idnits 2.17.1 draft-ietf-bess-srv6-services-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (November 2, 2020) is 1270 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-21) exists of draft-ietf-bess-evpn-igmp-mld-proxy-05 == Outdated reference: A later version (-28) exists of draft-ietf-spring-srv6-network-programming-24 == Outdated reference: A later version (-26) exists of draft-ietf-idr-segment-routing-te-policy-09 == Outdated reference: A later version (-22) exists of draft-ietf-spring-segment-routing-policy-09 == Outdated reference: A later version (-15) exists of draft-matsushima-spring-srv6-deployment-status-08 Summary: 0 errors (**), 0 flaws (~~), 6 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS Working Group G. Dawra, Ed. 3 Internet-Draft LinkedIn 4 Intended status: Standards Track C. Filsfils 5 Expires: May 6, 2021 K. Talaulikar, Ed. 6 Cisco Systems 7 R. Raszuk 8 Bloomberg LP 9 B. Decraene 10 Orange 11 S. Zhuang 12 Huawei Technologies 13 J. Rabadan 14 Nokia 15 November 2, 2020 17 SRv6 BGP based Overlay services 18 draft-ietf-bess-srv6-services-05 20 Abstract 22 This draft defines procedures and messages for SRv6-based BGP 23 services including L3VPN, EVPN and Internet services. It builds on 24 RFC4364 "BGP/MPLS IP Virtual Private Networks (VPNs)" and RFC7432 25 "BGP MPLS-Based Ethernet VPN". 27 Status of This Memo 29 This Internet-Draft is submitted in full conformance with the 30 provisions of BCP 78 and BCP 79. 32 Internet-Drafts are working documents of the Internet Engineering 33 Task Force (IETF). Note that other groups may also distribute 34 working documents as Internet-Drafts. The list of current Internet- 35 Drafts is at https://datatracker.ietf.org/drafts/current/. 37 Internet-Drafts are draft documents valid for a maximum of six months 38 and may be updated, replaced, or obsoleted by other documents at any 39 time. It is inappropriate to use Internet-Drafts as reference 40 material or to cite them other than as "work in progress." 42 This Internet-Draft will expire on May 6, 2021. 44 Copyright Notice 46 Copyright (c) 2020 IETF Trust and the persons identified as the 47 document authors. All rights reserved. 49 This document is subject to BCP 78 and the IETF Trust's Legal 50 Provisions Relating to IETF Documents 51 (https://trustee.ietf.org/license-info) in effect on the date of 52 publication of this document. Please review these documents 53 carefully, as they describe your rights and restrictions with respect 54 to this document. Code Components extracted from this document must 55 include Simplified BSD License text as described in Section 4.e of 56 the Trust Legal Provisions and are provided without warranty as 57 described in the Simplified BSD License. 59 Table of Contents 61 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 62 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 63 2. SRv6 Services TLVs . . . . . . . . . . . . . . . . . . . . . 4 64 3. SRv6 Service Sub-TLVs . . . . . . . . . . . . . . . . . . . . 5 65 3.1. SRv6 SID Information Sub-TLV . . . . . . . . . . . . . . 6 66 3.2. SRv6 Service Data Sub-Sub-TLVs . . . . . . . . . . . . . 7 67 3.2.1. SRv6 SID Structure Sub-Sub-TLV . . . . . . . . . . . 7 68 4. Encoding SRv6 SID information . . . . . . . . . . . . . . . . 9 69 5. BGP based L3 service over SRv6 . . . . . . . . . . . . . . . 10 70 5.1. IPv4 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 11 71 5.2. IPv6 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 12 72 5.3. Global IPv4 over SRv6 Core . . . . . . . . . . . . . . . 12 73 5.4. Global IPv6 over SRv6 Core . . . . . . . . . . . . . . . 12 74 6. BGP based Ethernet VPN (EVPN) over SRv6 . . . . . . . . . . . 12 75 6.1. Ethernet Auto-discovery route over SRv6 Core . . . . . . 13 76 6.1.1. Ethernet A-D per ES route . . . . . . . . . . . . . . 14 77 6.1.2. Ethernet A-D per EVI route . . . . . . . . . . . . . 14 78 6.2. MAC/IP Advertisement route over SRv6 Core . . . . . . . . 15 79 6.2.1. MAC/IP Advertisement route with MAC Only . . . . . . 16 80 6.2.2. MAC/IP Advertisement route with MAC+IP . . . . . . . 16 81 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core . . 16 82 6.4. Ethernet Segment route over SRv6 Core . . . . . . . . . . 18 83 6.5. IP prefix route over SRv6 Core . . . . . . . . . . . . . 18 84 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 85 core . . . . . . . . . . . . . . . . . . . . . . . . . . 19 86 7. Implementation Status . . . . . . . . . . . . . . . . . . . . 19 87 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 19 88 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 21 89 9.1. BGP Prefix-SID TLV Types registry . . . . . . . . . . . . 21 90 9.2. SRv6 Service Sub-TLV Types registry . . . . . . . . . . . 21 91 9.3. SRv6 Service Data Sub-Sub-TLV Types registry . . . . . . 22 92 10. Security Considerations . . . . . . . . . . . . . . . . . . . 22 93 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23 94 12. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 23 95 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 24 96 13.1. Normative References . . . . . . . . . . . . . . . . . . 24 97 13.2. Informative References . . . . . . . . . . . . . . . . . 27 98 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 28 100 1. Introduction 102 SRv6 refers to Segment Routing [RFC8402] instantiated on the IPv6 103 dataplane [RFC8754]. 105 SRv6 based BGP services refers to the L3 and L2 overlay services with 106 BGP as control plane and SRv6 as dataplane. 108 SRv6 SID refers to a SRv6 Segment Identifier as defined in [RFC8402]. 110 SRv6 Service SID refers to an SRv6 SID associated with one of the 111 service specific behavior on the advertising Provider Edge (PE) 112 router, such as (but not limited to), END.DT (Table lookup in a VRF) 113 or END.DX (cross-connect to a nexthop) behaviors in the case of L3VPN 114 service as defined in [I-D.ietf-spring-srv6-network-programming]. 116 To provide SRv6 service with best-effort connectivity, the egress PE 117 signals an SRv6 Service SID with the BGP overlay service route. The 118 ingress PE encapsulates the payload in an outer IPv6 header where the 119 destination address is the SRv6 Service SID provided by the egress 120 PE. The underlay between the PEs only need to support plain IPv6 121 forwarding [RFC8200]. 123 To provide SRv6 service in conjunction with an underlay SLA from the 124 ingress PE to the egress PE, the egress PE colors the overlay service 125 route with a Color extended community 126 [I-D.ietf-idr-segment-routing-te-policy]. The ingress PE 127 encapsulates the payload packet in an outer IPv6 header with the 128 segment list of SR policy associated with the related SLA followed by 129 the SRv6 Service SID associated with the route. The underlay nodes 130 whose SRv6 SID's are part of the segment list MUST support SRv6 data 131 plane. 133 BGP is used to advertise the reachability of prefixes of a particular 134 service from an egress PE to ingress PE nodes. 136 This document describes how existing BGP messages between PEs may 137 carry SRv6 Service SIDs as a means to interconnect PEs and form VPNs. 139 1.1. Requirements Language 141 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 142 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 143 "OPTIONAL" in this document are to be interpreted as described in BCP 144 14 [RFC2119] [RFC8174] when, and only when, they appear in all 145 capitals, as shown here. 147 2. SRv6 Services TLVs 149 This document extends the BGP Prefix-SID attribute [RFC8669] to carry 150 SRv6 SIDs and associated information. 152 The SRv6 Service TLVs are defined as two new TLVs of the BGP Prefix- 153 SID Attribute to achieve signaling of SRv6 SIDs for L3 and L2 154 services. 156 o SRv6 L3 Service TLV: This TLV encodes Service SID information for 157 SRv6 based L3 services. It corresponds to the equivalent 158 functionality provided by an MPLS Label when received with a Layer 159 3 service route as defined in [RFC4364] [RFC4659] 160 [I-D.ietf-bess-rfc5549revision] 161 [I-D.ietf-bess-evpn-prefix-advertisement]. Some behaviors which 162 MAY be encoded, but not limited to, are End.DX4, End.DT4, End.DX6, 163 End.DT6, etc. 165 o SRv6 L2 Service TLV: This TLV encodes Service SID information for 166 SRv6 based L2 services. It corresponds to the equivalent 167 functionality provided by an MPLS Label1 for EVPN Route-Types as 168 defined in [RFC7432]. Some behaviors which MAY be encoded, but 169 not limited to, are End.DX2, End.DX2V, End.DT2U, End.DT2M etc. 171 When an egress PE is enabled for BGP Services over SRv6 data-plane, 172 it MUST signal one or more SRv6 Service SIDs enclosed in SRv6 Service 173 TLV(s) within the BGP Prefix-SID Attribute attached to MP-BGP NLRIs 174 defined in [RFC4760] [RFC4659] [I-D.ietf-bess-rfc5549revision] 175 [RFC7432] [RFC4364] [I-D.ietf-bess-evpn-prefix-advertisement] where 176 applicable as described in Section 5 and Section 6. 178 The following depicts the SRv6 Service TLVs encoded in the BGP 179 Prefix-SID Attribute: 181 0 1 2 3 182 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 183 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 184 | TLV Type | TLV Length | RESERVED | 185 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 186 // SRv6 Service Sub-TLVs // 187 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 189 o TLV Type (1 octet): This field is assigned values from the IANA 190 registry "BGP Prefix-SID TLV Types". It is set to 5 for SRv6 L3 191 Service TLV. It is set to 6 for SRv6 L2 Service TLV. 193 o TLV Length (2 octets): Specifies the total length of the TLV 194 Value. 196 o RESERVED (1 octet): This field is reserved; it SHOULD be set to 0 197 by the sender and MUST be ignored by the receiver. 199 o SRv6 Service Sub-TLVs (variable): This field contains SRv6 Service 200 related information and is encoded as an unordered list of Sub- 201 TLVs whose format is described below. 203 A BGP speaker receiving a route containing BGP Prefix-SID Attribute 204 with one or more SRv6 Service TLVs observes the following rules when 205 advertising the received route to other peers: 207 o if the nexthop is unchanged during advertisement, the SRv6 Service 208 TLVs, including any unrecognized Types of Sub-TLV and Sub-Sub-TLV, 209 SHOULD be propagated further. In addition, all Reserved fields in 210 the TLV or Sub-TLV or Sub-Sub-TLV MUST be propagated unchanged. 212 o if the nexthop is changed, the TLVs, Sub-TLVs and Sub-Sub-TLVs 213 SHOULD be updated as appropriate. Any unrecognized received sub- 214 TLVs and Sub-Sub-TLVs MUST be removed. 216 3. SRv6 Service Sub-TLVs 218 The format of a single SRv6 Service Sub-TLV is depicted below: 220 0 1 2 3 221 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 222 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 223 | SRv6 Service | SRv6 Service | SRv6 Service // 224 | Sub-TLV | Sub-TLV | Sub-TLV // 225 | Type | Length | value // 226 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 228 o SRv6 Service Sub-TLV Type (1 octet): Identifies the type of SRv6 229 service information. It is assigned values from the IANA Registry 230 "SRv6 Service Sub-TLV Types". 232 o SRv6 Service Sub-TLV Length (2 octets): Specifies the total length 233 of the Sub-TLV Value field. 235 o SRv6 Service Sub-TLV Value (variable): Contains data specific to 236 the Sub-TLV Type. In addition to fixed length data, it contains 237 other properties of the SRv6 Service encoded as a set of SRv6 238 Service Data Sub-Sub-TLVs whose format is described in Section 3.2 239 below. 241 3.1. SRv6 SID Information Sub-TLV 243 SRv6 Service Sub-TLV Type 1 is assigned for SRv6 SID Information Sub- 244 TLV. This Sub-TLV contains a single SRv6 SID along with its 245 properties. Its encoding is depicted below: 247 0 1 2 3 248 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 249 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 250 | SRv6 Service | SRv6 Service | | 251 | Sub-TLV | Sub-TLV | | 252 | Type=1 | Length | RESERVED1 | 253 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 254 // SRv6 SID Value (16 bytes) // 255 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 256 | SRv6 SID Flags| SRv6 Endpoint Behavior | RESERVED2 | 257 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 258 // SRv6 Service Data Sub-Sub-TLVs // 259 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 261 o SRv6 Service Sub-TLV Type (1 octet): This field is set to 1 to 262 represent SRv6 SID Information Sub-TLV. 264 o SRv6 Service Sub-TLV Length (2 octets): This field contains the 265 total length of the Value field of the Sub-TLV. 267 o RESERVED1 (1 octet): SHOULD be set to 0 by the sender and MUST be 268 ignored by the receiver. 270 o SRv6 SID Value (16 octets): Encodes an SRv6 SID as defined in 271 [I-D.ietf-spring-srv6-network-programming] 273 o SRv6 SID Flags (1 octet): Encodes SRv6 SID Flags - none are 274 currently defined. SHOULD be set to 0 by sender and MUST be 275 ignored by the receiver. 277 o SRv6 Endpoint Behavior (2 octets): Encodes SRv6 Endpoint behavior 278 codepoint value from the IANA registry defined in section 9.2 of 279 [I-D.ietf-spring-srv6-network-programming] that is associated with 280 SRv6 SID. The opaque behavior (i.e. value 0xFFFF) or an 281 unrecognized behavior MUST NOT be considered as invalid by the 282 receiver. 284 o RESERVED2 (1 octet): SHOULD be set to 0 by the sender and MUST be 285 ignored by the receiver. 287 o SRv6 Service Data Sub-Sub-TLV Value (variable): Used to advertise 288 properties of the SRv6 SID. It is encoded as a set of SRv6 289 Service Data Sub-Sub-TLVs. 291 When multiple SRv6 SID Information Sub-TLVs are present, the ingress 292 PE SHOULD use the SRv6 SID from the first instance of the Sub-TLV. 293 An implementation MAY provide a local policy to override this 294 selection. 296 3.2. SRv6 Service Data Sub-Sub-TLVs 298 The format of the SRv6 Service Data Sub-Sub-TLV is depicted below: 300 0 1 2 3 301 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 302 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 303 | Service Data | Sub-Sub-TLV Length |Sub-Sub TLV // 304 | Sub-Sub-TLV | | Value // 305 | Type | | // 306 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 308 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): Identifies the type 309 of Sub-Sub-TLV. It is assigned values from the IANA Registry 310 "SRv6 Service Data Sub-Sub-TLVs". 312 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): Specifies the 313 total length of the Sub-Sub-TLV Value field. 315 o SRv6 Service Data Sub-Sub-TLV Value (variable): Contains data 316 specific to the Sub-Sub-TLV Type. 318 3.2.1. SRv6 SID Structure Sub-Sub-TLV 320 SRv6 Service Data Sub-Sub-TLV Type 1 is assigned for SRv6 SID 321 structure Sub-Sub-TLV. SRv6 SID Structure Sub-Sub-TLV is used to 322 advertise the lengths of each individual parts of the SRv6 SID as 323 defined in [I-D.ietf-spring-srv6-network-programming]. It is carried 324 as Sub-Sub-TLV in SRv6 SID Information Sub-TLV 325 0 1 2 3 326 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 327 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 328 | SRv6 Service | SRv6 Service | Locator Block | 329 | Data Sub-Sub | Data Sub-Sub-TLV | Length | 330 | -TLV Type=1 | Length=6 | | 331 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 332 | Locator Node | Function | Argument | Transposition | 333 | Length | Length | Length | Length | 334 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 335 | Transposition | 336 | Offset | 337 +-+-+-+-+-+-+-+-+ 339 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): This field is set to 340 1 to represent SRv6 SID Structure Sub-Sub-TLV. 342 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): This field 343 contains the total length of 6 bytes. 345 o Locator Block Length (1 octet): Contains length of SRv6 SID 346 locator Block in bits. 348 o Locator Node Length (1 octet): Contains length of SRv6 SID locator 349 Node in bits. 351 o Function Length (1 octet): Contains length of SRv6 SID Function in 352 bits. 354 o Argument Length (1 octet): Contains length of SRv6 SID argument in 355 bits. 357 o Transposition Length (1 octet): Size in bits for the part of SID 358 that has been transposed (or shifted) into a label field 360 o Transposition Offset (1 octet): The offset position in bits for 361 the part of SID that has been transposed (or shifted) into a label 362 field. 364 Section 4 describes mechanisms for signaling of the SRv6 Service SID 365 by transposing a variable part of the SRv6 SID value (function and/or 366 the argument parts) and carrying them in existing label fields to 367 achieve more efficient packing of those service prefix NLRIs in BGP 368 update messages. The SRv6 SID Structure Sub-Sub-TLV contains 369 appropriate length fields when the SRv6 Service SID is signaled in 370 split parts to enable the receiver to put together the SID 371 accurately. 373 Transposition Offset indicates the bit position and Transposition 374 Length indicates the number of bits that are being taken out of the 375 SRv6 SID value and put into high order bits of label field. The bits 376 that have been shifted out MUST be set to 0 in the SID value. 378 Transposition Length of 0 indicates nothing is transposed and that 379 the entire SRv6 SID value is encoded in the SID Information sub-TLV. 380 In this case, the Transposition Offset MUST be set to 0. 382 The size of the label field limits the bits transposed from the SRv6 383 SID value into it. E.g., the size of label field in [RFC4364] 384 [RFC8277] is 20 bits while in [RFC7432] is 24 bits. 386 As an example, when the entire function part of size 16 of an SRv6 387 SID is transposed and the sum of the locator block and locator node 388 parts is 64, then the transposition offset would be set to 64 and the 389 transposition length is set to 16. 391 BGP speakers that do not support this specification may misinterpret, 392 on reception of an SRv6-based BGP service route update, the function 393 and/or argument parts of the SRv6 SID encoded in label field(s) as 394 MPLS label values for MPLS-based services. Implementations 395 supporting this specification SHOULD provide a mechanism to control 396 advertisement of SRv6-based BGP service routes on a per neighbor and 397 per service basis. 399 Arguments MAY be generally applicable for SIDs of only specific 400 behaviors (e.g. End.DT2M) and therefore the argument length MUST be 401 set to 0 for SIDs where the argument is not applicable. 403 4. Encoding SRv6 SID information 405 The SRv6 Service SID(s) for a BGP Service Prefix are carried in the 406 SRv6 Services TLVs of the BGP Prefix-SID Attribute. 408 For certain types of BGP Services like L3VPN where a per-VRF SID 409 allocation is used (i.e. End.DT4 or End.DT6 behaviors), the same SID 410 is shared across multiple NLRIs thus providing efficient packing. 411 However, for certain other types of BGP Services like EVPN VPWS where 412 a per-PW SID allocation is required (i.e. End.DX2 behavior), each 413 NLRI would have its own unique SID there by resulting in inefficient 414 packing. 416 To achieve efficient packing, this document allows the encoding of 417 the SRv6 Service SID either as a whole in the SRv6 Services TLVs or 418 the encoding of only the common part of the SRv6 SID (e.g. Locator) 419 in the SRv6 Services TLVs and encoding the variable (e.g. Function 420 and Argument parts) in the existing label fields specific to that 421 service encoding. This later form of encoding is referred to as the 422 Transposition Scheme where the SRv6 SID Structure Sub-Sub-TLV 423 describes the sizes of the parts of the SRv6 SID and to also indicate 424 offset of variable part along with its length in SRv6 SID value. The 425 use of the Transposition Scheme is RECOMMENDED for the specific 426 service encodings that allow it as described further in Section 5 and 427 Section 6. 429 As an example, for the EVPN VPWS service prefix described further in 430 Section 6.1.2, the function part of the SRv6 SID is encoded in the 431 MPLS Label field of the NLRI and the SID value in the SRv6 Services 432 TLV carries only the locator part with the SRv6 SID Structure Sub- 433 Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines the lengths of 434 locator block, locator node and function parts (arguments are not 435 applicable for the End.DX2 behavior). Transposition Offset indicates 436 the bit position and Transposition Length indicates the number of 437 bits that are being taken out of the SID and put into label field. 439 In yet another example, for the EVPN Ethernet A-D per ES route 440 described further in Section 6.1.1, only the argument of the SID 441 needs to be signaled. This argument part of the SRv6 SID MAY be 442 transposed in the ESI Label field of the ESI Label Extended Community 443 and the SID value in the SRv6 Services TLV is set to 0 with the SRv6 444 SID Structure Sub-Sub-TLV. The SRv6 SID Structure sub-sub-TLV 445 defines the lengths of locator block, locator node, function and 446 argument parts. The offset and length of argument part SID value 447 moved to label field is set in transposition offset and length of SID 448 structure TLV. The receiving router is then able to put together the 449 entire SRv6 Service SID (e.g. for the End.DT2M behavior) placing the 450 label value received in the ESI Label field of the Ethernet A-D per 451 ES route into the correct transposition offset and length in the SRv6 452 SID with the End.DT2M behavior received for a EVPN Route Type 3 453 value. 455 5. BGP based L3 service over SRv6 457 BGP egress nodes (egress PEs) advertise a set of reachable prefixes. 458 Standard BGP update propagation schemes[RFC4271], which may make use 459 of route reflectors [RFC4456], are used to propagate these prefixes. 460 BGP ingress nodes (ingress PEs) receive these advertisements and may 461 add the prefix to the RIB in an appropriate VRF. 463 Egress PEs which supports SRv6 based L3 services advertises overlay 464 service prefixes along with a Service SID enclosed in a SRv6 L3 465 Service TLV within the BGP Prefix-SID Attribute. This TLV serves two 466 purposes - first, it indicates that the egress PE supports SRv6 467 overlay and the BGP ingress PE receiving this route MUST choose to 468 perform IPv6 encapsulation and optionally insert an SRH [RFC8754] 469 when required; second ,it indicates the value of the Service SID to 470 be used in the encapsulation. 472 The Service SID thus signaled only has local significance at the 473 egress PE, where it may be allocated or configured on a per-CE or 474 per-VRF basis. In practice, the SID may encode a cross-connect to a 475 specific Address Family table (END.DT) or next-hop/interface (END.DX) 476 as defined in [I-D.ietf-spring-srv6-network-programming]. 478 The SRv6 Service SID SHOULD be routable within the AS of the egress 479 PE and serves the dual purpose of providing reachability between 480 ingress PE and egress PE while also encoding the endpoint behavior. 482 When providing best-effort connectivity to the egress PE, the ingress 483 PE encapsulates the payload in an outer IPv6 header where the 484 destination address is the SRv6 Service SID associated with the 485 related BGP route update. Therefore, the ingress PE SHOULD perform 486 resolvability check for the SRv6 Service SID before considering the 487 received prefix for the BGP best path computation. 489 For service over SRv6 core, the egress PE sets the next-hop to one of 490 its IPv6 address. Such an address MAY be one that is covered by the 491 SRv6 Locator from which the SRv6 Service SID is allocated. The next- 492 hop is used for tracking reachability of the egress PE based on 493 existing BGP procedures. 495 When the BGP route received at an ingress PE is colored with an 496 extended color community and is being steered over a valid SRv6 497 Policy associated with SID list as described in 498 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 499 effective SR Policy is . 501 Multiple routes MAY resolve recursively via the same SR Policy. 503 5.1. IPv4 VPN Over SRv6 Core 505 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 VPN 506 Over IPv6 Core defined in [I-D.ietf-bess-rfc5549revision]. 508 Label field of IPv4-VPN NLRI is encoded as specified in [RFC8277] 509 with the Label Value set to the Function part of the SRv6 SID when 510 the Transposition Scheme of encoding (Section 4) is used and 511 otherwise set to Implicit NULL. 513 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 514 behavior of the SRv6 SID is entirely up to the originator of the 515 advertisement. In practice, the behavior is End.DX4 or End.DT4. 517 5.2. IPv6 VPN Over SRv6 Core 519 The MP_REACH_NLRI over SRv6 core is encoded according to IPv6 VPN 520 over IPv6 Core is defined in [RFC4659]. 522 Label field of the IPv6-VPN NLRI is encoded as specified in [RFC8277] 523 with the Label Value set to the Function part of the SRv6 SID when 524 the Transposition Scheme of encoding (Section 4) is used and 525 otherwise set to Implicit NULL. 527 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 528 behavior of the SRv6 SID is entirely up to the originator of the 529 advertisement. In practice, the behavior is End.DX6 or End.DT6. 531 5.3. Global IPv4 over SRv6 Core 533 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 over 534 IPv6 Core is defined in [I-D.ietf-bess-rfc5549revision]. 536 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 537 behavior of the SRv6 SID is entirely up to the originator of the 538 advertisement. In practice, the behavior is End.DX4 or End.DT4. 540 5.4. Global IPv6 over SRv6 Core 542 The MP_REACH_NLRI over SRv6 core is encoded according to [RFC2545] 544 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 545 behavior of the SRv6 SID is entirely up to the originator of the 546 advertisement. In practice, the behavior is End.DX6 or End.DT6. 548 6. BGP based Ethernet VPN (EVPN) over SRv6 550 [RFC7432] provides an extendable method of building an Ethernet VPN 551 (EVPN) overlay. It primarily focuses on MPLS based EVPNs and 552 [RFC8365] extends to IP based EVPN overlays. [RFC7432] defines Route 553 Types 1, 2 and 3 which carry prefixes and MPLS Label fields; the 554 Label fields have specific use for MPLS encapsulation of EVPN 555 traffic. Route Type 5 carrying MPLS label information (and thus 556 encapsulation information) for EVPN is defined in 557 [I-D.ietf-bess-evpn-prefix-advertisement]. Route Types 6,7 and 8 are 558 defined in [I-D.ietf-bess-evpn-igmp-mld-proxy]. 560 o Ethernet Auto-discovery Route (Route Type 1) 562 o MAC/IP Advertisement Route (Route Type 2) 564 o Inclusive Multicast Ethernet Tag Route (Route Type 3) 565 o Ethernet Segment route (Route Type 4) 567 o IP prefix route (Route Type 5) 569 o Selective Multicast Ethernet Tag route (Route Type 6) 571 o IGMP join sync route (Route Type 7) 573 o IGMP leave sync route (Route Type 8) 575 To support SRv6 based EVPN overlays, one or more SRv6 Service SIDs 576 are advertised with Route Type 1,2,3 and 5. The SRv6 Service SID(s) 577 per Route Type are advertised in SRv6 L3/L2 Service TLVs within the 578 BGP Prefix-SID Attribute. Signaling of SRv6 Service SID(s) serves 579 two purposes - first, it indicates that the BGP egress device 580 supports SRv6 overlay and the BGP ingress device receiving this route 581 MUST perform IPv6 encapsulation and optionally insert an SRH 582 [RFC8754] when required; second, it indicates the value of the 583 Service SID(s) to be used in the encapsulation. 585 The SRv6 Service SID SHOULD be routable within the AS of the egress 586 PE and serves the dual purpose of providing reachability between 587 ingress PE and egress PE while also encoding the endpoint behavior. 589 When providing best-effort connectivity to the egress PE, the ingress 590 PE encapsulates the payload in an outer IPv6 header where the 591 destination address is the SRv6 Service SID associated with the 592 related BGP route update. Therefore, the ingress PE SHOULD perform 593 resolvability check for the SRv6 Service SID before considering the 594 received prefix for the BGP best path computation. 596 For service over SRv6 core, the egress PE sets the next-hop to one of 597 its IPv6 address. Such an address MAY be one that is covered by the 598 SRv6 Locator from which the SRv6 Service SID is allocated. The next- 599 hop is used for tracking reachability of the egress PE based on 600 existing BGP procedures. 602 When the BGP route received at an ingress PE is colored with an 603 extended color community and is being steered over a valid SRv6 604 Policy associated with SID list as described in 605 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 606 effective SR Policy is . 608 6.1. Ethernet Auto-discovery route over SRv6 Core 610 Ethernet Auto-Discovery (A-D) routes are Route Type 1 defined in 611 [RFC7432] and may be used to achieve split horizon filtering, fast 612 convergence and aliasing. EVPN Route Type 1 is also used in EVPN- 613 VPWS as well as in EVPN flexible cross-connect; mainly used to 614 advertise point-to-point services ID. 616 As a reminder, EVPN Route Type 1 is encoded as follows: 618 +---------------------------------------+ 619 | RD (8 octets) | 620 +---------------------------------------+ 621 |Ethernet Segment Identifier (10 octets)| 622 +---------------------------------------+ 623 | Ethernet Tag ID (4 octets) | 624 +---------------------------------------+ 625 | MPLS label (3 octets) | 626 +---------------------------------------+ 628 6.1.1. Ethernet A-D per ES route 630 Ethernet A-D per ES route NLRI encoding over SRv6 core is as per 631 [RFC7432]. 633 The ESI label field of the ESI label extended community carries the 634 Argument part of the SRv6 SID when ESI filtering approach is used 635 along with the Transposition Scheme of encoding (Section 4) and 636 otherwise set to Implicit NULL. 638 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 639 Prefix-SID attribute is advertised along with the A-D route. The 640 behavior of the Service SID thus signaled is entirely up to the 641 originator of the advertisement. When ESI filtering approach is 642 used, the Service SID is used to signal Arg.FE2 SID argument for 643 applicable End.DT2M SIDs. When local-bias approach is used, the 644 Service SID MAY be of value 0. 646 6.1.2. Ethernet A-D per EVI route 648 Ethernet A-D per EVI route NLRI encoding over SRv6 core is similar to 649 [RFC7432] and [RFC8214] with the following change: 651 o MPLS Label: carries the Function part of the SRv6 SID when the 652 Transposition Scheme of encoding (Section 4) is used and otherwise 653 set to Implicit NULL. 655 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 656 Prefix-SID attribute is advertised along with the A-D route. The 657 behavior of the Service SID thus signaled is entirely up to the 658 originator of the advertisement. In practice, the behavior is 659 END.DX2, END.DX2V or END.DT2U. 661 6.2. MAC/IP Advertisement route over SRv6 Core 663 EVPN Route Type 2 is used to advertise unicast traffic MAC+IP address 664 reachability through MP-BGP to all other PEs in a given EVPN 665 instance. 667 As a reminder, EVPN Route Type 2 is encoded as follows: 669 +---------------------------------------+ 670 | RD (8 octets) | 671 +---------------------------------------+ 672 |Ethernet Segment Identifier (10 octets)| 673 +---------------------------------------+ 674 | Ethernet Tag ID (4 octets) | 675 +---------------------------------------+ 676 | MAC Address Length (1 octet) | 677 +---------------------------------------+ 678 | MAC Address (6 octets) | 679 +---------------------------------------+ 680 | IP Address Length (1 octet) | 681 +---------------------------------------+ 682 | IP Address (0, 4, or 16 octets) | 683 +---------------------------------------+ 684 | MPLS Label1 (3 octets) | 685 +---------------------------------------+ 686 | MPLS Label2 (0 or 3 octets) | 687 +---------------------------------------+ 689 NLRI encoding over SRv6 core is similar to [RFC7432] with the 690 following changes: 692 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 693 carries the Function part of the SRv6 SID when the Transposition 694 Scheme of encoding (Section 4) is used and otherwise set to 695 Implicit NULL. 697 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 698 carries the Function part of the SRv6 SID when the Transposition 699 Scheme of encoding (Section 4) is used and otherwise set to 700 Implicit NULL. 702 Service SIDs enclosed in SRv6 L2 Service TLV and optionally in SRv6 703 L3 Service TLV within the BGP Prefix-SID attribute is advertised 704 along with the MAC/IP Advertisement route. 706 Described below are different types of Route Type 2 advertisements. 708 6.2.1. MAC/IP Advertisement route with MAC Only 710 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 711 carries the Function part of the SRv6 SID when the Transposition 712 Scheme of encoding (Section 4) is used and otherwise set to 713 Implicit NULL. 715 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 716 Prefix-SID attribute is advertised along with the route. The 717 behavior of the Service SID thus signaled is entirely up to the 718 originator of the advertisement. In practice, the behavior is 719 END.DX2 or END.DT2U. 721 6.2.2. MAC/IP Advertisement route with MAC+IP 723 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 724 carries the Function part of the SRv6 SID when the Transposition 725 Scheme of encoding (Section 4) is used and otherwise set to 726 Implicit NULL. 728 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 729 carries the Function part of the SRv6 SID when the Transposition 730 Scheme of encoding (Section 4) is used and otherwise set to 731 Implicit NULL. 733 An L2 Service SID enclosed in a SRv6 L2 Service TLV within the BGP 734 Prefix-SID attribute is advertised along with the route. In 735 addition, an L3 Service SID enclosed in a SRv6 L3 Service TLV within 736 the BGP Prefix-SID attribute MAY also be advertised along with the 737 route. The behavior of the Service SID(s) thus signaled is entirely 738 up to the originator of the advertisement. In practice, the behavior 739 is END.DX2 or END.DT2U for the L2 Service SID, and END.DT6/4 or 740 END.DX6/4 for the L3 Service SID. 742 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core 744 EVPN Route Type 3 is used to advertise multicast traffic reachability 745 information through MP-BGP to all other PEs in a given EVPN instance. 747 As a reminder, EVPN Route Type 3 is encoded as follows: 749 +---------------------------------------+ 750 | RD (8 octets) | 751 +---------------------------------------+ 752 | Ethernet Tag ID (4 octets) | 753 +---------------------------------------+ 754 | IP Address Length (1 octet) | 755 +---------------------------------------+ 756 | Originating Router's IP Address | 757 | (4 or 16 octets) | 758 +---------------------------------------+ 760 NLRI encoding over SRv6 core is similar to [RFC7432]. 762 PMSI Tunnel Attribute [RFC6514] is used to identify the P-tunnel used 763 for sending BUM traffic. The format of PMSI Tunnel Attribute is 764 encoded as follows over SRv6 Core: 766 +---------------------------------------+ 767 | Flag (1 octet) | 768 +---------------------------------------+ 769 | Tunnel Type (1 octet) | 770 +---------------------------------------+ 771 | MPLS label (3 octet) | 772 +---------------------------------------+ 773 | Tunnel Identifier (variable) | 774 +---------------------------------------+ 776 o Flag: zero value defined per [RFC7432] 778 o Tunnel Type: defined per [RFC6514] 780 o MPLS label: It carries the Function part of the SRv6 SID when 781 ingress replication is used and the Transposition Scheme of 782 encoding (Section 4) is used and otherwise it is set as defined in 783 [RFC6514] 785 o Tunnel Identifier: IP address of egress PE 787 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 788 Prefix-SID attribute is advertised along with the route. The 789 behavior of the Service SID thus signaled, is entirely up to the 790 originator of the advertisement. In practice, the behavior of the 791 SRv6 SID is as follows: 793 o END.DT2M behavior. 795 o When ESI-based filtering is used for Multi-Homing or E-Tree 796 procedures, the ESI Filtering argument (Arg.FE2) of the Service 797 SID carried along with EVPN Route Type 1 route SHOULD be merged 798 together with the applicable End.DT2M SID of Type 3 route 799 advertised by remote PE by doing a bitwise logical-OR operation to 800 create a single SID on the ingress PE. Details of split-horizon 801 ESI-based filtering mechanisms for multihoming are described in 802 [RFC7432]. Details of filtering mechanisms for Leaf-originated 803 BUM traffic in EVPN E-Tree services are provided in [RFC8317]. 805 o When "local-bias" is used as the Multi-Homing split-horizon 806 method, the ESI Filtering argument SHOULD NOT be merged with the 807 corresponding End.DT2M SID on the ingress PE. Details of the 808 "local-bias" procedures are described in [RFC8365]. 810 The setup of multicast trees for use as P-tunnels is outside the 811 scope of this document. 813 6.4. Ethernet Segment route over SRv6 Core 815 As a reminder, an Ethernet Segment route i.e. EVPN Route Type 4 is 816 encoded as follows: 818 +---------------------------------------+ 819 | RD (8 octets) | 820 +---------------------------------------+ 821 | Ethernet Tag ID (4 octets) | 822 +---------------------------------------+ 823 | IP Address Length (1 octet) | 824 +---------------------------------------+ 825 | Originating Router's IP Address | 826 | (4 or 16 octets) | 827 +---------------------------------------+ 829 NLRI encoding over SRv6 core is similar to [RFC7432]. 831 SRv6 Service TLVs within BGP Prefix-SID attribute are not advertised 832 along with this route. The processing of the route has not changed - 833 it remains as described in [RFC7432]. 835 6.5. IP prefix route over SRv6 Core 837 EVPN Route Type 5 is used to advertise IP address reachability 838 through MP-BGP to all other PEs in a given EVPN instance. IP address 839 may include host IP prefix or any specific subnet. 841 As a reminder, EVPN Route Type 5 is encoded as follows: 843 +---------------------------------------+ 844 | RD (8 octets) | 845 +---------------------------------------+ 846 |Ethernet Segment Identifier (10 octets)| 847 +---------------------------------------+ 848 | Ethernet Tag ID (4 octets) | 849 +---------------------------------------+ 850 | IP Prefix Length (1 octet) | 851 +---------------------------------------+ 852 | IP Prefix (4 or 16 octets) | 853 +---------------------------------------+ 854 | GW IP Address (4 or 16 octets) | 855 +---------------------------------------+ 856 | MPLS Label (3 octets) | 857 +---------------------------------------+ 859 NLRI encoding over SRv6 core is similar to [RFC7432] with the 860 following change: 862 o MPLS Label: carries the Function part of the SRv6 SID when the 863 Transposition Scheme of encoding (Section 4) is used and otherwise 864 set to Implicit NULL. 866 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 867 function of the SRv6 SID is entirely up to the originator of the 868 advertisement. In practice, the behavior is End.DT4/6 or End.DX4/6. 870 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 core 872 These routes do not require the advertisement of SRv6 Service TLVs 873 along with them. Similar to EVPN Route Type 4, the BGP Nexthop is 874 equal to the IPv6 address of egress PE. 876 7. Implementation Status 878 [Note to RFC Editor : This section needs to be removed before 879 publication as RFC.] 881 The [I-D.matsushima-spring-srv6-deployment-status] describes the 882 current deployment and implementation status of SRv6 which also 883 includes the BGP services over SRv6 as specified in this document. 885 8. Error Handling 887 In case of any errors encountered while processing SRv6 Service TLVs, 888 the details of the error SHOULD be logged for further analysis. 890 If multiple instances of SRv6 L3 Service TLV is encountered, all but 891 the first instance MUST be ignored. 893 If multiple instances of SRv6 L2 Service TLV is encountered, all but 894 the first instance MUST be ignored. 896 An SRv6 Service TLV is considered malformed in the following cases: 898 o the TLV Length is less than 1 900 o the TLV Length is inconsistent with the length of BGP Prefix-SID 901 attribute 903 o at least one of the constituent Sub-TLVs is malformed 905 An SRv6 Service Sub-TLV is considered malformed in the following 906 cases: 908 o the Sub-TLV Length is inconsistent with the length of the 909 enclosing SRv6 Service TLV 911 An SRv6 SID Information Sub-TLV is considered malformed in the 912 following cases: 914 * the Sub-TLV Length is less than 21 916 * the Sub-TLV Length is inconsistent with the length of the 917 enclosing SRv6 Service TLV 919 * at least one of the constituent Sub-Sub-TLVs is malformed 921 An SRv6 Service Data Sub-sub-TLV is considered malformed in the 922 following cases: 924 o the Sub-Sub-TLV Length is inconsistent with the length of the 925 enclosing SRv6 service Sub-TLV 927 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 928 its Type is unrecognized. 930 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 931 of failing any semantic validation of its Value field. 933 SRv6 overlay service requires Service SID for forwarding. The treat- 934 as-withdraw action [RFC7606] MUST be performed when at least one 935 malformed SRV6 Service TLV is present in the BGP Prefix-SID 936 attribute. 938 SRv6 SID value in SRv6 SID Information Sub-TLV is invalid when SID 939 Structure Sub-Sub-TLV transposition length is greater than the number 940 of bits of the label field or addition of transposition offset and 941 length is greater than 128. The transposition offset and length MUST 942 be 0 when the Sub-Sub-TLV is advertised along with routes where 943 transposition scheme is not applicable (e.g., for Global IPv6 Service 944 [RFC2545] where there is no label field). Path having such Prefix- 945 SID Attribute should be ineligible during the selection of best path 946 for the corresponding prefix. 948 9. IANA Considerations 950 9.1. BGP Prefix-SID TLV Types registry 952 This document introduces three new TLV Types of the BGP Prefix-SID 953 attribute. IANA has assigned Type values in the registry "BGP 954 Prefix-SID TLV Types" as follows: 956 Value Type Reference 957 -------------------------------------------- 958 4 Deprecated 959 5 SRv6 L3 Service TLV 960 6 SRv6 L2 Service TLV 962 The value 4 previously corresponded to the SRv6-VPN SID TLV, which 963 was specified in previous versions of this document and used by early 964 implementations of this specification. It was deprecated and 965 replaced by the SRv6 L3 Service and SRv6 L2 Service TLVs. 967 9.2. SRv6 Service Sub-TLV Types registry 969 IANA is requested to create and maintain a new registry called "SRv6 970 Service Sub-TLV Types". The allocation policy for this registry is: 972 0 : Reserved 973 1-127 : IETF Review 974 128-254 : First Come First Served 975 255 : Reserved 977 The following Sub-TLV Type is defined in this document: 979 Value Type Reference 980 ---------------------------------------------------- 981 1 SRv6 SID Information Sub-TLV 983 9.3. SRv6 Service Data Sub-Sub-TLV Types registry 985 IANA is requested to create and maintain a new registry called "SRv6 986 Service Data Sub-Sub-TLV Types". The allocation policy for this 987 registry is: 989 0 : Reserved 990 1-127 : IETF Review 991 128-254 : First Come First Served 992 255 : Reserved 994 The following Sub-Sub-TLV Type is defined in this document: 996 Value Type Reference 997 ---------------------------------------------------- 998 1 SRv6 SID Structure Sub-Sub-TLV 1000 10. Security Considerations 1002 This document specifies extensions to BGP protocol for signalling of 1003 services for SRv6. As such, techniques related to authentication of 1004 BGP sessions for securing messages between BGP peers as discussed in 1005 the BGP specification [RFC4271] and in the security analysis for BGP 1006 [RFC4272] apply. The discussion of the use of the TCP Authentication 1007 option to protect BGP sessions is found in [RFC5925], while [RFC6952] 1008 includes an analysis of BGP keying and authentication issues. 1010 This document does not introduce new services or BGP NLRI types but 1011 extends the signaling of existing ones for SRv6. Therefore, the 1012 security considerations for the respective BGP services 1013 [I-D.ietf-bess-rfc5549revision] [RFC4659] [RFC2545] [RFC7432] 1014 [I-D.ietf-bess-evpn-prefix-advertisement] also apply. 1016 SRv6 operates within a trusted SR domain with filtering of traffic at 1017 the domain boundaries. These and other security aspects of SRv6 are 1018 discussed in the security considerations of [RFC8402] [RFC8754] and 1019 apply for deployment of BGP services using SRv6. The SRv6 SIDs used 1020 for the BGP Services in this document are defined in 1021 [I-D.ietf-spring-srv6-network-programming] and hence the security 1022 considerations of that document also apply. The service flows 1023 between PE routers using SRv6 SIDs advertised via BGP are expected to 1024 be limited within the trusted SR domain (e.g. within a single AS or 1025 between multiple ASes within a single provider network). Therefore, 1026 precaution is necessary to ensure that the BGP service information 1027 (including associated SRv6 SID) advertised via BGP sessions is 1028 limited to peers within this trusted SR domain. Security 1029 consideration section of [RFC8669] discuss mechanisms to prevent 1030 leaking of BGP Prefix-SID attribute, that carries SRv6 SID, outside 1031 the SR domain. In the event that these filtering mechanisms, both in 1032 the forwarding and control plane, are not implemented properly, it 1033 may be possible for nodes outside the SR domain to learn the VPN 1034 Service SIDs and use them to direct traffic into VPN networks from 1035 outside the SR domain. 1037 11. Acknowledgments 1039 The authors of this document would like to thank Stephane Litkowski, 1040 Rishabh Parekh, Xiejingrong and Rajesh M for their comments and 1041 review of this document. 1043 12. Contributors 1045 Satoru Matsushima 1046 SoftBank 1048 Email: satoru.matsushima@g.softbank.co.jp 1050 Dirk Steinberg 1051 Steinberg Consulting 1053 Email: dws@steinberg.net 1055 Daniel Bernier 1056 Bell Canada 1058 Email: daniel.bernier@bell.ca 1060 Daniel Voyer 1061 Bell Canada 1063 Email: daniel.voyer@bell.ca 1065 Jonn Leddy 1066 Individual 1068 Email: john@leddy.net 1070 Swadesh Agrawal 1071 Cisco 1073 Email: swaagraw@cisco.com 1075 Patrice Brissette 1076 Cisco 1078 Email: pbrisset@cisco.com 1079 Ali Sajassi 1080 Cisco 1082 Email: sajassi@cisco.com 1084 Bart Peirens 1085 Proximus 1086 Belgium 1088 Email: bart.peirens@proximus.com 1090 Darren Dukes 1091 Cisco 1093 Email: ddukes@cisco.com 1095 Pablo Camarilo 1096 Cisco 1098 Email: pcamaril@cisco.com 1100 Shyam Sethuram 1101 Cisco 1103 Email: shyam.ioml@gmail.com 1105 Zafar Ali 1106 Cisco 1108 Email: zali@cisco.com 1110 13. References 1112 13.1. Normative References 1114 [I-D.ietf-bess-evpn-igmp-mld-proxy] 1115 Sajassi, A., Thoria, S., Patel, K., Drake, J., and W. Lin, 1116 "IGMP and MLD Proxy for EVPN", draft-ietf-bess-evpn-igmp- 1117 mld-proxy-05 (work in progress), April 2020. 1119 [I-D.ietf-bess-evpn-prefix-advertisement] 1120 Rabadan, J., Henderickx, W., Drake, J., Lin, W., and A. 1121 Sajassi, "IP Prefix Advertisement in EVPN", draft-ietf- 1122 bess-evpn-prefix-advertisement-11 (work in progress), May 1123 2018. 1125 [I-D.ietf-bess-rfc5549revision] 1126 Litkowski, S., Agrawal, S., ananthamurthy, k., and K. 1127 Patel, "Advertising IPv4 Network Layer Reachability 1128 Information with an IPv6 Next Hop", draft-ietf-bess- 1129 rfc5549revision-06 (work in progress), September 2020. 1131 [I-D.ietf-spring-srv6-network-programming] 1132 Filsfils, C., Camarillo, P., Leddy, J., Voyer, D., 1133 Matsushima, S., and Z. Li, "SRv6 Network Programming", 1134 draft-ietf-spring-srv6-network-programming-24 (work in 1135 progress), October 2020. 1137 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1138 Requirement Levels", BCP 14, RFC 2119, 1139 DOI 10.17487/RFC2119, March 1997, 1140 . 1142 [RFC2545] Marques, P. and F. Dupont, "Use of BGP-4 Multiprotocol 1143 Extensions for IPv6 Inter-Domain Routing", RFC 2545, 1144 DOI 10.17487/RFC2545, March 1999, 1145 . 1147 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A 1148 Border Gateway Protocol 4 (BGP-4)", RFC 4271, 1149 DOI 10.17487/RFC4271, January 2006, 1150 . 1152 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 1153 Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February 1154 2006, . 1156 [RFC4456] Bates, T., Chen, E., and R. Chandra, "BGP Route 1157 Reflection: An Alternative to Full Mesh Internal BGP 1158 (IBGP)", RFC 4456, DOI 10.17487/RFC4456, April 2006, 1159 . 1161 [RFC4659] De Clercq, J., Ooms, D., Carugi, M., and F. Le Faucheur, 1162 "BGP-MPLS IP Virtual Private Network (VPN) Extension for 1163 IPv6 VPN", RFC 4659, DOI 10.17487/RFC4659, September 2006, 1164 . 1166 [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, 1167 "Multiprotocol Extensions for BGP-4", RFC 4760, 1168 DOI 10.17487/RFC4760, January 2007, 1169 . 1171 [RFC6514] Aggarwal, R., Rosen, E., Morin, T., and Y. Rekhter, "BGP 1172 Encodings and Procedures for Multicast in MPLS/BGP IP 1173 VPNs", RFC 6514, DOI 10.17487/RFC6514, February 2012, 1174 . 1176 [RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A., 1177 Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based 1178 Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February 1179 2015, . 1181 [RFC7606] Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. 1182 Patel, "Revised Error Handling for BGP UPDATE Messages", 1183 RFC 7606, DOI 10.17487/RFC7606, August 2015, 1184 . 1186 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1187 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1188 May 2017, . 1190 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 1191 (IPv6) Specification", STD 86, RFC 8200, 1192 DOI 10.17487/RFC8200, July 2017, 1193 . 1195 [RFC8214] Boutros, S., Sajassi, A., Salam, S., Drake, J., and J. 1196 Rabadan, "Virtual Private Wire Service Support in Ethernet 1197 VPN", RFC 8214, DOI 10.17487/RFC8214, August 2017, 1198 . 1200 [RFC8277] Rosen, E., "Using BGP to Bind MPLS Labels to Address 1201 Prefixes", RFC 8277, DOI 10.17487/RFC8277, October 2017, 1202 . 1204 [RFC8317] Sajassi, A., Ed., Salam, S., Drake, J., Uttaro, J., 1205 Boutros, S., and J. Rabadan, "Ethernet-Tree (E-Tree) 1206 Support in Ethernet VPN (EVPN) and Provider Backbone 1207 Bridging EVPN (PBB-EVPN)", RFC 8317, DOI 10.17487/RFC8317, 1208 January 2018, . 1210 [RFC8365] Sajassi, A., Ed., Drake, J., Ed., Bitar, N., Shekhar, R., 1211 Uttaro, J., and W. Henderickx, "A Network Virtualization 1212 Overlay Solution Using Ethernet VPN (EVPN)", RFC 8365, 1213 DOI 10.17487/RFC8365, March 2018, 1214 . 1216 [RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., 1217 Decraene, B., Litkowski, S., and R. Shakir, "Segment 1218 Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, 1219 July 2018, . 1221 [RFC8669] Previdi, S., Filsfils, C., Lindem, A., Ed., Sreekantiah, 1222 A., and H. Gredler, "Segment Routing Prefix Segment 1223 Identifier Extensions for BGP", RFC 8669, 1224 DOI 10.17487/RFC8669, December 2019, 1225 . 1227 [RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., 1228 Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header 1229 (SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020, 1230 . 1232 13.2. Informative References 1234 [I-D.ietf-idr-segment-routing-te-policy] 1235 Previdi, S., Filsfils, C., Talaulikar, K., Mattes, P., 1236 Rosen, E., Jain, D., and S. Lin, "Advertising Segment 1237 Routing Policies in BGP", draft-ietf-idr-segment-routing- 1238 te-policy-09 (work in progress), May 2020. 1240 [I-D.ietf-spring-segment-routing-policy] 1241 Filsfils, C., Talaulikar, K., Voyer, D., Bogdanov, A., and 1242 P. Mattes, "Segment Routing Policy Architecture", draft- 1243 ietf-spring-segment-routing-policy-09 (work in progress), 1244 November 2020. 1246 [I-D.matsushima-spring-srv6-deployment-status] 1247 Matsushima, S., Filsfils, C., Ali, Z., Li, Z., and K. 1248 Rajaraman, "SRv6 Implementation and Deployment Status", 1249 draft-matsushima-spring-srv6-deployment-status-08 (work in 1250 progress), October 2020. 1252 [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis", 1253 RFC 4272, DOI 10.17487/RFC4272, January 2006, 1254 . 1256 [RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP 1257 Authentication Option", RFC 5925, DOI 10.17487/RFC5925, 1258 June 2010, . 1260 [RFC6952] Jethanandani, M., Patel, K., and L. Zheng, "Analysis of 1261 BGP, LDP, PCEP, and MSDP Issues According to the Keying 1262 and Authentication for Routing Protocols (KARP) Design 1263 Guide", RFC 6952, DOI 10.17487/RFC6952, May 2013, 1264 . 1266 Authors' Addresses 1268 Gaurav Dawra (editor) 1269 LinkedIn 1270 USA 1272 Email: gdawra.ietf@gmail.com 1274 Clarence Filsfils 1275 Cisco Systems 1276 Belgium 1278 Email: cfilsfil@cisco.com 1280 Ketan Talaulikar (editor) 1281 Cisco Systems 1282 India 1284 Email: ketant@cisco.com 1286 Robert Raszuk 1287 Bloomberg LP 1288 USA 1290 Email: robert@raszuk.net 1292 Bruno Decraene 1293 Orange 1294 France 1296 Email: bruno.decraene@orange.com 1298 Shunwan Zhuang 1299 Huawei Technologies 1300 China 1302 Email: zhuangshunwan@huawei.com 1303 Jorge Rabadan 1304 Nokia 1305 USA 1307 Email: jorge.rabadan@nokia.com