Hi Guys

I've been researching an MPLS rollout and would like to have a single pppoe server near the internet breakout instead of at each highsite...I have a few questions that i'm hoping the experts can shed some light on:

1)Would QoS still be able effective even when the customers have pppoe sessions across the MPLS cloud from their CPE to internet breakout? I read somewere that encapsulated packets cause issues...
2)How would I forward the pppoe authentication's to the access concentrator? Would I create a VPLS tunnel from each highsite to the PPPOE A/C?

Thanks

Not too sure on the QOS part, but on the other part you can use VPLS or TE tunnels from the "Provider Edge" e.g. your customer facing AP's through your backhaul AP's to the concentrator.

thanks, is there a performance advantage in using VPLS compared to EOIP?

There definitely are performance benefits, you can see migration from EoIP to VPLS example with comparison (showing 60% improvement) here: http://mum.mikrotik.com/presentations/CZ09/MPLS.pdf

In order to tunnel PPPoE to central AC, you have to establish VPLS connections between APs and AC. It does not matter what way of establishing LSPs (either by LDP or TE) is used.

As to QoS - you have to be more specific as to what you want to achieve (where you want your QoS policy to be enforced and such). MPLS is able to carry QoS info in similar way as VLANs do, see:
http://wiki.mikrotik.com/wiki/EXP_bit_behaviour and http://wiki.mikrotik.com/wiki/WMM on how L2 protocols carry priority info.

Thanks for that PDF link, very useful. I want to prioritise the network for Voice

I've read both those wiki's and I am currently using WMM but I read somewhere that if the traffic is encapsulated in a pppoe tunnel then the AP cannot use WMM because it cannot identify the EXP_bit_label

If I give the packets a DSCP marking before the packets are encapsulated in pppoe, would WMM still function properly?


Thanks

WMM does not look into frames itself (e.g. at DSCP field). In order for WMM to prioritize packets, you must set priority of packet before it enters WMM enabled wireless link, as discussed here:
http://wiki.mikrotik.com/wiki/WMM#How_to_set_priority

Note that VPLS terminating router does not automatically set this packet property - it only initializes "ingress priority" property with value received in EXP bits. So you must add bridge firewall rule that would set packet priority from ingress priority.

So basically you have to do 2 things:
- set priority of packets on your PPPoE AC before they enter VPLS tunnel (this will ensure that your priority value gets sent in EXP bits);
- copy ingress priority to priority on APs (this will ensure that when packet hits wlan interface, its priority will be set to value received in EXP bits) using bridge firewall rule.

So basically you have to do 2 things:
- set priority of packets on your PPPoE AC before they enter VPLS tunnel (this will ensure that your priority value gets sent in EXP bits);
- copy ingress priority to priority on APs (this will ensure that when packet hits wlan interface, its priority will be set to value received in EXP bits) using bridge firewall rule.

How would I achieve step 1 if all the VPLS end points are bridged and the PPPOE A/C is on this bridged interface? Would I use mangle in the prerouting, postrouting or forward chains on the box with the PPPOE A/C?

thanks

Whichever you prefer/is best for your config, I guess. Probably postrouting, before packets get PPPoE encapsulated. The only requirement is that you do it before packet enters VPLS tunnel.

before packets get PPPoE encapsulated. The only requirement is that you do it before packet enters VPLS tunnel

So it needs to be before both then, before pppoe encapsulation and before entering the VPLS interface?...

If I add a transparent QoS box between the pppoe A/C and internet gateway, would that work?

EDIT: would pppoe encryption need to be turned off?

thanks

You can do it in IP firewall before PPPoE encap or in bridge firewall (by telling bridge firewall to use IP firewall for PPPoE packets) before entering VPLS tunnel. I would do it before PPPoE encap, because bridge firewall is not able to inspect encrypted PPPoE packets and that would also keep your setup simpler.

You can use transparent QoS box, but remember that packet priority value is completely "virtual" - it is not a field in packet. Therefore your QoS box would have to set up e.g. DSCP field in IP header and your PPPoE AC would still have to set priority value based on that (in IP firewall). The only benefit of this is that your PPPoE AC would have only one firewall rule (and not do all QoS classification). I would say that transparent QoS box is not necessary.

PPPoE encryption does not have to be turned off, if you set priority on AC before PPPoE encap.

Ah yes, forgot about bridge firewall...

Thanks, i'll give it a shot and report back

What is the best practice! is it good to have one PPPOE A/C or each AP should act as PPPOE AC? As I see if you have client looking for tunnel (VPLS) with the two CPEs in the same tower/AP, then by using pppoe the packet have to go to PPOE AC which is wastage of bandwidth. Any idea?