double-tag becomes triple-tag me3600 to ASR91K

[mike-stevenson]

Hi,

I have setup a psuedo-wire between a port on a me3600-x to an ASR91K, the frames received on at the me3600 are QinQ (eg 101,25)  these frames are then forwarded via a xconnect to an ASR91K where I drop them out onto an interface (which I then 'handbag' to use for BNG services) however on the 9K interface if I plug my laptop in and use wireshark the frames are being recieved with triple-tags (eg 101,101,25) where the outer tag is repeated.

The configuration was working fine on an ASR901, however as soon as i swapped the 901 out for a ME3600, this problem started.

how do i get teh original qinq forwarded without the extra tag being pre-pended (and why is it doing this?)

The following are the relevant configurations:

ME3600:

interface GigabitEthernet0/3

switchport trunk allowed vlan none

switchport mode trunk

no keepalive

service instance 10 ethernet

  encapsulation default

  xconnect 103.241.59.4 10 encapsulation mpls

   mtu 9216

ASR9K1:

L2VPN

l2vpn

bridge group REMOTE

  bridge-domain REMOTE

   mac

    limit

     maximum 32000

    !

   !

   mtu 9216

   transport-mode vlan passthrough

   interface GigabitEthernet0/0/0/2.1

   !

   neighbor 103.241.59.2 pw-id 10

    split-horizon group

   !

INTERFACE

interface GigabitEthernet0/0/0/2

!

interface GigabitEthernet0/0/0/2.1 l2transport

encapsulation default

also any good debug/show commands would be great, as at this stage, the only way i can see what is happening is by using wireshark.

Thanks,

Mike

[mtsb]

Hi Mike,

I am not sure where exactly you do the packet capture...is it on the core facing MPLS interface on ASR 9K side or on the access facing side? If you are doing the SPAN where is the source SPAN port?

On ME3600 side you just match on a default encap which is like a default class and xconnect it to other side. There is no tag operation you are doing.

I am more interested to know where the extra tag is added? Is it on ME3600 as it leaves or is it on 9K side after receiving it?

Can you put in a command "rewrite ingress tag pop 1 symmetric" on ME3600 side and check if we receive 1 tag less?

Thanks,

Madhu

[mike-stevenson]

HI Madhu,

I am sorry i was not more specific. 

To confirm that I was sending only q-in-q into the me3600, i disconnected the downstream switch, and connected this to my laptop running wireshark, at this point I could confirm that the downstream switch was sending only q-in-q traffic (dhcp-broadcast requests).

I then plugged my laptop into the asr9k1, on port g0/0/0/2, at this point i was now seeing the traffic as tripple tag, with the svid tag repeated (eg 101, 101, 25) for the same DHCP broadcast requests.

I tried to configure, the command you mentioned.

The switch would not let me:

tpisp-ds01-h(config)#int g0/3

tpisp-ds01-h(config-if)#service instance 10 ethernet

tpisp-ds01-h(config-if-srv)#rewrite ingress tag pop 1 symmetric

Rewrite change is not logically valid on ServInst 10(Gi0/3)

Thank you for your comments, if you require more information, or clarity, please ask. 

Once again, thanks,

Mike

[mtsb]

Hi Mike,

Is gi0/0/0/2 port a CE facing or a PE (MPLS) port?

If you are sure that the packets are coming in as 101 and 25 tag then can you use the more specific match on service instance as "encapsulation dot1q 101 second-dot1q 25" and check if it is working?

I missed the point that you are using a encap default and thats the reason the rewrite command is not working but if you are matching specific tags it will work.

Thanks,

Madhu

[mike-stevenson]

Madhu,

I guess you could consider g0/0/0/2 to be 'CE' facing, though it actually is connected via a short patch lead to port g0/0/0/3 on the same ASR9K where i then run BNG services.  I am away from the equipment till tomorrow afternoon, so can not check the more specific configuration as suggested.  Though in the long run I will ahve to leave it as encapsulation default, as I have many downstream subscribers that may be coming through on any svid/cvid combination.  I will also have subscribers that i need to map elsewhere by matching specific svid/cvids.  The default encapsualtion acts as a catch all, so keepign this would be by far the best outcome.

as mentioned the config above worked perfectly when i was using an ASR901.

I will update tomorrow, when I once again have access to the equipment.

thanks,

Mike

[mtsb · Accepted solution]

Hi Mike,

Sure. No worries. The config you had earlier as mentioned before should not add a tag so was wondering if we are adding it and sending over to 9K or is 9K adding it.

My idea would be first to check who is adding it , check with more specific encap. Depending on this outcome we can progress further.

If it is ME adding extra tag, we can try to change it to VC type 4 using "interworking vlan" option on ME and forcing it to type 4 as default it type 5?

Thanks,

Madhu

[mike-stevenson]

Madhu,

You are a guru!  I ended up spannig the upstream port, and confirmed via wireshark that it was the me3600 that was adding the extra tag.

I configured a pw-class and set the interworking to ethernet as you advised, and suddenly everything started working!

Thank you.

configuration of working connection:

ME3600 end:

pseudowire-class TEST

encapsulation mpls

interworking ethernet

interface GigabitEthernet0/3

switchport trunk allowed vlan none

switchport mode trunk

mtu 9216

no keepalive

service instance 10 ethernet

  encapsulation default

  xconnect 10.10.10.2 10 encapsulation mpls pw-class TEST

ASR 9K end

l2vpn

bridge group UFB

  bridge-domain UFB

   mac

    limit

     maximum 32000

    !

   !

   mtu 9216

   interface GigabitEthernet0/0/0/2.1

   !

   neighbor 10.10.10.1 pw-id 10

    split-horizon group

Thank you for your help.

Mike

[mtsb]

Hi Mike,

Great! Thanks for letting us know.

Have a nice day!

Madhu

[joshuacmoore]

What IOS are you running on ME3600 and ASR? VC type should be negotiated.

Sent from Cisco Technical Support iPhone App