Theoretical foundations and architecture

Virtual Private Wire Service (VPWS, RFC 4447), frequently termed Ethernet over MPLS (EoMPLS) or Pseudowire (PW), delivers point-to-point Layer 2 circuit emulation across an IP/MPLS core. Edge PE routers encapsulate raw ingress customer Ethernet frames (or 802.1Q tagged frames) directly into MPLS packets without inspecting or routing IP payloads. Customers can run arbitrary upper-layer protocols (IPv4, IPv6, IPX, OSPF, IS-IS). Packet transmission uses a dual-label stack: 1. Outer Transport Label: directs the packet across the MPLS core to the egress PE. 2. Inner Pseudowire (VC) Label: negotiated between PEs via Targeted LDP (tLDP) or BGP, identifying the specific customer attachment circuit (AC) at the destination. Both PE endpoints must be configured with matching Virtual Circuit Identifiers (VC ID). Circuit establishment strictly verifies matching interface MTUs and Control Word signaling.

What VPWS is at the protocol level

VPWS (Virtual Private Wire Service) emulates a single wire between two Attachment Circuits (AC): a port or VLAN on PE1 is connected to a port or VLAN on PE2. The architecture is described in RFC 3985 (PWE3), Ethernet encapsulation in RFC 4448, and LDP signaling in RFC 4447. The PE does not look at the customer L3 header and does not build a MAC table: a frame received on the AC is placed whole (without preamble and FCS) into the pseudowire, then extracted at the egress and handed to the AC. This is why the customer can run any protocol on top: IPv4/IPv6, IS-IS, LLDP, STP BPDU.

Forwarding uses a stack of two labels. The outer one (transport/tunnel label) is chosen by the LDP or RSVP-TE LSP to the loopback of the remote PE and is swapped at every P router. The inner one (PW label, VC label) sits at the bottom of the stack (S bit = 1) and the P router does not see it; its value is allocated by the receiving PE and advertised to the sender. Labels in the two directions are independent: local 24 on PE1 and remote 21 is normal, there is no symmetry.

LDP signaling, FEC 128 (RFC 4447)

PE1 and PE2 open a targeted LDP session (unicast Hello on UDP 646 to the peer address, then TCP 646). It needs only IP reachability between the loopbacks: the session does not have to follow the same path as the PW. By default Cisco targeted hello is 10 s / hold 90 s, keepalive 60 s / hold 180 s, and link-hello is 5/15 s. The session survives the loss of an individual link adjacency as long as the route to the peer is alive.

Over the session each PE sends a Label Mapping with a FEC element of type 0x80 (PWid FEC, also known as FEC 128). Fields: C-bit (1 = ready to use the control word), PW Type (15 bits), Group ID (32 bits, a logical group of PWs for mass withdraw), PW ID (32 bits, this is the VC ID) and Interface Parameters. Among the parameters the important ones are Interface MTU (sub-TLV 0x01), VCCV capability (0x0C) and Requested VLAN ID. The PW label is carried in the Generic Label TLV. Two PEs bind the PW when PW ID, PW Type, MTU and (if the C-bit is set on both) the control word all match. A mismatch causes a refusal; on the CLI these are the statuses MM (mtu mismatch), EM (encapsulation mismatch), CM (control-word mismatch).

FEC 129 (AGI/SAII/TAII, RFC 6074) uses the Attachment Group Identifier and source/target identifiers instead of a numeric PW ID. It is used when PWs are found by BGP auto-discovery (BGP-AD) rather than configured by hand.

PW types and AC modes

PW Type 5 (Ethernet) carries frames in raw mode: if the AC has a VLAN tag, it is significant only on the AC and is usually removed (rewrite pop). PW Type 4 (Ethernet Tagged Mode) carries the tag in the PW, and at egress the PE may replace it (service-delimiting tag). Different types on the two ends will not come up without interworking. Other types: 0x0006 HDLC, 0x0007 PPP. Port-based AC: the whole port goes into the PW including all customer VLANs; VLAN-based AC: only one VLAN goes.

Control word and MTU

The control word (RFC 4385) is 4 bytes between the PW label and the frame: 0000 | flags (4 bits) | FRG (2) | Length (6) | Sequence (16). The first nibble 0000 is needed so that transit P routers doing ECMP hashing do not mistake the first byte of the Ethernet frame for an IP version (4 or 6) and spread packets of one flow over different paths, breaking the order. The sequence number is not used by default (0). The control word is also required for VCCV type 1.

The MTU is calculated like this: customer L3 MTU 1500 + Ethernet header 14 (+4 if the tag is preserved) + control word 4 + PW label 4 + transport label 4 = 1526-1530 bytes; with TE/FRR or two transport labels add another 4-8. Core interfaces are raised to 1600 or more, but the Interface MTU in the FEC is specifically the MTU of the AC (1500). If one end has 1500 and the other 1504, the PW will not come up (Cisco and Huawei check strictly, Junos shows MM). The check must not be disabled: large frames would be silently dropped in the core.

PW status and OAM

The PW Status TLV (RFC 4447, type 0x096A) is a 32-bit mask: 0x1 Pseudowire Not Forwarding, 0x2 Local AC Receive Fault, 0x4 Local AC Transmit Fault, 0x8 Local PSN-facing PW Receive Fault, 0x10 Local PSN-facing PW Transmit Fault. Support is negotiated in the Label Mapping. Thanks to it, an AC failure on PE2 is reflected on PE1 within seconds (the PW goes Down with status Remote AC fault) instead of waiting for the LDP timeout. Without the Status TLV only Label Withdraw remains, sent when the PW is deleted.