VPLS how to signal CE facing interface failure

Question

Hello,

I have a BGP-based VPLS setup with one CE machine being multi-homed

multi-homing works if i for example shut the active PE or i somehow disturb the connection between my PEs... that ok

but nothing happens if i shut down the CE facing interface on my active PE, other PEs just continue forwarding to the PE that cant forward anymore and the result is that connectivity is down even tho there is another way that would work

I am wondering, how do i signal a CE-facing interface failure to other peers?

PE1 is Juniper, PE5 is Cisco... i cant figure it out for either of them

config:

PE1:

bgp {
    group ibgp {
        type internal;
        local-address 10.255.255.1;
        family l2vpn {
            signaling;
        }
        neighbor 10.255.255.10;
    }
}

routing-instances {
VPLS {
    instance-type vpls;
    interface ge-0/0/1.0;
    route-distinguisher 100:1;
    vrf-target {
        import target:3:3;
        export target:1:1;
    }
    protocols {
        vpls {
            no-tunnel-services;
            site 1 {
                site-identifier 1;
                multi-homing;
                interface ge-0/0/1.0;
            }
        }
    }
}

PE5:

 l2vpn vfi context VPLS
 vpn id 100
 autodiscovery bgp signaling bgp
  ve id 1
  rd 110:1
  route-target export 1:1
  route-target import 3:3

bridge-domain 1
 member GigabitEthernet2 service-instance 1
 member vfi VPLS

interface GigabitEthernet2
 no ip address
 negotiation auto
 service instance 1 ethernet
  encapsulation default
 !
!

router bgp 100
 bgp log-neighbor-changes
 neighbor 10.255.255.10 remote-as 100
 neighbor 10.255.255.10 update-source Loopback0
 !
 address-family l2vpn vpls
  neighbor 10.255.255.10 activate
  neighbor 10.255.255.10 send-community extended
  neighbor 10.255.255.10 suppress-signaling-protocol ldp
 exit-address-family

THANKS!

Answer 1

@Radovan. I'll try to answer this by assuming both PE-1 and PE-5 are Juniper Nodes.

In Case of Juniper , you can use 'site-preference' knob under VPLS routing-instance. In your case CE is dual homed to 2 x PEs. The site-preference knob will control which PE is the currently the 'active' one that is forwarding the traffic to the CE. You have to define 'same' VPLS instance on both PEs (RD will be different) but RTs will be same as it defines VPN membership.

On PE-5 , under BGP VPLS instance , you can turn on the knob 'site-preference primary' like this

set routing-instances vpls-north-mx-abc-hsi protocols vpls site vpls-north-mx-abc-hsi multi-homing
set routing-instances vpls-north-mx-abc-hsi protocols vpls site vpls-north-mx-abc-hsi site-preference primary

On PE-1 , under the same BGP VPLS instance , you can turn on the knob 'site-preference backup'.Like this

set routing-instances vpls-north-mx-abc-hsi protocols vpls site vpls-north-mx-abc-hsi multi-homing
set routing-instances vpls-north-mx-abc-hsi protocols vpls site vpls-north-mx-abc-hsi site-preference backup

What wil happen is that both PEs will start advertising BGP VPLS NLRI along with local preference values (turned on by site-preference). The one which is active will set local preference high (65535) and while other will set to 1 like shown below :-

vpls-north-mx-abc-hsi.l2vpn.0: 6 destinations, 14 routes (6 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
  10.0.0.1:11037:8:9/96                    
*                         Self                         65535      I  


while othe one (backup) will advertise the same VPLS NLRI as below:-

vpls-north-mx-abc-hsi.l2vpn.0: 6 destinations, 14 routes (6 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
  10.0.0.2:11037:8:9/96                    
*                         Self                         1          I

As a result , remote PEs (in your case PE-3 and PE-2) will establish BGP VPLS PW with the primary one (PE-5) verified by 'show vpls connections instance'.

So in normal case, both PE-3 and PE-2 will send traffic to PE-5.

Now lets assume that link between PE-5 and CE goes down (you can simulate this by admin shut down the interface at either CE or PE end). Here we assume that there is only 1 Link between PE-5 and CE. In case of multiple links , VPLS instance will not be down by shutting only 1 interface. In that case for simulating purposes you could deactivate the VPLS instance on primary side PE-5.

When the link is down between PE-5 and CE , PE-5 will say that VPLS instance is down (as the link that was part of VPLS instance (or Attachment circuit) went down). So PE-5 will withdraw the BGP VPLS NLRI by sending the BGP update packet. 

Rest of PEs will receive the BGP VPLS NLRI withdraw packet via RR.and will say PE-5 is no longer the active one

Rest of remote PEs (PE-3 and PE-2) will now establish BGP VPLS PW to the backup PE which is PE-1 in your case. For traffic to flow , MAC address will again be re-learned by flooding (BUM). Finally , traffic will start flowing towards PE-1 and then to CE.

I hope that will make sense and will help to clarify .