[c-nsp] Cisco ASR 9k transporting QinQ traffic

[Curtis Piehler]

Make sure the port mtu is higher to allow for additional vlan tags. 4 byte
per vlan.
On Jul 14, 2016 7:11 AM, "David Wilkinson" <cisco-***@noroutetohost.net>
wrote:

> Hi,
>
> We are in the process of migrating some of our links over to Cisco ASR
> 9006, they are running IOS XR 5.3.3.
>
> Normal vlan tagged dot1q traffic seems be working fine, apart from some
> STP fun when pseudowire comes back up and STP doesn't know about the
> topology changing and both paths are forwarding for a short time. I don't
> think there is away around this as the ASR just passes on the STP traffic
> and doesn't take part STP.
>
> QinQ traffic doesn't seem to be going via ASR correctly and just
> disappears.
>
> It is currently setup like this, The customer port plugs in a Cisco 4948
> and the port is configured as a dot1q-tunnel. the port from the 4948 to ASR
> is configured as a trunk port and the same in reverse to the customer's
> other port.
>
> Customer -> Cisco 4948 -> Cisco ASR 9k -> Cisco 4948 -> Customer
>
> On the ASR I am picking up the QinQ vlan on sub interfaces, adding it to a
> bridge domain.
> Below is the configuration I am using
>
> ---- ASR ----
>
> interface GigabitEthernet0/0/0/17.427 l2transport
> encapsulation dot1ad 427
> l2protocol cpsv tunnel
>
> interface Bundle-Ether2.427 l2transport
> encapsulation dot1ad 427
> l2protocol cpsv tunnel
>
> l2vpn
> bridge group cust-a
> bridge-domain cust-a-qinq
> interface Bundle-Ether2.427
> !
> interface GigabitEthernet0/0/0/17.427
>
> --- 4948 ---
>
> interface GigabitEthernet1/1
> switchport access vlan 427
> switchport mode dot1q-tunnel
> l2protocol-tunnel cdp
> l2protocol-tunnel stp
> l2protocol-tunnel vtp
>
> interface GigabitEthernet1/48
> switchport trunk encapsulation dot1q
> switchport trunk allowed vlan 155,203,204,427,428
> switchport mode trunk
>
>
> On the ASR if I change the encapsulation from dot1ad 427 to dot1q 427,
> then STP blocks with an inconsistent peer vlan message.
>
> %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 1
> on GigabitEthernet1/48 VLAN427.
> %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet1/48 on VLAN0427.
> Inconsistent local vlan.
>
> Can any one point me in the right direction and let me know what I have
> done wrong, I am assuming it something on the ASR configuration as QinQs
> between the 4948s taking another path without the ASR in the middle work
> fine.
>
> Thanks
>
> David
>
> _______________________________________________
> cisco-nsp mailing list cisco-***@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list cisco-***@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[James Bensley]

Just a quick off-the-top-of-my-head response...

Have you tried using (on the 9K):

interface GigabitEthernet0/0/0/17.427 l2transport
encapsulation dot1q 427 second-dot1q ABC
! and optionally
rewrite ingress tag pop [1|2] symmetrical

Or if it is a range of C-VLANs "encapsulation dot1q 427 second-dot1q
10-50" ? This will assume both VLANs have Ethertype 8100.

If you want to support 9100 or 9200 as the outter tag Ethertype then
you need to set it on the physical interface:

interface GigabitEthernet0/0/0/17
dot1q tunneling ethertype [0x9100|0x9200]

interface GigabitEthernet0/0/0/17.427 l2transport
encapsulation dot1q 427 second-dot1q ABC


If you want Ethertype 88A8 on the outer tag you can use the following
without anything on the main physical interface:

interface GigabitEthernet0/0/0/17.427 l2transport
encapsulation dot1ad 427second dot1q XXX

Cheers,
James.
_______________________________________________
cisco-nsp mailing list cisco-***@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[Lukas Tribus]

Hi,


> wonder if the 4948 is using 8100 for both the outer and inner tags, in
> which case using dot1ad wouldn't match.

By default Cisco tags with 8100 for both outer and inner tag. Don't expected 1ad unless explicitly requested/configured on the Catalayst.



> Is "rewrite ingress tag pop [1|2] symmetrical" always required?

Required no. But it makes sense to pop the S-Tag, since your requirement is to transport the S-Tag payload, not the transport overhead.



> l2protocol cpsv tunnel

Don't tunnel, your Catalysts are already tunneling; just forward this traffic on the 9k.


So:
- match dot1q, not 1ad
- pop 1 tag
- don't tunnel l2tp



Lukas
_______________________________________________
cisco-nsp mailing list cisco-***@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[Tom Hill]

On 14/07/16 12:09, David Wilkinson wrote:
> Can any one point me in the right direction and let me know what I have
> done wrong, I am assuming it something on the ASR configuration as QinQs
> between the 4948s taking another path without the ASR in the middle work
> fine.

I *think* you're wrongly assuming that dot1q-tunnel actually uses the
dot1ad EtherType on its outside tag, I don't believe it does.

After changing to dot1q, then you're seeing working stuff, but probably
incorrect configuration on the ASR.

Perhaps try something like:

encapsulation dot1q 427 second-dot1q any exact

I've got this setup working with single dot1q VLANs, but I've not had to
bother with dot1qtunnel or dot1ad!

Good luck :)

--
Tom
_______________________________________________
cisco-nsp mailing list cisco-***@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[James Bensley]

On 14 July 2016 at 12:24, David Wilkinson <cisco-***@noroutetohost.net> wrote:
> The port MTU on the ASR is 9206 and 9198 on the 4948s

I'd fix that before it bites you in the bum.

Cheers,
James.
_______________________________________________
cisco-nsp mailing list cisco-***@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/