5

Let's say, that I have a following simple BGP-signaled L2VPN configuration:

root@PE4> show configuration routing-instances
vpn-b {
    instance-type l2vpn;
    interface ge-0/0/0.515;
    route-distinguisher 65512:200;
    vrf-target target:65512:200;
    protocols {
        l2vpn {
            encapsulation-type ethernet-vlan;
            site ce-d {
                site-identifier 2;
                interface ge-0/0/0.515;
            }
        }
    }
}

root@PE4>

Content of the vpn-b.l2vpn.0 table can be seen below:

root@PE4> show route table vpn-b.l2vpn.0 detail

vpn-b.l2vpn.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
 65512:200:1:1/96 (1 entry, 1 announced)
        *BGP    Preference: 170/-101
                Route Distinguisher: 65512:200
                Next hop type: Indirect, Next hop index: 0
                Address: 0xce2eb90
                Next-hop reference count: 6
                Source: 192.168.2.1
                Protocol next hop: 192.168.2.1
                Indirect next hop: 0x2 no-forward INH Session ID: 0x0
                State: <Secondary Active Int Ext>
                Local AS: 65512 Peer AS: 65512
                Age: 3:29:45    Metric2: 1
                Validation State: unverified
                Task: BGP_65512.192.168.2.1+179
                Announcement bits (1): 0-vpn-b-l2vpn
                AS path: I
                Communities: target:65512:200 Layer2-info: encaps: VLAN, control flags:[0x2] Control-Word, mtu: 0, site preference: 100
                Import Accepted
                Label-base: 800256, range: 2, status-vector: 0x0, offset: 1
                Localpref: 100
                Router ID: 192.168.2.1
                Primary Routing Table bgp.l2vpn.0

 65512:200:2:1/96 (1 entry, 1 announced)
        *L2VPN  Preference: 170/-101
                Next hop type: Indirect, Next hop index: 0
                Address: 0xce2f190
                Next-hop reference count: 3
                Protocol next hop: 192.168.2.4
                Indirect next hop: 0x0 - INH Session ID: 0x0
                State: <Active Int Ext>
                Age: 1d 23:46:41        Metric2: 1
                Validation State: unverified
                Task: vpn-b-l2vpn
                Announcement bits (1): 1-BGP_RT_Background
                AS path: I
                Communities: Layer2-info: encaps: VLAN, control flags:[0x2] Control-Word, mtu: 0, site preference: 100
                Label-base: 800000, range: 2, status-vector: 0x0, offset: 1
                Secondary Tables: vpn-b.l2id.0

root@PE4>

How does the PE4 know that frames from the CE connected to ge-0/0/0.515 interface have to be associated with 65512:200:1:1/96 NLRI and thus get the inner label of 800257(2 + 800256 - 1)?

6

There are two labels, so as traffic ingresses the PE from the CE there is a double push.

Inner Label

Every interface gets a label from that L2VPNs label block. The inner label is based on this interface specific label for the remote L2VPN site.

L2VPN's use the same NLRI as VPLS in that they contain:

  • Route Distinguisher
  • Edge ID (Site ID)
  • Label Block Offset
  • Label Block Size
  • Label Base

If you're not multihoming, each L2VPN CE interface has it's own site ID and therefore allocates its own label on the device. If you are multihoming, both are the same site and will use the same label, but require additional route selection to determine which circuit is active.

The information in the BGP NLRI allows both local and remote PE's to derive the inner label values for both sending and receiving. With every CE being its own site, both sides can figure out every necessary CE to CE label required. Remember that label blocks are essentially locally significant, that is to say that each PE's label blocks don't have to be identical.

You can look at the L2VPN connection to see the label details.

jhead@L2VPN-PE1> show l2vpn connections instance L2VPN-NESE
Layer-2 VPN connections:

<...snip...>

Instance: L2VPN-NESE
Edge protection: Not-Primary
  Local site: 1 (1)
    connection-site           Type  St     Time last up          # Up trans
    2                         rmt   Up     Jan  7 19:45:02 2021           1
      Remote PE: 2.2.2.2, Negotiated control-word: No
      Incoming label: 800183, Outgoing label: 800000
      Local interface: xe-0/0/7.119, Status: Up, Encapsulation: VLAN
      Flow Label Transmit: No, Flow Label Receive: No

Furthermore, you can see the mpls.0 table's label associations for the local interfaces.

jhead@L2VPN-PE1> show route label 800183

mpls.0: 1063 destinations, 1063 routes (1063 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

800183             *[L2VPN/7] 3w6d 22:34:47
                    > via xe-0/0/7.119, Pop

Outer Label

The outer label is whatever the transport label associated with the LSP to get to the remote PE (RSVP / LDP).

5
  • Thanks Jordan! However, let's say that your L2VPN-NESE.l2vpn.0 table has multiple L2VPN NLRIs. Why does the PE associate incoming frames to xe-0/0/7.119 interface with the NLRI with the label base of 800000(if the remote label offset is 1, then the local-site-id + remote-label-base - remote-label-offset formula will give 800000)? – Martin Feb 5 at 13:40
  • I'll edit my answer a bit later today. – Jordan Head Feb 5 at 14:19
  • 1
    I re-read this and want to make sure I understand what you're asking. Are you asking if a L2VPN had more than 1 CE (interface), how the local PE would determine which interface traffic belongs to? – Jordan Head Feb 5 at 20:46
  • I mean if you check the content of the vpn-b.l2vpn.0 table in my initial post, then it has only one BGP-learned route 65512:200:1:1/96. However, let's say that besides 65512:200:1:1/96 there are also 65512:200:3:1/96 and 65512:200:4:1/96 BGP-learned routes in that table. Now how does the PE know that ingress frames to ge-0/0/0.515 interface have to be associated with the 65512:200:1:1/96 and thus get the inner label of 800257. – Martin Feb 7 at 17:45
  • 1
    Hey @Martin, I added more detail - let me know if that does the trick or not. The short of it is that every L2VPN CE interface is its own site, so each side knows what labels to use because the site ID differentiates the label calculation. – Jordan Head Feb 8 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.