E-VPN & PBB-EVPN: the Next Generation of MPLS-based L2VPN

Transcription

1

2 E-VPN & PBB-EVPN: the Next Generation of -based L2VPN Jose Liste Technical Marketing Engineer

3 Agenda Technical Overview Flows and Use Cases Cisco s PBB-EVPN Implementation Summary 3

4 Technical Overview Highlights and Solution Requirements 4

5 DCI Brings New Requirements Data Center Interconnect requirements not fully addressed by current L2VPN technologies All-active Redundancy and Load Balancing Simplified Provisioning and Operation Optimal Forwarding Fast Convergence MAC Address Scalability Ethernet Virtual Private Network (E-VPN) and Provider Backbone Bridging EVPN (PBB-EVPN) designed to address these requirements

6 Towards EVPN Solve Challenges of VPLS for All-Active Redundancy Existing VPLS solutions do not offer an All-Active per-flow redundancy Looping of Traffic Flooded from PE Duplicate Frames from Floods from the Core M1 M1 Echo! CE2 M2 PE4 CE2 Duplicate! MAC Flip-Flopping over Pseudowire E.g. Port-Channel Load-Balancing does not produce a consistent hashvalue for a frame with the same source MAC (e.g. non MAC based Hash-Schemes) M1 MAC Flip- Flop PE4 PE4 CE2 M2 6

7 Solution Requirements All-Active Redundancy and Load Balancing Flow-based Multi-pathing WAN Flow-based Load balancing Backdoor Geo- Redundancy All-Active Redundancy to maximize bisectional bandwidth Load-balance traffic among PEs and exploit core ECMP based on flow entropy (flow can be L2/L3/L4 or combinations) Support geo-redundant PE nodes with optimal forwarding Flexible Redundancy Grouping of PEs Site 1 Site 2 Site N 7

8 Solution Requirements All-Active Redundancy and Load Balancing (cont.) Active / Active Multi-Homing with flow-based load balancing in CE to PE direction Maximize bisectional bandwidth Flows can be L2/L3/L4 or combinations Flow-based load balancing in PE to PE direction Multiple RIB entries associated for a given MAC Exercises multiple links towards CE Vlan X - F1 Vlan X F2 Vlan X - F1 Vlan X F2 Flow Based Load-balancing CE to PE direction PE PE PE PE Flow Based Load-balancing PE to PE direction PE PE PE PE 8

9 Solution Requirements All-Active Redundancy and Load Balancing (cont.) Flow-based Multi-Pathing Load balancing across equal cost multiple paths in the core Vlan X - F1 Vlan X F2 Vlan X F3 Vlan X F4 PE Flow Based Multi-Pathing in the Core P P PE Load balancing at PE and P routers based on Entropy labels PE P P PE 9

10 Solution Requirements Optimal Forwarding Optimal forwarding for unicast and multicast CE2 Shortest path no triangular forwarding at steady-state Triangular Forwarding! PE4 Loop-Free & Echo-Free Forwarding CE2 Avoid duplicate delivery of flooded traffic Echo! Multiple multicast tunneling options: Ingress Replication P2MP LSM tunnels MP2MP PE4 CE2 Duplicate! PE4 10

11 Solution Requirements MAC Address Scalability N * 1M 1M s WAN 1K s 10K s Server Virtualization fueling growth in MAC Address scalability: 1 VM = 1 MAC address. 1 server = 10 s or 100 s of VMs MAC address scalability most pronounced on Data Center WAN Edge for Layer 2 extensions over WAN. Example from a live network: 1M MAC addresses in a single SP data center DC Site 1 DC Site 2 DC Site N 11

12 Ethernet VPN Highlights Next generation solution for Ethernet multipoint connectivity services Leverage similarities with L3VPN Data-plane address learning from Access Control-plane address advertisement / learning over Core PEs run Multi-Protocol BGP to advertise & learn MAC addresses over Core VID 100 SMAC: M1 DMAC: F.F.F CE3 Learning on PE Access Circuits via data-plane transparent learning No pseudowire full-mesh required Unicast: use MP2P tunnels Multicast: use ingress replication over MP2P tunnels or use LSM PE4 Under standardization at IETF draftietf-l2vpn-evpn BGP MAC adv. Route E-VPN NLRI MAC M1 via

13 PBB Ethernet VPN Highlights Combines Ethernet Provider Backbone Bridging (PBB - IEEE 802.1ah) with Ethernet VPN Data-plane address learning from Core Remote C-MAC to remote B-MAC binding Control-plane address advertisement / learning over Core (B-MAC) PEs perform as PBB Backbone Edge Bridge (BEB) Reduces number of BGP MAC advertisements routes by aggregating Customer MACs (C- MAC) via Provider Backbone MAC (B-MAC) Addresses virtualized data centers with C-MAC count into the millions PEs advertise local Backbone MAC (B-MAC) addresses in BGP Data-plane address learning from Access Local C-MAC to local B- MAC binding B-MAC: B-M1 B-M2 CE3 C-MAC and C-MAC to B-MAC mapping learned in data-plane B-MAC: B-M1 B-M2 Under standardization at IETF draft-ietfl2vpn-pbb-evpn PE4 BGP MAC adv. Route E-VPN NLRI MAC B-M1 via

14 Technical Overview Concepts 14

15 E-VPN / PBB-EVPN Concepts E-VPN Instance (EVI) Ethernet Segment BGP Routes BGP Route Attributes PE BD BD EVI EVI SHD ESI1 MHD ESI2 CE2 Route Types [1] Ethernet Auto-Discovery (AD) Route [2] MAC Advertisement Route [3] Inclusive Multicast Route [4] Ethernet Segment Route Extended Communities ESI Label ES-Import MAC Mobility Default Gateway EVI identifies a VPN in the network Encompass one or more bridge-domains, depending on service interface type Port-based VLAN-based (shown above) VLAN-bundling VLAN aware bundling (NEW) Represents a site connected to one or more PEs Uniquely identified by a 10- byte global Ethernet Segment Identifier (ESI) Could be a single device or an entire network Single-Homed Device (SHD) Multi-Homed Device (MHD) Single-Homed Network (SHN) Multi-Homed Network (MHN) E-VPN and PBB-EVPN define a single new BGP NLRI used to carry all E- VPN routes NLRI has a new SAFI (70) Routes serve control plane purposes, including: MAC address reachability MAC mass withdrawal Split-Horizon label adv. Aliasing Multicast endpoint discovery Redundancy group discovery Designated forwarder election New BGP extended communities defined Expand information carried in BGP routes, including: MAC address moves C-MAC flush notification Redundancy mode MAC / IP bindings of a GW Split-horizon label encoding

16 E-VPN Instance (EVI) & Service Interfaces E-VPN Instance (EVI) identifies a VPN in the /IP network EVI may encompass one or more bridge-domains, depending on PE s service interface type: Port Based Service Interface All CE-VLANs UNI CE UNI VPN A UNI CE VLAN Based Service Interface CE VLAN X VLAN Y UNI UNI VPN A VPN B UNI CE VLAN Bundling Service Interface CE-VLAN subset UNI CE UNI VPN A UNI CE VLAN Aware Bundling Service Interface CE-VLAN subset UNI New! VPN A CE UNI UNI CE PE BD EVI PE BD BD EVI EVI PE BD EVI PE BD BD EVI

17 Ethernet Segment Definition SHD ESI1 MHD ESI2 CE2 PE5 CE4 CE5 MHN ESI4 MHD ESI3 CE3 PE4 CE6 SHN ESI5 Ethernet Segment is a site connected to one or more PEs Ethernet Segment could be a single device (i.e. CE) or an entire network Single-Homed Device (SHD) Multi-Homed Device * (MHD) using Ethernet Multi-chassis Link Aggregation Group Single-Homed Network (SHN) Multi-Homed Network * (MHN) Uniquely identified by a 10-byte global Ethernet Segment Identifier (ESI) (*) Includes Dual-Homed Device

18 Ethernet Segment ESI Auto-Sensing LACPDU BPDU CE MST LACPDU CE2 BPDU MHD with Multi-chassis LAG ESI is auto-discovered via LACP ESI is encoded using the CE s LACP parameters: MHN with MST ESI is auto-discovered via MST BPDU snooping ESI is encoded using the IST s root parameters: System Priority System MAC Address Port Key Bridge Priority Root Bridge MAC 0x bytes 6 bytes 2 bytes 2 bytes 6 bytes 2 bytes 18

19 Split Horizon For Ethernet Segments E-VPN Challenge: How to prevent flooded traffic from echoing back to a multi-homed Ethernet Segment? Echo! ESI-1 ESI-2 CE3 CE5 CE4 PE4 PE advertises in BGP a split-horizon label (ESI Label) associated with each multi-homed Ethernet Segment Split-horizon label is only used for multi-destination frames (Unknown Unicast, Multicast & Broadcast) When an ingress PE floods multi-destination traffic, it encodes the Split- Horizon label identifying the source Ethernet Segment in the packet Egress PEs use this label to perform selective split-horizon filtering over the attachment circuit

20 Split Horizon For Ethernet Segments PBB-EVPN Challenge: How to prevent flooded traffic from echoing back to a multi-homed Ethernet Segment? Echo! ESI-1 B-MAC1 B-MAC1 ESI-2 CE3 CE5 CE4 PE4 PEs connected to the same MHD use the same B-MAC address for the Ethernet Segment 1:1 mapping between B-MAC and ESI (for All-Active Redundancy with flow-based LB) Disposition PEs check the B-MAC source address for Split-Horizon filtering Frame not allowed to egress on an Ethernet Segment whose B-MAC matches the B- MAC source address in the PBB header

21 Split Horizon For Core Tunnels Challenge: How to prevent flooded traffic from looping back over the core? ESI-1 Loop! ESI-2 CE3 CE4 CE5 PE4 Traffic received from an tunnel over the core is never forwarded back to the core This is similar to the VPLS split-horizon filtering rule 21

22 Designated Forwarder (DF) DF Election Challenge: How to prevent duplicate copies of flooded traffic from being delivered to a multi-homed Ethernet Segment? ESI-1 ESI-2 CE2 Duplicate! PE4 PEs connected to a multi-homed Ethernet Segment discover each other via BGP These PEs then elect among them a Designated Forwarder responsible for forwarding flooded multi-destination frames to the multi-homed Segment DF Election granularity can be: Multiple DFs for load-sharing Per Ethernet Tag on Ethernet Segment (E-VPN) Per I-SID on Ethernet Segment (PBB-EVPN)

23 Designated Forwarder (DF) DF Filtering MHD All-Active with Per-Flow Load Balancing MHD / MHN All-Active with Per-Service Load Balancing CE! DF Filtering Legend Multi-destination Traffic Unicast Traffic MHN CE2! DF Filtering CE! DF Filtering Filtering Direction: Core to Segment Filtered Traffic: Flooded multi-destination Filtering Direction: Core to Segment Segment to Core Filtered Traffic: Flooded multi-destination Unicast 23

24 Aliasing I can reach MAC1 via ESI1 E-VPN Challenge: How to load-balance traffic towards a multihomed device across multiple PEs when MAC addresses are learnt by only a single PE? MAC1 ESI-1 MAC1 I can reach ESI1 (All-Active) I can reach ESI1 (All-Active) PE4 MAC1 ESI1 CE3 CE4 PEs advertise in BGP the ESIs of local multi-homed Ethernet Segments All-Active Redundancy Mode indicated When PE learns MAC address on its AC, it advertises the MAC in BGP along with the ESI of the Ethernet Segment from which the MAC was learnt Remote PEs can load-balance traffic to a given MAC address across all PEs advertising the same ESI

25 Aliasing PBB-EVPN I can reach B-MAC1 I can reach MAC1 via B-MAC1 MAC1 B-MAC1 Challenge: How to load-balance traffic towards a multihomed device across multiple PEs when MAC addresses are learnt by only a single PE? MAC1 MAC1 B-M1 B-M1 ESI-1 I can reach B-MAC1 PE4 CE3 CE4 PEs connected to the same MHD use the same B-MAC address for the Ethernet Segment 1:1 mapping between B-MAC and ESI (for All-Active Redundancy with flow-based LB) PEs advertise their B-MAC addresses independent of the C-MAC learning state Remote PEs can load-balance traffic to a given C-MAC across all PEs advertising the same associated B-MAC

26 Backup Path I can reach MAC1 via ESI1 E-VPN I can reach ESI1 (Active/Standby) MAC1 ESI1 (Active) (Backup) Challenge: How to identify PEs that have a backup path to a multi-homed Ethernet Segment? MAC1 MAC1 CE3 ESI-1 I can reach ESI1 (Active/Standby) PE4 CE4 PEs advertise in BGP connectivity to ESIs associated with local multi-homed Ethernet Segments Active/Standby Redundancy Mode is indicated When PE learns a MAC address on its AC, it advertises the MAC in BGP along with the ESI of the Ethernet Segment from which the MAC was learnt Remote PEs will install: active path to the PE that advertised both MAC Address & ESI backup path to the PE that advertised ESI only

27 MAC Mass-Withdraw E-VPN Challenge: How to inform remote PEs of a failure affecting many MAC addresses quickly while the control-plane re-converges? MAC1 I can reach MAC1 via ESI1 I can reach ESI1 (All-Active) MAC1, MAC2, MACn ESI-1 I can reach MAC2 via ESI1 I can reach MACn via ESI1 I lost ESI1 I can reach ESI1 (All-Active) MAC1,.. MACn ESI1 PE4 CE3 CE4 X PEs advertise two sets of information: MAC addresses along with the ESI from the address was learnt Connectivity to ESI(s) If a PE detects a failure impacting an Ethernet Segment, it withdraws the route for the associated ESI Remote PEs remove failed PE from the path-list for all MAC addresses associated with an ESI This effectively is a MAC mass-withdraw function 27

28 Technical Overview Comparison of Solutions 28

29 Comparison of L2VPN Solutions Requirement VPLS PBB-VPLS E-VPN PBB-EVPN Multi-Homing with All-Active Forwarding Service Based Load-balancing CE-to-PE Flow Based Load-balancing CE-to-PE x x Flow Based Load-balancing PE-to-PE x x Flow Based Multi-Pathing in the Core Provisioning Simplicity Core Auto-Discovery Access Auto-Sensing x x Redundancy Group Auto-Discovery x x Automatic Designated Forwarder election and Service Carving x x Service Interfaces Port-Based / VLAN-based / VLAN Bundling VLAN-aware Bundling x x Multi-Destination Traffic Forwarding Ingress Replication LSM with P2MP Tree LSM with MP2MP Tree x x 29

30 Comparison of L2VPN Solutions (cont.) Requirement VPLS PBB-VPLS E-VPN PBB-EVPN Fast Convergence CE-PE Link Failures / PE Node Failures MAC Mobility CE-PE Link Failures with Local Repair x x MAC Scalability Scale to Millions of C-MAC Addresses x x Confinement of C-MAC entries to PE with active flows x MAC Summarization x x MAC Summarization co-existence with C-MAC Mobility x x x Seamless Interworking with TRILL / 802.1aq / 802.1Qbp x x Flexible VPN Policies Per C-MAC Forwarding Control Policies x x x Per-Segment Forwarding Control Policies x x 30

31 Flows and Use Cases PBB-EVPN Startup Sequences 31

32 PBB-EVPN Startup Sequence Segment Auto-Discovery VPN Auto-Discovery ESI and B-MAC Auto-Sensing Multicast Tunnel ID / Endpoint Discovery Redundancy Group Membership Auto-Discovery Backbone MAC (B-MAC) Reachability Advertisement 32

33 PBB-EVPN Startup Sequence (cont.) ESI and B-MAC Auto-Sensing Segment Auto-Discovery ESI (10B) can be auto-generated* from CE s LACP information -> concatenation of CE s LACP System Priority + Sys ID + Port Key Example: System Priority System MAC Address Port Key 2 bytes 6 bytes 2 bytes ESI and B-MAC Auto-Sensing LACP PDU exchange B-MAC B-MAC CE LACP info: LACP System ID (MAC) (6B) e.g LACP System Priority (2B) e.g LACP Port Key (2B) e.g B-MAC B-MAC CE3 Source B-MAC used at PBB-EVPN PE on a given ESI can be auto-generated* from CE s LACP information -> CE s LACP System ID MAC with U/L** (Universal / Locally Administered) bit flipped Example: PE4 (*) ESI and B-MAC can also be manually configured (**) U/L is second-least-significant bit of most significant byte 33

34 PBB-EVPN Startup Sequence (cont.) BGP Ethernet Segment Route PE 1 Eth Segment Route Segment Auto-Discovery MAC address portion of ESI (6B) RD = RD10 ESI = ESI1 ES-Import ext. comm. e.g RD RD unique per advertising PE ESI and B-MAC Auto-Sensing CE3 Redundancy Group Membership Auto-Discovery PE4 PE 2 Eth Segment Route RD = RD20 ESI = ESI1 ES-Import ext. comm. e.g

35 PBB-EVPN Startup Sequence Ordered List of discovered PEs starting from zero (lowest IP add) Designated Forwarder (DF) Election* Segment Auto-Discovery Result of modulo operation is used to determine DF and BDF status Modulo Operation I-SID I-SID mod N (N = # of PEs) (e.g. I-SID mod 2) PE Ordered List Position PE 0 1 Example: DF for I-SIDs 100, 102 BDF for I-SIDs 101, 103 ESI and B-MAC Auto-Sensing Exchange of Ethernet Segment Routes CE3 Redundancy Group Membership Auto-Discovery Modulo Operation I-SID (I-SID mod 2) (*) DF election with Service Carving shown (i.e. one DF per I-SID in the segment) PE Ordered List Position PE 0 1 Example: DF for I-SIDs 101, 103 BDF for I-SIDs 100, 102 PE4 DF Designated Forwarder BDF Backup Designated Forwarder I-SID PBB 24-bit Service Instance ID 35

36 PBB-EVPN Startup Sequence (cont.) BGP MAC Advertisement Route (B-MAC) MAC Route RD RD unique per advertising PE per EVI Segment Auto-Discovery ESI and B-MAC Auto-Sensing MP2P VPN Label downstream allocated label used by other PEs to send traffic to advertised (MAC,EVI) RD = RD-1a ESI = all 1s MAC = B-M1 Label = L1 RT ext. community RT-a ESI reserved ESI indicates advertised MAC is a B-MAC B-MAC advertised by route B-M1 B-M2 CE3 Redundancy Group Membership Auto-Discovery Backbone MAC (B-MAC) Reachability Advertisement MAC Route RD = RD-2a ESI = all 1s B-M1 PE4 B-M2 MAC = B-M1 / PE4 RIB Path List Label = L2 VPN MAC ESI NH RT ext. community RT-a B-M1 n/a RT-a 36

37 PBB-EVPN Startup Sequence BGP Inclusive Multicast Route Tunnel Type Ingress Replication or P2MP LSP PE 1 Inclusive Multicast Route RD = RD-1a PMSI Tunnel Attribute RD RD unique per adv. PE per EVI VPN Auto-Discovery Mcast Label used to transmit BUM traffic - downstream assigned (ing. repl.) or upstream assigned (Aggregate Inclusive P2MP LSP 2 ) Tunnel Type (e.g. Ing. Repl.) Label (e.g. L1) RT ext. community RT-a Multicast Tunnel ID / Endpoint Discovery 1 RT RT associated with a given EVI CE3 PE 2 Inclusive Multicast Route RD = RD-2a PMSI Tunnel Attribute Tunnel Type (e.g. Ing. Repl.) PE4 Label (e.g. L2) (1) Inclusive Multicast Route advertized per I-SID (2) Multicast label is not set for Inclusive Trees (P2MP LSP) RT ext. community RT-a PMSI - P-Multicast Service Interface BUM Broadcast / Unknown Unicast / Multicast 37

38 Flows and Use Cases PBB-EVPN Life of a Packet 38

39 PBB-EVPN Life of a Packet Ingress Replication Multi-destination Traffic Forwarding B-M1 During start-up sequence,,,, PE4 sent Inclusive Multicast route which include Mcast label B-M2 receives broadcast traffic from. adds PBB encapsulation and forwards it using ingress replication 3 copies created VID 100 SMAC: M1 DMAC: F.F.F B-M1 PSN label to reach L3 PBB Mcast Label assigned by for incoming BUM traffic on a given EVI B-M2 as DF, it forwards BUM traffic towards segment CE3 CE3 L2 PBB L4 PBB PE 2 Inclusive Multicast Route B-M1 B-M2 B-M1 B-M2 RD = RD-2a PMSI Tunnel Attribute Tunnel Type = Ing. Repl. Label = L2 RT ext. community RT-a PE4 Mcast Label used to transmit BUM traffic - downstream assigned (for ingress replication) drops BUM traffic originated on same source B- MAC (B-M1) MAC Table I-SID xyz C-MAC M1 B-MAC B-M1 PE4 PE4 non-df for given I-SID drops BUM traffic Data-plane based MAC learning for C-MAC / B-MAC association 39

40 PBB-EVPN Life of a Packet (cont.) Unicast Traffic Forwarding and Aliasing MP2P VPN Label downstream allocated label used by other PEs to send traffic to advertised MAC VID 100 SMAC: M1 DMAC: F.F.F B-M1 MAC Route RD = RD-1a ESI = all 1s MAC = B-M1 Label = L1 RT ext. community RT-a MAC advertised by route B-M2 CE3 PSN label to reach B-M1 MP2P VPN Label assigned by for incoming traffic for target EVI L1 PBB forwards traffic on a flow (flow 1) to M1 using B-MAC B- M1 towards forwards traffic on a flow (flow 2) to M1 using B-MAC B- M1 towards VID 100 SMAC: M3 DMAC: M1 VID 100 SMAC: M4 B-M2 DMAC: M1 CE3 During start-up sequence, & advertised MAC route for B-MAC (B- M1) MAC Route RD = RD-2a ESI = all 1s MAC = B-M1 Label = L2 RT ext. community RT-a B-M1 RIB VPN MAC ESI RT-a B-M1 n/a PE4 Path List NH B-M2 MAC Table I-SID xyz C-MAC M1 Data-plane based MAC learning for C- MAC / B-MAC association B-MAC B-M1 B-M1 PSN label to reach L2 PBB PE4 MP2P VPN Label assigned by for incoming traffic for target EVI B-M2 40

41 PBB-EVPN Life of a Packet (cont.) Active / Active Load Balancing from CE MP2P VPN Label downstream allocated label used by other PEs to send traffic to advertised MAC MAC Route RD = RD-3a ESI = 0 MAC = B-M3 Label = L3 ESI == 0 used for Single Home Device MAC advertised by route forwards traffic to M3 using B-MAC B-M3 towards PSN label to reach MP2P VPN Label assigned by for incoming traffic for target EVI B-M1 RT ext. community RT-a VID 100 SMAC: M1 DMAC: M3 B-M1 L3 PBB CE3 CE3 B-M3 B-M3 B-M1 VID 100 SMAC: M2 DMAC: M3 B-M1 L3 PBB PE 1 / RIB VPN MAC ESI RT-a B-M3 0 Path List NH / MAC Table I-SID xyz C-MAC M3 B-MAC B-M3 forwards traffic to M3 using B-MAC B-M3 towards 41

42 Flows and Use Cases PBB-EVPN Operational / Failure scenarios 42

43 PBB-EVPN Operational Scenarios MAC Mobility 1 learns C-MAC M1 on local port and forwards across core according to C-MAC DA to Remote B-MAC mapping VID 100 SMAC: M1 DMAC: M2 B-M1 3 Host M1 moves from to CE3 s location B-M2 MAC Mobility event handled entirely by data-plane learning 2 Via data-plane learning, learns C-MAC M1 via B- MAC B-M1 5 Via data-plane learning, updates C-MAC M1 location (via B-MAC B-M2) 1 4 B-M1 4 After host sends traffic at new location, updates C-MAC M1 location (local port.) also forwards across core according to C- MAC DA to Remote B-MAC mapping B-M2 VID 100 SMAC: M1 DMAC: F.F.F L1 L2 PBB CE3 L3 L4 PBB CE3 M1 M1 M1 B-M1 B-M2 B-M1 B-M2 1 MAC Table I-SID xyz C-MAC B-MAC M1 - PE4 2 MAC Table I-SID xyz C-MAC M1 B-MAC B-M1 5 MAC Table I-SID xyz C-MAC M1 B-MAC B-M2 PE4 MAC Table I-SID xyz C-MAC B-MAC M1-4 43

44 PBB-EVPN Failure Scenarios / Convergence Link / Segment Failure Active/Active per Flow 1 detects failure of one of its attached segments 2 withdraws B-MAC advertised for failed segment (B-M1) B-M1 B-M2 CE3 2 3 withdraws Ethernet Segment Route B-M1 B-M2 / PE4 remove from path list for B- MAC (B-M1) 4 PE4 reruns DF election. Becomes DF for all I- SIDs on segment, PE4 RIB VPN MAC ESI Path List NH RT-a B-M1 n/a

45 PBB-EVPN Failure Scenarios / Convergence PE Failure Core Isolation 1 experiences a node failure (e.g. power failure) 2 BGP RR / detects BGP session time-out with 3 sends LACP OUT_OF_SYNC for to take port out of the bundle 1 looses connectivity to the core 2 BGP RR / detects BGP session time-out with B-M1 B-M2 LACP PDU B-M1 B-M2 CE3 CE3 2 BGP RR / detects BGP session time-out with B-M1 2 BGP RR / PE4 detects BGP session timeout with PE4 B-M2 3 / PE4 invalidate routes from 2 BGP RR / detects BGP session timeout with B-M1 2 BGP RR / PE4 detects BGP session timeout with PE4 B-M2 4 / PE4 invalidate routes from 4 reruns DF election. Becomes DF for all I- SIDs on segment, PE4 RIB Path List VPN MAC ESI NH RT-a B-M1 n/a 5 reruns DF election. Becomes DF for all I- SIDs on segment, PE4 RIB VPN MAC ESI RT-a M1 ES1 Path List NH 45

46 Use Cases 46

47 PBB-EVPN Model Ethernet Segment Identifier ESI 1 Customer Bridge Domain BD B-MAC1 Core Bridge Domain BD ESI 2 BD B-MAC2 BD BD E-VPN Forwarder BD EFP I-Component B-Component

48 PBB-EVPN Sample Use Access Single Home Device (SHD) Single Home Network (SHN) Dual Home Device (DHD) Active / Active Per-Flow LB Dual Home Device (DHD) Active / Active Per-Service LB VID X CE2 ESI Null Core VID X BMAC 1 ESI W Core VID X BMAC 1 ESI W Core ESI Null VID X VID X BMAC 1 ESI W VID Y BMAC 2 ESI W Null Ethernet Segment Identifier (ESI) Identical B-MAC on PBB- EVPN PEs ( / ) Identical ESI on PBB-EVPN PEs Different B-MAC on PBB- EVPN PEs ( / ) Identical ESI on PBB-EVPN PEs Per service (I-SID) carving (manual or automatic) 48

49 PBB-EVPN Sample Use Access (cont.) Multi Home Device (MHD) Active / Active Per-Flow LB Multi Home Device (MHD) Active / Active Per-Service LB VID X VID X BMAC 1 ESI W BMAC 1 ESI W VID X BMAC 1 ESI W Core VID X VID Z BMAC 1 ESI W BMAC 2 ESI W VID Y BMAC 3 ESI W Core More than two (2) PEs in redundancy group Same as DHD Act/Act perflow LB More than two (2) PEs in redundancy group Same as DHD Act/Act perservice LB 49

50 PBB-EVPN Sample Use Access (cont.) Dual Home Network (DHN) ITU-T G.8032 Dual Home Network (DHN) REP Dual Home Network (DHN) Active / Active Per-Service LB VID X ESI Null ESI Null VID X BMAC 1 ESI W RPL Link VID Y R-APS G.8032 Open Sub-ring VID X Core REP REP Edge No Neighbour VID Y VID X REP-AG REP-AG Core VID X VID Y Core CE2 VID Y ESI Null ALT port CE2 VID Y ESI Null CE2 BMAC 2 ESI W Treated as SHN by PBB- EVPN PEs ( / ) Null ESI; No DF election / No service carving Ring operation controlled by R-APS protocol Treated as SHN by PBB- EVPN PEs ( / ) Null ESI; No DF election / No service carving Segment operation controlled by REP protocol Different B-MAC on PBB- EVPN PEs ( / ) Identical ESI on PBB-EVPN PEs Per service (I-SID) carving (manual or automatic) 50

51 PBB-EVPN IOS-XR Implementation Configuration and Examples 51

52 PBB-EVPN Single Home Device (SHD) MINIMAL Configuration interface Bundle-Ether1.777 l2transport encapsulation dot1q 777 l2vpn bridge group gr1 bridge-domain bd1 interface Bundle-Ether1.777 pbb edge i-sid 100 core-bridge-domain core_bd1 bridge group gr2 bridge-domain core_bd1 pbb-core evpn evi 1000 router bgp 64 address-family l2vpn evpn! neighbor <x.x.x.x> remote-as 64 address-family l2vpn evpn Global B-MAC SA Auto RT for EVI Auto RD for EVI Auto RD for Segment Route PBB I-component Includes I-SID assignment PBB B-component No need to define B-VLAN Mandatory - Globally unique identifier for all PEs in a given EVI BGP configuration with new E-VPN AF Bundle- Eth1.777 Core Note: / LDP configuration required on core-facing interfaces (not shown) 52

53 PBB-EVPN Dual Home Device (DHD) Active / Active per-flow Load Balancing redundancy iccp group 66 mlacp node 1 mlacp system mac 0aaa.0bbb.0ccc mlacp system priority 1 mode singleton interface Bundle-Ether25 mlacp iccp-group 66 interface Bundle-Ether25.1 l2transport encapsulation dot1q 777 l2vpn bridge group gr1 bridge-domain bd1 interface Bundle-Ether25.1 pbb edge i-sid 100 core-bridge-domain core_bd1 bridge group gr2 bridge-domain core_bd1 pbb-core evpn evi 1000 router bgp 64 address-family l2vpn evpn neighbor <x.x.x.x> remote-as 64 address-family l2vpn evpn Auto ESI Auto B-MAC SA A/A Per-flow LB (default) Auto RT for EVI Auto RD for EVI Auto RD for Segment Route should use same RG number PE 2 should use different mlacp node id should use same mlacp system mac and system priority ICCP in singleton mode (i.e.no peer neighbor configuration) PBB I-component and B- component configuration. ISIDs must match on both PEs No need to define B-VLAN Mandatory EVI ID configuration BGP configuration with new EVPN AF Bundle- Eth25.1 Bundle- Eth25.1 MINIMAL Configuration Core Note: / LDP configuration required on core-facing interfaces (not shown) 53

54 PBB-EVPN Dual Home Device (DHD) Active / Active per-service Load Balancing and Dynamic Service Carving MINIMAL Configuration interface Bundle-Ether25.1 l2transport encapsulation dot1q 777 evpn interface Bundle-Ether25 ethernet-segment identifier system-priority 1 system-id b25.00ce load-balancing-mode per-service l2vpn bridge group gr1 bridge-domain bd1 interface Bundle-Ether25.1 pbb edge i-sid 100 core-bridge-domain core_bd1 bridge group gr2 bridge-domain core_bd1 pbb-core evpn evi 1000 router bgp 64 address-family l2vpn evpn neighbor <x.x.x.x> remote-as 64 address-family l2vpn evpn Global B-MAC SA Default Service Carving Auto RT for EVI Auto RD for EVI Auto RD for Segment Route A/A per-service (per-isid) load balancing with dynamic Service Carving ESI must match on both PEs PBB I-component and B- component configuration. ISIDs must match on both PEs No need to define B-VLAN Mandatory EVI ID configuration BGP configuration with new EVPN AF Bundle- Eth25 Bundle- Eth25 Core Note: / LDP configuration required on core-facing interfaces (not shown). ICCP (singleton) config (not shown) 54

55 Summary 55

56 Summary E-VPN / PBB-EVPN are next-generation L2VPN solutions based on a BGP control-plane for MAC distribution/learning over the core E-VPN / PBB-EVPN were designed to address following requirements: All-active Redundancy and Load Balancing Simplified Provisioning and Operation Optimal Forwarding Fast Convergence In addition, PBB-EVPN and its inherent MAC-in-MAC hierarchy provides: Scale to Millions of C-MAC (Virtual Machine) Addresses MAC summarization co-existence with C-MAC (VM) mobility E-VPN / PBB-EVPN applicability goes beyond DCI into Carrier Ethernet use cases 56

57 Content at Cisco Live US 2013 BRKMPL Introduction to BRKMPL Deploying Traffic Engineering BRKMPL Deploying -based Layer 2 Virtual Private Networks BRKMPL Deploying -based IP VPNs BRKMPL Designing in Next Generation Data Center: A Case Study BRKMPL Solutions for Cloud Networking - E-VPN & PBB-EVPN: the Next Generation of -based L2VPN BRKMPL Generalized - Introduction and Deployment BRKMPL Advanced Topics and Future Directions in LTRMPL Enterprise Network Virtualization using IP and Technologies: Introduction LTRMPL Unified Lab LTRMPL Enterprise Network Virtualization using IP and Technologies: Advanced PNLSPG Transport Evolution in SP Core Networks TECMPL Unified - An architecture for Advanced IP NGN Scale TECMPL SDN WAN Orchestration in and Segment Routing Networks 57

58 References draft-ietf-l2vpn-evpn draft-ietf-l2vpn-pbb-evpn draft-ietf-l2vpn-trill-evpn 58

59 Acronyms IP and Acronym Description Acronym Description AC Attachment Circuit PW Pseudo-Wire AS Autonomous System PWE3 Pseudo-Wire End-to-End Emulation BFD Bidirectional Failure Detection QoS Quality of Service CoS Class of Service RD Route Distinguisher ECMP Equal Cost Multipath RIB Routing Information Base Eo Ethernet over RR Route Reflector E-VPN Ethernet Virtual Private Network RSVP Resource Reservation Protocol EVI E-VPN Instance RSVP-TE RSVP based Traffic Engineering FRR Fast Re-Route RT Route Target IGP Interior Gateway Protocol TE Traffic Engineering LDP Label Distribution Protocol tldp Targeted LDP LER Label Edge Router VC Virtual Circuit LFIB Labeled Forwarding Information Base VCID VC Identifier LSM Label Switched Multicast VFI Virtual Forwarding Instance LSP Label Switched Path VPLS Virtual Private LAN Service LSR Label Switching Router VPN Virtual Private Network Multi-Protocol Label Switching VPWS Virtual Private Wire Service NLRI Network Layer Reachability Information VRF Virtual Route Forwarding Instance PSN Packet Switch Network VSI Virtual Switching Instance 59

60 Acronyms Ethernet/Bridging Acronym Description Acronym Description ACL Access Control List MVRP Multiple VLAN Registration Protocol BD Bridge Domain PE Provider Edge device BPDU Bridge Protocol Data Unit PoA Point of Attachment CE Customer Equipment (Edge) REP Resilient Ethernet Protocol C-VLAN / CE- VLAN CoS DHD Customer / CE VLAN Class of Service Dual Homed Device REP-AG RG STP REP Access Gateway Redundancy Group Spanning Tree Protocol LACP Link Aggregation Control Protocol LAN Local Area Network MEF Metro Ethernet Forum MEN Metro Ethernet Network MIRP Multiple I-Tag Registration Protocol mlacp Multi-Chassis LACP MST / MSTP Multiple Instance STP MSTG-AG MST Access Gateway 60

61 Acronyms Provider Backbone Bridging Acronym B-BEB BCB B-DA BEB B-MAC B-SA B-Tag B-VLAN C-DA CE C-MAC C-SA Description B-Component BEB Backbone Core Bridge Backbone Destination Address Backbone Edge Bridge Backbone MAC Address Backbone Source Address B-VLAN Tag Backbone VLAN Customer Destination Address Customer Equipment (Edge) Customer MAC Address 80 C-VLAN Tag C-VLAN / CE- VLAN DA FCS IB-BEB Customer Source Address Customer / CE VLAN Destination MAC Address Frame Check Sequence Combined I-Component & B-Component BEB Acronym I-BEB IEEE I-SID I-Tag MAC N-PE PB PBB PBBN PBN PE Q-in-Q SA S-Tag S-VLAN UNI U-PE VLAN Description I-Component BEB Institute of Electrical and Electronics Engineers Instance Service Identifier I-SID Tag Media Access Control Network-facing Provider Edge device Provider Bridge Provider Backbone Bridge / Bridging Provider Backbone Bridging Network Provider Bridging Network Provider Edge device VLAN tunneling using two 802.1Q tags Source MAC Address S-VLAN Tag Service VLAN (Provider VLAN) User to Network Interface User-facing Provider Edge device Virtual LAN 61

62 Complete Your Online Session Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Cisco Daily Challenge points for each session evaluation you complete. Complete your session evaluation online now through either the mobile app or internet kiosk stations. Maximize your Cisco Live experience with your free Cisco Live 365 account. Download session PDFs, view sessions on-demand and participate in live activities throughout the year. Click the Enter Cisco Live 365 button in your Cisco Live portal to log in.

63

64 BGP Routes and Attributes 64

65 BGP Routes Overview (PBB) E-VPN defines a single new BGP NLRI used to carry all E-VPN routes. The NLRI has a new SAFI (70). (PBB) E-VPN speakers must first exchange BGP capability for E-VPN AFI / SAFI per RFC byte 1 byte Route Type Length 1. Ethernet Auto-Discovery (AD) Route 2. MAC Advertisement Route 3. Inclusive Multicast Route 4. Ethernet Segment Route Variable Route Type Specific

66 BGP Routes Route Types and Usage Route Usage Applicability Ethernet A-D Route MAC Mass-Withdraw Aliasing Advertising Split-Horizon Labels MAC Advertisement Route Advertise MAC Address Reachability Advertise IP/MAC Bindings E-VPN only E-VPN & PBB-EVPN Inclusive Multicast Route Ethernet Segment Route Multicast Tunnel Endpoint Discovery Redundancy Group Discovery DF Election E-VPN & PBB-EVPN E-VPN & PBB-EVPN

67 BGP Routes Route Attributes and Usage Attribute Usage Route Applicability ESI Label Extended Community ES-Import Extended Community Encode Split-Horizon Label for Ethernet Segment. Indicate Redundancy Mode (Active/Standby vs. All- Active) Limit the import scope of the Ethernet Segment routes. Ethernet A-D Route Ethernet Segment Route MAC Mobility Extended Community E-VPN: Indicate that a MAC address has moved from one segment to another across PEs. PBB-EVPN: Signal C-MAC address flush notification MAC Advertisement Route Default Gateway Extended Community Indicate the MAC/IP bindings of a gateway MAC Advertisement Route