Connecting Logical Systems Using Logical Tunnel Interfaces

Connecting Logical Systems

To connect two logical systems, you configure a logical tunnel interface on both logical systems. Then you configure a peer relationship between the logical tunnel interfaces, thus creating a point-to-point connection.

To configure a point-to-point connection between two logical systems, configure the logical tunnel interface by including the lt-fpc/pic/port statement:

lt-fpc/pic/port {
    unit logical-unit-number {
        encapsulation encapsulation;
        peer-unit unit-number;   # peering logical system unit number
        dlci dlci-number;
        family (inet | inet6 | iso | mpls);
    }
}

You can include this statement at the following hierarchy levels:

• [edit interfaces]

• [edit logical-systems logical-system-name interfaces]

When configuring logical tunnel interfaces, note the following:

• You can configure each logical tunnel interface with one of the following encapsulation types: Ethernet, Ethernet circuit cross-connect (CCC), Ethernet VPLS, Frame Relay, Frame Relay CCC, VLAN, VLAN CCC, or VLAN VPLS.

• You can configure the IP, IPv6, International Organization for Standardization (ISO), or MPLS protocol family.

• Do not reconfigure a logical tunnel interface that is an anchor point with pseudowire devices stacked above it unless you first deactivate all broadband subscribers that are using the pseudowire subscriber interface.

• The peering logical interfaces must belong to the same logical tunnel interface derived from the Tunnel Services PIC or Adaptive Services Module.

• You can configure only one peer unit for each logical interface. For example, unit 0 cannot peer with both unit 1 and unit 2.

• To enable the logical tunnel interface, you must configure at least one physical interface statement.

• Logical tunnels are not supported with Adaptive Services, Multiservices, or Link Services PICs (but they are supported on the Adaptive Services Module on M7i routers, as noted above).

• On M Series routers other than the M40e router, logical tunnel interfaces require an Enhanced Flexible PIC Concentrator (FPC).

• On MX Series routers, logical tunnel interfaces require Trio MPC/MIC modules. They do not require a Tunnel Services PIC in the same system.

When you configure a logical tunnel on an MX series router which has one of the peer configured in layer 2 mode, ensure that the peer layer 2 logical tunnel is part of a bridge domain or VPLS instance, for bidirectional traffic flow.

To configure a logical tunnel with bridge encapsulation, you must first configure the logical tunnel to be part of the bridge domain. The following sample configuration allows you to configure a logical tunnel, lt-2/1/0.3 with bridge encapsulation.

user@host# edit bridge-domains {
             bd1 {
                    domain-type bridge;
                    vlan-id 1
                   }
                            }


user@host# edit chassis
lt-2/1/0 {
    unit 3 {
        description "MPLS port mirroring Bridge ingress interface";
        encapsulation ethernet-bridge;
                   mtu 4500;
            peer-unit 4;
            family bridge {
                interface-mode access;
                vlan-id 1;
                          }            
            }

    unit 4 {
            description "MPLS Port mirroring L2/CCC egress interface";
            encapsulation ethernet-ccc;
            mtu 4500;
            peer-unit 3;
            family ccc {
                filter {
                    input HighPriority;
                }
            }
          }
    }

By default, logical tunnel interfaces operates in the default mode. To enable configuration mode for logical tunnel interfaces recycle application using following sample configuration:

1. Configure percentage of the calendar bandwidth for logical tunnel application.

   content_copy zoom_out_map

   [edit]
     user@host# set system packet-forwarding-options recycle-bandwidth-profiles prof1 tunnel-services 80
   

   In this example, you reserve 80% of the calendar bandwidth for logical tunnel application. In this case, 80% of 800Gbps, i.e., 640Gbps is reserved for logical tunnel application.

2. Apply the configured bandwidth to the logical tunnel application.

   content_copy zoom_out_map

   [edit]
     user@host# set system packet-forwarding-options recycle-bandwidth profile prof1
   

In the default mode, logical tunnel bandwidth is shared with other recycle applications in best effort mode. In the configuration mode, the sum total of all logical tunnel interfaces' bandwidth is capped by the total logical tunnel recycle application bandwidth. If the sum of configured bandwidth for all logical tunnel interfaces is larger than the bandwidth derived by logical tunnel recycle application then, the sum of logical tunnel interfaces' banwidth is limited to logical tunnel recycle application value.

For example, configure bandwidth of 10Gbps for logical tunnle1 and bandwidth of 100Gbps for logical tunnel2. The logical tunnel application percentage is equal to 100 Gbps. Sum of bandwidth of logical tunnle1 and of logical tunnle2 will be 100 Gbps and not 110 Gbps. In such cases, logical tunnel recycle application bandwidth is distributed in the ratio of individual logical tunnel interface bandwidth. In this case, 1:10 ratio of 100 Gbps.

Starting in Junos OS Evolved Release 24.1R1, we support layer 3 VPN service over logical tunnel interface on the ACX7K Series routers. The feature includes:

• VRF over logical tunnel interface

• Stitching of layer 3 VPN and layer 2 services through logical tunnel interface

The following sample configuration allows you to configure layer 3 VPN over a logical tunnel interface:

user@host# edit chassis {
lt-0/0/1:0 {
    unit 0 {
        vlan-id 10;
        encapsulation vlan-bridge;
        peer-unit 1;
    }
    unit 1 {
        vlan-id 10;
        family inet {
            address 100.1.1.100/24;
        }
        family inet6 {
            address 2001::1/128;
          }
        peer-unit 0;
    }


        routing-instances {
            vpn100 {
                instance-type vrf;
                interface lt-0/0/1:0.1;
                route-distinguisher <...>;
                vrf-import vpn100-imp;
                vrf-export vpn100-exp;
                vrf-table-label;
}

policy-options {
            policy-statement vpn100-exp {
                term 1 {
                    from {
                        <...>;
                    }
                    then {
                        community add vpn100;
                        accept;
                    }
                }
            }
            policy-statement vpn100-imp {
                term 1 {
                    from {
                        <...>;
                        community vpn100;
                    }
                    then {
                        accept;
                    }
                }
            }
            community vpn100 members <...>;
        }

Configuring a Proxy Logical Interface in the Global Domain

To configure a proxy logical interface in the global domain, you need to create logical tunnel (lt-) interface and IRB interface and then associate the IRB interface to a bridge domain. The following is a example to configure a proxy logical interface in the global domain:

1. Create an logical tunnel (lt-) interface.

   content_copy zoom_out_map

   [edit]
   user@host# set chassis aggregated-devices ethernet device-count 1
   user@host# set chassis fpc 0 pic 0 tunnel-services bandwidth 1g
   user@host# set interfaces lt-0/0/10 unit 0 encapsulation vlan-bridge
   user@host# set interfaces lt-0/0/10 unit 0 vlan-id 101
   user@host# set interfaces lt-0/0/10 unit 0 peer-unit 1
   user@host# set interfaces lt-0/0/10 unit 1 encapsulation vlan-ccc
   user@host# set interfaces lt-0/0/10 unit 1 vlan-id 101
   user@host# set interfaces lt-0/0/10 unit 1 peer-unit 0
   

2. Create an IRB interface.

   content_copy zoom_out_map

   [edit]
   user@host# set interfaces irb unit 0 family inet address 192.168.1.2/24
   

3. Associate the IRB interface to a bridge domain.

   content_copy zoom_out_map

   [edit]
   user@host# set bridge-domains b1 vlan-id 101
   user@host# set bridge-domains b1 interface lt-0/0/10.0
   user@host# set bridge-domains b1 routing-interface irb.0
   

Associating the Proxy Logical Interface to a Logical Interface in a VRF Domain

To associate the proxy logical interface to a logical interface in a VRF domain, you need to run the following PFE commands:

• test pfe acx vrf-mc-leak enable—Enables proxy association.

• test pfe acx entry add VRF-logical-interface-name logical-tunnel-logical-interface-name IRB-logical-interface-name IRB-IP-address + 1—Creates an association between proxy logical interface and the logical interface in a VRF domain.

• test pfe acx vrf-mc-leak disable—Disables proxy association.

• test pfe acx entry del VRF-logical-interface-name logical-tunnel-logical-interface-name IRB-logical-interface-name IRB-IP-address + 1—Deletes the association between the proxy logical interface and the logical interface in a VRF domain.

• show pfe vrf-mc-leak—Displays the association entries between proxy logical interface and the logical interface in a VRF domain.

Limitations

The following limitations need to be considered for receiving multicast traffic in a VRF domain:

• Maximum of 5 proxy associations of logical interfaces can be configured.

• VRF IPv6 multicast is not supported.

• AE interface as a VRF interface (requesting multicast traffic) is not be supported.

• Multicast traffic cannot be forwarded from the logical interface in a VRF domain if the first hop router is an ACX router.

Redundant Logical Tunnel Configuration

In Junos OS Releases 14.1R1 and earlier, you can create up to 16 redundant logical tunnels, depending on the number of Packet Forwarding Engines and the number of loopback interfaces on each Packet Forwarding Engine on your device. Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255.

You can add up to 32 logical tunnels as members of a redundant logical tunnel.

When you add more than two members to the redundant logical tunnel, they are in active mode. The traffic is load-balanced by default over all the tunnel members. You can also configure your RLT for single-link targeting and specify a minimum number of active links for the RLT.

When you add only two members to the redundant logical tunnel, you can configure the members in one of these ways:

• Both members in active mode

• One member in active mode and the other in backup mode

Single Link Targeting

You can configure your RLT anchor to use single link targeting. In this mode, all traffic flowing through your pseudowire or PWHT interface will be directed through just one link in the rlt bundle. If the targeted link goes down, all subscribers on the RLT will be terminated.

Minimum Active Links

In this mode, you can specify the minimum number of links that must be active for the RLT interface to remain up. If the number of active links on the RLT drops below the minimum, the RLT will go down. Any pseudowire and PWHT interfaces stacked on the RLT will also go down, and all subscribers will be terminated.

Redundant Logical Tunnel Failure Detection and Failover

A logical tunnel fails and is removed from the redundant logical tunnel group, and the backup logical tunnel becomes active due to one of these events:

• A hardware failure on the MPC module occurs.

• An MPC failure occurs due to a microkernel crash.

• The MPC module is administratively shut down and removed from the redundant logical tunnel.

• A power failure on the MPC module occurs.