Do you have multiple locations and the want to tunnel layer2 over your IP network via a virtual wire to combine broadcast domains? You are in luck, this can be done utilizing something called Pseudowires and L2tpv3 (Layer 2 Tunneling Protocol Version 3). First, let me explain each of the 2 technologies used here:
- A Pseudowire is a virtual connection using an emulated “wire” that is carried over your IP network. This can be from router to router over a WAN connection or between routers inside your campus or between switches.
- L2tpv3 is the tunneling protocol used to encapsulate the layer 2 frames that will be sent over the Pseudowire.
Have a look at the following sample topology:
You will see that we have 2 sites, connected by a WAN link (a T1, in this example) using Cisco 3745 routers running 12.4(15)T14. At each location, you will see a switch for LAN connectivity. What we will accomplish here is not that dissimilar from what was covered in the article I wrote about “L2protocol and Dot1Q Tunneling.” This, however, is much more robust and will offer much more flexibility.
To start off, we have S0/0 on each router as a WAN connection, already configured.
R1:
interface Serial0/0
ip address 10.0.0.1 255.255.255.252
service-module t1 clock source internal
service-module t1 timeslots 1-24
R2:
interface Serial0/0
ip address 10.0.0.2 255.255.255.252
service-module t1 timeslots 1-24
The first thing to do is configure the Loopback interface on each router. This will be the address to which the Pseudowire will terminate. How you route these addresses to the other router(s) is up to you. In this simple example, we will just use a static route, but as more sites are added, you can use the routing protocol of your choice. This is just a proof of concept.
R1:
interface Loopback0
ip address 192.168.200.1 255.255.255.255
R2
interface Loopback0
ip address 192.168.200.2 255.255.255.255
Next, we will configure the Pseudowire Class. Here is where we will specify the origin of the Pseudowire as well as the encapsulation to be used. In each case, it is lo0 and l2tpv3.
R1:
pseudowire-class CLASS1
encapsulation l2tpv3
ip local interface Loopback0
R2
pseudowire-class CLASS1
encapsulation l2tpv3
ip local interface Loopback0
They look the same, right?
Now we will configure the LAN facing interface at each site as the endpoint of the pseudowire using the ‘xconnect’ command to specify the remote endpoint, ie, the lo0 interface of the far router. We also give it a VC (Virtual Circuit) ID, in this example, I used 1.
R1:
interface FastEthernet0/0
no ip address
duplex auto
speed auto
xconnect 192.168.200.2 1 encapsulation l2tpv3 pw-class CLASS1
R2:
interface FastEthernet0/0
no ip address
duplex auto
speed auto
xconnect 192.168.200.1 1 encapsulation l2tpv3 pw-class CLASS1
To verify the status of the Pseudowire, use the command ‘show xconnect all’
R1:
R1#show xconnect all
Legend: XC ST=Xconnect State, S1=Segment1 State, S2=Segment2 State
UP=Up, DN=Down, AD=Admin Down, IA=Inactive, NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP ac Fa0/0(Ethernet) UP l2tp 192.168.200.2:1 UP
R2
R2#show xconnect all
Legend: XC ST=Xconnect State, S1=Segment1 State, S2=Segment2 State
UP=Up, DN=Down, AD=Admin Down, IA=Inactive, NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP ac Fa0/0(Ethernet) UP l2tp 192.168.200.1:1 UP
You will see that the Pseudowire is “UP” and you have sucessfully created the cross connect between the 2 Fa0/0 interfaces at each site.
You can verify that the switches have formed a trunk to each other. As you can see, S1 (VLAN100: 192.168.100.1/24) and S2 (VLAN100: 192.168.100.2/24) can ping each other as well:
S1:
S1#show int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-4094
Port Vlans allowed and active in management domain
Fa0/1 1,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,100
S1#
S1#ping 192.168.100.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
S2:
S2#show int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-4094
Port Vlans allowed and active in management domain
Fa0/1 1,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,100
S2#
S2#ping 192.168.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
As far as clients at each location are concerned, they are on the same subnet. It is as if you ran a physical cable between the 2 switches. Your next step would be to upgrade that T1 to something with a little more throughput (think Metro Ethernet) and probably implement QoS. You can also add more sites and more Pseudowires should you wish. Just be mindful of your WAN connections and the capabilities of your platforms.
I hope you found this both informative and fun.
