VLAN manipulation/translation on Juniper MX series routers

The MX series routers are truly excellent. As well as being used for routing, they can also be used for switching. Switches do routing, so why not the other way around… right?

A basic switching setup on an MX is a VLAN bridge. Take the following config. It is akin to setting 2 802.1Q trunk ports on a switch, both in VLAN 66:

  1. interfaces {
  2. ge-1/0/4 {
  3. flexible-vlan-tagging;
  4. encapsulation flexible-ethernet-services;
  5. unit 66 {
  6. encapsulation vlan-bridge;
  7. vlan-id 66;
  8. }
  9. }
  10. ge-1/1/7 {
  11. flexible-vlan-tagging;
  12. encapsulation flexible-ethernet-services;
  13. unit 66 {
  14. encapsulation vlan-bridge;
  15. vlan-id 66;
  16. }
  17. }
  18. }
  19. bridge-domains {
  20. my-bridge {
  21. domain-type bridge;
  22. vlan-id 66;
  23. interface ge-1/0/4.66;
  24. interface ge-1/1/7.66;
  25. }
  26. }

Here we have 2 interfaces, both with a unit that matches traffic tagged for VLAN 66. The bridge domain sends layer 2 traffic between these two interfaces, as if it were a switch.

Bridge domains on the MX inherently do what is called VLAN Normalization/Translation. When a packet enters an interface, its VLAN is normalized to that of the bridge domain. When a packet leaves an interface, its VLAN is normalized to that of the exiting interface. The above example has the same VLAN on both interfaces and the bridge domain, so let’s look at a different example:

  1. interfaces {
  2. ge-1/0/4 {
  3. flexible-vlan-tagging;
  4. encapsulation flexible-ethernet-services;
  5. unit 55 {
  6. encapsulation vlan-bridge;
  7. vlan-id 55;
  8. }
  9. }
  10. ge-1/1/7 {
  11. flexible-vlan-tagging;
  12. encapsulation flexible-ethernet-services;
  13. unit 66 {
  14. encapsulation vlan-bridge;
  15. vlan-id 66;
  16. }
  17. }
  18. }
  19. bridge-domains {
  20. my-bridge {
  21. domain-type bridge;
  22. vlan-id 43;
  23. interface ge-1/0/4.55;
  24. interface ge-1/1/7.66;
  25. }
  26. }

In this example, when a packet tagged VLAN 55 enters on ge-1/0/4, its VLAN tag is swapped for 43 because that is the VLAN ID of the bridge. When the same packet leaves on ge-1/1/7, its VLAN tag is swapped again for 66 because that is the VLAN ID of the exiting interface.

As you can probably see, this is a silly example… the VLAN 43 is pointless here but it gives you an idea of what happens when packets traverse the bridge.

You can see this behavior when you do “show interfaces”:

  1. mx10> show interfaces ge-1/0/4.55
  2. Logical interface ge-1/0/4.55 (Index 346) (SNMP ifIndex 612)
  3. Flags: SNMP-Traps 0x0 VLAN-Tag [ 0x8100.55 ] In(swap .43) Out(swap .55) Encapsulation: VLAN-Bridge
  4.  
  5. mx10> show interfaces ge-1/1/7.66
  6. Logical interface ge-1/1/7.66 (Index 344) (SNMP ifIndex 611)
  7. Flags: SNMP-Traps 0x0 VLAN-Tag [ 0x8100.66 ] In(swap .43) Out(swap .66) Encapsulation: VLAN-Bridge

The key bit is the Flags line. You can see that input packets are swapped with VLAN 43 and output packets are swapped with the VLAN of the interface.

The above example shows you VLAN translation. In reality, you’d probably set the vlan-id of the bridge-domain to one of your interface VLANs or perhaps “none”. In the case of setting it to one of your VLANs, you’d see no work done on packets coming into/leaving the interface with the same VLAN ID and a swap for both In/Out on the other interface. In the case of “none”, the VLAN tag would be removed as a packet comes in and a new tag would be added when the packet leaves. This removal is called a “pop” and the addition as “push”.

Another good example of the usage of this is to convert a double tagged (Q-in-Q) packet to a single tagged one. You might have a provider who is using Q-in-Q and you want to remove their VLAN (the S-VLAN) and use only your VLAN (the C-VLAN) on devices which are on the “other side” of your MX. Here’s an example of that:

  1. interfaces {
  2. ge-1/0/0 {
  3. flexible-vlan-tagging;
  4. encapsulation flexible-ethernet-services;
  5. unit 601 {
  6. encapsulation vlan-bridge;
  7. vlan-id 601;
  8. }
  9. }
  10. ge-1/1/3 {
  11. flexible-vlan-tagging;
  12. encapsulation flexible-ethernet-services;
  13. unit 601 {
  14. encapsulation vlan-bridge;
  15. vlan-tags outer 255 inner 601;
  16. }
  17. }
  18. }
  19. bridge-domain {
  20. vlan-601 {
  21. domain-type bridge;
  22. vlan-id 601;
  23. interface ge-1/0/0.601;
  24. interface ge-1/1/3.601;
  25. }
  26. }

So here, we have a single tagged and a double tagged interface. The assumption is that the single tagged interface is facing our equipment (e.g. an SRX) and the double tagged interface is facing the provider. When double tagged packets from the provider enter on ge-1/1/3, the outer VLAN is removed (pop) because the vlan-id of the bridge domain is 601 – the same as the inner vlan-id. When packets leave on ge-1/0/0, nothing is done as the VLAN is already 601.

In the opposite direction, single tagged packets enter on ge-1/0/0. Nothing is done to them because the vlan-id already matches that of the bridge. When packets leave on ge-1/1/3, the VLAN 255 is added (push). Here’s what the “show interfaces” says:

  1. mx10> show interfaces ge-1/0/0.601
  2. Logical interface ge-1/0/0.601 (Index 363) (SNMP ifIndex 590)
  3. Flags: SNMP-Traps 0x0 VLAN-Tag [ 0x8100.601 ] Encapsulation: VLAN-Bridge
  4.  
  5. mx10> show interfaces ge-1/1/3.601
  6. Logical interface ge-1/1/3.601 (Index 374) (SNMP ifIndex 589)
  7. Flags: SNMP-Traps 0x0 VLAN-Tag [ 0x8100.255 0x8100.601 ] In(pop) Out(push 0x8100.255) Encapsulation: VLAN-Bridge

See the push/pop on the double tagged interface and nothing on the single tagged interface.

If you set no vlan-id on the bridge-domain… you are then allowed to define input-vlan-map and output-vlan-map on the logical interfaces. This allows you to customize exactly what happens in ingress and egress packets, rather than taking the default behavior as explained above.

What is anycast? Anycast explained at a very basic level

What is anycast? Anycast explained at a very basic level

AnycastWikipedia: Anycast is a network addressing and routing method in which datagrams from a single sender are routed to any one of several destination nodes, selected on the basis of which is the nearest, lowest cos..., at a very basic level, is when a collection of servers share the same IP address and data is sent from a source computer to the server that is topographically closest. It is important to remember that topographically closer does not inherently mean geographically closer, though this is often the case.

Anycast is used primarily for load balancingWikipedia: In computing, load balancing improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives.... to allow the server topographically closest to a user to handle their request. This helps cut down on latency and bandwidth costs and improves load time for users.

Anycast is linked with the Border Gateway ProtocolWikipedia: Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet.[1] The protocol is of.... This is a protocol used between routersWikipedia: A router[a] is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. A data packet is typically forwarded from one ... on the Internet with the intent of ensuring that all of a router’s neighbours are aware of the networks that can be reached through that router and the topographical distance to those networks. The principal of Anycast is that a single IP address is advertised in the BGP messages of multiple routers. As this propagates across the Internet, routers become aware of which of their neighbours provides the short topographical path to the advertised IP address.

IP addresses used in Anycast are often purchased directly from a Regional Internet registryWikipedia: A regional Internet registry (RIR) is an organization that manages the allocation and registration of Internet number resources within a particular region of the world. Internet number resources inclu.... Some data centersWikipedia: A data center is a facility used to house computer systems and associated components, such as telecommunications and storage systems. It generally includes redundant or backup power supplies, redundan... are known to rent IP addresses to customers and allow them to be advertised by other data centres.

As with all routing, it cannot be guaranteed that a packet will take the same path across the Internet as its predecessor. With Anycast, it cannot be guaranteed that a packet will reach the same destination server as its predecessor. As such, Anycast is not suitable for protocols which track state. TCP is an example of one of these. UDP, however, is perfect for Anycast providing it does not try to track state at a higher level of the OSI model and that the application layer protocol does not rely on a large number of fragemented datagrams to transfer data.

The typical scenario for Anycast as a load balancer is thus:

  • A server in London has its own IP address 3.3.3.3 and a shared Anycast IP address 1.1.1.1.
  • A server in New York has its own IP address 4.4.4.4 and a shared Anycast IP address 1.1.1.1.
  • Each of the above servers runs a DNSWikipedia: The Domain Name System (DNS) is a hierarchical decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It associates various information... server listening on 1.1.1.1.
  • The DNS servers serve up an A record for anycastdomain.com. London would serve up 3.3.3.3 and New York would serve up 4.4.4.4.
  • When a DNS request is made for anycastdomain.com, Anycast would route this request to its topographically closest DNS server. This DNS server would, in turn, serve up the unique IP address of its own server and a TCP connection would be established over standard unicast.

Feedback from companies such as ScaleEngine is that it’s quite difficult to persuade data centres to add IP addresses to their BGP. This appears to be best suited to larger organisations who lease their own transitWikipedia: Internet transit is the service of allowing network traffic to cross or "transit" a computer network, usually used to connect a smaller Internet service provider (ISP) to the larger Internet. Technica... and have BGP agreements with their transit providers.