Académique Documents
Professionnel Documents
Culture Documents
Forwarding models
During class please switch off your mobile, pager or other that may interrupt. Entry level requirements:
Objectives
At the end of this session, you will be able to summarize and explain the different forwarding modes the 7342 P-OLT can handle configure the 7342 P-OLT for using several of these forwarding models
Table of contents
Configuration options . General workflow Scenarios Hands-on . . . . . . . . . HSI service creation . Netopia as RG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p. 4 p. 10 p. 14 P. 16 P. 25 p. 27
University
Frame forwarding in the 7342
Configuration options
forwarding modes
iBridge (def) cross connect
marking modes
untrusted vlan-tag (def) vlan translation mode ethertype classification enhanced vlan translation
VLANx
interface
OLT
VLANy
NT
PON
interface
VLANz
LT
ONT
tagging modes
stacked unstacked (def) passthrough
> Most of the parameters can be combined, however, some combinations do not make sense (but can be configured anyway): one must take care that on the ethernet port of the ONT the same tagging is applied both for upstream and downstream e.g. if you send tagged traffic upstream, you expect to receive tagged frames in the downstream as well
=> Network => Access => Network => Access => Network
> General concept: we want to avoid user to user communication internally in the system itself at all times!
NETWORK
ONT
ONT
> The VLAN in cross-connect mode provides a connection-oriented model across the connectionless Ethernet access network through VLANs. One VLAN contains only one user port in VLAN cross-connect mode. A subscriber is identified across the entire network by a VLAN ID in VLAN cross-connect mode. > In the upstream direction, the incoming subscriber port without the MAC destination address is sufficient to identify the outgoing upstream port and the VLAN tag. This VLAN is the port-based default VLAN configured for this subscriber port. To identify the outgoing upstream port, the MAC destination address is required. If the MAC DA is not yet learned, the frame will be flooded. > When the frames sent through the bit pipe are IPoE frames, various protocol messages such as DHCP or IGMP can be snooped. These functions are disabled in CC mode so that these frames are handled as data traffic. Due to this handling, there can be downstream multicast frames, but there is no corresponding multicast tree. When there is no multicast tree, the frames are flooded to all access interfaces. In VLAN cross-connect mode, since there is only one access interface, all frames flood this access interface. The multicast frames pass transparently. > The broadcast frames are forwarded in the same way as multicast frames. > In this configuration, the layer 2 control protocol frames are discarded. The layer 2 frames are link related and are not handled within the scope of a VLAN. > A VLAN in cross-connect mode shares two common features with VLAN in iBridge mode: there will be no subscriber-to-subscriber communication and no broadcast storms. > In this example only one service is shown, but one can of course use multiple services per customer, as long as each VLAN is used only once per node. > This mode has similarities with the well known ATMPVC concepts, since traffic is contained within one VLAN (bitpipe)
CUSTOMER- A
DATA VLAN
NETWORK
VIDEO SERVICE
VOICE SERVICE
8
ONT CUSTOMER-B
The iBridge mode has the following features compared to standard bridging: > iBridge distinguishes network and subscriber ports. > Frames received from a subscriber will always be sent towards the network and never to anothersubscriber. The only exception is the traffic destined for the P-OLT. > iBridge avoids flooding by not sending broadcast to all nodes on the network. > iBridge avoids the use of the same MAC address over multiple ports. This prevents a MAC address learned on one port from receiving service on another port and prevents DoS and spoofing attacks. > Frame types > In iBridge mode, only the following frame types are accepted from the user ports: IP over Ethernet (IPoE) (IPv4)/ARP/Reverse Address Resolution Protocol (RARP) PPPoE (discovery & session) IPoE (IPv4)/ARP/RARP/PPPoE (discovery & session) all ethernet types Extensible Authentication Protocol Over LAN (EAPOL) EAPOL frames are dedicated packets that are never forwarded but are processed by the ONT. > Other frames, including multicast data frames, will be discarded.
> Note that more complex models can be setup, with additional splits per service provider.
ONT ONT
EMAN
- broadcast - unknown MAC DA
N VLA
123
MAC A
N VLA
123
MAC A
EMAN
VLA N1 23
ONT
VLA
N4
56
ONT
MAC B
MAC B
> It is important to note that the VLAN must be unique between the P-OLT and the NSP IP router in the Ethernet network to support the iBridge feature. If the network configuration uses a single VLAN for two P-OLTs and an NSP router, there could be direct subscriber-tosubscriber communication and the consequence of broadcast and flooding. > When the nodes would be directly connected to a router, or when the EMAN bridges allow for additional security settings to block this kind of user to user traffic, the same VLANs can still be used. The latter simplifies the whole setup, a plus for maintenance and troubleshooting.
University
General workflow
10
> Please note that the VLAN values used in this document only serve as an example. The actual values depend on the configurations in the lab. > Always ask your teacher which values should be used.
10
9
C2
VLAN TRANSLATION
8
C1
service 1
L2 forwarding
S OLT 1 2
C 7
SERVICE 1
SHUB
NETWORK
PON
ONT SERVICE 2
RGW
CONFIG FLOW
VLAN LEVEL
ENT-QOS-MARKPROF (3) UNTRUSTED / VLANTAG / VLANTMODE / ETYPEVLANMODE / ETYPECMODE (4) XMITNOTAG / XMITTAG ONT Ethernet port: ENT-ONTENET (5) CVLANDEF = ... UNI LEVEL ENT-SERVICE-HSI (6 ) (7 ) (8 ) (9 ) SVLANID = ... UNUSED / IPOE / PPPOE UNISIDEVLAN = ... NETWORKSIDEVLAN = ...
11
Example TL1 flow: (here only related to the parameters on the slide above) > ENT-PONVLAN::PONVLAN-150::::MODE=RBRIDGE,TAGMODE=UNSTACKED; > ENT-QOS MARKPROF::20:::M20:PROFTYPE=UNTRUSTED,DOT1P=2, UNTAGDS=XMITNOTAG; > ENT-QOS-SESSPROF::20:::S20:UPMARKPROFID=20; > ENT-ONTENET::ONTENET-1-1-1-3-1-1-1::::AUTODETECT=10_100BASETAUTO, CVLANDEF=0,SESSPROFID=20,MAXMACNUM=4:IS; > ENT-SERVICE-HSI::HSI-1-1-1-3-1-1-1-1::::BWPROFUPID=10,BWPROFDNID=10, PQPROFID=10,SVLAN=150,ETHERTYPE=UNUSED,UNISIDEVLAN=0,NETWORKSIDEVLAN=0 :IS;
11
Marking modes
UNTRUSTED
untrusted mode causes the DOT1P and CVLAN tags received from an RG to be overwritten with the DOT1P value configured on the port
VLANTAG
VLAN tag mode forwards traffic from an RG without altering tag priority
VLANTMODE
VLAN translation mode allows CVLANs to be sent from an RG to the ONT in the unstacked mode without being overwritten by an SVLAN
ETYPECMODE
EtherType classification mode allows HSI traffic to be segregated into IPoE and PPPoE flows
ETYPEVLANMODE
EtherType/VLAN translation mode allows CVLANs or NW VLANs to be sent in the upstream direction in unstacked or pass-through mode using a new combined EtherType/VLAN translation
12
12
TL1 parameters
ENT-PONVLAN::PONVLAN-150::::MODE=RBRIDGE,TAGMODE=UNSTACKED; ENT-QOS MARKPROF::20:::M20:PROFTYPE=UNTRUSTED,DOT1P=2,UNTAGDS=XMITNOTAG; ENT-QOS-SESSPROF::20:::S20:UPMARKPROFID=20; ENT-ONTENET::ONTENET-1-1-1-3-1-1-1::::AUTODETECT=10_100BASETAUTO,CVLANDEF=0, SESSPROFID=20,MAXMACNUM=4:IS; ENT-SERVICE-HSI::HSI-1-1-1-3-1-1-1-1::::BWPROFUPID=10,BWPROFDNID=10,PQPROFID=10, SVLAN=150,ETHERTYPE=UNUSED,UNISIDEVLAN=0,NETWORKSIDEVLAN=0:IS;
13
13
University
HSI service creation
14
14
ENET ENET
ent-service-hsi::hsi-1-1-7-1-12-1-1-1::::
bwprofupid, bwprofupnm, bwprofdnid, bwprofdnnm, pqprofid, pqprofnm, aesenable, label=, svlan, customerID, Ethertype, UNIsideVLAN, NWsideVLAN:is;
15
> At the same time T-CONTs are created, also one or more alloc-ids are created, but that is not a topic for now (this will be explained later in the QoS part) > What is important at this point is that one service corresponds to one single T-CONT, and that one might run multiple services over one single UNI!
15
University
Scenarios
16
16
RBRIDGE / UNSTACKED
S150, P1
SINGLE TAGGED
C0, Px
TAGGED
UNTAGGED
NETWORK
SHUB
OLT
PON
ONT
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 0
ENT-SERVICE-HSI (6) SVLANID = 150 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 0 (9) NETWORKSIDEVLAN = 0
17
17
C150, P1
TAGGED
C150, P1
TAGGED
UNTAGGED
NETWORK
SHUB
OLT
PON
ONT
RG
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 150
ENT-SERVICE-HSI (6) SVLANID = 150 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 0 (9) NETWORKSIDEVLAN = 0
specifying CVLANDEF = 150 means any other incoming tag (diff. from 150) will be discarded specifying CVLANDEF = 0 means no check on incoming tagged frame, useful for multiple services
18
18
it looks as if they all use queue 1, but internally the traffic is really spread over 3 different queues!!! important: specify different (set of) pbits for each PQ-profile
19
19
NETWORK
SHUB
OLT
PON
ONT
RG
2 3
ENT-PONVLAN (150, 160, 170) (1) XCONN / RBRIDGE (2) UNSTACKED / STACKED / PASSTHRU NETWORK LEVEL (3 x)
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 0 UNI LEVEL (1 x)
ENT-SERVICE-HSI (6) SVLANID = 150, 160, 170 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 0 (9) NETWORKSIDEVLAN = 0 SERVICE LEVEL (3 x)
20
20
translation
TAGGED TAGGED TAGGED
NETWORK
SHUB
OLT
PON
ONT
RG
2 3
ENT-PONVLAN (151, 161, 171) (1) XCONN / RBRIDGE (2) UNSTACKED / STACKED / PASSTHRU NETWORK LEVEL (3 x)
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 0
ENT-SERVICE-HSI (6) SVLANID = 151, 161, 171 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 150, 160, 170 (9) NETWORKSIDEVLAN = 151, 161, 171 SERVICE LEVEL (3 x)
21
UNI LEVEL (1 x)
21
NETWORK
SHUB
OLT
PON
ONT
RG
2 3
ENT-PONVLAN (400) (1) XCONN / RBRIDGE (2) UNSTACKED / STACKED / PASSTHRU NETWORK LEVEL (1 x)
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 0
ENT-SERVICE-HSI (6) SVLANID = 400 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 0 (9) NETWORKSIDEVLAN = 0 SERVICE LEVEL (1 x)
22
UNI LEVEL (1 x)
> Note that only one PONVLAN is required and also one service definition on the UNI. The CVLAN-tags are sent transparently and the pbits will be copied into the SVLAN tag. > It is again possible to restrict the incoming CVLAN tag by setting CVLANDEF = 150.
22
TRAINEE 3 11.11.11.13 / 24
TRAINEE ...
23
> This scenario would not work in RBRIDGE mode, since the initial broadcast ARP request would be blocked in that mode. One could of course add a static ARP entry.
23
translation
IPoE PPPoE
C151, P1 C200, P1
port 1 port 1
NETWORK
SHUB
OLT
PON
ONT
RG
2 3
ENT-PONVLAN (151, 200) (1) XCONN / RBRIDGE (2) UNSTACKED / STACKED / PASSTHRU NETWORK LEVEL (2 x)
ENT-QOS-MARKPROF (3) UNTRUSTED VLANTAG VLANTMODE ETYPEVLANMODE ETYPECMODE (4) XMITNOTAG / XMITTAG ENT-ONTENET (5) CVLANDEF = 0
ENT-SERVICE-HSI (6) SVLANID = 151, 200 (7) UNUSED / IPOE / PPPOE (8) UNISIDEVLAN = 150, 150 (9) NETWORKSIDEVLAN = 151, 200 SERVICE LEVEL (2 x)
24
UNI LEVEL (1 x)
24
University
NETOPIA as an RG
25
25
4 3 2 1 ONT TAGGED 802.1Q TRUNK VLAN 150, pbit = 1 upstream VLAN 160, pbit = 2 upstream VLAN 170, pbit = 3 upstream UNTAGGED, VLAN 150 member VMWARE client
MULTIPLE SERVICES
26
> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >
configure set dhcp option off set wireless option off set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN150" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160" set vlan name "VLAN160"
type global id 150 admin-restricted off seg-pbits 1 ports eth0.1 option on ports eth0.1 tag off ports eth0.1 priority on ports eth0.1 promote on ports eth0.1 port-pbits 1 ports eth0.2 option off ports eth0.3 option off ports eth0.4 option on ports eth0.4 tag on ports eth0.4 priority on ports eth0.4 promote on ports eth0.4 port-pbits 1 ports eth1 option off ip-interface ip-eth-a inter-vlan-routing group-1 off inter-vlan-routing group-2 off type global id 160 admin-restricted off seg-pbits 2 ports eth0.1 option off ports eth0.2 option on ports eth0.2 tag off ports eth0.2 priority on ports eth0.2 promote on ports eth0.2 port-pbits 2 ports eth0.3 option off ports eth0.4 option on ports eth0.4 tag on ports eth0.4 priority on ports eth0.4 promote on ports eth0.4 port-pbits 2 ports eth1 option off ip-interface none
> > > > > > > > > > > > > > > > > > > > >
set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan set vlan save quit restart
name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170" name "VLAN170"
type global id 170 admin-restricted off seg-pbits 3 ports eth0.1 option off ports eth0.2 option off ports eth0.3 option on ports eth0.3 tag off ports eth0.3 priority on ports eth0.3 promote on ports eth0.3 port-pbits 3 ports eth0.4 option on ports eth0.4 tag on ports eth0.4 priority on ports eth0.4 promote on ports eth0.4 port-pbits 3 ports eth1 option off ip-interface none
26
University
Hands-on
27
27
Hands-on
The purpose of this set of exercises is to check/test the different models explained in the theory, and to configure this using cli, TL1 and AMS R8. 1. Residential Bridge / Unstacked
28
www.alcatel-lucent.com
29
29