Configuring Virtual Private LAN Services

VPLS (Virtual Private LAN Service) enables enterprises to link together their Ethernet-based LANs from multiple sites via the infrastructure provided by their service provider. From the enterprise perspective, the service provider's public network looks like one giant Ethernet LAN. For the service provider, VPLS provides an opportunity to deploy another revenue-generating service on top of their existing network without major capital expenditures. Operators can extend the operational life of equipment in their network.

Virtual Private LAN Services (VPLS) uses the provider core to join multiple attachment circuits together to simulate a virtual bridge that connects the multiple attachment circuits together. From a customer point of view, there is no topology for VPLS. All of the CE devices appear to connect to a logical bridge emulated by the provider core (see the figure below).

The full-mesh configuration requires a full mesh of tunnel label switched paths (LSPs) between all the PEs that participate in the VPLS. With full-mesh, signaling overhead and packet replication requirements for each provisioned VC on a PE can be high.

You set up a VPLS by first creating a virtual forwarding instance (VFI) on each participating PE router. The VFI specifies the VPN ID of a VPLS domain, the addresses of other PE routers in the domain, and the type of tunnel signaling and encapsulation mechanism for each peer PE router.

The set of VFIs formed by the interconnection of the emulated VCs is called a VPLS instance; it is the VPLS instance that forms the logic bridge over a packet switched network. The VPLS instance is assigned a unique VPN ID.

The PE routers use the VFI to establish a full-mesh LSP of emulated VCs to all the other PE routers in the VPLS instance. PE routers obtain the membership of a VPLS instance through static configuration using the Cisco IOS CLI.

The full-mesh configuration allows the PE router to maintain a single broadcast domain. Thus, when the PE router receives a broadcast, multicast, or unknown unicast packet on an attachment circuit, it sends the packet out on all other attachment circuits and emulated circuits to all other CE devices participating in that VPLS instance. The CE devices see the VPLS instance as an emulated LAN.

To avoid the problem of a packet looping in the provider core, the PE devices enforce a "split-horizon" principle for the emulated VCs. That means if a packet is received on an emulated VC, it is not forwarded on any other emulated VC.

After the VFI has been defined, it needs to be bound to an attachment circuit to the CE device.

The packet forwarding decision is made by looking up the Layer 2 virtual forwarding instance (VFI) of a particular VPLS domain.

A VPLS instance on a particular PE router receives Ethernet frames that enter on specific physical or logical ports and populates a MAC table similarly to how an Ethernet switch works. The PE router can use the MAC address to switch those frames into the appropriate LSP for delivery to the another PE router at a remote site.

If the MAC address is not in the MAC address table, the PE router replicates the Ethernet frame and floods it to all logical ports associated with that VPLS instance, except the ingress port where it just entered. The PE router updates the MAC table as it receives packets on specific ports and removes addresses not used for specific periods.

Hierarchical VPLS (H-VPLS) reduces both signaling and replication overhead by using both full-mesh as well as hub and spoke configurations. Hub and spoke configurations operate with split horizon to allow packets to be switched between pseudo-wires (PWs), effectively reducing the number of PWs between PEs.

Note	Split horizon is the default configuration to avoid broadcast packet looping. To avoid looping when using the no-split-horizon keyword, be very mindful of your network configuration.

• Multipoint-to-Multipoint Support
• Non-Transparent Operation
• Circuit Multiplexing
• MAC-Address Learning Forwarding and Aging
• Jumbo Frame Support
• Q-in-Q Support and Q-in-Q to EoMPLS Support
• VPLS Services

• You can configure the Ethernet Flow Point (EFP) as the Layer 2 virtual interface. You have the option of selecting tagged or untagged traffic from the CE device.

• Configuring 802.1Q Access Ports for Tagged Traffic from a CE
• Configuring Access Ports for Untagged Traffic from CE
• Configuring Q-in-Q EFP

Router(config)# interface GigabitEthernet4/4
Router(config-if)# no ip address
Router(config-if)# negotiation auto
Router(config-if)# service instance 10 ethernet
Router(config-if-srv)# encapsulation dot1q 200
Router(config-if-srv)# bridge-domain 100

Router# show run interface GigabitEthernet4/4
Building configuration...
Current configuration : 212 bytes
!
interface GigabitEthernet4/4
 no ip address
 negotiation auto
 service instance 10 ethernet
 encapsulation dot1q 200
 bridge-domain 100
end

Router(config)# interface GigabitEthernet4/4
Router(config-if)# no ip address
Router(config-if)# negotiation auto
Router(config-if)# service instance 10 ethernet
Router(config-if-srv)# encapsulation untaggged
Router(config-if-srv)# bridge-domain 100

Router# show run interface GigabitEthernet4/4
Building configuration...
Current configuration : 212 bytes
!
interface GigabitEthernet4/4
 no ip address
 nonegotiation auto
 service instance 10 ethernet
 encapsulation untagged
 bridge-domain 100
end

Router(config)# interface GigabitEthernet4/4
Router(config-if)# no ip address
Router(config-if)# nonegotiate auto
Router(config-if)# service instance 10 ethernet
Router(config-if-srv)# encapsulation dot1q 200 second-dot1q 400
Router(config-if-srv)# bridge-domain 100

Router# show run interface GigabitEthernet4/4
Building configuration...
Current configuration : 212 bytes
!
interface GigabitEthernet4/4
 no ip address
 negotiate auto
 service instance 10 ethernet
 encapsulation dot1q 200 second-dot1q 400
 bridge-domain 100
end

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    mpls label protocol {ldp | tdp}

4.    mpls ldp logging neighbor-changes

5.    mpls ldp discovery hello holdtimeseconds

6.    mpls ldp router-id Loopback0 force

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	mpls label protocol {ldp | tdp} Example: Router(config)# mpls label protocol ldp	Specifies the default Label Distribution Protocol for a platform.
Step 4	mpls ldp logging neighbor-changes Example: Router(config)# mpls ldp logging neighbor-changes	(Optional) Determines logging neighbor changes.
Step 5	mpls ldp discovery hello holdtimeseconds Example: Router(config)# mpls ldp discovery hello holdtime 5	Configures the interval between transmission of LDP (TDP) discovery hello messages, or the hold time for a LDP transport connection
Step 6	mpls ldp router-id Loopback0 force Example: Router(config)# mpls ldp router-id Loopback0 force	Configures MPLS.

• Examples

Router(config)# mpls label protocol ldp
Router(config)# tag-switching tdp discovery directed hello 
Router(config)# tag-switching tdp router-id Loopback0 force

Router# show ip cef 192.168.17.7
192.168.17.7/32, version 272, epoch 0, cached adjacency to POS4/1
0 packets, 0 bytes
  tag information set
    local tag: 8149
    fast tag rewrite with PO4/1, point2point, tags imposed: {4017}
  via 11.3.1.4, POS4/1, 283 dependencies
    next hop 11.3.1.4, POS4/1
    valid cached adjacency
    tag rewrite with PO4/1, point2point, tags imposed: {4017}

SUMMARY STEPS

1.    l2 vfi name manual

2.    vpn id vpn-id

3.    neighbor remote router id {encapsulation mpls} [no-split-horizon]

4.    bridge-domain bd-id

DETAILED STEPS

	Command or Action	Purpose
Step 1	l2 vfi name manual Example: Router(config)# l2 vfi vfi110 manual Example:	Enables the Layer 2 VFI manual configuration mode.
Step 2	vpn id vpn-id Example: Router(config-vfi)# vpn id 110 Example:	Configures a VPN ID for a VPLS domain. The emulated VCs bound to this Layer 2 VRF use this VPN ID for signaling.
Step 3	neighbor remote router id {encapsulation mpls} [no-split-horizon] Example: Router(config-vfi)# neighbor 1.5.1.1 encapsulation mpls Example:	Specifies the remote peering router ID and the tunnel encapsulation type or the pseudo-wire property to be used to set up the emulated VC. Note    Split horizon is the default configuration to avoid broadcast packet looping and to isolate Layer 2 traffic. Use the no-split-horizon keyword to disable split horizon and to configure multiple VCs per spoke into the same VFI.
Step 4	bridge-domain bd-id Example: Router(config-vfi)# bridge-domain 100	Specifies bridge domain.

• Examples

Router(config)# l2 vfi VPLSA manual
Router(config-vfi)# vpn id 110
Router(config-vfi)# neighbor 11.11.11.11 encapsulation mpls
Router(config-vfi)# neighbor 33.33.33.33 encapsulation mpls
Router(config-vfi)# neighbor 44.44.44.44 encapsulation mpls
Router(config-vfi)# bridge-domain 100

Router(config)# l2 vfi VPLSA manual
Router(config-vfi)# vpn id 110
Router(config-vfi)# neighbor 9.9.9.9 encapsulation mpls
Router(config-vfi)# neighbor 12.12.12.12 encapsulation mpls
Router(config-vfi)# neighbor 33.33.33.33 encapsulation mpls no-split-horizon
Router(config-vfi)# bridge-domain 100

VPLS-PE2# show mpls l2transport vc 201
Local intf     Local circuit        Dest address    VC ID      Status
-------------  -------------------- --------------- ---------- ----------
VFI test1      VFI                  153.1.0.1       201        UP
VFI test1      VFI                  153.3.0.1       201        UP
VFI test1      VFI                  153.4.0.1       201        UP

nPE-3# show vfi VPLS-2
VFI name: VPLS-2, state: up
  Local attachment circuits:
    Vlan2  
  Neighbors connected via pseudowires:
  Peer Address     VC ID     Split-horizon
  1.1.1.1          2             Y
  1.1.1.2          2             Y
  2.2.2.3          2             N

VPLS integrated routing and bridging can route Layer 3 traffic as well as switch Layer 2 frames for pseudowire connections between provider edge (PE) devices using Virtual Private LAN Services (VPLS) multipoint PE. The ability to route frames to and from these interfaces supports termination of a pseudowire into a Layer 3 network (VPN or global) on the same switch, or to tunnel Layer 3 frames over a Layer 2 tunnel (VPLS).

Note	VPLS integrated routing and bridging is also known as routed pseudowire and routed VPLS.

• VPLS integrated routing and bridging does not support multicast routing.

To configure routing support for the pseudowire, configure an IP address and other Layer 3 features for the Layer 3 domain (VPN or global) in the interface configuration.

• The following example assigns the IP address 10.10.10.1 to a BDI interface.

interface bdi 100
  ip address 10.10.10.1 255.255.255.0 

• The following example assigns an IP address 20.20.20.1 to a BDI interface.

interface bdi 200
  ip address 20.20.20.1 255.255.255.0

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    pseudowire-class pw-name

4.    encapsulation mpls

5.    protocol none

6.    preferred-path interface Tunnel-tp

7.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	pseudowire-class pw-name Example: Router(config)# pseudowire-class static-vlps	Establishes a pseudowire class with a name that you specify. Enters pseudowire class configuration mode.
Step 4	encapsulation mpls Example: Router(config-pw-class)# encapsulation mpls	Specifies the tunneling encapsulation. For AToM, the encapsulation type is mpls.
Step 5	protocol none Example: Router(config-pw-class)# protocol none	Specifies that no protocol is configured for pseudowire class
Step 6	preferred-path interface Tunnel-tp Example: Router(config-pw-class)# preferred-path interface Tunnel-tpl	(Optional) Configures the preferred path.
Step 7	end Example: Router(config-pw-class)# end	Returns to global configuration mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    l2 vfi vfi-name manual

4.    vpn id vpn-id

5.    bridge-domain bd-id

6.    neighbor ip-address pw-class pw-name

7.    mpls label local-pseudowire-label remote-pseudowire-label

8.    [no] mpls control-word

9.    exit

10.    neighbor ip-address pw-class pw-name

11.    mpls label local-pseudowire-label remote-pseudowire-label

12.    mpls control-word

13.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	l2 vfi vfi-name manual Example: Router(config)# l2 vfi static-vfi manual	Creates a Layer 2 VFI and enters Layer 2 VFI manual configuration mode.
Step 4	vpn id vpn-id Example: Router(config-vfi)# vpn id 100	Specifies the VPN ID.
Step 5	bridge-domain bd-id Example: Router(config-vfi)# bridge-domain 24	Specifies the bridge domain ID.
Step 6	neighbor ip-address pw-class pw-name Example: Router(config-vfi)# neighbor 2.3.4.4 pw-class static-vpls	Specifies the IP address of the peer and the pseudowire class.
Step 7	mpls label local-pseudowire-label remote-pseudowire-label Example: Router(config-vfi-neighbor)# mpls label 301 17	Configures an Any Transport over MPLS (AToM) static pseudowire connection by defining local and remote circuit labels .
Step 8	[no] mpls control-word Example: Router(config-vfi-neighbor)# mpls control-word	(Optional) Enables the Multiprotocol Label Switching (MPLS) control word in an Any Transport over MPLS (AToM) static pseudowire connection .
Step 9	exit Example: Router(config-vfi-neighbor)# exit	Exits the current configuration mode and returns to VFI manual configuration mode.
Step 10	neighbor ip-address pw-class pw-name Example: Router(config-vfi)# neighbor 2.3.4.3 pw-class static-vpls	Specifies the IP address of the peer and the pseudowire class.
Step 11	mpls label local-pseudowire-label remote-pseudowire-label Example: Router(config-vfi-neighbor)# mpls label 302 18	Configures an Any Transport over MPLS (AToM) static pseudowire connection by defining local and remote circuit labels .
Step 12	mpls control-word Example: Router(config-vfi-neighbor)# mpls control-word	Enables the Multiprotocol Label Switching (MPLS) control word in an Any Transport over MPLS (AToM) static pseudowire connection .
Step 13	end Example: Router(config-vfi-neighbor)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface gigabitethernet slot/interface

4.    service instance si-id ethernet

5.    encapsulation dot1q vlan-id

6.    rewrite ingress pop number symmetric

7.    bridge-domain bd-id

8.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface gigabitethernet slot/interface Example: Router(config)# interface gigabitethernet 1/0	Specifies the Gigabit Ethernet subinterface and enters subinterface configuration mode. Make sure the subinterfaces between the CE and PE routers that are running Ethernet over MPLS are in the same subnet. All other subinterfaces and backbone routers do not need to be in the same subnet.
Step 4	service instance si-id ethernet Example: Router(config-if)# service instance 10 ethernet	Specifies the service instance ID.
Step 5	encapsulation dot1q vlan-id Example: Router(config-vfi)# encapsulation dot1q 200	Enables the subinterface to accept 802.1Q VLAN packets. Make sure the subinterface on the adjoining CE router is on the same VLAN as this PE router.
Step 6	rewrite ingress pop number symmetric Example: Router(config-if)# rewrite ingress pop 1 symmetric	(Optional) Specifies the ingress rewrite
Step 7	bridge-domain bd-id Example: Router(config-vfi)# bridge-domain 24	( Optional) When the MVR source bridge domain and MVR receiver ports are in a different bridge domain, specifies the bridge domain for which the MVR configuration will be done.
Step 8	end Example: Router(config-if)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface Tunnel-tp number

4.   no ip address

5.   no keepalive

6.   tp destination ip-address

7.   bfd tp

8.   working-lsp

9.   out-label number out-link number

10.    in-label number

11.    lsp-number number

12.    exit

13.    protect-lsp

14.   out-label number out-link number

15.    in-label number

16.    lsp-number number

17.    exit

18.    interface interface-name

19.   ip address ip_address ip-mask

20.   mpls tp link number {ipv4 ip_address | tx-mac mac_address}

21.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface Tunnel-tp number Use the same interface as you configured for the pseudowire class above. Example: Router(config)# interface Tunnel-tp 4	Configures a MPLS Transport Profile interface. Enters interface configuration mode.
Step 4	no ip address Example: Router(config-if)# no ip address	Disables the IP address configuration.
Step 5	no keepalive Example: Router(config-if)# no keepalive	Disables the keepalive configuration.
Step 6	tp destination ip-address Example: Router(config-if)# tp destination 22.22.22.22	Configures the tunnel destination.
Step 7	bfd tp Example: Router(config-if)# bfd tp	Configures the Bidirectional Forwarding Detection (BFD) protocol.
Step 8	working-lsp Example: Router(config-if)# working-lsp	Configures the working label switched path (LSP).
Step 9	out-label number out-link number Example: Router(config-if-working)# out-link 10 out-label 100	Configures the out link and out label for the working LSP.
Step 10	in-label number Example: Router(config-if-working)# in-label 400	Configures the in label for the working LSP.
Step 11	lsp-number number Example: Router(config-if-working)# lsp 0	Configures the ID number for the working LSP.
Step 12	exit Example: Router(config-if-working)# exit	Returns to interface configuration mode.
Step 13	protect-lsp Example: Router(config-if)# protect-lsp	Enters protection configuration mode for the label switched path (LSP).
Step 14	out-label number out-link number Example: Router(config-if-protect)# out-link 11 out-label 500	Configures the out link and out label for the protect LSP.
Step 15	in-label number Example: Router(config-if-protect)# in-label 600	Configures the in label for the protect LSP.
Step 16	lsp-number number Example: Router(config-if-protect)# lsp-number 0	Configures the ID number for the working protect LSP.
Step 17	exit Example: Router(config-if-working)# exit	Returns to interface configuration mode.
Step 18	interface interface-name Example: Router(config-if)# interface Ethernet1/0	Configures a interface and enters interface configuration mode.
Step 19	ip address ip_address ip-mask Example: Router(config-if)# ip address 20.0.0.1 255.255.255.0	(Optional) Configures the IP address and mask if not using IP-less core.
Step 20	mpls tp link number {ipv4 ip_address | tx-mac mac_address} Example: Router(config-if)# mpls tp link 10 ipv4 20.0.0.2	Configures the MPLS Transport Profile link number and ARP translation.
Step 21	end Example: Router(config-if)# end	Returns to global configuration mode.