idnits 2.17.1 draft-ietf-bess-srv6-services-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (April 11, 2021) is 1112 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-21) exists of draft-ietf-bess-evpn-igmp-mld-proxy-06 == Outdated reference: A later version (-26) exists of draft-ietf-idr-segment-routing-te-policy-11 == Outdated reference: A later version (-22) exists of draft-ietf-spring-segment-routing-policy-09 == Outdated reference: A later version (-15) exists of draft-matsushima-spring-srv6-deployment-status-10 Summary: 0 errors (**), 0 flaws (~~), 5 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS Working Group G. Dawra, Ed. 3 Internet-Draft LinkedIn 4 Intended status: Standards Track C. Filsfils 5 Expires: October 13, 2021 K. Talaulikar, Ed. 6 Cisco Systems 7 R. Raszuk 8 Bloomberg LP 9 B. Decraene 10 Orange 11 S. Zhuang 12 Huawei Technologies 13 J. Rabadan 14 Nokia 15 April 11, 2021 17 SRv6 BGP based Overlay Services 18 draft-ietf-bess-srv6-services-07 20 Abstract 22 This draft defines procedures and messages for SRv6-based BGP 23 services including L3VPN, EVPN, and Internet services. It builds on 24 RFC4364 "BGP/MPLS IP Virtual Private Networks (VPNs)" and RFC7432 25 "BGP MPLS-Based Ethernet VPN". 27 Status of This Memo 29 This Internet-Draft is submitted in full conformance with the 30 provisions of BCP 78 and BCP 79. 32 Internet-Drafts are working documents of the Internet Engineering 33 Task Force (IETF). Note that other groups may also distribute 34 working documents as Internet-Drafts. The list of current Internet- 35 Drafts is at https://datatracker.ietf.org/drafts/current/. 37 Internet-Drafts are draft documents valid for a maximum of six months 38 and may be updated, replaced, or obsoleted by other documents at any 39 time. It is inappropriate to use Internet-Drafts as reference 40 material or to cite them other than as "work in progress." 42 This Internet-Draft will expire on October 13, 2021. 44 Copyright Notice 46 Copyright (c) 2021 IETF Trust and the persons identified as the 47 document authors. All rights reserved. 49 This document is subject to BCP 78 and the IETF Trust's Legal 50 Provisions Relating to IETF Documents 51 (https://trustee.ietf.org/license-info) in effect on the date of 52 publication of this document. Please review these documents 53 carefully, as they describe your rights and restrictions with respect 54 to this document. Code Components extracted from this document must 55 include Simplified BSD License text as described in Section 4.e of 56 the Trust Legal Provisions and are provided without warranty as 57 described in the Simplified BSD License. 59 Table of Contents 61 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 62 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 63 2. SRv6 Services TLVs . . . . . . . . . . . . . . . . . . . . . 4 64 3. SRv6 Service Sub-TLVs . . . . . . . . . . . . . . . . . . . . 5 65 3.1. SRv6 SID Information Sub-TLV . . . . . . . . . . . . . . 6 66 3.2. SRv6 Service Data Sub-Sub-TLVs . . . . . . . . . . . . . 7 67 3.2.1. SRv6 SID Structure Sub-Sub-TLV . . . . . . . . . . . 7 68 4. Encoding SRv6 SID Information . . . . . . . . . . . . . . . . 9 69 5. BGP based L3 Service over SRv6 . . . . . . . . . . . . . . . 10 70 5.1. IPv4 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 11 71 5.2. IPv6 VPN Over SRv6 Core . . . . . . . . . . . . . . . . . 12 72 5.3. Global IPv4 over SRv6 Core . . . . . . . . . . . . . . . 12 73 5.4. Global IPv6 over SRv6 Core . . . . . . . . . . . . . . . 12 74 6. BGP based Ethernet VPN (EVPN) over SRv6 . . . . . . . . . . . 13 75 6.1. Ethernet Auto-discovery Route over SRv6 Core . . . . . . 14 76 6.1.1. Ethernet A-D per ES Route . . . . . . . . . . . . . . 14 77 6.1.2. Ethernet A-D per EVI Route . . . . . . . . . . . . . 15 78 6.2. MAC/IP Advertisement Route over SRv6 Core . . . . . . . . 15 79 6.2.1. MAC/IP Advertisement Route with MAC Only . . . . . . 17 80 6.2.2. MAC/IP Advertisement Route with MAC+IP . . . . . . . 17 81 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core . . 17 82 6.4. Ethernet Segment Route over SRv6 Core . . . . . . . . . . 19 83 6.5. IP Prefix Route over SRv6 Core . . . . . . . . . . . . . 20 84 6.6. EVPN Multicast Routes (Route Types 6, 7, 8) over SRv6 85 Core . . . . . . . . . . . . . . . . . . . . . . . . . . 20 86 7. Implementation Status . . . . . . . . . . . . . . . . . . . . 21 87 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 21 88 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 89 9.1. BGP Prefix-SID TLV Types Registry . . . . . . . . . . . . 22 90 9.2. SRv6 Service Sub-TLV Types Registry . . . . . . . . . . . 23 91 9.3. SRv6 Service Data Sub-Sub-TLV Types Registry . . . . . . 23 92 10. Security Considerations . . . . . . . . . . . . . . . . . . . 23 93 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 24 94 12. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 24 95 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 26 96 13.1. Normative References . . . . . . . . . . . . . . . . . . 26 97 13.2. Informative References . . . . . . . . . . . . . . . . . 28 98 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 29 100 1. Introduction 102 SRv6 refers to Segment Routing instantiated on the IPv6 dataplane 103 [RFC8402]. 105 SRv6 based BGP services refers to the Layer-3 and Layer-2 overlay 106 services with BGP as control plane and SRv6 as dataplane. 108 SRv6 SID refers to an SRv6 Segment Identifier as defined in 109 [RFC8402]. 111 SRv6 Service SID refers to an SRv6 SID associated with one of the 112 service-specific SRv6 Endpoint behaviors on the advertising Provider 113 Edge (PE) router, such as (but not limited to), END.DT (Table lookup 114 in a VRF) or END.DX (cross-connect to a nexthop) behaviors in the 115 case of Layer-3 Virtual Private Network (L3VPN) service as defined in 116 [RFC8986]. 118 To provide SRv6 service with best-effort connectivity, the egress PE 119 signals an SRv6 Service SID with the BGP overlay service route. The 120 ingress PE encapsulates the payload in an outer IPv6 header where the 121 destination address is the SRv6 Service SID provided by the egress 122 Provider Edge (PE). The underlay between the PEs only need to 123 support plain IPv6 forwarding [RFC8200]. 125 To provide SRv6 service in conjunction with an underlay SLA from the 126 ingress PE to the egress PE, the egress PE colors the overlay service 127 route with a Color Extended Community 128 [I-D.ietf-idr-segment-routing-te-policy] for steering of flows for 129 those routes as specified in section 8 of 130 [I-D.ietf-spring-segment-routing-policy]. The ingress PE 131 encapsulates the payload packet in an outer IPv6 header with the 132 segment list of SR policy associated with the related SLA along with 133 the SRv6 Service SID associated with the route using the Segment 134 Routing Header (SRH) [RFC8754]. The underlay nodes whose SRv6 SID's 135 are part of the SRH segment list MUST support SRv6 data plane. 137 BGP is used to advertise the reachability of prefixes of a particular 138 service from an egress PE to ingress PE nodes. 140 This document describes how existing BGP messages between PEs may 141 carry SRv6 Service SIDs to interconnect PEs and form VPNs. 143 1.1. Requirements Language 145 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 146 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 147 "OPTIONAL" in this document are to be interpreted as described in BCP 148 14 [RFC2119] [RFC8174] when, and only when, they appear in all 149 capitals, as shown here. 151 2. SRv6 Services TLVs 153 This document extends the use of the BGP Prefix-SID attribute 154 [RFC8669] to carry SRv6 SIDs and their associated information with 155 the BGP address-families that are listed further in this section. 157 The SRv6 Service TLVs are defined as two new TLVs of the BGP Prefix- 158 SID Attribute to achieve signaling of SRv6 SIDs for L3 and L2 159 services. 161 o SRv6 L3 Service TLV: This TLV encodes Service SID information for 162 SRv6 based L3 services. It corresponds to the equivalent 163 functionality provided by an MPLS Label when received with a Layer 164 3 service route as defined in [RFC4364] [RFC4659] [RFC8950] 165 [I-D.ietf-bess-evpn-prefix-advertisement]. Some SRv6 Endpoint 166 behaviors which MAY be encoded, but not limited to, are End.DX4, 167 End.DT4, End.DX6, End.DT6, etc. 169 o SRv6 L2 Service TLV: This TLV encodes Service SID information for 170 SRv6 based L2 services. It corresponds to the equivalent 171 functionality provided by an MPLS Label1 for Ethernet VPN (EVPN) 172 Route-Types as defined in [RFC7432]. Some SRv6 Endpoint behaviors 173 which MAY be encoded, but not limited to, are End.DX2, End.DX2V, 174 End.DT2U, End.DT2M etc. 176 When an egress PE is enabled for BGP Services over SRv6 data-plane, 177 it MUST signal one or more SRv6 Service SIDs enclosed in SRv6 Service 178 TLV(s) within the BGP Prefix-SID Attribute attached to MP-BGP NLRIs 179 defined in [RFC4760] [RFC4659] [RFC8950] [RFC7432] [RFC4364] 180 [I-D.ietf-bess-evpn-prefix-advertisement] where applicable as 181 described in Section 5 and Section 6. 183 The support for BGP Multicast VPN (MVPN) Services [RFC6513] with SRv6 184 is outside the scope of this document. 186 The following depicts the SRv6 Service TLVs encoded in the BGP 187 Prefix-SID Attribute: 189 0 1 2 3 190 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 191 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 192 | TLV Type | TLV Length | RESERVED | 193 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 194 // SRv6 Service Sub-TLVs // 195 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 197 o TLV Type (1 octet): This field is assigned values from the IANA 198 registry "BGP Prefix-SID TLV Types". It is set to 5 for SRv6 L3 199 Service TLV. It is set to 6 for SRv6 L2 Service TLV. 201 o TLV Length (2 octets): Specifies the total length of the TLV 202 Value. 204 o RESERVED (1 octet): This field is reserved; it SHOULD be set to 0 205 by the sender and MUST be ignored by the receiver. 207 o SRv6 Service Sub-TLVs (variable): This field contains SRv6 Service 208 related information and is encoded as an unordered list of Sub- 209 TLVs whose format is described below. 211 A BGP speaker receiving a route containing BGP Prefix-SID Attribute 212 with one or more SRv6 Service TLVs observes the following rules when 213 advertising the received route to other peers: 215 o if the nexthop is unchanged during the advertisement, the SRv6 216 Service TLVs, including any unrecognized Types of Sub-TLV and Sub- 217 Sub-TLV, SHOULD be propagated further. In addition, all Reserved 218 fields in the TLV or Sub-TLV or Sub-Sub-TLV MUST be propagated 219 unchanged. 221 o if the nexthop is changed, the TLVs, Sub-TLVs, and Sub-Sub-TLVs 222 SHOULD be updated as appropriate. Any unrecognized received sub- 223 TLVs and Sub-Sub-TLVs MUST be removed. 225 3. SRv6 Service Sub-TLVs 227 The format of a single SRv6 Service Sub-TLV is depicted below: 229 0 1 2 3 230 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 231 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 232 | SRv6 Service | SRv6 Service | SRv6 Service // 233 | Sub-TLV | Sub-TLV | Sub-TLV // 234 | Type | Length | value // 235 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 237 o SRv6 Service Sub-TLV Type (1 octet): Identifies the type of SRv6 238 service information. It is assigned values from the IANA Registry 239 "SRv6 Service Sub-TLV Types". 241 o SRv6 Service Sub-TLV Length (2 octets): Specifies the total length 242 of the Sub-TLV Value field. 244 o SRv6 Service Sub-TLV Value (variable): Contains data specific to 245 the Sub-TLV Type. In addition to fixed-length data, it contains 246 other properties of the SRv6 Service encoded as a set of SRv6 247 Service Data Sub-Sub-TLVs whose format is described in Section 3.2 248 below. 250 3.1. SRv6 SID Information Sub-TLV 252 SRv6 Service Sub-TLV Type 1 is assigned for SRv6 SID Information Sub- 253 TLV. This Sub-TLV contains a single SRv6 SID along with its 254 properties. Its encoding is depicted below: 256 0 1 2 3 257 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 258 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 259 | SRv6 Service | SRv6 Service | | 260 | Sub-TLV | Sub-TLV | | 261 | Type=1 | Length | RESERVED1 | 262 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 263 // SRv6 SID Value (16 bytes) // 264 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 265 | SRv6 SID Flags| SRv6 Endpoint Behavior | RESERVED2 | 266 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 267 // SRv6 Service Data Sub-Sub-TLVs // 268 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 270 o SRv6 Service Sub-TLV Type (1 octet): This field is set to 1 to 271 represent SRv6 SID Information Sub-TLV. 273 o SRv6 Service Sub-TLV Length (2 octets): This field contains the 274 total length of the Value field of the Sub-TLV. 276 o RESERVED1 (1 octet): SHOULD be set to 0 by the sender and MUST be 277 ignored by the receiver. 279 o SRv6 SID Value (16 octets): Encodes an SRv6 SID as defined in 280 [RFC8986] 282 o SRv6 SID Flags (1 octet): Encodes SRv6 SID Flags - none are 283 currently defined. SHOULD be set to 0 by the sender and MUST be 284 ignored by the receiver. 286 o SRv6 Endpoint Behavior (2 octets): Encodes SRv6 Endpoint behavior 287 codepoint value from the IANA registry defined in section 9.2 of 288 [RFC8986] that is associated with SRv6 SID. The opaque endpoint 289 behavior (i.e., value 0xFFFF) or an unrecognized endpoint behavior 290 MUST NOT be considered as invalid by the receiver. 292 o RESERVED2 (1 octet): SHOULD be set to 0 by the sender and MUST be 293 ignored by the receiver. 295 o SRv6 Service Data Sub-Sub-TLV Value (variable): Used to advertise 296 properties of the SRv6 SID. It is encoded as a set of SRv6 297 Service Data Sub-Sub-TLVs. 299 When multiple SRv6 SID Information Sub-TLVs are present, the ingress 300 PE SHOULD use the SRv6 SID from the first instance of the Sub-TLV. 301 An implementation MAY provide a local policy to override this 302 selection. 304 3.2. SRv6 Service Data Sub-Sub-TLVs 306 The format of the SRv6 Service Data Sub-Sub-TLV is depicted below: 308 0 1 2 3 309 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 310 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 311 | Service Data | Sub-Sub-TLV Length |Sub-Sub TLV // 312 | Sub-Sub-TLV | | Value // 313 | Type | | // 314 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 316 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): Identifies the type 317 of Sub-Sub-TLV. It is assigned values from the IANA Registry 318 "SRv6 Service Data Sub-Sub-TLVs". 320 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): Specifies the 321 total length of the Sub-Sub-TLV Value field. 323 o SRv6 Service Data Sub-Sub-TLV Value (variable): Contains data 324 specific to the Sub-Sub-TLV Type. 326 3.2.1. SRv6 SID Structure Sub-Sub-TLV 328 SRv6 Service Data Sub-Sub-TLV Type 1 is assigned for SRv6 SID 329 structure Sub-Sub-TLV. SRv6 SID Structure Sub-Sub-TLV is used to 330 advertise the lengths of the individual parts of the SRv6 SID as 331 defined in [RFC8986]. It is carried as Sub-Sub-TLV in SRv6 SID 332 Information Sub-TLV 333 0 1 2 3 334 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 335 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 336 | SRv6 Service | SRv6 Service | Locator Block | 337 | Data Sub-Sub | Data Sub-Sub-TLV | Length | 338 | -TLV Type=1 | Length=6 | | 339 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 340 | Locator Node | Function | Argument | Transposition | 341 | Length | Length | Length | Length | 342 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 343 | Transposition | 344 | Offset | 345 +-+-+-+-+-+-+-+-+ 347 o SRv6 Service Data Sub-Sub-TLV Type (1 octet): This field is set to 348 1 to represent SRv6 SID Structure Sub-Sub-TLV. 350 o SRv6 Service Data Sub-Sub-TLV Length (2 octets): This field 351 contains a total length of 6 bytes. 353 o Locator Block Length (1 octet): Contains the length of SRv6 SID 354 Locator Block in bits. 356 o Locator Node Length (1 octet): Contains the length of SRv6 SID 357 Locator Node in bits. 359 o Function Length (1 octet): Contains the length of SRv6 SID 360 Function in bits. 362 o Argument Length (1 octet): Contains the length of SRv6 SID 363 Argument in bits. 365 o Transposition Length (1 octet): Size in bits for the part of SID 366 that has been transposed (or shifted) into a label field 368 o Transposition Offset (1 octet): The offset position in bits for 369 the part of SID that has been transposed (or shifted) into a label 370 field. 372 Section 4 describes mechanisms for signaling of the SRv6 Service SID 373 by transposing a variable part of the SRv6 SID value and carrying 374 them in existing label fields to achieve more efficient packing of 375 those service prefix NLRIs in BGP update messages. The SRv6 SID 376 Structure Sub-Sub-TLV contains appropriate length fields when the 377 SRv6 Service SID is signaled in split parts to enable the receiver to 378 put together the SID accurately. 380 Transposition Offset indicates the bit position and Transposition 381 Length indicates the number of bits that are being taken out of the 382 SRv6 SID value and put into high order bits of label field. The bits 383 that have been shifted out MUST be set to 0 in the SID value. 385 Transposition Length of 0 indicates nothing is transposed and that 386 the entire SRv6 SID value is encoded in the SID Information sub-TLV. 387 In this case, the Transposition Offset MUST be set to 0. 389 The size of the label field limits the bits transposed from the SRv6 390 SID value into it. E.g., the size of label field in [RFC4364] 391 [RFC8277] is 20 bits while in [RFC7432] is 24 bits. 393 As an example, consider that the sum of the Locator Block and the 394 Locator Node parts is 64. For an SRv6 SID where the entire Function 395 part of size 16 bits is transposed, then the transposition offset is 396 set to 64 and the transposition length is set to 16. While for an 397 SRv6 SID where the Function length is 24 bits and only the lower 398 order 20 bits are transposed (e.g. due to limit of the label field 399 size), then the transposition offset is set to 68 and the 400 transposition length is set to 20. 402 BGP speakers that do not support this specification may misinterpret, 403 on the reception of an SRv6-based BGP service route update, the part 404 of the SRv6 SID encoded in label field(s) as MPLS label values for 405 MPLS-based services. Implementations supporting this specification 406 SHOULD provide a mechanism to control advertisement of SRv6-based BGP 407 service routes on a per neighbor and per service basis. The details 408 of deployment designs and implementation options are outside the 409 scope of this document. 411 Arguments MAY be generally applicable for SIDs of only specific SRv6 412 Endpoint behaviors (e.g., End.DT2M) and therefore the Argument length 413 MUST be set to 0 for SIDs where the Argument is not applicable. 415 4. Encoding SRv6 SID Information 417 The SRv6 Service SID(s) for a BGP Service Prefix are carried in the 418 SRv6 Services TLVs of the BGP Prefix-SID Attribute. 420 For certain types of BGP Services like L3VPN where a per-VRF SID 421 allocation is used (i.e., End.DT4 or End.DT6 behaviors), the same SID 422 is shared across multiple NLRIs thus providing efficient packing. 423 However, for certain other types of BGP Services like EVPN VPWS where 424 a per-PW SID allocation is required (i.e., End.DX2 behavior), each 425 NLRI would have its own unique SID thereby resulting in inefficient 426 packing. 428 To achieve efficient packing, this document allows the encoding of 429 the SRv6 Service SID either as a whole in the SRv6 Services TLVs or 430 the encoding of only the common part of the SRv6 SID (e.g., Locator) 431 in the SRv6 Services TLVs and encoding the variable (e.g., Function 432 or Argument parts) in the existing label fields specific to that 433 service encoding. This later form of encoding is referred to as the 434 Transposition Scheme where the SRv6 SID Structure Sub-Sub-TLV 435 describes the sizes of the parts of the SRv6 SID and also indicates 436 the offset of the variable part along with its length in SRv6 SID 437 value. The use of the Transposition Scheme is RECOMMENDED for the 438 specific service encodings that allow it as described further in 439 Section 5 and Section 6. 441 As an example, for the EVPN VPWS service prefix described further in 442 Section 6.1.2, the Function part of the SRv6 SID is encoded in the 443 MPLS Label field of the NLRI and the SID value in the SRv6 Services 444 TLV carries only the Locator part with the SRv6 SID Structure Sub- 445 Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines the lengths of 446 Locator Block, Locator Node, and Function parts (Arguments are not 447 applicable for the End.DX2 behavior). Transposition Offset indicates 448 the bit position and Transposition Length indicates the number of 449 bits that are being taken out of the SID and put into the label 450 field. 452 In yet another example, for the EVPN Ethernet A-D per Ethernet 453 Segment (ES) route described further in Section 6.1.1, only the 454 Argument of the SID needs to be signaled. This Argument part of the 455 SRv6 SID MAY be transposed in the Ethernet Segment Identifier (ESI) 456 Label field of the ESI Label Extended Community and the SID value in 457 the SRv6 Services TLV is set to 0 with the SRv6 SID Structure Sub- 458 Sub-TLV. The SRv6 SID Structure sub-sub-TLV defines the lengths of 459 Locator Block, Locator Node, Function and Argument parts. The offset 460 and length of Argument part SID value moved to label field is set in 461 transposition offset and length of SID structure TLV. The receiving 462 router is then able to put together the entire SRv6 Service SID 463 (e.g., for the End.DT2M behavior) placing the label value received in 464 the ESI Label field of the Ethernet A-D per ES route into the correct 465 transposition offset and length in the SRv6 SID with the End.DT2M 466 behavior received for an EVPN Route Type 3 value. 468 5. BGP based L3 Service over SRv6 470 BGP egress nodes (egress PEs) advertise a set of reachable prefixes. 471 Standard BGP update propagation schemes[RFC4271], which may make use 472 of route reflectors [RFC4456], are used to propagate these prefixes. 473 BGP ingress nodes (ingress PEs) receive these advertisements and may 474 add the prefix to the RIB in an appropriate VRF. 476 Egress PEs which supports SRv6 based L3 services advertises overlay 477 service prefixes along with a Service SID enclosed in an SRv6 L3 478 Service TLV within the BGP Prefix-SID Attribute. This TLV serves two 479 purposes - first, it indicates that the egress PE supports SRv6 480 overlay and the BGP ingress PE receiving this route MUST choose to 481 perform IPv6 encapsulation and optionally insert an SRH [RFC8754] 482 when required; second, it indicates the value of the Service SID to 483 be used in the encapsulation. 485 The Service SID thus signaled only has local significance at the 486 egress PE, where it may be allocated or configured on a per-CE or 487 per-VRF basis. In practice, the SID may encode a cross-connect to a 488 specific Address Family table (END.DT) or next-hop/interface (END.DX) 489 as defined in [RFC8986]. 491 The SRv6 Service SID SHOULD be routable within the AS of the egress 492 PE and serves the dual purpose of providing reachability between 493 ingress PE and egress PE while also encoding the SRv6 Endpoint 494 behavior. 496 When providing best-effort connectivity to the egress PE, the ingress 497 PE encapsulates the payload in an outer IPv6 header where the 498 destination address is the SRv6 Service SID associated with the 499 related BGP route update. Therefore, the ingress PE SHOULD perform 500 resolvability check for the SRv6 Service SID before considering the 501 received prefix for the BGP best path computation. 503 For service over SRv6 core, the egress PE sets the next-hop to one of 504 its IPv6 addresses. Such an address MAY be covered by the SRv6 505 Locator from which the SRv6 Service SID is allocated. The next-hop 506 is used for tracking the reachability of the egress PE based on 507 existing BGP procedures. 509 When the BGP route received at an ingress PE is colored with an 510 extended color community and is being steered over a valid SRv6 511 Policy associated with SID list as described in 512 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 513 effective SR Policy is . 515 Multiple routes MAY resolve recursively via the same SR Policy. 517 5.1. IPv4 VPN Over SRv6 Core 519 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 VPN 520 Over IPv6 Core defined in [RFC8950]. 522 Label field of IPv4-VPN NLRI is encoded as specified in [RFC8277] 523 with the 20-bit Label Value set to the whole or a portion of the 524 Function part of the SRv6 SID when the Transposition Scheme of 525 encoding (Section 4) is used and otherwise set to Implicit NULL. 526 When using the Transposition Scheme, the Transposition Length MUST be 527 less than or equal to 20 and less than or equal to the Function 528 Length. 530 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 531 SRv6 Endpoint behavior of the SRv6 SID is entirely up to the 532 originator of the advertisement. In practice, the SRv6 Endpoint 533 behavior is End.DX4 or End.DT4. 535 5.2. IPv6 VPN Over SRv6 Core 537 The MP_REACH_NLRI over SRv6 core is encoded according to IPv6 VPN 538 over IPv6 Core is defined in [RFC4659]. 540 Label field of the IPv6-VPN NLRI is encoded as specified in [RFC8277] 541 with the 20-bit Label Value set to the whole or a portion of the 542 Function part of the SRv6 SID when the Transposition Scheme of 543 encoding (Section 4) is used and otherwise set to Implicit NULL. 544 When using the Transposition Scheme, the Transposition Length MUST be 545 less than or equal to 20 and less than or equal to the Function 546 Length. 548 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 549 SRv6 Endpoint behavior of the SRv6 SID is entirely up to the 550 originator of the advertisement. In practice, the SRv6 Endpoint 551 behavior is End.DX6 or End.DT6. 553 5.3. Global IPv4 over SRv6 Core 555 The MP_REACH_NLRI over SRv6 core is encoded according to IPv4 over 556 IPv6 Core is defined in [RFC8950]. 558 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 559 SRv6 Endpoint behavior of the SRv6 SID is entirely up to the 560 originator of the advertisement. In practice, the SRv6 Endpoint 561 behavior is End.DX4 or End.DT4. 563 5.4. Global IPv6 over SRv6 Core 565 The MP_REACH_NLRI over SRv6 core is encoded according to [RFC2545] 567 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 568 SRv6 Endpoint behavior of the SRv6 SID is entirely up to the 569 originator of the advertisement. In practice, the SRv6 Endpoint 570 behavior is End.DX6 or End.DT6. 572 6. BGP based Ethernet VPN (EVPN) over SRv6 574 [RFC7432] provides an extendable method of building an Ethernet VPN 575 (EVPN) overlay. It primarily focuses on MPLS based EVPNs and 576 [RFC8365] extends to IP-based EVPN overlays. [RFC7432] defines Route 577 Types 1, 2, and 3 which carry prefixes and MPLS Label fields; the 578 Label fields have a specific use for MPLS encapsulation of EVPN 579 traffic. Route Type 5 carrying MPLS label information (and thus 580 encapsulation information) for EVPN is defined in 581 [I-D.ietf-bess-evpn-prefix-advertisement]. Route Types 6,7 and 8 are 582 defined in [I-D.ietf-bess-evpn-igmp-mld-proxy]. 584 o Ethernet Auto-discovery Route (Route Type 1) 586 o MAC/IP Advertisement Route (Route Type 2) 588 o Inclusive Multicast Ethernet Tag Route (Route Type 3) 590 o Ethernet Segment route (Route Type 4) 592 o IP prefix route (Route Type 5) 594 o Selective Multicast Ethernet Tag route (Route Type 6) 596 o IGMP join sync route (Route Type 7) 598 o IGMP leave sync route (Route Type 8) 600 To support SRv6 based EVPN overlays, one or more SRv6 Service SIDs 601 are advertised with Route Type 1,2,3 and 5. The SRv6 Service SID(s) 602 per Route Type are advertised in SRv6 L3/L2 Service TLVs within the 603 BGP Prefix-SID Attribute. Signaling of SRv6 Service SID(s) serves 604 two purposes - first, it indicates that the BGP egress device 605 supports SRv6 overlay and the BGP ingress device receiving this route 606 MUST perform IPv6 encapsulation and optionally insert an SRH 607 [RFC8754] when required; second, it indicates the value of the 608 Service SID(s) to be used in the encapsulation. 610 The SRv6 Service SID SHOULD be routable within the AS of the egress 611 PE and serves the dual purpose of providing reachability between 612 ingress PE and egress PE while also encoding the SRv6 Endpoint 613 behavior. 615 When providing best-effort connectivity to the egress PE, the ingress 616 PE encapsulates the payload in an outer IPv6 header where the 617 destination address is the SRv6 Service SID associated with the 618 related BGP route update. Therefore, the ingress PE SHOULD perform 619 resolvability check for the SRv6 Service SID before considering the 620 received prefix for the BGP best path computation. 622 For service over SRv6 core, the egress PE sets the next-hop to one of 623 its IPv6 addresses. Such an address MAY be covered by the SRv6 624 Locator from which the SRv6 Service SID is allocated. The next-hop 625 is used for tracking the reachability of the egress PE based on 626 existing BGP procedures. 628 When the BGP route received at an ingress PE is colored with an 629 extended color community and is being steered over a valid SRv6 630 Policy associated with SID list as described in 631 Section 8 of [I-D.ietf-spring-segment-routing-policy], then the 632 effective SR Policy is . 634 6.1. Ethernet Auto-discovery Route over SRv6 Core 636 Ethernet Auto-Discovery (A-D) routes are Route Type 1 defined in 637 [RFC7432] and may be used to achieve split-horizon filtering, fast 638 convergence, and aliasing. EVPN Route Type 1 is also used in EVPN- 639 VPWS as well as in EVPN flexible cross-connect; mainly used to 640 advertise point-to-point services ID. 642 As a reminder, EVPN Route Type 1 is encoded as follows: 644 +---------------------------------------+ 645 | RD (8 octets) | 646 +---------------------------------------+ 647 |Ethernet Segment Identifier (10 octets)| 648 +---------------------------------------+ 649 | Ethernet Tag ID (4 octets) | 650 +---------------------------------------+ 651 | MPLS label (3 octets) | 652 +---------------------------------------+ 654 6.1.1. Ethernet A-D per ES Route 656 Ethernet A-D per ES route NLRI encoding over SRv6 core is as per 657 [RFC7432]. 659 The 24-bit ESI label field of the ESI label extended community 660 carries the whole or a portion of the Argument part of the SRv6 SID 661 when ESI filtering approach is used along with the Transposition 662 Scheme of encoding (Section 4) and otherwise set to Implicit NULL 663 value in the high order 20 bits (i.e., 0x000030). When using the 664 Transposition Scheme, the Transposition Length MUST be less than or 665 equal to 24 and less than or equal to the Argument Length. 667 A Service SID enclosed in an SRv6 L2 Service TLV within the BGP 668 Prefix-SID attribute is advertised along with the A-D route. The 669 SRv6 Endpoint behavior of the Service SID thus signaled is entirely 670 up to the originator of the advertisement. When ESI filtering 671 approach is used, the Service SID is used to signal Arg.FE2 SID 672 Argument for applicable End.DT2M SIDs [RFC8986]. When the local-bias 673 approach is used, the Service SID MAY be of value 0. 675 6.1.2. Ethernet A-D per EVI Route 677 Ethernet A-D per EVI route NLRI encoding over SRv6 core is similar to 678 [RFC7432] and [RFC8214] with the following change: 680 o MPLS Label: 24-bit field carries the whole or a portion of the 681 Function part of the SRv6 SID when the Transposition Scheme of 682 encoding (Section 4) is used and otherwise set to Implicit NULL 683 value in the high order 20 bits (i.e., 0x000030). When using the 684 Transposition Scheme, the Transposition Length MUST be less than 685 or equal to 24 and less than or equal to the Function Length. 687 A Service SID enclosed in an SRv6 L2 Service TLV within the BGP 688 Prefix-SID attribute is advertised along with the A-D route. The 689 SRv6 Endpoint behavior of the Service SID thus signaled is entirely 690 up to the originator of the advertisement. In practice, the SRv6 691 Endpoint behavior is END.DX2, END.DX2V or END.DT2U. 693 6.2. MAC/IP Advertisement Route over SRv6 Core 695 EVPN Route Type 2 is used to advertise unicast traffic MAC+IP address 696 reachability through MP-BGP to all other PEs in a given EVPN 697 instance. 699 As a reminder, EVPN Route Type 2 is encoded as follows: 701 +---------------------------------------+ 702 | RD (8 octets) | 703 +---------------------------------------+ 704 |Ethernet Segment Identifier (10 octets)| 705 +---------------------------------------+ 706 | Ethernet Tag ID (4 octets) | 707 +---------------------------------------+ 708 | MAC Address Length (1 octet) | 709 +---------------------------------------+ 710 | MAC Address (6 octets) | 711 +---------------------------------------+ 712 | IP Address Length (1 octet) | 713 +---------------------------------------+ 714 | IP Address (0, 4, or 16 octets) | 715 +---------------------------------------+ 716 | MPLS Label1 (3 octets) | 717 +---------------------------------------+ 718 | MPLS Label2 (0 or 3 octets) | 719 +---------------------------------------+ 721 NLRI encoding over SRv6 core is similar to [RFC7432] with the 722 following changes: 724 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. This 725 24-bit field carries the whole or a portion of the Function part 726 of the SRv6 SID when the Transposition Scheme of encoding 727 (Section 4) is used and otherwise set to Implicit NULL value in 728 the high order 20 bits (i.e., 0x000030). When using the 729 Transposition Scheme, the Transposition Length MUST be less than 730 or equal to 24 and less than or equal to the Function Length. 732 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. This 733 24-bit field carries the whole or a portion of the Function part 734 of the SRv6 SID when the Transposition Scheme of encoding 735 (Section 4) is used and otherwise set to Implicit NULL value in 736 the high order 20 bits (i.e., 0x000030). When using the 737 Transposition Scheme, the Transposition Length MUST be less than 738 or equal to 24 and less than or equal to the Function Length. 740 Service SIDs enclosed in SRv6 L2 Service TLV and optionally in SRv6 741 L3 Service TLV within the BGP Prefix-SID attribute is advertised 742 along with the MAC/IP Advertisement route. 744 Described below are different types of Route Type 2 advertisements. 746 6.2.1. MAC/IP Advertisement Route with MAC Only 748 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. This 749 24-bit field carries the whole or a portion of the Function part 750 of the SRv6 SID when the Transposition Scheme of encoding 751 (Section 4) is used and otherwise set to Implicit NULL value in 752 the high order 20 bits (i.e., 0x000030). When using the 753 Transposition Scheme, the Transposition Length MUST be less than 754 or equal to 24 and less than or equal to the Function Length. 756 A Service SID enclosed in an SRv6 L2 Service TLV within the BGP 757 Prefix-SID attribute is advertised along with the route. The SRv6 758 Endpoint behavior of the Service SID thus signaled is entirely up to 759 the originator of the advertisement. In practice, the SRv6 Endpoint 760 behavior is END.DX2 or END.DT2U. 762 6.2.2. MAC/IP Advertisement Route with MAC+IP 764 o MPLS Label1: Is associated with the SRv6 L2 Service TLV. This 765 24-bit field carries the whole or a portion of the Function part 766 of the SRv6 SID when the Transposition Scheme of encoding 767 (Section 4) is used and otherwise set to Implicit NULL value in 768 the high order 20 bits (i.e., 0x000030). When using the 769 Transposition Scheme, the Transposition Length MUST be less than 770 or equal to 24 and less than or equal to the Function Length. 772 o MPLS Label2: Is associated with the SRv6 L3 Service TLV. This 773 24-bit field carries the whole or a portion of the Function part 774 of the SRv6 SID when the Transposition Scheme of encoding 775 (Section 4) is used and otherwise set to Implicit NULL value in 776 the high order 20 bits (i.e., 0x000030). When using the 777 Transposition Scheme, the Transposition Length MUST be less than 778 or equal to 24 and less than or equal to the Function Length. 780 An L2 Service SID enclosed in an SRv6 L2 Service TLV within the BGP 781 Prefix-SID attribute is advertised along with the route. In 782 addition, an L3 Service SID enclosed in an SRv6 L3 Service TLV within 783 the BGP Prefix-SID attribute MAY also be advertised along with the 784 route. The SRv6 Endpoint behavior of the Service SID(s) thus 785 signaled is entirely up to the originator of the advertisement. In 786 practice, the SRv6 Endpoint behavior is END.DX2 or END.DT2U for the 787 L2 Service SID, and END.DT6/4 or END.DX6/4 for the L3 Service SID. 789 6.3. Inclusive Multicast Ethernet Tag Route over SRv6 Core 791 EVPN Route Type 3 is used to advertise multicast traffic reachability 792 information through MP-BGP to all other PEs in a given EVPN instance. 794 As a reminder, EVPN Route Type 3 is encoded as follows: 796 +---------------------------------------+ 797 | RD (8 octets) | 798 +---------------------------------------+ 799 | Ethernet Tag ID (4 octets) | 800 +---------------------------------------+ 801 | IP Address Length (1 octet) | 802 +---------------------------------------+ 803 | Originating Router's IP Address | 804 | (4 or 16 octets) | 805 +---------------------------------------+ 807 NLRI encoding over SRv6 core is similar to [RFC7432]. 809 PMSI Tunnel Attribute [RFC6514] is used to identify the P-tunnel used 810 for sending broadcast, unknown unicast, or multicast (BUM) traffic. 811 The format of PMSI Tunnel Attribute is encoded as follows over SRv6 812 Core: 814 +---------------------------------------+ 815 | Flag (1 octet) | 816 +---------------------------------------+ 817 | Tunnel Type (1 octet) | 818 +---------------------------------------+ 819 | MPLS label (3 octet) | 820 +---------------------------------------+ 821 | Tunnel Identifier (variable) | 822 +---------------------------------------+ 824 o Flag: zero value defined per [RFC7432] 826 o Tunnel Type: defined per [RFC6514] 828 o MPLS label: This 24-bit field carries the whole or a portion of 829 the Function part of the SRv6 SID when ingress replication is used 830 and the Transposition Scheme of encoding (Section 4) is used and 831 otherwise, it is set as defined in [RFC6514]. When using the 832 Transposition Scheme, the Transposition Length MUST be less than 833 or equal to 24 and less than or equal to the Function Length. 835 o Tunnel Identifier: IP address of egress PE 837 A Service SID enclosed in an SRv6 L2 Service TLV within the BGP 838 Prefix-SID attribute is advertised along with the route. The SRv6 839 Endpoint behavior of the Service SID thus signaled, is entirely up to 840 the originator of the advertisement. In practice, the SRv6 Endpoint 841 behavior of the SRv6 SID is as follows: 843 o END.DT2M behavior. 845 o When ESI-based filtering is used for Multi-Homing or E-Tree 846 procedures, the ESI Filtering Argument (the Arg.FE2 notation 847 introduced in [RFC8986]) of the Service SID carried along with 848 EVPN Route Type 1 route SHOULD be merged with the applicable 849 End.DT2M SID of Type 3 route advertised by remote PE by doing a 850 bit-wise logical-OR operation to create a single SID on the 851 ingress PE. Details of split-horizon ESI-based filtering 852 mechanisms for multihoming are described in [RFC7432]. Details of 853 filtering mechanisms for Leaf-originated BUM traffic in EVPN 854 E-Tree services are provided in [RFC8317]. 856 o When "local-bias" is used as the Multi-Homing split-horizon 857 method, the ESI Filtering Argument SHOULD NOT be merged with the 858 corresponding End.DT2M SID on the ingress PE. Details of the 859 "local-bias" procedures are described in [RFC8365]. 861 Usage of multicast trees as P-tunnels is outside the scope of this 862 document. 864 6.4. Ethernet Segment Route over SRv6 Core 866 As a reminder, an Ethernet Segment route (i.e., EVPN Route Type 4) is 867 encoded as follows: 869 +---------------------------------------+ 870 | RD (8 octets) | 871 +---------------------------------------+ 872 | Ethernet Tag ID (4 octets) | 873 +---------------------------------------+ 874 | IP Address Length (1 octet) | 875 +---------------------------------------+ 876 | Originating Router's IP Address | 877 | (4 or 16 octets) | 878 +---------------------------------------+ 880 NLRI encoding over SRv6 core is similar to [RFC7432]. 882 SRv6 Service TLVs within the BGP Prefix-SID attribute are not 883 advertised along with this route. The processing of the route has 884 not changed - it remains as described in [RFC7432]. 886 6.5. IP Prefix Route over SRv6 Core 888 EVPN Route Type 5 is used to advertise IP address reachability 889 through MP-BGP to all other PEs in a given EVPN instance. The IP 890 address may include host IP prefix or any specific subnet. 892 As a reminder, EVPN Route Type 5 is encoded as follows: 894 +---------------------------------------+ 895 | RD (8 octets) | 896 +---------------------------------------+ 897 |Ethernet Segment Identifier (10 octets)| 898 +---------------------------------------+ 899 | Ethernet Tag ID (4 octets) | 900 +---------------------------------------+ 901 | IP Prefix Length (1 octet) | 902 +---------------------------------------+ 903 | IP Prefix (4 or 16 octets) | 904 +---------------------------------------+ 905 | GW IP Address (4 or 16 octets) | 906 +---------------------------------------+ 907 | MPLS Label (3 octets) | 908 +---------------------------------------+ 910 NLRI encoding over SRv6 core is similar to [RFC7432] with the 911 following change: 913 o MPLS Label: This 24-bit field carries the whole or a portion of 914 the Function part of the SRv6 SID when the Transposition Scheme of 915 encoding (Section 4) is used and otherwise set to Implicit NULL 916 value in the high order 20 bits (i.e., 0x000030). When using the 917 Transposition Scheme, the Transposition Length MUST be less than 918 or equal to 24 and less than or equal to the Function Length. 920 SRv6 Service SID is encoded as part of the SRv6 L3 Service TLV. The 921 SRv6 Endpoint behavior of the SRv6 SID is entirely up to the 922 originator of the advertisement. In practice, the SRv6 Endpoint 923 behavior is End.DT4/6 or End.DX4/6. 925 6.6. EVPN Multicast Routes (Route Types 6, 7, 8) over SRv6 Core 927 These routes do not require the advertisement of SRv6 Service TLVs 928 along with them. Similar to EVPN Route Type 4, the BGP Nexthop is 929 equal to the IPv6 address of egress PE. 931 7. Implementation Status 933 [Note to RFC Editor: This section needs to be removed before 934 publication as RFC.] 936 The [I-D.matsushima-spring-srv6-deployment-status] describes the 937 current deployment and implementation status of SRv6 which also 938 includes the BGP services over SRv6 as specified in this document. 940 8. Error Handling 942 In case of any errors encountered while processing SRv6 Service TLVs, 943 the details of the error SHOULD be logged for further analysis. 945 If multiple instances of SRv6 L3 Service TLV is encountered, all but 946 the first instance MUST be ignored. 948 If multiple instances of SRv6 L2 Service TLV is encountered, all but 949 the first instance MUST be ignored. 951 An SRv6 Service TLV is considered malformed in the following cases: 953 o the TLV Length is less than 1 955 o the TLV Length is inconsistent with the length of BGP Prefix-SID 956 attribute 958 o at least one of the constituent Sub-TLVs is malformed 960 An SRv6 Service Sub-TLV is considered malformed in the following 961 cases: 963 o the Sub-TLV Length is inconsistent with the length of the 964 enclosing SRv6 Service TLV 966 An SRv6 SID Information Sub-TLV is considered malformed in the 967 following cases: 969 * the Sub-TLV Length is less than 21 971 * the Sub-TLV Length is inconsistent with the length of the 972 enclosing SRv6 Service TLV 974 * at least one of the constituent Sub-Sub-TLVs is malformed 976 An SRv6 Service Data Sub-sub-TLV is considered malformed in the 977 following cases: 979 o the Sub-Sub-TLV Length is inconsistent with the length of the 980 enclosing SRv6 service Sub-TLV 982 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 983 its Type is unrecognized. 985 Any TLV or Sub-TLV or Sub-Sub-TLV is not considered malformed because 986 of failing any semantic validation of its Value field. 988 SRv6 overlay service requires Service SID for forwarding. The treat- 989 as-withdraw action [RFC7606] MUST be performed when at least one 990 malformed SRV6 Service TLV is present in the BGP Prefix-SID 991 attribute. 993 SRv6 SID value in SRv6 SID Information Sub-TLV is invalid when SID 994 Structure Sub-Sub-TLV transposition length is greater than the number 995 of bits of the label field or addition of transposition offset and 996 length is greater than 128. The transposition offset and length MUST 997 be 0 when the Sub-Sub-TLV is advertised along with routes where 998 transposition scheme is not applicable (e.g., for Global IPv6 Service 999 [RFC2545] where there is no label field). The path having such 1000 Prefix-SID Attribute should be ineligible during the selection of the 1001 best path for the corresponding prefix. 1003 9. IANA Considerations 1005 9.1. BGP Prefix-SID TLV Types Registry 1007 This document introduces three new TLV Types of the BGP Prefix-SID 1008 attribute. IANA has assigned Type values in the registry "BGP 1009 Prefix-SID TLV Types" as follows: 1011 Value Type Reference 1012 -------------------------------------------- 1013 4 Deprecated 1014 5 SRv6 L3 Service TLV 1015 6 SRv6 L2 Service TLV 1017 The value 4 previously corresponded to the SRv6-VPN SID TLV, which 1018 was specified in previous versions of this document and used by early 1019 implementations of this specification. It was deprecated and 1020 replaced by the SRv6 L3 Service and SRv6 L2 Service TLVs. 1022 9.2. SRv6 Service Sub-TLV Types Registry 1024 IANA is requested to create and maintain a new registry called "SRv6 1025 Service Sub-TLV Types". The allocation policy for this registry is: 1027 0 : Reserved 1028 1-127 : IETF Review 1029 128-254 : First Come First Served 1030 255 : Reserved 1032 The following Sub-TLV Type is defined in this document: 1034 Value Type Reference 1035 ---------------------------------------------------- 1036 1 SRv6 SID Information Sub-TLV 1038 9.3. SRv6 Service Data Sub-Sub-TLV Types Registry 1040 IANA is requested to create and maintain a new registry called "SRv6 1041 Service Data Sub-Sub-TLV Types". The allocation policy for this 1042 registry is: 1044 0 : Reserved 1045 1-127 : IETF Review 1046 128-254 : First Come First Served 1047 255 : Reserved 1049 The following Sub-Sub-TLV Type is defined in this document: 1051 Value Type Reference 1052 ---------------------------------------------------- 1053 1 SRv6 SID Structure Sub-Sub-TLV 1055 10. Security Considerations 1057 This document specifies extensions to BGP protocol for signaling of 1058 services for SRv6. As such, techniques related to authentication of 1059 BGP sessions for securing messages between BGP peers as discussed in 1060 the BGP specification [RFC4271] and, in the security analysis for BGP 1061 [RFC4272] apply. The discussion of the use of the TCP Authentication 1062 option to protect BGP sessions is found in [RFC5925], while [RFC6952] 1063 includes an analysis of BGP keying and authentication issues. 1065 This document does not introduce new services or BGP NLRI types but 1066 extends the signaling of existing ones for SRv6. Therefore, the 1067 security considerations for the respective BGP services [RFC8950] 1068 [RFC4659] [RFC2545] [RFC7432] 1069 [I-D.ietf-bess-evpn-prefix-advertisement] also apply. 1071 SRv6 operates within a trusted SR domain with filtering of traffic at 1072 the domain boundaries. These and other security aspects of SRv6 are 1073 discussed in the security considerations of [RFC8402] [RFC8754] and 1074 apply for the deployment of BGP services using SRv6. The SRv6 SIDs 1075 used for the BGP Services in this document are defined in [RFC8986] 1076 and hence the security considerations of that document also apply. 1077 The service flows between PE routers using SRv6 SIDs advertised via 1078 BGP are expected to be limited within the trusted SR domain (e.g., 1079 within a single AS or between multiple ASes within a single provider 1080 network). Therefore, precaution is necessary to ensure that the BGP 1081 service information (including associated SRv6 SID) advertised via 1082 BGP sessions are limited to peers within this trusted SR domain. The 1083 security consideration section of [RFC8669] discusses mechanisms to 1084 prevent leaking of BGP Prefix-SID attribute, that carries SRv6 SID, 1085 outside the SR domain. If these filtering mechanisms, both in the 1086 forwarding and control plane, are not implemented properly, it may be 1087 possible for nodes outside the SR domain to learn the VPN Service 1088 SIDs and use them to direct traffic into VPN networks from outside 1089 the SR domain. 1091 11. Acknowledgments 1093 The authors of this document would like to thank Stephane Litkowski, 1094 Rishabh Parekh, Xiejingrong, Rajesh M, Mustapha Aissaoui and 1095 Alexander Vainshtein for their comments and review of this document. 1097 12. Contributors 1099 Satoru Matsushima 1100 SoftBank 1102 Email: satoru.matsushima@g.softbank.co.jp 1104 Dirk Steinberg 1105 Steinberg Consulting 1107 Email: dirk@lapishills.com 1109 Daniel Bernier 1110 Bell Canada 1112 Email: daniel.bernier@bell.ca 1114 Daniel Voyer 1115 Bell Canada 1117 Email: daniel.voyer@bell.ca 1118 Jonn Leddy 1119 Individual 1121 Email: john@leddy.net 1123 Swadesh Agrawal 1124 Cisco 1126 Email: swaagraw@cisco.com 1128 Patrice Brissette 1129 Cisco 1131 Email: pbrisset@cisco.com 1133 Ali Sajassi 1134 Cisco 1136 Email: sajassi@cisco.com 1138 Bart Peirens 1139 Proximus 1140 Belgium 1142 Email: bart.peirens@proximus.com 1144 Darren Dukes 1145 Cisco 1147 Email: ddukes@cisco.com 1149 Pablo Camarilo 1150 Cisco 1152 Email: pcamaril@cisco.com 1154 Shyam Sethuram 1155 Cisco 1157 Email: shyam.ioml@gmail.com 1159 Zafar Ali 1160 Cisco 1162 Email: zali@cisco.com 1164 13. References 1166 13.1. Normative References 1168 [I-D.ietf-bess-evpn-igmp-mld-proxy] 1169 Sajassi, A., Thoria, S., Drake, J., and W. Lin, "IGMP and 1170 MLD Proxy for EVPN", draft-ietf-bess-evpn-igmp-mld- 1171 proxy-06 (work in progress), January 2021. 1173 [I-D.ietf-bess-evpn-prefix-advertisement] 1174 Rabadan, J., Henderickx, W., Drake, J., Lin, W., and A. 1175 Sajassi, "IP Prefix Advertisement in EVPN", draft-ietf- 1176 bess-evpn-prefix-advertisement-11 (work in progress), May 1177 2018. 1179 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1180 Requirement Levels", BCP 14, RFC 2119, 1181 DOI 10.17487/RFC2119, March 1997, 1182 . 1184 [RFC2545] Marques, P. and F. Dupont, "Use of BGP-4 Multiprotocol 1185 Extensions for IPv6 Inter-Domain Routing", RFC 2545, 1186 DOI 10.17487/RFC2545, March 1999, 1187 . 1189 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A 1190 Border Gateway Protocol 4 (BGP-4)", RFC 4271, 1191 DOI 10.17487/RFC4271, January 2006, 1192 . 1194 [RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private 1195 Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February 1196 2006, . 1198 [RFC4456] Bates, T., Chen, E., and R. Chandra, "BGP Route 1199 Reflection: An Alternative to Full Mesh Internal BGP 1200 (IBGP)", RFC 4456, DOI 10.17487/RFC4456, April 2006, 1201 . 1203 [RFC4659] De Clercq, J., Ooms, D., Carugi, M., and F. Le Faucheur, 1204 "BGP-MPLS IP Virtual Private Network (VPN) Extension for 1205 IPv6 VPN", RFC 4659, DOI 10.17487/RFC4659, September 2006, 1206 . 1208 [RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter, 1209 "Multiprotocol Extensions for BGP-4", RFC 4760, 1210 DOI 10.17487/RFC4760, January 2007, 1211 . 1213 [RFC6514] Aggarwal, R., Rosen, E., Morin, T., and Y. Rekhter, "BGP 1214 Encodings and Procedures for Multicast in MPLS/BGP IP 1215 VPNs", RFC 6514, DOI 10.17487/RFC6514, February 2012, 1216 . 1218 [RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A., 1219 Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based 1220 Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February 1221 2015, . 1223 [RFC7606] Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. 1224 Patel, "Revised Error Handling for BGP UPDATE Messages", 1225 RFC 7606, DOI 10.17487/RFC7606, August 2015, 1226 . 1228 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1229 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1230 May 2017, . 1232 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 1233 (IPv6) Specification", STD 86, RFC 8200, 1234 DOI 10.17487/RFC8200, July 2017, 1235 . 1237 [RFC8214] Boutros, S., Sajassi, A., Salam, S., Drake, J., and J. 1238 Rabadan, "Virtual Private Wire Service Support in Ethernet 1239 VPN", RFC 8214, DOI 10.17487/RFC8214, August 2017, 1240 . 1242 [RFC8277] Rosen, E., "Using BGP to Bind MPLS Labels to Address 1243 Prefixes", RFC 8277, DOI 10.17487/RFC8277, October 2017, 1244 . 1246 [RFC8317] Sajassi, A., Ed., Salam, S., Drake, J., Uttaro, J., 1247 Boutros, S., and J. Rabadan, "Ethernet-Tree (E-Tree) 1248 Support in Ethernet VPN (EVPN) and Provider Backbone 1249 Bridging EVPN (PBB-EVPN)", RFC 8317, DOI 10.17487/RFC8317, 1250 January 2018, . 1252 [RFC8365] Sajassi, A., Ed., Drake, J., Ed., Bitar, N., Shekhar, R., 1253 Uttaro, J., and W. Henderickx, "A Network Virtualization 1254 Overlay Solution Using Ethernet VPN (EVPN)", RFC 8365, 1255 DOI 10.17487/RFC8365, March 2018, 1256 . 1258 [RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., 1259 Decraene, B., Litkowski, S., and R. Shakir, "Segment 1260 Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, 1261 July 2018, . 1263 [RFC8669] Previdi, S., Filsfils, C., Lindem, A., Ed., Sreekantiah, 1264 A., and H. Gredler, "Segment Routing Prefix Segment 1265 Identifier Extensions for BGP", RFC 8669, 1266 DOI 10.17487/RFC8669, December 2019, 1267 . 1269 [RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., 1270 Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header 1271 (SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020, 1272 . 1274 [RFC8950] Litkowski, S., Agrawal, S., Ananthamurthy, K., and K. 1275 Patel, "Advertising IPv4 Network Layer Reachability 1276 Information (NLRI) with an IPv6 Next Hop", RFC 8950, 1277 DOI 10.17487/RFC8950, November 2020, 1278 . 1280 [RFC8986] Filsfils, C., Ed., Camarillo, P., Ed., Leddy, J., Voyer, 1281 D., Matsushima, S., and Z. Li, "Segment Routing over IPv6 1282 (SRv6) Network Programming", RFC 8986, 1283 DOI 10.17487/RFC8986, February 2021, 1284 . 1286 13.2. Informative References 1288 [I-D.ietf-idr-segment-routing-te-policy] 1289 Previdi, S., Filsfils, C., Talaulikar, K., Mattes, P., 1290 Rosen, E., Jain, D., and S. Lin, "Advertising Segment 1291 Routing Policies in BGP", draft-ietf-idr-segment-routing- 1292 te-policy-11 (work in progress), November 2020. 1294 [I-D.ietf-spring-segment-routing-policy] 1295 Filsfils, C., Talaulikar, K., Voyer, D., Bogdanov, A., and 1296 P. Mattes, "Segment Routing Policy Architecture", draft- 1297 ietf-spring-segment-routing-policy-09 (work in progress), 1298 November 2020. 1300 [I-D.matsushima-spring-srv6-deployment-status] 1301 Matsushima, S., Filsfils, C., Ali, Z., Li, Z., and K. 1302 Rajaraman, "SRv6 Implementation and Deployment Status", 1303 draft-matsushima-spring-srv6-deployment-status-10 (work in 1304 progress), December 2020. 1306 [RFC4272] Murphy, S., "BGP Security Vulnerabilities Analysis", 1307 RFC 4272, DOI 10.17487/RFC4272, January 2006, 1308 . 1310 [RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP 1311 Authentication Option", RFC 5925, DOI 10.17487/RFC5925, 1312 June 2010, . 1314 [RFC6513] Rosen, E., Ed. and R. Aggarwal, Ed., "Multicast in MPLS/ 1315 BGP IP VPNs", RFC 6513, DOI 10.17487/RFC6513, February 1316 2012, . 1318 [RFC6952] Jethanandani, M., Patel, K., and L. Zheng, "Analysis of 1319 BGP, LDP, PCEP, and MSDP Issues According to the Keying 1320 and Authentication for Routing Protocols (KARP) Design 1321 Guide", RFC 6952, DOI 10.17487/RFC6952, May 2013, 1322 . 1324 Authors' Addresses 1326 Gaurav Dawra (editor) 1327 LinkedIn 1328 USA 1330 Email: gdawra.ietf@gmail.com 1332 Clarence Filsfils 1333 Cisco Systems 1334 Belgium 1336 Email: cfilsfil@cisco.com 1338 Ketan Talaulikar (editor) 1339 Cisco Systems 1340 India 1342 Email: ketant@cisco.com 1344 Robert Raszuk 1345 Bloomberg LP 1346 USA 1348 Email: robert@raszuk.net 1349 Bruno Decraene 1350 Orange 1351 France 1353 Email: bruno.decraene@orange.com 1355 Shunwan Zhuang 1356 Huawei Technologies 1357 China 1359 Email: zhuangshunwan@huawei.com 1361 Jorge Rabadan 1362 Nokia 1363 USA 1365 Email: jorge.rabadan@nokia.com