VPWS, VPLS and EVPN lab

Theoretical foundations and architecture

Laboratory: comparing VPWS, VPLS and EVPN together with L2 OAM. The engineer builds parallel L2VPNs and checks how each behaves on failure. Three layers of verification are used: 1. VCCV (RFC 5085) tests the pseudowire itself: the probe travels inside the PW along the same path as the data (LSP ping for a PW, ping mpls pseudowire). 2. IEEE 802.1ag CFM: Maintenance Domain (MD), Maintenance Association (MA), Maintenance Endpoint (MEP); Continuity Check Messages (CCM) are sent at intervals from 3.33 ms to 10 minutes, and a failure is declared after 3.5 intervals are lost. 3. ITU-T Y.1731 adds delay measurement (DM), delay variation and frame loss measurement (LM). The failover time depends on the CCM interval, the detection method and the platform; a 50 ms target is achievable only with fast detection and hardware support.

Why OAM is needed in L2VPN

Pseudowire, VPLS and EVPN hide the whole path through MPLS from the customer: the customer sees a wire or a switch, and the provider is obliged to answer for it. If the customer ping fails, the cause may be in the AC, the outer transport label, the PW label, the MTU or the signaling. OAM (Operations, Administration, Maintenance) provides tools that check each layer separately, and in the lab you will go through them layer by layer: AC, LDP transport, PW, customer L2.

OAM levels and who is responsible for what

Transport LSP: LSP Ping and Traceroute (RFC 4379) send an MPLS Echo Request (UDP 3503, address from 127.0.0.0/8 with Router Alert) along the same label stack as the data, and check that the FEC is bound to the LSP along the whole path. Pseudowire: VCCV (RFC 5085) is a channel inside the PW itself that allows a test message to be sent so that it follows the same path as the customer data. Ethernet segment: IEEE 802.1ag CFM and ITU-T Y.1731 work between customer ports (UNI) or between PEs, checking precisely the L2 connectivity. Physical link: 802.3ah (EFM OAM) for a single physical link.

VCCV: channel types and checks

VCCV defines two parameters negotiated when the PW is established in the Interface Parameters (sub-TLV 0x0C, bit limitations). Control Channel (CC) type 1: the PWE3 control word whose first nibble equals 0001 (0000 in an ordinary data frame), so the PE distinguishes the OAM packet and processes it instead of sending it to the AC; type 2: the Router Alert label (label 1) between the transport and PW labels; type 3: TTL-expiry - a PW label with TTL=1, the packet reaches the PE through TTL expiration (used for traceroute across MS-PW segments). Connectivity Verification (CV): ICMP Ping, LSP Ping (with the PW FEC: sub-TLV FEC 128 type 10, containing the peer, PW ID and PW Type) and BFD (RFC 5885). The commands ping mpls pseudowire and ping mpls l2circuit use LSP Ping with the PW FEC: a reply arrives only if a PW with the same ID and label exists on the remote PE, which makes the check far more reliable than an ordinary customer ping.

BFD for PW

BFD (RFC 5880) provides failure detection in hundreds of milliseconds instead of the seconds of LDP. For a PW, VCCV-BFD (RFC 5885) is used: BFD packets are carried in the PW channel (CC type 1 or 3), and min-tx/min-rx intervals of 300 ms with a multiplier of 3 give a detection time of about 900 ms. The BFD status can be signaled in the PW Status TLV (BFD status signaling), and then a PW failure at one end is reflected on the AC of the other PE. Important: intervals below 100 ms are needed only with hardware BFD support, otherwise sessions flap under CPU load.

PW Status and convergence

When the AC on PE2 fails, PE2 sends a Notification with the PW Status TLV (bit 0x4 or 0x2: Local AC fault), and PE1 moves the PW to Down (Remote AC fault) without waiting for the LDP keepalive to expire (60 s, hold 180 s by default on Cisco). If the Status TLV is not negotiated, only the label withdrawal when the PW is deleted remains, and when a whole PE fails, the LDP session timeout. Therefore BFD on the IGP (or on LDP) and PW Status together determine the recovery time. For VPLS and EVPN the analog is: LDP MAC Address Withdraw (RFC 4762) and mass withdraw through the Type 1 A-D route.

Ethernet CFM (802.1ag, Y.1731)

The model: a Maintenance Domain (MD) with a level of 0-7 (the customer is usually 5-7, the operator 3-4, the link 0-1), inside it a Maintenance Association (MA), each device has its own MEP (Maintenance End Point), and MIPs (intermediate points) lie between them. Packets: CCM (Continuity Check Message, multicast, intervals 3.33 ms, 10 ms, 100 ms, 1 s, 10 s, 1 min, 10 min; a failure is declared when 3.5 intervals are lost), LBM/LBR (Loopback, the L2 equivalent of ping), LTM/LTR (Linktrace, L2 traceroute). Y.1731 adds delay measurement (DMM/DMR), loss measurement (LMM/LMR) and AIS. CFM messages are forwarded through the PW transparently (customer CFM) or terminated on the PE (operator).

MTU - the main reason for a PW that is "Up but not working"

The check method: ping across the core between loopbacks with a size of 1526 bytes and the DF bit, then a customer ping with DF. If the PW is Up but large frames are lost, then the MTU of some interface is smaller than the size of the frame with labels. LSP Ping can report the MTU through an Echo Reply with a Return Code (including with Downstream Mapping, which carries the MTU of the next interface).

Diagnostic algorithm

1. AC: the interface is Up, the required VLAN is accepted. 2) IGP/LDP: the PE2 loopback is reachable, a label exists (LDP bindings), the targeted session is Operational. 3) PW: the VC is Up, the local and remote labels are non-zero, MTU local = remote, the control word is negotiated. 4) Data: ping mpls pseudowire succeeds, then a customer ping with size 1500 and DF. 5) Fast detection: BFD is Up, the interval and multiplier correspond to the plan. Debugging from the bottom up allows you to localize the fault and not guess from a symptom at the customer level.

What to know about failures and injecting them in the lab

In the lab you deliberately break the service: change the VC ID, the MTU, shut down the AC on PE2, remove the loopback from LDP. For each failure, write down in advance what the commands will show. This teaches you to see the signs: DOWN/MM/EM/CM in Junos and Cisco, Remote AC fault, an empty Outgoing label, ping mpls with the error "no label entry", loss of BFD Up.

Architecture Diagram & Topology

+--------+   PW (VC ID 100)   +--------+
|  PE1   | ================== |  PE2   |
+--------+   [transport | PW label | PW ACH | IP/UDP LSP ping]   +--------+
  VCCV: Echo Request -->  inside the PW, same path as the customer data
        <-- Echo Reply (in-band or via IP path, depending on the reply mode)
  CFM:  MEP-1 on the AC of PE1 <---- CCM every N ms ----> MEP-2 on the AC of PE2

Traffic Flow & Label Stack Scheme

VCCV (RFC 5085) packet, control channel type 1 (PW ACH):
[Transport label] [PW label] [PW ACH: 0001 | version 0 | reserved | channel type 0x0021 (IPv4)] [IP/UDP dst 3503: MPLS LSP Ping Echo Request]
Type 2: [Transport label] [Router Alert label (1)] [PW label] [IP/UDP LSP ping]
Type 3: [Transport label] [PW label with TTL=1] [IP/UDP LSP ping]

State & Parameter Comparison Table

Architectural model and principles

In real service provider networks, MPLS unifies equipment from multiple vendors. Below are practical configuration and operational verification examples across four platforms: Cisco IOS-XE/XR, Huawei VRP, Juniper Junos, and MikroTik RouterOS v7. Pay close attention to syntax nuances and label distribution mechanisms.

Practical Configuration (Cisco, Huawei, Juniper, MikroTik)

Cisco (IOS-XE/XR)