day 1- tac03005 a wb ed01p07 forwarding models an

7/27/2019 Day 1- TAC03005 a WB ED01P07 Forwarding Models An

1/29

TAC03005_A AAAA WBZZA ED 01P07 1 2008 Alcatel-Lucent., All rights reserved

Alcatel-Lucent University Antwerp 1

University

Forwarding models

7342 FTTU operator part 2

Alcatel-Lucent University Antwerp

University

During class please switch offyour mobile, pager or other that may interrupt.

Entry level requirements:


2/29


2

Objectives

At the end of this session, you will be able to

summarize and explain the different forwarding modes the

7342 P-OLT can handle

configure the 7342 P-OLT for using several of theseforwarding models


3/29


3

Table of contents

Configuration options . . . . . . . p. 4

General workflow . . . . . . . p. 10

HSI service creation . . . . . . . p. 14

Scenarios . . . . . . . . . P. 16

Netopia as RG . . . . . . . . P. 25

Hands-on . . . . . . . . . p. 27


4/29



University

Frame forwarding in the 7342


5/29


5

LT

NT ONT

OLT

interface

interface

VLANx

VLANy

VLANz

PON

forwarding modes

iBridge (def)

cross connect

tagging modes

stacked

unstacked (def)

passthrough

marking modes

untrusted

vlan-tag (def)

vlan translation mode

ethertype classification

enhanced vlan translation

UNI modes for DS only

xmittag - transmit with tag

xmitnotag transmit w/o tag (def)

Configuration options

> Most of the parameters can be combined, however, some combinations do not makesense (but can be configured anyway):

one must take care that on the ethernet port of the ONT the same tagging is

applied both for upstream and downstream e.g. if you send tagged traffic upstream, you expect to receive tagged frames

in the downstream as well


6/29


6

General L2 forwarding rules

Allowed forwarding directions

Access => Network

Network => Access

Network => Network

Control => Access

Control => Network

MAC learning priorities

Control any other interface

always MAC movement to Control

Network Access

always MAC movement to Network

Network Network

MAC movement to last learned Network

Access Access

no MAC movement

Switching flood traffic (mcast, unknown MAC DA or unknown mcast addr)

limited to 500 packets/s per type per port for security reasons

flooded to all ports according to forwarding directions above

OLT

SHUB

(1)Networkinterface

(3) Accessinterface

OLT

NW

> General concept: we want to avoid user to user communication internally in the systemitself at all times!


7/29


7

Cross Connect mode

VLAN associated with a single user only

VLAN per subscriber model connection-oriented

stacked option for scalability

upstream traffic always send to the network, no user to user communication snooping disabled (no protocol handling for e.g. DHCP / IGMP)

all frame types allowed

broadcast from network to user allowed => transparent bitpipe

business applications

ONT

ONT

ONT

NETWORKVLAN SUBSCRIBER 2

VLAN SUBSCRIBER 3

VLAN SUBSCRIBER 1

> The VLAN in cross-connect mode provides a connection-oriented model across theconnectionless Ethernet access network through VLANs. One VLAN contains only one userport in VLAN cross-connect mode. A subscriber is identified across the entire network by a

VLAN ID in VLAN cross-connect mode.> In the upstream direction, the incoming subscriber port without the MAC destination

address is sufficient to identify the outgoing upstream port and the VLAN tag. This VLAN isthe port-based default VLAN configured for this subscriber port. To identify the outgoingupstream port, the MAC destination address is required. If the MAC DA is not yet learned,the frame will be flooded.

> When the frames sent through the bit pipe are IPoE frames, various protocol messages suchas DHCP or IGMP can be snooped. These functions are disabled in CC mode so that theseframes are handled as data traffic. Due to this handling, there can be downstreammulticast frames, but there is no corresponding multicast tree. When there is no multicasttree, the frames are flooded to all access interfaces. In VLAN cross-connect mode, sincethere is only one access interface, all frames flood this access interface. The multicast

frames pass transparently.> The broadcast frames are forwarded in the same way as multicast frames.

> In this configuration, the layer 2 control protocol frames are discarded. The layer 2 framesare link related and are not handled within the scope of a VLAN.

> A VLAN in cross-connect mode shares two common features with VLAN in iBridge mode:there will be no subscriber-to-subscriber communication and no broadcast storms.

> In this example only one service is shown, but one can of course use multiple services percustomer, as long as each VLAN is used only once per node.

> This mode has similarities with the well known ATMPVC concepts, since traffic is containedwithin one VLAN (bitpipe)


8/29


8

Intelligent Bridging mode

ONT

ONT

NETWORK

DATA VLAN

VIDEO VLAN

VOICE VLAN

DATASERVICE

VIDEOSERVICE

VOICESERVICE

CUSTOMER- A

CUSTOMER-B

VLAN associated by a number of users

VLAN per service model

upstream traffic always send to network, no user to user communication

some frame types discarded, e.g. multicast (see notes) broadcast from network to user blocked

residential applications

The iBridge mode has the following features compared to standard bridging:

> iBridge distinguishes network and subscriber ports.

> Frames received from a subscriber will always be sent towards the network and never toanothersubscriber. The only exception is the traffic destined for the P-OLT.

> iBridge avoids flooding by not sending broadcast to all nodes on the network.

> iBridge avoids the use of the same MAC address over multiple ports. This prevents a MACaddress learned on one port from receiving service on another port and prevents DoS andspoofing attacks.

> Frame types

> In iBridge mode, only the following frame types are accepted from the user ports:

IP over Ethernet (IPoE) (IPv4)/ARP/Reverse Address Resolution Protocol (RARP)

PPPoE (discovery & session)

IPoE (IPv4)/ARP/RARP/PPPoE (discovery & session)

all ethernet types

Extensible Authentication Protocol Over LAN (EAPOL)

EAPOL frames are dedicated packets that are never forwarded but are processed bythe ONT.

> Other frames, including multicast data frames, will be discarded.

> Note that more complex models can be setup, with additional splits per service provider.


9/29


9

EMAN

iBridge Different VLANs for different nodes

ONT

VLAN1

23

EMAN

VLAN123ONT

ONT

VLAN1

23

VLAN456ONT

if user A can obtain MAC of user B, user to user communication is possible

risk of performance degradation from broadcast frames

=> avoid same VLANs on different nodes

MAC A

MAC B

MAC A

MAC B

- broadcast- unknown MAC DA

> It is important to note that the VLAN must be unique between the P-OLT and the NSP IProuter in the Ethernet network to support the iBridge feature. If the network configurationuses a single VLAN for two P-OLTs and an NSP router, there could be direct subscriber-to-

subscriber communication and the consequence of broadcast and flooding.> When the nodes would be directly connected to a router, or when the EMAN bridges allow

for additional security settings to block this kind of user to user traffic, the same VLANs canstill be used. The latter simplifies the whole setup, a plus for maintenance andtroubleshooting.


10/29



University

General workflow

> Please note that the VLAN values used in this document only serve as an example. Theactual values depend on the configurations in the lab.

> Always ask your teacher which values should be used.


11/29


11

General workflow TL1 parameters

OLT

SHUB

PON ONT

SERVICE 2

NETWORK RGW

C2S C1C2

S C

ENT-PONVLAN (1) XCONN / RBRIDGE

(2) UNSTACKED / STACKED / PASSTHRU

ENT-QOS-MARKPROF (3) UNTRUSTED / VLANTAG / VLANTMODE / ETYPEVLANMODE / ETYPECMODE

(4) XMITNOTAG / XMITTAG

ENT-ONTENET (5) CVLANDEF = ...

ENT-SERVICE-HSI (6) SVLANID = ...

(7) UNUSED / IPOE / PPPOE

(8) UNISIDEVLAN = ...

(9) NETWORKSIDEVLAN = ...

CON

FIGFLOW

9 8VLAN TRANSLATION

ONT Ethernet port:UNI LEVEL

VLAN LEVEL

Service running on top of Ethernet port:SERVICE LEVEL

1 2

3 4 5

6

service 1

SERVICE 1

L2 forwarding

7

Example TL1 flow: (here only related to the parameters on the slide above)

> ENT-PONVLAN::PONVLAN-150::::MODE=RBRIDGE,TAGMODE=UNSTACKED;

> ENT-QOS MARKPROF::20:::M20:PROFTYPE=UNTRUSTED,DOT1P=2,UNTAGDS=XMITNOTAG;

> ENT-QOS-SESSPROF::20:::S20:UPMARKPROFID=20;

> ENT-ONTENET::ONTENET-1-1-1-3-1-1-1::::AUTODETECT=10_100BASETAUTO,CVLANDEF=0,SESSPROFID=20,MAXMACNUM=4:IS;

> ENT-SERVICE-HSI::HSI-1-1-1-3-1-1-1-1::::BWPROFUPID=10,BWPROFDNID=10,PQPROFID=10,SVLAN=150,ETHERTYPE=UNUSED,UNISIDEVLAN=0,NETWORKSIDEVLAN=0:IS;


12/29


12

UNTRUSTED

untrusted mode causes the DOT1P and CVLAN tags received from an RG to beoverwritten with the DOT1P value configured on the port

VLANTAG

VLAN tag mode forwards traffic from an RG without altering tag priority

VLANTMODE

VLAN translation mode allows CVLANs to be sent from an RG to the ONT in theunstacked mode without being overwritten by an SVLAN

ETYPECMODE

EtherType classification mode allows HSI traffic to be segregated into IPoE andPPPoE flows

ETYPEVLANMODE EtherType/VLAN translation mode allows CVLANs or NW VLANs to be sent in the

upstream direction in unstacked or pass-through mode using a new combinedEtherType/VLAN translation

Marking modes


13/29


13

TL1 parameters

ENT-PONVLAN::PONVLAN-150::::MODE=RBRIDGE,TAGMODE=UNSTACKED;

ENT-QOS MARKPROF::20:::M20:PROFTYPE=UNTRUSTED,DOT1P=2,UNTAGDS=XMITNOTAG;

ENT-QOS-SESSPROF::20:::S20:UPMARKPROFID=20;

ENT-ONTENET::ONTENET-1-1-1-3-1-1-1::::AUTODETECT=10_100BASETAUTO,CVLANDEF=0,

SESSPROFID=20,MAXMACNUM=4:IS;

ENT-SERVICE-HSI::HSI-1-1-1-3-1-1-1-1::::BWPROFUPID=10,BWPROFDNID=10,PQPROFID=10,

SVLAN=150,ETHERTYPE=UNUSED,UNISIDEVLAN=0,NETWORKSIDEVLAN=0:IS;


14/29



University

HSI service creation


15/29


15

ONT

HSI service creation

Service 1

Service 2

Service 3

ENET

ENET

POTS

POTS

STEP 1: ONT ENET port config.

ent-ontenet::ont-1-1-7-1-12-1-1 :::: autodetect,cvlandef, sessprofid,sessprofnm,maxmacnum:is;

STEP 2 ONT service configuration

ent-service-hsi::hsi-1-1-7-1-12-1-1-1::::bwprofupid, bwprofupnm, bwprofdnid, bwprofdnnm, pqprofid, pqprofnm, aesenable,label=, svlan, customerID, Ethertype, UNIsideVLAN, NWsideVLAN:is;

T-CONTx

T-CONTy

T-CONTz

configure services

on this port

configure BW profiles, PQ profiles,

session profile, S-VLAN

> At the same time T-CONTs are created, also one or more alloc-ids are created, but thatis not a topic for now (this will be explained later in the QoS part)

> What is important at this point is that one service corresponds to one single T-CONT,and that one might run multiple services over one single UNI!


16/29



University

Scenarios


17/29


17

OLTSHUB PON ONT

RBRIDGE / UNSTACKED

UNTAGGEDC0, Px TAGGEDS150, P1 SINGLE TAGGED

ENT-PONVLAN (150)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 0

ENT-SERVICE-HSI

(6) SVLANID = 150


(8) UNISIDEVLAN = 0

(9) NETWORKSIDEVLAN = 0

NETWORK


18/29


18

OLTSHUB PON ONT

RBRIDGE / PASSTHRU + CVLAN tagged userside

RG

UNTAGGEDTAGGEDC150, P1C150, P1 TAGGED

specifying CVLANDEF = 150 means any other incoming tag (diff. from 150) will be discarded

specifying CVLANDEF = 0 means no check on incoming tagged frame, useful for multiple services

ENT-PONVLAN (150)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 150

ENT-SERVICE-HSI

(6) SVLANID = 150


(8) UNISIDEVLAN = 0


S150, P1 SINGLE TAGGED

NETWORK


19/29


19

RBRIDGE / PASSTHRU + CVLAN tagged (multi-service)

for multiple services on one ethernet port

=> different PQ profiles required

ent-profile-pq::21:::p21:PQ1WEIGHT=0,DOT1P1PQ=1;



it looks as if they all use queue 1, but internally the traffic is

really spread over 3 different queues!!!

important: specify different (set of) pbits for each PQ-profile


20/29


20

OLTSHUB PON ONT RG


multiple services with residential gateway

requires 3 x different PONVLAN and 3 x SERVICE-HSI on the same ONT ethernet port

ENT-PONVLAN (150, 160, 170)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 0

ENT-SERVICE-HSI

(6) SVLANID = 150, 160, 170


(8) UNISIDEVLAN = 0



41

2

3

UNTAGGEDTAGGEDC160, P2C160, P2 TAGGEDS160, P2 SINGLE TAGGED


port 1

port 2

port 3

NETWORK LEVEL (3 x)

UNI LEVEL (1 x)

SERVICE LEVEL (3 x)

RBRIDGE / PASSTHRU + CVLAN tagged (multi-service)

NETWORK


21/29


21

OLTSHUB PON ONT

RBRIDGE / PASSTHRU + CVLAN tagged (VLAN-translation)

RG



requires 3 x different PONVLAN and 3 x SERVICE-HSI on the same ONT ethernet port

ENT-PONVLAN (151, 161, 171)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 0

ENT-SERVICE-HSI

(6) SVLANID = 151, 161, 171


(8) UNISIDEVLAN = 150, 160, 170

(9) NETWORKSIDEVLAN = 151, 161, 171


41

2

3



port 1

port 2

port 3

NETWORK LEVEL (3 x)

UNI LEVEL (1 x)

SERVICE LEVEL (3 x)

UNINETWORKtranslation

NETWORK


22/29


22

OLTSHUB PON ONT

XCONN / STACKED + CVLAN tagged userside

RG


requires 1 x PONVLAN and 1 x SERVICE-HSI

by defining CVLANDEF = 0, it behaves transparantly for the CVLAN tag

ENT-PONVLAN (400)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 0

ENT-SERVICE-HSI

(6) SVLANID = 400


(8) UNISIDEVLAN = 0


41

2

3

NETWORK LEVEL (1 x)

UNI LEVEL (1 x)

SERVICE LEVEL (1 x)




port 1

port 2

port 3

S400, P1 DUAL TAGGEDC150, P1



NETWORK

> Note that only one PONVLAN is required and also one service definition on the UNI. TheCVLAN-tags are sent transparently and the pbits will be copied into the SVLAN tag.

> It is again possible to restrict the incoming CVLAN tag by setting CVLANDEF = 150.


23/29


23

XCONN / STACKED + CVLAN tagged userside

Use static IP addresses (lab ALUA)

Verify scenario by pinging the other trainees

First ping generates ARP broadcast => OK: XCONN mode = transparent bitpipe

NETWORK

TRAINEE 1

TRAINEE 2

TRAINEE 3

TRAINEE ...

11.11.11.11 / 24

11.11.11.12 / 24

11.11.11.13 / 24

PING

> This scenario would not work in RBRIDGE mode, since the initial broadcast ARP requestwould be blocked in that mode. One could of course add a static ARP entry.


24/29


24

OLTSHUB PON ONT

RBRIDGE / UNSTACKED + CVLAN tagged (ETYPEVLANMODE)

using port 1 (VLAN 150 member) on RG for IPoE and PPPoE

RG

IPoEC150, P1C151, P1

ENT-PONVLAN (151, 200)

(1) XCONN / RBRIDGE


ENT-QOS-MARKPROF

(3) UNTRUSTED

VLANTAG

VLANTMODE

ETYPEVLANMODE

ETYPECMODE


ENT-ONTENET

(5) CVLANDEF = 0

ENT-SERVICE-HSI

(6) SVLANID = 151, 200


(8) UNISIDEVLAN = 150, 150

(9) NETWORKSIDEVLAN = 151, 200


41

2

3

PPPoEC150, P1C200, P1S200, P1 SINGLE TAGGED

port 1

port 1

NETWORK LEVEL (2 x)

UNI LEVEL (1 x)

SERVICE LEVEL (2 x)

UNINETWORKtranslation

IPoE

PPPoE

IPoE

PPPoE

IPoE

PPPoE

NETWORK


25/29



University

NETOPIA as an RG


26/29


26

NETOPIA VDSL2 modem (model 7347-64-20EU)

UNTAGGED, VLAN 170 member

1234


VMWAREclient


RG - RESIDENTIAL GATEWAY

ONT

TAGGED 802.1Q TRUNK

VLAN 150, pbit = 1upstream



multiple services over one trunk link to ONT, identified with VLAN-ID and pbits

how to configure?

reset modem to factory defaults

telnet 192.168.1.254, provide new password copy-paste CLI, see speaker notes

port 1 attached to IP itf 192.168.1.254 for mngt

MULTIPLE SERVICES

> configure

> set dhcp option off

> set wireless option off

> set vlan name "VLAN150" type global

> set vlan name "VLAN150" id 150

> set vlan name "VLAN150" admin-restricted off> set vlan name "VLAN150" seg-pbits 1

> set vlan name "VLAN150" ports eth0.1 option on

> set vlan name "VLAN150" ports eth0.1 tag off

> set vlan name "VLAN150" ports eth0.1 priority on

> set vlan name "VLAN150" ports eth0.1 promote on

> set vlan name "VLAN150" ports eth0.1 port-pbits 1

> set vlan name "VLAN150" ports eth0.2 option off



> set vlan name "VLAN150" ports eth0.4 tag on




> set vlan name "VLAN150" ports eth1 option off

> set vlan name "VLAN150" ip-interface ip-eth-a

> set vlan name "VLAN150" inter-vlan-routing group-1 off> set vlan name "VLAN150" inter-vlan-routing group-2 off



> set vlan name "VLAN160" admin-restricted off

> set vlan name "VLAN160" seg-pbits 2











> set vlan name "VLAN160" ports eth0.4 promote on> set vlan name "VLAN160" ports eth0.4 port-pbits 2


> set vlan name "VLAN160" ip-interface none



> set vlan name "VLAN170" admin-restricted off

> set vlan name "VLAN170" seg-pbits 3














> set vlan name "VLAN170" ip-interface none

> save

> quit

> restart


27/29



University

Hands-on


28/29


Hands-on

The purpose of this set of exercises is to check/test the different models explained in thetheory, and to configure this using cli, TL1 and AMS R8.

1. Residential Bridge / Unstacked

2. Residential Bridge / Passthrough + C-VLAN tagged @ userside

3. Residential Bridge / Passthrough + C-VLAN tagged @ userside (multi-service)

4. Residential Bridge / Passthrough + C-VLAN tagged @ userside (VLAN translation)

5. Cross-connect / Stacked + C-VLAN tagged @ userside

6. Residential Bridge / Unstacked + C-VLAN tagged @ userside (ETYPEVLANMODE)


29/29

29

www.alcatel-lucent.com

day 1- tac03005 a wb ed01p07 forwarding models an

Documents