idnits 2.17.1 draft-ietf-bess-srv6-services-06.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 9, 2021) is 1144 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-21) exists of draft-ietf-bess-evpn-igmp-mld-proxy-06 == Outdated reference: A later version (-26) exists of draft-ietf-idr-segment-routing-te-policy-11 == Outdated reference: A later version (-22) exists of draft-ietf-spring-segment-routing-policy-09 == Outdated reference: A later version (-15) exists of draft-matsushima-spring-srv6-deployment-status-10 Summary: 0 errors (**), 0 flaws (~~), 5 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS Working Group G. Dawra, Ed. 3 Internet-Draft LinkedIn 4 Intended status: Standards Track C. Filsfils 5 Expires: September 10, 2021 K. Talaulikar, Ed. 6 Cisco Systems 7 R. Raszuk 8 Bloomberg LP 9 B. Decraene 10 Orange 11 S. Zhuang 12 Huawei Technologies 13 J. Rabadan 14 Nokia 15 March 9, 2021 17 SRv6 BGP based Overlay services 18 draft-ietf-bess-srv6-services-06 20 Abstract 22 This draft defines procedures and messages for SRv6-based BGP 23 services including L3VPN, EVPN and Internet services. It builds on 24 RFC4364 "BGP/MPLS IP Virtual Private Networks (VPNs)" and RFC7432 25 "BGP MPLS-Based Ethernet VPN". 27 Status of This Memo 29 This Internet-Draft is submitted in full conformance with the 30 provisions of BCP 78 and BCP 79. 32 Internet-Drafts are working documents of the Internet Engineering 33 Task Force (IETF). Note that other groups may also distribute 34 working documents as Internet-Drafts. The list of current Internet- 35 Drafts is at https://datatracker.ietf.org/drafts/current/. 37 Internet-Drafts are draft documents valid for a maximum of six months 38 and may be updated, replaced, or obsoleted by other documents at any 39 time. It is inappropriate to use Internet-Drafts as reference 40 material or to cite them other than as "work in progress." 42 This Internet-Draft will expire on September 10, 2021. 44 Copyright Notice 46 Copyright (c) 2021 IETF Trust and the persons identified as the 47 document authors. All rights reserved. 49 This document is subject to BCP 78 and the IETF Trust's Legal 50 Provisions Relating to IETF Documents 51 (https://trustee.ietf.org/license-info) in effect on the date of 52 publication of this document. Please review these documents 53 carefully, as they describe your rights and restrictions with respect 54 to this document. Code Components extracted from this document must 55 include Simplified BSD License text as described in Section 4.e of 56 the Trust Legal Provisions and are provided without warranty as 57 described in the Simplified BSD License. 59 Table of Contents 61 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 62 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 63 2. SRv6 Services TLVs . . . . . . . . . . . . . . . . . . . . . 4 64 3. SRv6 Service Sub-TLVs . . . . . . . . . . . . . . . . . . . . 5 65 3.1. SRv6 SID Information Sub-TLV . . . . . . . . . . . . . . 6 66 3.2. SRv6 Service Data Sub-Sub-TLVs . . . . . . . . . . . . . 7 67 3.2.1. SRv6 SID Structure Sub-Sub-TLV . . . . . . . . . . . 7 68 4. Encoding SRv6 SID information . . . . . . . . . . . . . . . . 9 69 5. BGP based L3 service over SRv6 . . . . . . . . . . . . . . . 10 70 5.1. IPv4 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 11 71 5.2. IPv6 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 12 72 5.3. Global IPv4 over SRv6 Core . . . . . . . . . . . . . . . 12 73 5.4. Global IPv6 over SRv6 Core . . . . . . . . . . . . . . . 12 74 6. BGP based Ethernet VPN (EVPN) over SRv6 . . . . . . . . . . . 12 75 6.1. Ethernet Auto-discovery route over SRv6 Core . . . . . . 13 76 6.1.1. Ethernet A-D per ES route . . . . . . . . . . . . . . 14 77 6.1.2. Ethernet A-D per EVI route . . . . . . . . . . . . . 14 78 6.2. MAC/IP Advertisement route over SRv6 Core . . . . . . . . 15 79 6.2.1. MAC/IP Advertisement route with MAC Only . . . . . . 16 80 6.2.2. MAC/IP Advertisement route with MAC+IP . . . . . . . 16 81 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core . . 16 82 6.4. Ethernet Segment route over SRv6 Core . . . . . . . . . . 18 83 6.5. IP prefix route over SRv6 Core . . . . . . . . . . . . . 18 84 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 85 core . . . . . . . . . . . . . . . . . . . . . . . . . . 19 86 7. Implementation Status . . . . . . . . . . . . . . . . . . . . 19 87 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 20 88 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 21 89 9.1. BGP Prefix-SID TLV Types registry . . . . . . . . . . . . 21 90 9.2. SRv6 Service Sub-TLV Types registry . . . . . . . . . . . 21 91 9.3. SRv6 Service Data Sub-Sub-TLV Types registry . . . . . . 22 92 10. Security Considerations . . . . . . . . . . . . . . . . . . . 22 93 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23 94 12. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 23 95 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 24 96 13.1. Normative References . . . . . . . . . . . . . . . . . . 24 97 13.2. Informative References . . . . . . . . . . . . . . . . . 27 98 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 28 100 1. Introduction 102 SRv6 refers to Segment Routing instantiated on the IPv6 dataplane 103 [RFC8402]. 105 SRv6 based BGP services refers to the L3 and L2 overlay services with 106 BGP as control plane and SRv6 as dataplane. 108 SRv6 SID refers to a SRv6 Segment Identifier as defined in [RFC8402]. 110 SRv6 Service SID refers to an SRv6 SID associated with one of the 111 service specific behaviors on the advertising Provider Edge (PE) 112 router, such as (but not limited to), END.DT (Table lookup in a VRF) 113 or END.DX (cross-connect to a nexthop) behaviors in the case of L3VPN 114 service as defined in [RFC8986]. 116 To provide SRv6 service with best-effort connectivity, the egress PE 117 signals an SRv6 Service SID with the BGP overlay service route. The 118 ingress PE encapsulates the payload in an outer IPv6 header where the 119 destination address is the SRv6 Service SID provided by the egress 120 PE. The underlay between the PEs only need to support plain IPv6 121 forwarding [RFC8200]. 123 To provide SRv6 service in conjunction with an underlay SLA from the 124 ingress PE to the egress PE, the egress PE colors the overlay service 125 route with a Color Extended Community 126 [I-D.ietf-idr-segment-routing-te-policy] for steering of flows for 127 those routes as specified in section 8 of 128 [I-D.ietf-spring-segment-routing-policy]. The ingress PE 129 encapsulates the payload packet in an outer IPv6 header with the 130 segment list of SR policy associated with the related SLA along with 131 the SRv6 Service SID associated with the route using the SRH 132 [RFC8754]. The underlay nodes whose SRv6 SID's are part of the SRH 133 segment list MUST support SRv6 data plane. 135 BGP is used to advertise the reachability of prefixes of a particular 136 service from an egress PE to ingress PE nodes. 138 This document describes how existing BGP messages between PEs may 139 carry SRv6 Service SIDs as a means to interconnect PEs and form VPNs. 141 1.1. Requirements Language 143 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 144 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 145 "OPTIONAL" in this document are to be interpreted as described in BCP 146 14 [RFC2119] [RFC8174] when, and only when, they appear in all 147 capitals, as shown here. 149 2. SRv6 Services TLVs 151 This document extends the use of the BGP Prefix-SID attribute 152 [RFC8669] to carry SRv6 SIDs and their associated information with 153 the BGP address-families listed further in this section. 155 The SRv6 Service TLVs are defined as two new TLVs of the BGP Prefix- 156 SID Attribute to achieve signaling of SRv6 SIDs for L3 and L2 157 services. 159 o SRv6 L3 Service TLV: This TLV encodes Service SID information for 160 SRv6 based L3 services. It corresponds to the equivalent 161 functionality provided by an MPLS Label when received with a Layer 162 3 service route as defined in [RFC4364] [RFC4659] [RFC8950] 163 [I-D.ietf-bess-evpn-prefix-advertisement]. Some behaviors which 164 MAY be encoded, but not limited to, are End.DX4, End.DT4, End.DX6, 165 End.DT6, etc. 167 o SRv6 L2 Service TLV: This TLV encodes Service SID information for 168 SRv6 based L2 services. It corresponds to the equivalent 169 functionality provided by an MPLS Label1 for EVPN Route-Types as 170 defined in [RFC7432]. Some behaviors which MAY be encoded, but 171 not limited to, are End.DX2, End.DX2V, End.DT2U, End.DT2M etc. 173 When an egress PE is enabled for BGP Services over SRv6 data-plane, 174 it MUST signal one or more SRv6 Service SIDs enclosed in SRv6 Service 175 TLV(s) within the BGP Prefix-SID Attribute attached to MP-BGP NLRIs 176 defined in [RFC4760] [RFC4659] [RFC8950] [RFC7432] [RFC4364] 177 [I-D.ietf-bess-evpn-prefix-advertisement] where applicable as 178 described in Section 5 and Section 6. 180 The support for BGP MVPN Services [RFC6513] with SRv6 is outside the 181 scope of this document. 183 The following depicts the SRv6 Service TLVs encoded in the BGP 184 Prefix-SID Attribute: 186 0 1 2 3 187 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 188 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 189 | TLV Type | TLV Length | RESERVED | 190 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 191 // SRv6 Service Sub-TLVs // 192 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 194 o TLV Type (1 octet): This field is assigned values from the IANA 195 registry "BGP Prefix-SID TLV Types". It is set to 5 for SRv6 L3 196 Service TLV. It is set to 6 for SRv6 L2 Service TLV. 198 o TLV Length (2 octets): Specifies the total length of the TLV 199 Value. 201 o RESERVED (1 octet): This field is reserved; it SHOULD be set to 0 202 by the sender and MUST be ignored by the receiver. 204 o SRv6 Service Sub-TLVs (variable): This field contains SRv6 Service 205 related information and is encoded as an unordered list of Sub- 206 TLVs whose format is described below. 208 A BGP speaker receiving a route containing BGP Prefix-SID Attribute 209 with one or more SRv6 Service TLVs observes the following rules when 210 advertising the received route to other peers: 212 o if the nexthop is unchanged during advertisement, the SRv6 Service 213 TLVs, including any unrecognized Types of Sub-TLV and Sub-Sub-TLV, 214 SHOULD be propagated further. In addition, all Reserved fields in 215 the TLV or Sub-TLV or Sub-Sub-TLV MUST be propagated unchanged. 217 o if the nexthop is changed, the TLVs, Sub-TLVs and Sub-Sub-TLVs 218 SHOULD be updated as appropriate. Any unrecognized received sub- 219 TLVs and Sub-Sub-TLVs MUST be removed. 221 3. SRv6 Service Sub-TLVs 223 The format of a single SRv6 Service Sub-TLV is depicted below: 225 0 1 2 3 226 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 227 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 228 | SRv6 Service | SRv6 Service | SRv6 Service // 229 | Sub-TLV | Sub-TLV | Sub-TLV // 230 | Type | Length | value // 231 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 233 o SRv6 Service Sub-TLV Type (1 octet): Identifies the type of SRv6 234 service information. It is assigned values from the IANA Registry 235 "SRv6 Service Sub-TLV Types". 237 o SRv6 Service Sub-TLV Length (2 octets): Specifies the total length 238 of the Sub-TLV Value field. 240 o SRv6 Service Sub-TLV Value (variable): Contains data specific to 241 the Sub-TLV Type. In addition to fixed length data, it contains 242 other properties of the SRv6 Service encoded as a set of SRv6 243 Service Data Sub-Sub-TLVs whose format is described in Section 3.2 244 below. 246 3.1. SRv6 SID Information Sub-TLV 248 SRv6 Service Sub-TLV Type 1 is assigned for SRv6 SID Information Sub- 249 TLV. This Sub-TLV contains a single SRv6 SID along with its 250 properties. Its encoding is depicted below: 252 0 1 2 3 253 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 254 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 255 | SRv6 Service | SRv6 Service | | 256 | Sub-TLV | Sub-TLV | | 257 | Type=1 | Length | RESERVED1 | 258 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 259 // SRv6 SID Value (16 bytes) // 260 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 261 | SRv6 SID Flags| SRv6 Endpoint Behavior | RESERVED2 | 262 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 263 // SRv6 Service Data Sub-Sub-TLVs // 264 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 266 o SRv6 Service Sub-TLV Type (1 octet): This field is set to 1 to 267 represent SRv6 SID Information Sub-TLV. 269 o SRv6 Service Sub-TLV Length (2 octets): This field contains the 270 total length of the Value field of the Sub-TLV. 272 o RESERVED1 (1 octet): SHOULD be set to 0 by the sender and MUST be 273 ignored by the receiver. 275 o SRv6 SID Value (16 octets): Encodes an SRv6 SID as defined in 276 [RFC8986] 278 o SRv6 SID Flags (1 octet): Encodes SRv6 SID Flags - none are 279 currently defined. SHOULD be set to 0 by sender and MUST be 280 ignored by the receiver. 282 o SRv6 Endpoint Behavior (2 octets): Encodes SRv6 Endpoint behavior 283 codepoint value from the IANA registry defined in section 9.2 of 284 [RFC8986] that is associated with SRv6 SID. The opaque behavior 285 (i.e. value 0xFFFF) or an unrecognized behavior MUST NOT be 286 considered as invalid by the receiver. 288 o RESERVED2 (1 octet): SHOULD be set to 0 by the sender and MUST be 289 ignored by the receiver. 291 o SRv6 Service Data Sub-Sub-TLV Value (variable): Used to advertise 292 properties of the SRv6 SID. It is encoded as a set of SRv6 293 Service Data Sub-Sub-TLVs. 295 When multiple SRv6 SID Information Sub-TLVs are present, the ingress 296 PE SHOULD use the SRv6 SID from the first instance of the Sub-TLV. 297 An implementation MAY provide a local policy to override this 298 selection. 300 3.2. SRv6 Service Data Sub-Sub-TLVs 302 The format of the SRv6 Service Data Sub-Sub-TLV is depicted below: 304 0 1 2 3 305 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 306 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 307 | Service Data | Sub-Sub-TLV Length |Sub-Sub TLV // 308 | Sub-Sub-TLV | | Value // 309 | Type | | // 310 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 312 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): Identifies the type 313 of Sub-Sub-TLV. It is assigned values from the IANA Registry 314 "SRv6 Service Data Sub-Sub-TLVs". 316 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): Specifies the 317 total length of the Sub-Sub-TLV Value field. 319 o SRv6 Service Data Sub-Sub-TLV Value (variable): Contains data 320 specific to the Sub-Sub-TLV Type. 322 3.2.1. SRv6 SID Structure Sub-Sub-TLV 324 SRv6 Service Data Sub-Sub-TLV Type 1 is assigned for SRv6 SID 325 structure Sub-Sub-TLV. SRv6 SID Structure Sub-Sub-TLV is used to 326 advertise the lengths of each individual parts of the SRv6 SID as 327 defined in [RFC8986]. It is carried as Sub-Sub-TLV in SRv6 SID 328 Information Sub-TLV 329 0 1 2 3 330 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 331 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 332 | SRv6 Service | SRv6 Service | Locator Block | 333 | Data Sub-Sub | Data Sub-Sub-TLV | Length | 334 | -TLV Type=1 | Length=6 | | 335 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 336 | Locator Node | Function | Argument | Transposition | 337 | Length | Length | Length | Length | 338 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 339 | Transposition | 340 | Offset | 341 +-+-+-+-+-+-+-+-+ 343 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): This field is set to 344 1 to represent SRv6 SID Structure Sub-Sub-TLV. 346 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): This field 347 contains the total length of 6 bytes. 349 o Locator Block Length (1 octet): Contains length of SRv6 SID 350 locator Block in bits. 352 o Locator Node Length (1 octet): Contains length of SRv6 SID locator 353 Node in bits. 355 o Function Length (1 octet): Contains length of SRv6 SID Function in 356 bits. 358 o Argument Length (1 octet): Contains length of SRv6 SID argument in 359 bits. 361 o Transposition Length (1 octet): Size in bits for the part of SID 362 that has been transposed (or shifted) into a label field 364 o Transposition Offset (1 octet): The offset position in bits for 365 the part of SID that has been transposed (or shifted) into a label 366 field. 368 Section 4 describes mechanisms for signaling of the SRv6 Service SID 369 by transposing a variable part of the SRv6 SID value (function and/or 370 the argument parts) and carrying them in existing label fields to 371 achieve more efficient packing of those service prefix NLRIs in BGP 372 update messages. The SRv6 SID Structure Sub-Sub-TLV contains 373 appropriate length fields when the SRv6 Service SID is signaled in 374 split parts to enable the receiver to put together the SID 375 accurately. 377 Transposition Offset indicates the bit position and Transposition 378 Length indicates the number of bits that are being taken out of the 379 SRv6 SID value and put into high order bits of label field. The bits 380 that have been shifted out MUST be set to 0 in the SID value. 382 Transposition Length of 0 indicates nothing is transposed and that 383 the entire SRv6 SID value is encoded in the SID Information sub-TLV. 384 In this case, the Transposition Offset MUST be set to 0. 386 The size of the label field limits the bits transposed from the SRv6 387 SID value into it. E.g., the size of label field in [RFC4364] 388 [RFC8277] is 20 bits while in [RFC7432] is 24 bits. 390 As an example, when the entire function part of size 16 of an SRv6 391 SID is transposed and the sum of the locator block and locator node 392 parts is 64, then the transposition offset would be set to 64 and the 393 transposition length is set to 16. 395 BGP speakers that do not support this specification may misinterpret, 396 on reception of an SRv6-based BGP service route update, the function 397 and/or argument parts of the SRv6 SID encoded in label field(s) as 398 MPLS label values for MPLS-based services. Implementations 399 supporting this specification SHOULD provide a mechanism to control 400 advertisement of SRv6-based BGP service routes on a per neighbor and 401 per service basis. The details of deployment designs and 402 implementation options are outside the scope of this document. 404 Arguments MAY be generally applicable for SIDs of only specific 405 behaviors (e.g. End.DT2M) and therefore the argument length MUST be 406 set to 0 for SIDs where the argument is not applicable. 408 4. Encoding SRv6 SID information 410 The SRv6 Service SID(s) for a BGP Service Prefix are carried in the 411 SRv6 Services TLVs of the BGP Prefix-SID Attribute. 413 For certain types of BGP Services like L3VPN where a per-VRF SID 414 allocation is used (i.e. End.DT4 or End.DT6 behaviors), the same SID 415 is shared across multiple NLRIs thus providing efficient packing. 416 However, for certain other types of BGP Services like EVPN VPWS where 417 a per-PW SID allocation is required (i.e. End.DX2 behavior), each 418 NLRI would have its own unique SID there by resulting in inefficient 419 packing. 421 To achieve efficient packing, this document allows the encoding of 422 the SRv6 Service SID either as a whole in the SRv6 Services TLVs or 423 the encoding of only the common part of the SRv6 SID (e.g. Locator) 424 in the SRv6 Services TLVs and encoding the variable (e.g. Function 425 and Argument parts) in the existing label fields specific to that 426 service encoding. This later form of encoding is referred to as the 427 Transposition Scheme where the SRv6 SID Structure Sub-Sub-TLV 428 describes the sizes of the parts of the SRv6 SID and to also indicate 429 offset of variable part along with its length in SRv6 SID value. The 430 use of the Transposition Scheme is RECOMMENDED for the specific 431 service encodings that allow it as described further in Section 5 and 432 Section 6. 434 As an example, for the EVPN VPWS service prefix described further in 435 Section 6.1.2, the function part of the SRv6 SID is encoded in the 436 MPLS Label field of the NLRI and the SID value in the SRv6 Services 437 TLV carries only the locator part with the SRv6 SID Structure Sub- 438 Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines the lengths of 439 locator block, locator node and function parts (arguments are not 440 applicable for the End.DX2 behavior). Transposition Offset indicates 441 the bit position and Transposition Length indicates the number of 442 bits that are being taken out of the SID and put into label field. 444 In yet another example, for the EVPN Ethernet A-D per ES route 445 described further in Section 6.1.1, only the argument of the SID 446 needs to be signaled. This argument part of the SRv6 SID MAY be 447 transposed in the ESI Label field of the ESI Label Extended Community 448 and the SID value in the SRv6 Services TLV is set to 0 with the SRv6 449 SID Structure Sub-Sub-TLV. The SRv6 SID Structure sub-sub-TLV 450 defines the lengths of locator block, locator node, function and 451 argument parts. The offset and length of argument part SID value 452 moved to label field is set in transposition offset and length of SID 453 structure TLV. The receiving router is then able to put together the 454 entire SRv6 Service SID (e.g. for the End.DT2M behavior) placing the 455 label value received in the ESI Label field of the Ethernet A-D per 456 ES route into the correct transposition offset and length in the SRv6 457 SID with the End.DT2M behavior received for a EVPN Route Type 3 458 value. 460 5. BGP based L3 service over SRv6 462 BGP egress nodes (egress PEs) advertise a set of reachable prefixes. 463 Standard BGP update propagation schemes[RFC4271], which may make use 464 of route reflectors [RFC4456], are used to propagate these prefixes. 465 BGP ingress nodes (ingress PEs) receive these advertisements and may 466 add the prefix to the RIB in an appropriate VRF. 468 Egress PEs which supports SRv6 based L3 services advertises overlay 469 service prefixes along with a Service SID enclosed in a SRv6 L3 470 Service TLV within the BGP Prefix-SID Attribute. This TLV serves two 471 purposes - first, it indicates that the egress PE supports SRv6 472 overlay and the BGP ingress PE receiving this route MUST choose to 473 perform IPv6 encapsulation and optionally insert an SRH [RFC8754] 474 when required; second ,it indicates the value of the Service SID to 475 be used in the encapsulation. 477 The Service SID thus signaled only has local significance at the 478 egress PE, where it may be allocated or configured on a per-CE or 479 per-VRF basis. In practice, the SID may encode a cross-connect to a 480 specific Address Family table (END.DT) or next-hop/interface (END.DX) 481 as defined in [RFC8986]. 483 The SRv6 Service SID SHOULD be routable within the AS of the egress 484 PE and serves the dual purpose of providing reachability between 485 ingress PE and egress PE while also encoding the endpoint behavior. 487 When providing best-effort connectivity to the egress PE, the ingress 488 PE encapsulates the payload in an outer IPv6 header where the 489 destination address is the SRv6 Service SID associated with the 490 related BGP route update. Therefore, the ingress PE SHOULD perform 491 resolvability check for the SRv6 Service SID before considering the 492 received prefix for the BGP best path computation. 494 For service over SRv6 core, the egress PE sets the next-hop to one of 495 its IPv6 address. Such an address MAY be one that is covered by the 496 SRv6 Locator from which the SRv6 Service SID is allocated. The next- 497 hop is used for tracking reachability of the egress PE based on 498 existing BGP procedures. 500 When the BGP route received at an ingress PE is colored with an 501 extended color community and is being steered over a valid SRv6 502 Policy associated with SID list as described in 503 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 504 effective SR Policy is . 506 Multiple routes MAY resolve recursively via the same SR Policy. 508 5.1. IPv4 VPN Over SRv6 Core 510 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 VPN 511 Over IPv6 Core defined in [RFC8950]. 513 Label field of IPv4-VPN NLRI is encoded as specified in [RFC8277] 514 with the Label Value set to the Function part of the SRv6 SID when 515 the Transposition Scheme of encoding (Section 4) is used and 516 otherwise set to Implicit NULL. 518 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 519 behavior of the SRv6 SID is entirely up to the originator of the 520 advertisement. In practice, the behavior is End.DX4 or End.DT4. 522 5.2. IPv6 VPN Over SRv6 Core 524 The MP_REACH_NLRI over SRv6 core is encoded according to IPv6 VPN 525 over IPv6 Core is defined in [RFC4659]. 527 Label field of the IPv6-VPN NLRI is encoded as specified in [RFC8277] 528 with the Label Value set to the Function part of the SRv6 SID when 529 the Transposition Scheme of encoding (Section 4) is used and 530 otherwise set to Implicit NULL. 532 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 533 behavior of the SRv6 SID is entirely up to the originator of the 534 advertisement. In practice, the behavior is End.DX6 or End.DT6. 536 5.3. Global IPv4 over SRv6 Core 538 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 over 539 IPv6 Core is defined in [RFC8950]. 541 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 542 behavior of the SRv6 SID is entirely up to the originator of the 543 advertisement. In practice, the behavior is End.DX4 or End.DT4. 545 5.4. Global IPv6 over SRv6 Core 547 The MP_REACH_NLRI over SRv6 core is encoded according to [RFC2545] 549 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 550 behavior of the SRv6 SID is entirely up to the originator of the 551 advertisement. In practice, the behavior is End.DX6 or End.DT6. 553 6. BGP based Ethernet VPN (EVPN) over SRv6 555 [RFC7432] provides an extendable method of building an Ethernet VPN 556 (EVPN) overlay. It primarily focuses on MPLS based EVPNs and 557 [RFC8365] extends to IP based EVPN overlays. [RFC7432] defines Route 558 Types 1, 2 and 3 which carry prefixes and MPLS Label fields; the 559 Label fields have specific use for MPLS encapsulation of EVPN 560 traffic. Route Type 5 carrying MPLS label information (and thus 561 encapsulation information) for EVPN is defined in 562 [I-D.ietf-bess-evpn-prefix-advertisement]. Route Types 6,7 and 8 are 563 defined in [I-D.ietf-bess-evpn-igmp-mld-proxy]. 565 o Ethernet Auto-discovery Route (Route Type 1) 567 o MAC/IP Advertisement Route (Route Type 2) 569 o Inclusive Multicast Ethernet Tag Route (Route Type 3) 570 o Ethernet Segment route (Route Type 4) 572 o IP prefix route (Route Type 5) 574 o Selective Multicast Ethernet Tag route (Route Type 6) 576 o IGMP join sync route (Route Type 7) 578 o IGMP leave sync route (Route Type 8) 580 To support SRv6 based EVPN overlays, one or more SRv6 Service SIDs 581 are advertised with Route Type 1,2,3 and 5. The SRv6 Service SID(s) 582 per Route Type are advertised in SRv6 L3/L2 Service TLVs within the 583 BGP Prefix-SID Attribute. Signaling of SRv6 Service SID(s) serves 584 two purposes - first, it indicates that the BGP egress device 585 supports SRv6 overlay and the BGP ingress device receiving this route 586 MUST perform IPv6 encapsulation and optionally insert an SRH 587 [RFC8754] when required; second, it indicates the value of the 588 Service SID(s) to be used in the encapsulation. 590 The SRv6 Service SID SHOULD be routable within the AS of the egress 591 PE and serves the dual purpose of providing reachability between 592 ingress PE and egress PE while also encoding the endpoint behavior. 594 When providing best-effort connectivity to the egress PE, the ingress 595 PE encapsulates the payload in an outer IPv6 header where the 596 destination address is the SRv6 Service SID associated with the 597 related BGP route update. Therefore, the ingress PE SHOULD perform 598 resolvability check for the SRv6 Service SID before considering the 599 received prefix for the BGP best path computation. 601 For service over SRv6 core, the egress PE sets the next-hop to one of 602 its IPv6 address. Such an address MAY be one that is covered by the 603 SRv6 Locator from which the SRv6 Service SID is allocated. The next- 604 hop is used for tracking reachability of the egress PE based on 605 existing BGP procedures. 607 When the BGP route received at an ingress PE is colored with an 608 extended color community and is being steered over a valid SRv6 609 Policy associated with SID list as described in 610 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 611 effective SR Policy is . 613 6.1. Ethernet Auto-discovery route over SRv6 Core 615 Ethernet Auto-Discovery (A-D) routes are Route Type 1 defined in 616 [RFC7432] and may be used to achieve split horizon filtering, fast 617 convergence and aliasing. EVPN Route Type 1 is also used in EVPN- 618 VPWS as well as in EVPN flexible cross-connect; mainly used to 619 advertise point-to-point services ID. 621 As a reminder, EVPN Route Type 1 is encoded as follows: 623 +---------------------------------------+ 624 | RD (8 octets) | 625 +---------------------------------------+ 626 |Ethernet Segment Identifier (10 octets)| 627 +---------------------------------------+ 628 | Ethernet Tag ID (4 octets) | 629 +---------------------------------------+ 630 | MPLS label (3 octets) | 631 +---------------------------------------+ 633 6.1.1. Ethernet A-D per ES route 635 Ethernet A-D per ES route NLRI encoding over SRv6 core is as per 636 [RFC7432]. 638 The ESI label field of the ESI label extended community carries the 639 Argument part of the SRv6 SID when ESI filtering approach is used 640 along with the Transposition Scheme of encoding (Section 4) and 641 otherwise set to Implicit NULL. 643 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 644 Prefix-SID attribute is advertised along with the A-D route. The 645 behavior of the Service SID thus signaled is entirely up to the 646 originator of the advertisement. When ESI filtering approach is 647 used, the Service SID is used to signal Arg.FE2 SID argument for 648 applicable End.DT2M SIDs [RFC8986]. When local-bias approach is 649 used, the Service SID MAY be of value 0. 651 6.1.2. Ethernet A-D per EVI route 653 Ethernet A-D per EVI route NLRI encoding over SRv6 core is similar to 654 [RFC7432] and [RFC8214] with the following change: 656 o MPLS Label: carries the Function part of the SRv6 SID when the 657 Transposition Scheme of encoding (Section 4) is used and otherwise 658 set to Implicit NULL. 660 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 661 Prefix-SID attribute is advertised along with the A-D route. The 662 behavior of the Service SID thus signaled is entirely up to the 663 originator of the advertisement. In practice, the behavior is 664 END.DX2, END.DX2V or END.DT2U. 666 6.2. MAC/IP Advertisement route over SRv6 Core 668 EVPN Route Type 2 is used to advertise unicast traffic MAC+IP address 669 reachability through MP-BGP to all other PEs in a given EVPN 670 instance. 672 As a reminder, EVPN Route Type 2 is encoded as follows: 674 +---------------------------------------+ 675 | RD (8 octets) | 676 +---------------------------------------+ 677 |Ethernet Segment Identifier (10 octets)| 678 +---------------------------------------+ 679 | Ethernet Tag ID (4 octets) | 680 +---------------------------------------+ 681 | MAC Address Length (1 octet) | 682 +---------------------------------------+ 683 | MAC Address (6 octets) | 684 +---------------------------------------+ 685 | IP Address Length (1 octet) | 686 +---------------------------------------+ 687 | IP Address (0, 4, or 16 octets) | 688 +---------------------------------------+ 689 | MPLS Label1 (3 octets) | 690 +---------------------------------------+ 691 | MPLS Label2 (0 or 3 octets) | 692 +---------------------------------------+ 694 NLRI encoding over SRv6 core is similar to [RFC7432] with the 695 following changes: 697 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 698 carries the Function part of the SRv6 SID when the Transposition 699 Scheme of encoding (Section 4) is used and otherwise set to 700 Implicit NULL. 702 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 703 carries the Function part of the SRv6 SID when the Transposition 704 Scheme of encoding (Section 4) is used and otherwise set to 705 Implicit NULL. 707 Service SIDs enclosed in SRv6 L2 Service TLV and optionally in SRv6 708 L3 Service TLV within the BGP Prefix-SID attribute is advertised 709 along with the MAC/IP Advertisement route. 711 Described below are different types of Route Type 2 advertisements. 713 6.2.1. MAC/IP Advertisement route with MAC Only 715 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 716 carries the Function part of the SRv6 SID when the Transposition 717 Scheme of encoding (Section 4) is used and otherwise set to 718 Implicit NULL. 720 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 721 Prefix-SID attribute is advertised along with the route. The 722 behavior of the Service SID thus signaled is entirely up to the 723 originator of the advertisement. In practice, the behavior is 724 END.DX2 or END.DT2U. 726 6.2.2. MAC/IP Advertisement route with MAC+IP 728 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. It 729 carries the Function part of the SRv6 SID when the Transposition 730 Scheme of encoding (Section 4) is used and otherwise set to 731 Implicit NULL. 733 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. It 734 carries the Function part of the SRv6 SID when the Transposition 735 Scheme of encoding (Section 4) is used and otherwise set to 736 Implicit NULL. 738 An L2 Service SID enclosed in a SRv6 L2 Service TLV within the BGP 739 Prefix-SID attribute is advertised along with the route. In 740 addition, an L3 Service SID enclosed in a SRv6 L3 Service TLV within 741 the BGP Prefix-SID attribute MAY also be advertised along with the 742 route. The behavior of the Service SID(s) thus signaled is entirely 743 up to the originator of the advertisement. In practice, the behavior 744 is END.DX2 or END.DT2U for the L2 Service SID, and END.DT6/4 or 745 END.DX6/4 for the L3 Service SID. 747 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core 749 EVPN Route Type 3 is used to advertise multicast traffic reachability 750 information through MP-BGP to all other PEs in a given EVPN instance. 752 As a reminder, EVPN Route Type 3 is encoded as follows: 754 +---------------------------------------+ 755 | RD (8 octets) | 756 +---------------------------------------+ 757 | Ethernet Tag ID (4 octets) | 758 +---------------------------------------+ 759 | IP Address Length (1 octet) | 760 +---------------------------------------+ 761 | Originating Router's IP Address | 762 | (4 or 16 octets) | 763 +---------------------------------------+ 765 NLRI encoding over SRv6 core is similar to [RFC7432]. 767 PMSI Tunnel Attribute [RFC6514] is used to identify the P-tunnel used 768 for sending BUM traffic. The format of PMSI Tunnel Attribute is 769 encoded as follows over SRv6 Core: 771 +---------------------------------------+ 772 | Flag (1 octet) | 773 +---------------------------------------+ 774 | Tunnel Type (1 octet) | 775 +---------------------------------------+ 776 | MPLS label (3 octet) | 777 +---------------------------------------+ 778 | Tunnel Identifier (variable) | 779 +---------------------------------------+ 781 o Flag: zero value defined per [RFC7432] 783 o Tunnel Type: defined per [RFC6514] 785 o MPLS label: It carries the Function part of the SRv6 SID when 786 ingress replication is used and the Transposition Scheme of 787 encoding (Section 4) is used and otherwise it is set as defined in 788 [RFC6514] 790 o Tunnel Identifier: IP address of egress PE 792 A Service SID enclosed in a SRv6 L2 Service TLV within the BGP 793 Prefix-SID attribute is advertised along with the route. The 794 behavior of the Service SID thus signaled, is entirely up to the 795 originator of the advertisement. In practice, the behavior of the 796 SRv6 SID is as follows: 798 o END.DT2M behavior. 800 o When ESI-based filtering is used for Multi-Homing or E-Tree 801 procedures, the ESI Filtering argument (the Arg.FE2 notation 802 introduced in [RFC8986]) of the Service SID carried along with 803 EVPN Route Type 1 route SHOULD be merged together with the 804 applicable End.DT2M SID of Type 3 route advertised by remote PE by 805 doing a bit-wise logical-OR operation to create a single SID on 806 the ingress PE. Details of split-horizon ESI-based filtering 807 mechanisms for multihoming are described in [RFC7432]. Details of 808 filtering mechanisms for Leaf-originated BUM traffic in EVPN 809 E-Tree services are provided in [RFC8317]. 811 o When "local-bias" is used as the Multi-Homing split-horizon 812 method, the ESI Filtering argument SHOULD NOT be merged with the 813 corresponding End.DT2M SID on the ingress PE. Details of the 814 "local-bias" procedures are described in [RFC8365]. 816 The setup of multicast trees for use as P-tunnels is outside the 817 scope of this document. 819 6.4. Ethernet Segment route over SRv6 Core 821 As a reminder, an Ethernet Segment route i.e. EVPN Route Type 4 is 822 encoded as follows: 824 +---------------------------------------+ 825 | RD (8 octets) | 826 +---------------------------------------+ 827 | Ethernet Tag ID (4 octets) | 828 +---------------------------------------+ 829 | IP Address Length (1 octet) | 830 +---------------------------------------+ 831 | Originating Router's IP Address | 832 | (4 or 16 octets) | 833 +---------------------------------------+ 835 NLRI encoding over SRv6 core is similar to [RFC7432]. 837 SRv6 Service TLVs within BGP Prefix-SID attribute are not advertised 838 along with this route. The processing of the route has not changed - 839 it remains as described in [RFC7432]. 841 6.5. IP prefix route over SRv6 Core 843 EVPN Route Type 5 is used to advertise IP address reachability 844 through MP-BGP to all other PEs in a given EVPN instance. IP address 845 may include host IP prefix or any specific subnet. 847 As a reminder, EVPN Route Type 5 is encoded as follows: 849 +---------------------------------------+ 850 | RD (8 octets) | 851 +---------------------------------------+ 852 |Ethernet Segment Identifier (10 octets)| 853 +---------------------------------------+ 854 | Ethernet Tag ID (4 octets) | 855 +---------------------------------------+ 856 | IP Prefix Length (1 octet) | 857 +---------------------------------------+ 858 | IP Prefix (4 or 16 octets) | 859 +---------------------------------------+ 860 | GW IP Address (4 or 16 octets) | 861 +---------------------------------------+ 862 | MPLS Label (3 octets) | 863 +---------------------------------------+ 865 NLRI encoding over SRv6 core is similar to [RFC7432] with the 866 following change: 868 o MPLS Label: carries the Function part of the SRv6 SID when the 869 Transposition Scheme of encoding (Section 4) is used and otherwise 870 set to Implicit NULL. 872 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 873 function of the SRv6 SID is entirely up to the originator of the 874 advertisement. In practice, the behavior is End.DT4/6 or End.DX4/6. 876 6.6. EVPN multicast routes (Route Types 6, 7, 8) over SRv6 core 878 These routes do not require the advertisement of SRv6 Service TLVs 879 along with them. Similar to EVPN Route Type 4, the BGP Nexthop is 880 equal to the IPv6 address of egress PE. 882 7. Implementation Status 884 [Note to RFC Editor : This section needs to be removed before 885 publication as RFC.] 887 The [I-D.matsushima-spring-srv6-deployment-status] describes the 888 current deployment and implementation status of SRv6 which also 889 includes the BGP services over SRv6 as specified in this document. 891 8. Error Handling 893 In case of any errors encountered while processing SRv6 Service TLVs, 894 the details of the error SHOULD be logged for further analysis. 896 If multiple instances of SRv6 L3 Service TLV is encountered, all but 897 the first instance MUST be ignored. 899 If multiple instances of SRv6 L2 Service TLV is encountered, all but 900 the first instance MUST be ignored. 902 An SRv6 Service TLV is considered malformed in the following cases: 904 o the TLV Length is less than 1 906 o the TLV Length is inconsistent with the length of BGP Prefix-SID 907 attribute 909 o at least one of the constituent Sub-TLVs is malformed 911 An SRv6 Service Sub-TLV is considered malformed in the following 912 cases: 914 o the Sub-TLV Length is inconsistent with the length of the 915 enclosing SRv6 Service TLV 917 An SRv6 SID Information Sub-TLV is considered malformed in the 918 following cases: 920 * the Sub-TLV Length is less than 21 922 * the Sub-TLV Length is inconsistent with the length of the 923 enclosing SRv6 Service TLV 925 * at least one of the constituent Sub-Sub-TLVs is malformed 927 An SRv6 Service Data Sub-sub-TLV is considered malformed in the 928 following cases: 930 o the Sub-Sub-TLV Length is inconsistent with the length of the 931 enclosing SRv6 service Sub-TLV 933 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 934 its Type is unrecognized. 936 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 937 of failing any semantic validation of its Value field. 939 SRv6 overlay service requires Service SID for forwarding. The treat- 940 as-withdraw action [RFC7606] MUST be performed when at least one 941 malformed SRV6 Service TLV is present in the BGP Prefix-SID 942 attribute. 944 SRv6 SID value in SRv6 SID Information Sub-TLV is invalid when SID 945 Structure Sub-Sub-TLV transposition length is greater than the number 946 of bits of the label field or addition of transposition offset and 947 length is greater than 128. The transposition offset and length MUST 948 be 0 when the Sub-Sub-TLV is advertised along with routes where 949 transposition scheme is not applicable (e.g., for Global IPv6 Service 950 [RFC2545] where there is no label field). Path having such Prefix- 951 SID Attribute should be ineligible during the selection of best path 952 for the corresponding prefix. 954 9. IANA Considerations 956 9.1. BGP Prefix-SID TLV Types registry 958 This document introduces three new TLV Types of the BGP Prefix-SID 959 attribute. IANA has assigned Type values in the registry "BGP 960 Prefix-SID TLV Types" as follows: 962 Value Type Reference 963 -------------------------------------------- 964 4 Deprecated 965 5 SRv6 L3 Service TLV 966 6 SRv6 L2 Service TLV 968 The value 4 previously corresponded to the SRv6-VPN SID TLV, which 969 was specified in previous versions of this document and used by early 970 implementations of this specification. It was deprecated and 971 replaced by the SRv6 L3 Service and SRv6 L2 Service TLVs. 973 9.2. SRv6 Service Sub-TLV Types registry 975 IANA is requested to create and maintain a new registry called "SRv6 976 Service Sub-TLV Types". The allocation policy for this registry is: 978 0 : Reserved 979 1-127 : IETF Review 980 128-254 : First Come First Served 981 255 : Reserved 983 The following Sub-TLV Type is defined in this document: 985 Value Type Reference 986 ---------------------------------------------------- 987 1 SRv6 SID Information Sub-TLV 989 9.3. SRv6 Service Data Sub-Sub-TLV Types registry 991 IANA is requested to create and maintain a new registry called "SRv6 992 Service Data Sub-Sub-TLV Types". The allocation policy for this 993 registry is: 995 0 : Reserved 996 1-127 : IETF Review 997 128-254 : First Come First Served 998 255 : Reserved 1000 The following Sub-Sub-TLV Type is defined in this document: 1002 Value Type Reference 1003 ---------------------------------------------------- 1004 1 SRv6 SID Structure Sub-Sub-TLV 1006 10. Security Considerations 1008 This document specifies extensions to BGP protocol for signalling of 1009 services for SRv6. As such, techniques related to authentication of 1010 BGP sessions for securing messages between BGP peers as discussed in 1011 the BGP specification [RFC4271] and in the security analysis for BGP 1012 [RFC4272] apply. The discussion of the use of the TCP Authentication 1013 option to protect BGP sessions is found in [RFC5925], while [RFC6952] 1014 includes an analysis of BGP keying and authentication issues. 1016 This document does not introduce new services or BGP NLRI types but 1017 extends the signaling of existing ones for SRv6. Therefore, the 1018 security considerations for the respective BGP services [RFC8950] 1019 [RFC4659] [RFC2545] [RFC7432] 1020 [I-D.ietf-bess-evpn-prefix-advertisement] also apply. 1022 SRv6 operates within a trusted SR domain with filtering of traffic at 1023 the domain boundaries. These and other security aspects of SRv6 are 1024 discussed in the security considerations of [RFC8402] [RFC8754] and 1025 apply for deployment of BGP services using SRv6. The SRv6 SIDs used 1026 for the BGP Services in this document are defined in [RFC8986] and 1027 hence the security considerations of that document also apply. The 1028 service flows between PE routers using SRv6 SIDs advertised via BGP 1029 are expected to be limited within the trusted SR domain (e.g. within 1030 a single AS or between multiple ASes within a single provider 1031 network). Therefore, precaution is necessary to ensure that the BGP 1032 service information (including associated SRv6 SID) advertised via 1033 BGP sessions is limited to peers within this trusted SR domain. 1034 Security consideration section of [RFC8669] discuss mechanisms to 1035 prevent leaking of BGP Prefix-SID attribute, that carries SRv6 SID, 1036 outside the SR domain. In the event that these filtering mechanisms, 1037 both in the forwarding and control plane, are not implemented 1038 properly, it may be possible for nodes outside the SR domain to learn 1039 the VPN Service SIDs and use them to direct traffic into VPN networks 1040 from outside the SR domain. 1042 11. Acknowledgments 1044 The authors of this document would like to thank Stephane Litkowski, 1045 Rishabh Parekh, Xiejingrong, Rajesh M, Mustapha Aissaoui and 1046 Alexander Vainshtein for their comments and review of this document. 1048 12. Contributors 1050 Satoru Matsushima 1051 SoftBank 1053 Email: satoru.matsushima@g.softbank.co.jp 1055 Dirk Steinberg 1056 Steinberg Consulting 1058 Email: dirk@lapishills.com 1060 Daniel Bernier 1061 Bell Canada 1063 Email: daniel.bernier@bell.ca 1065 Daniel Voyer 1066 Bell Canada 1068 Email: daniel.voyer@bell.ca 1070 Jonn Leddy 1071 Individual 1073 Email: john@leddy.net 1075 Swadesh Agrawal 1076 Cisco 1078 Email: swaagraw@cisco.com 1079 Patrice Brissette 1080 Cisco 1082 Email: pbrisset@cisco.com 1084 Ali Sajassi 1085 Cisco 1087 Email: sajassi@cisco.com 1089 Bart Peirens 1090 Proximus 1091 Belgium 1093 Email: bart.peirens@proximus.com 1095 Darren Dukes 1096 Cisco 1098 Email: ddukes@cisco.com 1100 Pablo Camarilo 1101 Cisco 1103 Email: pcamaril@cisco.com 1105 Shyam Sethuram 1106 Cisco 1108 Email: shyam.ioml@gmail.com 1110 Zafar Ali 1111 Cisco 1113 Email: zali@cisco.com 1115 13. References 1117 13.1. Normative References 1119 [I-D.ietf-bess-evpn-igmp-mld-proxy] 1120 Sajassi, A., Thoria, S., Drake, J., and W. Lin, "IGMP and 1121 MLD Proxy for EVPN", draft-ietf-bess-evpn-igmp-mld- 1122 proxy-06 (work in progress), January 2021. 1124 [I-D.ietf-bess-evpn-prefix-advertisement] 1125 Rabadan, J., Henderickx, W., Drake, J., Lin, W., and A. 1126 Sajassi, "IP Prefix Advertisement in EVPN", draft-ietf- 1127 bess-evpn-prefix-advertisement-11 (work in progress), May 1128 2018. 1130 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1131 Requirement Levels", BCP 14, RFC 2119, 1132 DOI 10.17487/RFC2119, March 1997, 1133 . 1135 [RFC2545] Marques, P. and F. Dupont, "Use of BGP-4 Multiprotocol 1136 Extensions for IPv6 Inter-Domain Routing", RFC 2545, 1137 DOI 10.17487/RFC2545, March 1999, 1138 . 1140 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A 1141 Border Gateway Protocol 4 (BGP-4)", RFC 4271, 1142 DOI 10.17487/RFC4271, January 2006, 1143 . 1145 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 1146 Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February 1147 2006, . 1149 [RFC4456] Bates, T., Chen, E., and R. Chandra, "BGP Route 1150 Reflection: An Alternative to Full Mesh Internal BGP 1151 (IBGP)", RFC 4456, DOI 10.17487/RFC4456, April 2006, 1152 . 1154 [RFC4659] De Clercq, J., Ooms, D., Carugi, M., and F. Le Faucheur, 1155 "BGP-MPLS IP Virtual Private Network (VPN) Extension for 1156 IPv6 VPN", RFC 4659, DOI 10.17487/RFC4659, September 2006, 1157 . 1159 [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, 1160 "Multiprotocol Extensions for BGP-4", RFC 4760, 1161 DOI 10.17487/RFC4760, January 2007, 1162 . 1164 [RFC6514] Aggarwal, R., Rosen, E., Morin, T., and Y. Rekhter, "BGP 1165 Encodings and Procedures for Multicast in MPLS/BGP IP 1166 VPNs", RFC 6514, DOI 10.17487/RFC6514, February 2012, 1167 . 1169 [RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A., 1170 Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based 1171 Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February 1172 2015, . 1174 [RFC7606] Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. 1175 Patel, "Revised Error Handling for BGP UPDATE Messages", 1176 RFC 7606, DOI 10.17487/RFC7606, August 2015, 1177 . 1179 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1180 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1181 May 2017, . 1183 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 1184 (IPv6) Specification", STD 86, RFC 8200, 1185 DOI 10.17487/RFC8200, July 2017, 1186 . 1188 [RFC8214] Boutros, S., Sajassi, A., Salam, S., Drake, J., and J. 1189 Rabadan, "Virtual Private Wire Service Support in Ethernet 1190 VPN", RFC 8214, DOI 10.17487/RFC8214, August 2017, 1191 . 1193 [RFC8277] Rosen, E., "Using BGP to Bind MPLS Labels to Address 1194 Prefixes", RFC 8277, DOI 10.17487/RFC8277, October 2017, 1195 . 1197 [RFC8317] Sajassi, A., Ed., Salam, S., Drake, J., Uttaro, J., 1198 Boutros, S., and J. Rabadan, "Ethernet-Tree (E-Tree) 1199 Support in Ethernet VPN (EVPN) and Provider Backbone 1200 Bridging EVPN (PBB-EVPN)", RFC 8317, DOI 10.17487/RFC8317, 1201 January 2018, . 1203 [RFC8365] Sajassi, A., Ed., Drake, J., Ed., Bitar, N., Shekhar, R., 1204 Uttaro, J., and W. Henderickx, "A Network Virtualization 1205 Overlay Solution Using Ethernet VPN (EVPN)", RFC 8365, 1206 DOI 10.17487/RFC8365, March 2018, 1207 . 1209 [RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., 1210 Decraene, B., Litkowski, S., and R. Shakir, "Segment 1211 Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, 1212 July 2018, . 1214 [RFC8669] Previdi, S., Filsfils, C., Lindem, A., Ed., Sreekantiah, 1215 A., and H. Gredler, "Segment Routing Prefix Segment 1216 Identifier Extensions for BGP", RFC 8669, 1217 DOI 10.17487/RFC8669, December 2019, 1218 . 1220 [RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., 1221 Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header 1222 (SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020, 1223 . 1225 [RFC8950] Litkowski, S., Agrawal, S., Ananthamurthy, K., and K. 1226 Patel, "Advertising IPv4 Network Layer Reachability 1227 Information (NLRI) with an IPv6 Next Hop", RFC 8950, 1228 DOI 10.17487/RFC8950, November 2020, 1229 . 1231 [RFC8986] Filsfils, C., Ed., Camarillo, P., Ed., Leddy, J., Voyer, 1232 D., Matsushima, S., and Z. Li, "Segment Routing over IPv6 1233 (SRv6) Network Programming", RFC 8986, 1234 DOI 10.17487/RFC8986, February 2021, 1235 . 1237 13.2. Informative References 1239 [I-D.ietf-idr-segment-routing-te-policy] 1240 Previdi, S., Filsfils, C., Talaulikar, K., Mattes, P., 1241 Rosen, E., Jain, D., and S. Lin, "Advertising Segment 1242 Routing Policies in BGP", draft-ietf-idr-segment-routing- 1243 te-policy-11 (work in progress), November 2020. 1245 [I-D.ietf-spring-segment-routing-policy] 1246 Filsfils, C., Talaulikar, K., Voyer, D., Bogdanov, A., and 1247 P. Mattes, "Segment Routing Policy Architecture", draft- 1248 ietf-spring-segment-routing-policy-09 (work in progress), 1249 November 2020. 1251 [I-D.matsushima-spring-srv6-deployment-status] 1252 Matsushima, S., Filsfils, C., Ali, Z., Li, Z., and K. 1253 Rajaraman, "SRv6 Implementation and Deployment Status", 1254 draft-matsushima-spring-srv6-deployment-status-10 (work in 1255 progress), December 2020. 1257 [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis", 1258 RFC 4272, DOI 10.17487/RFC4272, January 2006, 1259 . 1261 [RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP 1262 Authentication Option", RFC 5925, DOI 10.17487/RFC5925, 1263 June 2010, . 1265 [RFC6513] Rosen, E., Ed. and R. Aggarwal, Ed., "Multicast in MPLS/ 1266 BGP IP VPNs", RFC 6513, DOI 10.17487/RFC6513, February 1267 2012, . 1269 [RFC6952] Jethanandani, M., Patel, K., and L. Zheng, "Analysis of 1270 BGP, LDP, PCEP, and MSDP Issues According to the Keying 1271 and Authentication for Routing Protocols (KARP) Design 1272 Guide", RFC 6952, DOI 10.17487/RFC6952, May 2013, 1273 . 1275 Authors' Addresses 1277 Gaurav Dawra (editor) 1278 LinkedIn 1279 USA 1281 Email: gdawra.ietf@gmail.com 1283 Clarence Filsfils 1284 Cisco Systems 1285 Belgium 1287 Email: cfilsfil@cisco.com 1289 Ketan Talaulikar (editor) 1290 Cisco Systems 1291 India 1293 Email: ketant@cisco.com 1295 Robert Raszuk 1296 Bloomberg LP 1297 USA 1299 Email: robert@raszuk.net 1300 Bruno Decraene 1301 Orange 1302 France 1304 Email: bruno.decraene@orange.com 1306 Shunwan Zhuang 1307 Huawei Technologies 1308 China 1310 Email: zhuangshunwan@huawei.com 1312 Jorge Rabadan 1313 Nokia 1314 USA 1316 Email: jorge.rabadan@nokia.com