idnits 2.17.1 draft-ietf-bess-srv6-services-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 11, 2020) is 1384 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-21) exists of draft-ietf-bess-evpn-igmp-mld-proxy-05 == Outdated reference: A later version (-08) exists of draft-ietf-bess-evpn-vpws-fxc-01 == Outdated reference: A later version (-06) exists of draft-ietf-bess-rfc5549revision-04 == Outdated reference: A later version (-28) exists of draft-ietf-spring-srv6-network-programming-16 == Outdated reference: A later version (-26) exists of draft-ietf-idr-segment-routing-te-policy-09 == Outdated reference: A later version (-22) exists of draft-ietf-spring-segment-routing-policy-08 == Outdated reference: A later version (-15) exists of draft-matsushima-spring-srv6-deployment-status-07 Summary: 0 errors (**), 0 flaws (~~), 8 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS Working Group G. Dawra, Ed. 3 Internet-Draft LinkedIn 4 Intended status: Standards Track C. Filsfils 5 Expires: January 12, 2021 Cisco Systems 6 R. Raszuk 7 Bloomberg LP 8 B. Decraene 9 Orange 10 S. Zhuang 11 Huawei Technologies 12 J. Rabadan 13 Nokia 14 July 11, 2020 16 SRv6 BGP based Overlay services 17 draft-ietf-bess-srv6-services-03 19 Abstract 21 This draft defines procedures and messages for SRv6-based BGP 22 services including L3VPN, EVPN and Internet services. It builds on 23 RFC4364 "BGP/MPLS IP Virtual Private Networks (VPNs)" and RFC7432 24 "BGP MPLS-Based Ethernet VPN". 26 Status of This Memo 28 This Internet-Draft is submitted in full conformance with the 29 provisions of BCP 78 and BCP 79. 31 Internet-Drafts are working documents of the Internet Engineering 32 Task Force (IETF). Note that other groups may also distribute 33 working documents as Internet-Drafts. The list of current Internet- 34 Drafts is at https://datatracker.ietf.org/drafts/current/. 36 Internet-Drafts are draft documents valid for a maximum of six months 37 and may be updated, replaced, or obsoleted by other documents at any 38 time. It is inappropriate to use Internet-Drafts as reference 39 material or to cite them other than as "work in progress." 41 This Internet-Draft will expire on January 12, 2021. 43 Copyright Notice 45 Copyright (c) 2020 IETF Trust and the persons identified as the 46 document authors. All rights reserved. 48 This document is subject to BCP 78 and the IETF Trust's Legal 49 Provisions Relating to IETF Documents 50 (https://trustee.ietf.org/license-info) in effect on the date of 51 publication of this document. Please review these documents 52 carefully, as they describe your rights and restrictions with respect 53 to this document. Code Components extracted from this document must 54 include Simplified BSD License text as described in Section 4.e of 55 the Trust Legal Provisions and are provided without warranty as 56 described in the Simplified BSD License. 58 Table of Contents 60 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 61 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 62 2. SRv6 Services TLVs . . . . . . . . . . . . . . . . . . . . . 4 63 3. SRv6 Service Sub-TLVs . . . . . . . . . . . . . . . . . . . . 5 64 3.1. SRv6 SID Information Sub-TLV . . . . . . . . . . . . . . 6 65 3.2. SRv6 Service Data Sub-Sub-TLVs . . . . . . . . . . . . . 7 66 3.2.1. SRv6 SID Structure Sub-Sub-TLV . . . . . . . . . . . 7 67 4. Encoding SRv6 SID information . . . . . . . . . . . . . . . . 9 68 5. BGP based L3 service over SRv6 . . . . . . . . . . . . . . . 10 69 5.1. IPv4 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 11 70 5.2. IPv6 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 12 71 5.3. Global IPv4 over SRv6 Core . . . . . . . . . . . . . . . 12 72 5.4. Global IPv6 over SRv6 Core . . . . . . . . . . . . . . . 12 73 6. BGP based Ethernet VPN (EVPN) over SRv6 . . . . . . . . . . . 12 74 6.1. Ethernet Auto-discovery route over SRv6 Core . . . . . . 13 75 6.1.1. Per-ES A-D route . . . . . . . . . . . . . . . . . . 14 76 6.1.2. Per-EVI A-D route . . . . . . . . . . . . . . . . . . 14 77 6.2. MAC/IP Advertisement route over SRv6 Core . . . . . . . . 14 78 6.2.1. MAC/IP Advertisement route with MAC Only . . . . . . 15 79 6.2.2. MAC/IP Advertisement route with MAC+IP . . . . . . . 16 80 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core . . 16 81 6.4. Ethernet Segment route over SRv6 Core . . . . . . . . . . 18 82 6.5. IP prefix route over SRv6 Core . . . . . . . . . . . . . 18 83 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 84 core . . . . . . . . . . . . . . . . . . . . . . . . . . 19 85 7. Implementation Status . . . . . . . . . . . . . . . . . . . . 19 86 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 19 87 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20 88 9.1. BGP Prefix-SID TLV Types registry . . . . . . . . . . . . 20 89 9.2. SRv6 Service Sub-TLV Types registry . . . . . . . . . . . 21 90 9.3. SRv6 Service Data Sub-Sub-TLV Types registry . . . . . . 21 91 10. Security Considerations . . . . . . . . . . . . . . . . . . . 21 92 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 22 93 12. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 22 94 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 24 95 13.1. Normative References . . . . . . . . . . . . . . . . . . 24 96 13.2. Informative References . . . . . . . . . . . . . . . . . 27 97 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27 99 1. Introduction 101 SRv6 refers to Segment Routing [RFC8402] instantiated on the IPv6 102 dataplane [RFC8754]. 104 SRv6 based BGP services refers to the L3 and L2 overlay services with 105 BGP as control plane and SRv6 as dataplane. 107 SRv6 SID refers to a SRv6 Segment Identifier as defined in [RFC8402]. 109 SRv6 Service SID refers to an SRv6 SID associated with one of the 110 service specific behavior on the advertising Provider Edge (PE) 111 router, such as (but not limited to), END.DT (Table lookup in a VRF) 112 or END.DX (cross-connect to a nexthop) behaviors in the case of L3VPN 113 service as defined in [I-D.ietf-spring-srv6-network-programming]. 115 To provide SRv6 service with best-effort connectivity, the egress PE 116 signals an SRv6 Service SID with the BGP overlay service route. The 117 ingress PE encapsulates the payload in an outer IPv6 header where the 118 destination address is the SRv6 Service SID provided by the egress 119 PE. The underlay between the PEs only need to support plain IPv6 120 forwarding [RFC8200]. 122 To provide SRv6 service in conjunction with an underlay SLA from the 123 ingress PE to the egress PE, the egress PE colors the overlay service 124 route with a Color extended community 125 [I-D.ietf-idr-segment-routing-te-policy]. The ingress PE 126 encapsulates the payload packet in an outer IPv6 header with the 127 segment list of SR policy associated with the related SLA followed by 128 the SRv6 Service SID associated with the route. The underlay nodes 129 whose SRv6 SID's are part of the segment list MUST support SRv6 data 130 plane. 132 BGP is used to advertise the reachability of prefixes of a particular 133 service from an egress PE to ingress PE nodes. 135 This document describes how existing BGP messages between PEs may 136 carry SRv6 Service SIDs as a means to interconnect PEs and form VPNs. 138 1.1. Requirements Language 140 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 141 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 142 "OPTIONAL" in this document are to be interpreted as described in BCP 143 14 [RFC2119] [RFC8174] when, and only when, they appear in all 144 capitals, as shown here. 146 2. SRv6 Services TLVs 148 This document extends the BGP Prefix-SID attribute [RFC8669] to carry 149 SRv6 SIDs and associated information. 151 The SRv6 Service TLVs are defined as two new TLVs of the BGP Prefix- 152 SID Attribute to achieve signaling of SRv6 SIDs for L3 and L2 153 services. 155 o SRv6 L3 Service TLV: This TLV encodes Service SID information for 156 SRv6 based L3 services. It corresponds to the equivalent 157 functionality provided by an MPLS Label when received with a Layer 158 3 service route. Some behaviors which MAY be encoded, but not 159 limited to, are End.DX4, End.DT4, End.DX6, End.DT6, etc. 161 o SRv6 L2 Service TLV: This TLV encodes Service SID information for 162 SRv6 based L2 services. It corresponds to the equivalent 163 functionality provided by an MPLS Label1 for EVPN Route-Types as 164 defined in[RFC7432]. Some behaviors which MAY be encoded, but not 165 limited to, are End.DX2, End.DX2V, End.DT2U, End.DT2M etc. 167 When an egress PE is enabled for BGP Services over SRv6 data-plane, 168 it MUST signal one or more SRv6 Service SIDs enclosed in SRv6 Service 169 TLV(s) within the BGP Prefix-SID Attribute attached to MP-BGP NLRIs 170 defined in [RFC4760] [RFC4659] [I-D.ietf-bess-rfc5549revision] 171 [RFC7432] [RFC4364] where applicable as described in Section 5 and 172 Section 6. 174 The following depicts the SRv6 Service TLVs encoded in the BGP 175 Prefix-SID Attribute: 177 0 1 2 3 178 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 179 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 180 | TLV Type | TLV Length | RESERVED | 181 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 182 // SRv6 Service Sub-TLVs // 183 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 185 o TLV Type (1 octet): This field is assigned values from the IANA 186 registry "BGP Prefix-SID TLV Types". It is set to 5 for SRv6 L3 187 Service TLV. It is set to 6 for SRv6 L2 Service TLV. 189 o TLV Length (2 octets): Specifies the total length of the TLV 190 Value. 192 o RESERVED (1 octet): This field is reserved; it SHOULD be set to 0 193 by the sender and MUST be ignored by the receiver. 195 o SRv6 Service Sub-TLVs (variable): This field contains SRv6 Service 196 related information and is encoded as an unordered list of Sub- 197 TLVs whose format is described below. 199 A BGP speaker receiving a route containing BGP Prefix-SID Attribute 200 with one or more SRv6 Service TLVs observes the following rules when 201 advertising the received route to other peers: 203 o if the nexthop is unchanged during advertisement, the SRv6 Service 204 TLVs, including any unrecognized Types of Sub-TLV and Sub-Sub-TLV, 205 SHOULD be propagated further. In addition, all Reserved fields in 206 the TLV or Sub-TLV or Sub-Sub-TLV MUST be propagated unchanged. 208 o if the nexthop is changed, the TLVs, Sub-TLVs and Sub-Sub-TLVs 209 SHOULD be updated as appropriate. Any unrecognized received sub- 210 TLVs and Sub-Sub-TLVs MUST be removed. 212 3. SRv6 Service Sub-TLVs 214 The format of a single SRv6 Service Sub-TLV is depicted below: 216 0 1 2 3 217 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 218 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 219 | SRv6 Service | SRv6 Service | SRv6 Service // 220 | Sub-TLV | Sub-TLV | Sub-TLV // 221 | Type | Length | value // 222 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 224 o SRv6 Service Sub-TLV Type (1 octet): Identifies the type of SRv6 225 service information. It is assigned values from the IANA Registry 226 "SRv6 Service Sub-TLV Types". 228 o SRv6 Service Sub-TLV Length (2 octets): Specifies the total length 229 of the Sub-TLV Value field. 231 o SRv6 Service Sub-TLV Value (variable): Contains data specific to 232 the Sub-TLV Type. In addition to fixed length data, it contains 233 other properties of the SRv6 Service encoded as a set of SRv6 234 Service Data Sub-Sub-TLVs whose format is described in Section 3.2 235 below. 237 3.1. SRv6 SID Information Sub-TLV 239 SRv6 Service Sub-TLV Type 1 is assigned for SRv6 SID Information Sub- 240 TLV. This Sub-TLV contains a single SRv6 SID along with its 241 properties. Its encoding is depicted below: 243 0 1 2 3 244 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 245 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 246 | SRv6 Service | SRv6 Service | | 247 | Sub-TLV | Sub-TLV | | 248 | Type=1 | Length | RESERVED1 | 249 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 250 // SRv6 SID Value (16 bytes) // 251 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 252 | SRv6 SID Flags| SRv6 Endpoint Behavior | RESERVED2 | 253 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 254 // SRv6 Service Data Sub-Sub-TLVs // 255 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 257 o SRv6 Service Sub-TLV Type (1 octet): This field is set to 1 to 258 represent SRv6 SID Information Sub-TLV. 260 o SRv6 Service Sub-TLV Length (2 octets): This field contains the 261 total length of the Value field of the Sub-TLV. 263 o RESERVED1 (1 octet): SHOULD be set to 0 by the sender and MUST be 264 ignored by the receiver. 266 o SRv6 SID Value (16 octets): Encodes an SRv6 SID as defined in 267 [I-D.ietf-spring-srv6-network-programming] 269 o SRv6 SID Flags (1 octet): Encodes SRv6 SID Flags - none are 270 currently defined. SHOULD be set to 0 by sender and MUST be 271 ignored by the receiver. 273 o SRv6 Endpoint Behavior (2 octets): Encodes SRv6 Endpoint behavior 274 codepoint value from the IANA registry defined in section 9.2 of 275 [I-D.ietf-spring-srv6-network-programming] that is associated with 276 SRv6 SID. The opaque behavior (i.e. value 0xFFFF) or an 277 unrecognized behavior MUST NOT be considered as invalid by the 278 receiver. 280 o RESERVED2 (1 octet): SHOULD be set to 0 by the sender and MUST be 281 ignored by the receiver. 283 o SRv6 Service Data Sub-Sub-TLV Value (variable): Used to advertise 284 properties of the SRv6 SID. It is encoded as a set of SRv6 285 Service Data Sub-Sub-TLVs. 287 When multiple SRv6 SID Information Sub-TLVs are present, the ingress 288 PE SHOULD use the SRv6 SID from the first instance of the Sub-TLV. 289 An implementation MAY provide a local policy to override this 290 selection. 292 3.2. SRv6 Service Data Sub-Sub-TLVs 294 The format of the SRv6 Service Data Sub-Sub-TLV is depicted below: 296 0 1 2 3 297 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 298 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 299 | Service Data | Sub-Sub-TLV Length |Sub-Sub TLV // 300 | Sub-Sub-TLV | | Value // 301 | Type | | // 302 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 304 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): Identifies the type 305 of Sub-Sub-TLV. It is assigned values from the IANA Registry 306 "SRv6 Service Data Sub-Sub-TLVs". 308 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): Specifies the 309 total length of the Sub-Sub-TLV Value field. 311 o SRv6 Service Data Sub-Sub-TLV Value (variable): Contains data 312 specific to the Sub-Sub-TLV Type. 314 3.2.1. SRv6 SID Structure Sub-Sub-TLV 316 SRv6 Service Data Sub-Sub-TLV Type 1 is assigned for SRv6 SID 317 structure Sub-Sub-TLV. SRv6 SID Structure Sub-Sub-TLV is used to 318 advertise the lengths of each individual parts of the SRv6 SID as 319 defined in [I-D.ietf-spring-srv6-network-programming]. It is carried 320 as Sub-Sub-TLV in SRv6 SID Information Sub-TLV 321 0 1 2 3 322 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 323 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 324 | SRv6 Service | SRv6 Service | Locator Block | 325 | Data Sub-Sub | Data Sub-Sub-TLV | Length | 326 | -TLV Type=1 | Length=6 | | 327 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 328 | Locator Node | Function | Argument | Transposition | 329 | Length | Length | Length | Length | 330 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 331 | Transposition | 332 | Offset | 333 +-+-+-+-+-+-+-+-+ 335 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): This field is set to 336 1 to represent SRv6 SID Structure Sub-Sub-TLV. 338 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): This field 339 contains the total length of 6 bytes. 341 o Locator Block Length (1 octet): Contains length of SRv6 SID 342 locator Block in bits. 344 o Locator Node Length (1 octet): Contains length of SRv6 SID locator 345 Node in bits. 347 o Function Length (1 octet): Contains length of SRv6 SID Function in 348 bits. 350 o Argument Length (1 octet): Contains length of SRv6 SID argument in 351 bits. 353 o Transposition Length (1 octet): Size in bits for the part of SID 354 that has been transposed (or shifted) into a label field 356 o Transposition Offset (1 octet): The offset position in bits for 357 the part of SID that has been transposed (or shifted) into a label 358 field. 360 Section 4 describes mechanisms for signaling of the SRv6 Service SID 361 by transposing a variable part of the SRv6 SID value (function and/or 362 the argument parts) and carrying them in existing label fields to 363 achieve more efficient packing of those service prefix NLRIs in BGP 364 update messages. The SRv6 SID Structure Sub-Sub-TLV contains 365 appropriate length fields when the SRv6 Service SID is signaled in 366 split parts to enable the receiver to put together the SID 367 accurately. 369 Transposition Offset indicates the bit position and Transposition 370 Length indicates the number of bits that are being taken out of the 371 SRv6 SID value and put into high order bits of label field. The bits 372 that have been shifted out MUST be set to 0 in the SID value. 374 Transposition Length of 0 indicates nothing is transposed and that 375 the entire SRv6 SID value is encoded in the SID Information sub-TLV. 376 In this case, the Transposition Offset MUST be set to 0. 378 Since size of label field is 24 bits, only that many bits can be 379 transposed from the SRv6 SID value into it. 381 As an example, when the entire function part of size 16 of an SRv6 382 SID is transposed and the sum of the locator block and locator node 383 parts is 64, then the transposition offset would be set to 64 and the 384 transposition length is set to 16. 386 BGP speakers that do not support this specification may misinterpret, 387 on reception of an SRv6-based BGP service route update, the function 388 and/or argument parts of the SRv6 SID encoded in label field(s) as 389 MPLS label values for MPLS-based services. Implementations 390 supporting this specification SHOULD provide a mechanism to control 391 advertisement of SRv6-based BGP service routes on a per neighbor and 392 per service basis. 394 Arguments MAY be generally applicable for SIDs of only specific 395 behaviors (e.g. End.DT2M) and therefore the argument length MUST be 396 set to 0 for SIDs where the argument is not applicable. 398 4. Encoding SRv6 SID information 400 The SRv6 Service SID(s) for a BGP Service Prefix are carried in the 401 SRv6 Services TLVs of the BGP Prefix-SID Attribute. 403 For certain types of BGP Services like L3VPN where a per-VRF SID 404 allocation is used (i.e. End.DT4 or End.DT6 behaviors), the same SID 405 is shared across multiple NLRIs thus providing efficient packing. 406 However, for certain other types of BGP Services like EVPN VPWS where 407 a per-PW SID allocation is required (i.e. End.DX2 behavior), each 408 NLRI would have its own unique SID there by resulting in inefficient 409 packing. 411 To achieve efficient packing, this document allows the encoding of 412 the SRv6 Service SID either as a whole in the SRv6 Services TLVs or 413 the encoding of only the common part of the SRv6 SID (e.g. Locator) 414 in the SRv6 Services TLVs and encoding the variable (e.g. Function 415 and Argument parts) in the existing label fields specific to that 416 service encoding. This later form of encoding is referred to as the 417 Transposition Scheme where the SRv6 SID Structure Sub-Sub-TLV 418 describes the sizes of the parts of the SRv6 SID and to also indicate 419 offset of variable part along with its length in SRv6 SID value. The 420 use of the Transposition Scheme is RECOMMENDED for the specific 421 service encodings that allow it as described further in Section 5 and 422 Section 6. 424 As an example, for the EVPN VPWS service prefix described further in 425 Section 6.1.2, the function part of the SRv6 SID is encoded in the 426 MPLS Label field of the NLRI and the SID value in the SRv6 Services 427 TLV carries only the locator part with the SRv6 SID Structure Sub- 428 Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines the lengths of 429 locator block, locator node and function parts (arguments are not 430 applicable for the End.DX2 behavior). Transposition Offset indicates 431 the bit position and Transposition Length indicates the number of 432 bits that are being taken out of the SID and put into label field. 434 In yet another example, for the EVPN Per-ES A-D route described 435 further in Section 6.1.1, only the argument of the SID needs to be 436 signaled. This argument part of the SRv6 SID MAY be transposed in 437 the ESI Label field of the ESI Label Extended Community and the SID 438 value in the SRv6 Services TLV is set to 0 with the SRv6 SID 439 Structure Sub-Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines 440 the lengths of locator block, locator node, function and argument 441 parts. The offset and length of argument part SID value moved to 442 label field is set in transposition offset and length of SID 443 structure TLV. The receiving router is then able to put together the 444 entire SRv6 Service SID (e.g. for the End.DT2M behavior) placing the 445 label value received in the ESI Label field of the Per-ES A-D route 446 into the correct transposition offset and length in the SRv6 SID with 447 the End.DT2M behavior received for a EVPN Route Type 3 value. 449 5. BGP based L3 service over SRv6 451 BGP egress nodes (egress PEs) advertise a set of reachable prefixes. 452 Standard BGP update propagation schemes[RFC4271], which may make use 453 of route reflectors [RFC4456], are used to propagate these prefixes. 454 BGP ingress nodes (ingress PEs) receive these advertisements and may 455 add the prefix to the RIB in an appropriate VRF. 457 Egress PEs which supports SRv6 based L3 services advertises overlay 458 service prefixes along with a Service SID enclosed in a SRv6 L3 459 Service TLV within the BGP Prefix-SID Attribute. This TLV serves two 460 purposes - first, it indicates that the egress PE supports SRv6 461 overlay and the BGP ingress PE receiving this route MUST choose to 462 perform IPv6 encapsulation and optionally insert an SRH [RFC8754] 463 when required; second ,it indicates the value of the Service SID to 464 be used in the encapsulation. 466 The Service SID thus signaled only has local significance at the 467 egress PE, where it may be allocated or configured on a per-CE or 468 per-VRF basis. In practice, the SID may encode a cross-connect to a 469 specific Address Family table (END.DT) or next-hop/interface (END.DX) 470 as defined in [I-D.ietf-spring-srv6-network-programming]. 472 The SRv6 Service SID SHOULD be routable within the AS of the egress 473 PE and serves the dual purpose of providing reachability between 474 ingress PE and egress PE while also encoding the endpoint behavior. 476 When the egress PE sets the next-hop to a value that is not covered 477 by the SRv6 Locator from which the SRv6 Service SID is allocated, 478 then the ingress PE SHOULD perform reachability check for the SRv6 479 Service SID in addition to the BGP next-hop reachability procedures. 481 At an ingress PE, BGP installs the received prefix in the correct RIB 482 table, recursing via an SR Policy leveraging the received SRv6 483 Service SID. 485 Assuming best-effort connectivity to the egress PE, the ingress PE 486 encapsulates the payload in an outer IPv6 header where the 487 destination address is the SRv6 Service SID associated with the 488 related BGP route update. 490 However, when the received route is colored with an extended color 491 community 'C' and Next-Hop 'N', and the ingress PE has a valid SRv6 492 Policy (C, N) associated with SID list 493 [I-D.ietf-spring-segment-routing-policy], then the effective SR 494 Policy is . 496 Multiple VPN routes MAY resolve recursively via the same SR Policy. 498 5.1. IPv4 VPN Over SRv6 Core 500 The MP_REACH_NLRI for SRv6 core is encoded according to IPv4 VPN Over 501 IPv6 Core defined in [I-D.ietf-bess-rfc5549revision]. 503 Label field of IPv4-VPN NLRI is encoded as specified in [RFC8277] 504 with the Label Value set to the Function part of the SRv6 SID when 505 the Transposition Scheme of encoding (Section 4) is used and 506 otherwise set to Implicit NULL. 508 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 509 behavior of the SRv6 SID is entirely up to the originator of the 510 advertisement. In practice, the behavior is End.DX4 or End.DT4. 512 5.2. IPv6 VPN Over SRv6 Core 514 The MP_REACH_NLRI for SRv6 core is encoded according to IPv6 VPN over 515 IPv6 Core is defined in [RFC4659]. 517 Label field of the IPv6-VPN NLRI is encoded as specified in [RFC8277] 518 with the Label Value set to the Function part of the SRv6 SID when 519 the Transposition Scheme of encoding (Section 4) is used and 520 otherwise set to Implicit NULL. 522 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 523 behavior of the SRv6 SID is entirely up to the originator of the 524 advertisement. In practice, the behavior is End.DX6 or End.DT6. 526 5.3. Global IPv4 over SRv6 Core 528 The MP_REACH_NLRI for SRv6 core is encoded according to IPv4 over 529 IPv6 Core is defined in [I-D.ietf-bess-rfc5549revision]. 531 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 532 behavior of the SRv6 SID is entirely up to the originator of the 533 advertisement. In practice, the behavior is End.DX4 or End.DT4. 535 5.4. Global IPv6 over SRv6 Core 537 The MP_REACH_NLRI for SRv6 core is encoded according to [RFC2545] 539 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 540 behavior of the SRv6 SID is entirely up to the originator of the 541 advertisement. In practice, the behavior is End.DX6 or End.DT6. 543 6. BGP based Ethernet VPN (EVPN) over SRv6 545 [RFC7432] provides an extendable method of building an Ethernet VPN 546 (EVPN) overlay. It primarily focuses on MPLS based EVPNs and 547 [RFC8365] extends to IP based EVPN overlays. [RFC7432] defines Route 548 Types 1, 2 and 3 which carry prefixes and MPLS Label fields; the 549 Label fields have specific use for MPLS encapsulation of EVPN 550 traffic. Route Type 5 carrying MPLS label information (and thus 551 encapsulation information) for EVPN is defined in 552 [I-D.ietf-bess-evpn-prefix-advertisement]. Route Types 6,7 and 8 are 553 defined in [I-D.ietf-bess-evpn-igmp-mld-proxy]. 555 o Ethernet Auto-discovery Route (Route Type 1) 557 o MAC/IP Advertisement Route (Route Type 2) 559 o Inclusive Multicast Ethernet Tag Route (Route Type 3) 560 o Ethernet Segment route (Route Type 4) 562 o IP prefix route (Route Type 5) 564 o Selective Multicast Ethernet Tag route (Route Type 6) 566 o IGMP join sync route (Route Type 7) 568 o IGMP leave sync route (Route Type 8) 570 To support SRv6 based EVPN overlays, one or more SRv6 Service SIDs 571 are advertised with Route Type 1,2,3 and 5. The SRv6 Service SID(s) 572 per Route Type are advertised in SRv6 L3/L2 Service TLVs within the 573 BGP Prefix-SID Attribute. Signaling of SRv6 Service SID(s) serves 574 two purposes - first, it indicates that the BGP egress device 575 supports SRv6 overlay and the BGP ingress device receiving this route 576 MUST perform IPv6 encapsulation and optionally insert an SRH 577 [RFC8754] when required; second, it indicates the value of the 578 Service SID(s) to be used in the encapsulation. 580 The SRv6 Service SID SHOULD be routable within the AS of the egress 581 PE and serves the dual purpose of providing reachability between 582 ingress PE and egress PE while also encoding the endpoint behavior. 584 When the egress PE sets the next-hop to a value that is not covered 585 by the SRv6 Locator from which the SRv6 Service SID is allocated, 586 then the ingress PE SHOULD perform reachability check for the SRv6 587 Service SID in addition to the BGP next-hop reachability procedures. 589 6.1. Ethernet Auto-discovery route over SRv6 Core 591 Ethernet Auto-Discovery (A-D) routes are Route Type 1 defined in 592 [RFC7432] and may be used to achieve split horizon filtering, fast 593 convergence and aliasing. EVPN Route Type 1 is also used in EVPN- 594 VPWS as well as in EVPN flexible cross-connect; mainly used to 595 advertise point-to-point services ID. 597 As a reminder, EVPN Route Type 1 is encoded as follows: 599 +---------------------------------------+ 600 | RD (8 octets) | 601 +---------------------------------------+ 602 |Ethernet Segment Identifier (10 octets)| 603 +---------------------------------------+ 604 | Ethernet Tag ID (4 octets) | 605 +---------------------------------------+ 606 | MPLS label (3 octets) | 607 +---------------------------------------+ 609 6.1.1. Per-ES A-D route 611 Per-ES A-D route for SRv6 overlay is advertised as follows: 613 o BGP next-hop: IPv6 address of an egress PE 615 o Ethernet Tag ID: set as per [RFC7432] 617 o MPLS Label: set as per [RFC7432] 619 o ESI label extended community ESI label field: carries the Argument 620 part of the SRv6 SID when ESI filtering approach is used along 621 with the Transposition Scheme of encoding (Section 4) and 622 otherwise set to Implicit NULL. 624 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 625 Prefix-SID attribute is advertised along with the A-D route. The 626 behavior of the Service SID thus signaled is entirely up to the 627 originator of the advertisement. When ESI filtering approach is 628 used, the Service SID is used to signal Arg.FE2 SID argument for 629 applicable End.DT2M SIDs. When local-bias approach is used, the 630 Service SID MAY be of value 0. 632 6.1.2. Per-EVI A-D route 634 Per-EVI A-D route for SRv6 overlay is advertised as follows: 636 o BGP next-hop: IPv6 address of an egress PE 638 o Ethernet Tag ID: Set as per [RFC7432], [RFC8214] and 639 [I-D.ietf-bess-evpn-vpws-fxc] 641 o MPLS Label: carries the Function part of the SRv6 SID when the 642 Transposition Scheme of encoding (Section 4) is used and otherwise 643 set to Implicit NULL. 645 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 646 Prefix-SID attribute is advertised along with the A-D route. The 647 behavior of the Service SID thus signaled is entirely up to the 648 originator of the advertisement. In practice, the behavior is 649 END.DX2, END.DX2V or END.DT2U. 651 6.2. MAC/IP Advertisement route over SRv6 Core 653 EVPN Route Type 2 is used to advertise unicast traffic MAC+IP address 654 reachability through MP-BGP to all other PEs in a given EVPN 655 instance. 657 As a reminder, EVPN Route Type 2 is encoded as follows: 659 +---------------------------------------+ 660 | RD (8 octets) | 661 +---------------------------------------+ 662 |Ethernet Segment Identifier (10 octets)| 663 +---------------------------------------+ 664 | Ethernet Tag ID (4 octets) | 665 +---------------------------------------+ 666 | MAC Address Length (1 octet) | 667 +---------------------------------------+ 668 | MAC Address (6 octets) | 669 +---------------------------------------+ 670 | IP Address Length (1 octet) | 671 +---------------------------------------+ 672 | IP Address (0, 4, or 16 octets) | 673 +---------------------------------------+ 674 | MPLS Label1 (3 octets) | 675 +---------------------------------------+ 676 | MPLS Label2 (0 or 3 octets) | 677 +---------------------------------------+ 679 o BGP next-hop: IPv6 address of an egress PE 681 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 682 carries the Function part of the SRv6 SID when the Transposition 683 Scheme of encoding (Section 4) is used and otherwise set to 684 Implicit NULL. 686 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 687 carries the Function part of the SRv6 SID when the Transposition 688 Scheme of encoding (Section 4) is used and otherwise set to 689 Implicit NULL. 691 Service SIDs enclosed in SRv6 L2 Service TLV and optionally in SRv6 692 L3 Service TLV within the BGP Prefix-SID attribute is advertised 693 along with the MAC/IP Advertisement route. 695 Described below are different types of Route Type 2 advertisements. 697 6.2.1. MAC/IP Advertisement route with MAC Only 699 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 700 carries the Function part of the SRv6 SID when the Transposition 701 Scheme of encoding (Section 4) is used and otherwise set to 702 Implicit NULL. 704 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 705 Prefix-SID attribute is advertised along with the route. The 706 behavior of the Service SID thus signaled is entirely up to the 707 originator of the advertisement. In practice, the behavior is 708 END.DX2 or END.DT2U. 710 6.2.2. MAC/IP Advertisement route with MAC+IP 712 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 713 carries the Function part of the SRv6 SID when the Transposition 714 Scheme of encoding (Section 4) is used and otherwise set to 715 Implicit NULL. 717 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 718 carries the Function part of the SRv6 SID when the Transposition 719 Scheme of encoding (Section 4) is used and otherwise set to 720 Implicit NULL. 722 An L2 Service SID enclosed in a SRv6 L2 Service TLV within the BGP 723 Prefix-SID attribute is advertised along with the route. In 724 addition, an L3 Service SID enclosed in a SRv6 L3 Service TLV within 725 the BGP Prefix-SID attribute MAY also be advertised along with the 726 route. The behavior of the Service SID(s) thus signaled is entirely 727 up to the originator of the advertisement. In practice, the behavior 728 is END.DX2 or END.DT2U for the L2 Service SID, and END.DT6/4 or 729 END.DX6/4 for the L3 Service SID. 731 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core 733 EVPN Route Type 3 is used to advertise multicast traffic reachability 734 information through MP-BGP to all other PEs in a given EVPN instance. 736 As a reminder, EVPN Route Type 3 is encoded as follows: 738 +---------------------------------------+ 739 | RD (8 octets) | 740 +---------------------------------------+ 741 | Ethernet Tag ID (4 octets) | 742 +---------------------------------------+ 743 | IP Address Length (1 octet) | 744 +---------------------------------------+ 745 | Originating Router's IP Address | 746 | (4 or 16 octets) | 747 +---------------------------------------+ 749 o BGP next-hop: IPv6 address of egress PE 750 PMSI Tunnel Attribute [RFC6514] is used to identify the P-tunnel used 751 for sending BUM traffic. The format of PMSI Tunnel Attribute is 752 encoded as follows for SRv6 Core: 754 +---------------------------------------+ 755 | Flag (1 octet) | 756 +---------------------------------------+ 757 | Tunnel Type (1 octet) | 758 +---------------------------------------+ 759 | MPLS label (3 octet) | 760 +---------------------------------------+ 761 | Tunnel Identifier (variable) | 762 +---------------------------------------+ 764 o Flag: zero value defined per [RFC7432] 766 o Tunnel Type: defined per [RFC6514] 768 o MPLS label: It carries the Function part of the SRv6 SID when 769 ingress replication is used and the Transposition Scheme of 770 encoding (Section 4) is used and otherwise it is set as defined in 771 [RFC6514] 773 o Tunnel Identifier: IP address of egress PE 775 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 776 Prefix-SID attribute is advertised along with the route. The 777 behavior of the Service SID thus signaled, is entirely up to the 778 originator of the advertisement. In practice, the behavior of the 779 SRv6 SID is as follows: 781 o END.DT2M behavior. 783 o When ESI-based filtering is used for Multi-Homing or E-Tree 784 procedures, the ESI Filtering argument (Arg.FE2) of the Service 785 SID carried along with EVPN Route Type 1 route SHOULD be merged 786 together with the applicable End.DT2M SID of Type 3 route 787 advertised by remote PE by doing a bitwise logical-OR operation to 788 create a single SID on the ingress PE. Details of split-horizon 789 ESI-based filtering mechanisms for multihoming are described in 790 [RFC7432]. Details of filtering mechanisms for Leaf-originated 791 BUM traffic in EVPN E-Tree services are provided in [RFC8317]. 793 o When "local-bias" is used as the Multi-Homing split-horizon 794 method, the ESI Filtering argument SHOULD NOT be merged with the 795 corresponding End.DT2M SID on the ingress PE. Details of the 796 "local-bias" procedures are described in [RFC8365]. 798 The setup of multicast trees for use as P-tunnels is outside the 799 scope of this document. 801 6.4. Ethernet Segment route over SRv6 Core 803 As a reminder, an Ethernet Segment route i.e. EVPN Route Type 4 is 804 encoded as follows: 806 +---------------------------------------+ 807 | RD (8 octets) | 808 +---------------------------------------+ 809 | Ethernet Tag ID (4 octets) | 810 +---------------------------------------+ 811 | IP Address Length (1 octet) | 812 +---------------------------------------+ 813 | Originating Router's IP Address | 814 | (4 or 16 octets) | 815 +---------------------------------------+ 817 o BGP next-hop: IPv6 address of egress PE 819 SRv6 Service TLVs within BGP Prefix-SID attribute are not advertised 820 along with this route. The processing of the route has not changed - 821 it remains as described in [RFC7432]. 823 6.5. IP prefix route over SRv6 Core 825 EVPN Route Type 5 is used to advertise IP address reachability 826 through MP-BGP to all other PEs in a given EVPN instance. IP address 827 may include host IP prefix or any specific subnet. 829 As a reminder, EVPN Route Type 5 is encoded as follows: 831 +---------------------------------------+ 832 | RD (8 octets) | 833 +---------------------------------------+ 834 |Ethernet Segment Identifier (10 octets)| 835 +---------------------------------------+ 836 | Ethernet Tag ID (4 octets) | 837 +---------------------------------------+ 838 | IP Prefix Length (1 octet) | 839 +---------------------------------------+ 840 | IP Prefix (4 or 16 octets) | 841 +---------------------------------------+ 842 | GW IP Address (4 or 16 octets) | 843 +---------------------------------------+ 844 | MPLS Label (3 octets) | 845 +---------------------------------------+ 847 o BGP next-hop: IPv6 address of egress PE 849 o MPLS Label: It carries the Function part of the SRv6 SID when the 850 Transposition Scheme of encoding (Section 4) is used and otherwise 851 set to Implicit NULL. 853 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 854 function of the SRv6 SID is entirely up to the originator of the 855 advertisement. In practice, the behavior is End.DT4/6 or End.DX4/6. 857 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 core 859 These routes do not require the advertisement of SRv6 Service TLVs 860 along with them. Similar to EVPN Route Type 4, the BGP Nexthop is 861 equal to the IPv6 address of egress PE. 863 7. Implementation Status 865 The [I-D.matsushima-spring-srv6-deployment-status] describes the 866 current deployment and implementation status of SRv6 which also 867 includes the BGP services over SRv6 as specified in this document. 869 8. Error Handling 871 In case of any errors encountered while processing SRv6 Service TLVs, 872 the details of the error SHOULD be logged for further analysis. 874 If multiple instances of SRv6 L3 Service TLV is encountered, all but 875 the first instance MUST be ignored. 877 If multiple instances of SRv6 L2 Service TLV is encountered, all but 878 the first instance MUST be ignored. 880 An SRv6 Service TLV is considered malformed in the following cases: 882 o the TLV Length is less than 1 884 o the TLV Length is inconsistent with the length of BGP Prefix-SID 885 attribute 887 o at least one of the constituent Sub-TLVs is malformed 889 An SRv6 Service Sub-TLV is considered malformed in the following 890 cases: 892 o the Sub-TLV Length is inconsistent with the length of the 893 enclosing SRv6 Service TLV 895 An SRv6 SID Information Sub-TLV is considered malformed in the 896 following cases: 898 * the Sub-TLV Length is less than 21 900 * the Sub-TLV Length is inconsistent with the length of the 901 enclosing SRv6 Service TLV 903 * at least one of the constituent Sub-Sub-TLVs is malformed 905 An SRv6 Service Data Sub-sub-TLV is considered malformed in the 906 following cases: 908 o the Sub-Sub-TLV Length is inconsistent with the length of the 909 enclosing SRv6 service Sub-TLV 911 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 912 its Type is unrecognized. 914 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 915 of failing any semantic validation of its Value field. 917 SRv6 overlay service requires Service SID for forwarding. The treat- 918 as-withdraw action [RFC7606] MUST be performed when at least one 919 malformed SRV6 Service TLV is present in the BGP Prefix-SID 920 attribute. 922 SRv6 SID value in SRv6 Service Sub-TLV is invalid when SID Structure 923 Sub-Sub-TLV transposition length is greater than 24 or addition of 924 transposition offset and length is greater than 128. Path having 925 such Prefix-SID Attribute should be ineligible during the selection 926 of best path for the corresponding prefix. 928 9. IANA Considerations 930 9.1. BGP Prefix-SID TLV Types registry 932 This document introduces three new TLV Types of the BGP Prefix-SID 933 attribute. IANA has assigned Type values in the registry "BGP 934 Prefix-SID TLV Types" as follows: 936 Value Type Reference 937 -------------------------------------------- 938 4 Deprecated 939 5 SRv6 L3 Service TLV 940 6 SRv6 L2 Service TLV 942 The value 4 previously corresponded to the SRv6-VPN SID TLV, which 943 was specified in previous versions of this document and used by early 944 implementations of this specification. It was deprecated and 945 replaced by the SRv6 L3 Service and SRv6 L2 Service TLVs. 947 9.2. SRv6 Service Sub-TLV Types registry 949 IANA is requested to create and maintain a new registry called "SRv6 950 Service Sub-TLV Types". The allocation policy for this registry is: 952 0 : Reserved 953 1-127 : IETF Review 954 128-254 : First Come First Served 955 255 : Reserved 957 The following Sub-TLV Types are defined in this document: 959 Value Type Reference 960 ---------------------------------------------------- 961 1 SRv6 SID Information Sub-TLV 963 9.3. SRv6 Service Data Sub-Sub-TLV Types registry 965 IANA is requested to create and maintain a new registry called "SRv6 966 Service Data Sub-Sub-TLV Types". The allocation policy for this 967 registry is: 969 0 : Reserved 970 1-127 : IETF Review 971 128-254 : First Come First Served 972 255 : Reserved 974 The following Sub-Sub-TLV Types are defined in this document: 976 Value Type Reference 977 ---------------------------------------------------- 978 1 SRv6 SID Structure Sub-Sub-TLV 980 10. Security Considerations 982 This document specifies extensions to BGP protocol for signalling of 983 services for SRv6. As such, techniques related to authentication of 984 BGP sessions for securing messages between BGP peers as discussed in 985 the BGP specification [RFC4271] and in the security analysis for BGP 986 [RFC4272] apply. The discussion of the use of the TCP Authentication 987 option to protect BGP sessions is found in [RFC5925], while [RFC6952] 988 includes an analysis of BGP keying and authentication issues. 990 This document does not introduce new services or BGP NLRI types but 991 extends the signaling of existing ones for SRv6. Therefore, the 992 security considerations for the respective BGP services 993 [I-D.ietf-bess-rfc5549revision] [RFC4659] [RFC2545] [RFC7432] 994 [I-D.ietf-bess-evpn-prefix-advertisement] also apply. 996 SRv6 operates within a trusted SR domain with filtering of traffic at 997 the domain boundaries. These and other security aspects of SRv6 are 998 discussed in the security considerations of [RFC8402] [RFC8754] and 999 apply for deployment of BGP services using SRv6. The SRv6 SIDs used 1000 for the BGP Services in this document are defined in 1001 [I-D.ietf-spring-srv6-network-programming] and hence the security 1002 considerations of that document also apply. The service flows 1003 between PE routers using SRv6 SIDs advertised via BGP are expected to 1004 be limited within the trusted SR domain (e.g. within a single AS or 1005 between multiple ASes within a single provider network). Therefore, 1006 precaution is necessary to ensure that the BGP service information 1007 (including associated SRv6 SID) advertised via BGP sessions is 1008 limited to peers within this trusted SR domain. Security 1009 consideration section of [RFC8669] discuss mechanisms to prevent 1010 leaking of BGP Prefix-SID attribute, that carries SRv6 SID, outside 1011 the SR domain. In the event that these filtering mechanisms, both in 1012 the forwarding and control plane, are not implemented properly, it 1013 may be possible for nodes outside the SR domain to learn the VPN 1014 Service SIDs and use them to direct traffic into VPN networks from 1015 outside the SR domain. 1017 11. Acknowledgments 1019 The authors of this document would like to thank Stephane Litkowski, 1020 Rishabh Parekh and Xiejingrong for their comments and review of this 1021 document. 1023 12. Contributors 1025 Satoru Matsushima 1026 SoftBank 1028 Email: satoru.matsushima@g.softbank.co.jp 1030 Dirk Steinberg 1031 Steinberg Consulting 1033 Email: dws@steinberg.net 1034 Daniel Bernier 1035 Bell Canada 1037 Email: daniel.bernier@bell.ca 1039 Daniel Voyer 1040 Bell Canada 1042 Email: daniel.voyer@bell.ca 1044 Jonn Leddy 1045 Individual 1047 Email: john@leddy.net 1049 Swadesh Agrawal 1050 Cisco 1052 Email: swaagraw@cisco.com 1054 Patrice Brissette 1055 Cisco 1057 Email: pbrisset@cisco.com 1059 Ali Sajassi 1060 Cisco 1062 Email: sajassi@cisco.com 1064 Bart Peirens 1065 Proximus 1066 Belgium 1068 Email: bart.peirens@proximus.com 1070 Darren Dukes 1071 Cisco 1073 Email: ddukes@cisco.com 1075 Pablo Camarilo 1076 Cisco 1078 Email: pcamaril@cisco.com 1079 Shyam Sethuram 1080 Cisco 1082 Email: shyam.ioml@gmail.com 1084 Zafar Ali 1085 Cisco 1087 Email: zali@cisco.com 1089 Ketan Talaulikar 1090 Cisco 1092 Email: ketant@cisco.com 1094 13. References 1096 13.1. Normative References 1098 [I-D.ietf-bess-evpn-igmp-mld-proxy] 1099 Sajassi, A., Thoria, S., Patel, K., Drake, J., and W. Lin, 1100 "IGMP and MLD Proxy for EVPN", draft-ietf-bess-evpn-igmp- 1101 mld-proxy-05 (work in progress), April 2020. 1103 [I-D.ietf-bess-evpn-prefix-advertisement] 1104 Rabadan, J., Henderickx, W., Drake, J., Lin, W., and A. 1105 Sajassi, "IP Prefix Advertisement in EVPN", draft-ietf- 1106 bess-evpn-prefix-advertisement-11 (work in progress), May 1107 2018. 1109 [I-D.ietf-bess-evpn-vpws-fxc] 1110 Sajassi, A., Brissette, P., Uttaro, J., Drake, J., Lin, 1111 W., Boutros, S., and J. Rabadan, "EVPN VPWS Flexible 1112 Cross-Connect Service", draft-ietf-bess-evpn-vpws-fxc-01 1113 (work in progress), June 2019. 1115 [I-D.ietf-bess-rfc5549revision] 1116 Litkowski, S., Agrawal, S., ananthamurthy, k., and K. 1117 Patel, "Advertising IPv4 Network Layer Reachability 1118 Information with an IPv6 Next Hop", draft-ietf-bess- 1119 rfc5549revision-04 (work in progress), July 2020. 1121 [I-D.ietf-spring-srv6-network-programming] 1122 Filsfils, C., Camarillo, P., Leddy, J., Voyer, D., 1123 Matsushima, S., and Z. Li, "SRv6 Network Programming", 1124 draft-ietf-spring-srv6-network-programming-16 (work in 1125 progress), June 2020. 1127 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1128 Requirement Levels", BCP 14, RFC 2119, 1129 DOI 10.17487/RFC2119, March 1997, 1130 . 1132 [RFC2545] Marques, P. and F. Dupont, "Use of BGP-4 Multiprotocol 1133 Extensions for IPv6 Inter-Domain Routing", RFC 2545, 1134 DOI 10.17487/RFC2545, March 1999, 1135 . 1137 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A 1138 Border Gateway Protocol 4 (BGP-4)", RFC 4271, 1139 DOI 10.17487/RFC4271, January 2006, 1140 . 1142 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 1143 Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February 1144 2006, . 1146 [RFC4456] Bates, T., Chen, E., and R. Chandra, "BGP Route 1147 Reflection: An Alternative to Full Mesh Internal BGP 1148 (IBGP)", RFC 4456, DOI 10.17487/RFC4456, April 2006, 1149 . 1151 [RFC4659] De Clercq, J., Ooms, D., Carugi, M., and F. Le Faucheur, 1152 "BGP-MPLS IP Virtual Private Network (VPN) Extension for 1153 IPv6 VPN", RFC 4659, DOI 10.17487/RFC4659, September 2006, 1154 . 1156 [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, 1157 "Multiprotocol Extensions for BGP-4", RFC 4760, 1158 DOI 10.17487/RFC4760, January 2007, 1159 . 1161 [RFC6514] Aggarwal, R., Rosen, E., Morin, T., and Y. Rekhter, "BGP 1162 Encodings and Procedures for Multicast in MPLS/BGP IP 1163 VPNs", RFC 6514, DOI 10.17487/RFC6514, February 2012, 1164 . 1166 [RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A., 1167 Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based 1168 Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February 1169 2015, . 1171 [RFC7606] Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. 1172 Patel, "Revised Error Handling for BGP UPDATE Messages", 1173 RFC 7606, DOI 10.17487/RFC7606, August 2015, 1174 . 1176 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1177 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1178 May 2017, . 1180 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 1181 (IPv6) Specification", STD 86, RFC 8200, 1182 DOI 10.17487/RFC8200, July 2017, 1183 . 1185 [RFC8214] Boutros, S., Sajassi, A., Salam, S., Drake, J., and J. 1186 Rabadan, "Virtual Private Wire Service Support in Ethernet 1187 VPN", RFC 8214, DOI 10.17487/RFC8214, August 2017, 1188 . 1190 [RFC8277] Rosen, E., "Using BGP to Bind MPLS Labels to Address 1191 Prefixes", RFC 8277, DOI 10.17487/RFC8277, October 2017, 1192 . 1194 [RFC8317] Sajassi, A., Ed., Salam, S., Drake, J., Uttaro, J., 1195 Boutros, S., and J. Rabadan, "Ethernet-Tree (E-Tree) 1196 Support in Ethernet VPN (EVPN) and Provider Backbone 1197 Bridging EVPN (PBB-EVPN)", RFC 8317, DOI 10.17487/RFC8317, 1198 January 2018, . 1200 [RFC8365] Sajassi, A., Ed., Drake, J., Ed., Bitar, N., Shekhar, R., 1201 Uttaro, J., and W. Henderickx, "A Network Virtualization 1202 Overlay Solution Using Ethernet VPN (EVPN)", RFC 8365, 1203 DOI 10.17487/RFC8365, March 2018, 1204 . 1206 [RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., 1207 Decraene, B., Litkowski, S., and R. Shakir, "Segment 1208 Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, 1209 July 2018, . 1211 [RFC8669] Previdi, S., Filsfils, C., Lindem, A., Ed., Sreekantiah, 1212 A., and H. Gredler, "Segment Routing Prefix Segment 1213 Identifier Extensions for BGP", RFC 8669, 1214 DOI 10.17487/RFC8669, December 2019, 1215 . 1217 [RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., 1218 Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header 1219 (SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020, 1220 . 1222 13.2. Informative References 1224 [I-D.ietf-idr-segment-routing-te-policy] 1225 Previdi, S., Filsfils, C., Talaulikar, K., Mattes, P., 1226 Rosen, E., Jain, D., and S. Lin, "Advertising Segment 1227 Routing Policies in BGP", draft-ietf-idr-segment-routing- 1228 te-policy-09 (work in progress), May 2020. 1230 [I-D.ietf-spring-segment-routing-policy] 1231 Filsfils, C., Talaulikar, K., Voyer, D., Bogdanov, A., and 1232 P. Mattes, "Segment Routing Policy Architecture", draft- 1233 ietf-spring-segment-routing-policy-08 (work in progress), 1234 July 2020. 1236 [I-D.matsushima-spring-srv6-deployment-status] 1237 Matsushima, S., Filsfils, C., Ali, Z., Li, Z., and K. 1238 Rajaraman, "SRv6 Implementation and Deployment Status", 1239 draft-matsushima-spring-srv6-deployment-status-07 (work in 1240 progress), April 2020. 1242 [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis", 1243 RFC 4272, DOI 10.17487/RFC4272, January 2006, 1244 . 1246 [RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP 1247 Authentication Option", RFC 5925, DOI 10.17487/RFC5925, 1248 June 2010, . 1250 [RFC6952] Jethanandani, M., Patel, K., and L. Zheng, "Analysis of 1251 BGP, LDP, PCEP, and MSDP Issues According to the Keying 1252 and Authentication for Routing Protocols (KARP) Design 1253 Guide", RFC 6952, DOI 10.17487/RFC6952, May 2013, 1254 . 1256 Authors' Addresses 1258 Gaurav Dawra (editor) 1259 LinkedIn 1260 USA 1262 Email: gdawra.ietf@gmail.com 1264 Clarence Filsfils 1265 Cisco Systems 1266 Belgium 1268 Email: cfilsfil@cisco.com 1269 Robert Raszuk 1270 Bloomberg LP 1271 USA 1273 Email: robert@raszuk.net 1275 Bruno Decraene 1276 Orange 1277 France 1279 Email: bruno.decraene@orange.com 1281 Shunwan Zhuang 1282 Huawei Technologies 1283 China 1285 Email: zhuangshunwan@huawei.com 1287 Jorge Rabadan 1288 Nokia 1289 USA 1291 Email: jorge.rabadan@nokia.com