Layer 2 Transport and Tunneling (L2VPN) Application and Deployment

Transcription

1 1 Layer 2 Transport and Tunneling (L2VPN) Application and Deployment 2 1

2 Objectives Review the basics of L2VPN technology Introduce the L2VPN (XConnect CLI) Outline common service requirements for L2VPN and how they are being addressed Cover how advanced networks can offer guaranteed bandwidth and PW circuit protection Expanded Case Studies will cover why and how SPs have chosen to implement L2VPNs 3 What You Should Know? Why L2VPN technology is becoming ever important to Service Providers? Good understanding of L2VPN technologies operation (AToM, L2TPv3) Quality of Service characteristics of traditional L2 and L3 encapsulations 4 2

3 Agenda L2VPN Technology Review Pseudo-wire Configuration Basics Implementation Considerations Case Studies 5 VPN Deployments Today: Technology and VPN Diversity Access Different Access Technologies Different Core Solutions Only Partial Integration Access IP/ IPsec MPLS or IP IP/ IPsec FR/ATM Broadband ATM FR/ATM Broadband Ethernet SONET Ethernet 6 3

4 Consolidated Core Supports Access Different Access Technologies Complete Integration Access IP/ IPsec MPLS or IP IP/ IPsec FR/ATM Broadband FR/ATM Broadband Ethernet Ethernet 7 A Brief Word about L2 / L3 VPNs Layer 3 VPNs Layer 2 VPNs Provider devices forward customer packets based on Layer 3 information (e.g., IP) Provider devices forward customer packets based on Layer 2 information SP involvement in routing Tunnels, circuits, LSPs, MAC address MPLS/BGP VPNs (RFC 2547), GRE, virtual router approaches pseudo-wire concept 8 4

5 What Is an L2VPN? IETF s L2VPN Logical Context An L2VPN is comprised of switched connections between subscriber endpoints over a shared network. Nonsubscribers do not have access to those same endpoints. SP Network Provider Edge SP Interconnection Remote Subscriber Location Provider Edge Pseudowire ATM PPP Ethernet HDLC FR Many subscriber encapsulations supportable Some L1 frame encapsulations are transportable under the framework of L2VPN. This is acceptable since (unlike native L1) Frames can be dropped dueto congestion. 9 L2VPN Data Messages Layer 2 PDU (variable) Control Word L2TPv3 Header IPv4 Header (20 Bytes) Native IP Layer 2 PDU (variable) Control Word MPLS VC-Label MPLS Tunnel Label (4 Bytes) MPLS Core Transported / Tunneled Protocol Opt. Control Info MUX ID Outer Delivery Protocol Both transport technologies have similar purposes, functionality and features. 10 5

6 Layer-2 Transport across MPLS Control Connection Directed LDP Used for VC-Label Negotiation, Withdrawal, Error Notification Transport Component Tunneling Component L2 PDU (Emulated) Emulated Circuits have 3 layers of encapsulation Tunnel Header (Tunnel Label) to get PDU from ingress to egress PE; could be an MPLS label, GRE tunnel, L2TP tunnel Demultiplexer field (VC Label) to identify individual circuits within a tunnel; could be an MPLS label, L2TPv3 header, GRE Key, etc. Emulated VC encapsulation (Control Word) information on enclosed Layer-2 PDU; implemented as a 32-bit control word 11 Layer-2 Transport over IP Control Connection L2TP Control Connection Used for Session ID Negotiation, Withdrawal, Error Notification Transport Component Tunneling Component L2 PDU Emulated Circuits have 3 layers of encapsulation Delivery Header (IPv4 Header) to get PDU from ingress to egress PE; could be an MPLS label, GRE tunnel, L2TP tunnel Demultiplexer field (L2TPv3 Header) to identify individual circuits within a tunnel; (4 byte Session ID + Optional 8 byte Cookie) L2 Specific Sublayer + Payload (Layer 2 PDU) Basic Priority & Sequence Support L2 Payload:ATM, HDLC, PPP, Ethernet, Frame Relay, etc. 12 6

7 Agenda L2VPN Technology Review Pseudo-wire Configuration Basics Implementation Considerations Case Studies 13 L2VPN XConnect CLI Overview Modular design allows application specific pseudo-wire characteristics to be applied easily to many individual VCs XConnect can be applied at Port, Sub-if, VP and VC level depending on access circuit (AC) type Control Channel can be tailored to fit the application 14 7

8 L2TPv3 XConnect CLI Components l2tp-class (optional) - Defines Control Plane attributes - Used to tweak defaults pseudowire-class - Characteristics template for PWs - Tunneling mechanism - Data plane encapsulation type Example: L2TP-Class is optional l2tp-class default hostname PE3 password 0 cisco cookie size 8 pseudowire-class vlan-hi-priority encapsulation l2tpv3 ip local interface Loopback0 ip pmtu ip tos value 5 xconnect <target pe> - Xconnect is defined - DLCI, VLAN, PVC information. interface FastEthernet5/1.500 encapsulation dot1q 500 service-policy input vlan-hi-priority no cdp enable xconnect pw-class vlan-hi-/ priority 15 AToM XConnect CLI Components ldp enabled - Defines LDP as label protocol - Globally defined Example: mpls label protocol ldp mpls ldp router-id loopback 0 force pseudowire-class (optional) - Characteristics template for PWs - Tunneling mechanism - Data plane encapsulation type pseudowire-class atom_default encapsulation mpls sequencing both 2 Ways to configure: - xconnect <target PE> - mpls l2transport route <target PE> interface FastEthernet5/1.500 encapsulation dot1q 500 service-policy input vlan-hi-priority xconnect pw-class foo 16 8

9 L2TPv3 Example of FR with different priorities frame-relay switching! pseudowire-class FR-CIR! encapsulation l2tpv3 sequencing both ip local interface Loopback0 ip tos value 5 pseudowire-class FR-NO-CIR! encapsulation l2tpv3 ip local interface Loopback0 ip tos value 0 connect fr-cir-1 ser2/0 500 l2transport xconnect pw-class FR-CIR connect fr-no-cir-1 ser2/0 501 l2transport xconnect pw-class FR-NO-CIR Turn Frame Relay Switching On Establish PW characteristics that reflect the service you wish to provide. Note: PW class is data plane only and the ToS values are in the outer delivery header. Apply to correct DLCIs 17 When and Where Can I Do This? Platform Support 7200, 7500, 10720, in S 1700, 2600, 3700, 7400 in T Cisco IOS Image 12.0(23)S Service Provider Train 12.3(1)T Technology Train 18 9

10 Agenda L2VPN Technology Review Pseudo-wire Configuration Basics Implementation Considerations Case Studies 19 Things to Consider.. How to provide different Classes of Service? When and where to enforce them? What options exist to provide network resiliency? How different media can introduce MTU issues? 20 10

11 Service Level Agreements Why Important? Service Providers require tools to measure and predict service delivery; vital to customer retention (Network Perspective) Enterprise ITs often provide Service Guarantees based on application criticality. (Budget dictates service) (Network and / or User Perspective) Common Components: Availability Predictability Reparation Service Credit, etc. 21 Layer-2 SLA FR / ATM customers receive traditional SLA FR / ATM / Ethernet access network may enforce SLA Pay-as-you-grow services can be implemented for PPP / HDLC Service is typically unmanaged CE Site 1 PE ATM Frame Relay Ethernet Service Provider PE CE Site

12 Service What Priority Options Do the SP Have? GFC VPI VCI PT CLP HEC DLCI C/R EA DLCI FECN BECN DE DA SA Type TAG L3 Data CRC Provide Service on Port, Layer 2 or Layer 3 Info Enforcing sub-rate leased line access L2 PDUs provide options for setting frame priority (ex: CLP, DE, 802.1p) L2 PVC or Inner L3 Precedence 23 Service Precedence Equivalence: MPLS / IP Outer Delivery Header IP Packet Data MPLS Label Label EXP S TTL Inner IP Header X X X y y 0 Class DSCP IP Precedence is the most often used in determining different traffic priorities (0 7) Most SPs implement 3 4 traffic classes (Best Effort Mission Critical) Enforce policies through shaping, marking, policing 24 12

13 Example What Are Common Service Requirements? Frame Relay Service: Talking to service providers we could define 4 service classes for a FR network: - FR-1: Bandwidth guarantee - FR-2: CIR+EIR (a la VBR-3) - FR-3: CIR+EIR (a la VBR-1) - FR-4: CIR 0 25 QoS What Tools Are Available? Modular QoS CLI (MQC): Shaping When transmit rates are higher than expected buffering or queuing is used delay excess traffic, opposite of policing Marking The ability to differentiated packets by setting properties within the Layer 2 or Layer 3 header like the IP precedence, or L2 Class of Service or drop priority. Policing Used to drop or remark with a lower priority IP Precedence or MPLS EXP bits in traffic that is in excess of contract. Queuing Congestion management by giving correct priority to traffic classes one can manage time-sensitive applications without penalizing lower priority traffic. (CBWFQ) Policers or MQC definition will be set at incoming DLCI (class-map, match command) or pw-vc definition (future) Dual-Rate Policer required to enforce CIR + PIR profiles 26 13

14 Traffic Leaving Enterprise Network Service with Access Network Service without Access Network Access Network CE PE CE PE SP enforces SLA on access network preferably Drop precedence may be marked for FR / ATM / Ethernet Ethernet may support multiple classes PE may mark traffic after encapsulation No elaborate traffic classification or mapping of existing IP markings SP enforces SLA using input QoS policy on PE Input policy uses policing and marking Drop precedence may be marked for FR / ATM / Ethernet Ethernet may support multiple classes PE may mark traffic after encapsulation No Elaborate traffic classification or mapping of existing markings on PE 27 Traffic Leaving Enterprise Network Service with Access Network Service without Access Network Access Network CE PE CE PE CE Output Policy <irrelevant> Access Network Input Policy Policing [Marking] PE Input Policy [Marking] CE Output Policy <irrelevant> PE Input Policy Policing [Marking] 28 14

15 Traffic Leaving Service Provider Network Service with Access Network Service without Access Network Access Network CE PE CE PE SP enforces SLA on access network preferably Access network should serve packets according to their marking (class / drop precedence) where applicable SP enforces SLA using the output QoS policy on PE Output policy uses queuing, dropping and optionally, shaping 29 Traffic Leaving Service Provider Network Service with Access Network Service without Access Network Access Network CE PE CE PE CE Input Policy Access Network Output Policy <irrelevant> Queuing (LLQ) Dropping (WRED) [Shaping] PE Output Policy <optional> CE Input Policy <irrelevant> PE Output Policy Queuing (LLQ) WRED [shaping] 30 15

16 The Complete Picture - WRED IP/MPLS based - LLQ IP/MPLS based - Per Interface level shaping - QoS-Group LLQ - Discard-Class WRED - De-bit marking - BECN/FECN marking - Per VC and DE-bit Classification Policing and MPLS-EXP or IP- DSCP marking - IP/MPLS classification - QoS-Group/Discard-class marking -Including VBR3 policer PW-VC Traffic flow 31 L2VPN MQC Policing Example Example: class-map fr-dlci-100 match fr-dlci 100 class-map fr-dlci-101 match fr-dlci 101 Match Traffic on L2 Information Set a Policy Map for the entire interface Define actions for access circuit policy-map serial-3-1-in class fr-dlci-100 police conform set-mpls-exp-transmit 3 / exceed set-mpls-exp-transmit 2 class fr-dlci-333 police conform transmit exceed drop interface Serial3/1 encapsulation frame-relay service-policy input serial-3-1-in Apply to the Interface 32 16

17 AToM MPLS-TE w / FRR Highlights MPLS-TE: Allows MPLS enabled cores to utilize optimized paths for differing traffic requirements. Optimizes SPF-only routing behavior Can make sure underutilized links get used. (Equal/Unequal load balancing) Fast Re-Route (FRR) Provides alternate path protection for Link & Node failure Provides the mechanism to protect AToM PWs through the MPLS core. Reduces fail over times experienced with normal routing convergence. For more detail, see: RST-2062 Deploying MPLS Traffic Engineering 33 The Fish Problem Router A Node Next-Hop Cost B B 10 C C 10 D C 20 E B 20 F B 30 G B 30 OC-3 OC-3 80Mb Traffic Router C Router B DS3 Some links are DS3, some are OC-3 Router A has 40Mb of traffic for Route F, 40Mb of traffic for Router G Massive (44%) packet loss at Router B->Router E! Changing to A->C->D->E won t help Router F 35Mb Drops! DS3 Router D OC-3 Router E DS3 OC-3 Router G 34 17

18 What MPLS-TE Addresses Node Next-Hop Cost B B 10 C C 10 D C 20 E B 20 F Tunnel 0 30 G Tunnel 1 30 Router A sees all links Router A computes paths on properties other than just shortest cost Like a L2 PVC, but no IGP adjacency over the PVC!! Router A OC-3 OC-3 40Mb Router B 40Mb DS3 Router F OC-3 Router E Router G OC-3 DS3 Router C DS3 Router D 35 MPLS FRR What Does this Mean to AToM? You Can Minimize packet loss, thus increasing guarantees! FR AToMPW FR P1 Primary Secondary Currently for MPLS enabled cores only! FRR builds an alternate path to be used in case of a network failure (Link or Node) Alternate path is pre-calculated; ~50-100ms restore CE1 PE1 P2 P3 PE2 CE

19 MPLS FRR What Is Required to Enabled it? Primary Secondary P1 CE1 PE1 P2 P3 PE2 CE1 MPLS-TE Tunnels configured on ingress PEs Fast Reroute Protection configured on TE Tunnel Preferred-path is directed to local TE Tunnel XConnect configured with destination peer address plus the pseudo-wire class of the appropriate tunnel 37 AToM FRR Protection: PW Configuration Ex Primary Backup L1 CE1 PE1 L2 P PE2 CE1 pseudowire-class T41 encapsulation mpls preferred-path interface Tunnel41 / disable-fallback! interface gigabitethernet3/0.2 encapsulation dot1q 204 xconnect pw-class T41! ip route Tunnel41! ip explicit-path name PE_1 enable next-address Tunnel Selection - Set the pref path to Tunnel I/F for dst PE Force path to Tunnel dst thru Set exp-path, nextaddress to bypass link being protected Note: Pseudowire Specific Configuration Shown Only! 38 19

20 MTU Calculation / ICMP PMTU MTU Size: FR ~ 4470 POS ~ 4470 FE ~ 1500 CE1 FR PE1 X POS POS POS FE PE2 FR CE1 P Inter-PoP It is important to calculate the max MTU for all links in the network. Supported via ip pmtu (L2TPv3) command provides ICMP notification to the offending sender. In AToM mtu <x> or mpls mtu <x>, Example: Core MTU >= (Edge MTU + Transport header + AToM header + (MPLS label stack) 39 SLA How Do I Monitor Service? CE1 PE1 P PE2 CE1 20ms Inter-PoP 15ms 20ms Unmanaged Managed External Probes between POPs, and Embedded agents in customer CPE SAA is an embedded Active software agent in Cisco IOS UDP Echo & UDP Jitter Probes use intelligent time-stamps (Interupt level receive, etc.) 40 20

21 SLA SAA Configuration Example PE1 Probe Packet 1 Packet 1 Response Probe Packet PE2 PE1(config)#rtr 200 PE1(config-rtr)#type jitter dest-ip dest-port 99 num-packets 20 interval 20 PE1(config)#rtr schedule 1 life forever start-time now PE2# conf t PE2(config)#rtr responder Probes NOT required on all PEs to get bidirectional delay statistics; rtr responder only Run RTR ATM / Frame-Relay or L3 on CEs for customer verification Keep the SP honest Please see NMS-4041 for SAA deployment details! 41 Add it Up.. Setup Services with QoS / TE, etc. Setup MQC Actions to reflect Policies Build appropriate Pseudo-wire classes Enabled advanced features (MPLS-TE, DS-TE, etc.) Allocate BW for customers and don t over subscribe CIR, CBR commitments Implement FRR for resiliency Implement SAA for monitoring response times Start provisioning PWs

22 Agenda L2VPN Technology Review Pseudo-wire Configuration Basics Implementation Considerations Case Studies 43 L2VPN Application Objectives Illustrate How L2VPNs are being utilized: Operational Simplification through Network Consolidation Creative Cost Reduction for managed Services Leveraging the PSN for New Services 44 22

23 L2VPNs Network Consolidation Provider Profile: Wireless services, updating internal infrastructure, no new service creation Problem: Next generation technology required build-out of new network infrastructure Legacy services left too many overlapping networks to support, maintain and operate. New high-speed network is underutilized Q: How can the Service Provider consolidate legacy systems by utilizing L2VPN technology? 45 L2VPNs Pre - Network Consolidation T1s HDLC DS3 2G DS3 T1s HDLC MSC MSC DS3 2.5G DS3 MSC 3G MSC OC-3 OC-3 MSC Regional Switching Center National Data Center Regional Switching Center MSC 46 23

24 Consolidation Migration Steps Establish base MPLS infrastructure Enable on P, PE routers Incorporate enhanced MPLS services - Add MPLS TE Tunnels - Add relevant QoS configurations Upgrade links & design Redundancy Considerations Capacity Migrate the MSCs to main uplinks - Configure overlay network with AToM PWs 47 Consolidation Migration Steps CE1 FRR Link & Node Protection PE2 PE1 P PE1(Configuration): pseudowire-class HDLC_CEs encapsulation mpls preferred-path interface Tunnel10 disable -.. Serial1/0 encapsulation hdlc xconnect pw-class HDLC_CEs PE2(Configuration): pseudowire-class HDLC_CEs encapsulation mpls preferred-path interface Tunnel10 disable -.. Serial1/0. encapsulation hdlc xconnect pw-class HDLC_CEs 48 24

25 L2VPNs Post - Network Consolidation Serial Connections terminated locally on MPLS enabled Edge Router DS3 MSC MSC DS3s OC-3s 3G OC-3s DS3s MSC RSC NDC RSC RSC MSC AToM PWs running HDLC encap form overlay for legacy systems MSC MPLS Domain MSC 49 Consolidation Benefit Summary Leveraged new high speed network Reduced OPEX for multi-network infrastructure Migration path for future L2 & L3 services to external client base Enabled hardware migration for next generation wireless gear 50 25

26 L2VPNs Recurring Cost Reduction Provider Profile: Tier 2 Service Provider, regulatory limitation prevents owning copper last mile; ILEC leased. Providing Frame Relay, Leased Line services Problem: Recurring costs from ILEC make aggressive competition impossible. Wireless bypass alone doesn t allow existing customer s service protection Limited ability to expand. Q: How can the Service Provider save local loop costs without service disruption to existing customers? 51 L2VPNs PRE - Recurring Cost Reduction CPE Customer NTU Tier 1 SP Tier 2 SP ATM/FR Tier 1 SP NTU Customer CPE DTE DTE CPE NTU Cust. Prem. Copper Access MGX Edge - FRSM Copper Access NTU CPE Cust. Prem. Nx64 TDM access provided from the ILEC Frame Relay encapsulation from the CPE to the MGX Frame Relay VCs mapped through Tier 2 SPs ATM Core 52 26

27 Cost Reduction Migration Steps IP enabled wireless access network deployed (out of L2TPv3 scope) Swap SP1 NTUs for Cisco 1751 CPEs Clock Serial Interface for desired access speed Configure L2TPv3 FR trunking overlay on CPE Configure SAA responder to monitor access network Configure 7200 head end for PWs Configure channel-groups relevant to access speeds Configure L2TPv3 for FR trunking Configure SAA head end probe to Access network response time monitoring 53 Cost Reduction Migration Steps RTR (Configuration): pseudowire-class l2tpv3_1 encapsulation l2tpv3 ip pmtu sequencing Serial1/0 encapsulation hdlc xconnect pw-class l2tpv3_1 rtr responder RTR# rtr 1 type jitter dest-ipaddr / dest-port 2020 request-data-size 1000 rtr schedule 1 life forever start-time now 7200(Configuration): pseudowire-class l2tpv3_1 encapsulation l2tpv3 ip pmtu sequencing Serial1/0 encapsulation hdlc xconnect pw-class l2tpv3_

28 L2VPNs Recurring Cost Reduction CPE Customer U-PE Wireless Access Tier 2 SP ATM/FR DTE DCE CPE U-PE Cust. Prem. MGX Edge - FRSM L2TPv3 Tunnel Frame Relay Encap L2TPv3 enables transparent Frame Relay service Simplifies management and reduces overhead Seamless no-touch migration for the customer 55 Cost Reduction Benefit Summary Bypass the ILEC and reduce monthly recurring tail circuit lease costs Leads to competitive pricing for Enterprise Enables transparent layer 2 service that supports frame relay plus other WAN protocols, ie HDLC,PPP,802.1q etc No change to customer s network required Frame relay flow control features still work ie FECN, BECN Supports both managed and unmanaged service Option to convert customer to ethernet without need for additional router 56 28

29 L2VPNs New Service Offering Provider Profile: Tier 1 Service Provider with traditional voice & data services. Problem: Existing L3 data network is massively underutilized Upgrading legacy L2 ATM/FR network with switches is undesirable. Would like to offer more competitive L2 options. Possibly migrate FR switches to IP backbone. Q: How can the Service Provider take advantage of the unused bandwidth on their existing L3 packet infrastructure? 57 L2VPNs PRE - New Service Offering Separate ATM/FR 10% IP Core 3% 8% 9% 7% Europe 6% Asia 12% 11% 3% Internet & IP-VPN traffic only Bandwidth glut on IP core South America OC-192 OC-48 OC

30 New Service Preparation Global IP Infrastructure was Already Operational Update PE software to support L2TPv3 based services (Frame Relay, Ethernet, HDLC/PPP) Configure QoS policies to reflect service strategy Configured for FR service models w / egress policing Subrate services for virtual leased line, TLS Start configuring L2TPv3 based L2VPN Services Configured PW classes with relevant ToS, Sequencing and Path MTU discovery 59 New Service QoS Configuration 7507 class-map match-all dlci200 match fr-dlci 200 policy-map vlan-hi-priority class class-default set ip precedence 5 policy-map Serial2-1-in class dlci200 police cir bc be conform-action set-prec-transmit 5 exceed- / action set-prec-transmit 0 violate-action drop interface Serial2/0 frame-relay intf-type dce service-policy input Serial2-1-in 60 30

31 L2VPNs POST - New Service Offering IP Core FR FR FRoL2TPv3 Europe Asia FRoL2TPv3 FR Resist purchasing legacy switches New L2 services offered cost effectively Drive up utilization on L3 network South America OC-192 OC-48 OC Consolidation Benefit Summary Leverage existing packet infrastructure to offer new source of revenue $8M to Date 50+ Customers Online Utilize well-known native IP infrastructure Minimal OPEX expenditure for support Enterprise benefits: Reduces monthly WAN recurring costs Maintain well known Layer 2 service Future Layer 3 service opportunity 62 31

32 L2VPN Summary Established why L2VPN technologies are emerging as the new VPN options for PSNs? Introduced IETF backed solutions for addressing L2VPN market requirements Introduced some innovative ways Service Providers are taking advantage of L2VPN technologies. 63 Any Questions? 64 32

33 What s Next? Follow-on Sessions: RST-2062 Deploying MPLS Traffic Engineering RST-2081 Deploying Quality of Service for Converged Networks 65 Thank You! ematkovi@cisco.com 66 33

34 Please Complete Your Evaluation Form Session