H-VPLS N-PE Redundancy for QinQ and MPLS Access

Last Updated: November 29, 2011

The H-VPLS N-PE Redundancy for QinQ feature and the H-VPLS N-PE Redundancy for MPLS Access feature enable two network provider edge (N-PE) routers to provide failover services to a user provider edge (U-PE) router in a hierarchical virtual private LAN service (H-VPLS). Having redundant N-PE routers provides improved stability and reliability against link and node failures. The VPLS MAC Address Withdrawal feature provides faster convergence by removing (or unlearning) MAC addresses that have been dynamically learned. This document explains how to implement these features.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for H-VPLS N-PE Redundancy for QinQ and MPLS Access

  • Before configuring the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature, configure your H-VPLS network and make sure it is operating correctly. For more information about configuring the H-VPLS network, see the " Configuring VPLS" section in Configuring Multiprotocol Label Switching on the Optical Services Modules .
  • Make sure that the PE-to-customer edge (CE) interface is configured with a list of allowed VLANs. For more information, see the " Configuring VPLS" section in Configuring Multiprotocol Label Switching on the Optical Services Modules .
  • To provide faster convergence, you can enable the MPLS Traffic Engineering: Fast Reroute feature in the Multiprotocol Label Switching (MPLS) core. For more information about MPLS traffic engineering, see the "MPLS Traffic Engineering (TE)--Fast Reroute (FRR) Link and Node Protection" section in the Cisco IOS Multiprotocol Label Switching Configuration Guide .
  • Enable the L2VPN Pseudowire Redundancy feature on the U-PE routers for MPLS access. For information about configuring the L2VPN Pseudowire Redundancy feature, see the "L2VPN Pseudowire Redundancy" section in the Cisco IOS Wide-Area Networking Configuration Guide .
  • When configuring Multiple Spanning Tree Protocol (MSTP), specify that one of the N-PE routers is the root by assigning it the lowest priority using the spanning-tree mst instance-id priority prioritycommand.

For information about configuring MSTP, see the "Configuring MST Instance Parameters" section in the Cisco 7600 Series Cisco IOS Software Configuration Guide.

  • When configuring MSTP, make sure that each router participating in the spanning tree is in the same region and is the same revision by issuing the revision, name, and instance commands in MST configuration mode. For more information on configuring these MSTP parameters, see the " Configuring Spanning Tree and IEEE 802.1s MST" section in the Cisco 7600 Series Cisco IOS Software Configuration Guide.

Restrictions for H-VPLS N-PE Redundancy for QinQ and MPLS Access

  • The H-VPLS N-PE Redundancy for QinQ and MPLS Access feature cannot be used with the VPLS Autodiscovery feature on pseudowires that attach to U-PE routers. When you create the VPLS, you can manually create the virtual forwarding interface (VFI).
  • You cannot configure more than one pseudowire to carry the bridge protocol data unit (BPDU) information between the N-PE routers. If you attempt to enter the forward permit l2protocol all command for multiple VFIs, an error message is displayed.
  • You cannot configure a local loopback address as a neighbor when you configure the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature on N-PE routers. If you do so, the following error is displayed:
VPLS local switching to peer address not supported
  • Only two N-PE routers can be connected to each U-PE router.
  • For a list of supported hardware for this feature, see the Release Notes for Cisco IOS Release 12.2SR for the Cisco 7600 Series Routers.
  • The spanning-tree mode must be MSTP for the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature. If the spanning-tree mode changes, the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature may not work correctly, even though the pseudowire that carries the BPDU information still exists and the H-VPLS N-PE Redundancy feature is still configured.

Information About H-VPLS N-PE Redundancy for QinQ and MPLS Access

How H-VPLS N-PE Redundancy for QinQ and MPLS Access Works

In a network configured with the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature, the U-PE router is connected to two N-PE routers. This feature provides a level of redundancy that can tolerate both link and device faults. If a failure occurs in the network that disables one N-PE router from transmitting data, the other N-PE router takes over. This feature works with both QinQ access based on MSTP and MPLS access based on pseudowire redundancy.

H-VPLS N-PE Redundancy with QinQ Access Based on MSTP

H-VPLS N-PE redundancy with QinQ access uses the MSTP running on the N-PE routers and U-PE routers in an H-VPLS network. A pseudowire running between N-PE routers carries only MSTP BPDUs. The pseudowire running between the N-PE routers is always up and is used to create a loop path between N-PE routers so that MSTP will block one of the redundant paths between the U-PE router and the N-PE routers. If the primary N-PE router or the path to it fails, MSTP will enable the path to the backup N-PE router.

The figure below shows an H-VPLS network with redundant access. Each U-PE router has two trunk connections, one to each N-PE router. Between the two N-PE routers is a pseudowire to provide a loop path for MSTP BPDUs. The network topology allows for the backup N-PE router to take over if the primary N-PE router or the path to it fails.

Figure 1 H-VPLS N-PE Redundancy with QinQ Access Based on MSTP


H-VPLS N-PE Redundancy with MPLS Access Based on Pseudowire Redundancy

For H-VPLS redundancy with MPLS access based on pseudowire redundancy, the MPLS network has pseudowires to the VPLS core N-PE routers.

As shown in the figure below, one pseudowire transports data between the U-PE router and its peer N-PE routers. When a failure occurs along the path of the U-PE router, the backup pseudowire and the redundant N-PE router become active and start transporting data.

Figure 2 H-VPLS N-PE Redundancy for QinQ and MPLS Access with MPLS Access Based on Pseudowire Redundancy


VPLS MAC Address Withdrawal

The VPLS MAC Address Withdrawal feature provides faster convergence by removing (or unlearning) MAC addresses that have been dynamically learned. A Label Distribution Protocol (LDP)-based MAC address withdrawal message is used for this purpose. A MAC list Type Length Value (TLV) is part of the MAC address withdrawal message.

The debug mpls ldp messages and debug mpls ldp session io commands support monitoring of MAC address withdrawal messages being exchanged between LDP peers. Any Transport over MPLS (AToM) may provide other means to display or monitor MAC address withdrawal messages. The Tag Distribution Protocol (TDP) is not supported as AToM uses only LDP for the MAC address withdrawal message.

PE routers learn the remote MAC addresses and directly attached MAC addresses on customer-facing ports by deriving the topology and forwarding information from packets originating at customer sites. To display the number of MAC address withdrawal messages, enter the show mpls l2transport vc detail command, as shown in the following example:

Router# show mpls l2transport vc detail
Local interface: VFI TEST VFI up
  MPLS VC type is VFI, interworking type is Ethernet
  Destination address: 10.1.1.1, VC ID: 1000, VC status: up
    Output interface: Se2/0, imposed label stack {17}
    Preferred path: not configured  
    Default path: active
    Next hop: point2point
  Create time: 00:04:34, last status change time: 00:04:15
  Signaling protocol: LDP, peer 10.1.1.1:0 up
    Targeted Hello: 10.1.1.1(LDP Id) -> 10.1.1.1
    MPLS VC labels: local 16, remote 17 
    Group ID: local 0, remote 0
    MTU: local 1500, remote 1500
    Remote interface description:
    MAC Withdraw: sent 5, received 3
  Sequencing: receive disabled, send disabled
  VC statistics:
    packet totals: receive 0, send 0
    byte totals:   receive 0, send 0
    packet drops:  receive 0, send 0

How MAC Address Withdrawal Works with H-VPLS N-PE Redundancy with QinQ Access

If a failure occurs in the customer-switched network, a spanning-tree Topology Change Notification (TCN) is issued to the N-PE router, which issues an LDP-based MAC address withdrawal message to the peer N-PE routers and flushes its MAC address table.

How MAC Address Withdrawal Works with H-VPLS N-PE Redundancy with MPLS Access

If the pseudowire between the U-PE router and N-PE router fails, then the L2VPN Pseudowire Redundancy feature on the U-PE router activates the standby pseudowire. In addition, the U-PE router sends an LDP MAC address withdrawal request to the new N-PE router, which forwards the message to all pseudowires in the VPLS core and flushes its MAC address table.

If a switched virtual interface (SVI) on the N-PE router fails, the L2VPN Pseudowire Redundancy feature activates the standby pseudowire and the U-PE router sends a MAC withdrawal message to the newly active N-PE router.

For information about the L2VPN Pseudowire Redundancy feature, see the "L2VPN Pseudowire Redundancy" feature module.

How to Configure H-VPLS N-PE Redundancy for QinQ and MPLS Access

Configuring the VPLS Pseudowire Between the N-PE Routers

Configuring N-PE redundancy in an H-VPLS network requires two steps. First, you must define the VPLS pseudowire for transporting BPDU data. Then, you must connect that pseudowire to the native VLAN. This configuration provides a redundancy that provides improved reliability against link and node failures.

Before You Begin

Review the Prerequisites for H-VPLS N-PE Redundancy for QinQ and MPLS Access to ensure that your H-VPLS network is configured and operating correctly.


SUMMARY STEPS

1.    enable

2.    configure terminal

3.    l2 vfi name manual

4.    vpn id id-number

5.    forward permit l2protocol all

6.    neighbor remote-router-id vc-id {encapsulation encapsulation-type | pw-class pw-name} [no-split-horizon]

7.    end


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
l2 vfi name manual


Example:

Router(config)# l2 vfi vfitest1 manual

 

Creates a Layer 2 VFI and enters Layer 2 VFI manual configuration mode.

 
Step 4
vpn id id-number


Example:

Router(config-vfi)# vpn id 200

 

Specifies the VPN ID.

 
Step 5
forward permit l2protocol all


Example:

Router(config-vfi)# forward permit l2protocol all

 

Creates a pseudowire that is to be used to transport BPDU data between the two N-PE routers.

 
Step 6
neighbor remote-router-id vc-id {encapsulation encapsulation-type | pw-class pw-name} [no-split-horizon]


Example:

Router(config-vfi)# neighbor 10.2.2.2 3 encapsulation mpls

 

Specifies the peer IP address of the redundant N-PE router and the type of tunnel signaling and encapsulation mechanism.

 
Step 7
end


Example:

Router(config-vfi)# end

 

Exits Layer 2 VFI manual configuration mode and returns to privileged EXEC mode.

 

Configuring the SVI for the Native VLAN

Perform the following task to configure the switched virtual interface for the native VLAN and verify that it is correctly configured.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface vlan vlanid

4.    xconnect vfi vfi-name

5.    end

6.    show vfi vfi-name

7.    end


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
interface vlan vlanid


Example:

Router(config)# interface vlan 23

 

Creates a dynamic SVI.

  • To make the SVI active when you create a VLAN, you must configure the VLAN with at least one physical interface that is in the "up" state. Use the show vfi command to display the status of the SVI. The state field will display "up" when the SVI is active.
 
Step 4
xconnect vfi vfi-name


Example:

Router(config)# xconnect vfi vfitest1

 

Specifies the Layer 2 VFI that you are binding to the VLAN port.

 
Step 5
end


Example:

Router(config-vfi)# end

 

Ends the current configuration session and returns to privileged EXEC mode.

 
Step 6
show vfi vfi-name


Example:

Router# show vfi VPLS-2

 

(Optional) Displays information about the pseudowire between the two N-PE routers so that you can verify that the H-VPLS N-PE Redundancy for QinQ and MPLS Access feature is correctly configured.

 
Step 7
end


Example:

Router# end

 

Exits privileged EXEC mode and returns to user EXEC mode.

 

Configuration Examples for H-VPLS N-PE Redundancy for QinQ and MPLS Access

Example H-VPLS N-PE Redundancy for QinQ Access

The figure below shows a configuration that is set up for H-VPLS N-PE redundancy with QinQ access.

Figure 3 H-VPLS N-PE Redundancy with QinQ Access Topology


The table below shows the configuration of two N-PE routers for H-VPLS N-PE redundancy with QinQ access.

Table 1 Example: H-VPLS N-PE Redundancy for QinQ Access

N-PE1

N-PE2

l2 vfi l2trunk manual
 vpn id 10
 forward permit l2protocol all
 neighbor 10.4.4.4 encapsulation mpls
!
interface Vlan1
 no ip address
 xconnect vfi l2trunk
!
spanning-tree mode mst
spanning-tree extend system-id
!
spanning-tree mst configuration
 revision 10
 instance 1 vlan 20
!
interface GigabitEthernet5/2
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 20
 switchport mode trunk

l2 vfi l2trunk manual
 vpn id 10
 forward permit l2protocol all
 neighbor 10.2.2.2 encapsulation mpls
!
interface Vlan1
 no ip address
 xconnect vfi l2trunk
!
spanning-tree mode mst
spanning-tree extend system-id
!
spanning-tree mst configuration
 revision 10
 instance 1 vlan 20
!
spanning-tree mst 1 priority 0
!
interface GigabitEthernet2/0/5
 switchport
 switchport trunk allowed vlan 20
 switchport mode trunk
 mls qos trust dscp

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

MPLS commands

Cisco IOS Multiprotocol Label Switching Command Reference

L2VPN pseudowire redundancy

"L2VPN Pseudowire Redundancy" section in the Cisco IOS Wide-Area Networking Configuration Guide

H-VPLS

"Configuring VPLS" section in the Configuring Multiprotocol Label Switching on the Optical Services Modules

Multiple spanning tree configuration

"Configuring MST Instance Parameters" section in the Cisco 7600 Series Cisco IOS Software Configuration Guide

MPLS traffic engineering

"MPLS Traffic Engineering (TE)--Fast Reroute (FRR) Link and Node Protection" section in the Cisco IOS Multiprotocol Label Switching Configuration Guide

Configuring MSTP

"Configuring MST Instance Parameters" section in the Cisco 7600 Series Cisco IOS Software Configuration Guide

Supported hardware on the Cisco 7600 series routers

Release Notes for Cisco IOS Release 12.2SR for the Cisco 7600 Series Routers

Standards

Standard

Title

http://www.ietf.org/rfc/rfc4447.txt

Pseudowire Setup and Maintenance Using the Label Distribution Protocol (LDP)

http://www3.ietf.org/proceedings/06mar/IDs/draft-ietf-l2vpn-vpls-ldp-08.txt

Virtual Private LAN Services over MPLS

http://www.ietf.org/internet-drafts/draft-ietf-pwe3-segmented-pw-02.txt

Segmented Pseudo Wire

draft-ietf-pwe3-vccv-10.txt

Pseudo Wire Virtual Circuit Connectivity Verification (VCCV)

draft-ietf-pwe3-oam-msg-map-03.txt

Pseudo Wire (PW) OAM Message Mapping

MIBs

MIB

MIBs Link

Pseudowire Emulation Edge-to-Edge MIBs for Ethernet, Frame Relay, and ATM Services

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

None

--

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for H-VPLS N-PE Redundancy for QinQ and MPLS Access

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 2 Feature Information for H-VPLS N-PE Redundancy for QinQ and MPLS Access

Feature Name

Releases

Feature Information

H-VPLS N-PE Redundancy for MPLS Access

12.2(33)SRC

12.2(50)SY

The H-VPLS N-PE Redundancy for MPLS Access feature enables two N-PE routers to provide redundancy to a U-PE router in an H-VPLS. Having redundant N-PE routers provides improved stability and reliability against link and node failures.

In Cisco IOS Release 12.2(33)SRC, this feature was introduced on the Cisco 7600 series routers.

The following sections provide information about this feature:

The following commands were introduced or modified: forward permit l2protocol, show mpls l2transport vc.

H-VPLS N-PE Redundancy for QinQ Access

12.2(33)SRC

The H-VPLS N-PE Redundancy for QinQ Access feature provides the capability to dual-home a given U-PE router to two N-PE routers in order to provide protection against link and node failures.

In Cisco IOS Release 12.2(33)SRC, this feature was introduced on the Cisco 7600 series routers.

The following sections provide information about this feature:

The following commands were introduced or modified: forward permit l2protocol, show mpls l2transport vc.

VPLS MAC Address Withdrawal

12.2(33)SXI4

12.2(50)SY

XE 3.5S

15.2(1)S

The VPLS MAC Address Withdrawal feature provides faster convergence by removing (or unlearning) MAC addresses that have been dynamically learned.

The following sections provide information about this feature:

"MAC Address Withdrawal"

In Cisco IOS XE Release 3.5S, this feature was introduced on the Cisco ASR 1000 Series Aggregation Services Routers.

In Cisco IOS XE Release 3.5S, support was added for the Cisco ASR 903 Router.

In Cisco IOS Release 15.2(1)S, this feature was integrated.

Glossary

CE router --customer edge router. A router that belongs to a customer network, which connects to a PE router to utilize MPLS VPN network services.

LAN --local-area network. High-speed, low-error data network covering a relatively small geographic area. LANs connect workstations, peripherals, terminals, and other devices in a single building or other geographically limited areas.

MPLS --Multiprotocol Label Switching. A packet-forwarding technology, used in the network core, that applies data link layer labels to tell switching nodes how to forward data, resulting in faster and more scalable forwarding than network layer routing normally can do.

MSTP --Multiple Spanning Tree Protocol. MSTP enables multiple VLANs to be mapped to the same spanning-tree instance, reducing the number of spanning-tree instances needed to support a large number of VLANs.

N-PE --network provider edge router. This router acts as a gateway between the MPLS core and edge domains.

PE router --provider edge router. The PE router is the entry point into the service provider network. The PE router is typically deployed on the edge of the network and is administered by the service provider.

pseudowire --A pseudowire is a virtual connection that, in the context of VPLS, connects two SVIs. It is a mechanism that carries the elements of an emulated service from one PE router to one or more PE routers over a packet switched network (PSN). A pseudowire is bidirectional and consists of a pair of unidirectional MPLS virtual circuits (VCs). A pseudowire can be used to connect a point-to-point circuit.

QinQ --An IEEE 802.1Q VLAN tunnel. A mechanism for constructing multipoint Layer 2 VPN using Ethernet switches.

redundancy --The duplication of devices, services, or connections so that, in the event of a failure, they can perform the work of those that failed.

router --A network layer device that uses one or more metrics to determine the optimal path along which network traffic should be forwarded. Routers forward packets from one network to another based on network layer information.

spanning tree --Loop-free subset of a network topology.

U-PE --user provider edge router. This router connects CE routers to the service.

VFI --virtual forwarding instance. A VFI is a collection of data structures used by the data plane, software-based or hardware-based, to forward packets to one or more VCs.

VLAN --Virtual LAN. Group of devices on one or more LANs that are configured (using management software) so that they can communicate as if they were attached to the same wire, when in fact they are located on a number of different LAN segments.

VPLS --Virtual Private LAN Service. VPLS describes an architecture that delivers Layer 2 service that emulates an Ethernet LAN across a wide-area network (WAN) and inherits the scaling characteristics of a LAN.

VPLS redundancy --Also called N-PE redundancy. Allows U-PEs to be dual-honed (to their N-PEs) in a loop-free topology with MPLS or QinQ as the access or aggregation domain.

VPN --Virtual Private Network. Allows IP traffic to travel securely over public TCP/IP networks and the Internet by encapsulating and encrypting all IP packets. VPN uses a tunnel to encrypt all information at the IP level.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2011 Cisco Systems, Inc. All rights reserved.