Layer 2 and 3 Routing over Metro E Circuits

[Mikey John]

Hi Follks,

I am planning to procure a Metro E circuit between two locations. Some of the traffic that would be routed between these two locations need to be secure, and not mix with other traffic/VLANs.

Can I have Layer 3 (mu VRFs) and Layer 2 traffic passing over this Metro E link? Is there anything that needs to be provided to the service provider for this arrangement to happen?

For example
1) Traffic A - A VRF
2) Traffic B - B VRF
3) Traffic C - Vlan X
4) Traffic D - Vlan Y
5) Traffic E - VLan Z

Cheers
Mikey

[Giuseppe Larosa]

Hello @Mikey John ,

the Service Provider can give you  a port based L2 service.

Then you can put over the link/service 802.1Q tagged frames.

You can implement VRF lite meaning that each VRF will need a dedicated VLAN to create end  to end connectivity

Addititonal VLANs will be carried as well.

At OSI level 2 you will be carrying 5 different Vlans.

The first two will be associated one to VRF A and one to VRF B the other VLANs are carried and associated to the global routing table.

Hope to help

Giuseppe

[Joseph W. Doherty]

How secure? Reason I ask, what Giuseppe describe will logically "separate" your traffic on the same MetroE link, but for additional security you may want to encrypt some of the traffic.

[Richard Burts]

The original post asks a key question "Can I have Layer 3 (mu VRFs) and Layer 2 traffic passing over this Metro E link" which seems to suggest that some traffic over the Metro E will be layer 3 routed while other traffic will be layer 2 forwarded. From the perspective of the provider it is either one or the other. The provider could provide a layer 3 routed link to you or the provider could provide a layer 2 link carrying multiple vlans. What you do with each vlan is up to you. And you could certainly run a dynamic routing protocol to do layer 3 routing on some vlans while you do layer 2 forwarding on other vlans. But from the perspective of what you negotiate with the provider it is one or the other.

[insideshell]

I agree with @Richard Burts. That's a fundamental question. It seems the provider will provide an Ethernet private line (an EPL in MEF terminology), meaning it will transparently carry your Ethernet frames between your two locations. The provider will not read any upper layer protocol.

Often, these frames can be VLAN tagged (but this you may want to check with the provider). And you can encapsulate whatever you want in these Ethernet frames: IP for routed traffic (e.g., VRF lite) or even MPLS (e.g., for BGP/MPLS IP VPN).

You may also want to check with the provider the L2MTU of the circuit to ensure it can carry at least one VLAN tag with the standard IP MTU of 1500 bytes (if you plan to send IP over your Ethernet frames) - it should be at least 1522 bytes = standard IP MTU (1500) + Ethernet header FCS included (18) + one VLAN tag (4). Sometimes, provider also support jumbo frames (e.g., 9022 bytes based on the other common IP MTU of 9000 bytes).