Wednesday, December 21, 2016

CCIE SPv4 - MPLS L2VPN - Hierarchical VPLS (H-VPLS) - MPLS Access and PW Redundancy

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:

In this post we will be taking a look at H-VPLS. We've taken a look at VPLS in previous posts, however, H-VPLS is scalability enhancement to VPLS as you may know it. With traditional VPLS, all PEs that wish to exchange customer data must join the bridge domain used to propagate the L2 traffic. Much in the same way that traditional iBGP works, if no route reflection is used, all iBGP speakers must connect to all other iBGP speakers. H-VPLS works in much the same manner. We have to introduce some new terms and their functions before we tackle the config. 

U-PE - User Provider Edge: This is the PE that participates in forwarding with the customer equipment, this could be a switch or a router. The router forms PW peerings with the MPLS core of N-PEs and is the entry point of customer data into the SP network. The UPE can connect to 1 or multiple NPEs for redundancy. In this post we will focus on 1 UPE connecting to 1 NPE for easing into this topic, I'll do another post focusing on redundancy and failover options. 

N-PE - Network Provider Edge: This is the PE that participates in MPLS SP core forwarding and forms PW peerings with the UPEs. Think of the NPE as loosely analogous to the BGP route reflector, it does more than host the control plane and sits in the data plane. It enables the "hierarchy" that makes H-VPLS possible. As previously stated, traditional VPLS PEs form a "full mesh" of peering with other PEs. In H-VPLS, UPEs only form PW peerings with NPEs. NPEs form a full mesh of PW peerings with other NPEs. That's where the "loosely" part comes into play, it reduces the UPE full mesh requirement, beyond that, no real savings. 

Let's take the above topology, we'll focus on 2 different parts, R4, R5 and R2 will be the "NPEs", XR5 and XR6 are Provider core routers,  and R1, R3, R6 and XR3 will be the "UPEs". The NPEs will form a full mesh of peerings and terminate the "SP Access". SP Access relates to the part of the SP network that customers connect to, the SP core is the part where no customers connect. So the NPEs are the SP core and the UPEs are the SP access. As stated in previous posts, XRv doesn't support the L2 VPN data plane, we'll just get the control plane up and running. *NOTE* XRv doesn't appear to support the NPE feature.

Since the UPEs are configured with the "xconnect" context and the NPEs are configured with the "vfi" contexts, the deployment is slightly different. The UPE pretty much acts like a intermediary device between the customer and the NPE router. Since we'll be dealing with 2 PWs, we'll configure the redundancy on the UPEs as we go. 

UPE to NPE peerings

R3 to R2 and R4
R6 to R5 and R4
R1 to R2 and R5
XR3 to R2 and R5


NPE Configuration

R4
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire34105
 description UPE_TO_R3
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.3 34105
 signaling protocol ldp
interface pseudowire42105
 description NPE_TO_R2
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.2 42105
 signaling protocol ldp
interface pseudowire45105
 description NPE_TO_R5
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.5 45105
 signaling protocol ldp
interface pseudowire46105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.6 46105
 signaling protocol ldp
!
l2vpn vfi context H_VPLS
 vpn id 105
 member pseudowire42105
 member pseudowire45105
!
bridge-domain 150
 member vfi H_VPLS
 member pseudowire46105
 member pseudowire34105


R5
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire15105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.1 15105
 signaling protocol ldp
interface pseudowire45105
 description NPE_TO_R4
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.4 45105
 signaling protocol ldp
interface pseudowire52105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.2 52105
 signaling protocol ldp
interface pseudowire53105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.13 53105
 signaling protocol ldp
interface pseudowire56105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.6 56105
!
l2vpn vfi context H_VPLS
 vpn id 105
 member pseudowire52105
 member pseudowire45105
!
bridge-domain 150
 member vfi H_VPLS
 member pseudowire53105
 member pseudowire15105
 member pseudowire56105


R2
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire12105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.1 12105
 signaling protocol ldp
interface pseudowire23105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.13 23105
 signaling protocol ldp
interface pseudowire32105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.3 32105
 signaling protocol ldp
interface pseudowire42105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.4 42105
 signaling protocol ldp
interface pseudowire52105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.5 52105
!
l2vpn vfi context H_VPLS
 vpn id 150
 member pseudowire52105
 member pseudowire42105
!
bridge-domain 150
 member vfi H_VPLS
 member pseudowire32105
 member pseudowire23105
 member pseudowire12105



UPE Configuration
R3
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire32105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.2 32105
 signaling protocol ldp
interface pseudowire34105
  source template type pseudowire HVPLS
 encapsulation mpls

 neighbor 192.168.1.4 34105
!
l2vpn xconnect context H_VPLS
 member pseudowire34105 group HVPLS_RED priority 5
 member pseudowire32105 group HVPLS_RED priority 10
 member GigabitEthernet2 service-instance 150


R6
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire46105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.4 46105
 signaling protocol ldp
interface pseudowire56105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.5 56105
 signaling protocol ldp
!
l2vpn xconnect context HVPLS
 member GigabitEthernet2 service-instance 150
 member pseudowire56105 group HVPLS_RED priority 5
 member pseudowire46105 group HVPLS_RED priority 10


R1
template type pseudowire HVPLS
 encapsulation mpls
 sequencing both
 control-word include
 signaling protocol ldp
!
interface pseudowire12105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.2 12105
 signaling protocol ldp
interface pseudowire15105
  source template type pseudowire HVPLS
 encapsulation mpls
 neighbor 192.168.1.5 15105
 signaling protocol ldp
!
l2vpn xconnect context H_VPLS
 member GigabitEthernet2 service-instance 150
 member pseudowire12105 group HVPLS_RED priority 5
 member pseudowire15105 group HVPLS_RED priority 10


XR3
l2vpn
 xconnect group H_VPLS
  p2p H_VPLS
   interface GigabitEthernet0/0/0/1
   neighbor ipv4 192.168.1.2 pw-id 23105
    backup neighbor 192.168.1.5 pw-id 53105



Let's verify the NPE core from R4s perspective.


R4#sh l2vpn atom vc | in H
pw42105   192.168.1.2     42105      vfi    H_VPLS                   UP
pw34105   192.168.1.3     34105      vfi    H_VPLS                   UP
pw45105   192.168.1.5     45105      vfi    H_VPLS                   UP
pw46105   192.168.1.6     46105      vfi    H_VPLS                   STANDBY


We can see that the connections between the NPEs and UPEs are up and running.

R4#sh l2vpn service vfi name H_VPLS
Legend: St=State    XC St=State in the L2VPN Service      Prio=Priority
        UP=Up       DN=Down            AD=Admin Down      IA=Inactive
        SB=Standby  HS=Hot Standby     RV=Recovering      NH=No Hardware
        m=manually selected

  Interface          Group       Encapsulation                   Prio  St  XC St
  ---------          -----       -------------                   ----  --  -----
VPLS name: H_VPLS, State: UP
  pw100001                       H_VPLS(VFI)                     0     UP  UP
  pw46105            core_pw     192.168.1.6:46105(MPLS)         0     SB  SB
  pw42105            core_pw     192.168.1.2:42105(MPLS)         0     UP  UP
  pw34105            core_pw     192.168.1.3:34105(MPLS)         0     UP  UP
  pw45105            core_pw     192.168.1.5:45105(MPLS)         0     UP  UP


This output is just a bit more detailed than the last, it give us more specific status to the "VFI" than just the up or down status of the xconnect.


R4#sh bridge-domain
Bridge-domain 150 (4 ports in all)
State: UP                    Mac learning: Enabled
Aging-Timer: 300 second(s)
    vfi H_VPLS neighbor 192.168.1.5 45105
    vfi H_VPLS neighbor 192.168.1.2 42105
    vfi H_VPLS neighbor 192.168.1.3 34105
    vfi H_VPLS neighbor 192.168.1.6 46105
   AED MAC address    Policy  Tag       Age  Pseudoport
   0   000C.2994.B818 forward dynamic   299  H_VPLS.1004010
   1   FFFF.FFFF.FFFF flood   static    0    OLIST_PTR:0xe7fa6c00
   0   000C.2990.89E9 forward dynamic   297  H_VPLS.1004014
   0   000C.29BA.0E21 forward dynamic   296  H_VPLS.1004013


By consulting the bridge domain, we can see that we are learning 3 MACs from the different PWs we have configured, more importantly the learning is being done from both NPE and UPE devices.


R4#sh l2vpn vfi name H_VPLS
Legend: RT=Route-target, S=Split-horizon, Y=Yes, N=No

VFI name: H_VPLS, state: up, type: multipoint, signaling: LDP
  VPN ID: 105
  Bridge-Domain 150 attachment circuits:
  Pseudo-port interface: pseudowire100001
  Interface          Peer Address     VC ID        S
  pseudowire46105    192.168.1.6      46105        N
  pseudowire42105    192.168.1.2      42105        Y
  pseudowire34105    192.168.1.3      34105        N
  pseudowire45105    192.168.1.5      45105        Y


We can see that the NPE pseudowires, R2 and R5 have split horizon enabled, where the connections down to the UPEs do not have split horizon enabled. This is intentional, we don't want to send info we learn from NPEs back out to those same NPEs. This is the core, so we use those connections to receive data and forward it out to the UPEs. As information is propagated from the SP access into the SP core, LDP is used to figure out where to send the data. If split horizon wasn't enabled between NPEs then data would flood uncontrolled in the core, just like a switch would just send the data everywhere.



Let's verify R3 and then XR3 since we have both IOS and XR in the access layer.

R3
R3#sh l2vpn atom vc | in H
pw32105   192.168.1.2     32105      p2p    H_VPLS                   STANDBY
pw34105   192.168.1.4     34105      p2p    H_VPLS                   UP



R3#sh xconnect all
Legend:    XC ST=Xconnect State  S1=Segment1 State  S2=Segment2 State
  UP=Up       DN=Down            AD=Admin Down      IA=Inactive
  SB=Standby  HS=Hot Standby     RV=Recovering      NH=No Hardware

XC ST  Segment 1                         S1 Segment 2                         S2
------+---------------------------------+--+---------------------------------+--
UP pri mpls 192.168.1.4:34105            UP   ac Gi2:150(Eth VLAN)            UP
IA pri mpls 192.168.1.2:32105            SB   ac Gi2:150(Eth VLAN)            SB


Since both R3 and XR3 are configured with xconnect l2vpn, there isn't much to verify other than the PWs being up.


XR3
RP/0/0/CPU0:XR3#sh l2vpn xconnect
Thu Dec 22 02:48:03.848 UTC
Legend: ST = State, UP = Up, DN = Down, AD = Admin Down, UR = Unresolved,
        SB = Standby, SR = Standby Ready, (PP) = Partially Programmed

XConnect                   Segment 1                       Segment 2
Group      Name       ST   Description            ST       Description            ST
------------------------   -----------------------------   -----------------------------
H_VPLS     H_VPLS     UP   Gi0/0/0/1              UP       192.168.1.2     23105  UP
                                                                                         Backup
                                                                                         192.168.1.5     53105  SB

RP/0/0/CPU0:XR3#sh l2vpn atom-db
Thu Dec 22 02:48:24.976 UTC

Peer ID         Source          VC ID                 Encap  SIG    FEC AD
_______________________________________________________________________________

192.168.1.2     192.168.1.13    23105                 MPLS   LDP    128 none
192.168.1.5     192.168.1.13    53105                 MPLS   LDP    128 none


RP/0/0/CPU0:XR3#sh l2vpn database ac
Thu Dec 22 02:49:39.751 UTC
GigabitEthernet0/0/0/1:
      Other-Segment MTU: 0
      Other-Segment status flags: 0x3
      Signaled capability valid: Yes
      Signaled capability flags: 0x20
      Configured capability flags: 0x0
      XCID: 0x1
      PSN Type: MPLS Dynamic
      ETH data:
          Xconnect tags: 0
          Vlan rewrite tag: 0
    AC defn:
        ac-ifname: GigabitEthernet0_0_0_1
        capabilities: 0x0000707f
        extra-capabilities: 0x00000000
        parent-ifh: 0x00000000
        ac-type: 0x04
        interworking: 0x00
    AC info:
        seg-status-flags: 0x00000003
        segment mtu/l2-mtu: 1500/1514


Lets verify the CE side
R7

router eigrp 1
 network 0.0.0.0
!
interface GigabitEthernet1.150
 encapsulation dot1Q 150
 ip address 192.168.150.7 255.255.255.0
!
R7#sh ip eigrp nei
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
7   192.168.150.13          Gi1.150                  14 01:34:18  378  2268  0  422
6   192.168.150.10          Gi1.150                  11 01:37:56  128   768  0  386

All is well.



Thanks for stopping by!
Rob Riker, CCIE #50693

No comments:

Post a Comment