Services · Topic 2 of 5

L2VPN and Carrier Ethernet

Configure L2VPN pseudowires and VPLS, and describe E-Line, E-LAN, E-Tree, E-Access, 802.1ad, 802.1ah, G.8032, Ethernet OAM and VLAN tag rewrites.

6 min
Includes a diagram

In a nutshell

E-Line is point to point, E-LAN is multipoint, and E-Tree has roots and leaves.
In E-Tree, leaves cannot talk to other leaves.
VPWS gives point to point, and VPLS gives multipoint with a full mesh of pseudowires.

What it is

L2VPN carries customer Ethernet frames across a provider network, so that the customer sees one Layer 2 network.

Carrier Ethernet is the set of service definitions and tools that providers use to sell and run these services. The provider does not route the customer traffic. It carries the frames from one customer port to another.

How it works

First the service types, then the protocols that build, protect and monitor them.

Ethernet services

The MEF defines the service types by the shape of the connection.

Service	Shape	Description
E-Line	Point to point	Two customer ports, like a leased line
E-LAN	Multipoint	Any site can reach any other site
E-Tree	Rooted multipoint	Roots reach leaves, but leaves cannot reach each other
E-Access	Access to another operator	A service between a customer port and an operator interconnect

Each service is an Ethernet virtual connection, or EVC. A customer port is a UNI. The link between two operators is an ENNI, and E-Access uses it so that a second operator can reach the customer.

Building the service: VPWS and VPLS

A customer switch at site A connects over an attachment circuit to PE1, a pseudowire with pw-id 100 runs over the MPLS core to PE2 at 2.2.2.2, and PE2 connects to the customer switch at site B. VPWS is the point to point technology, behind E-Line. A pseudowire is signalled between two PEs, and it carries frames from one attachment circuit to the other.

RP/0/RP0/CPU0:PE1(config)# l2vpn
RP/0/RP0/CPU0:PE1(config-l2vpn)# xconnect group CUST1
RP/0/RP0/CPU0:PE1(config-l2vpn-xc)# p2p WIRE1
RP/0/RP0/CPU0:PE1(config-l2vpn-xc-p2p)# interface GigabitEthernet0/0/0/1.100
RP/0/RP0/CPU0:PE1(config-l2vpn-xc-p2p)# neighbor ipv4 2.2.2.2 pw-id 100

VPLS is the multipoint technology, behind E-LAN. PEs are joined by a full mesh of pseudowires, and each PE learns MAC addresses and forwards like a switch. A bridge domain and a virtual forwarding instance (VFI) tie the ports and pseudowires together.

RP/0/RP0/CPU0:PE1(config-l2vpn)# bridge group BG1
RP/0/RP0/CPU0:PE1(config-l2vpn-bg)# bridge-domain BD1
RP/0/RP0/CPU0:PE1(config-l2vpn-bg-bd)# interface GigabitEthernet0/0/0/1.100
RP/0/RP0/CPU0:PE1(config-l2vpn-bg-bd)# vfi VFI1
RP/0/RP0/CPU0:PE1(config-l2vpn-bg-bd-vfi)# neighbor 2.2.2.2 pw-id 100

A pseudowire in a full mesh does not forward a frame to another pseudowire. This is split horizon, and it prevents loops in the core.

On IOS XE, an attachment circuit is a service instance with xconnect 2.2.2.2 100 encapsulation mpls for a point to point pseudowire.

VLAN tag manipulation

The provider often changes the VLAN tags at the edge. On IOS XR, the sub interface matches the incoming tag, and a rewrite changes it.

RP/0/RP0/CPU0:PE1(config)# interface GigabitEthernet0/0/0/1.100 l2transport
RP/0/RP0/CPU0:PE1(config-subif)# encapsulation dot1q 100
RP/0/RP0/CPU0:PE1(config-subif)# rewrite ingress tag pop 1 symmetric

The common rewrite actions are pop, push and translate. The keyword symmetric applies the opposite action in the other direction.

IEEE 802.1ad and 802.1ah

IEEE 802.1ad (Q-in-Q) adds an outer service tag, the S-tag, above the customer tag, the C-tag. The provider switches on the S-tag and leaves the customer VLANs untouched. This extends the limit of 4094 VLANs by using pairs of tags.

IEEE 802.1ah (Provider Backbone Bridging, or MAC in MAC) goes further. The provider wraps the whole customer frame in a new Ethernet header with backbone MAC addresses and a 24 bit service identifier, the I-SID.

The I-SID allows about 16 million services. Core switches learn only the backbone MAC addresses, not every customer MAC, so the tables stay small.

ITU G.8032

A four node Ethernet ring where the link between nodes C and D has failed, R-APS messages go around the ring, and the ring protection link between A and B is now unblocked. G.8032 is Ethernet ring protection. It prevents loops in a ring without Spanning Tree, and recovers quickly from a failure.

One link, the ring protection link (RPL), is blocked in normal operation. If another link fails, the RPL is unblocked and traffic flows the other way. The nodes tell each other about the failure with R-APS messages sent on a control channel.

Ethernet OAM

Ethernet OAM monitors the service end to end. The standards are IEEE 802.1ag for connectivity fault management (CFM), IEEE 802.3ah for single link OAM, and ITU Y.1731 for performance.

CFM uses maintenance domains, with maintenance end points (MEPs) at the edges, and intermediate points (MIPs). MEPs send continuity check messages. A loopback works like a ping and a linktrace works like a traceroute.

RP/0/RP0/CPU0:PE1# show ethernet cfm peer meps

What to remember for the exam

Eight facts cover most questions on this topic.

E-Line is point to point, E-LAN is multipoint, and E-Tree has roots and leaves.
In E-Tree, leaves cannot talk to other leaves.
VPWS gives point to point, and VPLS gives multipoint with a full mesh of pseudowires.
Split horizon stops a pseudowire frame being sent to another pseudowire.
802.1ad adds an S-tag, and 802.1ah wraps the whole frame with an I-SID.
G.8032 blocks one RPL, and R-APS messages trigger the unblock.
CFM uses MEPs and continuity check messages, and Y.1731 measures performance.
rewrite ingress tag pop 1 symmetric removes one tag and reverses it on the way out.

Exam tip

To remember E-Tree, think of a head office as the root and branch offices as the leaves, which should not reach each other.

Common mistakes

These four mistakes appear often.

Confusing 802.1ad with 802.1ah. 802.1ad adds a tag. 802.1ah adds a whole new Ethernet header.

Forgetting split horizon in VPLS. Without it, frames can loop around the full mesh.

Using rewrite without symmetric. The return traffic may then keep the wrong tag.

Thinking the RPL is always down. It is blocked only while the ring is healthy.

Watch out

L2VPN extends the customer broadcast domain across the core, so a loop on the customer side can affect a large area.

Check yourself

Work through these three questions.

Which MEF service lets roots reach leaves but stops leaves reaching each other?
E-Tree does.
What does the I-SID in 802.1ah provide?
It is a 24 bit service identifier, which allows about 16 million services.
Which link does G.8032 block in a healthy ring?
The ring protection link, or RPL, is blocked until another link fails.

Topic 2 of 5 in Services

Test yourself on Services

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.