Network Working Group                                  L. Andersson, Ed.
Request for Comments: 4664                                      Acreo AB
Category: Informational                                    E. Rosen, Ed.
                                                     Cisco Systems, Inc.
                                                          September 2006
Network Working Group                                  L. Andersson, Ed.
Request for Comments: 4664                                      Acreo AB
Category: Informational                                    E. Rosen, Ed.
                                                     Cisco Systems, Inc.
                                                          September 2006

Framework for Layer 2 Virtual Private Networks (L2VPNs)


Status of This Memo


This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.


Copyright Notice


Copyright (C) The Internet Society (2006).




This document provides a framework for Layer 2 Provider Provisioned Virtual Private Networks (L2VPNs). This framework is intended to aid in standardizing protocols and mechanisms to support interoperable L2VPNs.


Table of Contents


   1. Introduction ....................................................3
      1.1. Conventions Used in This Document ..........................3
      1.2. Objectives and Scope of the Document .......................3
      1.3. Layer 2 Virtual Private Networks ...........................3
      1.4. Terminology ................................................4
   2. Models ..........................................................5
      2.1. Reference Model for VPWS ...................................5
           2.1.1. Entities in the VPWS Reference Model ................5
      2.2. Reference Model for VPLS ...................................6
           2.2.1. Entities in the VPLS Reference Model ................8
      2.3. Reference Model for Distributed VPLS-PE or VPWS-PE .........9
           2.3.1. Entities in the Distributed PE Reference Models .....9
      2.4. VPWS-PE and VPLS-PE ........................................9
   3. Functional Components of L2 VPN .................................9
      3.1. Types of L2VPN ............................................10
           3.1.1. Virtual Private Wire Service (VPWS) ................10
           3.1.2. Virtual Private LAN Service (VPLS) .................10
           3.1.3. IP-Only LAN-Like Service (IPLS) ....................11
      3.2. Generic L2VPN Transport Functional Components .............11
           3.2.1. Attachment Circuits ................................11
           3.2.2. Pseudowires ........................................12
           3.2.3. Forwarders .........................................14
           3.2.4. Tunnels ............................................15
           3.2.5. Encapsulation ......................................16
           3.2.6. Pseudowire Signaling ...............................16
         Point-to-Point Signaling ..................18
         Point-to-Multipoint Signaling .............18
         Inter-AS Considerations ...................19
           3.2.7. Service Quality ....................................20
         Quality of Service (QoS) ..................20
         Resiliency ................................21
           3.2.8. Management .........................................22
      3.3. VPWS ......................................................22
           3.3.1. Provisioning and Auto-Discovery ....................23
         Attachment Circuit Provisioning ...........23
         PW Provisioning for Arbitrary
                           Overlay Topologies ........................23
         Colored Pools PW Provisioning Model .......25
           3.3.2. Requirements on Auto-Discovery Procedures ..........27
           3.3.3. Heterogeneous Pseudowires ..........................28
      3.4. VPLS Emulated LANs ........................................29
           3.4.1. VPLS Overlay Topologies and Forwarding .............31
           3.4.2. Provisioning and Auto-Discovery ....................33
           3.4.3. Distributed PE .....................................33
           3.4.4. Scaling Issues in VPLS Deployment ..................36
      3.5. IP-Only LAN-Like Service (IPLS) ...........................36
   1. Introduction ....................................................3
      1.1. Conventions Used in This Document ..........................3
      1.2. Objectives and Scope of the Document .......................3
      1.3. Layer 2 Virtual Private Networks ...........................3
      1.4. Terminology ................................................4
   2. Models ..........................................................5
      2.1. Reference Model for VPWS ...................................5
           2.1.1. Entities in the VPWS Reference Model ................5
      2.2. Reference Model for VPLS ...................................6
           2.2.1. Entities in the VPLS Reference Model ................8
      2.3. Reference Model for Distributed VPLS-PE or VPWS-PE .........9
           2.3.1. Entities in the Distributed PE Reference Models .....9
      2.4. VPWS-PE and VPLS-PE ........................................9
   3. Functional Components of L2 VPN .................................9
      3.1. Types of L2VPN ............................................10
           3.1.1. Virtual Private Wire Service (VPWS) ................10
           3.1.2. Virtual Private LAN Service (VPLS) .................10
           3.1.3. IP-Only LAN-Like Service (IPLS) ....................11
      3.2. Generic L2VPN Transport Functional Components .............11
           3.2.1. Attachment Circuits ................................11
           3.2.2. Pseudowires ........................................12
           3.2.3. Forwarders .........................................14
           3.2.4. Tunnels ............................................15
           3.2.5. Encapsulation ......................................16
           3.2.6. Pseudowire Signaling ...............................16
         Point-to-Point Signaling ..................18
         Point-to-Multipoint Signaling .............18
         Inter-AS Considerations ...................19
           3.2.7. Service Quality ....................................20
         Quality of Service (QoS) ..................20
         Resiliency ................................21
           3.2.8. Management .........................................22
      3.3. VPWS ......................................................22
           3.3.1. Provisioning and Auto-Discovery ....................23
         Attachment Circuit Provisioning ...........23
         PW Provisioning for Arbitrary
                           Overlay Topologies ........................23
         Colored Pools PW Provisioning Model .......25
           3.3.2. Requirements on Auto-Discovery Procedures ..........27
           3.3.3. Heterogeneous Pseudowires ..........................28
      3.4. VPLS Emulated LANs ........................................29
           3.4.1. VPLS Overlay Topologies and Forwarding .............31
           3.4.2. Provisioning and Auto-Discovery ....................33
           3.4.3. Distributed PE .....................................33
           3.4.4. Scaling Issues in VPLS Deployment ..................36
      3.5. IP-Only LAN-Like Service (IPLS) ...........................36
   4. Security Considerations ........................................37
      4.1. Provider Network Security Issues ..........................37
      4.2. Provider-Customer Network Security Issues .................39
      4.3. Customer Network Security Issues ..........................39
   5. Acknowledgements ...............................................40
   6. Normative References ...........................................41
   7. Informative References .........................................41
   4. Security Considerations ........................................37
      4.1. Provider Network Security Issues ..........................37
      4.2. Provider-Customer Network Security Issues .................39
      4.3. Customer Network Security Issues ..........................39
   5. Acknowledgements ...............................................40
   6. Normative References ...........................................41
   7. Informative References .........................................41
1. Introduction
1. 介绍
1.1. Conventions Used in This Document
1.1. 本文件中使用的公约

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

本文件中的关键词“必须”、“不得”、“要求”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照RFC 2119[RFC2119]中所述进行解释。

1.2. Objectives and Scope of the Document
1.2. 文件的目标和范围

This document provides a framework for Layer 2 Provider Provisioned Virtual Private Networks (L2VPNs). This framework is intended to aid in standardizing protocols and mechanisms to support interoperable L2VPNs.


The term "provider provisioned VPNs" refers to Virtual Private Networks (VPNs) for which the Service Provider (SP) participates in management and provisioning of the VPN.


Requirements for L2VPNs can be found in [RFC4665].


This document provides reference models for L2VPNs and discusses the functional components of L2VPNs. Specifically, this includes discussion of the technical issues that are important in the design of standards and mechanisms for L2VPNs, including those standards and mechanisms needed for interworking and security.


This document discusses a number of different technical approaches to L2VPNs. It tries to show how the different approaches are related, and to clarify the issues that may lead one to select one approach instead of another. However, this document does not attempt to select any particular approach.


1.3. Layer 2 Virtual Private Networks
1.3. 第二层虚拟专用网络

There are two fundamentally different kinds of Layer 2 VPN service that a service provider could offer to a customer: Virtual Private Wire Service (VPWS) and Virtual Private LAN Service (VPLS). There is also the possibility of an IP-only LAN-like Service (IPLS).


A VPWS is a VPN service that supplies an L2 point-to-point service. As this is a point-to-point service, there are very few scaling issues with the service as such. Scaling issues might arise from the number of end-points that can be supported on a particular PE.


A VPLS is an L2 service that emulates LAN service across a Wide Area Network (WAN). With regard to the amount of state information that must be kept at the edges in order to support the forwarding function, it has the scaling characteristics of a LAN. Other scaling issues might arise from the number of end-points that can be supported on a particular PE. (See Section 3.4.4.)


Note that VPLS uses a service that does not have native multicast capability to emulate a service that does have native multicast capability. As a result, there will be scalability issues with regard to the handling of multicast traffic in VPLS.


A VPLS service may also impose longer delays and provide less reliable transport than would a native LAN service. The standard LAN control protocols may not have been designed for such an environment and may experience scaling problems when run in that environment.


1.4. Terminology
1.4. 术语

The list of the technical terms used when discussing L2VPNs may be found in the companion document [RFC4026].


2. Models
2. 模型
2.1. Reference Model for VPWS
2.1. VPWS的参考模型

The VPWS reference model is shown in Figure 1.


                  Attachment        PSN           Attachment
                   Circuits        tunnel          Circuits
           +-----+                 pseudo                    +-----+
           |     |                  wire                     |     |
           | CE1 |--+                                     +--| CE2 |
           |     |  |    +-----+   +-----+     +-----+    |  |     |
           +-----+  +----|---- |   |  P  |     | ----+----+  +-----+
                         | PE1 |===|=====|=====| PE2 |
                         |    /|---|-----|-----|\\    |
           +-----+  +----|---- |   |     |     | ----|----+  +-----+
           |     |  |    +-----+   +-----+     +-----+    |  |     |
           | CE3 |--+                                     +--| CE4 |
           |     |                                           |     |
           +-----+                                           +-----+
                  Attachment        PSN           Attachment
                   Circuits        tunnel          Circuits
           +-----+                 pseudo                    +-----+
           |     |                  wire                     |     |
           | CE1 |--+                                     +--| CE2 |
           |     |  |    +-----+   +-----+     +-----+    |  |     |
           +-----+  +----|---- |   |  P  |     | ----+----+  +-----+
                         | PE1 |===|=====|=====| PE2 |
                         |    /|---|-----|-----|\\    |
           +-----+  +----|---- |   |     |     | ----|----+  +-----+
           |     |  |    +-----+   +-----+     +-----+    |  |     |
           | CE3 |--+                                     +--| CE4 |
           |     |                                           |     |
           +-----+                                           +-----+

Figure 1


2.1.1. Entities in the VPWS Reference Model
2.1.1. VPWS参考模型中的实体

The P, PE (VPWS-PE), and CE devices and the PSN tunnel are defined in [RFC4026]. The attachment circuit and pseudowire are discussed in Section 3. The PE does a simple mapping between the PW and attachment circuit based on local information; i.e., the PW demultiplexor and incoming/outgoing logical/physical port.

[RFC4026]中定义了P、PE(VPWS-PE)和CE设备以及PSN隧道。第3节讨论了连接电路和伪线。PE根据本地信息在PW和连接电路之间进行简单映射;i、 例如,PW解复用器和输入/输出逻辑/物理端口。

2.2. Reference Model for VPLS
2.2. VPLS参考模型

The following diagram shows a VPLS reference model where PE devices that are VPLS-capable provide a logical interconnect such that CE devices belonging to a specific VPLS appear to be on a single bridged Ethernet. A VPLS can contain a single VLAN or multiple tagged VLANs.


The VPLS reference model is shown in Figures 2 and 3.


           +-----+                                  +-----+
           + CE1 +--+                           +---| CE2 |
           +-----+  |    ...................    |   +-----+
            VPLS A  |  +----+           +----+  |    VPLS A
                    |  |VPLS|           |VPLS|  |
                    +--| PE |--Routed---| PE |-+
                       +----+  Backbone +----+
                      /  .       |         .  \     _   /\_
           +-----+   /   .       |         .   \   / \ /   \     +-----+
           + CE  +--+    .       |         .    +--\ Access \----| CE  |
           +-----+       .    +----+       .       | Network |   +-----+
            VPLS B       .....|VPLS|........        \       /     VPLS B
                              | PE |     ^           -------
                              +----+     |
                                |        |
                                |        |
                             +-----+     |
                             | CE3 |     +-- Emulated LAN
                              VPLS A
           +-----+                                  +-----+
           + CE1 +--+                           +---| CE2 |
           +-----+  |    ...................    |   +-----+
            VPLS A  |  +----+           +----+  |    VPLS A
                    |  |VPLS|           |VPLS|  |
                    +--| PE |--Routed---| PE |-+
                       +----+  Backbone +----+
                      /  .       |         .  \     _   /\_
           +-----+   /   .       |         .   \   / \ /   \     +-----+
           + CE  +--+    .       |         .    +--\ Access \----| CE  |
           +-----+       .    +----+       .       | Network |   +-----+
            VPLS B       .....|VPLS|........        \       /     VPLS B
                              | PE |     ^           -------
                              +----+     |
                                |        |
                                |        |
                             +-----+     |
                             | CE3 |     +-- Emulated LAN
                              VPLS A

Figure 2


                         |-----Routed Backbone-----|
                         |     (P Routers)         |PSN Tunnels,
   Emulated LAN          |                         |Pseudowires
 .                       |                         |                   .
 . |---------------------|----|           |--------|-----------------| .
 . | --------------------|--- |           | -------|---------------- | .
 . |      VPLS Forwarder      |           |      VPLS Forwarder      | .
 . | ----------|------------- |           | ----------|------------- | .
   |           | Emulated LAN |           |           | Emulated LAN |
   |           | Interface    | VPLS-PEs  |           | Interface    |
   |           |              |  <---->   |           |              |
   | ----------|------------  |           | ----------|------------  |
   | |       Bridge        |  |           | |       Bridge        |  |
   | -|--------|---------|--  |           | ---|-------|---------|-  |
   |--|--------|---------|----|           |----|-------|---------|---|
      |        |         |                     |       |         |
      |        | Access  |                     |       | Access  |
      |        | Networks|                     |       | Networks|
      |        |         |                     |       |         |
      |        |         |                     |       |         |
           CE devices                                CE devices
                         |-----Routed Backbone-----|
                         |     (P Routers)         |PSN Tunnels,
   Emulated LAN          |                         |Pseudowires
 .                       |                         |                   .
 . |---------------------|----|           |--------|-----------------| .
 . | --------------------|--- |           | -------|---------------- | .
 . |      VPLS Forwarder      |           |      VPLS Forwarder      | .
 . | ----------|------------- |           | ----------|------------- | .
   |           | Emulated LAN |           |           | Emulated LAN |
   |           | Interface    | VPLS-PEs  |           | Interface    |
   |           |              |  <---->   |           |              |
   | ----------|------------  |           | ----------|------------  |
   | |       Bridge        |  |           | |       Bridge        |  |
   | -|--------|---------|--  |           | ---|-------|---------|-  |
   |--|--------|---------|----|           |----|-------|---------|---|
      |        |         |                     |       |         |
      |        | Access  |                     |       | Access  |
      |        | Networks|                     |       | Networks|
      |        |         |                     |       |         |
      |        |         |                     |       |         |
           CE devices                                CE devices

Figure 3


From Figure 3, we see that in VPLS, a CE device attaches, possibly through an access network, to a "bridge" module of a VPLS-PE. Within the VPLS-PE, the bridge module attaches, through an "Emulated LAN Interface", to an Emulated LAN. For each VPLS, there is an Emulated LAN instance. Figure 3 shows some internal structure to the Emulated LAN: it consists of "VPLS Forwarder" modules connected by pseudowires, where the pseudowires may be traveling through PSN tunnels over a routed backbone.


A "VPLS instance" consists of a set of VPLS Forwarders (no more than one per PE) connected by pseudowires.


The functionality that the bridge module must support depends on the service that is being offered by the SP to its customers, as well as on various details of the SP's network. At a minimum, the bridge module must be able to learn MAC addresses, and to "age them out", in the standard manner. However, if the PE devices have backdoor connections with each other via a Layer 2 network, they may need to be full IEEE bridges ([IEEE8021D]), running a spanning tree with each other. Specification of the precise functionality that the bridge


modules must have in particular circumstances is, however, out of scope of the current document.


This framework specifies that each "bridge module" have a single "Emulated LAN interface". It does not specify the number of bridge modules that a VPLS-PE may contain, nor does it specify the number of VPLS instances that may attach to a bridge module over a single "Emulated LAN interface".


Thus the framework is compatible with at least the following three models:


- Model 1

- 模式1

A VPLS-PE contains a single bridge module and supports a single VPLS instance. The VPLS instance is an Emulated LAN; if that Emulated LAN contains VLANs, 802.1Q [IEEE8021Q] tagging must be used to indicate which packets are in which VLANs.


- Model 2

- 模式2

A VPLS-PE contains a single bridge module, but supports multiple VPLS instances. Each VPLS instance is thought of as a VLAN (in effect, an "Emulated VLAN"), and the set of VPLS instances are treated as a set of VLANs on a common LAN. Since each VLAN uses a separate set of PWs, there is no need for 802.1Q tagging.


- Model 3

- 模式3

A VPLS-PE contains an arbitrary number of bridge modules, each of which attaches to a single VPLS instance.


There may be other models as well, some of which are combinations of the 3 models above. Different models may have different characteristics, and different scopes of applicability.


Each VPLS solution should specify the model or models that it is supporting. Each solution should also specify the necessary bridge functionality that its bridge modules must support.


This framework does not specify the way in which bridge control protocols are used on the Emulated LANs.


2.2.1. Entities in the VPLS Reference Model
2.2.1. VPLS参考模型中的实体

The PE (VPLS-PE) and CE devices are defined in [RFC4026].


2.3. Reference Model for Distributed VPLS-PE or VPWS-PE
2.3. 分布式VPLS-PE或VPWS-PE的参考模型
                   Functionality       . . . . . . .
               . . . . . . . . . . .   .           .
               .                   .   .           .
       +----+  .  +----+    +----+ .   .  Service  .
       | CE |--.--|U-PE|----|N-PE|-.---.  Provider .
       +----+  .  +----+    +----+ .   .  Backbone .
               . . . . . . . . . . .   .           .
                   Functionality       . . . . . . .
               . . . . . . . . . . .   .           .
               .                   .   .           .
       +----+  .  +----+    +----+ .   .  Service  .
       | CE |--.--|U-PE|----|N-PE|-.---.  Provider .
       +----+  .  +----+    +----+ .   .  Backbone .
               . . . . . . . . . . .   .           .
2.3.1. Entities in the Distributed PE Reference Models
2.3.1. 分布式PE参考模型中的实体

A VPLS-PE or a VPWS-PE functionality may be distributed to more than one device. The device closer to the customer/user is called the User-facing PE (U-PE), and the device closer to the core network is called Network-facing PE (N-PE).


For further discussion, see Section 3.4.3.


The terms "U-PE" and "N-PE" are defined in [RFC4026].


2.4. VPWS-PE and VPLS-PE

The VPWS-PE and VPLS-PE are functionally very similar, in that they both use forwarders to map attachment circuits to pseudowires. The only difference is that while the forwarder in a VPWS-PE does a one-to-one mapping between the attachment circuit and pseudowire, the forwarder in a VPLS-PE is a Virtual Switching Instance (VSI) that maps multiple attachment circuits to multiple pseudowires (for further discussion, see Section 3).


3. Functional Components of L2 VPN
3. l2vpn的功能组件

This section specifies a functional model for L2VPN, which allows one to break an L2VPN architecture down into its functional components. This exhibits the roles played by the various protocols and mechanisms, and thus makes it easier to understand the differences and similarities between various proposed L2VPN architectures.


Section 3.1 contains an overview of some different types of L2VPNs. In Section 3.2, functional components that are common to the different types are discussed. Then, there is a section for each of the L2VPN service types being considered. The latter sections discuss functional components, which may be specific to particular L2VPN types, and type-specific features of the generic components.


3.1. Types of L2VPN
3.1. L2VPN的类型

The types of L2VPN are distinguished by the characteristics of the service that they offer to the customers of the Service Provider (SP).


3.1.1. Virtual Private Wire Service (VPWS)
3.1.1. 虚拟专用线路服务(VPWS)

In a VPWS, each CE device is presented with a set of point-to-point virtual circuits.


The other end of each virtual circuit is another CE device. Frames transmitted by a CE on such a virtual circuit are received by the CE device at the other end-point of the virtual circuit. Forwarding from one CE device to another is not affected by the content of the frame, but is fully determined by the virtual circuit on which the frame is transmitted. The PE thus acts as a virtual circuit switch.


This type of L2VPN has long been available over ATM and Frame Relay backbones. Providing this type of L2VPN over MPLS and/or IP backbones is the current topic.


Requirements for this type of L2VPN are specified in [RFC4665].


3.1.2. Virtual Private LAN Service (VPLS)
3.1.2. 虚拟专用局域网服务(VPLS)

In a VPLS, each CE device has one or more LAN interfaces that lead to a "virtual backbone".


Two CEs are connected to the same virtual backbone if and only if they are members of the same VPLS instance (i.e., same VPN). When a CE transmits a frame, the PE that receives it examines the MAC Destination Address field in order to determine how to forward the frame. Thus, the PE functions as a bridge. As Figure 3 indicates, if a set of PEs support a common VPLS instance, then there is an Emulated LAN, corresponding to that VPLS instance, to which each of those PE bridges attaches (via an emulated interface). From the perspective of a CE device, the virtual backbone is the set of PE bridges and the Emulated LAN on which they reside. Thus to a CE device, the LAN that attaches it to the PE is extended transparently over the routed MPLS and/or IP backbone.


The PE bridge function treats the Emulated LAN as it would any other LAN to which it has an interface. Forwarding decisions are made in the manner that is normal for bridges, which is based on MAC Source Address learning.


VPLS is like VPWS in that forwarding is done without any consideration of the Layer3 header. VPLS is unlike VPWS in that:


- VPLS allows the PE to use addressing information in a frame's L2 header to determine how to forward the frame; and

- VPLS允许PE使用帧的L2报头中的寻址信息来确定如何转发帧;和

- VPLS allows a single CE/PE connection to be used for transmitting frames to multiple remote CEs; in this particular respect, VPLS resembles L3VPN more than VPWS.

- VPLS允许单个CE/PE连接用于向多个远程CE传输帧;在这一特定方面,VPLS比VPWS更类似于L3VPN。

Requirements for this type of L2VPN are specified in [RFC4665].


3.1.3. IP-Only LAN-Like Service (IPLS)
3.1.3. 仅限IP的类似LAN的服务(IPLS)

An IPLS is very like a VPLS, except that:


- it is assumed that the CE devices are hosts or routers, not switches; and

- 假设CE设备是主机或路由器,而不是交换机;和

- it is assumed that the service will only carry IP packets and supporting packets such as ICMP and ARP (in the case of IPv4) or Neighbor Discovery (in the case of IPv6); Layer 2 packets that do not contain IP are not supported.

- 假设该服务将仅承载IP数据包和支持数据包,如ICMP和ARP(在IPv4情况下)或邻居发现(在IPv6情况下);不支持不包含IP的第2层数据包。

While this service is a functional subset of the VPLS service, it is considered separately because it may be possible to provide it using different mechanisms, which may allow it to run on certain hardware platforms that cannot support the full VPLS functionality.


3.2. Generic L2VPN Transport Functional Components
3.2. 通用L2VPN传输功能组件

All L2VPN types must transport "frames" across the core network connecting the PEs. In all L2VPN types, a PE (PE1) receives a frame from a CE (CE1), and then transports the frame to a PE (PE2), which then transports the frame to a CE (CE2). In this section, we discuss the functional components that are necessary to transport L2 frames in any type of L2VPN service.


3.2.1. Attachment Circuits
3.2.1. 连接电路

In any type of L2VPN, a CE device attaches to a PE device via some sort of circuit or virtual circuit. We will call this an "Attachment Circuit" (AC). We use this term very generally; an Attachment Circuit may be a Frame Relay DLCI, an ATM VPI/VCI, an Ethernet port, a VLAN, a PPP connection on a physical interface, a PPP session from

在任何类型的L2VPN中,CE设备通过某种电路或虚拟电路连接到PE设备。我们称之为“连接电路”(AC)。我们非常普遍地使用这个术语;连接电路可以是帧中继DLCI、ATM VPI/VCI、以太网端口、VLAN、物理接口上的PPP连接、来自的PPP会话

an L2TP tunnel, an MPLS LSP, etc. The CE device may be a router, a switch, a host, or just about anything, which the customer needs hooked up to the VPN. An AC carries a frame between CE and PE, or vice versa.

L2TP隧道、MPLS LSP等。CE设备可以是路由器、交换机、主机或客户需要连接到VPN的任何设备。AC在CE和PE之间承载帧,反之亦然。

Procedures for setting up and maintaining the ACs are out of scope of this architecture.


These procedures are generally specified as part of the specification of the particular Attachment Circuit technology.


Any given frame will traverse an AC from a CE to a PE, and then on another AC from a PE to a CE.


We refer to the former AC as the frame's "ingress AC" and to the latter AC as the frame's "egress AC". Note that this notion of "ingress AC" and "egress AC" is relative to a specific frame and denotes nothing more than the frame's direction of travel while it is on that AC.


3.2.2. Pseudowires
3.2.2. 假导线

A "Pseudowire" (PW) is a relation between two PE devices. Whereas an AC is used to carry a frame from CE to PE, a PW is used to carry a frame between two PEs. We use the term "pseudowire" in the sense of [RFC3985].


Setting up and maintaining the PWs is the job of the PEs. State information for a particular PW is maintained at the two PEs that are its endpoints, but not at other PEs, and not in the backbone routers (P routers).


Pseudowires may be point-to-point, multipoint-to-point, or point-to-multipoint. In this framework, point-to-point PWs are always considered bidirectional; multipoint-to-point and point-to-multipoint PWs are always considered unidirectional. Multipoint-to-point PWs can be used only when the PE receiving a frame does not need to infer, from the PW on which the frame was received, the identity of the frame's ingress AC. Point-to-multipoint PWs may be useful when frames need to be multicast.


Procedures for setting up and maintaining point-to-multipoint PWs are not considered in this version of this framework.


Any given frame travels first on its ingress AC, then on a PW, and then on its egress AC.


Multicast frames may be replicated by a PE, so of course the information carried in multicast frames may travel on more than one PW and more than one egress AC.


Thus with respect to a given frame, a PW may be said to associate a number of ACs. If these ACs are of the same technology (e.g., both ATM, both Ethernet, both Frame Relay), the PW is said to provide "homogeneous transport"; otherwise it is said to provide "heterogeneous transport". Heterogeneous transport requires that some sort of interworking function be applied. There are at least three different approaches to interworking:


1. One of the CEs may perform the interworking locally. For example, if CE1 attaches to PE1 via ATM, but CE2 attaches to PE2 via Ethernet, then CE1 may decide to send/receive Ethernet frames over ATM, using the RFC 2684, "LLC Encapsulation for Bridged Protocols". In such a case, PE1 would need to know that it is to terminate the ATM VC locally, and only to send/receive Ethernet frames over the PW.

1. 其中一个ce可以在本地执行互通。例如,如果CE1通过ATM连接到PE1,但是CE2通过以太网连接到PE2,那么CE1可以决定使用RFC 2684“桥接协议的LLC封装”通过ATM发送/接收以太网帧。在这种情况下,PE1需要知道它将在本地终止ATM VC,并且只在PW上发送/接收以太网帧。

2. One of the PEs may perform the interworking. For example, if CE1 attaches to PE1 via ATM, but CE2 attaches to PE2 via Frame Relay, PE1 may provide the "ATM/FR Service Interworking" function. This would be transparent to the CEs, and the PW would carry only Frame Relay frames.

2. 其中一个PE可以执行互通。例如,如果CE1通过ATM连接到PE1,但CE2通过帧中继连接到PE2,则PE1可以提供“ATM/FR服务互通”功能。这对CEs是透明的,PW将只携带帧中继帧。

3. IPLS could be used. In this case, the "frames" carried by the PW are IP datagrams, and the two PEs need to cooperate in order to spoof various L2-specific procedures used by IP (see Section 3.5).

3. 可以使用IPL。在这种情况下,PW携带的“帧”是IP数据报,两个PE需要合作以欺骗IP使用的各种L2特定程序(参见第3.5节)。

If heterogeneous PWs are used, the setup protocol must ensure that each endpoint knows the MTU of the remote AC. If the two ACs do not have the same MTU, one of the following three procedures must be carried out:


- The PW is not allowed to come up.

- 不允许出现PW。

- The endpoint at the AC with the larger MTU must reduce the AC's MTU so that it is the same as the MTU of the remote AC.

- 具有较大MTU的AC处的端点必须减少AC的MTU,使其与远程AC的MTU相同。

- The two endpoints must agree to use a specified fragmentation/reassembly procedure.

- 两个端点必须同意使用指定的碎片/重新组装程序。

3.2.3. Forwarders
3.2.3. 货代

In all types of L2VPN, a PE (say, PE1) receives a frame over an AC and forwards it over a PW to another PE (say, PE2). PE2 then forwards the frame out on another AC.


The case in which PE1 and PE2 are the same device is an important case to handle correctly, in order to provide the L2VPN service properly. However, as this case does not require any protocol, we do not address it further in this document.


When PE1 receives a frame on a particular AC, it must determine the PW on which the frame must be forwarded. In general, this is done by considering:


- the incoming AC;

- 输入交流电;

- possibly the contents of the frame's Layer2 header; and

- 可能是帧的Layer2头的内容;和

- possibly some forwarding information that may be statically or dynamically maintained.

- 可能是一些静态或动态维护的转发信息。

If dynamic or static forwarding information is considered, the information is specific to a particular L2VPN instance (i.e., to a particular VPN).


Similarly, when PE2 receives a frame on a particular PW, it must determine the AC on which the frame must be forwarded. This is done by considering:


- the incoming PW;

- 输入PW;

- possibly the contents of the frame's Layer2 header; and

- 可能是帧的Layer2头的内容;和

- possibly some forwarding information that may be statically or dynamically maintained.

- 可能是一些静态或动态维护的转发信息。

If dynamic or static forwarding information is considered, the information is specific to a particular L2VPN instance (i.e., to a particular VPN).


The procedures used to make the forwarding decision are known as a "forwarder". We may think of a PW as being "bound", at each of its endpoints, to a forwarder. The forwarder in turn "binds" the PWs to ACs. Different types of L2VPN have different types of forwarders.


For instance, a forwarder may bind a single AC to a single PW, ignoring all frame contents and using no other forwarding information. Or a forwarder may bind an AC to a set of PWs and ACs, moving individual frames from AC to PW, from a PW to an AC or from AC to AC by comparing information from the frame's Layer2 header to information in a forwarding database. This is discussed in more detail below, as we consider the different L2VPN types.


3.2.4. Tunnels
3.2.4. 隧道

A PW is carried in a "tunnel" from PE1 to PE2. We assume that an arbitrary number of PWs may be carried in a single tunnel; the only requirement is that the PWs all terminate at PE2.


We do not even require that all the PWs in the tunnel originate at PE1; the tunnels may be multipoint-to-point tunnels. Nor do we require that all PWs between the same pair of PEs travel in the same tunnel. All we require is that when a frame traveling through such a tunnel arrives at PE2, PE2 will be able to associate it with a particular PW.


(While one can imagine tunneling techniques that only allow one PW per tunnel, they have evident scalability problems, and we do not consider them further.)


A variety of different tunneling technologies may be used for the PE-PE tunnels. All that is really required is that the tunneling technologies allow the proper demultiplexing of the contained PWs. The tunnels might be MPLS LSPs, L2TP tunnels, IPsec tunnels, MPLS-in-IP tunnels, etc. Generally the tunneling technology will require the use of an encapsulation that contains a demultiplexor field, where the demultiplexor field is used to identify a particular PW. Procedures for setting up and maintaining the tunnels are not within the scope of this framework. (But see Section 3.2.6, "Pseudowire Signaling".)

PE-PE隧道可采用多种不同的隧道技术。真正需要的是,隧道技术允许对包含的PW进行适当的解复用。隧道可能是MPLS LSP、L2TP隧道、IPsec隧道、IP隧道中的MPLS等。通常,隧道技术需要使用包含解复用器字段的封装,其中解复用器字段用于识别特定PW。设置和维护隧道的程序不在本框架的范围内。(但请参见第3.2.6节“伪线信号”。)

If there are multiple tunnels from PE1 to PE2, it may be desirable to assign a particular PE1-PE2 PW to a particular tunnel based on some particular characteristics of the PW and/or the tunnel. For example, perhaps different tunnels are associated with different QoS characteristics, and different PWs require different QoS. Procedures for specifying how to assign PWs to tunnels are out of scope of the current framework.

如果有多个从PE1到PE2的隧道,则可能需要基于PW和/或隧道的某些特定特征将特定PE1-PE2 PW分配给特定隧道。例如,可能不同的隧道与不同的QoS特征相关联,并且不同的pw需要不同的QoS。指定如何将PWs分配给隧道的程序超出了当前框架的范围。

Though point-to-point PWs are bidirectional, the tunnels in which they travel need not be either bidirectional or point-to-point. For example, a point-to-point PW may travel within a unidirectional multipoint-to-point MPLS LSP.

尽管点到点PWs是双向的,但它们运行的隧道不需要双向或点到点。例如,点到点PW可以在单向多点到点MPLS LSP内移动。

3.2.5. Encapsulation
3.2.5. 封装

As L2VPN packets are carried in pseudowires, standard pseudowire encapsulation formats and techniques (as specified by the IETF's PWE3 WG) should be used wherever applicable.

由于L2VPN数据包以伪线传输,因此应在适用的情况下使用标准伪线封装格式和技术(如IETF的PWE3 WG所规定)。

Generally the PW encapsulations will themselves be encapsulated within a tunnel encapsulation, as determined by the specification of the tunneling protocol.


It may be necessary to define additional PW encapsulations to cover areas that are of importance for L2VPN, but that may not be within the scope of PWE3. Heterogeneous transport may be an instance of this.


3.2.6. Pseudowire Signaling
3.2.6. 伪线信号

Procedures for setting up and maintaining the PWs themselves are within the scope of this framework. This includes procedures for distributing demultiplexor field values, even though the demultiplexor field, strictly speaking, belongs to the tunneling protocol and not to the PW.


The signaling for a point-to-point pseudowire must perform the following functions:


- Distribution of the demultiplexor.

- 解复用器的分布。

Since many PWs may be carried in a single tunnel, the tunneling protocol must assign a demultiplexor value to each PW. These demultiplexors must be unique with respect to a given tunnel (or, with some tunneling technologies, unique at the egress PE). Generally, the PE that is the egress of the tunnel will select the demultiplexor values and will distribute them to the PE(s) which is (are) the ingress(es) of the tunnel. This is the essential part of the PW setup procedure.


Note that, as is usually the case in tunneling architectures, the demultiplexor field belongs to the tunneling protocol, not to the protocol being tunneled. For this reason, the PW setup protocols may be extensions of the control protocols for setting up the tunnels.


- Selection of the Forwarder at the remote PE.

- 选择远程PE的转发器。

The signaling protocol must contain enough information to enable the remote PE to select the proper forwarder to which the PW is to be bound. We can call this information the "Remote Forwarder


Selector". The information that is required will depend on the type of L2VPN being provided and on the provisioning model being used (see Sections 3.3.1 and 3.4.2). The Remote Forwarder Selector may uniquely identify a particular Forwarder, or it may identify an attribute of Forwarders. In the latter case, it would select whichever Forwarder has been provisioned with that attribute.


- Supporting pseudowire emulations.

- 支持伪线仿真。

To the extent that a particular PW must emulate the signaling of a particular Layer2 technology, the PW signaling must provide the necessary functions.


- Distribution of state changes.

- 状态变化的分布。

Changes in the state of an AC may need to be reflected in changes to the state of the PW to which the AC is bound, and vice versa. The specification as to which changes need to be reflected in what way would generally be within the province of the PWE3 WG.


- Establishing pseudowire characteristics.

- 建立伪线特征。

To the extent that one or more characteristics of a PW must be known to and/or agreed upon by both endpoints, the signaling must allow for the necessary interaction.


As specified above, signaling for point-to-point PWs must pass enough information to allow a remote PE to properly bind a PW to a Forwarder, and to associate a particular demultiplexor value with that PW. Once the two PEs have done the proper PW/Forwarder bindings, and have agreed on the demultiplexor values, the PW may be considered set up. If it is necessary to negotiate further characteristics or parameters of a particular PW, or to pass status information for a particular PW, the PW may be identified by the demultiplexor value.


Signaling procedures for point-to-point pseudowires are most commonly point-to-point procedures that are executed by the two PW endpoints. There are, however, proposals to use point-to-multipoint signaling for setting up point-to-point pseudowires, so this is included in the framework. When PWs are themselves point-to-multipoint, it is also possible to use either point-to-point signaling or point-to-multipoint signaling to set them up. This is discussed in the remainder of this section.

点到点伪线的信令过程通常是由两个PW端点执行的点到点过程。然而,有人建议使用点对多点信令来建立点对点伪线,因此这包括在框架中。当PW本身是点对多点时,也可以使用点对点信令或点对多点信令来设置它们。这将在本节的其余部分讨论。 Point-to-Point Signaling 点对点信令

There are several ways to do the necessary point-to-point signaling. Among them are:



- 自民党

LDP [RFC3036] extensions can be defined for pseudowire signaling. This form of signaling can be used for pseudowires that are to be carried in MPLS "tunnels", or in MPLS-in-something-else tunnels.


- L2TP

- L2TP

L2TP [RFC2661] can be used for pseudowire signaling, resulting in pseudowires that are carried as "sessions" within L2TP tunnels. Pseudowire-specific extensions to L2TP may also be needed.


Other methods may be possible as well.


It is possible to have one control connection between a pair of PEs, which is used to control many PWs.


The use of point-to-point signaling for setting up point-to-point PWs is straightforward. Multipoint-to-point PWs can also be set up by point-to-point signaling, as the remote PEs do not necessarily need to know whether the PWs are multipoint-to-point or point-to-point. In some signaling procedures, the same demultiplexor value may be assigned to all the remote PEs.

使用点对点信令来建立点对点PWs非常简单。也可以通过点对点信令设置多点对点PWs,因为远程PEs不一定需要知道PWs是多点对点还是点对点。在一些信令过程中,可以将相同的解复用器值分配给所有远程PE。 Point-to-Multipoint Signaling 点对多点信令

Consider the following conditions:


- It is necessary to set up a set of PWs, all of which have the same characteristics.

- 有必要建立一套PWs,所有PWs都具有相同的特性。

- It is not necessary to use the PW signaling protocol to pass PW state changes.

- 无需使用PW信令协议来传递PW状态更改。

- For each PW in the set, the same value of the Remote Forwarder Selector can be used.

- 对于集合中的每个PW,可以使用相同的远程转发器选择器值。

Call these the "Environmental Conditions".


Suppose also that there is some mechanism by which, given a range of demultiplexor values, each of a set of PEs can make a unique and


deterministic selection of a single value from within that range. Call this the "Demultiplexor Condition". Alternatively, suppose that one is trying to set up a multipoint-to-point PW rather than to set up a point-to-point PW. Call this the "Multipoint Condition".




- The Environmental Conditions hold; and

- 环境条件保持不变;和

- Either

- 任何一个

* the Demultiplexor Condition holds, or

* 解复用器条件保持不变,或

* the Multipoint Condition holds,

* 多点条件成立,

then for a given set of PWs that terminate at egress PE1, the information that PE1 needs to send to the ingress PE(s) of each pseudowire in the set is exactly the same. All the ingress PE(s) receive the same Forwarder Selector value. They all receive the same set of PW parameters (if any). And either they all receive the same demultiplexor value (if the PW is multipoint-to-point) or they all receive a range of demultiplexor values from which each can choose a unique demultiplexor value for itself.


Rather than connect to each ingress PE and replicate the same information, it may make sense either to multicast the information, or to send the information once to a "reflector", which will then take responsibility for distributing the information to the other PEs.


We refer to this sort of technique as "point-to-multipoint" signaling. It would, for example, be possible to use BGP [RFC1771] to do the signaling, with PEs that are BGP peers not of each other, but of one or more BGP route reflectors [RFC2796].

我们将这种技术称为“点对多点”信令。例如,可以使用BGP[RFC1771]进行信令,其中PE不是彼此的BGP对等方,而是一个或多个BGP路由反射器[RFC2796]的对等方。 Inter-AS Considerations 作为考虑因素的国际货币基金组织

Pseudowires may need to run from a PE in one Service Provider's network to a PE in another Service Provider's network. This has the following implications:


- The signaling protocol that sets up the PWs must be able to cross network boundaries. Of course, all IP-based protocols have this capability.

- 设置PWs的信令协议必须能够跨越网络边界。当然,所有基于IP的协议都具有这种能力。

- The two PEs at the PW endpoints must be addressable and routable from each other.

- PW端点处的两个PE必须可寻址,并且彼此可路由。

- The signaling protocol needs to allow each PW endpoint to authenticate the other. To make use of the authentication capability, there would also need to be some method of key distribution that is acceptable to both administrations.

- 信令协议需要允许每个PW端点对另一个进行身份验证。为了利用身份验证功能,还需要某种双方都能接受的密钥分发方法。

3.2.7. Service Quality
3.2.7. 服务质量

Service Quality refers to the ability for the network to deliver a Service level Specification (SLS) for service attributes such as protection, security, and Quality of Service (QoS). The service quality provided depends on the subscriber's requirements and can be characterized by a number of performance metrics.


The necessary Service Quality must be provided on the ACs, as well as on the PWs. Mechanisms for providing Service Quality on the PWs may be PW-specific or tunnel-specific; in the latter case, the assignment of a PW to a tunnel may depend on the Service Quality.

必须在ACs和PWs上提供必要的服务质量。在PWs上提供服务质量的机制可能是特定于PW或特定于隧道的;在后一种情况下,将PW分配给隧道可能取决于服务质量。 Quality of Service (QoS) 服务质量(QoS)

QoS describes the queuing behavior applied to a particular "flow", in order to achieve particular goals of precedence, throughput, delay, jitter, etc.


Based on the customer Service Level Agreement (SLA), traffic from a customer can be prioritized, policed, and shaped for QoS requirements. The queuing and forwarding policies can preserve the packet order and QoS parameters of customer traffic. The class of services can be mapped from information in the customer frames, or it can be independent of the frame content.


QoS functions can be listed as follows:


- Customer Traffic Prioritization: L2VPN services could be best effort or QoS guaranteed. Traffic from one customer might need to be prioritized over others when sharing same network resources. This requires capabilities within the L2VPN solution to classify and mark priority to QoS guaranteed customer traffic.

- 客户流量优先级:L2VPN服务可以尽最大努力或保证QoS。共享相同的网络资源时,可能需要优先考虑来自一个客户的流量。这需要L2VPN解决方案中的功能来分类和标记QoS保证的客户流量的优先级。

- Proper queuing behavior would be needed at the egress AC, and possibly within the backbone network as well. If queuing behavior must be controlled within the backbone network, the control might be based on CoS information in the MPLS or IP header, or it might be achieved by nesting particular tunnels within particular traffic engineering tunnels.

- 在出口AC处需要适当的排队行为,也可能在主干网内。如果必须在主干网内控制排队行为,则控制可能基于MPLS或IP报头中的CoS信息,或者可以通过在特定流量工程隧道中嵌套特定隧道来实现。

- Policing: This ensures that a user of L2VPN services uses network resources within the limits of the agreed SLA. Any excess L2VPN traffic can be rejected or handled differently based on provider policy.

- 策略:这确保L2VPN服务的用户在商定的SLA限制内使用网络资源。根据提供商策略,可以拒绝或以不同方式处理任何多余的L2VPN流量。

- Policing would generally be applied at the ingress AC.

- 通常在入口AC处实施监管。

- Shaping: Under some cases, the random nature of L2VPN traffic might lead to sub-optimal utilization of network resources. Through queuing and forwarding mechanisms, the traffic can be shaped without altering the packet order.

- 成形:在某些情况下,L2VPN流量的随机性可能导致网络资源的次优利用。通过排队和转发机制,可以在不改变数据包顺序的情况下调整流量。

- Shaping would generally be applied at the ingress AC.

- 成型通常应用于入口AC。 Resiliency 弹性

Resiliency describes the ability of the L2VPN infrastructure to protect a flow from network outage, so that service remains available in the presence of failures.


L2VPN, like any other service, is subject to failures such as link, trunk, and node failures, both in the SP's core network infrastructure and on the ACs.


It is desirable that the failure be detected "immediately" and that protection mechanisms allow fast restoration times to make L2VPN service almost transparent to these failures to the extent possible, based on the level of resiliency. Restoration should take place before the CEs can react to the failure. Essential aspects of providing resiliency are:


- Link/Node failure detection: Mechanisms within the L2VPN service should allow for link or node failures that impact the service, and that should be detected immediately.

- 链路/节点故障检测:L2VPN服务中的机制应允许影响服务的链路或节点故障,并且应立即检测。

- Resiliency policy: The way in which a detected failure is handled will depend on the restoration policy of the SLA associated with the L2VPN service specification. It may need to be handled immediately, or it may need to be handled only if no other critical failure needs protection resources, or it may be completely ignored if it is within the bounds of the "acceptable downtime" allowed by the L2VPN service.

- 弹性策略:处理检测到的故障的方式将取决于与L2VPN服务规范相关联的SLA的恢复策略。它可能需要立即处理,或者只有在没有其他关键故障需要保护资源时才需要处理,或者如果在L2VPN服务允许的“可接受停机时间”范围内,则可能完全忽略它。

- Restoration Mechanisms: The L2VPN solutions could allow for physical level protection, logical level protection, or both. For example, by connecting customers over redundant and

- 恢复机制:L2VPN解决方案可以支持物理级保护、逻辑级保护或两者兼有。例如,通过冗余和冗余连接客户

physically separate ACs to different provider customer-facing devices, one AC can be maintained as active, and the other could be marked as a backup; upon the failure detection across the primary AC, the backup could become active.


To a great extent, resiliency is a matter of having appropriate failure and recovery mechanisms in the network core, including "ordinary" adaptive routing as well as "fast reroute" capabilities. The ability to support redundant ACs between CEs and PEs also plays a role.


3.2.8. Management
3.2.8. 经营

An L2VPN solution can provide mechanisms to manage and monitor different L2VPN components. From a Service Level Agreement (SLA) perspective, L2VPN solutions could allow monitoring of L2VPN service characteristics and offer mechanisms used by Service Providers to report such monitored statistical data. Trouble-shooting and verification of operational and maintenance activities of L2VPN services are essential requirements for Service Providers.


3.3. VPWS
3.3. VPWS

A VPWS is an L2VPN service in which each forwarder binds exactly one AC to exactly one PW. Frames received on the AC are transmitted on the PW; frames received on the PW are transmitted on the AC. The content of a frame's Layer2 header plays no role in the forwarding decision, except insofar as the Layer2 header contents are used to associate the frame with a particular AC (e.g., the DLCI field of a Frame Relay frame identifies the AC).


A particular combination of <AC, PW, AC> forms a "virtual circuit" between two CE devices.


A particular VPN (VPWS instance) may be thought of as a collection of such virtual circuits, or as an "overlay" of PWs on the MPLS or IP backbone. This creates an overlay topology that is in effect the "virtual backbone" of a particular VPN.


Whether two virtual circuits are said to belong to the same VPN or not is an administrative matter based on the agreements between the SPs and their customers. This may impact the provisioning model (discussed below). It may also affect how particular PWs are assigned to tunnels, the way QoS is assigned to particular ACs and PWs, etc.


Note that VPWS makes use of point-to-point PWs exclusively.


3.3.1. Provisioning and Auto-Discovery
3.3.1. 资源调配和自动发现

Provisioning a VPWS is a matter of:


1. Provisioning the ACs;

1. 提供ACs;

2. Providing the PEs with the necessary information to enable them to set up PWs between ACs to result in the desired overlay topology; and

2. 向PEs提供必要的信息,使其能够在ACs之间建立PWs,从而形成所需的覆盖拓扑;和

3. Configuring the PWs with any necessary characteristics.

3. 配置具有任何必要特性的PWs。 Attachment Circuit Provisioning 连接电路供应

In many cases, the ACs must be individually provisioned on the PE and/or CE. This will certainly be the case if the CE/PE attachment technology is a switched network, such as ATM or FR, and the VCs are PVCs rather than SVCs. It is also the case whenever the individual Attachment Circuits need to be given specific parameters (e.g., QoS parameters, guaranteed bandwidth parameters) that differ from circuit to circuit.


There are also cases in which ACs might not have to be individually provisioned. For example, if an AC is just an MPLS LSP running between a CE and a PE, it could be set up as the RESULT of setting up a PW rather than having to be provisioned BEFORE the PW can be set up. The same may apply whenever the AC is a Switched Virtual Circuit of any sort, though in this case, various policy controls might need to be provisioned; e.g., limiting the number of ACs that can be set up between a given CE and a given PE.

在某些情况下,可能不需要单独设置ACs。例如,如果AC只是在CE和PE之间运行的MPLS LSP,则可以将其设置为设置PW的结果,而不必在设置PW之前进行设置。每当AC是任何种类的交换虚拟电路时,相同的情况都可以应用,尽管在这种情况下,可能需要提供各种策略控制;e、 例如,限制可在给定CE和给定PE之间设置的AC数量。

Issues such as whether the Attachment Circuits need to be individually provisioned or not, whether they are Switched VCs or Permanent VCs, and what sorts of policy controls may be applied are implementation and deployment issues and are considered to be out of scope of this framework.

诸如附件电路是否需要单独设置、它们是交换vc还是永久vc、以及可以应用何种策略控制等问题属于实施和部署问题,被认为不在本框架的范围内。 PW Provisioning for Arbitrary Overlay Topologies 任意覆盖拓扑的PW配置

In order to support arbitrary overlay topologies, it is necessary to allow the provisioning of individual PWs. In this model, when a PW is provisioned on a PE device, it is locally bound to a specific AC. It is also provisioned with information that identifies a specific AC at a remote PE.


There are basically two variations of this provisioning model:


- Two-sided provisioning

- 双边供应

With two-sided provisioning, each PE that is at the end of a PW is provisioned with the following information:


* Identifier of the Local AC to which the PW is to be bound

* PW要绑定到的本地AC的标识符

* PW type and parameters

* PW类型和参数

* IP address of the remote PE (i.e., the PE that is to be at the remote end of the PW)

* 远程PE的IP地址(即位于PW远程端的PE)

* Identifier that is meaningful to the remote PE, and that can be passed in the PW signaling protocol to enable the remote PE to bind the PW to the proper AC. This can be an identifier of the PW or an identifier of the remote AC. If a PW identifier is used, it must be unique at each of the two PEs. If an AC identifier is used, it need only be unique at the remote PE.

* 对远程PE有意义的标识符,可在PW信令协议中传递,以使远程PE能够将PW绑定到适当的AC。这可以是PW的标识符或远程AC的标识符。如果使用PW标识符,则在两个PE中的每一个都必须是唯一的。如果使用AC标识符,则它只需在远程PE上是唯一的。

This identifier is then used as the Remote Forwarder Selector when signaling is done (see


- Single-sided provisioning

- 单边资源调配

With single-sided provisioning, a PE at one end of a PW is provisioned with the following information:


* Identifier of the Local AC to which the PW is to be bound

* PW要绑定到的本地AC的标识符

* PW type and parameters

* PW类型和参数

* Globally unique identifier of remote AC

* 远程AC的全局唯一标识符

This identifier is then used as the Forwarder Selector when signaling is done (see section


In this provisioning model, the IP address of the remote PE is not provisioned. Rather, the assumption is that an auto-discovery scheme will be used to map the globally unique identifier to the IP address of the remote PE, along with an identifier (perhaps unique only at the latter PE) for an AC at that PE. The PW signaling protocol can then make a connection to the remote PE, passing the AC identifier, so that the remote PE binds the PW to the proper AC.


This scheme requires provisioning of the PW at only one PE, but it does not eliminate the need (if there is a need) to provision the ACs at both PEs.


These provisioning models fit well with the use of point-to-point signaling. When each PW is individually provisioned, as the conditions necessary for the use of point-to-multipoint signaling do not hold.

这些供应模型非常适合使用点到点信令。当每个PW单独设置时,因为使用点对多点信令所需的条件不成立。 Colored Pools PW Provisioning Model 彩色池PW配置模型

Suppose that at each PE, sets of ACs are gathered together into "pools", and that each such pool is assigned a "color". (For example, a pool might contain all and only the ACs from this PE to a particular CE.) Now suppose that we impose the following rule: whenever PE1 and PE2 have a pool of the same color, there will be a PW between PE1 and PE2 that is bound at PE1 to an arbitrarily chosen AC from that pool, and at PE2 to an arbitrarily chosen AC from that pool. (We do not rule out the case where a single PE has multiple pools of a given color.)


For example, each pool in a particular PE might represent a particular CE device, for which the ACs in the pool are the ACs connecting that CE to that PE. The color might be a VPN-id. Application of this provisioning model would then lead to a full CE-to-CE mesh within the VPN, where every CE in the VPN has a virtual circuit to every other CE within the VPN.


More specifically, to provision VPWS according to this model, one provisions a set of pools and configures each pool with the following information:


- The set of ACs that belong to the pool (with no AC belonging to more than one pool)

- 属于池的一组AC(没有属于多个池的AC)

- The color

- 颜色

- A pool identifier that is unique at least relative to the color.

- 至少相对于颜色是唯一的池标识符。

An auto-discovery procedure is then used to map each color into a list of ordered pairs <IP address of PE, pool id>. The occurrence of a pair <X, Y> on this list means that the PE at IP address X has a pool with pool id Y, which is of the specified color.


This information can be used to support several different signaling techniques. One possible technique proceeds as follows:


- A PE finds that it has a pool of color C.

- PE发现它有一个C色池。

- Using auto-discovery, it obtains the set of ordered pairs <X,Y> for color C.

- 使用自动发现,它获得颜色C的有序对集<X,Y>。

- For each such pair <X,Y>, it:

- 对于每一对<X,Y>,它:

* removes an AC from the pool;

* 从池中移除AC;

* binds the AC to a particular PW; and

* 将AC绑定到特定PW;和

* signals PE X via point-to-point signaling that the PW is to be bound to an AC from pool Y.

* 通过点对点信令向PE X发送信号,表示PW将绑定到来自池Y的AC。

Another possible signaling technique is the following:


- A PE finds that it has a pool of color C, containing n ACs.

- PE发现它有一个C色池,其中包含n个AC。

- It binds each AC to a PW, creating a set of PWs. This set of PWs is then organized into a sequence. (For instance, each PW may be associated with a demultiplexor field value, and the PWs may then be sequenced according to the numerical value of their respective demultiplexors.)

- 它将每个AC绑定到一个PW,从而创建一组PW。然后将这组PW组织成一个序列。(例如,每个PW可与解复用器字段值相关联,然后可根据其各自解复用器的数值对PW进行排序。)

- Using auto-discovery, it obtains the list of PE routers that have one or more pools of color C.

- 使用自动发现,它获取具有一个或多个C色池的PE路由器列表。

- It signals each such PE router, specifying the sequence Q of PWs.

- 它向每个这样的PE路由器发送信号,指定PWs的序列Q。

- If PE X receives such a signal and PE X has a pool Y of the specified color, it:

- 如果PE X接收到这样的信号,并且PE X具有指定颜色的池Y,则它:

* removes an AC from the pool; and

* 从池中移除AC;和

* binds the AC to the PW that is the "Yth" PW in the sequence Q.

* 将AC绑定到序列Q中的“Yth”PW。

This presumes, of course, that the pool identifiers are or can be uniquely mapped into small ordinal numbers; assigning the pool identifiers in this way becomes a requirement of the provisioning system.


Note that since this technique signals the same information to all the remote PEs, it can be supported via point-to-multipoint signaling.


This provisioning model can be applied as long as the following conditions hold:


- There is no need to provision different characteristics for the different PWs;

- 不需要为不同的PWs提供不同的特性;

- It makes no difference which pairs of ACs are bound together by PWs, as long as both ACs in the pair come from like-colored pools; and

- 只要一对ACs中的两个ACs都来自相同颜色的池,PWs将哪对ACs绑定在一起就没有区别;和

- It is possible to construct the desired overlay topology simply by assigning colors to the pools. (This is certainly simple if a full mesh is desired, or if a hub and spoke configuration is desired; creating arbitrary topologies is less simple, and is perhaps not always possible.)

- 只需为池指定颜色,就可以构建所需的覆盖拓扑。(如果需要一个完整的网格,或者需要一个中心辐射配置,这当然很简单;创建任意拓扑就不那么简单,而且可能并不总是可能的。)

3.3.2. Requirements on Auto-Discovery Procedures
3.3.2. 自动发现程序的要求

Some of the requirements for auto-discovery procedures can be deduced from the above.


To support the single-sided provisioning model, auto-discovery must be able to map a globally unique identifier (of a PW or of an Attachment Circuit) to an IP address of a PE.


To support the colored pools provisioning model, auto-discovery must enable a PE to determine the set of other PEs that contain pools of the same color.


These requirements enable the auto-discovery scheme to provide the information, which the PEs need to set up the PWs.


There are additional requirements on the auto-discovery procedures that cannot simply be deduced from the provisioning model:


- Particular signaling schemes may require additional information before they can proceed and hence may impose additional requirements on the auto-discovery procedures.

- 特定信令方案可能需要额外的信息才能继续,因此可能会对自动发现过程施加额外的要求。

- A given Service Provider may support several different types of signaling procedures, and thus the PEs may need to learn, via auto-discovery, which signaling procedures to use.

- 给定的服务提供商可能支持几种不同类型的信令过程,因此PEs可能需要通过自动发现来了解要使用哪些信令过程。

- Changes in the configuration of a PE should be reflected by the auto-discovery procedures, within a timely manner, and without the need to explicitly reconfigure any other PE.

- PE配置的更改应通过自动发现程序及时反映出来,无需明确重新配置任何其他PE。

- The auto-configuration procedures must work across service provider boundaries. This rules out, e.g., use of schemes that piggyback the auto-discovery information on the backbone's IGP.

- 自动配置过程必须跨服务提供商边界工作。例如,这排除了使用在主干网的IGP上搭载自动发现信息的方案。

3.3.3. Heterogeneous Pseudowires
3.3.3. 异质假丝

Under certain circumstances, it may be desirable to have a PW that binds two ACs that use different technologies (e.g., one is ATM, one is Ethernet). There are a number of different ways, depending on the AC types, in which this can be done. For example:


- If one AC is ATM and one is FR, then standard ATM/FR Network Interworking can be used. In this case, the PW might be signaled for ATM, where the Interworking function occurs between the PW and the FR AC.

- 如果一个AC是ATM,另一个是FR,则可以使用标准ATM/FR网络互通。在这种情况下,PW可能被发信号用于ATM,其中PW和FR AC之间发生互通功能。

- A common encapsulation can be used on both ACs, if for example, one AC is Ethernet and one is FR, an "Ethernet over FR" encapsulation can be used on the latter. In this case, the PW could be signaled for Ethernet, with processing of the Ethernet over FR encapsulation local to the PE with the FR AC.

- 两个AC上都可以使用公共封装,例如,如果一个AC是以太网,一个是FR,则可以在后者上使用“Ethernet over FR”封装。在这种情况下,PW可以用信号通知以太网,通过FR AC对PE本地的FR封装处理以太网。

- If it is known that the two ACs attach to IP routers or hosts and carry only IP traffic, then one could use a PW that carries the IP packets, and the respective Layer2 encapsulations would be local matters for the two PEs. However, if one of the ACs is a LAN and one is a point-to-point link, care would have to be taken to ensure that procedures such as ARP and Inverse ARP are properly handled; this might require some signaling, and some proxy functions. Further, if the CEs use a routing algorithm that has different procedures for LAN interfaces than those for point-to-point interfaces, additional mechanisms may be required to ensure proper interworking.

- 如果已知两个ACs连接到IP路由器或主机并仅承载IP流量,则可以使用承载IP数据包的PW,并且两个PE的相应第2层封装将是本地事务。但是,如果其中一个ACs是LAN,另一个是点对点链路,则必须小心确保ARP和反向ARP等程序得到正确处理;这可能需要一些信令和一些代理功能。此外,如果CEs使用的路由算法对于LAN接口的过程与对于点到点接口的过程不同,则可能需要额外的机制来确保适当的互通。

3.4. VPLS Emulated LANs
3.4. VPLS模拟局域网

A VPLS is an L2VPN service in which:


- the ACs attach CE devices to PE bridge modules; and

- ACs将CE设备连接至PE桥接模块;和

- each PE bridge module is attached via an "emulated LAN interface" to an "emulated LAN".

- 每个PE网桥模块通过“模拟LAN接口”连接到“模拟LAN”。

This is shown in Figure 3.


In this section, we examine the functional decomposition of the VPLS Emulated LAN. An Emulated LAN's ACs are the "emulated LAN interfaces" attaching PE bridge modules to the "VPLS Forwarder" modules (see Figure 3). The payload on the ACs consists of ethernet frames, with or without VLAN headers.


A given VPLS Forwarder in a given PE will have multiple ACs only if there are multiple bridge modules in that PE that attach to that Forwarder. This scenario is included in the Framework, though discussion of its utility is out of scope.


The set of VPLS Forwarders within a single VPLS are connected via PWs. Two VPLS Forwarders will have a PW between them only if those two Forwarders are part of the same VPLS. (There may be a further restriction that two VPLS Forwarders have a PW between them only if those two Forwarders belong to the same VLAN in the same VPN.) A particular set of interconnected VPLS Forwarders is what constitutes a VPLS Emulated LAN.


On a real LAN, any frame transmitted by one entity is received by all the others. A VPLS Emulated LAN, however, behaves somewhat differently. When a VPLS Forwarder receives a unicast frame over one of its Emulated LAN interfaces, the Forwarder does not necessarily send the frame to all the other Forwarders on that Emulated LAN. A unicast frame needs to be sent to only one other Forwarder in order to be properly delivered to its destination MAC address. If the transmitting Forwarder knows which other Forwarder needs to receive a particular unicast frame, it will send the frame to just that one Forwarder. This forwarding optimization is an important part of any attempt to provide a VPLS service over a wide-area or metropolitan area network.


In effect, then, each Forwarder behaves as a "Virtual Switch Instance" (VSI), maintaining a forwarding table that maps MAC addresses to PWs. The VSI is populated in much the same way that a standard bridge populates its forwarding table. The VPLS Forwarders do MAC Source Address (SA) learning on frames received on PWs from


other Forwarders and must also do the related set of procedures, such as aging out address entries. Frames with unknown DAs or multicast DAs must be "broadcast" by one Forwarder to all the others (on the same emulated LAN). There are, however, a few important differences between the VPLS Forwarder VSI and the standard bridge forwarding function:


- A VPLS Forwarder never learns the MAC SAs of frames that it receives on its ACs; it only learns the MAC SAs of frames that are received on PWs from other VPLS Forwarders; and

- VPLS转发器从不了解它在其ACs上接收的帧的MAC SA;它只学习在PWs上从其他VPLS转发器接收的帧的MAC SA;和

- The VPLS Forwarders of a particular emulated LAN do not participate in a spanning tree protocol with each other. A "split horizon" technique is used to prevent forwarding loops.

- 特定模拟LAN的VPLS转发器彼此不参与生成树协议。“分割地平线”技术用于防止转发循环。

These points are discussed further in the next section.


Note that the PE bridge modules that are on a given Emulated LAN may or may not run a spanning tree protocol with each other over the Emulated LAN; whether they do so or not is outside the scope of the VPLS specifications. The PE bridge modules will do MAC address learning on the ACs. The PE bridge modules also do MAC address learning on the Emulated LAN interfaces, but do not do MAC address learning on the PWs, as the PWs are "hidden" behind the Emulated LAN interface. Conceptually, the PE bridge module's forwarding table and the VPLS Forwarder's VSI are distinct entities. (Of course, particular implementations might combine these into a single table, but that is beyond the scope of this document.)


A further issue arises if the PE bridges run bridge control protocols with each other over the Emulated LAN. Bridge control protocols are generally designed to run in over a real LAN and may presume, for their proper functioning, certain characteristics of the LAN, such as low latency and sequential delivery. If the Emulated LAN does not provide these characteristics, the control protocols may not perform as expected unless special mechanisms are provided for carrying the control frames.


It should be noted that changes in the spanning tree (if any) of a customer network, or in the spanning tree (if any) of the PE bridges, may cause certain MAC addresses to change their location from one PE to another. These changes may not be visible to the VPLS Forwarders, which means that those MAC addresses might become unreachable until they are aged out of the first PE's VSI. If this is not acceptable, some mechanism for communicating such changes to the VPLS Forwarders must be provided.


3.4.1. VPLS Overlay Topologies and Forwarding
3.4.1. VPLS覆盖拓扑和转发

Within a single VPLS, the VPLS Forwarders are interconnected by PWs. The set of PWs thus forms an "overlay topology".


The VPLS Forwarder VSIs are populated by means of MAC address learning. That is, the VSI keeps track of which MAC SAs have been received over which PWs. The presumption, of course, is that if a particular MAC address appears as the SA of a frame received over a particular PW, then frames that carry that MAC address in the DA field should be sent to the VSI that is at the remote end of the PW. In order for this presumption to be true, there must be a unique VSI at the remote end of the PW, which means that VSIs cannot be interconnected by means of multipoint-to-point PWs. The PWs are necessarily either point-to-point or, possibly, point-to-multipoint.

VPLS转发器VSI通过MAC地址学习来填充。也就是说,VSI跟踪通过哪些PW接收到哪些MAC SA。当然,假设是,如果特定MAC地址显示为通过特定PW接收的帧的SA,则在DA字段中携带该MAC地址的帧应发送到PW远端的VSI。为了使这一假设成立,必须在PW的远端有一个唯一的VSI,这意味着VSI不能通过多点对点PWs互连。PWs必须是点对点或点对多点。

MAC learning over a point-to-point PW is done via the standard techniques as specified by IEEE, where the PW is treated by the VPLS Forwarder as a "bridge port". Of course, if a MAC address is learned from a point-to-multipoint PW, the VSI must indicate that packets to that address are to be sent over a point-to-point PW that leads to the root of that point-to-multipoint PW.


The VSI forwarding decisions must be coordinated so that loop-free forwarding over the overlay topology is ensured.


There are several possible types of overlay topologies:


- Full mesh

- 全网

In a full mesh, every VSI in a given VPLS has exactly one point-to-point PW to every other VSI in that same VPLS.


In this topology, loop free forwarding of frames is ensured by the following rule: if a VSI receives a frame, over a PW, from another VSI, it MUST NOT forward that frame over ANY other PW to any other VSI. This ensures that once a frame traverses the Emulated LAN, it must be sent off the Emulated LAN.


If a VSI receives, on one of its Emulated LAN interfaces, a unicast frame with a known DA, the frame is sent on exactly one point-to-point PW.


If a VSI receives, on one of its Emulated LAN interfaces, a multicast frame or a unicast frame with an unknown DA, it sends a copy of the frame to each other VSI in the same Emulated LAN. This can be done by replicating the frame and sending a copy over each point-to-point PW. Alternatively, the full mesh of


point-to-point PWs may be augmented with point-to-multipoint PWs, where each VSI in a VPLS is the transmitter on a single point-to-multipoint PW, and the receivers on that PW are all the other VSIs in that VPLS.


- Tree structured

- 树形结构

In a tree structured topology, every VSI in a particular VPLS is provisioned to be at a particular level in the tree. A given VSI has at most one pseudowire leading to a higher level. The root of the tree is considered the highest level.


In this topology, loop free forwarding of frames is ensured by the following rule: if a frame is received over a pseudowire from a higher level, it may not be sent over a pseudowire that leads to a higher level.


- Tree with Meshed Highest Level

- 最高层次有网格的树

In this variant of the tree-structured topology, there may be more than one VSI at the highest level, but the set of VSIs that are at the highest level must be fully meshed. To ensure loop free forwarding, we need to impose the rule that a frame can be sent on a pseudowire to the same or higher level only if it arrived over a pseudowire from a lower level, and that frames arriving over PWs from the same level cannot be sent on PWs to the same level.


Other overlay topologies are also possible; e.g., an arbitrary partial mesh of PWs among the VSIs of a VPLS. Loop-freedom could then be assured by, for example, running a spanning tree on the overlay. These topologies are not further considered in this framework.

其他叠加拓扑也是可能的;e、 例如,VPLS的VSI中PWs的任意部分网格。然后,可以通过在覆盖上运行生成树来确保循环自由。在本框架中不进一步考虑这些拓扑。

Note that loop freedom in the overlay topology does not necessarily ensure loop freedom in the overall customer LAN that contains the VPLS. It does not even ensure loop freedom among the PE bridge modules. It ensures only that when a frame is sent on the Emulated LAN, the frame will not loop endlessly before (or instead of) leaving the Emulated LAN.


Improper configuration of the customer LAN or PE bridge modules may cause frames to loop, and frames that fall into such loops may transit the overlay topology multiple times. Procedures that enable the PE to detect and/or prevent such loops may be advisable.


3.4.2. Provisioning and Auto-Discovery
3.4.2. 资源调配和自动发现

Each VPLS must be assigned a globally unique identifier. This can be thought of as a VPN-id.


The ACs attaching the CEs to the PEs must be provisioned on both the PEs and the CEs. A VSI for that VPLS must be provisioned on the PE, and the local ACs of that VPLS must be associated with that VSI. The VSI must be provisioned with the identifier of the VPLS to which it belongs.


An auto-discovery scheme may be used by a PE to map a VPLS identifier into the set of remote PEs that have VSIs in that VPLS. Once this set is determined, the PE can use pseudowire signaling to set up a PW to each of those VSIs. The VPLS identifier would serve as the signaling protocol's Forwarder Selector. This would result in a full mesh of PWs among the VSIs in a particular VPLS.


If a single VPLS contains multiple VLANs, then it may be desirable to limit connectivity so that two VSIs are connected only if they have a VLAN in common.


In this case, each VSI would need to be provisioned with one or more VLAN ids, and the auto-discovery scheme would need to map a VPLS identifier into pairs of <PE, VLAN id>.

在这种情况下,每个VSI需要配置一个或多个VLAN id,自动发现方案需要将VPLS标识符映射到<PE,VLAN id>对中。

If a fully meshed topology of VSIs is not desired, then each VSI needs to be provisioned with additional information specifying its placement in the topology. This information would also need to be provided by the auto-discovery scheme.


Alternatively, the single-sided provisioning method discussed in Section could be used. As this is more complicated, it would only be used if it were necessary to associate individual PWs with individual characteristics. For example, if different guaranteed bandwidths were needed between different pairs of sites within a VPLS, the PWs would have to be provisioned individually.


3.4.3. Distributed PE
3.4.3. 分布式PE

Often, when a VPLS type of service is provided, the CE devices attach to a provider-managed CPE device. This provider-managed CPE device may attach to CEs of multiple customers, especially if, for example, there are multiple customers occupying the same building. However, this device is really part of the SP's network, hence may be considered a PE device.


In some scenarios in which a VPLS type of service is provided, the CE devices attach to a provider-managed intermediary device. This provider-managed device may attach to CEs of multiple customers. This may arise if there are multiple customers occupying the same building. This device is really part of the SP's network and may for that reason be considered to be a PE device; however, in the simplest case, it is performing only aggregation and none of the function associated with a VPLS.


Relative to the VPLS there are three different possibilities for allocate functions to a device in such a position in the provider network:


- it can perform aggregation and pure Layer2 service only, in which case it does not really play the role of a PE device in a VPLS service. In this case the intermediary system must connect to devices that perform VPLS PE functionality; the intermediary device itself is not part of the VPLS architecture and has hence not been named in this architecture.

- 它只能执行聚合和纯Layer2服务,在这种情况下,它实际上不能在VPLS服务中扮演PE设备的角色。在这种情况下,中间系统必须连接到执行VPLS PE功能的设备;中间设备本身不是VPLS体系结构的一部分,因此未在该体系结构中命名。

- it can perform all the PE functions relevant for a VPLS. In such a case, the device is called VPLS-PE, see [RFC4026]. This type of device will be connected to the core (P) routers.

- 它可以执行与VPLS相关的所有PE功能。在这种情况下,该设备称为VPLS-PE,请参阅[RFC4026]。这种类型的设备将连接到核心(P)路由器。

The PE functionality for a VPLS may be distributed between two devices, one "low-end" closer to the customer that performs, for example, the MAC-address learning and forwarding decisions, and one "high-end" that performs the control functions; e.g., establishing tunnels, PWs, and VCs. We call the low-end device the User-Facing PE (U-PE) and the high-end device the Network-Facing PE (N-PE).

VPLS的PE功能可以分布在两个设备之间,一个“低端”设备更靠近执行例如MAC地址学习和转发决策的客户,另一个“高端”设备执行控制功能;e、 例如,建立隧道、PWs和VCs。我们将低端设备称为面向用户的PE(U-PE),将高端设备称为面向网络的PE(N-PE)。

It is conceivable that the U-PE may be placed very close to the customer; e.g., in a building with more than one customer. The N-PE will presumably be placed on the SP's premises.

可以想象,U-PE可能放置在离客户非常近的位置;e、 例如,在一个有多个客户的建筑物内。N-PE可能放置在SP的场所。

The distributed case is potentially of interest for a number of possible reasons:


- The N-PE may be a device that cannot easily implement the VSI functionality described above. For example, perhaps the N-PE is a router that cannot perform the high speed MAC learning that is needed in order to implement a VSI forwarder. At the same time, the U-PE may need to be a low-cost device that also cannot implement the full set of VPLS functions.

- N-PE可以是不能容易地实现上述VSI功能的设备。例如,可能N-PE是一个路由器,它不能执行实现VSI转发器所需的高速MAC学习。同时,U-PE可能需要是一种低成本设备,也不能实现全套VPLS功能。

This leads one to investigate further if there are sensible ways to split the VPLS PE functionality between the U-PE and the N-PE.

这导致人们进一步研究是否有合理的方法在U-PE和N-PE之间分割VPLS PE功能。

- Generally, in the L2VPN architecture, the PEs are expected to participate as peers in the backbone routing protocol. Since the number of U-PEs is potentially very large relative to the number of N-PEs, this may be undesirable as a matter of scaling the backbone routing protocol.

- 通常,在L2VPN体系结构中,PEs应作为对等方参与主干路由协议。由于U-PEs的数量相对于N-PEs的数量可能非常大,因此在扩展主干路由协议时,这可能是不可取的。

- The U-PE may be a relatively inexpensive device that is unable to participate in the full range of signaling and/or auto-discovery procedures that are needed in order to provide the VPLS service.

- U-PE可以是相对便宜的设备,不能参与提供VPLS服务所需的全部信令和/或自动发现过程。

The VPLS functionality can be distributed between U-PE and N-PE in a number of different ways, and a number of different proposals have been made. They all presume that the U-PE will maintain a VSI forwarder, connected by PWs to the remote VSIs; the N-PE thus does not need to perform the VSI forwarding function. The proposals tend to differ with respect to the following questions:


- Should the U-PEs perform full PW signaling to set up the PWs to remote VSIs, or should the N-PEs do this signaling?

- U-PEs应该执行完整的PW信令来设置PWs到远程VSI,还是N-PEs应该执行此信令?

Since the U-PEs need to be able to send packets on PWs to remote VSIs and receive packets on PWs from remote VSIs, if the PW signaling is done by the N-PE, there would have to be some form of "lightweight" (presumably) signaling between N-PE and U-PE that allows the PWs to be extended from N-PE to U-PE.


- Should the U-PEs do their own auto-discovery, or should this be done by the N-PEs?

- U-PEs应该自己进行自动发现,还是由N-PEs进行自动发现?

In the latter case, the U-PEs may need to have some means of telling the N-PEs which VPLSes they are interested in, and the N-PEs must have some means of passing the results of the auto-discovery process to the U-PE.


Whether it makes sense to split auto-discovery in this manner may depend on the particular auto-discovery protocol used. One would not expect the U-PEs to participate in, if for example, a BGP-based auto-discovery scheme, but perhaps they would be expected to participate in a RADIUS-based auto-discovery scheme.


- If a U-PE does not participate in routing but is redundantly connected to two different N-PEs, can the U-PE still make an intelligent choice of the best N-PE to use as the "next hop" for

- 如果U-PE不参与路由,但冗余连接到两个不同的N-PE,U-PE是否仍然可以智能地选择最佳N-PE作为路由的“下一跳”

traffic destined to a particular remote VSI? If not, can this choice be made as the result of some other sort of interaction between N-PE and U-PE, or does this choice need to be established by provisioning?


- If a U-PE does not participate in routing but does participate in full PW signaling, and if MPLS is being used, how can an N-PE send a U-PE the labels that the U-PE needs in order to be able to send traffic to its signaling peers? (If the U-PE did participate in routing, this would happen automatically.)

- 如果U-PE不参与路由,但参与完整PW信令,并且如果使用MPLS,则N-PE如何向U-PE发送U-PE所需的标签,以便能够向其信令对等方发送流量?(如果U-PE确实参与了路由,这将自动发生。)

- When a frame must be multicast, should the replication be done by the N-PE or the U-PE?

- 当帧必须是多播时,复制应该由N-PE还是U-PE完成?

These questions are not all independent; the way one answers some of them may influence the way one answers others.


3.4.4. Scaling Issues in VPLS Deployment
3.4.4. VPLS部署中的扩展问题

In general, the PSN supports a VPLS solution with a tunnel from each VPLS-PE to every other VPLS-PE participating in the same VPLS instance. Strictly, VPLS-PEs with more than one VPLS instance in common only need one tunnel, but for resource allocation reasons it might be necessary to establish several tunnels. For each VPLS service on a given VPLS-PE, it needs to establish one pseudowire to every other VPLS-PE participating in that VPLS service. In total n*(n-1) pseudowires must be setup between the VPLS-PE routers. In large scale deployment this obviously creates scaling problems. One way to address the scaling problems is to use hierarchy.

通常,PSN支持VPLS解决方案,该解决方案具有从每个VPLS-PE到参与同一VPLS实例的每个其他VPLS-PE的隧道。严格来说,具有多个VPLS实例的VPLS PE只需要一个隧道,但出于资源分配原因,可能需要建立多个隧道。对于给定VPLS-PE上的每个VPLS服务,它需要与参与该VPLS服务的每个其他VPLS-PE建立一条伪线。VPLS-PE路由器之间总共必须设置n*(n-1)条伪线。在大规模部署中,这显然会造成扩展问题。解决缩放问题的一种方法是使用层次结构。

3.5. IP-Only LAN-Like Service (IPLS)
3.5. 仅限IP的类似LAN的服务(IPLS)

If, instead of providing a general VPLS service, one wishes to provide a VPLS that is used only to connect IP routers or hosts (i.e., the CE devices are all assumed to be IP routers or hosts), then it is possible to make certain simplifications.


In this environment, all Ethernet frames sent from a particular CE to a particular PE on a particular Attachment Circuit will have the same MAC Source Address. Thus, rather than use address learning in the data plane to learn the MAC addresses, the PE can use the control plane to learn the MAC address. This allows the PE to be implemented on devices that are not capable of doing MAC address learning in the data plane.


To eliminate the need for MAC address learning on the PWs as well as on the ACs, the pseudowire signaling protocol would have to carry the MAC address from one pseudowire endpoint to the other. In the case


of IPv4, Each PE would perform proxy ARP to its directly attached CEs. In the case of IPv6, each PE would send proxy Neighbor and/or Router Advertisements.


Eliminating the need to do MAC address learning on the PWs eliminates the need for the PWs to be point-to-point. Multipoint-to-point PWs could be used instead.


Unlike a VPLS, all the ACs in an IPLS would not necessarily have to carry Ethernet frames; only the IP packets would need to be passed across the network, not their Layer 2 wrappers. However, if there are protocols that are specific to the Layer 2, but that provide, for example, address resolution services for Layer 3, it may then be necessary to "translate" (or otherwise interwork) one of these Layer 2 protocols to the other. For example, if an IPLS instance has an ethernet AC and a Frame Relay AC, and IPv4 is running on both, interworking between ARP and Inverse ARP might be required.


The set of routing protocols that could be carried across the IPLS might also be restricted.


An IPLS instance must have a particular IPLS-wide MTU; if there are different kinds of AC in an IPLS instance, and those different kinds of AC support different MTUs, all ACS must enforce the IPLS-wide MTU; an AC that cannot do this must not be allowed to join the IPLS instance.


4. Security Considerations
4. 安全考虑

The security considerations section of the L2VPN requirements document [RFC4665] addresses a number of areas that are potentially insecure aspects of the L2VPN. These relate to both control plane and data plane security issues that may arise in the following areas:


- issues fully contained in the provider network

- 提供商网络中完全包含的问题

- issues fully contained in the customer network

- 完全包含在客户网络中的问题

- issues in the customer-provider interface network

- 客户-提供商接口网络中的问题

These three areas are addressed below.


4.1. Provider Network Security Issues
4.1. 提供商网络安全问题

This section discusses security issues that only impact the SP's equipment.


There are security issues having to do with the control connections that are used on a PE-PE basis for setting up and maintaining the pseudowires.


A PE should not engage with another PE in a control connection unless it has some confidence that the peer is really a PE to which it should be setting up PWs. Otherwise, L2PVN traffic may go to the wrong place. If control packets are maliciously and undetectably altered while in flight, denial of service, or alteration of the expected quality of service, may result.


If peers discover each other dynamically (via some auto-discovery procedure), this presupposes that the auto-discovery procedures are themselves adequately trusted.


PEs should not accept control connections from arbitrary entities; a PE either should be configured with its peers or should learn them from a trusted auto-configuration procedure. If the peer is required to be within the same SP's network, then access control filters at the borders of that network can be used to prevent spoofing of the peer's source address. If the peer is from another SP's network, then setting up such filters may be difficult or even impossible, depending on the way in which the two SPs are connected. Even if the access filters can be set up, the level of assurance that they provide will be lower.


Thus, for inter-SP control connections, it is advisable to use some sort of cryptographic authentication procedure. Control protocols which used TCP may use the TCP MD5 option to provide a measure of PE-PE authentication; this requires at least one shared secret between SPs. The use of IPsec between PEs is also possible and provides a greater degree of assurance, though at a greater cost.

因此,对于SP间控制连接,建议使用某种加密身份验证过程。使用TCP的控制协议可以使用TCP MD5选项来提供PE-PE认证的度量;这要求SP之间至少有一个共享机密。在PEs之间使用IPsec也是可能的,并且提供了更大程度的保证,尽管成本更高。

Any other security considerations that apply to the control protocol in general will also apply when the control protocol is used for setting up PWs. If the control protocol uses UDP messages, it may be advisable to have some protection against spoofed UDP messages that appear to be from a valid peer; this requires further study.


To limit the effect of Denial of Service attacks on a PE, some means of limiting the rate of processing of control plane traffic may be desirable.


Unlike authentication and integrity, privacy of the signaling messages is not usually considered very important. If it is needed, the signaling messages can be sent through an IPsec connection.


If the PE cannot efficiently handle high volumes of multicast traffic for sustained periods, then it may be possible to launch a denial of service attack on a VPLS service by sending a PE a large number of frames that have either a multicast address or an unknown MAC address in their MAC Destination Address fields. A similar denial of service attack can be mounted by sending a PE a large number of frames with bogus MAC Source Address fields. The bogus addresses can fill the MAC address tables in the PEs, with the result that frames destined to the real MAC addresses always get flooded (i.e., multicast). Note that this flooding can remove the (weak) confidentiality property of this or any other bridged network.


4.2. Provider-Customer Network Security Issues
4.2. 提供商客户网络安全问题

There are a number of security issues related to the access network between the provider and the customer. This is also traditionally a network that is hard to protect physically.


Typical security issues on the provider-customer interface include the following:


- Ensuring that the correct customer interface is configured

- 确保配置了正确的客户界面

- Preventing unauthorized access to the PE

- 防止未经授权访问PE

- Preventing unauthorized access to a specific PE port

- 防止未经授权访问特定PE端口

- Ensuring correct service delimiting fields (VLAN, DLCI, etc.)

- 确保正确的服务定界字段(VLAN、DLCI等)

As the access network for an L2VPN service is necessarily a Layer 2 network, it is preferable to use authentication mechanisms that do not presuppose any IP capabilities on the CE device.


There are existing Layer 2 protocols and best current practices to guard against these security issues. For example, IEEE 802.1x defines authentication at the link level for access through an ethernet bridge; the Frame Relay Forum defines LMI extensions for authentication (FRF.17).

现有的第2层协议和当前最佳实践可以防止这些安全问题。例如,IEEE 802.1x在链路级别定义了通过以太网桥访问的身份验证;帧中继论坛定义了用于身份验证的LMI扩展(FRF.17)。

4.3. Customer Network Security Issues
4.3. 客户网络安全问题

Even if all CE devices are properly authorized to attach to their PE devices, misconfiguration of the PE may interconnect CEs that are not supposed to be in the same L2VPN.


In a VPWS, the CEs may run IPsec to authenticate each other. Other Layer 3 or Layer 4 protocols may have their own authentication methods.


In a VPLS, CE-to-CE IPsec is even more problematic, as IPsec does not well support the multipoint configuration that is provided by the VPLS service.

在VPLS中,CE到CE IPsec的问题更大,因为IPsec不支持VPLS服务提供的多点配置。

There may be alternative methods for achieving a degree of CE-to-CE authentication, if the L2VPN signaling protocol can carry opaque objects between the CEs, either inband (over the L2VPN) or out-of-band, through the participation of the signaling protocol. This is for further study.


The L2VPN procedures do not provide authentication, integrity, or privacy for the customer's traffic; if this is needed, it becomes the responsibility of the customer. For customers who really need these features or who do not trust their service providers to provide the level of security that they need, the L2VPN framework discussed in this document may not be satisfactory. Such customers may consider alternative L2VPN schemes that are based not on an overlay of PWs, but on an overlay of IPsec tunnels whose endpoints are at the customer sites; however, such alternatives are not discussed in this document.


If there is CE-to-CE control traffic (e.g., BPDUs) on whose integrity the customer's own Layer 2 network depends, it may be advisable to send the control traffic using some more secure mechanism than is used for the data traffic.


In general, any means of mounting a denial of service attack on bridged networks generally can also be used to mount a denial of service attack on the VPLS service for a particular customer. We have discussed here only those attacks that rely on features of the VPLS service that are not shared by bridged networks in general.


5. Acknowledgements
5. 致谢

This document is the outcome of discussions within a Layer 2 VPN design team, all of whose members could be considered co-authors. Specifically, the co-authors are Loa Andersson, Waldemar Augustyn, Marty Borden, Hamid Ould-Brahim, Juha Heinanen, Kireeti Kompella, Vach Kompella, Marc Lasserre, Pascal Menezes, Vasile Radoaca, Eric Rosen, and Tissa Senevirathne.


The authors would like to thank Marco Carugi for cooperation in setting up context, working directions, and taking time for discussions in this space; Tove Madsen and Pekka Savola for valuable input and reviews; and Norm Finn, Matt Squires, and Ali Sajassi for valuable discussion of the VPLS issues.

作者要感谢Marco Carugi在建立背景、工作方向和花时间在此领域进行讨论方面的合作;Tove Madsen和Pekka Savola提供有价值的意见和评论;以及Norm Finn、Matt Squires和Ali Sajassi对VPLS问题进行了有价值的讨论。

6. Normative References
6. 规范性引用文件

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2119]Bradner,S.,“RFC中用于表示需求水平的关键词”,BCP 14,RFC 2119,1997年3月。

[RFC3985] Bryant, S. and P. Pate, "Pseudo Wire Emulation Edge-to-Edge (PWE3) Architecture", RFC 3985, March 2005.

[RFC3985]Bryant,S.和P.Pate,“伪线仿真边到边(PWE3)架构”,RFC 39852005年3月。

[RFC4026] Andersson, L. and T. Madsen, "Provider Provisioned Virtual Private Network (VPN) Terminology", RFC 4026, March 2005.

[RFC4026]Andersson,L.和T.Madsen,“提供商提供的虚拟专用网络(VPN)术语”,RFC 4026,2005年3月。

[RFC4665] Augustyn, W., Ed. and Y. Serbest, Ed., "Service Requirements for Layer 2 Provider-Provisioned Virtual Private Networks (L2VPNs)", RFC 4665, September 2006.

[RFC4665]Augustyn,W.,Ed.和Y.Serbest,Ed.,“第二层提供商提供的虚拟专用网络(L2VPN)的服务要求”,RFC 46652006年9月。

7. Informative References
7. 资料性引用

[IEEE8021D] IEEE 802.1D-2003, "IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Bridges"

[IEEE8021D]IEEE 802.1D-2003,“局域网和城域网的IEEE标准:媒体访问控制(MAC)网桥”

[IEEE8021Q] IEEE 802.1Q-1998, "IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks"

[IEEE8021Q]IEEE 802.1Q-1998,“局域网和城域网的IEEE标准:虚拟桥接局域网”

[RFC1771] Rekhter, Y. and T. Li, "A Border Gateway Protocol 4 (BGP-4)", RFC 1771, March 1995.

[RFC1771]Rekhter,Y.和T.Li,“边境网关协议4(BGP-4)”,RFC 17711995年3月。

[RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G., and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2661, August 1999.

[RFC2661]汤斯利,W.,瓦伦西亚,A.,鲁本斯,A.,帕尔,G.,佐恩,G.,和B.帕尔特,“第二层隧道协议“L2TP”,RFC 26611999年8月。

[RFC2796] Bates, T., Chandra, R., and E. Chen, "BGP Route Reflection - An Alternative to Full Mesh IBGP", RFC 2796, April 2000.

[RFC2796]Bates,T.,Chandra,R.,和E.Chen,“BGP路线反射-全网格IBGP的替代品”,RFC 2796,2000年4月。

[RFC3036] Andersson, L., Doolan, P., Feldman, N., Fredette, A., and B. Thomas, "LDP Specification", RFC 3036, January 2001.

[RFC3036]Andersson,L.,Doolan,P.,Feldman,N.,Fredette,A.,和B.Thomas,“LDP规范”,RFC 3036,2001年1月。

Authors' Addresses


Loa Andersson Acreo AB



Eric C. Rosen Cisco Systems, Inc. 1414 Massachusetts Avenue Boxborough, MA 01719

Eric C.Rosen Cisco Systems,Inc.马萨诸塞州伯斯堡马萨诸塞大道1414号,邮编01719


Waldemar Augustyn



Marty Borden



Juha Heinanen Song Networks, Inc. Hallituskatu 16 33200 Tampere, Finland

Juha Heinanen Song Networks,Inc.Hallituskatu 16 33200坦佩雷,芬兰


Kireeti Kompella Juniper Networks, Inc. 1194 N. Mathilda Ave Sunnyvale, CA 94089

Kireeti Kompella Juniper Networks,Inc.加利福尼亚州桑尼维尔市马蒂尔达大道北1194号,邮编94089


Vach Kompella TiMetra Networks 274 Ferguson Dr. Mountain View, CA 94043

Vach Kompella TiMetra Networks 274 Ferguson Mountain View博士,加利福尼亚州94043


Marc Lasserre Riverstone Networks 5200 Great America Pkwy Santa Clara, CA 95054

Marc Lasserre Riverstone Networks 5200大美洲Pkwy圣克拉拉,加利福尼亚州95054


Pascal Menezies



Hamid Ould-Brahim Nortel Networks P O Box 3511 Station C Ottawa, ON K1Y 4H7, Canada

加拿大K1Y 4H7渥太华C站3511号邮政信箱哈米德·乌尔德·布拉希姆北电网络公司


Vasile Radoaca Nortel Networks 600 Technology Park Billerica, MA 01821



Tissa Senevirathne 1567 Belleville Way Sunnyvale CA 94087

Tissa Senevirathne 1567加利福尼亚州桑尼维尔贝尔维尔路94087号


Full Copyright Statement


Copyright (C) The Internet Society (2006).


This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

本文件受BCP 78中包含的权利、许可和限制的约束,除其中规定外,作者保留其所有权利。



Intellectual Property


The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围,或此类权利下的任何许可可能或可能不可用的程度,不采取任何立场;它也不表示它已作出任何独立努力来确定任何此类权利。有关RFC文件中权利的程序信息,请参见BCP 78和BCP 79。

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at


The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at




Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).