MPLS Layer-2 Virtual Private Networks

MPLS Layer-2 Virtual Private Networks
Foundry Networks Delivers Ethernet Services over MPLS
Agenda
Foundrys Strategy for Supporting MPLS Layer-2 VPNs
Providing Full Mesh Connectivity

Service Terminology
Specifications & Requirements
How It Works
Application Examples
Providing Point to Point Connectivity

The Virtual Leased Line (VLL) Service
How It Works
Foundry Product Offering
Foundry Proprietary - MPLS Layer 2 VPNs
2001 Foundry Networks, Inc.
Foundrys MPLS Vision/Strategy
Reduce the Burden of Network Administration and Address the

Hyper-Aggregation Problem
Implement MPLS Traffic Engineering for Route Management
and Data Flow Path Selection
Extend Foundrys Global Ethernet Strategy (Layer 2 over SONET)

to Include MPLS-based Transport Systems
Implement draft-Martini to Include Switched Ethernet
Infrastructures (MAN Deployments) into MPLS Environments
Provide Complete Layer 2, Layer 3, and VPN Services over a

Common MPLS Core
Implement Label Distribution Protocol (LDP) for Multi-vendor
Interoperability
Offer both Virtual Leased Line and Virtual Private LAN
Segments (Transparent LAN Services)
Support For MPLS Layer-2 VPNs
Virtual Leased Line:

The Martini drafts address point to point connectivity only.
However, this allows for offering a Virtual Leased Line (VLL)
service
If multiple sites need to be connected, the provider has to
provide multiple VLLs
Just like with leased line connectivity, packet switching is done
by the subscribers equipment (the Customer Edge - CE
device)
Virtual Private LAN Segment (Transparent LAN Services):

Provides full mesh connectivity
Connects CE equipment as if they were on the same LAN
segment
Agenda

Service Terminology
How It Works

How It Works
Goal:
To allow the provider to carry customer layer-2 frames from one
endpoint to the other over an IP/MPLS infrastructure
Scenario:
The provider offers a service that allows the customer to connect
two CE devices at two sites as if they had a leased line between
them
Draft-martini is the de facto standard, with some existing

implementations
Team will consolidate into WG document
Work will be done by two working groups

Pseudo Wire Emulation Edge to Edge (PWE3)
Provider Provisioned Virtual Private Networks (PPVPN)
Agenda

Service Terminology
How It Works

How It Works
The Martini Drafts
The Martini drafts introduce the concept of Virtual

Circuits (VCs)
Label Switched Paths (LSPs) are used as tunnels, an

LSP might carry multiple VCs
To accomplish this, the drafts leverage the MPLS label
stacking ability by adding an extra MPLS label that
distinguishes the VC used
An MPLS frame traversing a service provider network
has two labels:
For the LSP
Tunnel Label
For the VC
VC Label
The Martini Drafts
draft-martini-l2circuit-trans-mpls-07.txt
Distribution of VC labels via Label Distribution Protocol (LDP)
Introduces a new VC Forwarding Equivalency Class (FEC) Type
Length Value (TLV), to be used within Label Mapping
messages
draft-martini-l2circuit-encap-mpls-03.txt
Defines encapsulations for ATM, Frame Relay, Ethernet,
Ethernet VLAN, HDLC, and PPP
Format for Ethernet/VLAN Encapsulation:
PPP
or
Enet Hdr.
Tunnel
Label
VC
Label
Optional
Control
Word
Tagged or untagged Ethernet payload
Agenda

Service Terminology
How It Works
10

How It Works
The Virtual Leased Line (VLL)

Service
The mechanisms specified in the Martini drafts could
be used to offer a Virtual Leased Line (VLL) service for

point to point connectivity
The Virtual Leased Line is just an abstraction of the

Virtual Circuits involved in realizing the point to point
connectivity, making the service more manageable
A VLL is composed of two VCs one in each direction,

thus giving it bi-directionality
VLL
Provider Edge (PE)-A

11
LSP
VC
PE-B
Provisioning the Service

A Virtual Leased Line is given a unique ID, called VLL
ID.
12
The VLL ID is configured on both PE routers having the

end-points of the line
On each PE router, the address of the other PE router
called VLL Peer is configured
A PE router is configured to accept and forward either
untagged frames from the subscriber, or tagged
frames with a certain VLAN ID
PE routers automatically negotiate VC Labels to be
used using LDP
Optionally, the administrator may statically configure
the VC Labels to be used
Agenda

Service Terminology
How It Works
13

How It Works
VC Label Assignment
After a new VLL ID and its VLL-Peer is configured, the VLL

controller dynamically assigns a local VC label
This is the label for inbound packets to be forwarded to the
local CE end-point
VC label is assigned from a label range that has per-platform
scope
VC label range is separate from tunnel label range used by
RSVP
Assign inbound VC label X

For VLL-ID 1000
PE-A
14
Assign inbound VC label Y

for VLL-ID 1000
PE-B
VC Label Signaling
The VLL controller

Initiates a targeted LDP session to the VLL-Peer IP address
Selects a tunnel LSP whose end-point is that VLL-Peer
LSP egress point address must match VLL-Peer address to
be considered
However, if the remote and local VLL VC labels are statically
configured, there is no need for the LDP session
PE-A can be reached by LSP # 20:

outgoing tunnel label is L
PE-A
15
PE-B can be reached by LSP # 10:

outgoing tunnel label is M
PE-B
VC Label Signaling (cont.)
Once all configurations are complete, a PE router sends an LDP

Label-Mapping message to the other end (in downstream
unsolicited mode)
The message indicates the binding of a local VC label (in Label

TLV) to the VC FEC TLV (introduced by draft-martini)
0
1
2
3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
VC tlv
|C|
VC Type
|VC info Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
Group ID
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
VC ID
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
Interface parameters
|
|
"
|
|
"
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
16
VC Label Signaling (cont.)

Local label X
Remote label Y
Local label Y
Remote label X
I bind label X to VLL-ID 1000
I bind label Y to VLL-ID 1000

PE-A
PE-B
PE router sends an LDP Label-Mapping message to the

other end
May send Label-Withdraw message when local CE

interface goes down
17
Forwarding Frames:
CE to Backbone
Apply VC and
tunnel labels
MPLS Backbone
CE interface
PE-A
Inbound lookup
based on VLAN & port number
or just port number
Outgoing MPLS Packet Format:
PPP
or
Enet Hdr.
18
Tunnel
Label
M
VC
Label
Y
Optional
Control
Word
Forwarding Frames:
Backbone to CE
MPLS Backbone
CE interface
PE-B
Incoming VC label Y indicates VLL
payload, which CE interface to send to,
and which VLAN-ID to use
Incoming MPLS Packet Format in the General Case:
PPP
or
Enet Hdr.
Tunnel
Label
N1
VC
Label
Y
Optional
Control
Word
Incoming MPLS Packet Format in Case of Pen-Ultimate Hop Popping:

PPP
or
Enet Hdr.
1
VC
Label
Y
Optional
Control
Word
Tunnel label is changed by transit LSRs on the path

19
Agenda

Service Terminology
How It Works
20

How It Works
VLL Example Application:

CE Device Handles Switching
Router at central location responsible for data

forwarding among all remotes; switches or routers at
remotes
Remote
Central Site
Router
VLL for subnet 1
UT
The VLAN-IDs on these
PEs are not required to
match with the central site
PE
T
Multinetting
w/ one subnet
to each remote
VLL for subnet 2
UT
Remote
T: tagged
UT: untagged
21
VLL Example Application:

Service Provider Handles Switching
Tagged interface
shared among VLANs
One VLAN per

customer
Customer 1
Site C
Customer 2
Site A
Service Provider network
MPLS Backbone
Customer 1
Site A
22
Customer 2
Site C
Edge switches perform

SA learning, layer-2 frame
forwarding, and STP
Customer 1
Site B
Customer 2
Site B
Agenda

Service Terminology
How It Works
23

How It Works
24
Building on the mechanisms specified in the Martini

drafts
This functionality is currently under development
Goal:
To handle the more general case of a Provider offering
multiple point connectivity for a customer VPN
Scenario:
The provider offers a service that allows the customer
to connect multiple CE devices at multiple sites as if
they were on one LAN segment
The service provider handles packet switching and
offers the service in a manner that is totally
transparent to the user
Service Provider View of the Service

PE-2
PE-1
Private
VLAN 10
Private
VLAN 20
MPLS Backbone
Private
VLAN 10
Private
VLAN 20
Customer A
Site-2 CE Device
Customer A
Site-1 CE Device
tagged
LSP Tunnel
Virtual Circuit
PE-3
Private
VLAN 10
Private
VLAN 20
Customer A
Site-3 CE Device
25
Customers View of the Service

Customers CE devices think that they are all in the same subnet and
that they are connected through a switch
Private
VLAN 10
Private
VLAN 20
Private
VLAN 10
Private
VLAN 20
Customer A
Site-2 CE Device
Customer A
Site-1 CE Device
tagged
PE-3
Private
VLAN 10
Private
VLAN 20
Customer A
Site-3 CE Device
26
Agenda

Service Terminology
How It Works
27

How It Works
Service Terminology
In this scenario, the provider is said to be offering:

A Virtual Private LAN Segment (VPLS)
or (alternative name):
A Transparent LAN Service
28
Not to be confused with Virtual

Private LAN Services which is
an IP only solution described in
draft-tsenevir-vpl-ip-00.txt
Agenda

Service Terminology
How It Works
29

How It Works
VPLS Defining Documents
RFC 2764 A Framework for IP Based Virtual Private Networks:

Provides the general framework for IP Based VPNs MPLS
included
draft-lasserre-tls-mpls-00.txt:
Describes the forwarding of Ethernet/802.3 frames between
multiple customer sites, as if they were in the same layer-2
broadcast domain
Defines a new parameter VPN ID to identify PE routers
participating in the same customer VPN
draft-vkompella-ppvpn-vpsn-mpls-00.txt:
Describes MAC address learning and aging
Describes MAC address signaling
A single Working Group (WG) document will be formulated
30
Functional Requirements
As frames are transported over a provider backbone,

efficient use of resources is crucial
Frames should be forwarded only over the needed VCs

PE routers should be capable of learning Ethernet
source MAC addresses, just like a regular switch
A PE router keeps a VPLS Forwarding Table (quite
similar to a bridges MAC table) that distinguishes the
entries belonging to the different VPNs
Before forwarding a frame, the PE router checks its
VPLS forwarding table to determine which VCs the
frame should go over
31
Functional Requirements (Cont.)
Broadcast or unknown unicast frames are flooded over

all outgoing VCs belonging to the VPN
The PE routers have to be connected via VCs forming a

full mesh topology
For loop prevention, running an instance of STP per

VPN in the provider network would not scale:
Solution:
When forwarding frames a PE follows a split-horizon
rule: it never forwards a frame from one VC to
another in the same VPN
32
Handling Multicast Frames
Multicast frames are currently handled like broadcasts
Possible scenarios:
Interaction with 802.1 GMRP
IGMP snooping
Static MAC multicast filters
33
Extensions for performing smarter multicasts are to be

developed in the future
Agenda

Service Terminology
How It Works
34

How It Works
PE Router Performs Source Address

Learning
PE-3 associates MAC X with the outgoing VC (VC Label N)
PE-2
PE-1
MPLS Backbone
SA
=X
VC
L
VC
Customer A
Site-1 CE Device
La b
a be
el =
Customer A
Site-2 CE Device
l=N
LSP Tunnel
PE-3
VPLS Forwarding
Table
Virtual Circuit
Customer A
Site-3 CE Device
35
PE Router Performs Forwarding

PE-3 Checks its VPLS forwarding table and selects VC Label N
PE-2
PE-1
Customer A
Site-1 CE Device
LSP Tunnel
Virtual Circuit
X
DA=
MPLS Backbone
DA
=X V
CL
a be
l=N
VC
La b
el =
M
Customer A
Site-2 CE Device
PE-3
VPLS Forwarding
Table
Customer A
Site-3 CE Device
36
Speeding up Convergence
For faster convergence:
Whenever a PE router learns a new MAC SA from the
customer side, it signals it using an LDP Address
message to its peers
Should a MAC SA age out or should the CE device get
disconnected, the PE sends an LDP Address Withdraw
message to its peers
37
MAC Signaling
PE-3 signals the new MAC to speed up convergence
PE-2
PE-1
Customer A
Site-1 CE Device
LSP Tunnel
Virtual Circuit
Customer A
Site-2 CE Device
L DP
Ms
g
Y
SA=
LD
P
Msg
MPLS Backbone
PE-3
New MAC?
Yes Notify peers.
Customer A
Site-3 CE Device
38
Facilitating Provisioning
39
VPN membership:
Each customer VPN is assigned a unique 7 octet
VPN ID
It is defined as a new interface parameter included
in the LDP messages defined in the Martini drafts
(VC FEC)
This allows PE routers to signal the VPNs they are
members of
Automatic discovery of VPLS capable routers:
IGP extensions might be used
Still in the works
Agenda

Service Terminology
How It Works
40

How It Works
VPLS Example Application:

Providing TLS
Customer A
Site-1 Router
PE-2
UT
Private
VLAN 10
Private
VLAN 20
UT
Customer A
Site-2 Router
PE-1
Private
VLAN 10
Private
VLAN 20
MPLS Backbone
Customer B
Site-2 Switch
Customer B
Site-1 Switch
UT
LSP Tunnel
Virtual Circuit
UT Untagged
T Tagged
41
PE-3
Private
VLAN 10
Private
VLAN 20
Customer A
Site-3 Router
Customer B
Site-3 Switch
VPLS Example Application:

Dual Homing the Customer
The customer might run and manage their own instance of STP
The provider does not run STP on their backbone, they just carry the
customers BPDUs
STP used by the customer but not by the provider

PE-2
PE-1
STP
MPLS Backbone
STP
STP
Customer A
Site-1
STP
No STP
STP
STP
PE-3
PE-4
Customer A
Site-2
LSP Tunnel
Virtual Circuit
42
Agenda

Service Terminology
How It Works
43

How It Works
Empower Your MAN with MPLS
Foundry offers a complete MPLS solution for the cost of the nearest
competitor!
Exclusive Wire-Speed Layer 2 VPNs Unmatched in the market space.
At 480 Gbps aggregated switching capacity, Foundry delivers the

industrys highest performance in the smallest form factor.
Take advantage of a full suite of WAN interfaces including ATM, Packet

over SONET/SDH, and 10 Gigabit Ethernet.
A complete End-to-end solution from ONE vendor providing the

unmatched Return on Investment (ROI):
Consistent software development
Common product look and feel
Cisco-like Command Line Interface (CLI) across the entire product
line for a reduced learning curve
44
The only vendor to offer a forklift free seamless migration path from
Layer 2 services right through to an MPLS enabled infrastructure.
Foundry MAN Feature Set - Core
Next Generation Routing Architecture

Effectively scales from 128 to 480
Gbps of switching capacity
High-performance, low-latency, and
Head-of-Line Blocking-free packet
forwarding
Fully distributed switching delivers
best Price/Performance ratio
Robust Internet Routing Suite

Full featured BGP4, OSPF, ISIS
Comprehensive MPLS
RSVP/TE
Draft-Martini
Wire-speed ACLs and Extended ACLs
for Security and Control
RADIUS, AAA, TACACS, & TACACS+
support for Authentication and
Verification
45
Carrier-Class Features
Hot-swap capability enables
components to be added or removed
without service disruption
APS for SONET/SDH
Redundant Route Processors with
sub-second fail over
Redundant AC and/or DC Power
Load Balanced
Hot Swappable
Level 3 NEBS Tested
Industry Leading High Density

Interfaces
Packet over SONET/SDH
ATM
10/100 Mbps Ethernet
Gigabit Ethernet
10 Gbps Ethernet
Investment Protection
All modules seamlessly work across
all NetIron and BigIron chassis
Consistent look and feel
10 Gbps Ready
Foundry MAN Feature Set - Edge
802.1w Rapid Spanning Tree Protocol (RSTP) for rapid

convergence time of 1 to 5 seconds
802.1s STP per VLAN group provides VLAN and STP scalability,
and utilizes dark fiber efficiently
Super VLAN Aggregation Decouples customer-side VLANs

from service provider VLANs, and allows VPN like connectivity for
4,096 customers in the Metro core
SuperSpan Super Spanning Tree Protocol allows different

STP domains for simplicity, manageability and dramatic
improvements in Metro core network scalability
Layer 2 POS Allows Layer 2 VLAN services over existing SONET

infrastructure to combine simplicity of Ethernet with reliability of
SONET, and provide global VLANs in the Metro
46
Foundrys MAN Advantages
47
Complete Solution Layer 2 & 3 Switches and Internet routers

with MPLS Traffic Engineering and Draft Martini with industry
leading price/performance
Complete Interfaces 10/100 Mbps, 1 Gbps and 10 Gbps
Ethernet, OC-3c, OC-12c and OC-48c PoS, and OC-3c ATM
Complete Network Management New IronView Network
Manager for centralized management
Industrys First Wire-Speed Rate Limiting Next Generation
ASICs provide fine-grain Committed Access Rate functionality
Complete Accounting NetFlow version 1, 5, and 8, Up to 10
collectors, Five aggregation schemes, sFlow and XRMON
IronShield Security Wire-speed ACLs, SYN and ICMP rate
limiting, bi-directional NAT, Radius, TACACS/TACACS+
authentication
Thank You!

MPLS Layer-2 Virtual Private Networks

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

MPLS Layer-2 Virtual Private Networks

Загружено:

Авторское право:

Доступные форматы

MPLS Layer-2 Virtual Private Networks

Foundry Networks Delivers Ethernet Services over MPLS

Foundrys Strategy for Supporting MPLS Layer-2 VPNs

Providing Full Mesh Connectivity

Providing Point to Point Connectivity

Foundry Product Offering

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

Foundrys MPLS Vision/Strategy

Reduce the Burden of Network Administration and Address the

Extend Foundrys Global Ethernet Strategy (Layer 2 over SONET)

Provide Complete Layer 2, Layer 3, and VPN Services over a

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

Support For MPLS Layer-2 VPNs

Virtual Leased Line:

Virtual Private LAN Segment (Transparent LAN Services):

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

Foundrys Strategy for Supporting MPLS Layer-2 VPNs

Providing Full Mesh Connectivity

Providing Point to Point Connectivity

Foundry Product Offering

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

Providing Point to Point Connectivity

Draft-martini is the de facto standard, with some existing

Work will be done by two working groups

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

Foundrys Strategy for Supporting MPLS Layer-2 VPNs

Providing Full Mesh Connectivity

Providing Point to Point Connectivity

Foundry Product Offering

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

The Martini Drafts

The Martini drafts introduce the concept of Virtual

Label Switched Paths (LSPs) are used as tunnels, an

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

The Martini Drafts

Foundry Proprietary - MPLS Layer 2 VPNs

Tagged or untagged Ethernet payload

2001 Foundry Networks, Inc.

Foundrys Strategy for Supporting MPLS Layer-2 VPNs

Providing Full Mesh Connectivity

Providing Point to Point Connectivity

Foundry Product Offering

Foundry Proprietary - MPLS Layer 2 VPNs

2001 Foundry Networks, Inc.

The Virtual Leased Line (VLL)

be used to offer a Virtual Leased Line (VLL) service for

The Virtual Leased Line is just an abstraction of the

A VLL is composed of two VCs one in each direction,

Provider Edge (PE)-A

2001 Foundry Networks, Inc.

Provisioning the Service

The VLL ID is configured on both PE routers having the

2001 Foundry Networks, Inc.

Foundrys Strategy for Supporting MPLS Layer-2 VPNs

Providing Full Mesh Connectivity

Providing Point to Point Connectivity

Foundry Product Offering