Bridge Virtual Interface (BVI) Over L3VPN
Overview
A Bridge Virtual Interface (BVI) is a virtual interface on a router that acts like a routed interface and is associated with a single bridge domain.
BVI Interface acts as L3 routed interface gateway between bridge domain and L3VPN for traffic exchange. The incoming tagged packet from the L2 sub-interface consolidated itself into a bridge domain. The bridge domain in turn uses the BVI interface to forward the IP traffic to the L3VPN tunnel.
Characteristics of BVI Over L3VPN
• The BVI functions as an L3 routed interface for a bridge domain, allowing IP traffic from L2 subinterfaces within the domain to be routed to L3VPN tunnels.
• L2 subinterfaces can be grouped into a bridge domain under the BVI. The BVI aggregates traffic from multiple subinterfaces within the same domain and routes it as required.
• The BVI remains operationally “up” as long as at least one of the subinterfaces in the bridge domain is active.
• BVI supports unicast forwarding of IPv4 traffic between other L3 interfaces and L3VPNs. The BVI can function as a DHCP server or relay for IP address allocation within the network.
Benefits
• The BVI enables seamless communication between L2 bridge domains and L3 networks (e.g., L3VPN), allowing for flexible traffic forwarding between the two layers.
• The BVI serves as an L3 gateway for M-plane traffic, routing it efficiently to L3VPN tunnels for further processing or external routing.
• The BVI remains operational even if only one subinterface is active, ensuring high availability and fault tolerance.
Limitations
• Only Q2-based platforms are supported.
• Everything related to ipv6 is not supported
• L2 sub interfaces support only pop and pop2-tag vlan rewrite translations and for the purpose of bridge-domain support, all member L2 sub interfaces should have relevant rewrite configurations to make sure that all traffic for bridge-domain has uniform encapsulation.
• The dot1q and dot1ad encapsulations with range are not supported for the BVI.
• BVI is a generic L3 interface and allows users to configure any / all existing OcNOS features. However, only a few of these are supported in release 6.6.0 and those are IP address related, VRF, any routing protocol specific commands (OSPF/IS-IS/BGP related), MTU, DHCP server/relay, Ingress/Egress ACL and QoS commands related to marking.
• L3 ACL applied at BVI is only relevant for routed traffic. Bridged traffic between L2 sub-interfaces will not be subjected to L3 ACL configured at BVI.
• No Interface counters are supported for BVI Interface.
• BVI can’t be used as a network interface for all transports in MPLS core network.
• For QoS, only marking related CLIs are supported. Policing, rate limiting, shaping and other queuing features are not supported at BVI level. However, existing QoS scheduling and queuing features on other interfaces can be used in conjunction with the BVI interface.
• VRRP over the BVI interface is not supported.
• TWAMP support along with QoS shaping and Queuing for BVI is planned for future releases.
• BUM traffic is not supported.
Prerequisites
• Define Interfaces and Loopback Addresses:
Configure Layer 2 interfaces, like port channel interfaces (e.g., po1), and assign specific IP addresses for proper identification and routing. Additionally, assign loopback IP addresses to establish essential points of connectivity. These configurations establish efficient network routing and communication.
interface lo
ip address 127.0.0.1/8
ip address 135.1.1.27/32 secondary
ipv6 address ::1/128
interface po6
ip address 10.1.1.1/30
interface xe6
channel-group 6 mode active
• Configure IGP for Dynamic Routing:
Enable ISIS to facilitate dynamic routing on all nodes within the network. Define ISIS router instances to match loopback IP addresses and add network segments to ISIS areas for proper route distribution.Set up neighbor relationships using loopback IP addresses, ensuring efficient route advertisement and convergence for optimal network performance.
• ISIS Configuration:
router isis 1
is-type level-2-only
metric-style wide
mpls traffic-eng router-id 10.12.183.1
mpls traffic-eng level-2
capability cspf
dynamic-hostname
fast-reroute ti-lfa level-2 proto ipv4
net 49.0000.0000.0027.00
passive-interface lo
interface po6
isis network point-to-point
ip router isis 1
• OSPF Configuration:
router ospf 100
ospf router-id 10.12.183.1
network 10.12.183.1/32 area 0.0.0.0
network 10.1.1.0/24 area 0.0.0.0
network 10.1.1.0/24 area 0.0.0.0
• Configure LDP for Label Transport:
Configure label-switching on all the nodes to help exchange the network packets at a lower lever rather than the traditional network layer and enable ldp to transport those labels.
router ldp
targeted-peer ipv4 10.12.183.3
exit-targeted-peer
transport address ipb4 10.12.183.1
Interface po6
label-switching
enable-ldp ipv4
Configuration
Topology
The sample topology includes Edge nodes (PE1 and PE2), core Node (P1), and Customer Edge nodes (CE1 and CE2).
BVI Interface Topology
CE1
1. Set up the interface with VLAN encapsulation and assign an IP address.
CE1(config)#interface xe20.101
CE1(config-if)#encapsulation dot1q 101
CE1(config-if)#ip address 101.0.1.2/24
CE1(config-if)#exit
2. Configure BGP with a neighbor in the same AS (200).
CE1(config)# router bgp 200
CE1(config-router)# neighbor 101.0.1.1 remote-as 100
CE1(config-router)#address-family ipv4 unicast
CE1(config-router-af)#neighbor 101.0.1.1 activate
CE1(config-router-af)#exit-address-family
CE1(config-router)#exit
PE1
1. Create a VRF instance (VRF101) and define route targets.
PE1(config)# ip vrf VRF101
PE1(config-vrf)# rd 10.12.183.1:100
PE1(config-vrf)# route-target both 100:101
PE1(config-vrf)# exit
2. Configure the access port with VLAN encapsulation and enable rewriting.
PE1(config)#interface xe20.101 switchport
PE1(config-if)#encapsulation dot1q 101
PE1(config-if)#rewrite pop
PE1(config-if)# exit
3. Set up a BVI (Bridge Virtual Interface) for VRF forwarding.
PE1(config)# interface bvi101
PE1(config-if)#ip vrf forwarding VRF101
PE1(config-if)#ip address 101.0.1.1/24
PE1(config-f)# exit
4. Configure BGP with internal (PE) and external (CE) neighbors.
PE1(config)# router bgp 100
PE1(config-router)# neighbor 10.12.183.3 remote-as 100
PE1(config-router)# neighbor 10.12.183.3 update-source lo
PE1(config-router)#address-family ipv4 unicast
PE1(config-router-af)#neighbor 10.12.183.3 activate
PE1(config-router-af)#exit-address-family
PE1(config-router)#address-family vpnv4 unicast
PE1(config-router-af)#neighbor 10.12.183.3 activate
PE1(config-router-af)#exit-address-family
5. Enable VPNv4 and redistribute connected routes.
PE1(config-router)#address-family ipv4 vrf VRF101
PE1(config-router-af)#redistribute connected
PE1(config-router-af)#neighbor 101.0.1.2 remote-as 200
PE1(config-router-af)# neighbor 101.0.1.2 activate
PE1(config-router-af)#exit-address-family
PE1(config-router)#exit
6. Set up a bridge domain to associate the interface with BVI.
PE1(config)# bridge-domain 101
PE1(config)#interface xe20.101
PE1(config)#routed-interface bvi101
PE2
1. Create the same VRF instance (VRF101) with route targets.
PE2(config)# ip vrf VRF101
PE2(config-vrf)# rd 10.12.183.3:100
PE2(config-vrf)# route-target both 100:101
PE2(config-vrf)#exit
2. Configure the access port with VLAN encapsulation and VRF forwarding.
PE2(config)# interface xe30.101
PE2(config-if)#encapsulation dot1q 101
PE2(config-if)#ip vrf forwarding VRF101
PE2(config-if)#ip address 103.0.1.1/24
PE2(config-f)# exit
3. Assign an IP address to the interface.
PE2(config)# router bgp 100
PE2(config-router)# neighbor 10.12.183.1 remote-as 100
PE2(config-router)# neighbor 10.12.183.1 update-source lo
PE2(config-router)#address-family ipv4 unicast
PE2(config-router-af)#neighbor 10.12.183.1 activate
PE2(config-router-af)#exit-address-family
4. Configure BGP with internal (PE) and external (CE) neighbors.
PE2(config-router)#address-family vpnv4 unicast
PE2(config-router-af)#neighbor 10.12.183.1 activate
PE2(config-router-af)#exit-address-family
5. Enable VPNv4 and redistribute connected routes.
PE2(config-router)#address-family ipv4 vrf VRF101
PE2(config-router-af)#redistribute connected
PE2(config-router-af)#neighbor 103.0.1.2 remote-as 200
PE2(config-router-af)# neighbor 103.0.1.2 activate
PE2(config-router-af)#exit-address-family
PE2(config-router)#exit
CE2
1. Set up the interface with VLAN encapsulation and assign an IP address.
CE2#configure terminal
CE2(config)#interface xe30.101
CE2(config-if)#encapsulation dot1q 101
CE2(config-if)#ip address 103.0.1.2/24
CE2(config-if)#exit
2. Configure BGP with a neighbor in the same AS (200).
CE2(config)# router bgp 200
CE2(config-router)# neighbor 101.0.1.1 remote-as 100
CE2(config-router)#address-family ipv4 unicast
CE2(config-router-af)#neighbor 101.0.1.1 activate
CE2(conf ig-router-af)#exit-address-family
CE2(config-router)#exit
Running configuration on CE1 router is as follows:
#show running-config
!
feature netconf-ssh vrf management
feature netconf-tls vrf management
no feature netconf-ssh
no feature netconf-tls
!
service password-encryption
!
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
!
hardware-profile statistics ingress-acl enable
!
qos enable
!
hostname CE1
no ip domain-lookup
ip domain-lookup vrf management
tfo Disable
errdisable cause stp-bpdu-guard
no feature telnet vrf management
no feature telnet
feature ssh vrf management
no feature ssh
feature dns relay
ip dns relay
ipv6 dns relay
feature ntp vrf management
ntp enable vrf management
lldp run
lldp tlv-select basic-mgmt port-description
lldp tlv-select basic-mgmt system-name
lldp tlv-select basic-mgmt system-capabilities
lldp tlv-select basic-mgmt system-description
lldp tlv-select basic-mgmt management-address
lldp notification-interval 1000
!
ip vrf management
!
interface ce0
!
interface ce1
!
interface eth0
ip vrf forwarding management
ip address dhcp
!
interface lo
ip address 127.0.0.1/8
ipv6 address ::1/128
!
interface lo.management
ip vrf forwarding management
ip address 127.0.0.1/8
ipv6 address ::1/128
interface xe20
!
interface xe20.101
encapsulation dot1q 101
ip address 101.0.1.2/24
!
router bgp 200
neighbor 101.0.1.1 remote-as 100
!
address-family ipv4 unicast
neighbor 101.0.1.1 activate
exit-address-family
!
exit
!
!
end
Running configuration on PE1 router is as follows:
#show running-config
!
feature netconf-ssh vrf management
feature netconf-tls vrf management
no feature netconf-ssh
no feature netconf-tls
!
service password-encryption
!
logging console 5
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
!
hardware-profile filter ingress-ipv4-ext enable
hardware-profile filter egress-ipv4-ext enable
hardware-profile statistics voq-full-color enable
hardware-profile statistics cfm-ccm enable
!
qos enable
!
hostname PE1
port ce2 breakout 4X10g
no ip domain-lookup
ip domain-lookup vrf management
ip name-server vrf management 10.12.3.23
bridge 1 protocol ieee vlan-bridge
tfo Disable
errdisable cause stp-bpdu-guard
no feature telnet vrf management
no feature telnet
feature ssh vrf management
no feature ssh
snmp-server enable snmp vrf management
snmp-server view all .1 included vrf management
snmp-server community test vrf management
feature dns relay
ip dns relay
ipv6 dns relay
feature ntp vrf management
ntp enable vrf management
feature rsyslog
logging remote server 10.12.100.252 5 port 1514 vrf management
lldp run
lldp tlv-select basic-mgmt port-description
lldp tlv-select basic-mgmt system-name
lldp tlv-select basic-mgmt system-capabilities
lldp tlv-select basic-mgmt system-description
lldp tlv-select basic-mgmt management-address
lldp notification-interval 1000
fault-management enable
!
router-id 10.12.183.1
!
ip vrf management
!
ip vrf VRF101
rd 10.12.183.1:100
route-target both 100:101
!
router ldp
fast-reroute
session-protection duration 40
targeted-peer ipv4 10.12.183.3
exit-targeted-peer-mode
transport-address ipv4 10.12.183.1
!
router rsvp
!
interface po6
ip address 10.1.1.1/24
label-switching
ip router isis ISIS-IGP-100
enable-ldp ipv4
!
interface bvi101
ip vrf forwarding VRF101
ip address 101.0.1.1/24
!
interface eth0
ip vrf forwarding management
ip address dhcp
!
interface lo
ip address 127.0.0.1/8
ip address 10.12.183.1/32 secondary
ipv6 address ::1/128
ip router isis ISIS-IGP-100
!
interface lo.management
ip vrf forwarding management
ip address 127.0.0.1/8
ipv6 address ::1/128
!
interface xe1
channel-group 6 mode active
!
interface xe20
!
interface xe20.101 switchport
encapsulation dot1q 101
rewrite pop
!
exit
!
router ospf 100
ospf router-id 10.12.183.1
network 10.1.1.0/24 area 0.0.0.0
network 10.12.183.1/32 area 0.0.0.0
!
router isis ISIS-IGP-100
is-type level-1
metric-style wide
mpls traffic-eng router-id 10.12.183.1
mpls traffic-eng level-1
capability cspf
dynamic-hostname
fast-reroute per-prefix remote-lfa level-1 proto ipv4 tunnel mpls-ldp
bfd all-interfaces
net 49.0001.0000.0000.0001.00
passive-interface lo
!
router bgp 100
neighbor 10.12.183.3 remote-as 100
neighbor 10.12.183.3 update-source lo
!
address-family ipv4 unicast
neighbor 10.12.183.3 activate
exit-address-family
!
address-family vpnv4 unicast
neighbor 10.12.183.3 activate
exit-address-family
!
address-family ipv4 vrf VRF101
redistribute connected
neighbor 101.0.1.2 remote-as 200
neighbor 101.0.1.2 activate
exit-address-family
!
exit
!
bridge-domain 100
interface xe20.101
routed-interface bvi101
!
!
end
Running configuration on P1 router is as follows:
#show running-config
!
feature netconf-ssh vrf management
feature netconf-tls vrf management
no feature netconf-ssh
no feature netconf-tls
!
service password-encryption
!
logging console 5
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
!
hardware-profile statistics voq-full-color enable
hardware-profile statistics cfm-ccm enable
!
qos enable
!
hostname P1
no ip domain-lookup
ip domain-lookup vrf management
ip name-server vrf management 10.12.3.23
bridge 1 protocol ieee vlan-bridge
tfo Disable
errdisable cause stp-bpdu-guard
no feature telnet vrf management
no feature telnet
feature ssh vrf management
no feature ssh
snmp-server enable snmp vrf management
snmp-server view all .1 included vrf management
snmp-server community test vrf management
feature dns relay
ip dns relay
ipv6 dns relay
feature ntp vrf management
ntp enable vrf management
lldp run
lldp tlv-select basic-mgmt port-description
lldp tlv-select basic-mgmt system-name
lldp tlv-select basic-mgmt system-capabilities
lldp tlv-select basic-mgmt system-description
lldp tlv-select basic-mgmt management-address
lldp notification-interval 1000
!
router-id 10.12.183.2
!
ip vrf management
!
router ldp
transport-address ipv4 10.12.183.2
!
router rsvp
!
interface po6
ip address 10.1.1.2/24
label-switching
ip router isis ISIS-IGP-100
enable-ldp ipv4
!
interface eth0
ip vrf forwarding management
ip address dhcp
!
interface lo
ip address 127.0.0.1/8
ip address 10.12.183.2/32 secondary
ipv6 address ::1/128
ip router isis ISIS-IGP-100
!
interface lo.management
ip vrf forwarding management
ip address 127.0.0.1/8
ipv6 address ::1/128
!
interface xe1
channel-group 6 mode active
!
interface xe2
ip address 20.1.1.1/24
label-switching
ip router isis ISIS-IGP-100
enable-ldp ipv4
!
exit
!
router ospf 100
ospf router-id 10.12.183.2
network 10.1.1.0/24 area 0.0.0.0
network 10.12.183.2/32 area 0.0.0.0
network 20.1.1.0/24 area 0.0.0.0
!
router isis ISIS-IGP-100
is-type level-1
metric-style wide
mpls traffic-eng router-id 10.12.183.2
mpls traffic-eng level-1
capability cspf
dynamic-hostname
fast-reroute per-prefix remote-lfa level-1 proto ipv4 tunnel mpls-ldp
bfd all-interfaces
net 49.0001.0000.0000.0002.00
passive-interface lo
!
end
Running configuration on PE2 router is as follows:
#show running-config
!
feature netconf-ssh vrf management
feature netconf-tls vrf management
no feature netconf-ssh
no feature netconf-tls
!
service password-encryption
!
logging console 5
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
!
hardware-profile statistics ingress-acl enable
hardware-profile statistics ac-lif enable
!
qos enable
!
hostname PE2
no ip domain-lookup
ip domain-lookup vrf management
ip name-server vrf management 10.12.3.23
bridge 1 protocol ieee vlan-bridge
tfo Disable
errdisable cause stp-bpdu-guard
no feature telnet vrf management
no feature telnet
feature ssh vrf management
no feature ssh
snmp-server enable snmp vrf management
snmp-server view all .1 included vrf management
snmp-server community test vrf management
feature dns relay
ip dns relay
ipv6 dns relay
feature ntp vrf management
ntp enable vrf management
lldp run
lldp tlv-select basic-mgmt port-description
lldp tlv-select basic-mgmt system-name
lldp tlv-select basic-mgmt system-capabilities
lldp tlv-select basic-mgmt system-description
lldp tlv-select basic-mgmt management-address
lldp notification-interval 10
!
router-id 10.12.183.3
!
ip vrf management
!
ip vrf VRF101
rd 10.12.183.3:100
route-target both 100:101
!
router ldp
fast-reroute
session-protection duration 40
targeted-peer ipv4 10.12.183.1
exit-targeted-peer-mode
transport-address ipv4 10.12.183.3
!
interface eth0
ip vrf forwarding management
ip address dhcp
!
interface lo
ip address 127.0.0.1/8
ip address 10.12.183.3/32 secondary
ipv6 address ::1/128
ip router isis ISIS-IGP-100
!
interface lo.management
ip vrf forwarding management
ip address 127.0.0.1/8
ipv6 address ::1/128
!
interface xe2
ip address 20.1.1.2/24
label-switching
ip router isis ISIS-IGP-100
enable-ldp ipv4
!
interface xe30
!
interface xe30.101
description L3VPN-VRF101
encapsulation dot1q 101
ip vrf forwarding VRF101
ip address 103.0.1.1/24
!
exit
!
router ospf 100
ospf router-id 10.12.183.3
network 10.12.183.3/32 area 0.0.0.0
network 20.1.1.0/24 area 0.0.0.0
!
router isis ISIS-IGP-100
is-type level-1
metric-style wide
mpls traffic-eng router-id 10.12.183.3
mpls traffic-eng level-1
capability cspf
dynamic-hostname
fast-reroute per-prefix remote-lfa level-1 proto ipv4 tunnel mpls-ldp
bfd all-interfaces
net 49.0001.0000.0000.0003.00
passive-interface lo
!
router bgp 100
neighbor 10.12.183.1 remote-as 100
neighbor 10.12.183.1 update-source lo
!
address-family ipv4 unicast
neighbor 10.12.183.1 activate
exit-address-family
!
address-family vpnv4 unicast
neighbor 10.12.183.1 activate
exit-address-family
!
address-family ipv4 vrf VRF101
redistribute connected
neighbor 103.0.1.2 remote-as 200
neighbor 103.0.1.2 activate
exit-address-family
!
exit
!
end
Running configuration on CE2 router is as follows:
#show running-config
!
feature netconf-ssh vrf management
feature netconf-tls vrf management
no feature netconf-ssh
no feature netconf-tls
!
service password-encryption
!
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
!
hardware-profile statistics ingress-acl enable
!
qos enable
!
hostname CE2
no ip domain-lookup
ip domain-lookup vrf management
tfo Disable
errdisable cause stp-bpdu-guard
no feature telnet vrf management
no feature telnet
feature ssh vrf management
no feature ssh
feature dns relay
ip dns relay
ipv6 dns relay
feature ntp vrf management
ntp enable vrf management
lldp run
lldp tlv-select basic-mgmt port-description
lldp tlv-select basic-mgmt system-name
lldp tlv-select basic-mgmt system-capabilities
lldp tlv-select basic-mgmt system-description
lldp tlv-select basic-mgmt management-address
lldp notification-interval 1000
!
ip vrf management
!
interface eth0
ip vrf forwarding management
ip address dhcp
!
interface lo
ip address 127.0.0.1/8
ipv6 address ::1/128
!
interface lo.management
ip vrf forwarding management
ip address 127.0.0.1/8
ipv6 address ::1/128
interface xe30
!
interface xe30.101
encapsulation dot1q 101
ip address 103.0.1.2/24
!
router bgp 200
neighbor 103.0.1.1 remote-as 100
!
address-family ipv4 unicast
neighbor 103.0.1.1 activate
exit-address-family
!
exit
!
!
end
Validation
PE1
To Verify the L2 interfaces and BVI interface attached on a bridge domain:
PE1#show running-config bridge-domain
bridge-domain 101
Interface xe20.101
routed-interface bvi101
To Verify the link status of L2 Interfaces attached to bridge-domain:
PE1#show bridge-domain
Total number of bridge-domains Configured: 1
Bridge Id interfaces Status
----------+----------------+-----------
101 xe20.101 UP
To Verify the link status of the BVI interface:
PE1#show ip interface bvi101 brief
'*' - address is assigned by dhcp client
Interface IP-Address Admin-Status Link-Status
bvi101 101.0.1.1 up up
To Verify BGP session between PE1-CE1
PE1#show ip bgp summary
BGP router identifier 10.12.183.1, local AS number 100
BGP table version is 11
1 BGP AS-PATH entries
0 BGP community entries
Neighbor V AS MsgRcv MsgSen TblVer InQ OutQ Up/Down State/PfxRcd Desc
10.12.183.3 4 100 280 283 11 0 0 00:18:47 0
Total number of neighbors 1
Total number of Established sessions 1
BGP router identifier 101.0.1.1, local AS number 100
BGP VRF VRF101 Route Distinguisher: 10.12.183.1:100
BGP table version is 1
1 BGP AS-PATH entries
0 BGP community entries
Neighbor V AS MsgRcv MsgSen TblVer InQ OutQ Up/Down State/PfxRcd Desc
101.0.1.2 4 200 10 13 1 0 0 00:03:54 0
Total number of neighbors 1
Total number of Established sessions 1
To Verify the route between PE1-CE1
PE1#show ip route vrf VRF101
IP Route Table for VRF "VRF101"
C 101.0.1.0/24 is directly connected, bvi101, installed 01:59:42, last update 01:59:42 ago
C 127.0.0.0/8 is directly connected, lo.VRF101, installed 01:59:46, last update 01:59:46 ago
To Verify vrf Ping between PE1-CE1
PE1#ping ip vrf VRF 101.0.1.2 vrf VRF101
Press CTRL+C to exit
PING 101.0.200.2 (101.0.200.2) 100(128) bytes of data.
108 bytes from 101.0.200.2: icmp_seq=1 ttl=64 time=0.432 ms
108 bytes from 101.0.200.2: icmp_seq=2 ttl=64 time=0.427 ms
108 bytes from 101.0.200.2: icmp_seq=3 ttl=64 time=0.348 ms
--- 101.0.200.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2070ms
rtt min/avg/max/mdev = 0.348/0.402/0.432/0.038 ms
Glossary
The following provides definitions for key terms or abbreviations and their meanings used throughout this document:
Key Terms/Acronym | Description |
BUM | Broadcast, Unknown, Multicast |
BVI | Bridge Virtual Interface |
L3VPN | Layer 3 Virtual Private Network |
IGP | Interior Gateway Protocol |
ISIS | Intermediate System to Intermediate System |
OSPF | Open Shortest Path First |
LDP | Label Distribution Protocol |