BGP L2VPN
The BNG Blaster supports BGP auto-discovery and signaling for Layer 2 VPNs (RFC 6624), also known as BGP L2VPN, Kompella L2VPN or BGP VPWS, where point-to-point pseudowires between the CEs of an L2VPN are signaled with label blocks using the BGP NLRI of RFC 4761 (AFI 25, SAFI 65).
Learn the label blocks received from the DUT
Advertise label blocks of an emulated PE using RAW update files generated with
bgpupdate --l2vpnSend traffic streams as Ethernet over MPLS with the pseudowire label resolved from the label block of the remote CE
Verify the traffic received from the DUT including the label advertised by the BNG Blaster
Reply to ARP, IPv6 neighbor solicitation and ICMP echo requests of a real CE
Label Blocks
Each CE of an L2VPN has a unique CE ID (site identifier). The PE advertises
for each local CE one or more label blocks, where a label block with label
block offset O, label block size S and label base L contains the
labels L to L + S - 1 for the remote CE IDs O to O + S - 1.
A PE with local CE W sends traffic to the remote CE V with the label
L + W - O of the label block of CE V which covers CE W and
expects traffic from CE V with the label of its own label block
covering CE V (RFC 4761 section 3.2.3).
The label blocks are advertised with the route targets of the L2VPN and the Layer2 Info extended community, which signals the encapsulation type (e.g. 4 for Ethernet VLAN or 5 for Ethernet), the control flags (control word and sequenced delivery) and the Layer 2 MTU. The circuit status vector TLV (RFC 6624) signals the status of the pseudowire to each remote CE of the label block.
Routes
BGP sessions with learn-routes enabled and the family l2vpn learn all
label blocks received from the peer, which can be displayed with the
bgp-l2vpn-routes command. Withdrawn routes and routes of
sessions which went down are kept as inactive entries.
$ sudo bngblaster-cli run.sock bgp-l2vpn-routes
{
"status": "ok",
"code": 200,
"bgp-l2vpn-routes": [
{
"interface": "eth1",
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"routes": [
{
"rd": "10.0.0.1:300",
"ce-id": 1,
"active": true,
"version": 1,
"label-block-offset": 1,
"label-block-size": 2,
"label-base": 29,
"nexthop": "10.0.1.1",
"route-targets": [
"65000:300"
],
"layer2-info": {
"encapsulation-type": 4,
"encapsulation": "ethernet-vlan",
"flags": 2,
"control-word": true,
"sequencing": false,
"mtu": 0
},
"circuit-status": [
true,
true
]
}
]
}
]
}
Traffic Streams
Traffic streams with bgp-l2vpn-rd, bgp-l2vpn-ce-id (remote CE) and
bgp-l2vpn-local-ce-id (local CE emulated by the BNG Blaster) resolve the
pseudowire label from the active label block of the remote CE which covers
the local CE ID and send the stream packets as Ethernet frames over MPLS to
the destination-mac of the remote CE. The control word is added if requested
by the remote PE (control word flag) or enabled with tx-control-word.
Streams wait until a matching label block is learned and are rebuilt
automatically if the label block changes. The stream-info command
shows if the label is resolved (l2vpn-resolved), the resolved label
(l2vpn-label) and the circuit status signaled by the remote PE for the
local CE (l2vpn-circuit-up). The circuit status is only displayed, streams
are sent independent of the status.
The options vpws-vlan, vpws-inner-vlan, vpws-qinq, vpws-arp and
rx-control-word are supported as for EVPN VPWS. Received traffic
can be verified with rx-label1 (or rx-label2 with transport label).
{
"name": "L2VPN-PE-CE",
"type": "ipv4",
"direction": "downstream",
"network-interface": "eth1",
"network-ipv4-address": "192.0.2.1",
"destination-ipv4-address": "192.0.2.2",
"destination-mac": "02:00:00:00:00:02",
"bgp-l2vpn-rd": "10.0.0.1:300",
"bgp-l2vpn-ce-id": 1,
"bgp-l2vpn-local-ce-id": 2,
"vpws-vlan": 300
}
The label blocks of the emulated PE are generated with bgpupdate --l2vpn,
with one label block for the local CE --ce-id per L2VPN instance
(--service-num). The label block covers the remote CE IDs
--label-block-offset (default 1) to --label-block-offset +
--label-block-size (default 8) - 1, where the label block of instance n
starts with label --label-base + n * --label-block-size. The
encapsulation type is set with --encapsulation (ethernet-vlan or
ethernet), the control word flag with --control-word and the MTU with
--mtu. All circuits are signaled up in the circuit status vector.
The option --streams generates the corresponding streams named
l2vpn-<n>-pe-ce and l2vpn-<n>-ce-pe, where --stream-l2vpn-rd is the
route distinguisher and --stream-l2vpn-ce-id the CE ID of the DUT. The
CE to PE streams expect the label of the label block of the BNG Blaster which
covers the CE ID of the DUT. All other stream options (--stream-*) are the
same as for EVPN VPWS.
bgpupdate --l2vpn -n 10.0.1.2 -l 100 --rd 10.0.1.2:300 --rt 65000:300 \
-m 7000 --ce-id 2 --label-block-size 2 --control-word --end-of-rib -f l2vpn.bgp \
-s streams.json --stream-direction both --stream-pps 1000 \
--stream-interface eth1 --stream-ce-interface eth2 --stream-ce-vlan 300 \
--stream-l2vpn-rd 10.0.0.1:300 --stream-l2vpn-ce-id 1 \
--stream-destination-mac 02:00:00:00:00:02 --stream-vpws-vlan 300 --stream-vpws-arp
Testing BGP L2VPN
The test setup is the same as for EVPN services, where the
BNG Blaster emulates the remote PE with an internal BGP session (family l2vpn)
and an MPLS network interface, and the CE connected to the attachment
circuit of the DUT with a second network interface.
+----------------------------------+ +-------------------+
| BNG Blaster | | DUT |
| | | (PE) |
| remote PE eth1 10.0.1.2/24 |--- BGP L2VPN + MPLS ----| 10.0.1.1 |
| CE ID 2 02:00:00:00:00:01 | | CE ID 1 |
| | | |
| CE eth2 VLAN 300 |--- L2VPN (VLAN 300) ----| AC |
| 02:00:00:00:00:02 | | |
+----------------------------------+ +-------------------+
Step 1: Configure the DUT
Internal BGP session to the emulated PE (
10.0.1.2) with family L2VPN (AFI 25, SAFI 65)MPLS on the interface to the emulated PE and an MPLS path to the BGP next-hop of the emulated PE (e.g. LDP, segment routing or a static route)
L2VPN instance with route distinguisher
10.0.0.1:300, route target65000:300and Ethernet VLAN encapsulationLocal CE with CE ID (site identifier) 1 and the attachment circuit on VLAN 300 of the CE interface connected to the remote CE ID 2
Step 2: Generate the label block and streams of the emulated PE
Generate the RAW update file and streams with the bgpupdate command shown
above. The label block of the BNG Blaster (CE ID 2) must cover the CE ID of
the DUT (1) and the encapsulation, control word and MTU must match the
configuration of the DUT.
Step 3: Configure the BNG Blaster
The generated streams are added to the BNG Blaster configuration. The CE
interface resolves the gateway address 192.0.2.1 of the emulated PE via ARP
through the L2VPN, which is answered by the BNG Blaster (vpws-arp). The option
gateway-resolve-wait must be disabled for the CE interface because the
gateway is only reachable after the BGP session is established.
{
"interfaces": {
"network": [
{
"interface": "eth1",
"address": "10.0.1.2/24",
"gateway": "10.0.1.1"
},
{
"interface": "eth2",
"vlan": 300,
"address": "192.0.2.2/24",
"gateway": "192.0.2.1",
"gateway-resolve-wait": false
}
]
},
"bgp": [
{
"network-interface": "eth1",
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"local-as": 65000,
"peer-as": 65000,
"learn-routes": true,
"family": [ "l2vpn" ],
"raw-update-file": "l2vpn.bgp"
}
],
"streams": [
{
"name": "l2vpn-1-pe-ce",
"type": "ipv4",
"direction": "downstream",
"pps": 1000,
"network-interface": "eth1",
"destination-ipv4-address": "192.0.2.2",
"network-ipv4-address": "192.0.2.1",
"bgp-l2vpn-rd": "10.0.0.1:300",
"bgp-l2vpn-ce-id": 1,
"bgp-l2vpn-local-ce-id": 2,
"destination-mac": "02:00:00:00:00:02",
"vpws-arp": true,
"vpws-vlan": 300
},
{
"name": "l2vpn-1-ce-pe",
"type": "ipv4",
"direction": "downstream",
"pps": 1000,
"network-interface": "eth2:300",
"destination-ipv4-address": "192.0.2.1",
"network-ipv4-address": "192.0.2.2",
"rx-label1": 7000,
"rx-control-word": true
}
]
}
Step 4: Verify the control plane
Verify that the BGP session is established and the label block of the DUT
is learned (bgp-l2vpn-routes). On the DUT, the pseudowire to the remote
CE ID 2 should be up, using the label 7000 of the BNG Blaster to send traffic
and expecting the label of its own label block which covers CE ID 2.
Step 5: Verify the traffic
The stream-info command shows the resolved label of the PE to
CE stream, which must be the label expected by the DUT.
$ sudo bngblaster-cli run.sock stream-info flow-id 1
{
"status": "ok",
"code": 200,
"stream-info": {
"name": "l2vpn-1-pe-ce",
...
"l2vpn-resolved": true,
"l2vpn-label": 30,
"l2vpn-circuit-up": true
}
}
All streams should be received without loss. Further tests can withdraw
the label block of the emulated PE with a RAW update file generated with
--withdraw (bgp-raw-update command) or scale the number
of L2VPN instances with --service-num.
Troubleshooting
Problem |
Possible Cause and Solution |
|---|---|
Stream |
The |
Pseudowire is down on the DUT |
The label block of the BNG Blaster must cover the CE ID of the
DUT and the encapsulation type, control word flag and MTU must
match the configuration of the DUT (RFC 6624 section 5.1).
Routes of internal BGP sessions require the local preference
( |
PE to CE frames are received by the CE with 4 additional bytes or are dropped by the DUT |
Control word mismatch. Generate the label blocks with
|
PE to CE frames are dropped by the DUT |
With Ethernet VLAN encapsulation, the DUT may expect the
customer VLAN within the pseudowire, add |
BNG Blaster does not start traffic (resolve network interfaces) |
The CE interface waits for the gateway, which is only reachable
through the L2VPN. Disable |