Troubleshooting segment routing

Troubleshooting EVPN VPWS over SRv6

Troubleshooting EVPN VPWS over SRv6 BE traffic forwarding failure

Symptom

In an EVPN VPWS over SRv6 network, traffic forwarding fails in SRv6 BE mode.

Common causes

The following are the common causes of this type of issue:

·     The BGP EVPN peers are not successfully established.

·     The EVPN instance configurations do not match on both ends.

·     The AC interface state is not up, or the AC access methods configured on both ends are different.

·     The EVPN route cannot be steered to the SRv6 BE tunnel.

Analysis

Figure 1 shows the troubleshooting flowchart.

Figure 1 Flowchart for troubleshooting EVPN VPWS over SRv6 BE traffic forwarding failure

 

Solution

To resolve the issue:

1.     Verify that the BGP EVPN peers are successfully established.

Execute the display bgp peer l2vpn evpn command on the local PE to verify that the BGP EVPN peers have been successfully established.

¡     If the State field in the output information is Established, the BGP EVPN peers have been successfully established between the PEs. If the condition exists, proceed to step 2.

¡     If the condition does not exist, resolve the issue of BGP EVPN peer establishment failure. For more information, see the analysis for locating the BGP peer establishment failure.

<PE1> display bgp peer l2vpn evpn

 

 BGP local router ID: 1.1.1.1

 Local AS number: 100

 Total number of peers: 1                 Peers in established state: 1

 

 * - Dynamically created peer

 Peer                    AS  MsgRcvd  MsgSent OutQ  PrefRcv Up/Down  State

 

 2::2                   100       13       10    0        2 00:00:05 Established

2.     Verify that the EVPN VPWS over SRv6 configurations on both PEs match.

In the EVPN VPWS over SRv6 network, the Route Target and Service ID settings on both ends must match. The encapsulation method used by EVPN must be SRv6. In addition, the MTU, control word, and SRv6 PW data encapsulation type settings must be the same.

Verify that the configurations on both PEs match by following these steps:

a.     Execute the display this command in cross-connect group view of the two PEs to check the encapsulation method and Route Target of EVPN. If the encapsulation method is not SRv6, execute the evpn encapsulation srv6 command in cross-connect group view to modify the encapsulation method. If the Export RT value of one PE is not within the Import RT value range of the other PE, execute the vpn-target command in cross-connect group EVPN instance view to edit the RT value, so that the RTs of the two PEs match.

<PE1> system-view

[PE1] xconnect-group vpna

[PE1-xcg-vpna] display this

#

xconnect-group vpna

 evpn encapsulation srv6

  route-distinguisher 1:1

  vpn-target 1:1 export-extcommunity

  vpn-target 1:1 import-extcommunity

 connection abc

  segment-routing ipv6 locator aaa

  evpn local-service-id 1 remote-service-id 2

  ac interface gigabitethernet 2/0/1

#

return

b.     Execute the display evpn route xconnect-group command on both PEs to view the Service ID, MTU, and control word information.

-     Service ID: The local service ID on one PE must be the same as the remote service ID on the other PE. If they are different, the SRv6 PW cannot be established. If the service IDs do not match, you need to execute the evpn local-service-id remote-service-id command in cross-connect view of the PE to edit the local service ID or remote service ID for them to match each other.

-     MTU: View the local MTU value through the Local MTU field. If the MTU values of both ends are different, you need to edit the MTU value by executing the mtu command in cross-connect view. If the MTU value on one PE is 0, it can match any MTU value on the remote PE, and you do not need to edit the MTU.

-     Control word: The control word settings on both PEs must be identical. If the Flags field value does not include C, the control word feature is not enabled. Otherwise, the control word feature is enabled. If the control word settings on both PEs are different, you need to modify the control word configuration in the PW template specified for the SRv6 PW with the control-word enable command.

<PE1> display evpn route xconnect-group

Ctrl Flags: P - Primary, B - Backup, C - Control word

Xconnect group name: vpna

 Connection name: pw1

  Encapsulation       : SRv6

  ESI                 : 0000.0000.0000.0000.0000

  Local service ID    : 1

  Remote service ID   : 2

  In SID[DX2]         : 100::1:0:2

  In SID[DX2L]        : -

  Local MTU           : 1500

  AC State            : Up

  Tunnel policy       : -

  PW class            : -

  PW type             : Ethernet

  SRv6 Tunnel:

    Next Hop          : 2::2

    ESI               : 0000.0000.0000.0000.0000

    Out SID           : 200::1:0:2

    Flags             : P

    MTU               : 1500

    State             : Up

If the settings on both PEs match but the issue persists, proceed to the next step.

3.     Verify that the AC interface is up.

Execute the display evpn route xconnect-group command on the PE to view the state of the AC. If the AC is in down state, check the network connection and resolve the physical link down issue.

<PE1> display evpn route xconnect-group

Ctrl Flags: P - Primary, B - Backup, C - Control word

 

Xconnect group name: vpna

 Connection name: pw1

  Encapsulation       : SRv6

  ESI                 : 0000.0000.0000.0000.0000

  Local service ID    : 1

  Remote service ID   : 2

  In SID[DX2]         : 100::1:0:2

  In SID[DX2L]        : -

  Local MTU           : 1500

  AC State            : Up

  SRv6 Tunnel:

    Next Hop          : 2::2

    ESI               : 0000.0000.0000.0000.0000

    Out SID           : 200::1:0:2

    Flags             : P

    MTU               : 1500

    State             : Up

4.     Verify that the AC access modes on both PEs are consistent.

Execute the display l2vpn forwarding ac verbose command on both PEs to check the AC access mode. If the two ends use different AC access modes, traffic forwarding might fail. You need to modify the AC access mode through the access-mode keyword of the ac interface command in cross-connect view.

<PE1> display l2vpn forwarding ac verbose

Xconnect-group Name: vpws1

 Connection Name: actopw

  Interface: GE2/0/1

    Link ID         : 1

    Access Mode     : Ethernet

  Interface: GE2/0/3

    Link ID         : 1

    Access Mode     : Ethernet

    Reflector    :

      IP Address    : 100.1.1.4

      MAC Address   : 8850-fc51-5cee

      Src Port      : 200

      Dst Port      : 201

5.     Verify that the EVPN route is steered to the SRv6 BE tunnel.

Execute the display l2vpn peer srv6 verbose command on the PE to examine the SRv6 BE tunnel to which the EVPN route is steered.

<PE1> display l2vpn peer srv6 verbose

 

Xconnect-group Name: vpna

 Connection Name: pw1

  Peer: 2::2

   Remote Service ID             : 2

   Signaling Protocol            : EVPN

   Link ID                       : 0x1

   Sub Link ID                   : 0x0

   SRv6 Tunnel State             : Up

   In SID                        : 100::1:0:2

   Out SID                       : 200::1:0:2

   MTU                           : 1500

   SRv6 Tunnel Attributes        : Main

   Tunnel Group ID               : 0x1000000030080000

   Tunnel NHLFE IDs              : -

   Nexthop/Interface             : FE80::7A6F:24FF:FE26:306 / GE2/0/2  

   Color                         : -

   Color-Only                    : -

   Recursion Mode                : SID based

¡     If the Nexthop/Interface field has a value, the EVPN route is steered to the SRv6 BE tunnel. Execute the display ipv6 fib command to identify whether the forwarding information of the next hop address in the output information is accurate. If it is not accurate, contact technical support.

<PE1> display ipv6 fib FE80::7A6F:24FF:FE26:306

FIB entry count: 1

 

Flag:

  U:Usable   G:Gateway   H:Host   B:Blackhole   D:Dynamic   S:Static

  R:Relay     F:FRR

 

Destination: FE80::                                         Prefix length: 10

Nexthop    : ::                                             Flags: U

Time stamp : 0x1                                            Label: Null

Interface  : InLoop0                                        Token: Invalid

¡     If the value of the Nexthop/Interface field is a hyphen (-), the EVPN route is not steered to the SRv6 BE tunnel. Execute the display ipv6 routing-table command to verify that a route is available to the SRv6 SID. If no such an IPv6 route exists, resolve the IGP route learning issue. For more information, see the Layer 3 IP routing troubleshooting guide.

<PE1> display ipv6 routing-table 200::1:0:2

 

Summary count : 1

 

Destination: 200::/64                                    Protocol  : O_INTRA

NextHop    : FE80::7A6F:24FF:FE26:306                    Preference: 10

Interface  : GE2/0/2                                     Cost      : 2

6.     If the issue persists, collect the following information and contact Technical Support:

¡     Results of each step.

¡     The configuration file, log messages, and alarm messages.

Related alarm and log messages

Alarm messages

N/A

Log messages

N/A

Troubleshooting EVPN VPWS over SRv6 TE traffic forwarding failure

Symptom

In the EVPN VPWS over SRv6 network, traffic forwarding through an SRv6 TE policy fails in SRv6 TE mode.

Common causes

The following are the common causes of this type of issue:

·     The BGP EVPN peers are not successfully established.

·     The EVPN instance configurations do not match on both ends.

·     The AC interface state is not up, or the AC access methods configured on both ends are different.

·     Traffic steering in SRv6 TE mode is not configured.

·     The EVPN route cannot be steered to the SRv6 TE policy.

Analysis

Figure 2 shows the troubleshooting flowchart.

Figure 2 Flowchart for troubleshooting EVPN VPWS over SRv6 TE policy traffic forwarding failure

 

Solution

To resolve the issue:

1.     Verify that the BGP EVPN peers are successfully established.

Execute the display bgp peer l2vpn evpn command on the local PE to verify that the BGP EVPN peers have been successfully established.

¡     If the State field in the output information is Established, the BGP EVPN peers have been successfully established between the PEs. If the condition exists, proceed to step 2.

¡     If the condition does not exist, resolve the issue of BGP EVPN peer establishment failure. For more information, see the analysis for locating the BGP peer establishment failure.

<PE1> display bgp peer l2vpn evpn

 

 BGP local router ID: 1.1.1.1

 Local AS number: 100

 Total number of peers: 1                 Peers in established state: 1

 

 * - Dynamically created peer

 Peer                    AS  MsgRcvd  MsgSent OutQ  PrefRcv Up/Down  State

 

 2::2                   100       13       10    0        2 00:00:05 Established

2.     Verify that the EVPN VPWS over SRv6 configurations on both PEs match.

In the EVPN VPWS over SRv6 network, the Route Target and Service ID settings on both ends must match. The encapsulation method used by EVPN must be SRv6. In addition, the MTU, control word, and PW data encapsulation type settings must be the same.

Verify that the configurations on both PEs match by following these steps:

a.     Execute the display this command in cross-connect group view of the two PEs to check the encapsulation method and Route Target of EVPN. If the encapsulation method is not SRv6, execute the evpn encapsulation srv6 command in cross-connect group view to modify the encapsulation method. If the Export RT value of one PE is not within the Import RT value range of the other PE, execute the vpn-target command in cross-connect group EVPN instance view to edit the RT value, so that the RTs of the two PEs match.

<PE1> system-view

[PE1] xconnect-group vpna

[PE1-xcg-vpna] display this

#

xconnect-group vpna

 evpn encapsulation srv6

  route-distinguisher 1:1

  vpn-target 1:1 export-extcommunity

  vpn-target 1:1 import-extcommunity

connection abc

  segment-routing ipv6 locator aaa

  evpn local-service-id 1 remote-service-id 2

  ac interface gigabitethernet 2/0/1

#

return

b.     Execute the display evpn route xconnect-group command on both PEs to view the Service ID, MTU, and control word information.

-     Service ID: The local service ID on one PE must be the same as the remote service ID on the other PE. If they are different, the SRv6 PW cannot be established. If the service IDs do not match, you need to execute the evpn local-service-id remote-service-id command in cross-connect view of the PE to edit the local service ID or remote service ID for them to match each other.

-     MTU: View the local MTU value through the Local MTU field. If the MTU values of both ends are different, you need to edit the MTU value by executing the mtu command in cross-connect view. If the MTU value on one PE is 0, it can match any MTU value on the remote PE, and you do not need to edit the MTU.

-     Control word: The control word settings on both PEs must be identical. If the Flags field value does not include C, the control word feature is not enabled. Otherwise, the control word feature is enabled. If the control word settings on both PEs are different, you need to modify the control word configuration in the PW template specified for the SRv6 PW with the control-word enable command.

<PE1> display evpn route xconnect-group

Ctrl Flags: P - Primary, B - Backup, C - Control word

Xconnect group name: vpna

 Connection name: pw1

  Encapsulation       : SRv6

  ESI                 : 0000.0000.0000.0000.0000

  Local service ID    : 1

  Remote service ID   : 2

  In SID[DX2]         : 100::1:0:2

  In SID[DX2L]        : -

  Local MTU           : 1500

  AC State            : Up

  Tunnel policy       : -

  PW class            : -

  PW type             : Ethernet

  SRv6 Tunnel:

    Next Hop          : 2::2

    ESI               : 0000.0000.0000.0000.0000

    Out SID           : 200::1:0:2

    Flags             : P

    MTU               : 1500

    State             : Up

If the settings on both PEs match but the issue persists, proceed to the next step.

3.     Verify that the AC interface is up.

Execute the display evpn route xconnect-group command on the PE to view the state of the AC. If the AC is in down state, check the network connection and resolve the physical link down issue.

<PE1> display evpn route xconnect-group

Ctrl Flags: P - Primary, B - Backup, C - Control word

 

Xconnect group name: vpna

 Connection name: pw1

  Encapsulation       : SRv6

  ESI                 : 0000.0000.0000.0000.0000

  Local service ID    : 1

  Remote service ID   : 2

  In SID[DX2]         : 100::1:0:2

  In SID[DX2L]        : -

  Local MTU           : 1500

  AC State            : Up

  SRv6 Tunnel:

    Next Hop          : 2::2

    ESI               : 0000.0000.0000.0000.0000

    Out SID           : 200::1:0:2

    Flags             : P

    MTU               : 1500

    State             : Up

4.     Verify that the AC access modes on both PEs are consistent.

Execute the display l2vpn forwarding ac verbose command on both PEs to check the AC access mode. If the two ends use different AC access modes, traffic forwarding might fail. You need to modify the AC access mode through the access-mode keyword of the ac interface command in cross-connect view.

<PE1> display l2vpn forwarding ac verbose

Xconnect-group Name: vpws1

 Connection Name: actopw

  Interface: GE2/0/1

    Link ID         : 1

    Access Mode     : Ethernet

  Interface: GE2/0/3

    Link ID         : 1

    Access Mode     : Ethernet

    Reflector    :

      IP Address    : 100.1.1.4

      MAC Address   : 8850-fc51-5cee

      Src Port      : 200

      Dst Port      : 201

5.     Verify that traffic steering in SRv6 TE mode is configured.

In cross-connect group EVPN instance view, execute the display this command to verify that the segment-routing ipv6 traffic-engineering or segment-routing ipv6 traffic-engineering best-effort command is configured. If no such commands exist, configure the command. If the command exists, proceed to step 6.

<PE1> system-view

[PE1] xconnect-group vpna

[PE1-xcg-vpna] evpn encapsulation srv6

[PE1-xcg-vpna-evpn-srv6] display this

#

 evpn encapsulation srv6

  route-distinguisher 1:1

  vpn-target 1:1 export-extcommunity

  vpn-target 1:1 import-extcommunity

  segment-routing ipv6 traffic-engineering

#

return

6.     Verify that the EVPN route is steered to the SRv6 TE policy.

Execute the display l2vpn peer srv6 verbose command on the PE to examine the SRv6 TE policy to which the EVPN route is steered.

<PE1> display l2vpn peer srv6 verbose

Xconnect-group Name: vpna

 Connection Name: pw1

  Peer: 2::2

   Remote Service ID             : 2

   Signaling Protocol            : EVPN

   Link ID                       : 0x1

   Sub Link ID                   : 0x0

   SRv6 Tunnel State             : Up

   In SID                        : 100::1:0:2

   Out SID                       : 200::1:0:2

   MTU                           : 1500

   SRv6 Tunnel Attributes        : Main

   Tunnel Group ID               : 0x1000000230080001

   Tunnel NHLFE IDs              : 2150629377

   Nexthop/Interface             : -

   Color                         : 10

   Color-Only                    : 11

   Recursion Mode                : Nexthop based

¡     If the Tunnel NHLFE IDs field has a value, the EVPN route is steered to the SRv6 TE policy, and this value is the tunnel index of the SRv6 TE policy to which the EVPN route is steered. Execute the display segment-routing ipv6 te policy command on PE. If the Forwarding index field value is the same as the Tunnel NHLFE IDs field value, this SRv6 TE policy is the one to which the EVPN route is steered. Execute the display l2vpn forwarding srv6 verbose command on the PE, and identify whether the SRv6 Tunnel State field value is Up. If it is Down, contact technical support. If it is Up, verify that such issues exist as the SRv6 TE policy SID list and the packet forwarding path planning are different and a physical link becomes faulty on the SRv6 TE policy packet forwarding path. For how to resolve such issues, see the analysis for locating the issue that the SRv6 TE policy cannot take effect.

<PE1> display l2vpn forwarding srv6 verbose

Xconnect-group Name: vpna

 Connection Name: pw1

  Link ID                : 0x1

  SRv6 Tunnel Type       : Ethernet

  SRv6 Tunnel State      : Up

  In  SID                : 100::1:0:2

  Out SID                : 200::1:0:2

  MTU                    : 1500

  SRv6 Tunnel Attributes : Main

  SRv6 Forwarding IDs    : 2150629377

<PE1> display segment-routing ipv6 te policy

 

Name/ID: p1/0

 Color: 10

 End-point: 2::2

 Name from BGP:

 Name from PCE:

 BSID:

  Mode: Dynamic             Type: Type_2              Request state: Succeeded

  Current BSID: 100::1:0:1  Explicit BSID: -          Dynamic BSID: 100::1:0:1

 Reference counts: 5

 Flags: A/BS/NC

 Status: Up

 AdminStatus: Up

 Up time: 2022-05-13 18:53:48

 Down time: 2022-05-13 18:49:56

 Hot backup: Disabled

 Statistics: Disabled

  Statistics by service class: Disabled

 Path verification: Not configured

 Drop-upon-invalid: Disabled

 BFD trigger path-down: Disabled

 SBFD: Disabled

 BFD Echo: Disabled

 BFD no-bypass: Disabled

 Forwarding index: 2150629377

 Association ID: 1

 Service-class: -

 Rate-limit: -

 PCE delegation: Disabled

 PCE delegate report-only: Disabled

 Reoptimization: Disabled

 Encapsulation mode: -

 Flapping suppression Remaining interval: -

 Candidate paths state: Configured

 Candidate paths statistics:

  CLI paths: 1          BGP paths: 0          PCEP paths: 0          ODN paths: 0

 Candidate paths:

  Preference : 10

   Network slice ID: -

   CPathName:

   ProtoOrigin: CLI        Discriminator: 10

   Instance ID: 0          Node address: 0.0.0.0

   Originator:  0, ::

   Optimal: Y              Flags: V/A

   Dynamic: Not configured

   PCEP: Not configured

   Explicit SID list:

    ID: 1                     Name: s1

    Weight: 1                 Forwarding index: 2149580802

    State: Up                 State(-): -

    Verification State: -

    Path MTU: 1500            Path MTU Reserved: 0

    Local BSID: -

    Reverse BSID: -

¡     If the Tunnel NHLFE IDs field value is a hyphen (-), the EVPN route is not steered to the SRv6 TE policy. You need to identify whether the SRv6 TE policy configuration on the PE is correct, and resolve the issue that the SRv6 TE policy cannot come up. For more information, see the analysis for locating the issue that the SRv6 TE policy cannot take effect.

7.     If the issue persists, collect the following information and contact Technical Support:

¡     Results of each step.

¡     The configuration file, log messages, and alarm messages.

Related alarm and log messages

Alarm messages

N/A

Log messages

N/A