Why VPWS service - MPLS has a two ethernet frame headers?

Question

I am trying to understand VPWS services, and going through RFC 4448, Encapsulation Methods for Transport of Ethernet over MPLS Networks.

Here is the packet capture:

1. Why there is a need for again source MAC and destination MAC addresses?

2. My understanding is that it uses MPLS labeling for switching/routing within the core network. Once it moves out from the PE, it will go to its attachment circuit based on the ethernet frame- destination MAC address. Is that correct?

3. I see that in the packet capture, there are two Ethernet frame headers - The red one shows the ethernet source and destination MAC addresses of its immediate neighbor. Is the label not being used for switching?

4. If so, then why two labels?

5. I am confused about the second ethernet frame - My understanding is that it is for the attachment circuit - like where to go after reaching the far end PE.

Answer 1

Why there is a need for again source MAC and destination MAC addresses?

The original source and destination MAC addresses have no meaning while the packet is in the tunnel.

My understanding is that it uses MPLS labeling for switching/routing within the core network. Once it moves out from the PE, it will go to its attachment circuit based on the ethernet frame- destination MAC address. Is that correct?

Yes - the encapsulation is removed and the original frame is sent to the local network.

I see that in the packet capture, there are two Ethernet frame headers - The red one shows the ethernet source and destination MAC addresses of its immediate neighbor. Is the label not being used for switching?

The outer label is used for switching within the MPLS tunnel. The inner label is ignored while in the tunnel - currently, it's just payload to transport.

Once the encapsulated payload reaches the destination network, the encapsulation is removed and the original frame continues on as before the tunnel.

I am confused about the second ethernet frame - My understanding is that it is for the attachment circuit - like where to go after reaching the far end PE.

In a nutshell, yes!

Answer 2

VPWS is a point to point L2VPN, using this technology two geographically remote hosts from the same IP subnet are able to communicate as if they were connected to the same switch.

This thing is achieved by the transport of Ethernet frames inside an MPLS tunnel.

So if to capture the packet as it travels between two LSRs inside the MPLS core you would get the following headers:

| ETH | MPLS (transport label) | MPLS (VPN label) | ETH | PAYLOAD |

The outer Ethernet header is for communication between two adjacent MPLS core routers, and is de-encapsulated and encapsulated inside the tunnel for every hop the packet travels (Along with the transport label). While the inner Ethernet header is for the destination endpoint beyond the tunnel (Identified by the VPN label) and remains intact while inside the tunnel.

For example:

CE1 10.0.0.1-------- PE1 -----MPLS BACKBONE------ PE2 ----- 10.0.0.2 CE2

When CE1 pings 10.0.0.2 , it first has to get the L2 address of the "directly connected" address 10.0.0.2. So an ARP request is sent across this tunnel in the form of :

| ETH | MPLS(transport label) | MPLS (VPN label) | DMAC:FF:FF.... | ARP |

After ARP reply is sent back across the tunnel, CE1 is able to communicate with CE2 using the learned L2 info.

| ETH | MPLS(transport label) | MPLS (VPN label) | CE2's DMAC... | IP | DATA |

Answer 3

This is normal in a l2vpn packet, because CE devices mac will be encapsulated inside and intermediate devices will keep on changing the top ethernet header.