Egress pipeline with tag manipulation and ESI label push capability

Packet processing in a EVPN L2 MPLS deployment includes performing tag editing operations in the egress pipeline. More particularly, tag manipulation is based on the egress port. Packet processing further includes performing ESI label selection in the egress pipeline, and includes selecting the ESI label based on the ingress port where the ingress port can be a physical port or a subinterface configured on a physical port.

BACKGROUND

The present disclosure generally relates to an Ethernet virtual private network (EVPN) multi-protocol label switching (MPLS) deployment.

EVPN logically extends a Layer 2 (L2) domain across a wide area network. EVPN uses VPN techniques to carry L2 traffic across the network. EVPN can use MPLS as the underlying network. From the point of view of host machines, the host machines see a deployment of virtual local area networks (VLANs). Devices at the edge of the MPLS network allow host machines to bridge to other VLANs, for example, to send Broadcast, Unknown unicast, Multicast (BUM) traffic. The edge devices perform EVPN and MPLS encapsulation to send traffic into the network, and perform decapsulation when receiving traffic from the network to be forwarded to the host machines. The present disclosure relates to processing packets in an EVPN MPLS deployment.

DETAILED DESCRIPTION

FIG.1shows an illustrative EVPN MPLS deployment (system)100. System100comprises a network102, customer edge devices104, and provider edge devices114to support communication among host machines (e.g., Host A, Host B, etc.). An EVPN MPLS network (provider network102) provides a single virtual Layer 2 (L2) domain for host machines connected to the network. System100shows two bridge domains comprising bridged VLANs. For example, a bridge domain identified as bridged VLAN10comprises two sites, Site A and Site C, that are bridged by provider network102. Likewise, a bridge domain identified as bridged VLAN30comprises two sites, Site B and Site D, that are also bridged by provider network102.

MPLS is a well known networking technology. Briefly, a packet arrives at one end of the MPLS network via normal transport mechanisms (e.g., IP routing). When the packet enters the MPLS network (core), it is assigned to a forwarding equivalence class (FEC). Based on the FEC, a label is appended to (pushed on) the packet. As the packet moves through the core, network devices in the core direct the packet according to the label. At the other end of the core, the label is removed (popped off) and the packet is delivered via normal transport such as IP routing.

Continuing withFIG.1, provider network102includes an MPLS core comprising intermediate network devices112, which in the MPLS context are referred to as label switch routers (LSRs). Provider edge devices (PEs)114serve as endpoint devices of provider network102for entry to and exit from the network. PEs114can be referred to as label edge routers in the MPLS context. PEs114can include network devices (switches, routers, etc.) that operate in accordance with the present disclosure.

Host machines (e.g., Host A, Host B, etc.) can connect to provider network102via respective customer edge devices (CEs)104that connect to the respective PEs114. The host machines can be servers, user devices such as laptop computers, desktop systems, and the like. CEs104can include any suitable network device such as a switch, a router, and the like.

As shown inFIG.1, CE104-4is configured for single homing. In other words, CE104-4has a single link to PE114-4. Merely for discussion purposes and without loss of generality, CEs104-1,104-2,104-3can be configured for multihoming. Link Aggregation Group (LAG) technology is an example of multihoming where multiple physical ports on a network device appear as a single “logical” port. In the illustrative deployment ofFIG.1, CE104-1is shown to be multihomed to PEs114-1,114-2. There is a link (connection) between a physical port on CE104-1and a physical port on PE114-1, and there is another link between another physical port on CE104-1and a physical port on PE114-2. The two links can be collectively referred to as Ethernet segment (ES)106-1. CE104-1can transmit data (packets) to provider network102on either of the two links. Conversely, data from provider network102destined for CE104-1can be transmitted to the CE on either of the two links. CEs104-2,104-3shown inFIG.1are likewise multihomed on respective ESs106-2,106-3.

PEs114can be configured to receive, process, and forward packets in pipeline fashion. AsFIG.1shows, in some embodiments, packet processing pipelines in a PE (e.g., PE114-1) can be configured as ingress pipelines and separate egress pipelines. In accordance with the present disclosure, certain functionality such as VLAN tag manipulation and ES identifier (ESI) label push can be performed in the egress pipelines. These aspects of the present disclosure are discussed in more detail below.

The discussion will now turn to a description of packet formats for various data packets that are transmitted in system100. Packets described in the present disclosure are well known and understood, and so only a brief description of the relevant data fields (components) of the packets will be given.

FIG.2Ashows the general format for an MPLS packet202. Packets that are transmitted within an MPLS network (e.g., provider network102) generally have this format, including packets sent between PEs114and the MPLS core and packets within the MPLS core. The media access control (MAC) header component of an MPLS packet includes information such as the destination MAC (DMAC) and the source MAC (SMAC) addresses which represent, respectively, the MAC addresses of the receiving (destination) device and the sending device (source). Strictly speaking, packet202is an Ethernet frame that encapsulates an MPLS packet. That distinction, however, is not relevant to the present disclosure; MPLS packet202can be loosely referred to as an MPLS packet.

The MPLS labels component (also referred to as the MPLS stack) of MPLS packet202contains one or more labels that are used by MPLS to forward packets within the MPLS core. Labels are used to switch the packet through the MPLS core. MPLS packet202encapsulates in its payload a data packet received from a device (e.g., CE104) connected to the MPLS network. InFIG.1, for example, PE114-1can receive a packet from CE104-1. PE114-1would encapsulate the packet received from CE114-1as the payload of MPLS packet202. In some embodiments, the packet received from CE-114-1can be an Ethernet frame.

FIG.2Ashows an Ethernet frame212encapsulated within MPLS packet202. The MAC header of Ethernet frame212includes information such as the destination MAC (DMAC) address to which the Ethernet frame is transmitted and the source MAC (SMAC) address from which the Ethernet frame was sent. The payload component in the Ethernet frame can be a packet of data sent by a host to a CE. The MAC header of Ethernet frame212can also be referred to as the “inner” MAC header to distinguish the “outer” MAC header of the MPLS packet202that encapsulates the Ethernet frame.

FIG.2Bshows an example of an Ethernet packet222that is tagged with a VLAN tag224. VLANs and VLAN tagging are known. Packets on a VLAN are “tagged” with an identifier, referred to as the VLAN tag, so that the network knows how to forward the packets within a VLAN and forward the packet after mapping the VLAN tag to a bridge domain. As shown inFIG.2B, VLAN tag224includes a VLAN identifier (VID). The VID generally identifies the VLAN that a packet belongs to, but in the context of EVPN MPLS, PE devices can be configured to provide mapping between the VID in a received packet and a bridge domain. This aspect of the present disclosure is discussed in more detail below.

FIG.3depicts an example of a network device300(e.g., PE114,FIG.1) in accordance with some embodiments of the present disclosure. As shown, network device300can include a management module302, an internal fabric module304, and one or more I/O modules306a-306p. Management module302includes the control plane (also referred to as a control layer) of network device300and can include one or more management CPUs308afor managing and controlling operation of network device300. Each management CPU308acan be a general purpose processor, such as but not limited to an Intel®/AMD® x86 or ARM® processor, that operates under the control of software stored in a memory308b, such as dynamic random access memory (DRAM). The control plane provides processes to determine which path to use, such as routing protocols, spanning tree learning, and the like.

Internal fabric module304and I/O modules306a-306pcollectively represent the data plane of network device300(also referred to as the data layer, the forwarding plane, etc.). Internal fabric module304serves to interconnect the various other modules of network device300. Each I/O module306a-306pincludes one or more input/output ports310a-310pthat are used by network device300to send and receive network packets. Each I/O module306a-306pprovides packet processing functionality, logically represented by respective packet processors312a-312pand memory components314a-314p. Each packet processor312a-312pcan comprise a forwarding hardware component, comprising for example, elements such as application specific integrated circuit (ASIC), field programmable gate array (FPGA), digital processing unit, content-addressable memory, and the like. The forwarding hardware component can be configured to make wire speed decisions on how to handle incoming (ingress) and outgoing (egress) network packets. In accordance with some embodiments some aspects of the present disclosure can be performed wholly within the data plane. The memory components can hold information for processing in accordance with the present disclosure.

FIG.4Ashows a high level representation of an I/O module400in accordance with some embodiments. The N physical ports408on I/O module400have corresponding ingress pipelines402to process ingress packets and corresponding egress pipelines404to process packets for egress. Each ingress pipeline includes selection circuitry (selector)406to direct intermediate packets that exit the ingress pipeline to an appropriate egress pipeline. The ingress pipelines and egress pipelines can be separate components. In some embodiments, for example, the ingress pipeline and the egress pipeline can be implemented using separate circuitry. In other embodiments, the ingress pipeline and the egress pipeline can be implemented on separate IC (integrated circuit) chips.

Each port408has a corresponding ingress pipeline402to process packets that ingress the port and a corresponding egress pipeline404to process packets for egress on the port. The ingress port (e.g., a port408-x, not shown) and the egress port (e.g., a port408-y, not shown) for a given packet may be different ports. A packet that is received on port408-xis processed by associated ingress pipeline402-x, may be sent via respective selector406-xto an egress pipeline404-ythat is associated with port408-ydifferent from port408-x.

FIG.4Bshows some details of ingress and egress pipelines in accordance with some embodiments. The example inFIG.4Bshows ingress pipeline402-ito process packets that ingress on port i, and egress pipeline404-jto process packets for egress on port j.

Ingress pipeline402-ican include a parser422and a processing engine424. The ingress pipeline can use ingress lookup and editing tables (ingress data tables)412to provide editing instructions based on the contents of the ingress packet to drive processing engine424. Generally, when a packet is received (ingresses) on a port of the network device, the ingress packet feeds into the ingress pipeline associated with that port. Parser422parses the ingress packet to access parts of the packet. Various lookups can be performed using ingress data tables412to obtain editing instructions that feed into processing engine424to direct editing actions to be performed on the ingress packet. In some instances parts of the ingress packet may be modified, and in other instances the ingress packet may not be edited. For discussion purposes, in either case the packet that leaves the ingress pipeline will be referred to as an “intermediate packet.” Parts of the ingress packet can be used as keys into the ingress data tables to produce metadata that can be used to identify an egress pipeline and to direct processing in the egress pipeline. The ingress packet and metadata can collectively constitute the intermediate packet.

The intermediate packet produced by ingress pipeline402-ican be forwarded by corresponding selector406-ito an appropriate egress pipeline; e.g., egress pipeline404-j. In some embodiments, the selector can select the egress pipeline based on information contained in the intermediate packet and/or on the metadata.

Similar to ingress pipeline402-i, egress pipeline404-jcan include a parser442and a processing engine444. The egress pipeline can access egress lookup and editing tables (egress data tables)414to provide editing instructions to processing engine444. Generally, when selector406-itransmits a packet the egress pipeline, parser442can parse the received packet to access parts of the packet. Various lookups can be performed on the egress data tables414using the parsed packet and the metadata produced by the ingress pipeline or the egress pipeline to obtain appropriate editing instructions that feed into processing engine444to direct actions performed by processing engine to produce an egress packet.

Payload Tag Manipulation

FIG.5shows details in an EVPN MPLS deployment500to illustrate an example of payload tag manipulation in accordance with some embodiments. The deployment comprises provider network502and CEs504, which in this example are configured for single homing, although it will be appreciated that the deployment can include multi-homed CEs. Host A and Host B are connected to CE504-1; and CE504-1, in turn, connects to physical port et11on PE514-1. Host C connects to CE504-2; and CE504-2, in turn, connects to physical port et12on PE514-1.

Deployment500is configured with two bridge domains. A bridge domain identified as bridged VLAN10comprises three sites: Site A comprising Host A, Site C comprising Host C, and Site E comprising Host E and Host F. Another bridge domain identified as bridged VLAN30comprises two sites: Site B comprising Host B and Site D comprising Host D.

Referring toFIG.6A, the discussion will now turn to a high-level description of processing in a network device (e.g., PE514-1,FIG.5) for tag manipulation of an ingress packet in accordance with the present disclosure. In some embodiments, for example, the network device can include one or more digital processing units, which when operated, can cause the network device to perform processing in accordance withFIG.6A. Digital processing units can include specialized processors in the data plane such as digital signal processors, field programmable gate arrays, application specific integrated circuits, and the like that operate by way of executing computer program code or by way of logic circuits being configured for specific operations. For example, packet forwarding logic312(FIG.3) in the data plane can be an ASIC.

At operation602, the network device can receive a packet (the ingress packet) at one of its ports (the ingress port). The ingress packet can be provided to the ingress pipeline associated with the ingress port.

At operation604, processing in the ingress pipeline can produce metadata for further downstream processing. The ingress pipeline outputs the ingress packet as an intermediate packet. In some instances, the ingress pipeline may perform edits on the ingress packet, and in other instances the ingress packet may not be edited. Information contained in the ingress packet can be used as lookup keys on the ingress data tables (e.g.,412,FIG.4B) associated with the ingress pipeline to identify editing directives and metadata. Referring for a moment toFIG.7, for example, the ingress data tables can include a local ingress editing database (DB)702; this database is “local” in the sense that it is specific to the ingress pipeline. The metadata can include an ingress traffic stream identifier (ID)712that identifies the traffic stream of the ingress packet and, as shown below, the ingress traffic stream ID can be used to identify an egress pipeline.

The metadata can further include information (a bridge ID) that identifies the bridged VLAN in which to bridge the ingress packet. Depending on configuration, an incoming packet can be bridged in a bridged VLAN. In some embodiments, for example, the bridged VLAN is determined based on the VID contained in the ingress packet; the VID can be mapped (translated) to a bridged VLAN. The mapping can be to the same or a different bridged VLAN as the sending host. The mapping between VID and bridged VLAN depends on a particular given deployment and is configured in each PE device on a port by port basis by a network administrator or some suitable automation (e.g., a central controller).

Merely to illustrate, refer for a moment toFIG.6Bwhich shows some examples of port-based VID-to-bridged VLAN mappings (translations) that can be programmed or otherwise configured in PE514-1(FIG.5). The example includes some mappings for port et11on PE514-1. A packet having a VID=10 that is received at port et11will be mapped to (and bridged in) bridged VLAN10. Similarly, a packet having a VID=50 that is received at port et11will be mapped to bridged VLAN30. Notably, the mapping is not based on the site (Site A or Site B) from which the packet was transmitted. For example, a packet from Site A (which is in bridged VLAN10) that contains VID=10 will be bridged in the same bridge VLAN, namely bridged VLAN10. On the other hand, a packet from Site A that contains VID=50 will be bridged in a different bridged VLAN, namely bridged VLAN30. Of further note is that the VLAN in a VID is not related to the VLAN in a bridged VLANs.

At operation606, the ingress pipeline can identify an appropriate egress pipeline. In some embodiments, for example, the egress pipeline can be identified based on the ingress traffic stream ID712which identifies where the ingress packet came in on. As noted above, the logic circuitry of ingress pipelines can be separate from the logic circuitry of egress pipelines, and in some embodiments can be on separate IC chips (ingress chips, egress chips). A global egress DB704can contain information about the egress pipelines, including on which egress chips the egress pipelines are located; this database is “global” in that the information in it is available to every ingress pipeline in the network device. The ingress traffic stream ID712can be used to perform a lookup on the global egress DB to identify an appropriate egress identifier714. The egress identifier can include information that identifies the egress pipeline and the corresponding egress port, and the egress chip that contains the egress pipeline, which may or may not be the same chip as the ingress pipeline. The intermediate packet can be queued onto the identified egress pipeline for egress processing. Continuing withFIG.6A, processing of the intermediate packet can continue in the identified egress pipeline as follows.

At operation608, the egress pipeline can use the intermediate packet and metadata from the ingress pipeline (e.g.,FIG.4B) to identify editing directives in the egress data tables (e.g.,414) associated with the egress pipeline. The editing directives can direct the egress processing engine to produce an egress packet by further editing the intermediate packet. Referring again toFIG.7, the egress data tables can include a local egress editing DB706. The egress identifier714can be used to access appropriate editing directives from the local egress editing DB. The directives, for example, can include an EVPN tunnel encapsulation entry716to encapsulate the intermediate packet.

At operation610, the egress pipeline can perform tag manipulation on the intermediate packet. As can be seen inFIG.6C, this operation can be performed by a tag manipulator logic circuit in the egress pipeline. Tag manipulation is known and includes editing actions such as adding VLAN tags, deleting VLAN tags, changing VLAN tags, changing between single-tagged and double-tagged formats, and so on. Tag formats are known, such as Dot1Q, Dot1ad, QinQ, etc. In accordance with the present disclosure, the tag manipulations can be stored in a tag manipulation DB708in the egress pipeline. The EVPN tunnel encapsulation entry716can be used to determine an appropriate tag manipulation based on certain features to apply, such as EVPN MPLS, EVPN VxLAN, VPLS, etc. In some embodiments, for example, a feature ID716acontained in the EVPN tunnel encapsulation entry716and the bridge ID (contained in the metadata from the ingress pipeline) that identifies the bridged VLAN can be used as lookup criteria to select a suitable tag manipulation directive718from the tag manipulation DB708. The feature ID716ainforms the kind of tag manipulation to perform and the bridge ID provides the information (e.g., VID) for the manipulated tag.

To illustrate some examples of tag manipulation, suppose PE514-1inFIG.5is configured according to the VID-to-bridged VLAN mapping shown inFIG.6B. Consider the following use cases:

Use Case 1

Host A transmits a packet tagged with (ingress) VID=10ingress port on PE514-1: port et11bridge domain: bridged VLAN10bridge ID=bridged VLAN10egress port: port et14Host A's packet (as payload): Dot1Q tagged with (egress) VID=10
Use Case 1 illustrates an example of a packet sent by Host A, where Host A (in bridged VLAN10) transmits a packet with VID=10. The packet will ingress PE514-1on port et11. The mapping inFIG.6Bwill map the ingress VID to bridged VLAN10, per mapping entry 1, and the bridge ID will be set to a suitable identifier. The egress port (et14in this case) is based on destination information in the ingress packet. A tag manipulation directive can then be selected based on feature(s) associated with the egress port and the bridge ID (bridged VLAN10in this case), and used to edit (manipulate) the tag in Host A's packet for egress. It will be understood that in the example shown above, the Dot1Q tagging of the Host A packet with egress VID=10 is strictly illustrative. The specific kind of tagging can include any kind of known tagging such as Dot1Q, Dot1ad, QinQ, etc., and the egress VID can be any suitable value. In other words, the specific tag manipulation will depend on how a given deployment is configured. To complete the discussion of this use case, the egress Host A packet will be encapsulated in an MPLS packet (discussed below) and so the tag manipulation can be referred to as payload tag manipulation. The encapsulated packet will egress on port et14of PE514-1.

Use Case 2

Host C transmits a packet tagged with (ingress) VID=100ingress port on PE514-1: port et12bridge domain: bridged VLAN10bridge ID=bridged VLAN10Host C's packet (as payload): Dot1Q tagged with (egress) VID=10egress port: port et14
Use Case 2 illustrates an example of a packet sent by Host C, where Host C (in bridged VLAN10) transmits a packet with VID=100. The packet will ingress PE514-1on port et12. The mapping inFIG.6Bwill map the ingress VID to bridged VLAN10, per mapping entry 3, and the bridge ID will be set to a suitable identifier. The egress port (et14in this case) is based on destination information in the ingress packet. A tag manipulation directive can then be selected based on feature(s) associated with the egress port and the bridge ID (bridged VLAN10in this case), and used to edit (manipulate) the tag in Host C's packet for egress. For Use Case 2, payload tag manipulation of the tag in the Host C packet results in the VID being changed from VID=100 to VID=10. However, as noted above in connection with Use Case 1, the Dot1Q tagging of the Host C packet is strictly illustrative. The specific tag manipulation performed on the Host C packet will depend on how a given deployment is configured. To complete the discussion of this use case, the egress Host C packet will be encapsulated in an MPLS packet (discussed below) and so the tag manipulation can be referred to as payload tag manipulation.

As can be seen from the foregoing use cases, tag manipulation in accordance with the present disclosure is based on the egress tunnel (e.g., determined based on features and bridge ID), rather than on the ingress port. As such, tag manipulation of packets that ingress on a given port can vary from one packet to the next depending on their destination at egress. Tag manipulation in accordance with the present disclosure is not tied to the ingress port.

At decision612, if an MPLS encapsulation is required, then processing can continue at614. For example, if the egress port connects to an MPLS core, then MPLS encapsulation can be performed. Otherwise, processing can continue at operation616.

At operation614, the egress pipeline can perform a lookup to identify an MPLS label. The tag-manipulated intermediate packet can be encapsulated in an MPLS packet (e.g.,202,FIG.2A) with the MPLS label. As can be seen inFIG.6C, this operation can be performed by an encapsulator logic circuit in the egress pipeline.

At operation616, the egress pipeline can transmit the egress packet with or without MPLS encapsulation as illustrated inFIG.6C. Processing of the received packet can be deemed complete.

ESI Label Push Per Subinterface

FIG.8shows details in an EVPN MPLS deployed system800to illustrate an example of ESI label pushes in accordance with some embodiments, and in particular ESI label pushes based on subinterfaces. Deployment800comprises provider network102(FIG.1) and CEs804, which in this example are configured for multihoming. Host A and Host B are connected to CE804-1. CE-804-1, in turn, is multihomed to PE814-1and PE814-2. The two links from CE804-1to PE814-1and PE814-2can be referred to as an Ethernet segment (ES), and is identified in the figure as ESI100. The figure shows Host C connected to CE804-2. CE804-2is multihomed to PE814-1and PE814-2on ESI200.

Deployment800is configured with two bridge domains. A bridge domain identified as bridged VLAN10that comprises two sites: Site A comprising Host A and Host B and Site C comprising Host D. A second bridge domain identified as bridged VLAN30comprises two sites: Site B comprising Host C and Site D comprising Host E and Host F.

PE814-1includes a physical port et10that is configured as two subinterfaces et10.1and et10.2. The figure shows that CE804-1and CE804-2are connected to PE814-1respectively on subinterfaces et10.1and et10.2. Subinterface techniques are known and understood. Briefly, a physical port can be logically divided into two or more interfaces, referred to as subinterfaces, logical interfaces, etc. A subinterface defined on a physical port provides data transport independently of other subinterfaces defined on that physical port.

When a multihomed CE (e.g.,804-1) transmits a BUM packet to one of its PEs (e.g.,814-2), the PE will replicate the BUM packet to other (destination) PEs. The replicated packet that is destined for the other PE to which CE804-1is multihomed, namely PE814-1, will include information that identifies the CE's Ethernet segment, namely ES100. The Ethernet segment identifier serves to inform PE814-1that the original BUM packet was received on ES100so that the PE will know to not forward the received replicated BUM packet back CE804-1, thus avoiding a flood loop. Accordingly, an Ethernet segment identifier (ESI) label that identifies Ethernet segment ES100must be pushed onto the MPLS stack of the MPLS packet that targets PE814-1. MPLS packet82shown inFIG.8represents the packet destined for PE814-1and includes an ESI label that identifies ES100.

In general, an ESI label is selected according to (1) the Ethernet segment on which the receiving PE received the BUM packet and (2) the destination PE of the replication packet. In the example shown inFIG.8, for instance, if PE814-2receives a BUM packet on ES100(e.g., from CE804-1), then the replicated packet destined for PE814-1will have an ESI label that identifies Ethernet segment ESI100. Likewise, if PE814-2receives a packet on ES200(e.g., from CE804-2), then the replicated packet destined for PE814-1will have an ESI label that identifies ESI200. When the packet arrives at PE814-1, the ESI label will inform PE814-1which Ethernet segment to avoid transmitting the packet on.

Referring toFIG.9A, the discussion will now turn to a high-level description of processing in a network device (e.g., PE814-1,FIG.8) for selecting ESI labels for MPLS packets in accordance with the present disclosure. In some embodiments, for example, the network device can include one or more digital processing units, which when operated, can cause the network device to perform processing in accordance withFIG.9A. Digital processing units can include specialized processors in the data plane such as digital signal processors, field programmable arrays, application specific integrated circuits, and the like that operate by way of executing computer program code or by way of logic circuits being configured for specific operations. For example, packet forwarding logic312(FIG.3) in the data plane can be a specialized processor.

At operation902, the network device can receive a BUM packet (the ingress packet) at one of its ports. The ingress packet can be provided to the ingress pipeline associated with that port.

At operation904, processing in the ingress pipeline can produce metadata for further downstream processing. The ingress pipeline outputs the ingress packet as an intermediate packet, which as noted above may or may not include edits to the ingress packet. The ingress data tables (e.g.,412,FIG.4B) associated with the ingress pipeline can be used to identify editing directives and other metadata using information contained in the ingress packet as lookup keys.FIG.10shows ingress and egress data tables similar to the tables shown inFIG.7. Information in the ingress packet can be used to identify editing directives and metadata in local ingress editing DB1002. The metadata can include an ingress traffic stream identifier (ID)1012that identifies the traffic stream of the ingress packet and, as shown below, the ingress traffic stream ID can be used to identify an egress pipeline.

The metadata can further include information that identifies the bridged VLAN in which to bridge the ingress packet. In some embodiments, for example, the bridged VLAN is determined based on the VID contained in the ingress packet; the VID can be mapped (translated) to a bridged VLAN. The mapping between VID and bridged VLAN is configured in the PE device on a port by port basis, and more particularly on a subinterface by subinterface basis. For example, referring to the illustrative deployment inFIG.8, port et10on PE814-1can be configured to map a packet that arrives on subinterface et10.1and contains a VID=100 to bridged VLAN10. If Host A sends a packet with VID=100, then the packet will remain in bridge VLAN10by operation of the configured mapping.FIG.9Bshows additional examples of subinterface-based VID-to-bridged VLAN mappings that can be programmed or otherwise configured in PE814-1.

At operation906, the ingress pipeline can identify one or more egress pipelines on which to forward the BUM packet. In some embodiments, for example, the egress pipeline can be identified based on the ingress traffic stream ID1012which identifies where the ingress packet came in on. As noted above, logic circuitry of ingress pipelines can be separate from logic circuitry of egress pipelines, and in some embodiments can be on separate IC chips (egress chips). A global egress DB1004can contain information about the egress pipelines, including on which egress chips the egress pipelines are located. The ingress traffic stream ID1012can be used to perform a lookup on the global egress DB to identify appropriate egress identifiers1014. The egress identifier can include information that identifies the egress pipeline and the corresponding egress port, and the egress chip that contains the egress pipeline, which may or may not be the same chip as the ingress pipeline. The intermediate packet can be replicated and queued onto each identified egress pipeline. Continuing withFIG.9A, processing of the intermediate packet can continue in each of the identified egress pipelines as follows.

At operation908, the egress pipeline can use the intermediate packet and metadata from the ingress pipeline to identify editing directives in the egress data tables associated with the egress pipeline. As can be seen inFIG.9C, this operation can be performed by a tag manipulator logic circuit in the egress pipeline. The editing directives can direct the egress processing engine to produce an egress packet by further editing the intermediate packet. Referring again toFIG.10, the egress identifier1014can be used to access appropriate editing directives from local egress editing DB1006a. As described above, for example, the directives can include an EVPN tunnel encapsulation entry1016to encapsulate the intermediate packet.

At operation910, the egress pipeline can determine the EVPN tunnel and an IMET (Inclusive Multicast Ethernet Tag) label. Referring toFIG.10for example, the EVPN tunnel encapsulation entry1016can include information that identifies an IMET (Inclusive Multicast Ethernet Tag) label1018. As explained below, the IMET label will be pushed onto the MPLS label stack of the MPLS packet.

At decision912, if an ESI label is available, then processing can continue at914. If an ESI label is not available, then processing can continue at916. As explained above, an ESI label is pushed onto the MPLS stack according to (1) the Ethernet segment on which the packet ingressed and (2) the destination PE. Referring toFIG.10, in accordance with some embodiments, ingress editing directives1012can include information, e.g., port ID1012a, that identifies the ingress port and hence the Ethernet segment. As shown inFIG.8, for example, port et10.1on PE814-1is connected to Ethernet segment100, and port et10.2is connected to Ethernet segment200.

Further in accordance with some embodiments, an additional local egress editing DB1006bcontains egress tunnel identifiers. The EVPN tunnel encapsulation entry1016can include a pointer to an entry in the egress editing DB1006bto obtain an egress tunnel identifier1020that identifies the tunnel on which the packet will be transmitted, including the destination PE.

In some embodiments, the egress data tables can include a multihoming DB1008that contains ESI labels to support multihomed configurations. The port ID1012a(representing the Ethernet segment) and the egress tunnel identifier1020(representing the destination PE) can be used as lookup keys to perform a lookup in the multihoming DB. If the lookup produces an ESI label1022, then the ESI label can be pushed onto the MPLS label stack (operation914). Consider PE814-2inFIG.8, for example. The multihoming DB in PE814-2will contain an entry that matches on port ID==et10.1and egress tunnel identifier==PE814-1because both port et10.1and PE814-1are connected to Ethernet segment ES100; the entry will contain an ESI label that represents ES100for PE814-1. On the other hand, the multihoming DB will not contain ESI label entries for PEs814-3,814-4because neither PE is connected to ES100.

In accordance with the present disclosure, port ID1012acan identify physical-only ports or subinterfaces. In some instances, the ingress port that is identified by port ID1012acan be a physical-only port, where the physical port is not configured as multiple subinterfaces. In other instances, the ingress port that is identified by port ID1012acan be a subinterface.FIG.8, for example, shows physical port et10to be configured as subinterfaces (interfaces) et10.1, et10.2, so port ID1012awill identify et10.1or et10.2. Selection of the ESI label In accordance with the present disclosure is not tied to the ingress port being a physical port and can be based on ingress ports that are subinterfaces of a physical port.

At operation914, the egress pipeline can push an ESI label onto the MPLS label stack, if the lookup in multihoming DB1008resulted in an ESI label (decision point912). As can be seen inFIG.9C, this operation can be performed by an encapsulator logic circuit in the egress pipeline.

At operation916, the egress pipeline can push the IMET label (determined at operation910) onto the MPLS label stack. If an ESI label is required, then the MPLS stack will have the ESI label pushed, followed by a push of the IMET label. If an ESI label is not required, then the MPLS stack will have only a push of the IMET label.

At operation918, the egress pipeline can transmit the egress packet. Processing of the replicated BUM packet can be deemed complete. It will be understood that the foregoing egress pipeline operations are applied to each replicated BUM packet.

Tag Manipulation and ESI Label Push

FIG.11shows details in an EVPN MPLS deployed system1100to illustrate an example of tag manipulation in conjunction with ESI label pushes, in accordance with some embodiments. Deployment1100is based on the deployments shown inFIGS.5and8. Deployment1100comprises provider network102(FIG.1) and CEs1104, which in this example are configured for multihoming. Host A and Host B are connected to CE1104-1. CE1104-1, in turn, is multihomed to PE1114-1and PE1114-2. The two links from CE1104-1to PE1114-1and PE1114-2can be referred to as an Ethernet segment (ES), and is identified in the figure as ESI100. The figure shows Host C connected to CE1104-2. CE1104-2is multihomed to PE1114-1and PE1114-2on ESI200.

Deployment1100is configured with two bridge domains. A bridge domain identified as bridged VLAN10that comprises two sites: Site A comprising Host A and Host B and Site C comprising Host D. A second bridge domain identified as bridged VLAN30comprises two sites: Site B comprising Host C and Site D comprising Host E and Host F.

PE1114-1includes physical ports et11and et12, although it will be appreciated that in other embodiments, PE1114-1can be configured with subinterfaces such as shown inFIG.8for instance.FIG.11shows that CE1104-1and CE1104-2are connected to PE1114-1on respectively ports et11and et12. When a multihomed CE (e.g.,1104-1) transmits a BUM packet to one of its PEs (e.g.,1114-2), the PE will replicate the BUM packet to the other PEs. As explained above in connection withFIG.8, the replicated packet that is sent to the other PE (PE1114-1) to which CE1104-1is multihomed will include information that identifies the CE's Ethernet segment, in this case ES100. The Ethernet segment identifier informs PE1114-1to not forward the replicated BUM packet back to CE1104-1so as to avoid creating a flood loop.

In general, an ESI label is selected according to the Ethernet segment on which the receiving PE received the BUM packet and the destination PE of the replication packet. In the example inFIG.11, if PE1114-2receives a BUM packet on ES100(e.g., from CE1104-1), then the replicated packet destined for PE1114-1will have an ESI label that identifies Ethernet segment ESI100. Likewise, if PE1114-2receives a packet on ES200(e.g., from CE1104-2), then the replicated packet destined for PE1114-1will have an ESI label that identifies ESI200. When the replicated packet arrives at PE1114-1, the ESI label will inform the PE which Ethernet segment to avoid transmitting the packet on; e.g., if the ESI label identifies ES100, then the PE will not forward the replicated packet on ES100and likewise if the ESI label identifies ES200, then the PE will not forward the replicated packet on ES200.

Referring toFIG.12, the discussion will now turn to a high-level description of processing in a network device (e.g., PE1114-1,FIG.11) for tag manipulation and ESI label selection in accordance with the present disclosure. In some embodiments, for example, the network device can include one or more digital processing units, which when operated, can cause the network device to perform processing in accordance withFIG.12. Digital processing units can include specialized processors in the data plane such as digital signal processors, field programmable arrays, application specific integrated circuits, and the like that operate by way of executing computer program code or by way of logic circuits being configured for specific operations. For example, packet forwarding logic312(FIG.3) in the data plane can be a specialized processor.

At operation1202, the network device can receive a BUM packet (the ingress packet) at one of its ports. The ingress packet can be provided to the ingress pipeline associated with that port.

At operation1204, processing in the ingress pipeline can produce metadata for further downstream processing. The ingress pipeline outputs the ingress packet as an intermediate packet, which as noted above may or may not include edits to the ingress packet. The ingress data tables (e.g.,412,FIG.4B) associated with the ingress pipeline can be used to identify editing directives and other metadata using information contained in the ingress packet as lookup keys. Referring for a moment to the data tables inFIG.13, the figure shows examples of ingress and egress editing tables such as those shown inFIGS.7and10. The ingress data tables can include a local ingress editing database (DB)1302. Information in the ingress packet can be used to identify editing directives and metadata in local ingress editing DB1302. The metadata can include an ingress traffic stream identifier (ID)1312that identifies the traffic stream of the ingress packet and, as shown below, the ingress traffic stream ID can be used in the egress pipeline.

As explained above, the metadata can further include information that identifies the bridged VLAN in which to bridge the ingress packet. In some embodiments, for example, the bridged VLAN is determined based on the VID contained in the ingress packet; the VID can be mapped (translated) to a bridged VLAN. The mapping between VID and bridged VLAN is configured in the PE device on a port by port basis, in some embodiments, and in other embodiments, on a subinterface by subinterface basis.

At operation1206, the ingress pipeline can identify one or more egress pipelines on which to forward the BUM packet. In some embodiments, for example, the egress pipeline can be identified based on the ingress traffic stream ID1312which identifies where the ingress packet came in on. As noted above, logic circuitry of ingress pipelines can be separate from logic circuitry of egress pipelines, and in some embodiments can be on separate IC chips (egress chips). A global egress DB1304can contain information about the egress pipelines, including on which egress chips the egress pipelines are located. The ingress traffic stream ID1312can be used to perform a lookup on the global egress DB to identify appropriate egress identifiers1314. The egress identifier can include information that identifies the egress pipeline and the corresponding egress port, and the egress chip that contains the egress pipeline, which may or may not be the same chip as the ingress pipeline. The intermediate packet can be replicated and queued onto each identified egress pipeline. Continuing withFIG.12, processing of the intermediate packet can continue in each of the identified egress pipelines as follows.

At operation1208, the egress pipeline can use the intermediate packet and metadata from the ingress pipeline to identify editing directives in the egress data tables associated with the egress pipeline. The editing directives can direct the egress processing engine to produce an egress packet by further editing the intermediate packet. Referring again toFIG.13, the egress data tables can include a local egress editing DB1306a. The egress identifier1314can be used to access appropriate editing directives from the local egress editing DB. The directives, for example, can include an EVPN tunnel encapsulation entry1316to encapsulate the intermediate packet in an MPLS packet for egress.

At operation1210, the egress pipeline can perform tag manipulation. In some embodiments in accordance with the present disclosure, the editing directives can include information that identifies VLAN tag manipulation directives. As explained above, tag manipulation includes actions such as adding VLAN tags, deleting VLAN tags, changing VLAN tags, changing between single-VLAN and double-VLAN tagged formats, and so on.

Tag manipulation in accordance with the present disclosure can be customized based on the egress tunnel vis-à-vis the EVPN tunnel encapsulation directive. As such, tag manipulation packets that ingress on a given port can vary from one packet to the next depending on their destination at egress, and is not tied to the ingress port.

In accordance with the present disclosure, the tag manipulations can be stored in a tag manipulation DB1308in the egress pipeline. The EVPN tunnel encapsulation entry1316can be used to determine an appropriate tag manipulation based on certain feature to apply, such as EVPN MPLS, EVPN VxLAN, VPLS, etc. In some embodiments, for example, a feature ID1316acontained in the EVPN tunnel encapsulation entry1316and the bridge ID (contained in the metadata from the ingress pipeline) that identifies the bridged VLAN can be used as lookup criteria to select a suitable tag manipulation directive1318from the tag manipulation DB1308. The feature ID1316ainforms the kind of tag manipulation to perform and the bridge ID provides the information (e.g., VID) for the manipulated tag.

At operation1212, the egress pipeline can determine the EVPN tunnel and an IMET label. Referring toFIG.13for example, the EVPN tunnel encapsulation entry1316can include information that identifies an IMET label1316b. As explained below, the IMET label will be pushed onto the MPLS label stack of the MPLS packet.

At decision1214, if an ESI label is available, then processing can continue at1216. If an ESI label is not available, then processing can continue at1218. As explained above, an ESI label is pushed onto the MPLS stack according to (1) the Ethernet segment on which the packet ingressed and (2) the destination PE. Referring toFIG.13, in accordance with some embodiments, ingress editing directives1312can include information, e.g., port ID1312a, that identifies the ingress port and hence the Ethernet segment. As shown inFIG.11, for example, port et11on PE1114-1is connected to Ethernet segment100, and port et12is connected to Ethernet segment200.

Further in accordance with some embodiments, an additional local egress editing DB1306bcontains egress tunnel identifiers. The EVPN tunnel encapsulation entry1316can include a pointer to an entry in the egress editing DB1306bto obtain an egress tunnel identifier1320that identifies the tunnel on which the packet will be transmitted, including the destination PE.

The egress data tables can include a multihoming DB1310that contains ESI labels to support multihomed configurations. The port ID1312a(representing the Ethernet segment) and the egress tunnel identifier1320(representing the destination PE) can be used as lookup keys to perform a lookup in the multihoming DB. If the lookup produces an ESI label1322, then that ESI label can be pushed onto the MPLS label stack (operation1214).

At operation1216, the egress pipeline can push an ESI label onto the MPLS label stack, if the lookup in multihoming DB1308resulted in an ESI label.

At operation1218, the egress pipeline can push the IMET label (determined at operation1212) onto the MPLS label stack. If an ESI label is required, then the MPLS stack will have the ESI label pushed, followed by a push of the IMET label. If an ESI label is not required, then the MPLS stack will have only a push of the IMET label.

At operation1220, the egress pipeline can transmit the egress packet. Processing of the received BUM packet can be deemed complete.

Further Examples

In accordance with the present disclosure, a method in a network device includes receiving an ingress packet, the ingress packet containing a VLAN tag; producing an egress packet; and transmitting the egress packet on the egress port. Producing an egress packet includes performing first processing of the ingress packet in an ingress pipeline; performing second processing of the ingress packet, subsequent to the first processing, in an egress pipeline separate from the ingress pipeline, wherein the second processing includes identifying an egress port; and modifying the VLAN tag contained in the ingress packet to produce a modified VLAN tag for the egress packet, wherein modifying the VLAN tag is based at least on the egress port.

In some embodiments, the ingress pipeline is on a processing chip separate from a processing chip that contains the egress pipeline.

In some embodiments, the egress port is associated with a plurality of destination devices, wherein the second processing further includes identifying a destination device from among the plurality of destination devices, wherein modifying the VLAN tag contained in the ingress packet is further based on the identified destination device. In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on an L2 EVPN MPLS network.

In some embodiments, modifying the VLAN tag contained in the ingress packet includes performing a table lookup on a data table in the egress pipeline.

In some embodiments, modifying the VLAN tag contained in the ingress packet includes one of: changing the VLAN tag from a single-tag format to a double-tag format; changing the VLAN tag from a double-tag format to a single-tag format; and changing the untagged packet to single-tag format.

In accordance with the present disclosure, a method in a network device includes receiving a packet, the received packet containing a virtual local area network (VLAN) tag; generating an egress packet from the received packet, including performing first processing of the received packet in an ingress pipeline, including identifying an egress port; performing second processing of the received packet, subsequent to the first processing, in an egress pipeline associated with the egress port and separate from the ingress pipeline; and modifying, in the egress pipeline, the VLAN tag contained in the received packet to produce a modified VLAN tag for the egress packet, wherein modifying the VLAN tag is based at least on the egress port; and transmitting the egress packet on the egress port.

In some embodiments, the ingress pipeline is on a processing chip separate from a processing chip that contains the egress pipeline.

In some embodiments, modifying the VLAN tag contained in the received packet includes performing a table lookup on a data table in the egress pipeline.

In some embodiments, the second processing further includes identifying a destination device from among a plurality of destination devices, wherein modifying the VLAN tag contained in the received packet is further based on the identified destination device. In some embodiments, the plurality of destination devices are provider edge (PE) devices on an L2 EVPN MPLS (Layer 2, Ethernet virtual private network, multi-protocol label switching) network.

In some embodiments, wherein modifying the VLAN tag contained in the received packet includes one of changing the VLAN tag from a single-tag format to a double-tag format; or changing the VLAN tag from a double-tag format to a single-tag format.

In some embodiments, modifying the VLAN tag is not performed when the ingress port and the egress port are connected to the same bridge domain.

In accordance with the present disclosure, a method in a network device includes receiving a packet on a first port of the network device; performing first processing of the received packet in an ingress pipeline, including identifying a second port; performing second processing of the received packet in an egress pipeline associated with the second port, the egress pipeline separate from the ingress pipeline, wherein the second processing includes a tag editing operation when the first port and the second port are connected to different bridge domains; and transmitting the egress packet on the second port.

In some embodiments, the second processing does not include the tag editing operation when the first port and the second port are connected to the same bridge domain.

In some embodiments, the second processing further includes identifying a destination device from among a plurality of destination devices, wherein the tag editing operation is based on the identified destination device. In some embodiments, the tag editing operation is further based on a feature identifier.

In some embodiments, the tag editing operation includes performing a table lookup on a data table in the egress pipeline.

In some embodiments, the ingress pipeline is on a processing chip separate from a processing chip that contains the egress pipeline.

In some embodiments, the tag editing operation includes adding a VLAN tag to the received packet; or changing a VLAN tag already contained in the received packet, including changing the VLAN tag from a single-tag format to a double-tag format or changing the VLAN tag from a double-tag format to a single-tag format.

In accordance with the present disclosure, a network device includes one or more computer processors; and a first port, the first port having ingress pipeline circuitry associated with the first port; and a second port different from the first port, the second port having egress pipeline circuitry associated with the second port, wherein a packet received on the first port is processed by the ingress pipeline circuitry to produce an intermediate packet, wherein the intermediate packet is subsequently processed in the egress pipeline circuitry, including performing tag manipulation of the intermediate packet and transmitting an egress packet on the second port.

In some embodiments, tag manipulation of the intermediate packet is performed when the first port and the second port are connected to different bridge domains.

In some embodiments, tag manipulation of the intermediate packet is not performed when the first port and the second port are connected to the same bridge domain.

In some embodiments, the egress pipeline circuitry includes egress data tables, wherein the tag manipulation includes performing a table lookup on the egress data tables.

In some embodiments, the ingress pipeline circuitry is on an integrated circuit (IC) chip different from an IC chip of the egress pipeline circuitry.

In some embodiments, the tag manipulation includes adding a VLAN tag to the received packet; or changing a VLAN tag already contained in the received packet, including changing the VLAN tag from a single-tag format to a double-tag format or changing the VLAN tag from a double-tag format to a single-tag format.

In some embodiments, the network device is a PE device on a L2 EVPN MPLS network.

In accordance with the present disclosure, a method in a network device on an L2 EVPN MPLS network includes (a) receiving an ingress packet on a (ingress) port that is associated with one or more Ethernet segments (ES's), wherein the ingress port is a physical port or a logical port; (b) determining from among the one or more ES's an (ingress) ES on which the ingress packet was received based on the ingress port; (c) selecting a destination device from among a plurality of destination devices; (d) pushing a second MPLS label on the egress packet when the selected destination device is associated with the ingress ES, the second MPLS label based on the ingress ES and selected destination device; (e) pushing a first MPLS label on an egress packet, the first MPLS label based on the selected destination device; and (f) transmitting the egress packet to the determined destination.

In some embodiments, the ingress port is a logical port among a plurality of logical ports defined on a physical port of the network device.

In some embodiments, the ingress port is a physical port of the network device.

In some embodiments, the method further includes using the ingress ES and the selected destination device to access the second MPLS label from a database.

In some embodiments, the ingress packet is a flood packet, the method further comprising repeating (c) to (f) for each destination device in the plurality of destination devices.

In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on the L2 EVPN MPLS network.

In accordance with the present disclosure, a method in a network device on an L2 EVPN MPLS network includes receiving an ingress packet; performing first processing of the ingress packet in an ingress pipeline; performing second processing of the ingress packet subsequent to the first processing in an egress pipeline separate from the ingress pipeline; and transmitting the egress packet to the MPLS network. The second processing includes modifying a VLAN tag contained in the ingress packet to produce a modified VLAN tag for an egress packet and pushing an Ethernet segment identifier label onto the egress packet.

In some embodiments, the network device is associated with a plurality of Ethernet segments (ES's), wherein the ingress packet is received on a (ingress) ES among the plurality of ES's, the method further comprising pushing an additional MPLS label on the egress packet when the selected destination device is associated with the ingress ES, wherein the additional MPLS label is a label that identifies the ingress ES.

In some embodiments, the ingress packet is a flood packet, the method further comprising repeating the modifying, pushing, and transmitting for each destination device in the plurality of destination devices. In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on the L2 EVPN MPLS network.

In some embodiments, modifying the VLAN tag is based at least on an egress port on which to transmit the egress packet. In some embodiments, the tag editing operation is further based on a feature identifier

In some embodiments, the ingress pipeline is on a processing chip separate from a processing chip that contains the egress pipeline.

In accordance with the present disclosure, a network device on an Ethernet virtual private network (EVPN) Layer 2 (L2) multi-protocol label switching (MPLS) network, including receiving an ingress packet; performing first processing in response to receiving the ingress packet in an ingress pipeline; and performing second processing on the ingress packet in an egress pipeline separate from the ingress pipeline, the second processing including: modifying a virtual local area network (VLAN) tag contained in the ingress packet to produce a modified VLAN tag for an egress packet; pushing at least one MPLS label onto the egress packet; and transmitting the egress packet to a destination device on the MPLS network.

In some embodiments, the method further includes encapsulating the ingress packet as a payload in the egress packet, wherein the encapsulated ingress packet contains the modified VLAN tag as a payload VLAN tag.

In some embodiments, the EVPN L2 MPLS network includes a plurality of Ethernet segments (ES's), wherein the ingress packet is received on one of the plurality of ES's (ingress ES), wherein the at least one MPLS label is an identifier of the ingress ES when the destination device is connected to an ES that is the same as the ingress ES.

In some embodiments, the ingress packet is a flood packet, the method further comprising identifying a plurality of destination devices and repeating the modifying, pushing, and transmitting for each destination device in the plurality of destination devices. In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on the EVPN L2 MPLS network.

In some embodiments, the first processing in the ingress pipeline produces metadata that is used for the second processing in the egress pipeline.

In some embodiments, modifying the VLAN tag is based at least on an egress port on an egress port on which the egress packet is to be transmitted, and on a feature associated with the egress port.

In some embodiments, the ingress pipeline is on a processing chip separate from a processing chip that contains the egress pipeline.

In accordance with the present disclosure, a network device on an MPLS network includes one or more computer processors; a first port, the first port having ingress pipeline circuitry associated with the first port; and a second port different from the first port, the second port having egress pipeline circuitry, separate from the ingress pipeline, associated with the second port. An ingress packet received on the first port is processed by the ingress pipeline circuitry to produce metadata. The ingress packet is processed by the egress pipeline circuitry using the metadata to produce an egress packet, the egress packet including a modified VLAN tag generated by modifying a VLAN tag in the ingress packet; and at least one MPLS label determined based on the first port; and wherein the egress pipeline circuitry transmits the egress packet to the MPLS network to a destination device.

In some embodiments, the ingress pipeline circuitry is on an integrated circuit (IC) chip different from an IC chip of the egress pipeline circuitry.

In some embodiments, the first port is associated with an Ethernet segment (ES) and the destination device to which the egress packet is transmitted is connected to the same ES as the first port, wherein the at least one MPLS label is an identifier that identifies the ES.

In some embodiments, when the ingress packet is a flood packet, the method further comprises identifying a plurality of destination devices and repeating the modifying, pushing, and transmitting for each of the plurality of destination devices. In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on the MPLS network.

In some embodiments, the VLAN tag that is generated from the VLAN tag in the ingress packet is based on the second port being an egress port of the egress packet.

In accordance with the present disclosure, a method in a network device on an MPLS network including using first pipeline circuitry of the network device to process a received packet; and using second pipeline circuitry of the network device different from the first pipeline circuitry to generate an egress packet from the received packet, including: modifying a VLAN tag contained in the received packet, the egress packet containing the modified VLAN tag; and pushing an MPLS label onto the egress packet that is determined based on an ingress port of the network device on which the received packet ingressed; and transmitting the egress packet to a destination device, the egress packet transmitted on an egress port of the network device different from the ingress port.

In some embodiments, the ingress port is associated with an Ethernet segment (ES), wherein the MPLS label is an ES identifier label that identifies the ES when the destination device is connected to the same ES that the ingress port is associated with.

In some embodiments, the VLAN tag that is generated from the VLAN tag in the received packet is based at least on the egress port.

In some embodiments, the received packet is a flood packet, the method further comprising identifying a plurality of destination devices and repeating the modifying, pushing, and transmitting for each of the plurality of destination devices. In some embodiments, the network device and the plurality of destination devices are provider edge (PE) devices on the MPLS network.

In some embodiments, the first pipeline circuitry is on an IC chip different from an IC chip of the second pipeline circuitry.