VLANs

This chapter provides information on configuring virtual local area networks (VLANs) in support of enhanced or extended services. Product-specific and feature-specific Administration Guides provide examples and procedures for configuration of services on the system that may utilize VLANs. You should select the configuration example that best meets your service model before using the procedures described below.


Important

VLAN – Layer 2 Traffic Management is a Cisco feature that requires a separate license. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of Software Management Operations.

Overview

Virtual LANs (VLANs) provide greater flexibility in the configuration and use of contexts and services.

They are configured as "tags" on a per-port basis and allow more complex configurations to be implemented. The VLAN tag allows a single physical port to be bound to multiple logical interfaces that can be configured in different contexts. Therefore, each Ethernet port can be viewed as containing many logical ports when VLAN tags are employed.


Important

VLANs are supported in conjunction with subscriber traffic ports on Management I/O (MIO/UMIO/MIO2) cards. The system supports the configuration limits for VLANs as described in Engineering Rules.

Overlapping IP Address Pool Support – GGSN

Overlapping IP Address pools allow operators to more flexibly support multiple corporate VPN customers with the same private IP address space without expensive investments in physically separate routers or virtual routers.

The system supports two types of overlapping pools:

  • Resource pools are designed for dynamic assignment only, and use a VPN tunnel (such as a GRE tunnel) to forward and receive the private IP addresses to and from the VPN.

  • Overlap pools can be used for both dynamic and static addressing, and use VLANs and a next hop forwarding address to connect to the VPN customer.

To forward downstream traffic to the correct PDP context, the GGSN uses either the GRE tunnel ID or the VLAN ID to match the packet. When forwarding traffic upstream, the GGSN uses the tunnel and forwarding information in the IP pool configuration; overlapping pools must be configured in the APN in such instances.

When a PDP context is created, the IP address is assigned from the IP pool. In this case the forwarding rules are also configured into the GGSN. If the address is assigned statically, when the GGSN confirms the IP address from the pool configured in the APN, the forwarding rules are also applied.

The GGSN can scale to as many actual overlapping pools as there are VLAN interfaces per context, and there can be multiple contexts per GGSN. The limit is the number of IP pools. This scalability allows operators who wish to provide VPN services to customers using the customer's private IP address space, not to be concerned about escalating hardware costs or complex configurations.

RADIUS VLAN Support – Enhanced Charging Services

VPN customers often use private address space which can easily overlap with other customers. The subscriber addresses are supported with overlapping pools which can be configured in the same virtual routing context.

RADIUS Server and NAS IP addresses do not need to be in separate contexts, thereby simplifying APN and RADIUS configuration and network design. This feature allows the following scenarios to be defined in the same context:

  • Overlapping RADIUS NAS-IP addresses for various RADIUS server groups representing different APNs.

  • Overlapping RADIUS server IP addresses for various RADIUS servers groups.

Every overlapping NAS-IP address is given a unique next-hop address which is then bound to an interface that is bound to a unique VLAN, thereby allowing the configuration to exist within the same context.

The system forwards RADIUS access requests and accounting messages to the next hop defined for that NAS-IP; the connected routers forward the messages to the RADIUS server. The next hop address determines the interface and VLAN to use. Traffic from the server is identified as belonging to a certain NAS-IP by the port/VLAN combination.

The number of RADIUS NAS-IP addresses that can be configured is limited by the number of loopback addresses that can be configured.

APN Support – PDN Gateway (P-GW)

P-GW Access Point Name (APN) supports extensive parameter configuration flexibility for the APN. VLAN tagging may be selected by the APN, but are configured in the P-GW independently from the APN.

Creating VLAN Tags

Use the following example to create VLANs on a port and bind them to pre-existing interfaces. For information on creating interfaces, refer to System Interfaces and Ports. 

config 
   port ethernet slot/port 
      no shutdown 
      vlan vlan_tag_ID 
      no shutdown 
      bind interface interface_name context_name 
      end
Notes:

  • Optional: Configure VLAN-subscriber associations. Refer to Configuring Subscriber VLAN Associations for more information.

  • Repeat this procedure as needed to configure additional VLANs for the port.

  • Refer to VLAN-Related CLI Commands and the Command Line Interface Reference for additional information.

  • Save your configuration as described in the Verifying and Saving Your Configuration chapter.

Verifying the Port Configuration

Run the following command to verify the port configuration: 

[local]host_name# show port info slot/port

An example of this command's output when at least one VLAN has been configured for the port is shown below: 

Port: 5/11 
  Port Type               : 10G Ethernet  
  Role                    : Service Port  
  Description             : (None Set) 
  Redundancy Mode         : Port Mode 
  Redundant With          : 6/11 
  Preferred Port          : Non-Revertive  
  Physical ifIndex        : 85262336 
  Administrative State    : Enabled 
  Configured Duplex       : Auto 
  Configured Speed        : Auto 
  Fault Unidirection Mode : 802_3ae clause 46  
  Configured Flow Control : Enabled 
  Interface MAC Address   : 64-9E-F3-69-5B-EA  
  SRP Virtual MAC Address : None  
  Fixed MAC Address       : 64-9E-F3-69-5B-CA  
  Link State              : Up 
  Link Duplex             : Full 
  Link Speed              : 10 Gb 
  Flow Control            : Enabled 
  Link Aggregation Group  : None 
  Untagged: 
    Logical ifIndex       : 85262337 
    Operational State     : Up, Active 
  Tagged VLAN: VID 10 
    Logical ifIndex       : 285278210 
    VLAN Type             : Standard 
    VLAN Priority         : 0 
    Administrative State  : Enabled 
    Operational State     : Up, Active 
  Number of VLANs         : 1 
  SFP Module              : Present (10G Base-SR)
Notes:

  • Repeat this sequence as needed to verify additional ports.

  • Optional: Configure VLAN-subscriber associations. Refer to Configuring Subscriber VLAN Associations for more information.

  • Refer to VLAN-Related CLI Commands for additional information.

  • Save your configuration as described in the Verifying and Saving Your Configuration chapter.

Configuring Subscriber VLAN Associations

Subscriber traffic can be routed to specific VLANs based on the configuration of their user profile. This functionality provides a mechanism for routing all traffic from a subscriber over the specified VLAN. All packets destined for the subscriber must also be sent using only IP addresses valid on the VLAN or they will be dropped.

RADIUS Attributes Used

The following RADIUS attributes can be configured within subscriber profiles on the RADIUS server to allow the association of a specific VLAN to the subscriber:

  • SN-Assigned-VLAN-ID: In the Starent VSA dictionary

  • SN1-Assigned-VLAN-ID: In the Starent VSA1 dictionary


Important

Since the instructions for configuring subscriber profiles differ between RADIUS server applications, this section only describes the individual attributes that can be added to the subscriber profile. Please refer to the documentation that shipped with your RADIUS server for instructions on configuring subscribers.

Configuring Local Subscriber Profiles

Use the configuration example below to configure VLAN associations within local subscriber profiles on the system.


Important

These instructions assume that you have already configured subscriber-type VLAN tags according to the instructions provided in Creating VLAN Tags. 

config 
   context context_name 
      subscriber name user_name 
         ip vlan vlan_id 
         end

Verify the Subscriber Profile Configuration

Use the following command to view the configuration for a subscriber profile: 

[local]host_name# show subscriber configuration username user_name
Notes:

  • Repeat this command for each subscriber.

  • Save your configuration as described in the Verifying and Saving Your Configuration chapter.

VLAN-Related CLI Commands

VLAN-related features and functions are supported across several CLI command modes. The following tables identify commands associated with configuration and monitoring of VLAN-related functions.

For detailed information regarding the use of the commands listed below, see the Command Line Interface Reference.

Table 1. VLAN-Related Configuration Commands
CLI Mode Command Description

AAA Server Group Configuration Mode

radius attribute nas-ip-address address ip_address nexthop-forwarding-address ip_address vlan vlan_id

Sets the RADIUS client to provide the VLAN ID with the nexthop forwarding address to a system when running in single nexthop gateway mode.

Note: To access the vlan keyword, aaa-large configuration must be enabled via the Global Configuration mode.

ACS Charging Action Configuration Mode

ip vlan vlan_id

Configures the VLAN identifier to be associated with the subscriber traffic in the destination context.

Context Configuration Mode

ip pool pool_name nexthop forwarding address ip_address overlap vlanid vlan_id

When a nexthop forwarding address is configured, the overlap vlanid keyword enables support for overlapping IP address pools and associates the pool with the specified VLAN ID.

Context Configuration Mode

ip routing overlap-pool

Advertises overlap-pool addresses in dynamic routing protocols when overlap pools are configured using VLAN IDs. When enabled, the overlap addresses are added as interface addresses and advertised.

Context Configuration Mode

radius attribute nas-ip-address address ip_address nexthop-forwarding-address ip_address vlan vlan_id

Specifies the VLAN ID to be associated with the next-hop IP address.

Ethernet Interface Configuration Mode

[no] logical-port-statistics

Enables or disables the collection of logical port (VLAN and NPU) bulk statistics for the first 32 configured Ethernet or PVC interface types.

Ethernet Interface Configuration Mode

vlan-map next-hop ipv4_address

Sets a single next-hop IP address so that multiple VLANs can use a single next-hop gateway. The vlan-map is associated with a specific interface.

Ethernet Port Configuration Mode

vlan vlan_id

Enters VLAN Configuration mode.

PVC Configuration Mode

[no] shutdown

Enables or disables traffic over a specified VLAN. See below.

Subscriber Configuration Mode

ip vlan vlan_id

Configures the subscriber VLAN ID that is used with the assigned address for the subscriber session to receive packets. If the IP pool from which the address is assigned is configured with a VLAN ID, this subscriber configured VLAN ID overrides it.

VLAN Configuration Mode

bind interface interface_name context_name

Binds a virtual interface and context to support VLAN service.

VLAN Configuration Mode

[no] ingress-mode

Enables or disables port ingress incoming) mode.

VLAN Configuration Mode

priority value

Configures an 802.1p VLAN priority bit for ASN-GW service only.

VLAN Configuration Mode

[no] shutdown

Enables or disables traffic over the current VLAN.

VLAN Configuration Mode

vlan-map interface if_name context_name

Associates an IP interface having a VLAN ID with a context.

Table 2. VLAN-Related Monitoring Commands
CLI Mode Command Description

Exec Mode show commands

clear port slot/port vlan vlan_id

Clears NPU statistics for the port that has a previously configured VLAN ID.

Exec Mode show commands

show logical-port utilization table vlan { 5-minute | hourly }

Displays VLAN utilization for a specified collection interval.

Exec Mode show commands

show port info slot/port vlan vlan_id

Displays NPU counters for a previously configured VLAN ID.