Aggregation, BNG and BRAS

Theoretical foundations and architecture

Broadband Access architectures bridge residential and commercial subscribers into the MPLS backbone through a 3-tier topology: 1. Access Layer: Layer-2 access switches and GPON Optical Line Terminals (OLTs) terminating customer premise equipment (CPE/ONT). 2. Aggregation Layer: Metro Ethernet ring switches consolidating upstream access rings via 802.1ad QinQ dual-tagging (Outer Service VLAN / S-VLAN identifying regional hubs, Inner Customer VLAN / C-VLAN isolating subscriber ports). 3. Broadband Network Gateway (BNG / BRAS): the edge routing nexus and default gateway for all broadband subscribers. The BNG terminates Layer-2 subscriber access sessions, coordinates with central RADIUS servers for AAA (Authentication, Authorization, Accounting), dynamically instantiates per-subscriber QoS and rate-limiting policies, and maps subscriber flows directly into corresponding core MPLS VRFs.

Three levels of the access network and the role of the BNG

The subscriber (ONT/CPE) connects to an OLT (GPON/XGS-PON) or an Ethernet access switch (FTTB); these are collected into an aggregation ring or star (Metro Ethernet, 10/100G), and only there sits the BNG, the first L3 point for the subscriber. Access and aggregation work at L2: they hold no subscriber routes, they only tag frames and limit the broadcast domain. The BNG terminates the subscriber (IP address, session, policy, accounting), so the state on it is measured in tens or hundreds of thousands of sessions rather than MAC addresses. PPPoE/IPoE are covered in the next lesson and RADIUS after that; here we look at what lies below the session: tags, isolation and the hand-off to MPLS.

Q-in-Q: 802.1Q, 802.1ad and tag capacity

A VLAN ID is 12 bits, i.e. 4094 usable values, which is not enough for a city with hundreds of thousands of subscribers. Double tagging gives 4094 x 4094 combinations. The outer tag (S-VLAN, Service/Provider VLAN) identifies an OLT, an aggregation port or a service; the inner tag (C-VLAN, Customer VLAN) identifies a subscriber or a service. In IEEE 802.1ad the outer tag has TPID 0x88A8 and the inner one 0x8100; in practice some access equipment also uses 0x8100 for the outer tag (so-called "legacy Q-in-Q"), so the TPID at the OLT - aggregation - BNG boundary must be checked explicitly: if it does not match, the BNG does not recognise the frame as double-tagged. Each extra tag adds 4 bytes: with a subscriber MTU of 1500 the aggregation needs at least 1508 at the Ethernet level, and with PPPoE (+8) and MPLS labels in the core even more, so access networks usually configure jumbo MTU 9000+ on all uplinks.

1:1 and N:1 (VLAN models per TR-101)

In the 1:1 model every subscriber has its own S+C pair (or its own C-VLAN on a port): the subscriber is isolated at L2 by construction and the BNG gets the line identifier directly from the tags. The price is the number of subinterfaces on the BNG and a lot of configuration (so tagged interfaces are created dynamically on the first frame rather than by hand). In the N:1 (service VLAN) model many subscribers share one VLAN per service (Internet, IPTV, VoIP); isolation is provided by the switches themselves: split horizon/private VLAN on access ports, a ban on forwarding between client ports, DHCP snooping + IP source guard + dynamic ARP inspection, MAC forced forwarding. N:1 is cheaper in BNG resources, but MAC/IP spoofing, ARP poisoning and rogue DHCP servers are blocked only by discipline at the access level. For services a separate C-VLAN (or S-VLAN) is usually taken for Internet, IPTV (multicast) and VoIP so that different QoS and VRFs can be applied.

Line identification: DHCP option 82 and the PPPoE Intermediate Agent

If the subscriber does not enter a login, the BNG has to know which physical line the request came from. An access switch with DHCP snooping inserts option 82 (RFC 3046) into the DHCPv4 request: sub-option 1 Circuit-ID (port/VLAN), sub-option 2 Remote-ID (identifier of the access node, often a MAC or hostname). The TR-101 format is Access-Node-Identifier eth slot/port[:vlan-id], for example OLT-05 eth 1/3/7:20. For IPv6 the equivalents are DHCPv6 option 18 (Interface-ID) and 37 (Remote-ID); for PPPoE it is the PPPoE Intermediate Agent tag (Agent-Circuit-ID/Remote-ID in the PPPoE Vendor-Specific tag). The BNG passes these values to RADIUS (Agent-Circuit-Id/Agent-Remote-Id or NAS-Port-Id attributes) and uses them to bind the session to the line. An important trap: a packet that arrives from a switch with option 82 but with giaddr = 0.0.0.0 is dropped by a standard DHCP relay as untrusted; trust must be enabled explicitly (ip dhcp relay information trust-all on Cisco).

Binding a subscriber to a VRF and the exit into MPLS

In an L3VPN core the BNG is an ordinary PE. For static subinterfaces the VRF binding is part of the configuration (vrf forwarding, ip binding vpn-instance, routing-instances ... interface). For dynamic sessions the VRF is selected by a RADIUS attribute or a profile (see the RADIUS lesson). Subscriber routes (the C-VLAN subnet or per-session /32s) enter the BGP VRF through redistribute connected/subscriber and travel over MP-BGP with a VPN label: the transport label towards the BNG PE is provided by LDP/SR, as in the earlier modules. Service resources (DHCP, RADIUS, DNS, payment portal) are placed in their own VRF/service network and imported with the right RTs so that they are reachable from the subscriber VRF while subscribers do not see each other. Subscriber IP packets enter the core as VPN traffic: the stack consists of a transport and a VPN label, so the core MTU must cover 1500 + 8 (PPPoE maximum) + labels.