This KB will demonstrate generic troubleshooting steps to debug an issue where customer reports l2circuit connection is UP but the traffic is not passing through.

L2-circuit connection is UP between PE devices, but data plane traffic is not working.

Assuming following topology to describe the issue.

CE-1------PE-1=======l2circuit=====PE-2------CE-2

In the above topology,

CEs are EX4300 switches

PE-1 is QFX5100

PE-2 is QFX10002

There are multiple P devices between both the PEs, but those are out of scope for this KB.

Here the L2circuit connection between PE1 and PE2 is UP, however, pings between CE-1 and CE-2 is not successful

In the above scenario, following steps can be checked to identify and isolate where the traffic dropping.

Assuming the arp requests are sent from CE-1 towards CE-2

1. Try to configure firewall filters wherever possible to count arp request/reply packets on PE-1 and PE-2 to determine in which direction the traffic is dropping.
   
   
2. If the corresponding encapsulation firewall filter or egress firewall filter is not supported, verify with interface statistics if those are incrementing.
   For eg, to check if the arp request are coming in to the interface PE-1 connected to CE-1 to verify if the broadcast packets receive statistics are incrementing. Similarly,  check transmit statistics on PE-2 on the interface connected to CE-2 to verify if the arp requests are sent out to CE-2
   
   show interfaces <> extensive | match broad
   MAC statistics:                      Receive         Transmit
   Broadcast packets                        1                0
   
   
3. If the arp requests are received by CE-2 and it is sending out replies, and if firewall filter results are non-deterministic, try to configure ingress mpls filter on next hop P router (connected to PE-2) as the traffic out of PE routers will be encapsulated.(assuming the P router is a Juniper device).
   
   
4. To determine the mpls label advertised by the peer (for mpls firewall filter configuration) perform a label walk. Label advertised/learnt can be verified using show ldp show ldp database session command on juniper devices.
5. Using the same command, you can perform label walk to verify if all the P and PE routers along the path are advertising/receiving correct labels. If label mismatch is found, bounce the corresponding LDP session.
   
   
6. As a last resort, port mirroring can be done to isolate further to check which device is dropping the traffic. Once determined, you can investigate further on why the device is dropping the traffic based on the device role in the network