idnits 2.17.1 draft-ietf-mpls-sr-epe-oam-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 9 instances of too long lines in the document, the longest one being 4 characters in excess of 72. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Line 415 has weird spacing: '...k-depth if an...' == Line 448 has weird spacing: '...k-depth if an...' -- The document date (February 20, 2021) is 1158 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'RFC5065' is mentioned on line 360, but not defined == Missing Reference: 'RFC4271' is mentioned on line 371, but not defined == Missing Reference: 'RFC6286' is mentioned on line 371, but not defined == Outdated reference: A later version (-22) exists of draft-ietf-spring-segment-routing-policy-09 Summary: 1 error (**), 0 flaws (~~), 7 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Routing area S. Hegde 3 Internet-Draft K. Arora 4 Intended status: Standards Track M. Srivastava 5 Expires: August 24, 2021 Juniper Networks Inc. 6 S. Ninan 7 Individual Contributor 8 X. Xu 9 Alibaba Inc. 10 February 20, 2021 12 Label Switched Path (LSP) Ping/Traceroute for Segment Routing (SR) 13 Egress Peer Engineering Segment Identifiers (SIDs) with MPLS Data Planes 14 draft-ietf-mpls-sr-epe-oam-02 16 Abstract 18 Egress Peer Engineering (EPE) is an application of Segment Routing to 19 Solve the problem of egress peer selection. The Segment Routing 20 based BGP-EPE solution allows a centralized controller, e.g. a 21 Software Defined Network (SDN) controller to program any egress peer. 22 The EPE solution requires a node to program the PeerNode Segment 23 Identifier(SID) describing a session between two nodes, the PeerAdj 24 SID describing the link (one or more) that is used by sessions 25 between peer nodes, and the PeerSet SID describing an arbitrary set 26 of sessions or links between a local node and its peers. This 27 document provides new sub-TLVs for EPE Segment Identifiers (SID) that 28 would be used in the MPLS Target stack TLV (Type 1), in MPLS Ping and 29 Traceroute procedures. 31 Status of This Memo 33 This Internet-Draft is submitted in full conformance with the 34 provisions of BCP 78 and BCP 79. 36 Internet-Drafts are working documents of the Internet Engineering 37 Task Force (IETF). Note that other groups may also distribute 38 working documents as Internet-Drafts. The list of current Internet- 39 Drafts is at https://datatracker.ietf.org/drafts/current/. 41 Internet-Drafts are draft documents valid for a maximum of six months 42 and may be updated, replaced, or obsoleted by other documents at any 43 time. It is inappropriate to use Internet-Drafts as reference 44 material or to cite them other than as "work in progress." 46 This Internet-Draft will expire on August 24, 2021. 48 Copyright Notice 50 Copyright (c) 2021 IETF Trust and the persons identified as the 51 document authors. All rights reserved. 53 This document is subject to BCP 78 and the IETF Trust's Legal 54 Provisions Relating to IETF Documents 55 (https://trustee.ietf.org/license-info) in effect on the date of 56 publication of this document. Please review these documents 57 carefully, as they describe your rights and restrictions with respect 58 to this document. Code Components extracted from this document must 59 include Simplified BSD License text as described in Section 4.e of 60 the Trust Legal Provisions and are provided without warranty as 61 described in the Simplified BSD License. 63 Table of Contents 65 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 66 2. Theory of Operation . . . . . . . . . . . . . . . . . . . . . 3 67 3. Requirements Language . . . . . . . . . . . . . . . . . . . . 4 68 4. FEC Definitions . . . . . . . . . . . . . . . . . . . . . . . 4 69 4.1. PeerAdj SID Sub-TLV . . . . . . . . . . . . . . . . . . . 4 70 4.2. PeerNode SID Sub-TLV . . . . . . . . . . . . . . . . . . 6 71 4.3. PeerSet SID Sub-TLV . . . . . . . . . . . . . . . . . . . 8 72 5. EPE-SID FEC validation . . . . . . . . . . . . . . . . . . . 10 73 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 74 7. Security Considerations . . . . . . . . . . . . . . . . . . . 13 75 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13 76 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 77 9.1. Normative References . . . . . . . . . . . . . . . . . . 13 78 9.2. Informative References . . . . . . . . . . . . . . . . . 14 79 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 81 1. Introduction 83 Egress Peer Engineering (EPE) as defined in 84 [I-D.ietf-spring-segment-routing-central-epe] is an effective 85 mechanism to select the egress peer link based on different criteria. 86 The EPE-SIDs provide means to represent egress peer links. Many 87 network deployments have built their networks consisting of multiple 88 Autonomous Systems either for ease of operations or as a result of 89 network mergers and acquisitons. The inter-AS links connecting the 90 two Autonomous Systems could be traffic engineered using EPE-SIDs in 91 this case as well.It is important to be able to validate the control 92 plane to forwarding plane synchronization for these SIDs so that any 93 anomaly can be detected easily by the operator. 95 +---------+ +------+ 96 | | | | 97 | H B------D G 98 | | +---/| AS 2 |\ +------+ 99 | |/ +------+ \ | |---L/8 100 A AS1 C---+ \| | 101 | |\\ \ +------+ /| AS 4 |---M/8 102 | | \\ +-E |/ +------+ 103 | X | \\ | K 104 | | +===F AS 3 | 105 +---------+ +------+ 107 Figure 1: Reference Diagram 109 In this reference diagram, EPE-SIDs are advertised from AS1 to AS2 110 and AS3. In certain cases the EPE-SIDs advertised by the control 111 plane may not be in synchronization with label programmed in data- 112 plane. For example, on C a PeerAdj SID could be advertised to 113 indicate it is for the link C->D. Due to some software anomaly the 114 actual data forwarding on this PeerAdj SID could be happening over 115 C->E link. If E had relevant data paths for further forwarding the 116 packet, this kind of anomalies will go unnoticed by the operator. A 117 FEC definition for the EPE-SIDs will define the details of the 118 control plane association of the SID and the data plane validation of 119 the SID will be done during the MPLS trace route procedure. When 120 there is a multi-hop EBGP session between the ASBRs, PeerNode SID is 121 advertised and traffic would be load-balanced between the interfaces 122 connecting two nodes. In the reference diagram C and F could have a 123 PeerNode-SID advertised. When the OAM packet is received on F, it 124 needs to validate if the packet came on one of the two interfaces 125 connected to C. 127 This document provides Target Forwarding Equivalence Class (FEC) 128 stack TLV definitions for EPE-SIDs. Other procedures for MPLS Ping 129 and Traceroute as defined in [RFC8287] section 7 and clarified by 130 [RFC8690] are applicable for EPE-SIDs as well. 132 2. Theory of Operation 134 [I-D.ietf-idr-bgpls-segment-routing-epe] provides mechanisms to 135 advertise the EPE-SIDs in BGP-LS. These EPE-SIDs may be used to 136 build Segment Routing paths as described in 137 [I-D.ietf-spring-segment-routing-policy] or using Path Computation 138 Element Protocol (PCEP) extensions as defined in [RFC8664]. Data 139 plane monitoring for such paths which consist of EPE-SIDs will use 140 extensions defined in this document to build the Taget FEC stack TLV. 141 The MPLS Ping and Traceroute procedures MAY be initaited by the head- 142 end of the Segment Routing path or a centralized topology-aware data 143 plane monitoring system as described in [RFC8403]. The extensions in 144 [I-D.ietf-spring-segment-routing-policy] and [RFC8664] do not define 145 the details of the SID and such extensions are out of scope for this 146 document. The node initiating the data plane monitoring may acquire 147 the details of EPE-SIDs through BGP-LS advertisements as described in 148 [I-D.ietf-idr-bgpls-segment-routing-epe]. There may be other 149 possible mechanisms to learn the definition of the SID from 150 controller. Details of such mechanisms are out of scope for this 151 document. 153 The EPE-SIDs are advertised for inter-AS links which run EBGP 154 sessions. The procedures to operate EBGP sessions in a scenario with 155 unnumbered interfaces is not very well defined and hence out of scope 156 for this document. During AS migration scenario procedures described 157 in [RFC7705] may be in force. In these scenarios, if the local and 158 remote AS fields in the FEC as described in Section 4 carries the 159 global AS and not the "local AS" as defined in [RFC7705], the FEC 160 validation procedures may fail. 162 3. Requirements Language 164 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 165 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 166 "OPTIONAL" in this document are to be interpreted as described in BCP 167 14, [RFC2119], [RFC8174] when, and only when, they appear in all 168 capitals, as shown here. 170 4. FEC Definitions 172 Three new sub-TLVs are defined for the Target FEC Stack TLV (Type 1), 173 the Reverse-Path Target FEC Stack TLV (Type 16), and the Reply Path 174 TLV (Type 21). 176 Sub-Type Sub-TLV Name 177 -------- --------------- 178 TBD1 PeerAdj SID Sub-TLV 179 TBD2 PeerNode SID Sub-TLV 180 TBD3 PeerSet SID Sub-TLV 182 Figure 2: New sub-TLV types 184 4.1. PeerAdj SID Sub-TLV 185 0 1 2 3 186 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 187 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 188 |Type = TBD | Length | 189 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 190 | Local AS Number (4 octets) | 191 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 192 | Remote As Number (4 octets) | 193 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 194 | Local BGP router ID (4 octets) | 195 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 196 | Remote BGP Router ID (4 octets) | 197 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 198 | Local Interface address (4/16 octets) | 199 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 200 | Remote Interface address (4/16 octets) | 201 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 203 Figure 3: PeerAdj SID Sub-TLV 205 Type : TBD 207 Length : variable based on IPV4/IPV6 interface address. Length 208 excludes the length of Type and length field.For IPV4 interface 209 addresses length will be 24. In case of IPV6 address length will be 210 48 212 Local AS Number : 214 4 octet unsigned integer representing the Member ASN inside the 215 Confederation.[RFC5065]. The AS number corresponds to the AS to 216 which PeerAdj SID advertising node belongs to. 218 Remote AS Number : 220 4 octet unsigned integer representing the Member ASN inside the 221 Confederation.[RFC5065]. The AS number corresponds to the AS of the 222 remote node for which the PeerAdj SID is advertised. 224 Local BGP Router ID : 226 4 octet unsigned integer of the advertising node representing the BGP 227 Identifier as defined in [RFC4271] and [RFC6286]. 229 Remote BGP Router ID : 231 4 octet unsigned integer of the receiving node representing the BGP 232 Identifier as defined in [RFC4271] and [RFC6286]. 234 Local Interface Address : 236 In case of PeerAdj SID Local interface address corresponding to the 237 PeerAdj SID should be apecified in this field. For IPV4,this field 238 is 4 octets; for IPV6, this field is 16 octets. Link Local IPV6 239 addresses are for further study. 241 Remote Interface Address : 243 In case of PeerAdj SID Remote interface address corresponding to the 244 PeerAdj SID should be apecified in this field. For IPV4,this field 245 is 4 octets; for IPV6, this field is 16 octets.Link Local IPv6 246 addresses are for further study. 248 [I-D.ietf-idr-bgpls-segment-routing-epe] mandates sending local 249 interface ID and remote interface ID in the Link Descriptors and 250 allows a value of 0 in the remote descriptors. It is useful to 251 validate the incoming interface for a OAM packet and if the remote 252 descriptor is 0 this validation is not possible. 253 [I-D.ietf-idr-bgpls-segment-routing-epe] allows optional link 254 descriptors of local and remote interface addresses as described in 255 section 4.2. This document recommends sending these optional 256 descriptors and use them to validate incoming interface. When these 257 local and remote interface addresses are not available, an ingress 258 node can send 0 in the local and/or remote interface address field. 259 The receiver SHOULD skip the validation for the incoming interface if 260 the address field contains 0. 262 4.2. PeerNode SID Sub-TLV 263 0 1 2 3 264 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 265 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 266 |Type = TBD | Length | 267 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 268 | Local AS Number (4 octets) | 269 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 270 | Remote As Number (4 octets) | 271 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 272 | Local BGP router ID (4 octets) | 273 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 274 | Remote BGP Router ID (4 octets) | 275 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 277 Figure 4: PeerNode SID Sub-TLV 279 Type : TBD 281 Length : 16 283 Local AS Number : 285 4 octet unsigned integer representing the Member ASN inside the 286 Confederation.[RFC5065]. The AS number corresponds to the AS to 287 which PeerNode SID advertising node belongs to. 289 Remote AS Number : 291 4 octet unsigned integer representing the Member ASN inside the 292 Confederation.[RFC5065]. The AS number corresponds to the AS of the 293 remote node for which the PeerNode SID is advertised. 295 Local BGP Router ID : 297 4 octet unsigned integer of the advertising node representing the BGP 298 Identifier as defined in [RFC4271] and [RFC6286]. 300 Remote BGP Router ID : 302 4 octet unsigned integer of the receiving node representing the BGP 303 Identifier as defined in [RFC4271] and [RFC6286]. 305 When there is a multi-hop EBGP session between two ASBRs, PeerNode 306 SID is advertised for this session and traffic can be load balanced 307 across these interfaces. An EPE controller that does bandiwdth 308 management for these links should be aware of the links on which the 309 traffic will be load-balanced. As per [RFC8029], the node 310 advertising the EPE SIDs will send Downstream Detailed Mapping TLV 311 (DDMT) specifying the details of nexthop interfaces, the OAM packet 312 will be sent out. Based on this information controller MAY choose to 313 verify the actual forwarding state with the topology information 314 controller has. On the router, the validation procedures will 315 include received DDMT validation as specified in [RFC8029] to verify 316 the control and forwarding state synchronization on the two routers. 317 Any descrepancies between controller's state and forwarding state 318 will not be detected by the procedures described in the document. 320 4.3. PeerSet SID Sub-TLV 321 0 1 2 3 322 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 323 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 324 |Type = TBD | Length | 325 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 326 | Local AS Number (4 octets) | 327 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 328 | Local BGP router ID (4 octets) | 329 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 330 | No.of elements in set | Reserved | 331 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 332 | Remote As Number (4 octets) | 333 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 334 | Remote BGP Router ID (4 octets) | 335 ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++ 337 One element in set consists of below details 338 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 339 | Remote As Number (4 octets) | 340 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 341 | Remote BGP Router ID (4 octets) | 342 ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++ 344 Figure 5: PeerSet SID Sub-TLV 346 Type : TBD 348 Length : variable based on the number of elements in the set. The 349 length field does not include the length of Type and Length fields. 351 Local AS Number : 353 4 octet unsigned integer representing the Member ASN inside the 354 Confederation.[RFC5065]. The AS number corresponds to the AS to 355 which PeerSet SID advertising node belongs to. 357 Remote AS Number : 359 4 octet unsigned integer representing the Member ASN inside the 360 Confederation.[RFC5065]. The AS number corresponds to the AS of the 361 remote node for which the PeerSet SID is advertised. 363 Advertising BGP Router ID : 365 4 octet unsigned integer of the advertising node representing the BGP 366 Identifier as defined in [RFC4271] and [RFC6286]. 368 Receiving BGP Router ID : 370 4 octet unsigned integer of the receiving node representing the BGP 371 Identifier as defined in [RFC4271] and [RFC6286]. 373 No.of elements in set: 375 Number of remote ASes, the set SID load-balances on. 377 PeerSet SID may be associated with a number of PeerNode SIDs and 378 PeerAdj SIDs. The remote AS number and the Router ID of each of 379 these PeerNode SIDs PeerAdj SIDs MUST be included in the FEC. 381 5. EPE-SID FEC validation 383 When a remote ASBR of the EPE-SID advertisement receives the MPLS OAM 384 packet with top FEC being the EPE-SID, it SHOULD perform validity 385 checks on the content of the EPE-SID FEC sub-TLV. The basic length 386 check should be performed on the received FEC. 388 PeerAdj SID 389 ----------- 390 Length = 24 or 48 392 Peer Node SID 393 ------------- 394 Length = 20 + "No.of IPv4 interface pairs" * 8 + 395 "No.of IPv6 interface pairs " * 32 397 PeerSet SID 398 ----------- 399 Length = 9 + no.of elements in the set * 400 (8 + "No.of IPv4 interface pairs" * 8 + 401 "No.of IPv6 interface pairs " * 32) 403 Figure 6: Length Validation 405 If a malformed FEC sub-TLV is received, then a return code of 1, 406 "Malformed echo request received" as defined in [RFC8029] SHOULD be 407 sent. The below section augments the section 7.4 of [RFC8287] 409 4a. Segment Routing EPE-SID Validation: 411 If the Label-stack-depth is 0 and the Target FEC Stack sub-TLV 412 at FEC-stack-depth is TBD1 (PeerAdj SID sub-TLV) 414 Set the Best-return-code to 10, "Mapping for this FEC is not 415 the given label at stack-depth if any below 416 conditions fail: 418 o Validate that the Receiving Node BGP Local AS matches 419 with the remote AS field in the received PeerAdj SID 420 FEC sub-TLV. 422 o Validate that the Receiving Node BGP Router-ID matches 423 with the Remote Router ID field in the received 424 PeerAdj SID FEC. 426 o Validate that there is a EBGP session with a peer 427 having local As number and BGP Router-ID as 428 specified in the Local AS number and Local Router-ID 429 field in the received PeerAdj SID FEC sub-TLV. 431 If the Remote interface address is not zero, validate the 432 incoming interface. 433 Set the Best-return-code to 35 "Mapping for this FEC is not 434 associated with the incoming interface" (RFC8287) if any below 435 conditions fail: 437 o Validate the incoming interface on which the OAM packet 438 was receieved, matches with the remote interface 439 specified in the PeerAdj SID FEC sub-TLV 441 If all above validations have passed, set the return code to 3 442 "Replying router is an egress for the FEC at stack-depth" 444 Else, if the Target FEC sub-TLV at FEC-stack-depth is TBD2 445 (PeerNode SID sub-TLV), 447 Set the Best-return-code to 10, "Mapping for this FEC is not 448 the given label at stack-depth if any below 449 conditions fail: 451 o Validate that the Receiving Node BGP Local AS matches with 452 the remote AS field in the 453 received PeerNode SID FEC sub-TLV. 455 o Validate that the Receiving Node BGP Router-ID matches 456 with the Remote Router ID field in the received 457 PeerNode SID FEC. 459 o Validate that there is a EBGP session with a peer 460 having local As number and BGP Router-ID as 461 specified in the Local AS number and Local Router-ID 462 field in the received PeerNode SID FEC sub-TLV. 464 If all above validations have passed, set the return code to 3 465 "Replying router is an egress for the FEC at stack-depth" 467 Else, if the Target FEC sub-TLV at FEC-stack-depth is TBD3 468 (PeerSet SID sub-TLV), 470 Set the Best-return-code to 10, "Mapping for this FEC is not 471 the given label at stack-depth" if any below 472 conditions fail: 474 o Validate that the Receiving Node BGP Local AS matches 475 with one of the remote AS field in the received PeerSet 476 SID FEC sub-TLV. 478 o Validate that the Receiving Node BGP Router-ID matches 479 with one of the Remote Router ID field in the received 480 PeerSet SID FEC sub-TLV. 482 o Validate that there is a EBGP session with a peer having 483 local As number and BGP Router-ID as 484 specified in the Local AS number and Local Router-ID 485 field in the received PeerSet SID FEC sub-TLV. 487 If all above validations have passed, set the return code to 3 488 "Replying router is an egress for the FEC at stack-depth" 490 Figure 7: EPE-SID FEC validiation 492 6. IANA Considerations 494 New Target FEC stack sub-TLV from the "sub-TLVs for TLV types 1,16 495 and 21" subregistry of the "Multi-Protocol Label switching (MPLS) 496 Label Switched Paths (LSPs) Ping parameters" registry 498 PeerAdj SID Sub-TLV : TBD1 500 PeerNode SID Sub-TLV: TBD2 502 PeerSet SID Sub-TLV : TBD3 504 7. Security Considerations 506 The EPE-SIDs are advertised for egress links for Egress Peer 507 Engineering purposes or for inter-As links between co-operating ASes. 508 When co-operating domains are involved, they can allow the packets 509 arriving on trusted interfaces to reach the control plane and get 510 processed. When EPE-SIDs which are created for egress TE links where 511 the neighbor AS is an independent entity, it may not allow packets 512 arriving from external world to reach the control plane. In such 513 deployments MPLS OAM packets will be dropped by the neighboring AS 514 that receives the MPLS OAM packet. In MPLS traceroute applications, 515 when the AS boundary is crossed with the EPE-SIDs, the FEC stack is 516 changed. [RFC8287] does not mandate that the initiator upon 517 receiving an MPLS Echo Reply message that includes the FEC Stack 518 Change TLV with one or more of the original segments being popped 519 remove a corresponding FEC(s) from the Target FEC Stack TLV in the 520 next (TTL+1) traceroute request. If an initiator does not remove the 521 FECs belonging to the previous AS that has traversed, it MAY expose 522 the internal AS information to the following AS being traversed in 523 traceroute. 525 8. Acknowledgments 527 Thanks to Loa Andersson, Dhruv Dhody, Ketan Talaulikar, Italo Busi 528 and Alexander Vainshtein, Deepti Rathi for careful review and 529 comments. 531 9. References 533 9.1. Normative References 535 [I-D.ietf-idr-bgpls-segment-routing-epe] 536 Previdi, S., Talaulikar, K., Filsfils, C., Patel, K., Ray, 537 S., and J. Dong, "BGP-LS extensions for Segment Routing 538 BGP Egress Peer Engineering", draft-ietf-idr-bgpls- 539 segment-routing-epe-19 (work in progress), May 2019. 541 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 542 Requirement Levels", BCP 14, RFC 2119, 543 DOI 10.17487/RFC2119, March 1997, 544 . 546 [RFC8029] Kompella, K., Swallow, G., Pignataro, C., Ed., Kumar, N., 547 Aldrin, S., and M. Chen, "Detecting Multiprotocol Label 548 Switched (MPLS) Data-Plane Failures", RFC 8029, 549 DOI 10.17487/RFC8029, March 2017, 550 . 552 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 553 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 554 May 2017, . 556 [RFC8287] Kumar, N., Ed., Pignataro, C., Ed., Swallow, G., Akiya, 557 N., Kini, S., and M. Chen, "Label Switched Path (LSP) 558 Ping/Traceroute for Segment Routing (SR) IGP-Prefix and 559 IGP-Adjacency Segment Identifiers (SIDs) with MPLS Data 560 Planes", RFC 8287, DOI 10.17487/RFC8287, December 2017, 561 . 563 [RFC8690] Nainar, N., Pignataro, C., Iqbal, F., and A. Vainshtein, 564 "Clarification of Segment ID Sub-TLV Length for RFC 8287", 565 RFC 8690, DOI 10.17487/RFC8690, December 2019, 566 . 568 9.2. Informative References 570 [I-D.ietf-spring-segment-routing-central-epe] 571 Filsfils, C., Previdi, S., Dawra, G., Aries, E., and D. 572 Afanasiev, "Segment Routing Centralized BGP Egress Peer 573 Engineering", draft-ietf-spring-segment-routing-central- 574 epe-10 (work in progress), December 2017. 576 [I-D.ietf-spring-segment-routing-policy] 577 Filsfils, C., Talaulikar, K., Voyer, D., Bogdanov, A., and 578 P. Mattes, "Segment Routing Policy Architecture", draft- 579 ietf-spring-segment-routing-policy-09 (work in progress), 580 November 2020. 582 [RFC7705] George, W. and S. Amante, "Autonomous System Migration 583 Mechanisms and Their Effects on the BGP AS_PATH 584 Attribute", RFC 7705, DOI 10.17487/RFC7705, November 2015, 585 . 587 [RFC8403] Geib, R., Ed., Filsfils, C., Pignataro, C., Ed., and N. 588 Kumar, "A Scalable and Topology-Aware MPLS Data-Plane 589 Monitoring System", RFC 8403, DOI 10.17487/RFC8403, July 590 2018, . 592 [RFC8664] Sivabalan, S., Filsfils, C., Tantsura, J., Henderickx, W., 593 and J. Hardwick, "Path Computation Element Communication 594 Protocol (PCEP) Extensions for Segment Routing", RFC 8664, 595 DOI 10.17487/RFC8664, December 2019, 596 . 598 Authors' Addresses 600 Shraddha Hegde 601 Juniper Networks Inc. 602 Exora Business Park 603 Bangalore, KA 560103 604 India 606 Email: shraddha@juniper.net 608 Kapil Arora 609 Juniper Networks Inc. 611 Email: kapilaro@juniper.net 613 Mukul Srivastava 614 Juniper Networks Inc. 616 Email: msri@juniper.net 618 Samson Ninan 619 Individual Contributor 621 Email: samson.cse@gmail.com 623 Xiaohu Xu 624 Alibaba Inc. 625 Beijing 626 China 628 Email: xiaohu.xxh@alibaba-inc.com