idnits 2.17.1 draft-ietf-bess-orf-covering-prefixes-06.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The document has examples using IPv4 documentation addresses according to RFC6890, but does not use any IPv6 documentation addresses. Maybe there should be IPv6 examples, too? Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 6, 2015) is 3339 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) No issues found here. Summary: 0 errors (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS Working Group H. Jeng 3 Internet-Draft AT&T 4 Intended status: Standards Track L. Jalil 5 Expires: September 7, 2015 Verizon 6 R. Bonica 7 Juniper Networks 8 K. Patel 9 Cisco Systems 10 L. Yong 11 Huawei Technologies 12 March 6, 2015 14 Covering Prefixes Outbound Route Filter for BGP-4 15 draft-ietf-bess-orf-covering-prefixes-06 17 Abstract 19 This document defines a new Outbound Route Filter (ORF) type, called 20 the "Covering Prefixes ORF (CP-ORF)". CP-ORF is applicable in 21 Virtual Hub-and-Spoke VPNs. It also is applicable in BGP/MPLS 22 Ethernet VPN (EVPN) networks. 24 Requirements Language 26 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 27 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 28 document are to be interpreted as described in RFC 2119 [RFC2119]. 30 Status of This Memo 32 This Internet-Draft is submitted in full conformance with the 33 provisions of BCP 78 and BCP 79. 35 Internet-Drafts are working documents of the Internet Engineering 36 Task Force (IETF). Note that other groups may also distribute 37 working documents as Internet-Drafts. The list of current Internet- 38 Drafts is at http://datatracker.ietf.org/drafts/current/. 40 Internet-Drafts are draft documents valid for a maximum of six months 41 and may be updated, replaced, or obsoleted by other documents at any 42 time. It is inappropriate to use Internet-Drafts as reference 43 material or to cite them other than as "work in progress." 45 This Internet-Draft will expire on September 7, 2015. 47 Copyright Notice 49 Copyright (c) 2015 IETF Trust and the persons identified as the 50 document authors. All rights reserved. 52 This document is subject to BCP 78 and the IETF Trust's Legal 53 Provisions Relating to IETF Documents 54 (http://trustee.ietf.org/license-info) in effect on the date of 55 publication of this document. Please review these documents 56 carefully, as they describe your rights and restrictions with respect 57 to this document. Code Components extracted from this document must 58 include Simplified BSD License text as described in Section 4.e of 59 the Trust Legal Provisions and are provided without warranty as 60 described in the Simplified BSD License. 62 Table of Contents 64 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 65 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 66 2. CP-ORF Encoding . . . . . . . . . . . . . . . . . . . . . . . 3 67 3. Processing Rules . . . . . . . . . . . . . . . . . . . . . . 6 68 4. Applicability In Virtual Hub-and-Spoke VPNs . . . . . . . . . 9 69 4.1. Multicast Considerations . . . . . . . . . . . . . . . . 12 70 5. Applicability In BGP/MPLS Ethernet VPN (EVPN) . . . . . . . . 12 71 6. Clean-up . . . . . . . . . . . . . . . . . . . . . . . . . . 16 72 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 73 8. Security Considerations . . . . . . . . . . . . . . . . . . . 17 74 9. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 17 75 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 17 76 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 77 11.1. Normative References . . . . . . . . . . . . . . . . . . 17 78 11.2. Informative References . . . . . . . . . . . . . . . . . 18 79 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 81 1. Introduction 83 A BGP [RFC4271] speaker can send Outbound Route Filters (ORF) 84 [RFC5291] to a peer. The peer uses ORFs to filter routing updates 85 that it sends to the BGP speaker. Using ORF, a BGP speaker can 86 realize a "route pull" paradigm, in which the BGP speaker, on demand, 87 pulls certain routes from the peer. 89 This document defines a new ORF-type, called the "Covering Prefixes 90 ORF (CP-ORF)". A BGP speaker sends a CP-ORF to a peer in order to 91 pull routes that cover a specified host address. A prefix covers a 92 host address if it can be used to forward traffic towards that host 93 address. Section 3 provides a more complete description of covering 94 prefix selection criteria. 96 CP-ORF is applicable in Virtual Hub-and-Spoke VPNs [RFC7024] 97 [RFC4364]. It also is applicable BGP/MPLS Ethernet VPN (EVPN) 98 [RFC7432] networks. 100 1.1. Terminology 102 This document uses the following terms: 104 o Address Family Identifier (AFI) - defined in [RFC4760] 106 o Subsequent Address Family Identifier (SAFI) - defined in [RFC4760] 108 o VPN IP Default Route - defined in [RFC7024]. 110 o V-Hub - defined in [RFC7024]. 112 o V-Spoke - defined in [RFC7024]. 114 o BGP/MPLS Ethernet VPN (EVPN) - defined in [RFC7432] 116 o EVPN Instance (EVI) - defined in [RFC7432] 118 o Unknown MAC Route (UMR) - A regular EVPN MAC/IP Advertisement 119 route where the MAC Address Length is set to 48 and the MAC 120 address to 00:00:00:00:00:00 122 o Default MAC Gateway (DMG) - An EVPN PE that advertises a UMR 124 2. CP-ORF Encoding 126 RFC 5291 augments the BGP ROUTE-REFRESH message so that it can carry 127 ORF entries. When the ROUTE-REFRESH message carries ORF entries, it 128 includes the following fields: 130 o AFI [IANA.AFI] 132 o SAFI [IANA.SAFI] 134 o When-to-refresh (IMMEDIATE or DEFERRED) 136 o ORF Type 138 o Length (of ORF entries) 140 The ROUTE-REFRESH message also contains a list of ORF entries. Each 141 ORF entry contains the following fields: 143 o Action (ADD, REMOVE, or REMOVE-ALL) 144 o Match (PERMIT or DENY) 146 The ORF entry may also contain Type-specific information. Type- 147 specific information is present only when the Action is equal to ADD 148 or REMOVE. It is not present when the Action is equal to REMOVE-ALL. 150 When the BGP ROUTE-REFRESH message carries CP-ORF entries, the 151 following conditions MUST be true: 153 o ORF Type MUST be equal to CP-ORF (65). 155 o The AFI MUST be equal to IPv4, IPv6 or L2VPN 157 o If the AFI is equal to IPv4 or IPv6, SAFI MUST be equal to MPLS- 158 labeled VPN address 160 o If the AFI is equal to L2VPN, the SAFI MUST be equal to BGP EVPN 162 o Match field MUST be equal to PERMIT 164 Figure 1 depicts the encoding of the CP-ORF type-specific 165 information. 167 +--------------------------------+ 168 | Sequence (32 bits) | 169 +--------------------------------+ 170 | Minlen (8 bits) | 171 +--------------------------------+ 172 | Maxlen (8 bits) | 173 +--------------------------------+ 174 | VPN Route Target (64 bits) | 175 +--------------------------------+ 176 | Import Route Target (64 bits) | 177 +--------------------------------+ 178 | Route Type (8 bits) | 179 +--------------------------------+ 180 | Host Address | 181 | (0, 32, 48 or 128 bits) | 182 | .... 183 +--------------------------------+ 185 Figure 1: CP-ORF Type-specific Encoding 187 The CP-ORF recipient uses the following fields to select routes 188 matching the CP-ORF: 190 o Sequence: Relative position of CP-ORF entry among other CP-ORF 191 entries 193 o Minlen: Minimum length of selected route (measured in bits) 195 o Maxlen: Maximum length of selected route (measured in bits) 197 o VPN Route Target : VPN Route Target carried by selected route 199 o Route Type: Type of selected route 201 o Host Address: Address covered by selected route 203 See Section 3 for details. 205 The CP-ORF recipient marks routes that match CP-ORF with the Import 206 Route Target before advertising those routes to the CP-ORF 207 originator. See Section 3 for details. 209 If the ROUTE-REFRESH AFI is equal to IPv4: 211 o The value of Minlen MUST be less than or equal to 32 213 o The value of Maxlen MUST be less than or equal to 32 215 o The value of Minlen MUST be less than or equal to the value of 216 Maxlen 218 o The value of Route Type MUST be 0 (i.e., RESERVED) 220 o The Host Address MUST contain exactly 32 bits 222 If the ROUTE-REFRESH AFI is equal to IPv6: 224 o The value of Minlen MUST be less than or equal to 128 226 o The value of Maxlen MUST be less than or equal to 128 228 o The value of Minlen MUST be less than or equal to the value of 229 Maxlen 231 o The value of Route Type MUST be 0 (i.e., RESERVED) 233 o The Host Address MUST contain exactly 128 bits 235 If the ROUTE-REFRESH AFI is equal to L2VPN, the value of Route Type 236 MUST be one of the following values, taken from IANA EVPN Registry 237 [IANA.EVPN]: 239 o 1 - Ethernet Autodiscovery Route 240 o 2 - MAC/IP Advertisement Route 242 o 3 - Inclusive Multicast Route 244 o 4 - Ethernet Segment Route 246 If the ROUTE-REFRESH AFI is equal to L2VPN and the value of Route 247 Type is equal to Ethernet Autodiscovery Route, Inclusive Multicast 248 Route, or Ethernet Segment Route: 250 o The value of Minlen MUST be equal to 0 252 o The value of Maxlen MUST be equal to 0 254 o The Host Address MUST be absent (i.e., contain 0 bits) 256 If the ROUTE-REFRESH AFI is equal to L2VPN and the value of Route 257 Type is equal to MAC/IP Advertisement Route: 259 o The value of Minlen MUST be less than or equal to 48 261 o The value of Maxlen MUST be less than or equal to 48 263 o The value of Minlen MUST be less than or equal to the value of 264 Maxlen 266 o The Host Address MUST contain exactly 48 bits. 268 3. Processing Rules 270 According to [RFC4271], every BGP speaker maintains a single Loc-RIB. 271 For each of its peers, the BGP speaker also maintains an Outbound 272 Filter and an Adj-RIB-Out. The Outbound Filter defines policy that 273 determines which Loc-RIB entries are processed into the corresponding 274 Adj-RIB-Out. Mechanisms such as RT-Contstrain [RFC4684] and ORF 275 [RFC5291] enable a router's peer to influence the Outbound Filter. 276 Therefore, the Outbound Filter for a given peer is constructed using 277 a combination of the locally configured policy and the information 278 received via RT-Constrain and ORF from the peer. 280 Using this model we can describe the operations of CP-ORF as follows: 282 When a BGP speaker receives a ROUTE-REFRESH message that contains a 283 CP-ORF, and that ROUTE-REFRESH message violates any of the encoding 284 rules specified in Section 2, the BGP speaker MUST ignore the entire 285 ROUTE-REFRESH message. It SHOULD also log the event. However, an 286 implementation MAY apply logging thresholds to avoid excessive 287 messaging or log file overflow. 289 Otherwise, the BGP speaker processes each CP-ORF entry as indicated 290 by the Action field. If the Action is equal to ADD, the BGP speaker 291 adds the CP-ORF entry to the Outbound Filter associated with the peer 292 in the position specified by the Sequence field. If the Action is 293 equal to REMOVE, the BGP speaker removes the CP-ORF entry from the 294 Outbound Filter. If the Action is equal to REMOVE-ALL, the BGP 295 speaker removes all CP-ORF entries from the Outbound Filter. 297 Whenever the BGP speaker applies an Outbound Filter to a route 298 contained in its Loc-RIB, it evaluates the route in terms of the CP- 299 ORF entries first. It then evaluates the route in terms of the 300 remaining, non-CP-ORF entries. The rules for the former are 301 described below. The rules for the latter are outside the scope of 302 this document. 304 The following route types can match a CP-ORF: 306 o IPv4-VPN 308 o IPv6-VPN 310 o L2VPN 312 In order for an IPv4-VPN route or IPv6-VPN route to match a CP-ORF, 313 all of the following conditions MUST be true: 315 o the route carries an RT whose value is the same as the CP-ORF VPN 316 Route Target 318 o the route prefix length is greater than or equal to the CP-ORF 319 Minlen plus 64 (i.e., the length of a VPN Route Distinguisher) 321 o the route prefix length is less than or equal to the CP-ORF Maxlen 322 plus 64 (i.e., the length of a VPN Route Distinguisher) 324 o ignoring the Route Distinguisher, the leading bits of the route 325 prefix are identical to the leading bits of the CP-ORF Host 326 Address. CP-ORF Minlen defines the number of bits that must be 327 identical. 329 o Loc-RIB does not contain a more specific route that also satisfies 330 all of the above listed conditions. 332 The BGP speaker ignores Route Distinguishers when determining whether 333 a prefix matches a host address. For example, assume that a CP-ORF 334 carries the following information: 336 o Minlen equal to 1 337 o Maxlen equal to 32 339 o Host Address equal to 192.0.2.1 341 Assume also that Loc-RIB contains routes for the following IPv4-VPN 342 prefixes, and that all of these routes carry an RT whose value is the 343 same as the CP-ORF VPN Route Target: 345 o 1:0.0.0.0/64. 347 o 2:192.0.2.0/88 349 o 3:192.0.2.0/89 351 Only the prefix 3:192.0.2.0/89 matches the CP-ORF. The prefix 352 1:0.0.0.0/64 does not match, because its length (64) is less than the 353 CP-ORF Minlen (1) plus the length of an L3VPN Route Distinguisher 354 (64). If Loc-RIB did not contain the prefix 3:192.0.2.0/89, 355 2:192.0.2.0/88 would match the CP-ORF. However, because Loc-RIB also 356 contains a more specific covering route (3:192.0.2.0/89), 357 2:192.0.2.0/88 does not match. Only 3:192.0.2.0/89 satisfies all of 358 the above listed match criteria. Note that the matching algorithm 359 ignored Route Distinguishers. 361 In order for an EVPN route to match a CP-ORF, all of the following 362 conditions MUST be true: 364 o the EVPN route type is equal to the CP-ORF Route Type 366 o the route carries an RT whose value is equal to the CP-ORF VPN 367 Route Target 369 In addition, if the CP-ORF Route Type is equal to MAC/IP 370 Advertisement Route, the following conditions also MUST be true: 372 o the EVPN Route MAC Address Length is greater than or equal to the 373 CP-ORF Minlen plus 64 (i.e., the length of a VPN Route 374 Distinguisher) 376 o the EVPN Route MAC Address Length is less than or equal to the CP- 377 ORF Maxlen plus 64 (i.e., the length of a VPN Route Distinguisher) 379 o ignoring the Route Distinguisher, the leading bits of the EVPN 380 Route MAC Address are identical to the leading bits of the CP-ORF 381 Host Address. CP-ORF Minlen defines the number of bits that must 382 be identical. 384 If a route matches the selection criteria of a CP-ORF entry, and it 385 does not violate any subsequent rule specified by the Outbound Filter 386 (e.g., rules that reflect local policy, or rules that are due to RT- 387 Constrains), the BGP speaker places the route into the Adj-RIB-Out. 388 In Adj-RIB-Out, the BGP speaker adds the CP-ORF Import Route Target 389 to the list of Route Targets that the route already carries. The BGP 390 speaker also adds a Transitive Opaque Extended Community [RFC4360] 391 with subtype equal to CP-ORF (0x03). As a result of being placed in 392 Adj-RIB-Out, the route is advertised to the peer associated with the 393 Adj-RIB-Out. 395 Receiving CP-ORF entries with REMOVE or REMOVE-ALL Actions may cause 396 a route that has previously been installed in a particular Adj-RIB- 397 Out be excluded from that Adj-RIB-Out. In this case, as specified in 398 [RFC4271], "the previously advertised route in that Adj-RIB-Out MUST 399 be withdrawn from service by means of an UPDATE message". 401 RFC 5291 states that a BGP speaker should respond to a ROUTE REFRESH 402 message as follows: 404 "If the When-to-refresh indicates IMMEDIATE, then after processing 405 all the ORF entries carried in the message the speaker re-advertises 406 to the peer routes from the Adj-RIB-Out associated with the peer that 407 have the same AFI/SAFI as what is carried in the message, and taking 408 into account all the ORF entries for that AFI/SAFI received from the 409 peer. The speaker MUST re-advertise all the routes that have been 410 affected by the ORF entries carried in the message, but MAY also re- 411 advertise the routes that have not been affected by the ORF entries 412 carried in the message." 414 When the ROUTE-REFRESH message includes only CP-ORF entries, the BGP 415 speaker MUST re-advertise routes that have been affected by these CP- 416 ORF entries. It is RECOMMENDED not to re-advertise the routes that 417 have not been affected by the CP-ORF entries. 419 The behavior when the ROUTE-REFRESH message includes one or more CP- 420 ORF entries and one or more ORF entries of a different type remains 421 unchanged from that described in RFC 5291. 423 4. Applicability In Virtual Hub-and-Spoke VPNs 425 In a Virtual Hub-and-Spoke environment, VPN sites are attached to 426 Provider Edge (PE) routers. For a given VPN, a PE router acts in 427 exactly one of the following roles: 429 o As neither a V-hub nor a V-Spoke 431 o As a V-hub 432 o As a V-spoke 434 To illustrate CP-ORF operation in conjunction with Virtual Hub-and- 435 Spoke assume the following: 437 o One of the sites in a particular VPN, RED-VPN, is connected to a 438 PE that acts as neither a V-hub nor a V-Spoke for RED-VPN. We 439 refer to this PE as PE1. 441 o Another site in RED-VPN is connected to another PE, and that PE 442 acts as a V-hub for RED-VPN. We refer to this PE as V-hub1. 444 o Yet another site in RED-VPN is connected to another PE, and that 445 PE acts as a V-spoke for RED-VPN. We refer to this PE as 446 V-spoke1. 448 All of these PEs advertise RED-VPN routes to a route reflector (RR). 449 They mark these routes with a route target, which we will call RT- 450 RED. In particular, PE1 advertises a RED-VPN route to a prefix that 451 we will call P. P covers a host address, that we will call H. 453 For the purpose of illustration also assume that the PEs and the RRs 454 use Route Target Constraint [RFC4684]. 456 V-hub1 serves the RED-VPN. Therefore, V-hub1 advertises a VPN IP 457 default route for the RED-VPN to the RR, carrying the route target 458 RT-RED-FROM-HUB1. 460 V-spoke1 establishes a BGP session with the RR, negotiating the CP- 461 ORF capability, as well as the Multiprotocol Extensions Capability 462 [RFC4760]. Upon establishment of the BGP session, the RR does not 463 advertise any routes to V-spoke1. The RR will not advertise any 464 routes until it receives either a ROUTE-REFRESH message or a BGP 465 UPDATE message containing a Route Target Membership NLRI [RFC4684]. 467 Immediately after the BGP session is established, V-spoke1 sends the 468 RR a BGP UPDATE message containing a Route Target Membership NLRI. 469 The Route Target Membership NLRI specifies RT-RED-FROM-HUB1 as its 470 route target. In response to the BGP-UPDATE message, the RR 471 advertises the VPN IP default route for the RED-VPN to V-spoke1. 472 This route carries the route target RT-RED-FROM-HUB1. V-spoke1 473 subjects this route to its import policy and accepts it because it 474 carries the route target RT-RED-FROM-HUB1. 476 Now, V-spoke1 begins normal operation, sending all of its RED-VPN 477 traffic through V-hub1. At some point, V-spoke1 determines that it 478 might benefit from a more direct route to H. (Criteria by which 479 V-spoke1 determines that it needs a more direct route to H are beyond 480 the scope of this document.) 482 In order to discover a more direct route, V-spoke1 assigns a unique 483 numeric identifier to H. V-spoke1 then sends a ROUTE-REFRESH message 484 to the RR, containing the following information: 486 o AFI is equal to IPv4 or IPv6, as appropriate 488 o SAFI is equal to "MPLS-labeled VPN address" 490 o When-to-refresh is equal IMMEDIATE 492 o Action is equal to ADD 494 o Match is equal to PERMIT 496 o ORF Type is equal to CP-ORF 498 o CP-ORF Sequence is equal to the identifier associated with H 500 o CP-ORF Minlen is equal to 1 502 o CP-ORF Maxlen is equal to 32 or 128, as appropriate 504 o CP-ORF VPN Route Target is equal to RT-RED 506 o CP-ORF Import Route Target is equal to RT-RED-FROM-HUB1 508 o CP-ORF Route Type is equal to 0 (i.e., undefined) 510 o CP-ORF Host Address is equal H 512 Upon receipt of the ROUTE-REFRESH message, the RR MUST ensure that it 513 carries all routes belonging to the RED-VPN. In at least one special 514 case, where all of the RR clients are V-spokes and none of the RR 515 clients are V-hubs, the RR will lack some or all of the required RED- 516 VPN routes. So, the RR sends a BGP UPDATE message containing a Route 517 Target Membership NLRI for VPN-RED to all of its peers. This causes 518 the peers to advertise VPN-RED routes to the RR, if they have not 519 done so already. 521 Next, the RR adds the received CP-ORF to the Outbound Filter 522 associated with V-spoke1. Using the procedures in Section 3, the RR 523 determines whether any of the routes in its Loc-RIB satisfy the 524 selection criteria of the newly updated Outbound Filter. If any 525 routes satisfy the match criteria, they are added to the Adj-RIB-Out 526 associated with V-spoke1. In Adj-RIB-Out, the RR adds RT-RED-FROM- 527 HUB1 to the list of Route Targets that the route already carries. 528 The RR also adds a Transitive Opaque Extended Community [RFC4360] 529 with subtype equal to CP-ORF. Finally, RR advertises the newly added 530 routes to V-spoke1. In this example, the RR advertises P to V-Spoke1 531 with a next-hop of PE1. 533 V-spoke1 subjects the advertised routes to its import policy and 534 accepts them because they carry the route target RT-RED-FROM-HUB1. 536 V-spoke1 may repeat this process whenever it discovers another flow 537 that might benefit from a more direct route to its destination. 539 4.1. Multicast Considerations 541 When applying Multicast VPN [RFC6513][RFC6514] procedures, routes 542 bearing a Transitive Opaque Extended Community [RFC4360] with subtype 543 equal to CP-ORF MUST NOT be used to determine Eligible Upstream 544 Multicast Hops (UMH). 546 5. Applicability In BGP/MPLS Ethernet VPN (EVPN) 548 In a EVPN environment, CE devices are attached to Provider Edge (PE) 549 routers. A CE can be a host, a router or a switch. For a given EVPN 550 Instance (EVI), a PE router acts in exactly one of the following 551 roles: 553 o As neither a Default MAC Gateway (DMG) nor a Spoke 555 o As a DMG 557 o As a Spoke 559 To illustrate CP-ORF operation in the EVPN environment assume the 560 following: 562 o A CE device in a particular EVI, RED-EVI, is connected to a PE 563 that acts as neither a DMG nor a Spoke for RED-EVI. We refer to 564 this PE as PE1. 566 o Another CE device in RED-EVI is connected to another PE, and that 567 PE acts as a DMG for RED-EVI. We refer to this PE as DMG1. 569 o Yet another CE device in RED-EVI is connected to another PE, and 570 that PE acts as a Spoke for RED-EVI. We refer to this PE as 571 Spoke1. 573 All of these PEs advertise RED-EVI routes to a RR. They mark these 574 routes with a route target, which we will call RT-RED. In 575 particular, PE1 advertises a RED-EVI route to a MAC Address that we 576 will call M. 578 The RED-EVI VRFs on all of these PEs are provisioned to import EVPN 579 routes that carry RT-RED. 581 Since DMG1 acts as a DMG for RED-EVI, DMG1 advertises a Unknown MAC 582 Route (UMR) for the RED-EVI to the RR, carrying the route target RT- 583 RED. The UMR is characterized as follows: 585 o EVPN Route Type is equal to MAC/IP Advertisement Route 587 o MAC address length is equal to 0 589 o IP address length is equal to 0 591 Spoke1 establishes a BGP session with the RR, negotiating the CP-ORF 592 capability, as well as the Multiprotocol Extensions Capability 593 [RFC4760]. Upon establishment of the BGP session, the RR does not 594 advertise any routes to Spoke1. The RR will not advertise any routes 595 until it receives a ROUTE-REFRESH message. 597 Immediately after the BGP session is established, Spoke1 sends the RR 598 a ROUTE REFRESH message containing the following information: 600 o AFI is equal to L2VPN 602 o SAFI is equal to BGP EVPN 604 o When-to-refresh is equal IMMEDIATE 606 o Action is equal to ADD 608 o Match is equal to PERMIT 610 The ROUTE REFRESH message also contains four ORF entries. The first 611 ORF entry contains the following information: 613 o ORF Type is equal to CP-ORF 615 o CP-ORF Sequence is equal 1 617 o CP-ORF Minlen is equal to 0 619 o CP-ORF Maxlen is equal to 0 621 o CP-ORF VPN Route Target is equal to RT-RED 622 o CP-ORF Import Route Target is equal to RT-RED 624 o CP-ORF Route Type is equal to 1 (Ethernet Autodiscovery Route) 626 The second ORF entry contains the following information: 628 o ORF Type is equal to CP-ORF 630 o CP-ORF Sequence is equal 2 632 o CP-ORF Minlen is equal to 0 634 o CP-ORF Maxlen is equal to 0 636 o CP-ORF VPN Route Target is equal to RT-RED 638 o CP-ORF Import Route Target is equal to RT-RED 640 o CP-ORF Route Type is equal to 2 (MAC/IP Advertisement Route) 642 The third ORF entry contains the following information: 644 o ORF Type is equal to CP-ORF 646 o CP-ORF Sequence is equal 3 648 o CP-ORF Minlen is equal to 0 650 o CP-ORF Maxlen is equal to 0 652 o CP-ORF VPN Route Target is equal to RT-RED 654 o CP-ORF Import Route Target is equal to RT-RED 656 o CP-ORF Route Type is equal to 3 (Inclusive Multicast Route) 658 The fourth ORF entry contains the following information: 660 o ORF Type is equal to CP-ORF 662 o CP-ORF Sequence is equal 4 664 o CP-ORF Minlen is equal to 0 666 o CP-ORF Maxlen is equal to 0 668 o CP-ORF VPN Route Target is equal to RT-RED 669 o CP-ORF Import Route Target is equal to RT-RED 671 o CP-ORF Route Type is equal to 4 (Ethernet Segment Route) 673 In response to the ROUTE REFRESH message, the RR advertises the 674 following to V-spoke1: 676 o All Ethernet Autodiscovery Routes belonging to RED-EVI 678 o A UMR advertised by DMG1 and belonging to RED-EVI 680 o All Inclusive Multicast Routes belonging to RED-EVI 682 o All Ethernet Segment Routes belonging to RED-EVI 684 All of these routes carries the route target RT-RED. Spoke1 subjects 685 these routes to its import policy and accepts them because they carry 686 the route target RT-RED. 688 Now, Spoke1 begins normal operation, sending all of its RED-VPN 689 traffic through DMG1. At some point, Spoke1 determines that it might 690 benefit from a more direct route to M. (Criteria by which Spoke1 691 determines that it needs a more direct route to M are beyond the 692 scope of this document.) 694 In order to discover a more direct route, Spoke1 assigns a unique 695 numeric identifier to M. V-spoke1 then sends a ROUTE-REFRESH message 696 to the RR, containing the following information: 698 o AFI is equal to L2VPN 700 o SAFI is equal to BGP EVPN 702 o When-to-refresh is equal IMMEDIATE 704 o Action is equal to ADD 706 o Match is equal to PERMIT 708 o ORF Type is equal to CP-ORF 710 o CP-ORF Sequence is equal to the identifier associated with M 712 o CP-ORF Minlen is equal to 1 714 o CP-ORF Maxlen is equal to 48 716 o CP-ORF VPN Route Target is equal to RT-RED 717 o CP-ORF Import Route Target is equal to RT-RED 719 o CP-ORF Route Type is equal to 2 (i.e., MAC/IP Advertisement Route) 721 o CP-ORF Host Address is equal M 723 Next, the RR adds the received CP-ORF to the Outbound Filter 724 associated with Spoke1. Using the procedures in Section 3, the RR 725 determines whether any of the routes in its Loc-RIB satisfy the 726 selection criteria of the newly updated Outbound Filter. If any 727 routes satisfy the match criteria, they are added to the Adj-RIB-Out 728 associated with Spoke1. The RR adds a Transitive Opaque Extended 729 Community [RFC4360] with subtype equal to CP-ORF. Note that as these 730 routes are added to the Adj-RIB-Out, the RR does not change the list 731 of Route Targets that the route already carries. Finally, RR 732 advertises the newly added routes to V-spoke1. In this example, the 733 RR advertises M to V-Spoke1 with a next-hop of PE1. 735 Spoke1 subjects the advertised routes to its import policy and 736 accepts them because they carry the route target RT-RED. 738 Spoke1 may repeat this process whenever it discovers another flow 739 that might benefit from a more direct route to its destination. 741 Note that in general an EVI may have more than one DMG, in which case 742 each spoke would receive a UMR from each of them. The spoke should 743 follow its local route selection procedures to select one of them as 744 the "best", and use the selected one. 746 6. Clean-up 748 Each CP-ORF consumes memory and compute resources on the device that 749 supports it. Therefore, in order to obtain optimal performance, BGP 750 speakers periodically evaluate all CP-ORFs that they have originated 751 and remove unneeded CP-ORFs. The criteria by which a BGP speaker 752 identifies unneeded CP-ORF entries is a matter of local policy, and 753 is beyond the scope of this document. 755 7. IANA Considerations 757 This memo uses code points from the first-come-first-served range of 758 the following registries: 760 +-----------------------------------------------+---------------+ 761 | Registry | Code Point | 762 +-----------------------------------------------+---------------+ 763 | BGP Outbound Route Filtering (ORF) Types | CP-ORF (65) | 764 | Transitive Opaque Extended Community Sub-Type | CP-ORF (0x03) | 765 +-----------------------------------------------+---------------+ 767 IANA is requested to update the above mentioned registry entries so 768 that they include a stable reference to this memo. 770 8. Security Considerations 772 Each CP-ORF consumes memory and compute resources on the device that 773 supports it. Therefore, a device supporting CP-ORF takes the 774 following steps to protect itself from oversubscription: 776 o When negotiating the ORF capability, advertise willingness to 777 receive the CP-ORF only to known, trusted iBGP peers. See 778 Section 5 of RFC 5291 for negotiation details. 780 o Enforce a per-peer limit on the number of CP-ORFs that can be 781 installed at any given time. Ignore all requests to add CP-ORFs 782 beyond that limit 784 Security considerations for BGP are presented in RFC4271 while 785 further security analysis of BGP is found in [RFC6952]. 787 9. Contributors 789 The following individuals contributed to the development of this 790 document: 792 o Yakov Rekhter 794 o Xiaohu Xu 796 10. Acknowledgements 798 The authors wish to acknowledge Han Nguyen, James Uttaro and Alvaro 799 Retana for their comments and contributions. 801 11. References 803 11.1. Normative References 805 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 806 Requirement Levels", BCP 14, RFC 2119, March 1997. 808 [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway 809 Protocol 4 (BGP-4)", RFC 4271, January 2006. 811 [RFC4360] Sangli, S., Tappan, D., and Y. Rekhter, "BGP Extended 812 Communities Attribute", RFC 4360, February 2006. 814 [RFC4684] Marques, P., Bonica, R., Fang, L., Martini, L., Raszuk, 815 R., Patel, K., and J. Guichard, "Constrained Route 816 Distribution for Border Gateway Protocol/MultiProtocol 817 Label Switching (BGP/MPLS) Internet Protocol (IP) Virtual 818 Private Networks (VPNs)", RFC 4684, November 2006. 820 [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, 821 "Multiprotocol Extensions for BGP-4", RFC 4760, January 822 2007. 824 [RFC5291] Chen, E. and Y. Rekhter, "Outbound Route Filtering 825 Capability for BGP-4", RFC 5291, August 2008. 827 [RFC6513] Rosen, E. and R. Aggarwal, "Multicast in MPLS/BGP IP 828 VPNs", RFC 6513, February 2012. 830 [RFC6514] Aggarwal, R., Rosen, E., Morin, T., and Y. Rekhter, "BGP 831 Encodings and Procedures for Multicast in MPLS/BGP IP 832 VPNs", RFC 6514, February 2012. 834 [RFC7024] Jeng, H., Uttaro, J., Jalil, L., Decraene, B., Rekhter, 835 Y., and R. Aggarwal, "Virtual Hub-and-Spoke in BGP/MPLS 836 VPNs", RFC 7024, October 2013. 838 [RFC7432] Sajassi, A., Aggarwal, R., Bitar, N., Isaac, A., Uttaro, 839 J., Drake, J., and W. Henderickx, "BGP MPLS-Based Ethernet 840 VPN", RFC 7432, February 2015. 842 11.2. Informative References 844 [IANA.AFI] 845 IANA, "Address Family Numbers", 846 . 849 [IANA.EVPN] 850 IANA, "Ethernet VPN (EVPN)", 851 . 853 [IANA.SAFI] 854 IANA, "Subsequent Address Family Identifiers (SAFI) 855 Parameters", . 858 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 859 Networks (VPNs)", RFC 4364, February 2006. 861 [RFC6952] Jethanandani, M., Patel, K., and L. Zheng, "Analysis of 862 BGP, LDP, PCEP, and MSDP Issues According to the Keying 863 and Authentication for Routing Protocols (KARP) Design 864 Guide", RFC 6952, May 2013. 866 Authors' Addresses 868 Huajin Jeng 869 AT&T 871 Email: hj2387@att.com 873 Luay Jalil 874 Verizon 876 Email: luay.jalil@verizon.com 878 Ron Bonica 879 Juniper Networks 880 2251 Corporate Park Drive 881 Herndon, Virginia 20170 882 USA 884 Email: rbonica@juniper.net 886 Keyur Patel 887 Cisco Systems 888 170 W. Tasman Drive 889 San Jose, California 95134 890 USA 892 Email: keyupate@cisco.com 893 Lucy Yong 894 Huawei Technologies 895 Austin, Texas 896 USA 898 Email: lucy.yong@huawei.com