Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Connecting Logical Systems Using Logical Tunnel Interfaces

 

Configuring Logical Tunnel Interfaces

Logical tunnel (lt-) interfaces provide quite different services depending on the host router:

  • On M Series, MX Series, and T Series routers, logical tunnel interfaces allow you to connect logical systems, virtual routers, or VPN instances. M Series and T Series routers must be equipped with a Tunnel Services PIC or an Adaptive Services Module (only available on M7i routers). MX Series routers must be equipped with a Trio MPC/MIC module. For more information about connecting these applications, see the Junos OS VPNs Library for Routing Devices.

  • On SRX Series Services Gateways, the logical tunnel interface is used to interconnect logical systems. See the Logical Systems and Tenant Systems User Guide for Security Devices for information about using the logical tunnel interface on the SRX Series.

  • On ACX Series routers, logical tunnel interfaces allow you to connect a bridge domain and a pseudowire. Logical systems are not supported on ACX Series routers.

Connecting Logical Systems

To connect two logical systems, you configure a logical tunnel interface on both logical systems. Then you configure a peer relationship between the logical tunnel interfaces, thus creating a point-to-point connection.

To configure a point-to-point connection between two logical systems, configure the logical tunnel interface by including the lt-fpc/pic/port statement:

You can include this statement at the following hierarchy levels:

  • [edit interfaces]

  • [edit logical-systems logical-system-name interfaces]

When configuring logical tunnel interfaces, note the following:

  • You can configure each logical tunnel interface with one of the following encapsulation types: Ethernet, Ethernet circuit cross-connect (CCC), Ethernet VPLS, Frame Relay, Frame Relay CCC, VLAN, VLAN CCC, or VLAN VPLS.

  • You can configure the IP, IPv6, International Organization for Standardization (ISO), or MPLS protocol family.

  • Do not reconfigure a logical tunnel interface that is an anchor point with pseudowire devices stacked above it unless you first deactivate all broadband subscribers that are using the pseudowire subscriber interface.

  • The peering logical interfaces must belong to the same logical tunnel interface derived from the Tunnel Services PIC or Adaptive Services Module.

  • You can configure only one peer unit for each logical interface. For example, unit 0 cannot peer with both unit 1 and unit 2.

  • To enable the logical tunnel interface, you must configure at least one physical interface statement.

  • Logical tunnels are not supported with Adaptive Services, Multiservices, or Link Services PICs (but they are supported on the Adaptive Services Module on M7i routers, as noted above).

  • On M Series routers other than the M40e router, logical tunnel interfaces require an Enhanced Flexible PIC Concentrator (FPC).

  • On MX Series routers, logical tunnel interfaces require Trio MPC/MIC modules. They do not require a Tunnel Services PIC in the same system.

Guidelines for Configuring Logical Tunnels on ACX Series Routers

Observe the following guidelines while configuring logical tunnel (lt-) interfaces on ACX Series routers:

  • You can use a logical tunnel interface to connect only bridge domains and pseudowires.

  • Logical tunnel interfaces cannot interconnect the following links:

    • Pesudowire and a routing instance (Pseudowire terminating on a VRF)

    • Two routing instances

    • VPLS instance and a routing instance

    • Two VPLS instances

    • Two Bridge domains

    • Bridge domain and a VPLS instance

  • Only one logical tunnel (physical interface) per bandwidth type (1 Gbps or 10 Gbps) can be configured on ACX routers. However, you can specify up to two logical tunnel interfaces (one with 1 Gb bandwidth and another with 10 Gb bandwidth) on ACX routes.

  • Guaranteed bandwidth for logical tunnels is 1 Gbps and certain platforms support up to an additional 10 Gbps bandwidth. All the services configured using logical tunnel interfaces share this bandwidth.

    The bandwidth configured on the logical tunnel interface is shared between upstream and downstream traffic on that interface. The effective bandwidth available for the service is half the configured bandwidth.

  • Multiple logical tunnel interfaces to enable configuration of separate services on each logical interface to obtain increased bandwidth for each individual interface separately or the bundling of individual logical tunnel interfaces is not supported.

  • You can configure Ethernet VLAN, Ethernet CCC, VLAN bridge on Ethernet interfaces, and VLAN on circuit cross-connects (CCC) as encapsulation types on logical tunnel interfaces. Other encapsulation types such as Ethernet, VLAN, Ethernet VPLS, or VLAN VPLS are not supported.

  • When the encapsulation configured on the logical interface units is one of the supported types such as Ethernet VLAN or VLAN bridge, you can enable only bridge domains or CCC protocols on logical tunnel interfaces. Other address families or protocols such as IPv4, IPv5, MPLS, or OSPF are not supported.

  • Classifier, rewrite and ingress policer configuration are supported on logical tunnel interfaces. Fixed, BA-based, and multifield classifiers are supported on the lt- interfaces at the physical interface-level.

    802.1p, 802.1ad, TOS and DSCP based BA classifiers are supported. Remarking rules can be configured at the port level on the LT interface. 802.1p, 802.1ad, TOS and DSCP fields in the packet can be rewritten in the LT interface. Ingress policers are supported.

    Simple, Single-rate tricolor marking (srTCM), two-rate tricolor marking (trTCM) policers are supported. Egress policers are not supported.

  • Default classifiers do not work properly when lt- interfaces are configured on non-Ethernet PICs.

  • Port-level queuing is supported; up to eight queues per lt- interface are supported. These eight queues are shared between the upstream and downstream traffic traversing through the lt- interface. If the configured bandwidth on the lt- interface is not adequate for the upstream and downstream traffic of the services configured on the interface, a failure occurs with traffic propagation because multiple lt- interfaces are not supported.

  • Eight forwarding classes (0-7) are mapped to the eight queues based on the global system configuration. The remainder of the scheduler configuration, buffer-size, transmit-rate, shaping-rate, priority and WRED or drop profiles maps can be configured on the lt- interface queues.

  • The following firewall filter types are supported on lt- interfaces:

    • Logical interface-level filters

    • Bridge family filters

    • CCC family filters

    All firewall configurations are supported. The scaling limitation with such filters is the same as the existing firewall filter restrictions.

  • OAM is not supported on lt- interfaces.

  • Similar to other physical interfaces, the number of logical interfaces that can be supported on logical tunnel physical interfaces is 30.

  • When a bridge domain is configured with a VLAN ID (bridge domain has normalized VLANs), the difference is behavior between MX and ACX Series routers is that the MX router does not match the user-vlan-id in output filter, whereas the ACX router matches the user-vlan-id specified in the output filter.

  • If the logical tunnel interface is created using non Ethernet PICs, then default classifier is not bound to the interface.

To create logical tunnel interfaces and the bandwidth in gigabits per second to reserve for tunnel services, include the tunnel-services bandwidth (1g | 10g) statement at the [edit chassis fpc slot-number pic number] hierarchy level:

The ACX5048 and ACX5096 routers support ethernet-vpls and vlan-vpls encapsulations. These encapsulations are supported only on logical tunnel interface and are required for configuring hierarchial VPLS.

You can use any unused physical port on the ACX5048 and ACX5096 routers to create a logical tunnel interface as shown below:

The following sample configuration allows you to encapsulate vlan-ccc to vlan-vpls using LT interface in ACX5048 and ACX5096 routers:

Example: Configuring Logical Tunnels

Configure three logical tunnels:

Configuring an Interface in the VRF Domain to Receive Multicast Traffic

You can configure an ACX Series router to receive multicast traffic in a VRF domain. In an IPTV solution, IPTV sources and receivers can be spread across different end points of a network in a VRF domain. To receive the multicast traffic at the receiver’s side, it is necessary for the multicast traffic to be tunneled across the network to reach the end receiving device or the subscriber. This tunneling is usually done using the Multicast Virtual Private Network (MVPN) technology.

ACX Series routers do not support MVPN technology. An alternate method for receiving the multicast traffic in the VRF domain in ACX Series router is by associating a global logical interface to a logical interface in the VRF domain. The global logical interface acts as a proxy for receiving the multicast traffic on the logical interface in the VRF domain. To associate a global logical interface to a logical interface in the VRF domain, you need to configure an IRB interface in a global domain to act as a proxy for the logical interface in the VRF domain.

Configuring a Proxy Logical Interface in the Global Domain

To configure a proxy logical interface in the global domain, you need to create logical tunnel (lt-) interface and IRB interface and then associate the IRB interface to a bridge domain. The following is a example to configure a proxy logical interface in the global domain:

  1. Create an logical tunnel (lt-) interface.
  2. Create an IRB interface.
  3. Associate the IRB interface to a bridge domain.

Associating the Proxy Logical Interface to a Logical Interface in a VRF Domain

To associate the proxy logical interface to a logical interface in a VRF domain, you need to run the following PFE commands:

  • test pfe acx vrf-mc-leak enable—Enables proxy association.

  • test pfe acx entry add VRF-logical-interface-name logical-tunnel-logical-interface-name IRB-logical-interface-name IRB-IP-address + 1—Creates an association between proxy logical interface and the logical interface in a VRF domain.

  • test pfe acx vrf-mc-leak disable—Disables proxy association.

  • test pfe acx entry del VRF-logical-interface-name logical-tunnel-logical-interface-name IRB-logical-interface-name IRB-IP-address + 1—Deletes the association between the proxy logical interface and the logical interface in a VRF domain.

  • show pfe vrf-mc-leak—Displays the association entries between proxy logical interface and the logical interface in a VRF domain.

Note

When the router or PFE is rebooted, the proxy associations of logical interfaces is removed and you need to once again create the proxy associations of logical interface.

Limitations

The following limitations need to be considered for receiving multicast traffic in a VRF domain:

  • Maximum of 5 proxy associations of logical interfaces can be configured.

  • VRF IPv6 multicast is not supported.

  • AE interface as a VRF interface (requesting multicast traffic) is not be supported.

  • Multicast traffic cannot be forwarded from the logical interface in a VRF domain if the first hop router is an ACX router.

Redundant Logical Tunnels Overview

You can connect two devices, such as an access-facing device and a core-facing device, through logical tunnels. To provide redundancy for the tunnels, you can create and configure multiple physical logical tunnels and add them to a virtual redundant logical tunnel.

Note

Redundant logical tunnels are supported only on MX Series routers with MPCs. Starting in Junos OS Release 18.4R3, redundant logical tunnels are supported on MX Series Virtual Chassis..

For example, in an MPLS access network, you can configure multiple pseudowires between an access node and an MX Series router with MPCs and add them to a redundant logical tunnel. You can then add multiple logical tunnels to the redundant logical tunnel. Figure 1 shows a redundant logical tunnel between the access node and the MX Series router.

Figure 1: Redundant Logical Tunnels
Redundant Logical Tunnels

The redundant logical tunnel has peer logical interfaces at each end, rlt0.0 and rlt0.1. You can configure router features on these interfaces for the redundant logical tunnel and its members.

Each member logical tunnel has peer logical interfaces. In Figure 1, lt-0/0/10.0 and lt-0/0/10.1 are peers.

The MX Series router performs IP lookup in the Layer 3 VPN routing and forwarding (VRF) table on the router where the pseudowires that are grouped in logical tunnels terminate.

Redundant Logical Tunnel Configuration

In Junos OS Releases 14.1R1 and earlier, you can create up to 16 redundant logical tunnels, depending on the number of Packet Forwarding Engines and the number of loopback interfaces on each Packet Forwarding Engine on your device. Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255.

You can add up to 32 logical tunnels as members of a redundant logical tunnel.

When you add more than two members to the redundant logical tunnel, they are in active mode. The traffic is load-balanced over all the tunnel members.

When you add only two members to the redundant logical tunnel, you can configure the members in one of these ways:

  • Both members in active mode

  • One member in active mode and the other in backup mode

Redundant Logical Tunnel Failure Detection and Failover

A logical tunnel fails and is removed from the redundant logical tunnel group, and the backup logical tunnel becomes active due to one of these events:

  • A hardware failure on the MPC module occurs.

  • An MPC failure occurs due to a microkernel crash.

  • The MPC module is administratively shut down and removed from the redundant logical tunnel.

  • A power failure on the MPC module occurs.

Note

You can decrease the time it takes for failure detection and failover to occur. Configure the enhanced-ip statement at the [edit chassis network-services] hierarchy level to enable Packet Forwarding Engine liveliness detection.

Configuring Redundant Logical Tunnels

Use redundant logical tunnels to provide redundancy for logical tunnels between two devices, such as an access-facing device and a core-facing device.

When configuring redundant logical tunnel interfaces, note the following:

  • Starting in Junos OS Release 13.3, you can configure redundant logical tunnels only on MX Series routers with MPCs.

    In Junos OS Releases 14.1R1 and earlier, you can create up to 16 redundant logical tunnels, depending on the number of Packet Forwarding Engines and the number of loopback interfaces on each Packet Forwarding Engine on your device. Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255. The command is shown below.

    set chassis redundancy-group interface-type redundant-logical-tunnel device-count [number];

    You can add up to 32 logical tunnels as members.

  • When a logical tunnel with an existing configuration joins a redundant logical tunnel, you must configure the redundant logical tunnel with the settings from the existing configuration.

  • You can add member logical tunnels to a parent logical tunnel for redundancy.

  • When you add more than two logical tunnels to the redundant logical tunnel, the members are in active mode by default.

  • When you add only two members, you can configure the members in one of these ways:

    • Both members in active mode

    • One member in active mode and the other in backup mode

To configure a redundant logical tunnel between two devices:

  1. Create the logical tunnel and redundant logical tunnel interfaces.
  2. Bind the member logical tunnels to the redundant logical tunnel.
  3. Configure the redundant logical tunnel interfaces.
  4. Attach the redundant logical tunnel interface to a Layer 2 circuit.
  5. Add the peer redundant logical tunnel interface to a Layer 3 VRF instance.
  6. Configure MPLS and LDP in the pseudowires and the Layer 3 VPN.
  7. Configure BGP in the Layer 3 VPN.
  8. Configure OSPF on the core-facing interfaces and the router local loopback interface.
  9. Set the policy options for BGP.
  10. Set the router ID and the autonomous system (AS) number.

Example: Configuring Redundant Logical Tunnels

This example shows how to configure redundant logical tunnels in an MPLS access network.

Requirements

In Junos OS Release 13.3 or later, you can configure redundant logical tunnels only on MX Series routers with MPCs.

Overview

When a logical tunnel with an existing configuration joins a redundant logical tunnel, you must configure the redundant logical tunnel with the settings from the existing configuration.

You can add member logical tunnels to a parent logical tunnel for redundancy.

On MX Series routers with MPCs, you can configure redundant logical tunnels as follows:

  • In Junos OS Releases 14.1R1 and earlier, you can create up to 16 redundant logical tunnels, depending on the number of Packet Forwarding Engines and the number of loopback interfaces on each Packet Forwarding Engine on your device. Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255. The command is shown below.

    set chassis redundancy-group interface-type redundant-logical-tunnel device-count [number];

  • You can add up to 32 logical tunnels as members.

  • When you add more than two logical tunnels to a redundant logical tunnel, the members are in active mode by default.

  • When you add only two members, you can configure the members in one of these ways:

    • Both members in active mode

    • One member in active mode and the other in backup mode

Topology

Figure 2 shows a redundant logical tunnel between the access node and the MX Series router in an MPLS access network.

Figure 2: Redundant Logical Tunnels
Redundant Logical Tunnels

The redundant logical tunnel has peer logical interfaces at each end, rlt0.0 and rlt0.1. You can configure router features on these interfaces for the redundant logical tunnel and its members.

Each member logical tunnel has peer logical interfaces on the access-facing and core-facing devices. In Figure 2, lt-0/0/10.0 and lt-0/0/10.1 are peers.

The MX Series router performs IP lookup in the Layer 3 VPN routing and forwarding (VRF) table on the router where the pseudowires that are grouped in logical tunnels terminate.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

In this example, all the logical tunnels are in active mode.

  1. Create the logical tunnel and redundant logical tunnel interfaces.
  2. Bind the member logical tunnels to the redundant logical tunnel.
  3. Configure the redundant logical tunnel interfaces.
  4. Attach rlt0.0 to a Layer 2 circuit.
  5. Add rlt0.1 to a Layer 3 VRF instance.
  6. Configure MPLS and LDP in the pseudowires and the Layer 3 VPN.
  7. Configure BGP in the Layer 3 VPN.
  8. Configure OSPF on the core-facing interfaces and the router local loopback interface.
  9. Set the policy options for BGP.
  10. Set the router ID and the autonomous system (AS) number.

Results

From configuration mode, confirm your configuration by entering the following commands:

  • show chassis

  • show interfaces

  • show policy-options

  • show protocols

  • show routing-instances

  • show routing-options

If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Verification

Confirm that the configuration is working properly.

Verifying the Redundant Logical Tunnel Configuration

Purpose

Verify that the redundant logical tunnel with the child logical tunnel interfaces are created with the correct encapsulations.

Action

user@host# run show interfaces terse | match rlt0

Verifying the Layer 2 Circuit

Purpose

Verify that the Layer 2 circuit is up.

Action

user@host# run show l2circuit connections

Verifying OSPF Neighbors

Purpose

Verify that routers are adjacent and able to exchange OSPF data.

Action

user@host# run show ospf neighbor

Verifying the BGP Group

Purpose

Verify that the BGP group is created.

Action

user@host# run show bgp group internal

Verifying the BGP Routes in the Routing Table

Purpose

Verify that the BGP routes are in the pe-vrf.inet.0 routing table.

Action

user@host# run show route protocol bgp table pe-vrf.inet.0
Release History Table
Release
Description
Starting in Junos OS Release 18.4R3, redundant logical tunnels are supported on MX Series Virtual Chassis.
Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255.
Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255.
Starting in Junos OS Release 14.2 and for 13.3R3 and 14.1R2, the valid range for device-count is from 1 to 255. The command is shown below.
Starting in Junos OS Release 13.3, you can configure redundant logical tunnels only on MX Series routers with MPCs.