Port Cross-Connect

The following describes Port Cross-Connect (PXC) terminology:

• PXC

  PXC is a software concept representing a pair of logical ports interconnecting egress and ingress forwarding paths within the same forwarding complex.

  The physical underpinning of a PXC can be either of the following:

  • a faceplate (physical) port in a loopback mode

    The PXC is referred to as a port-based PXC. Multiple PXCs can be created per a faceplate port.

  • a loopback configuration in the MAC chip

    The PXC is referred to as an internal or MAC-based PXC. Multiple PXCs can be created per MAC loopback.

• PXC sub-port

  PXC sub-port is a logical port that is created under the PXC. Two interconnected PXC sub-ports are created per PXC. This is further described in Port-based PXC.

• Forwarding Complex (FC)

  FC is a chipset connected to a set of faceplate ports that processes traffic in the ingress direction (the ingress path) and the egress direction (the egress path). A line card can contain multiple FCs for increased throughput, while the inverse is not true, a single FC cannot be distributed over multiple line cards.

  The terms cross-connect and loopback can be used interchangeably.

This section describes the PXC feature implementation. PXC is a software concept representing a pair of logical ports interconnecting egress and ingress forwarding paths within the same forwarding complex (FC). In cross-connect functionality, an egress forwarding path is looped back to the ingress forwarding path on the same forwarding complex instead of leading out of the system.

The cross-connect is modeled in the system and in the CLI as a port, appropriately naming the feature Port Cross-Connect (PXC) software concept representing a pair of logical ports interconnecting egress and ingress forwarding paths within the same forwarding complex.

Conceptually, PXC functionality is similar to the functionality provided by two externally interconnected faceplate ports where traffic exits the system through one port (the egress path) and is immediately looped back into another port (the ingress path) through a cable.

Traffic preprocessing using PXC shows the traffic flow from the first to the second stage through a cross-connect in a system with PXC:

1. Traffic entering a node through a faceplate port is processed by the local ingress forwarding path (1) on the line cards 1 and 2. Traffic is then directed toward the PXC (3) on the line card 3.

2. The PXC (3) loops the traffic from the local egress path (2) into the local ingress forwarding path (4) where it is further processed.

The concept of a port-based PXC (a PXC based on a faceplate port in loopback mode) is shown in Port-based PXC. This PXC does not require an optical transceiver.

[ex:/configure]
A:admin@node-2# info
   port-xc {
        pxc 1 {
            admin-state enable
            port-id 1/1/c1/1 
        }
    }

A:node-2>config>port-xc# info
----------------------------------------------
        pxc 1 create
            port 1/1/c1/1 
            no shutdown
        exit
    exit
----------------------------------------------

[ex:/configure]
A:admin@node-2# info
    port-xc {
        pxc 1 {
            admin-state enable
            port-id 1/1/c1/1 
        }
        pxc 2 {
            admin-state enable
            port-id 1/1/c2/1 
        }
        pxc 3 {
            admin-state enable
            port-id 1/1/c3/1 
        }
    }

A:node-2>config>port-xc# info
----------------------------------------------
        pxc 1 create
            port 1/1/c1/1 
            no shutdown
        exit
        pxc 2 create
            shutdown
            port 1/1/c2/1 
        exit
        pxc 3 create
            shutdown
            port 1/1/c3/1 
        exit
    exit

Two cross-connected external ports versus a single cross-connect displays the benefit of PXC sub-ports on top of the cross-connect, which is analogous to two distinct faceplate ports that are connected by a fiber cable.

Bidirectional connectivity provided by PXC requires two sub-ports, one in each direction. The router uses these PXC sub-ports as logical configurations to transmit traffic in both directions over a half-duplex (one-way) cross-connect created in the system. As a result, the total bandwidth capacity supported by the mated PXC sub-ports is limited by the bandwidth capacity of the underlying cross-connect (a single faceplate port or a MAC loopback).

For example, if a 10 Gb/s faceplate port is allocated for PXC functions, the sum of downstream and upstream traffic on the mated PXC sub-ports is always less than or equal to 10 Gb/s. The bandwidth distribution is flexible; it can be symmetric (5 Gb/s downstream and 5 Gb/s upstream), or asymmetric (9 Gb/s downstream and 1 Gb/s upstream, 8 Gb/s downstream and 2 Gb/s upstream, or any other downstream and upstream distribution combination). Therefore, the faceplate port speed from the PXC perspective is half-duplex.

Similar logic can be followed for MAC-based PXC, with two key differences:

• The bandwidth (for example, 100 Gb/s) is configured under the MAC loopback and there is no need to allocate an additional faceplate port.

• PXC traffic is not reserved as part of the faceplate port bandwidth, as it is in the port-based PXC where a faceplate port is reserved only for PXC traffic. Instead, the PXC traffic is added to the traffic from the faceplate ports even in situations where all faceplate ports are 100% used, potentially oversubscribing the forwarding complex.

After the faceplate port or the port based on MAC loopback is associated with a PXC ID, a pair of mated PXC sub-ports is automatically created in the classic CLI by the SR OS.

In MD-CLI, the user must manually create the sub-ports.

The sub-ports must be explicitly enabled. Use the following commands to enable the subports:

• MD-CLI

  admin-state enable

• classic CLI

  no shutdown

The two PXC sub-ports are distinguishable by ‟.a” and ‟.b” suffixes. They transmit traffic toward each other, simulating two ports that are interconnected.

Although, the most PXC sub-ports command options are configurable, specific command options are fixed and cannot be changed. For example, PXC sub-ports are created in a hybrid mode and this cannot be modified.

Each PXC sub-port is internally (within the system) represented by an internal four-byte VLAN tag which is not visible to the user. Therefore, traffic carried over the PXC contains four extra bytes, which must be accounted for in the QoS configured on PXC sub-ports.

[ex:/configure port-xc]
A:admin@node-2# info
    pxc 1 {
        admin-state enable
        port-id 1/1/c1/1
    }
    pxc 2 {
        admin-state enable
        port-id 1/1/c2/1
    }

A:node-2>config>port-xc# info
----------------------------------------------
        pxc 1 create
            port 1/1/c1/1
            no shutdown
        exit
        pxc 2 create
            port 1/1/c2/1
            no shutdown
        exit
----------------------------------------------

[ex:/configure]
A:admin@node-2# info
...
    port pxc-1.a {
    }
    port pxc-1.b {
    }
    port pxc-2.a {
    }
    port pxc-2.b {
    }

A:node-2# admin display-config
...
#--------------------------------------------------
echo "Port Configuration"
#--------------------------------------------------
    port pxc-1.a
        exit
    exit
    port pxc-1.b
        exit
    exit
    port pxc-2.a
        exit
    exit
    port pxc-2.b
        exit
    exit

Bandwidth consumed by PXCs based on faceplate ports correlates with the faceplate’s port capacity. Because each PXC allocates a faceplate port for exclusive use, the PXC capacity cannot exceed the card capacity that is already allocated for the faceplate ports. In other words, a PXC based on a faceplate port does not add any additional bandwidth to the forwarding complex.

The bandwidth management in the PXC environment is performed through existing QoS mechanisms.

A port under a PXC (for example, port 1/1/c1/1 ), the PXC itself (PXC ID represented by the cross-connect port configuration port-xc pxc 1), and PXC sub-ports (for example, port pxc-1.a and pxc-1.b) all have administrative and operational states.

For a port-based PXC, when all layers of a PXC (PXC port, PXC ID, and PXC sub-ports) are operationally up, the faceplate port status LED on the faceplate blinks amber. The port activity LED lights green in the presence of traffic on PXC ports and turns off in the absence of traffic on PXC ports. The presence of the optical transceiver on the PXC has no effect on its operational state. Traffic cannot be sent out through the transceiver or be received through the transceiver from the outside. However, the existing traps related to insertion or removal of a transceiver (SFF Inserted/Removed) are supported. The "Signal-Fail" alarm on the PXC is suppressed.

The operational state of the PXC ID is derived from its administrative state and the operational state of the sub-ports.

The operational state of the PXC sub-ports is dependent on the operational state of the underlying port and the administrative state of the corresponding PXC ID.

Two types of statistics can be collected on a regular, non-PXC Ethernet port:

• Low-level port statistics which provide information about conditions on the data-link layer and physical port, for example, the aggregate number of forwarded and dropped octets or bytes on the data-link layer (Layer 2 MAC), FCS errors, number of collisions, and so on. These statistics can be viewed with the show port command.

• Network-level statistics provide information about forwarded and dropped octets or packets on a per-queue level on network ports. These statistics can be viewed with the show port detail command.

PXC sub-ports can be aggregated into a PXC LAG for increased capacity and card redundancy. A logical concept of a PXC LAG is shown in Logical concept of a LAG on PXC ports.

Although the configuration allows for a mix of port-based PXCs and MAC-based PXCs in a LAG, the configuration should be used in a production network only during a short migration period when transitioning from one type of PXC to the other. Outside of the migration, the PXCs in a LAG should be of the same type, for example, a LAG should contain only port-based PXCs or only MAC-based PXCs but not both.

The LAGs on PXC ports must be configured in pairs as shown in the following example.

[ex:/configure]
A:admin@node-2# info
...
    lag "lag-1" {
        description "lag in the up direction"
        port pxc-1.a {
        }
        port pxc-2.a {
        }
    }
    lag "lag-2" {
        description "lag in the down direction"
        port pxc-1.b {
        }
        port pxc-2.b {
        }
    }

A:node-2# configure lag 1
A:node-2>config>lag$ info
----------------------------------------------
        description "lag in the up direction"
        port pxc-1.a
        port pxc-2.a
----------------------------------------------
A:node-2# configure lag 2
A:node-2>config>lag$ info
----------------------------------------------
        description "lag in the down direction"
        port pxc-1.b
        port pxc-2.b
        no shutdown
----------------------------------------------

The CLI configuration flow example shown in the following figures represents a PXC configuration based on the faceplate port. The oval marked ‟User” represents a configuration step that the user must perform. The block marked ‟Dynamic” represents a step that the system performs automatically without a user’s assistance.

Traffic on a PXC sub-port can be mirrored or lawfully intercepted (LI). For example, subscriber ‟Annex1” traffic arriving on a PXC sub-port is mirrored if ‟Annex1” is configured as a mirror or LI source. A PXC sub-port can also be used to transmit mirror and LI traffic out from a mirror-destination service (such as a mirror-dest SAP or SDP can egress out a PXC sub-port, or a routable LI encapsulated packet can be forwarded and transmitted out a PXC sub-port).

A mirror destination can be configured to transmit mirrored and LI traffic out of a SAP on a PXC sub-port that is then cross connected into a VPLS service where a VXLAN encapsulation is added to the mirrored packets before transmission out of the node.

The internal Q-tag that represents the PXC sub-port within the system is included in the lawfully intercepted copy of the packet for traffic intercepted (mirrored) on the ingress side of a PXC sub-port, when the associate mirror-dest service is of type ether (the default) with routable lawful interception encapsulation in the following context.

Use the following command to configure a mirror destination to transmit mirrored and LI traffic from a SAP on a PXC sub-port.

configure mirror mirror-dest encap

See the 7705 SAR Gen 2 OAM and Diagnostics Guide for information about LI.

The following example shows how a PXC port is used to transport an Epipe service over IPsec tunnels when the 7705 SAR Gen 2 is operating as an IPsec SecGW head-end router (for example, when aggregating Epipes over IPsec from a group of 7705 SAR-Hm series of routers). The Epipe service uses GRE transport, where this network egress traffic is sent over the PXC port and into a VPRN SAP configured on the other side of the PXC port. The VPRN SAP ingress traffic is routed over the relevant IPsec tunnel to reach the respective 7705 SAR-Hm series router that terminates the Epipe, using its own VPRN and PXC port to terminate the IPsec tunnel and GRE transport packets.

[ex:/configure]
A:admin@node-2# info
...
    card 1 {
        mda 2 {
            mda-type isa-tunnel-v
        }
        mda 3 {
            mda-type isa-bb-v
        }
    }
    port 1/1/c10 {
        admin-state enable
        connector {
            breakout c1-10g
        }
    }
    port 1/1/c10/1 {
        admin-state enable
        ethernet {
            mode hybrid
        }
    }
    port 1/1/c11 {
        admin-state enable
        connector {
            breakout c1-1g
        }
    }
    port 1/1/c11/1 {
        admin-state enable
        ethernet {
            mode hybrid
        }
    }
    port 1/1/c12 {
        admin-state enable
        connector {
            breakout c1-1g
        }
    }
    port 1/1/c12/1 {
        admin-state enable
        ethernet {
            mode access
            encap-type dot1q
        }
    }
...

[ex:/configure]
A:admin@node-2# info
...
    card 1
        card-type iom-sar
        mda 1
            mda-type m10-sfp++6-sfp
            no shutdown
        exit
        mda 2
            mda-type isa-tunnel-v
            no shutdown
        exit
    exit
    port 1/1/c10
        connector
            breakout c1-10g
        exit
        no shutdown
    exit
    port 1/1/c11
        connector
            breakout c1-1g
        exit
        no shutdown
    exit
    port 1/1/c12
        connector
            breakout c1-1g
        exit
        no shutdown
    exit
    port 1/1/c10/1
        ethernet
            mode hybrid
        exit
        no shutdown
    exit
    port 1/1/c11/1
        ethernet
            mode hybrid
            encap-type dot1q
        exit
        no shutdown
    exit
    port 1/1/c12/1
        ethernet
            mode access
            encap-type dot1q
        exit
        no shutdown
    exit
...

[ex:/configure port-xc]
A:admin@node-2# info
    pxc 1 {
        admin-state enable
        port-id 1/1/c10/1
    }
    port pxc-1.a {
        admin-state enable
        description "VPRN for IPsec; SAP private interface configured here" 
    }
    port pxc-1.b {
        admin-state enable
        description "GRE orig/term PXC side; NW interface will be configured here"
    }

A:node-2>config>port-xc# info
----------------------------------------------
        pxc 1 create
            port 1/1/c10/1
            no shutdown
        exit
A:node-2>config# info
...
    port pxc-1.a
        description "VPRN for IPsec; SAP private interface configured here" 
        ethernet
        exit
        no shutdown
    exit
    port pxc-1.b
        description "GRE orig/term PXC side; NW interface will be configured here"
        ethernet
        exit
        no shutdown
    exit
...
----------------------------------------------

A:admin@node-2>config>router# info
...
        interface "toVPRN100" {
            port pxc-1.b:200
            ipv4 {
                primary {
                    address 200.200.200.1
                    prefix-length 30
                    gre-termination true
                }
            }
        }
...

A:admin@node-2>config>router# info
...
        interface "toVPRN100"
            address 200.200.200.1/30 gre-termination
            port pxc-1.b:200
            no shutdown
        exit
...

[ex:/configure service]
A:admin@node-2# info
...
        pw-template "3084" {
            allow-fragmentation true
            auto-gre-sdp true
        }
        epipe "VLL-Hmc03" {
            admin-state enable
            service-id 10573
            customer "1"
            bgp 1 {
                route-distinguisher "65001:10573"
                route-target {
                    export "target:65001:10573"
                    import "target:65001:10573"
                }
                pw-template-binding "3084" {
                }
            }
            bgp-vpws {
                admin-state enable
                local-ve {
                    name "HEAD-END"
                    id 8432
                }
                remote-ve "Hmc" {
                    id 3284
                }
            }
            sap 1/1/c12/1:1101 {
            }
        }
        ies "10" {
            admin-state enable
            customer "1"
            interface "public-100" {
                sap tunnel-1.public:2 {
                    ipsec-gateway "gw-vprn-100" {
                        admin-state enable
                        default-tunnel-template 2
                        ike-policy 2
                        pre-shared-key "HUWumavMAgAr6Q6r7PYdDEO1aJC8 hash2"
                        default-secure-service {
                            service-name "VPRN_100"
                            interface "Int-private-100"
                        }
                        local {
                            gateway-address 10.107.2.1
                        }
                    }
                }
                ipv4 {
                    primary {
                        address 10.107.2.0
                        prefix-length 31
                    }
                }
            }
        }
        vprn "VPRN_100" {
            admin-state enable
            service-id 100
            customer "1"
            autonomous-system 65001
            ipsec {
                security-policy 1 {
                    entry 10 {
                        local-ip {
                            any true
                        }
                        remote-ip {
                            any true
                        }
                    }
                }
            }
            interface "Int-private-100" {
                tunnel true
                sap tunnel-1.private:2 {
                }
            }
            interface "toGRT" {
                ipv4 {
                    primary {
                        address 200.200.200.2
                        prefix-length 30
                    }
                }
                sap pxc-1.a:200 {
                }
            }
            static-routes {
                route 100.100.100.0/24 route-type unicast {
                    description "to 7705 SAR-Hm series routers"
                    interface "Int-private-100" {
                        admin-state enable
                    }
                }
            }
        }
    }
...

A:node-2>config>service$ info
...
        pw-template 3084 name "3084" auto-gre-sdp create
            allow-fragmentation
        exit
        ies 10 name "10" customer 1 create
            interface "public-100" create
            exit
        exit
        vprn 100 name "VPRN_100" customer 1 create
            interface "toGRT" create
            exit
            interface "Int-private-100" tunnel create
            exit
        exit
        ies 10 name "10" customer 1 create
            interface "public-100" create
                address 10.107.2.0/31
                tos-marking-state untrusted
                sap tunnel-1.public:2 create
                    ipsec-gw "gw-vprn-100"
                        default-secure-service name "VPRN_100" interface "Int-private-100"
                        default-tunnel-template 2
                        ike-policy 2
                        local-gateway-address 10.107.2.1
                        pre-shared-key "HUWumavMAgAr6Q6r7PYdDEO1aJC8" hash2
                        no shutdown
                    exit
                exit
            exit
            no shutdown
        exit
        vprn 100 name "VPRN_100" customer 1 create
            ipsec
                security-policy 1 create
                    entry 10 create
                        local-ip any
                        remote-ip any
                    exit
                exit
            exit
            autonomous-system 65001
            interface "toGRT" create
                address 200.200.200.2/30
                sap pxc-1.a:200 create
                exit
            exit
            interface "Int-private-100" tunnel create
                sap tunnel-1.private:2 create
                exit
            exit
            static-route-entry 100.100.100.0/24
                next-hop "Int-private-100"
                    no shutdown
                exit
            exit
            no shutdown
        exit
        epipe 10573 name "VLL-Hmc03" customer 1 create
            service-mtu 1614
            bgp 1
                route-distinguisher 65001:10573
                route-target export target:65001:10573 import target:65001:10573
                pw-template-binding 3084
                exit
            exit
            bgp-vpws
                ve-name "HEAD-END"
                    ve-id 8432
                exit
                remote-ve-name "Hmc"
                    ve-id 3284
                exit
                no shutdown
            exit
            sap 1/1/c12/1:1101 create
                no shutdown
            exit
            no shutdown
        exit
    exit
----------------------------------------------