ON THIS PAGE
Layer 2 Services
Learn about Layer 2 services and the configurations to enable these services on the ACX7000 family of routers. The ACX7000 family of routers includes ACX7020, ACX7024, ACX7024X, ACX7100, ACX7332, ACX7348, and ACX7509 routers.
This section describes Layer 2 services such as VPLS and Layer 2 circuit configurations on the ACX7000 family of routers.
VPLS
A virtual private LAN service (VPLS) routing instance is configured on the provider edge
(PE) routers, not on the customer edge (CE) or on the core provider (P) routers. On the
ACX7000 family of routers, use virtual-switch as the routing instance type
to configure virtual private LAN service (VPLS).
Prerequisites
-
MPLS backbone (MPLS underlay) is fully operational, including:
-
IGP (OSPF or IS-IS) is configured and stable to handle routing between core P and PE routers.
-
LDP or RSVP is enabled to create LSPs between PE routers.
-
Multiprotocol BGP (MP‑BGP) is configured between PE routers.
MP-BGP is required for BGP-based VPLS signaling configuration.
-
-
Loopback interfaces and router IDs are configured.
-
VLANs and CE‑facing interfaces are defined.
Here is a sample LDP-based and BGP-based Layer 2 VPLS configurations on an ACX7000 family of routers:
LDP-based Layer 2 VPLS Configuration:
VPLS routing instance configuration on a PE device:
set routing-instances VPLS-LDP instance-type virtual-switch set routing-instances VPLS-LDP protocols vpls neighbor 172.16.0.3 set routing-instances VPLS-LDP protocols vpls site-range 100 set routing-instances VPLS-LDP protocols vpls no-tunnel-services set routing-instances VPLS-LDP protocols vpls vpls-id 100 set routing-instances VPLS-LDP vlans VLAN100 vlan-id 100 set routing-instances VPLS-LDP vlans VLAN100 interface et-0/0/4.100
CE-facing interface configuration on a PE device:
set interfaces et-0/0/4 flexible-vlan-tagging set interfaces et-0/0/4 encapsulation flexible-ethernet-services set interfaces et-0/0/4 unit 100 encapsulation vlan-vpls set interfaces et-0/0/4 unit 100 vlan-id 100
Sample LDP-based VPLS Output:
user@PE> show vpls connections instance VPLS-LDP
Mar 24 13:23:35
Layer-2 VPN connections:
Legend for connection status (St)
EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS
EM -- encapsulation mismatch WE -- interface and instance encaps not same
VC-Dn -- Virtual circuit down NP -- interface hardware not present
CM -- control-word mismatch -> -- only outbound connection is up
CN -- circuit not provisioned <- -- only inbound connection is up
OR -- out of range Up -- operational
OL -- no outgoing label Dn -- down
LD -- local site signaled down CF -- call admission control failure
RD -- remote site signaled down SC -- local and remote site ID collision
LN -- local site not designated LM -- local site ID not minimum designated
RN -- remote site not designated RM -- remote site ID not minimum designated
XX -- unknown connection status IL -- no incoming label
MM -- MTU mismatch MI -- Mesh-Group ID not available
BK -- Backup connection ST -- Standby connection
PF -- Profile parse failure PB -- Profile busy
RS -- remote site standby SN -- Static Neighbor
LB -- Local site not best-site RB -- Remote site not best-site
VM -- VLAN ID mismatch HS -- Hot-standby Connection
Legend for interface status
Up -- operational
Dn -- down
Instance: VPLS-LDP
VPLS-id: 100
Neighbor Type St Time last up # Up trans
172.16.0.3(vpls-id 100) rmt Up Mar 23 19:36:11 2026 1
Remote PE: 172.16.0.3, Negotiated control-word: No
Incoming label: 27, Outgoing label: 25
Negotiated PW status TLV: No
Local interface: lsi.1048577, Status: Up, Encapsulation: ETHERNET
Description: Intf - vpls VPLS-LDP neighbor 172.16.0.3 vpls-id 100
Flow Label Transmit: No, Flow Label Receive: No
user@PE> show ethernet-switching table instance VPLS-LDP
Mar 24 13:29:05
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC
GBP - group based policy, B - Blocked MAC)
Ethernet switching table : 10 entries, 10 learned
Routing instance : VPLS-LDP
Vlan MAC MAC Age GBP Logical NH MAC RTR
name address flags Tag interface Index property ID
VLAN100 00:15:01:00:00:01 D - lsi.1048577 0 0
VLAN100 00:15:01:00:00:02 D - lsi.1048577 0 0
VLAN100 00:16:01:00:00:01 D - et-0/0/4.100 0 0
VLAN100 00:16:01:00:00:02 D - et-0/0/4.100 0 0
BGP-based Layer 2 VPLS Configuration:
VPLS routing instance configuration on a PE device:
set routing-instances VPLS-BGP instance-type virtual-switch set routing-instances VPLS-BGP protocols vpls site SITE-2 site-identifier 2 set routing-instances VPLS-BGP protocols vpls site-range 10 set routing-instances VPLS-BGP protocols vpls no-tunnel-services set routing-instances VPLS-BGP route-distinguisher 65101:201 set routing-instances VPLS-BGP vrf-target target:65101:200 set routing-instances VPLS-BGP vlans VLAN100 vlan-id 100 set routing-instances VPLS-BGP vlans VLAN100 interface et-0/0/4.100
CE-facing interface configuration on a PE device:
set interfaces et-0/0/4 flexible-vlan-tagging set interfaces et-0/0/4 encapsulation flexible-ethernet-services set interfaces et-0/0/4 unit 100 encapsulation vlan-vpls set interfaces et-0/0/4 unit 100 vlan-id 100
Sample BGP-based VPLS Output:
user@PE> show vpls connections instance VPLS-BGP
Mar 24 13:22:54
Layer-2 VPN connections:
Legend for connection status (St)
EI -- encapsulation invalid NC -- interface encapsulation not CCC/TCC/VPLS
EM -- encapsulation mismatch WE -- interface and instance encaps not same
VC-Dn -- Virtual circuit down NP -- interface hardware not present
CM -- control-word mismatch -> -- only outbound connection is up
CN -- circuit not provisioned <- -- only inbound connection is up
OR -- out of range Up -- operational
OL -- no outgoing label Dn -- down
LD -- local site signaled down CF -- call admission control failure
RD -- remote site signaled down SC -- local and remote site ID collision
LN -- local site not designated LM -- local site ID not minimum designated
RN -- remote site not designated RM -- remote site ID not minimum designated
XX -- unknown connection status IL -- no incoming label
MM -- MTU mismatch MI -- Mesh-Group ID not available
BK -- Backup connection ST -- Standby connection
PF -- Profile parse failure PB -- Profile busy
RS -- remote site standby SN -- Static Neighbor
LB -- Local site not best-site RB -- Remote site not best-site
VM -- VLAN ID mismatch HS -- Hot-standby Connection
Legend for interface status
Up -- operational
Dn -- down
Instance: VPLS-BGP
Edge protection: Not-Primary
Local site: SITE-1 (1)
connection-site Type St Time last up # Up trans
2 rmt Up Mar 24 12:57:35 2026 1
Remote PE: 172.16.0.3, Negotiated control-word: No
Incoming label: 30, Outgoing label: 30
Local interface: lsi.1048579, Status: Up, Encapsulation: VPLS
Description: Intf - vpls VPLS-BGP local site 1 remote site 2
Flow Label Transmit: No, Flow Label Receive: No
{master}
user@PE> show ethernet-switching table instance VPLS-BGP
Mar 24 13:23:09
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC
GBP - group based policy, B - Blocked MAC)
Ethernet switching table : 10 entries, 10 learned
Routing instance : VPLS-BGP
Vlan MAC MAC Age GBP Logical NH MAC RTR
name address flags Tag interface Index property ID
VLAN100 00:13:01:00:00:01 D - lsi.1048579 0 0
VLAN100 00:13:01:00:00:02 D - lsi.1048579 0 0
VLAN100 00:14:01:00:00:01 D - et-0/0/4.100 0 0
VLAN100 00:14:01:00:00:02 D - et-0/0/4.100 0 0
For an example of VPLS-based Layer 2 VPN configuration to provide end-to-end Layer 2 connectivity over an Enterprise WAN network, see End-to-end Layer 2 Connectivity using VPLS-based Layer 2 VPN.
Layer 2 Circuit
Layer 2 circuits enable service providers to transport Layer 2 traffic across MPLS networks, allowing efficient delivery of Ethernet services over IP/MPLS infrastructure. Routers function as provider edge (PE) switches in Layer 2 circuit deployments, transporting Layer 2 traffic between customer sites through label-switched paths.
Layer 2 circuits can be configured as either port-based or VLAN-based. For VLAN-based circuits, you configure access interfaces with VLAN encapsulation and establish MPLS label-switched paths between PE devices. The configuration requires setting up:
- Interface encapsulation (such as
vlan-cccfor VLAN-based circuits) - MPLS label-switched paths (LSPs) to remote PE switches
- LDP on core and loopback interfaces
Prerequisites
-
MPLS backbone (MPLS underlay) is fully operational, including:
-
IGP (OSPF or IS-IS) is configured and stable to handle routing between core P and PE routers.
-
LDP or RSVP is enabled to create LSPs between PE routers.
-
-
Loopback interfaces and router IDs are configured.
-
VLANs and CE‑facing interfaces are defined.
Here is a sample configuration for creating a Layer 2 circuit (Layer 2 pseudowire) on an ACX7000 family of routers, specifically a VLAN-based Ethernet circuit (VLAN CCC).
set protocols l2circuit neighbor 172.16.0.3 interface et-0/0/4.100 virtual-circuit-id 11500 set interfaces et-0/0/4 flexible-vlan-tagging set interfaces et-0/0/4 encapsulation flexible-ethernet-services set interfaces et-0/0/4 unit 100 encapsulation vlan-ccc set interfaces et-0/0/4 unit 100 vlan-id 100
Sample Output:
user@PE> show l2circuit connections
Mar 24 17:02:55
Layer-2 Circuit Connections:
Legend for connection status (St)
EI -- encapsulation invalid NP -- interface h/w not present
MM -- mtu mismatch Dn -- down
EM -- encapsulation mismatch VC-Dn -- Virtual circuit Down
CM -- control-word mismatch Up -- operational
VM -- vlan id mismatch CF -- Call admission control failure
OL -- no outgoing label IB -- TDM incompatible bitrate
NC -- intf encaps not CCC/TCC TM -- TDM misconfiguration
BK -- Backup Connection ST -- Standby Connection
CB -- rcvd cell-bundle size bad SP -- Static Pseudowire
LD -- local site signaled down RS -- remote site standby
RD -- remote site signaled down HS -- Hot-standby Connection
XX -- unknown
Legend for interface status
Up -- operational
Dn -- down
Neighbor: 172.16.0.3
Interface Type St Time last up # Up trans
et-0/0/4.100(vc 11500) rmt Up Mar 24 17:01:01 2026 1
Remote PE: 172.16.0.3, Negotiated control-word: Yes (Null)
Incoming label: 38, Outgoing label: 37
Negotiated PW status TLV: No
Local interface: et-0/0/4.100, Status: Up, Encapsulation: VLAN
Flow Label Transmit: No, Flow Label Receive: No