Chapter 43: BSoD L2VPN
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
1079
treatment. Also note that the L2VPN Q-tags are assigned by L2VPN TLV encodings embedded in CM configuration files
while L3VPN Q-tags are assigned in subinterface encapsulation commands by the CLI.
Use the following command to designate the range of Q-tags that are reserved to L2VPNs. This will prevent Q-tag collisions
between the L2VPN and the L3VPN features.
configure l2vpn [no] vlanid-range <2..4094> [- <2..4094>] {single-qtag | dual-qtag}
When a downstream L2VPN packet arrives at the CAM, the packet is transmitted only on the downstream channel used by
the CM. It is encrypted using BPI+ to ensure that it is received only by the target CM hosting the L2VPN instance. This BPI+
encryption is applied to individually-addressed (unicast MAC) and as well as to group-addressed (multicast/broadcast
MAC) packets that belong to the L2VPN instance. This ensures that L2VPN group-addressed packets transmitted on the
downstream channel are rejected by other CMs that do not have the correct BPI+ SAID to decrypt the L2VPN packet.
Furthermore, when the target CM is L2VPN-compliant under the BSoD L2VPN specification, then this CM forwards the
L2VPN packet only to the Cable Modem Customer Interface (CMCI) preventing its own eCM IP host stack or other
embedded eSAFE devices from receiving the packet. On the other hand a non-compliant CM forwards all unencrypted
downstream IP and ARP broadcast packets to the CMCI as well as to all internal eSAFE devices and the eCM IP host stack.
Not all cable modems are L2VPN capable. An L2VPN-compliant CM reports its L2VPN capabilities during registration. The
preferred mode of operation is to provide subscribers with L2VPN-compliant CMs when carrying native IP/ARP traffic in
the L2VPN tunnels. This ensures the maximum privacy for the L2VPN subscriber and the maximum performance for the
CM and CMTS. The CMTS only supports non-compliant CMs when explicitly enabled by CLI command. CMs that signal
L2VPN capabilities are always permitted to register with correct L2VPN TLV encodings, but non-compliant CMs are allowed
to register with L2VPN TLV encodings only when this policy is explicitly allowed.
L2VPN-compliant CMs must register with L2VPN capabilities that include Downstream Unencrypted Traffic (DUT) filtering
mode and eSAFE host identification. In particular, the CMTS does not perform DHCP snooping for eSAFE host MAC
addresses, nor does it support Downstream IP Multicast Encryption (DIME) for non-compliant CMs. Thus, these CMs form
L2VPN tunnels that are called leaky because the packets can be forwarded to endpoints outside the VPN tunnel. It is the
cable operator’s responsibility (via explicit CLI commands) to allow these non-compliant CMs to register with L2VPN TLV
encodings.
