LDP Based VPLS, Bridge Split Horizon and the Control Word

What it is

VPLS makes a provider network behave like one big Ethernet switch for the customer sites it connects.

Each pair of provider edge routers is joined by a tunnel called a pseudowire. Customer Ethernet frames enter one end and leave at the other, and the provider core sees only labelled packets.

This page covers the LDP based form, the split horizon rule that prevents loops, and the control word, an optional extra header.

How it works

LDP signals each pseudowire, a bridge joins the tunnels and customer ports, and horizon stops loops.

The building blocks

VPLS needs MPLS with LDP working first. The PE routers must reach each other's loopbacks, and LDP bindings must exist for those loopbacks as host prefixes.

Each pseudowire is a VPLS interface. A bridge ties the VPLS interfaces to the customer facing port, and the bridge learns MAC addresses like a switch.

/interface vpls add name=vpls-to-pe2 remote-peer=10.255.255.2 vpls-id=100:1 disabled=no
/interface bridge add name=br-cust
/interface bridge port add bridge=br-cust interface=ether3
/interface bridge port add bridge=br-cust interface=vpls-to-pe2

• remote-peer is the loopback address of the other PE.
• vpls-id identifies the service. It must be identical at both ends.
• The customer port and the VPLS interface sit in one bridge.

The tunnel is signalled with LDP between the two loopback addresses. An inner label identifies the pseudowire, and the outer label carries it across the core.

Full mesh and the loop problem

With more than two sites, each PE has a tunnel to every other PE. This is a full mesh. A frame that arrives from one pseudowire must not be sent into another, because the other PEs already got it directly.

Without a rule, a broadcast could be copied from tunnel to tunnel without end. Ethernet has no TTL to stop it.

Bridge split horizon

The fix is split horizon. Ports in the same horizon group do not forward frames to each other. On RouterOS this is the horizon setting on the bridge port.

/interface bridge port set [find interface=vpls-to-pe2] horizon=1
/interface bridge port set [find interface=vpls-to-pe3] horizon=1

All VPLS interfaces on a PE use the same horizon value. The customer port keeps no horizon, so it can talk to every tunnel.

A frame from the customer reaches all tunnels. A frame from one tunnel reaches the customer but no other tunnel.

The control word

The control word is a 4 byte field placed after the label stack. It carries flags and an optional sequence number.

Its main practical value is protection against bad load sharing. Some routers inspect the first bytes after the labels to guess if the payload is IP. An Ethernet frame may look like IP, and the router may then split the flow and reorder frames.

The control word makes the payload look unlike IP.

RouterOS lets you choose whether a VPLS interface uses it, so look for the control word option in the console help of /interface vpls on the version you run.

• Both ends must agree. If only one end uses the control word, the two sides disagree on the frame format, so the tunnel may not come up or traffic can fail.
• The control word adds 4 bytes, so it increases the MTU that the core must carry.
• When connecting to another vendor, check which control word setting the remote device expects.