mirror of
https://github.com/netbox-community/netbox.git
synced 2026-01-11 21:10:29 +01:00
Assign Multiple L2VPN / VPLS to a Single Endpoint #6999
Closed
opened 2025-12-29 19:47:36 +01:00 by adam
·
12 comments
No Branch/Tag Specified
main
update-changelog-comments-docs
feature-removal-issue-type
20911-dropdown
20239-plugin-menu-classes-mutable-state
21097-graphql-id-lookups
feature
fix_module_substitution
20923-dcim-templates
20044-elevation-stuck-lightmode
feature-ip-prefix-link
v4.5-beta1-release
20068-import-moduletype-attrs
20766-fix-german-translation-code-literals
20378-del-script
7604-filter-modifiers-v3
circuit-swap
12318-case-insensitive-uniqueness
20637-improve-device-q-filter
20660-script-load
19724-graphql
20614-update-ruff
14884-script
02496-max-page
19720-macaddress-interface-generic-relation
19408-circuit-terminations-export-templates
20203-openapi-check
fix-19669-api-image-download
7604-filter-modifiers
19275-fixes-interface-bulk-edit
fix-17794-get_field_value_return_list
11507-show-aggregate-and-rir-on-api
9583-add_column_specific_search_field_to_tables
v4.5.0
v4.4.10
v4.4.9
v4.5.0-beta1
v4.4.8
v4.4.7
v4.4.6
v4.4.5
v4.4.4
v4.4.3
v4.4.2
v4.4.1
v4.4.0
v4.3.7
v4.4.0-beta1
v4.3.6
v4.3.5
v4.3.4
v4.3.3
v4.3.2
v4.3.1
v4.3.0
v4.2.9
v4.3.0-beta2
v4.2.8
v4.3.0-beta1
v4.2.7
v4.2.6
v4.2.5
v4.2.4
v4.2.3
v4.2.2
v4.2.1
v4.2.0
v4.1.11
v4.1.10
v4.1.9
v4.1.8
v4.2-beta1
v4.1.7
v4.1.6
v4.1.5
v4.1.4
v4.1.3
v4.1.2
v4.1.1
v4.1.0
v4.0.11
v4.0.10
v4.0.9
v4.1-beta1
v4.0.8
v4.0.7
v4.0.6
v4.0.5
v4.0.3
v4.0.2
v4.0.1
v4.0.0
v3.7.8
v3.7.7
v4.0-beta2
v3.7.6
v3.7.5
v4.0-beta1
v3.7.4
v3.7.3
v3.7.2
v3.7.1
v3.7.0
v3.6.9
v3.6.8
v3.6.7
v3.7-beta1
v3.6.6
v3.6.5
v3.6.4
v3.6.3
v3.6.2
v3.6.1
v3.6.0
v3.5.9
v3.6-beta2
v3.5.8
v3.6-beta1
v3.5.7
v3.5.6
v3.5.5
v3.5.4
v3.5.3
v3.5.2
v3.5.1
v3.5.0
v3.4.10
v3.4.9
v3.5-beta2
v3.4.8
v3.5-beta1
v3.4.7
v3.4.6
v3.4.5
v3.4.4
v3.4.3
v3.4.2
v3.4.1
v3.4.0
v3.3.10
v3.3.9
v3.4-beta1
v3.3.8
v3.3.7
v3.3.6
v3.3.5
v3.3.4
v3.3.3
v3.3.2
v3.3.1
v3.3.0
v3.2.9
v3.2.8
v3.3-beta2
v3.2.7
v3.3-beta1
v3.2.6
v3.2.5
v3.2.4
v3.2.3
v3.2.2
v3.2.1
v3.2.0
v3.1.11
v3.1.10
v3.2-beta2
v3.1.9
v3.2-beta1
v3.1.8
v3.1.7
v3.1.6
v3.1.5
v3.1.4
v3.1.3
v3.1.2
v3.1.1
v3.1.0
v3.0.12
v3.0.11
v3.0.10
v3.1-beta1
v3.0.9
v3.0.8
v3.0.7
v3.0.6
v3.0.5
v3.0.4
v3.0.3
v3.0.2
v3.0.1
v3.0.0
v2.11.12
v3.0-beta2
v2.11.11
v2.11.10
v3.0-beta1
v2.11.9
v2.11.8
v2.11.7
v2.11.6
v2.11.5
v2.11.4
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.10
v2.10.9
v2.11-beta1
v2.10.8
v2.10.7
v2.10.6
v2.10.5
v2.10.4
v2.10.3
v2.10.2
v2.10.1
v2.10.0
v2.9.11
v2.10-beta2
v2.9.10
v2.10-beta1
v2.9.9
v2.9.8
v2.9.7
v2.9.6
v2.9.5
v2.9.4
v2.9.3
v2.9.2
v2.9.1
v2.9.0
v2.9-beta2
v2.8.9
v2.9-beta1
v2.8.8
v2.8.7
v2.8.6
v2.8.5
v2.8.4
v2.8.3
v2.8.2
v2.8.1
v2.8.0
v2.7.12
v2.7.11
v2.7.10
v2.7.9
v2.7.8
v2.7.7
v2.7.6
v2.7.5
v2.7.4
v2.7.3
v2.7.2
v2.7.1
v2.7.0
v2.6.12
v2.6.11
v2.6.10
v2.6.9
v2.7-beta1
Solcon-2020-01-06
v2.6.8
v2.6.7
v2.6.6
v2.6.5
v2.6.4
v2.6.3
v2.6.2
v2.6.1
v2.6.0
v2.5.13
v2.5.12
v2.6-beta1
v2.5.11
v2.5.10
v2.5.9
v2.5.8
v2.5.7
v2.5.6
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.9
v2.5-beta2
v2.4.8
v2.5-beta1
v2.4.7
v2.4.6
v2.4.5
v2.4.4
v2.4.3
v2.4.2
v2.4.1
v2.4.0
v2.3.7
v2.4-beta1
v2.3.6
v2.3.5
v2.3.4
v2.3.3
v2.3.2
v2.3.1
v2.3.0
v2.2.10
v2.3-beta2
v2.2.9
v2.3-beta1
v2.2.8
v2.2.7
v2.2.6
v2.2.5
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.6
v2.2-beta2
v2.1.5
v2.2-beta1
v2.1.4
v2.1.3
v2.1.2
v2.1.1
v2.1.0
v2.0.10
v2.1-beta1
v2.0.9
v2.0.8
v2.0.7
v2.0.6
v2.0.5
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v2.0-beta3
v1.9.6
v1.9.5
v2.0-beta2
v1.9.4-r1
v1.9.3
v2.0-beta1
v1.9.2
v1.9.1
v1.9.0-r1
v1.8.4
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.7.3
v1.7.2-r1
v1.7.1
v1.7.0
v1.6.3
v1.6.2-r1
v1.6.1-r1
1.6.1
v1.6.0
v1.5.2
v1.5.1
v1.5.0
v1.4.2
v1.4.1
v1.4.0
v1.3.2
v1.3.1
v1.3.0
v1.2.2
v1.2.1
v1.2.0
v1.1.0
v1.0.7-r1
v1.0.7
v1.0.6
v1.0.5
v1.0.4
v1.0.3-r1
v1.0.3
1.0.0
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/netbox#6999
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kvedder-amplex on GitHub (Sep 19, 2022).
NetBox version
v3.3.3
Feature type
Change to existing functionality
Proposed functionality
On our current routers, we can assign multiple VPLS circuits to a single interface. We cannot do this to VPWS interfaces. I would like to modify the restriction that limits a VPLS endpoint to a single instance/circuit.
Use case
It allows the modeling to align with the possibilities offered by vendors.
Database changes
I don't forsee any DB changes, I suspect modifying some python on model save is what restricts it to one circuit per endpoint currently. Changing the python to allow for more than one circuit if the type is VPLS shouldn't be awful. I am willing to put in the PR.
External dependencies
None.
@kvedder-amplex commented on GitHub (Sep 19, 2022):
I see this in the model.
This makes sense, as
L2VPNTypeChoices.P2Pincludes:The error I get is from:
@shatt79 commented on GitHub (Sep 19, 2022):
Here's the thing... by definition, a VPWS circuit is point-to-point. There is no MAC learning on a true VPWS circuit, so it can only be point-to-point. The ONLY types of virtual circuits that could qualify as VPWS are EPL and EVPL. EPLAN, EVPLAN, EPTREE and EVPTREE are point-to-multipoint circuits and would never be considered VPWS.
ALL VPWS circuits are either EPLAN or EVPLAN, but not all EPLAN or EVPLANs are VPWS. What determines that is the configuration on the device. On IOS-XR, a VPWS is built as a xconnect group. P2MPs are built as bridge-domains. You can absolutely build a P2P in a bridge-domain, but MAC learning will occur and by definition NOT be a VPWS.
So... the definitions in the model are wrong. It should say:
TYPE_VPWS,
TYPE_EPL,
TYPE_EVPL
TYPE VPLS,
TYPE_EPL,
TYPE_EVPL,
TYPE_EPTREE,
TYPE_EVPTREE,
TYPE_EPLAN,
TYPE_EVPLAN
@shatt79 commented on GitHub (Sep 19, 2022):
Also, if you want to use a single physical endpoint to terminate multiple virtual circuits, you must use a type of L2 circuit that begins with "EV", and you must use sub-interfaces. EPL, EP-TREE, and EP-LAN can only use physical ports as terminations.
EVPL, EVP-TREE, and EVPLs all use virtual/sub-interfaces with carrier ethernet tagging methods. Its what the MEF calls a multiplexed port. With this, you're not actually connecting the physical port to the L2VPN instance, but the logical/sub-interface. You can NOT attach a single physical or logical interface to multiple L2VPNs. Ever. Neither in Netbox or in the real world. Not without some intermediary device bridging the two LANs together.
@kvedder-amplex commented on GitHub (Sep 19, 2022):
Well, let me define that a bit more. I was specifically referring to a physical interface, not a logical one.
@shatt79 commented on GitHub (Sep 19, 2022):
So yeah... that's by design then. A single physical port cannot be a member of more than 1 L2VPN or VFI. That would be the equivalent of an access port being a member of two VLANs.
@kvedder-amplex commented on GitHub (Sep 19, 2022):
Then why am I currently using VPLS with multiple circuits configured on a single physical interface? I must be missing something.
Sanitized Config:
Ive seen the limitation you describe with VPWS, but not VPLS.
I am obviously not as familiar as you with all of the protocols and how they are designed. Go easy on me. I am more than willing to learn.
@baldgeek commented on GitHub (Sep 19, 2022):
We also output multiple VPLS vlans on a single physical ports. You
aren't doing anything unusual.
On 9/19/22 4:13 PM, kvedder-amplex wrote:
@DanSheps commented on GitHub (Sep 20, 2022):
What does your service template say?
It is likely defining a subint within that service template.
It would be weird for you to be terminating multiple VPLS' directly to the physical port, likely you are terminating to a service instance or subint.
@shatt79 commented on GitHub (Sep 20, 2022):
There has to be SOMETHING on the interface that identifies the unique traffic that belongs to specific L2VPNs/bridge-domains. Think about from an ingress perspective: How does the interface know what frames to place on each L2VPN/EVC/bridge-domain? In most cases, that is done through the matching of 1 or more VLAN tags.
This is the interesting part of your config:
mpls-vpls VPLS-LOCATION-1000 service-template VPLS-LOCATION-1000
exit-if-vpls
mpls-vpls VPLS-BNG1 service-template VPLS-BNG1
exit-if-vpls
The interface is referencing two different service templates. What is defined by those templates? I'll bet that if you dig into the config you'll find them and there will be unique VLAN/tagging information for each. It'll probably have something like a "match" command. Eg, "match outer tag 123" or something along those lines.
Even though the config is a little bit different than the traditional Cisco/sub-interface model, its still essentially multiple virtual interfaces under the single physical interface.
Here are three examples of how different vendors do this. There are two from Cisco, and one from another vendor that appears to be what you're using:
Cisco IOS-XR model (sub-interfaces):
interface gi0/0/0/0
mtu 9216
no shut
!
interface gi0/0/0/0.10 l2transport
encapsulation dot1q 10
rewrite ingress tag pop 1 symmetric
!
interface gi0/0/0/0.20 l2transport
encapsulation dot1q 20 second-dot1q 5
rewrite ingress tag pop 2 symmetric
!
l2vpn
bridge-group L2VPNs
bridge-domain CUSTOMER_ABC
interface gi0/0/0/0.10
neighbor 10.20.30.40 pw-id 12345 encapsulation mpls
!
bridge-domain CUSTOMER_XYZ
interface gi0/0/0/0.20
neighbor 10.20.30.40 pw-id 67890 encapsulation mpls
Cisco IOS-XE model (service instances):
interface gi0/0/0
mtu 9216
no shut
service-instance 10 ethernet
encapsulation dot1q 10
rewrite ingress tag pop 1 symmetric
bridge-domain 20
service instance 20 ethernet
encapsulation dot1q 20 second-dot1q 5
rewrite ingress tag pop 2 symmetric
bridge-domain 20
!
l2 vfi CUSTOMER_ABC manual
vpn id 12345
bridge-domain 10
neighbor 10.20.30.40 12345
!
l2 vfi CUSTOMER_XYZ manual
Your model (service templates):
interface ge2
mtu 9216
switchport
mpls-vpls VPLS-LOCATION-1000 service-template VPLS-LOCATION-1000
exit-if-vpls
mpls-vpls VPLS-BNG1 service-template VPLS-BNG1
exit-if-vpls
!
service-template VPLS-LOCATION-1000
match outer-vlan 10
rewrite ingress pop outgoing-tpid dot1q
!
service-template VPLS-BNG1
match double-tag outer-vlan 20 inner-vlan 5
rewrite ingress pop outgoing-tpid dot1q
Same config, different vendors. But its exactly what I stated before: multiple logical interfaces under a common physical interface. The vendors just handle them a bit differently. You simply can NOT have multiple L2VPNs/broadcast domains terminate to a single physical port. You just can't. It violates all the rules of ethernet and L2 switching. Think about it: If you had multiple L2VPN/bridge-domains terminating to a single physical port, then every one of your customers attached to that physical port would be receiving copies of every frame on every L2VPN/EVC terminating to that port. I won't even talk about the loops you'd have...
@vincentschuele commented on GitHub (Sep 20, 2022):
I believe the request is to map VPLS/VPWS instances to subinterfaces on one physical port. This is supported on most vendors.
@DanSheps commented on GitHub (Sep 20, 2022):
Sub-interfaces are already available for assignment for specifically the reasons stated above by @shatt79
@DanSheps commented on GitHub (Sep 20, 2022):
So, I did a little research on the config.
It appears this is for microtik.
Here would be a full config:
How this should be modelled in NetBox:
(1) Physical Interface (xe2 as a tagged port)
(1+) Virtual Interfaces (x2.10, tagged port with vid 10 as the allowed tag -- tagged/untagged could all be viable here)
(1) VPLS L2VPN: TEST, Identifier: 10
(1+) L2VPN Termination (Interface xe2.10)
All this being said, I do not believe this is a valid FR as it does not meet real-world implementation details. I am going to convert this to a discussion.