/9
no ip address
negotiation auto
service instance 1 ethernet
  encapsulation default
  bridge-domain 99
!
end

To verify the configuration of EVC default encapsulation with xconnect, use the show command shown below.

Router# show running-config interface gigabitEthernet 0/4
Building configuration...
Current configuration : 181 bytes
!
interface GigabitEthernet0/4
no ip address
negotiation auto
no keepalive
service instance 1 ethernet
  encapsulation default
  xconnect 2.2.2.2 100 encapsulation mpls
!
end

You can configure EFP service instances on EtherChannel port channels, but EtherChannels are not supported on ports configured with service instances. Load-balancing on port channels is based on the MAC address or IP address of the traffic flow on the EtherChannel interface.

Configuration Example

This example configures a service instance on an EtherChannel port channel. Configuration on the ports in the port channel are independent from the service instance configuration.

Router (config)# interface port-channel 4
Router (config-if)# service instance2ethernet
Router (config-if-srv)# encapsulation dot1q 20 
Router (config-if-srv)# bridge-domain 2

Tunneling is a feature used by service providers whose networks carry traffic of multiple customers and who are required to maintain the VLAN and Layer 2 protocol configurations of each customer without impacting the traffic of other customers. The Cisco ASR 901 router uses EFPs to support QinQ and Layer 2 protocol tunneling.

This section contains the following topics:

Cisco ASR 901 router supports pop 2 configuration.

The router supports IP routing for bridge domains, including Layer 3 and Layer 2 VPNs, using the SVI model.

This section contains the following topics:

To see MAC address information for VLANs 1 to 4094, use the show mac address-table vlan privileged EXEC command. For VLANs 4096 to 8000, use the show mac address-table bridge-domain privileged EXEC command. All other show mac address-table commands also support bridge domains as well as VLANs.

When an EFP property changes (bridge domain, rewrite, encapsulation, split-horizon, secured or unsecured, or a state change), the old dynamic MAC addresses are removed from their existing tables. This is to prevent old invalid entries from getting retained.

EFP bridge domains are supported by the Multiple Spanning Tree Protocol (MSTP). These restrictions apply when running MSTP with bridge domains.

• All incoming VLANs (outer-most or single) mapped to a bridge domain must belong to the same MST instance or loops could occur.
• For all EFPs that are mapped to the same MST instance, you must configure backup EFPs on every redundant path to prevent loss of connectivity due to STP blocking a port.
• EVC only supports MSTP.

class-map match-any CELL-TRFC
 match vlan  2615 3615
!
policy-map INPUT-SUBMAP
 class CELL-TRFC
  police cir 60000000 bc 1875000
   conform-action transmit
   exceed-action drop
policy-map INPUT-TOPMAP
 class class-default
  police cir 90000000 conform-action transmit  exceed-action drop
  service-policy INPUT-SUBMAP
policy-map INPUT-MAP
 class class-default
  police cir 60000000 bc 1875000
   conform-action transmit
   exceed-action drop
!
!
interface GigabitEthernet0/0
 no negotiation auto
 service instance 2615 ethernet
  encapsulation dot1q 2615
  service-policy input INPUT-TOPMAP
  bridge-domain 2615
 !
 service instance 3615 ethernet
  encapsulation dot1q 3615
  service-policy input INPUT-MAP
  bridge-domain 3615
 !
!
interface GigabitEthernet0/1
 no negotiation auto
!
interface GigabitEthernet0/2
 no negotiation auto
!
interface GigabitEthernet0/3
 no negotiation auto
!
interface GigabitEthernet0/4
 no negotiation auto
!
interface GigabitEthernet0/5
 no negotiation auto
!
interface GigabitEthernet0/6
 no negotiation auto
!
interface GigabitEthernet0/7
 no negotiation auto
!
interface GigabitEthernet0/8
 no negotiation auto
!
interface GigabitEthernet0/9
 no negotiation auto
 service instance 2615 ethernet
  encapsulation dot1q 100 second-dot1q 2615
  rewrite ingress tag pop 1 symmetric
  bridge-domain 2615
 !
 service instance 3615 ethernet
  encapsulation dot1q 100 second-dot1q 3615
  rewrite ingress tag pop 1 symmetric
  bridge-domain 3615
 !
!
interface GigabitEthernet0/10
 no negotiation auto
!
interface GigabitEthernet0/11
 no negotiation auto
!
interface ToP0/12
 no negotiation auto
!
interface FastEthernet0/0
 full-duplex
!
interface Vlan1
!
ip forward-protocol nd
!
!
no ip http server
!
logging esm config
!
!
!
control-plane
!
!
line con 0
line con 1
 transport preferred lat pad telnet rlogin udptn mop ssh
 transport output lat pad telnet rlogin udptn mop ssh
line vty 0 4
 login
!
exception data-corruption buffer truncate
exception crashinfo buffersize 128
!
end