This article demonstrates how to get virtual private LAN service (VPLS) connectivity between SRX devices over the GRE tunnel with the help of an example.
Topology
Given the above topology, the steps to achieve VPLS connectivity between LAN A and LAN B would be as follows:
SRX-A set interfaces gr-0/0/0 unit 0 tunnel source 172.16.0.1 set interfaces gr-0/0/0 unit 0 tunnel destination 172.16.0.10 set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.1/30
SRX-A
set interfaces gr-0/0/0 unit 0 tunnel source 172.16.0.1 set interfaces gr-0/0/0 unit 0 tunnel destination 172.16.0.10 set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.1/30
SRX-B set interfaces gr-0/0/0 unit 0 tunnel source 172.16.0.10 set interfaces gr-0/0/0 unit 0 tunnel destination 172.16.0.1 set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.2/30
SRX-B
set interfaces gr-0/0/0 unit 0 tunnel source 172.16.0.10 set interfaces gr-0/0/0 unit 0 tunnel destination 172.16.0.1 set interfaces gr-0/0/0 unit 0 family inet address 192.168.1.2/30
show mpls lsp
mpls ping
SRX-A set interfaces gr-0/0/0 unit 0 family mpls set protocols mpls no-cspf set protocols mpls label-switched-path To-SRX-B to 192.168.0.2 set protocols mpls interface gr-0/0/0.0 set protocols rsvp interface gr-0/0/0.0 SRX-B set interfaces gr-0/0/0 unit 0 family mpls set protocols mpls no-cspf set protocols mpls label-switched-path To-SRX-A to 192.168.0.1 set protocols mpls interface gr-0/0/0.0 set protocols rsvp interface gr-0/0/0.0
set interfaces gr-0/0/0 unit 0 family mpls set protocols mpls no-cspf set protocols mpls label-switched-path To-SRX-B to 192.168.0.2 set protocols mpls interface gr-0/0/0.0 set protocols rsvp interface gr-0/0/0.0
set interfaces gr-0/0/0 unit 0 family mpls set protocols mpls no-cspf set protocols mpls label-switched-path To-SRX-A to 192.168.0.1 set protocols mpls interface gr-0/0/0.0 set protocols rsvp interface gr-0/0/0.0
SRX-A set protocols bgp group VPLS type internal set protocols bgp group VPLS multihop set protocols bgp group VPLS local-address 192.168.0.1 set protocols bgp group VPLS family l2vpn signaling set protocols bgp group VPLS neighbor 192.168.0.2 set routing-options static route 192.168.0.2/32 next-hop gr-0/0/0.0 --> To force BGP to go via GRE SRX-B set protocols bgp group VPLS type internal set protocols bgp group VPLS multihop set protocols bgp group VPLS local-address 192.168.0.2 set protocols bgp group VPLS family l2vpn signaling set protocols bgp group VPLS neighbor 192.168.0.1 set routing-options static route 192.168.0.1/32 next-hop gr-0/0/0.0 --> To force BGP to go via GRE
set protocols bgp group VPLS type internal set protocols bgp group VPLS multihop set protocols bgp group VPLS local-address 192.168.0.1 set protocols bgp group VPLS family l2vpn signaling set protocols bgp group VPLS neighbor 192.168.0.2 set routing-options static route 192.168.0.2/32 next-hop gr-0/0/0.0 --> To force BGP to go via GRE
set protocols bgp group VPLS type internal set protocols bgp group VPLS multihop set protocols bgp group VPLS local-address 192.168.0.2 set protocols bgp group VPLS family l2vpn signaling set protocols bgp group VPLS neighbor 192.168.0.1 set routing-options static route 192.168.0.1/32 next-hop gr-0/0/0.0 --> To force BGP to go via GRE
SRX-A set routing-instances VPLS-A instance-type vpls set routing-instances VPLS-A interface ge-0/0/5.0 set routing-instances VPLS-A route-distinguisher 192.168.0.1:100 set routing-instances VPLS-A vrf-target target:100:100 set routing-instances VPLS-A protocols vpls no-tunnel-services set routing-instances VPLS-A protocols vpls site lanA site-identifier 1 SRX-B set routing-instances VPLS-B instance-type vpls set routing-instances VPLS-B interface ge-0/0/5.0 set routing-instances VPLS-B route-distinguisher 192.168.0.2:100 set routing-instances VPLS-B vrf-target target:100:100 set routing-instances VPLS-B protocols vpls no-tunnel-services set routing-instances VPLS-B protocols vpls site lanA site-identifier 2
set routing-instances VPLS-A instance-type vpls set routing-instances VPLS-A interface ge-0/0/5.0 set routing-instances VPLS-A route-distinguisher 192.168.0.1:100 set routing-instances VPLS-A vrf-target target:100:100 set routing-instances VPLS-A protocols vpls no-tunnel-services set routing-instances VPLS-A protocols vpls site lanA site-identifier 1
set routing-instances VPLS-B instance-type vpls set routing-instances VPLS-B interface ge-0/0/5.0 set routing-instances VPLS-B route-distinguisher 192.168.0.2:100 set routing-instances VPLS-B vrf-target target:100:100 set routing-instances VPLS-B protocols vpls no-tunnel-services set routing-instances VPLS-B protocols vpls site lanA site-identifier 2
Verification
SRX-A root@SRX-A> show route 192.168.0.2 inet.0: 14 destinations, 15 routes (14 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.2/32 *[Static/5] 22:21:47 > via gr-0/0/0.0 inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.2/32 *[RSVP/7/1] 00:01:37, metric 0 > via gr-0/0/0.0, label-switched-path To-SRX-B SRX-B root@SRX-B> show route 192.168.0.1 inet.0: 16 destinations, 17 routes (16 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.1/32 *[Static/5] 00:17:27 > via gr-0/0/0.0 inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.1/32 *[RSVP/7/1] 00:04:30, metric 65535 > via gr-0/0/0.0, label-switched-path To-SRX-A
root@SRX-A> show route 192.168.0.2 inet.0: 14 destinations, 15 routes (14 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.2/32 *[Static/5] 22:21:47 > via gr-0/0/0.0 inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.2/32 *[RSVP/7/1] 00:01:37, metric 0 > via gr-0/0/0.0, label-switched-path To-SRX-B
root@SRX-B> show route 192.168.0.1 inet.0: 16 destinations, 17 routes (16 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.1/32 *[Static/5] 00:17:27 > via gr-0/0/0.0 inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 192.168.0.1/32 *[RSVP/7/1] 00:04:30, metric 65535 > via gr-0/0/0.0, label-switched-path To-SRX-A
SRX-A root@SRX-A> show vpls connections |no-more Layer-2 VPN connections: Legend for connection status (St) EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS EM -- encapsulation mismatch WE -- interface and instance encaps not same VC-Dn -- Virtual circuit down NP -- interface hardware not present CM -- control-word mismatch -> -- only outbound connection is up CN -- circuit not provisioned <- -- only inbound connection is up OR -- out of range Up -- operational OL -- no outgoing label Dn -- down LD -- local site signaled down CF -- call admission control failure RD -- remote site signaled down SC -- local and remote site ID collision LN -- local site not designated LM -- local site ID not minimum designated RN -- remote site not designated RM -- remote site ID not minimum designated XX -- unknown connection status IL -- no incoming label MM -- MTU mismatch MI -- Mesh-Group ID not available BK -- Backup connection ST -- Standby connection PF -- Profile parse failure PB -- Profile busy RS -- remote site standby SN -- Static Neighbor LB -- Local site not best-site RB -- Remote site not best-site VM -- VLAN ID mismatch HS -- Hot-standby Connection Legend for interface status Up -- operational Dn -- down Instance: VPLS-A Edge protection: Not-Primary Local site: lanA (1) connection-site Type St Time last up # Up trans 2 rmt Up Jan 10 17:54:57 2020 1 Remote PE: 192.168.0.2, Negotiated control-word: No Incoming label: 262186, Outgoing label: 262145 Local interface: lsi.1049089, Status: Up, Encapsulation: VPLS Description: Intf - vpls VPLS-A local site 1 remote site 2 Flow Label Transmit: No, Flow Label Receive: No SRX-B root@SRX-B> show vpls connections |no-more Layer-2 VPN connections: Legend for connection status (St) EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS EM -- encapsulation mismatch WE -- interface and instance encaps not same VC-Dn -- Virtual circuit down NP -- interface hardware not present CM -- control-word mismatch -> -- only outbound connection is up CN -- circuit not provisioned <- -- only inbound connection is up OR -- out of range Up -- operational OL -- no outgoing label Dn -- down LD -- local site signaled down CF -- call admission control failure RD -- remote site signaled down SC -- local and remote site ID collision LN -- local site not designated LM -- local site ID not minimum designated RN -- remote site not designated RM -- remote site ID not minimum designated XX -- unknown connection status IL -- no incoming label MM -- MTU mismatch MI -- Mesh-Group ID not available BK -- Backup connection ST -- Standby connection PF -- Profile parse failure PB -- Profile busy RS -- remote site standby SN -- Static Neighbor LB -- Local site not best-site RB -- Remote site not best-site VM -- VLAN ID mismatch Legend for interface status Up -- operational Dn -- down Instance: VPLS-A Edge protection: Not-Primary Local site: lanB (2) connection-site Type St Time last up # Up trans 1 rmt Up Jan 10 17:41:27 2020 1 Remote PE: 192.168.0.1, Negotiated control-word: No Incoming label: 262145, Outgoing label: 262186 Local interface: lsi.1048576, Status: Up, Encapsulation: VPLS Description: Intf - vpls VPLS-A local site 2 remote site 1
root@SRX-A> show vpls connections |no-more Layer-2 VPN connections: Legend for connection status (St) EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS EM -- encapsulation mismatch WE -- interface and instance encaps not same VC-Dn -- Virtual circuit down NP -- interface hardware not present CM -- control-word mismatch -> -- only outbound connection is up CN -- circuit not provisioned <- -- only inbound connection is up OR -- out of range Up -- operational OL -- no outgoing label Dn -- down LD -- local site signaled down CF -- call admission control failure RD -- remote site signaled down SC -- local and remote site ID collision LN -- local site not designated LM -- local site ID not minimum designated RN -- remote site not designated RM -- remote site ID not minimum designated XX -- unknown connection status IL -- no incoming label MM -- MTU mismatch MI -- Mesh-Group ID not available BK -- Backup connection ST -- Standby connection PF -- Profile parse failure PB -- Profile busy RS -- remote site standby SN -- Static Neighbor LB -- Local site not best-site RB -- Remote site not best-site VM -- VLAN ID mismatch HS -- Hot-standby Connection Legend for interface status Up -- operational Dn -- down Instance: VPLS-A Edge protection: Not-Primary Local site: lanA (1) connection-site Type St Time last up # Up trans 2 rmt Up Jan 10 17:54:57 2020 1 Remote PE: 192.168.0.2, Negotiated control-word: No Incoming label: 262186, Outgoing label: 262145 Local interface: lsi.1049089, Status: Up, Encapsulation: VPLS Description: Intf - vpls VPLS-A local site 1 remote site 2 Flow Label Transmit: No, Flow Label Receive: No
root@SRX-B> show vpls connections |no-more Layer-2 VPN connections: Legend for connection status (St) EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS EM -- encapsulation mismatch WE -- interface and instance encaps not same VC-Dn -- Virtual circuit down NP -- interface hardware not present CM -- control-word mismatch -> -- only outbound connection is up CN -- circuit not provisioned <- -- only inbound connection is up OR -- out of range Up -- operational OL -- no outgoing label Dn -- down LD -- local site signaled down CF -- call admission control failure RD -- remote site signaled down SC -- local and remote site ID collision LN -- local site not designated LM -- local site ID not minimum designated RN -- remote site not designated RM -- remote site ID not minimum designated XX -- unknown connection status IL -- no incoming label MM -- MTU mismatch MI -- Mesh-Group ID not available BK -- Backup connection ST -- Standby connection PF -- Profile parse failure PB -- Profile busy RS -- remote site standby SN -- Static Neighbor LB -- Local site not best-site RB -- Remote site not best-site VM -- VLAN ID mismatch Legend for interface status Up -- operational Dn -- down Instance: VPLS-A Edge protection: Not-Primary Local site: lanB (2) connection-site Type St Time last up # Up trans 1 rmt Up Jan 10 17:41:27 2020 1 Remote PE: 192.168.0.1, Negotiated control-word: No Incoming label: 262145, Outgoing label: 262186 Local interface: lsi.1048576, Status: Up, Encapsulation: VPLS Description: Intf - vpls VPLS-A local site 2 remote site 1
Note: SRX-A and SRX-B are in packet mode. To get this working in flow mode, you need to apply the following firewall filters on gr-0/0/0 (input direction) on both SRX devices.
set firewall family mpls filter For-MPLS term 1 then packet-mode set interfaces gr-0/0/0 unit 0 family mpls filter input For-MPLS