idnits 2.17.1 draft-ietf-spring-resiliency-use-cases-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (October 28, 2016) is 2736 days in the past. Is this intentional? -- Found something which looks like a code comment -- if you have code sections in the document, please surround them with '' and '' lines. Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-09) exists of draft-ietf-rtgwg-uloop-delay-02 == Outdated reference: A later version (-15) exists of draft-ietf-spring-segment-routing-09 Summary: 0 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group C. Filsfils, Ed. 3 Internet-Draft S. Previdi, Ed. 4 Intended status: Informational Cisco Systems, Inc. 5 Expires: May 1, 2017 B. Decraene 6 Orange 7 R. Shakir 8 Google 9 October 28, 2016 11 Resiliency use cases in SPRING networks 12 draft-ietf-spring-resiliency-use-cases-08 14 Abstract 16 This document identifies and describes the requirements for a set of 17 use cases related to network resiliency on Segment Routing (SPRING) 18 networks. 20 Requirements Language 22 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 23 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 24 document are to be interpreted as described in RFC 2119 [RFC2119]. 26 Status of This Memo 28 This Internet-Draft is submitted in full conformance with the 29 provisions of BCP 78 and BCP 79. 31 Internet-Drafts are working documents of the Internet Engineering 32 Task Force (IETF). Note that other groups may also distribute 33 working documents as Internet-Drafts. The list of current Internet- 34 Drafts is at http://datatracker.ietf.org/drafts/current/. 36 Internet-Drafts are draft documents valid for a maximum of six months 37 and may be updated, replaced, or obsoleted by other documents at any 38 time. It is inappropriate to use Internet-Drafts as reference 39 material or to cite them other than as "work in progress." 41 This Internet-Draft will expire on May 1, 2017. 43 Copyright Notice 45 Copyright (c) 2016 IETF Trust and the persons identified as the 46 document authors. All rights reserved. 48 This document is subject to BCP 78 and the IETF Trust's Legal 49 Provisions Relating to IETF Documents 50 (http://trustee.ietf.org/license-info) in effect on the date of 51 publication of this document. Please review these documents 52 carefully, as they describe your rights and restrictions with respect 53 to this document. Code Components extracted from this document must 54 include Simplified BSD License text as described in Section 4.e of 55 the Trust Legal Provisions and are provided without warranty as 56 described in the Simplified BSD License. 58 Table of Contents 60 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 61 2. Path Protection . . . . . . . . . . . . . . . . . . . . . . . 4 62 3. Management-free Local Protection . . . . . . . . . . . . . . 5 63 3.1. Management-free Bypass Protection . . . . . . . . . . . . 5 64 3.2. Management-free Shortest Path Based Protection . . . . . 6 65 4. Managed Local Protection . . . . . . . . . . . . . . . . . . 6 66 4.1. Managed Bypass Protection . . . . . . . . . . . . . . . . 7 67 4.2. Managed Shortest Path Protection . . . . . . . . . . . . 7 68 5. Loop Avoidance . . . . . . . . . . . . . . . . . . . . . . . 8 69 6. Co-existence of multiple resilience techniques in the same 70 infrastructure . . . . . . . . . . . . . . . . . . . . . . . 8 71 7. Security Considerations . . . . . . . . . . . . . . . . . . . 9 72 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 73 9. Manageability Considerations . . . . . . . . . . . . . . . . 9 74 10. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 9 75 11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 76 12. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 77 12.1. Normative References . . . . . . . . . . . . . . . . . . 10 78 12.2. Informative References . . . . . . . . . . . . . . . . . 10 79 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10 81 1. Introduction 83 SPRING aims at providing a network architecture supporting services 84 with tight Service Level Agreements (SLA) guarantees 85 [I-D.ietf-spring-segment-routing]. This document reviews various use 86 cases for the protection of services in a SPRING network. 88 The resiliency use cases described in this document can be applied 89 not only to traffic that is forwarded according to the SPRING 90 architecture but also to traffic that originally is forwarded using 91 other paradigms such as LDP signalling or pure IP traffic (IP routed 92 traffic). 94 Three key alternatives are described: path protection, local 95 protection without operator management and local protection with 96 operator management. 98 Path protection lets the ingress node be in charge of the failure 99 recovery, as discussed in Section 2. 101 The rest of the document focuses on approaches where protection is 102 performed by the node adjacent to the failed component, commonly 103 referred to as local protection techniques or Fast Reroute 104 techniques. 106 In Section 3 we discuss two different approaches providing unmanaged 107 local protection, namely link/node bypass protection and shortest 108 path based protection. 110 Section 4 illustrates a case allowing the operator to manage the 111 local protection behavior in order to accommodate specific policies. 113 In Section 5 we discuss the opportunity for the SPRING architecture 114 to provide loop-avoidance mechanisms, such that transient forwarding 115 state inconsistencies during routing convergence do not lead into 116 traffic loss. 118 The purpose of this document is to illustrate the different 119 approaches and explain how an operator could combine them in the same 120 network (see Section 6). Solutions are not defined in this document. 122 B------C------D------E 123 /| | \ / | \ / |\ 124 / | | \/ | \/ | \ 125 A | | /\ | /\ | Z 126 \ | | / \ | / \ | / 127 \| |/ \|/ \|/ 128 F------G------H------I 130 Figure 1: Reference topology 132 We use Figure 1 as a reference topology throughout the document. 133 Following link metrics are applied: 135 Link metrics are bidirectional. In other words, the same metric 136 value is configured at both side of each link. 138 Links from/to A and Z are configured with a metric of 100. 140 CH, GD, DI and HE links are configured with a metric of 6. 142 All other links are configured with a metric of 5. 144 2. Path Protection 146 A first protection strategy consists in excluding any local repair 147 but instead use end-to-end path protection where each SPRING path is 148 protected by a second disjoint SPRING path. In this case local 149 protection MUST NOT be used. 151 For example, a Pseudo Wire (PW) from A to Z can be "path protected" 152 in the direction A to Z in the following manner: the operator 153 configures two SPRING paths T1 (primary) and T2 (backup) from A to Z. 155 The two paths maybe used concurrently or as a primary and backup path 156 where the secondary path is used when the primary failed. 158 T1 is established over path {AB, BC, CD, DE, EZ} as the primary path 159 and T2 is established over path {AF, FG, GH, HI, IZ} as the backup 160 path. As a requirement, the two paths MUST be disjoint in their 161 links, nodes or shared risk link groups (SRLGs). 163 In the case of primary/backup paths, when the primary path T1 is up, 164 the packets of the PW are sent on T1. When T1 fails, the packets of 165 the PW are sent on backup path T2. When T1 comes back up, the 166 operator either allows for an automated reversion of the traffic onto 167 T1 or selects an operator-driven reversion. Typically, the 168 switchover from path T1 to path T2 is done in a fast reroute fashion 169 (e.g.: sub-50 milliseconds range) but depending on the service that 170 needs to be delivered, other restoration times may be used. 172 It is essential that the primary and backup path benefit from an end- 173 to-end liveness monitoring/verification. The method and mechanisms 174 that provide such liveness check are outside the scope of this 175 document. 177 There are multiple options for liveness check, e.g., path liveness 178 where the path is monitored at the network level (either by the head- 179 end node or by a network controller/monitoring system). Another 180 possible approach consists of a service-based path monitored by the 181 service instance (verifying reachability of the endpoint). All these 182 options are given here as examples. While this document does express 183 the requirement for a liveness mechanism, it does not mandate, nor 184 define, any specific one. 186 From a SPRING viewpoint, we would like to highlight the following 187 requirements: 189 o SPRING architecture MUST provide a way to compute paths that MUST 190 NOT be protected by local repair techniques (as illustrated in the 191 example of paths T1 and T2). 193 o SPRING architecture MUST provide a way to instantiate pairs of 194 disjoint paths on a topology and based on a protection strategy 195 (link, node or SRLG protection) and allow the validation or re- 196 computation of these paths upon network events. 198 o The SPRING architecture MUST provide end-to-end liveness check of 199 SPRING based paths. 201 3. Management-free Local Protection 203 This section describes two alternatives providing local protection 204 without requiring operator management, namely bypass protection and 205 shortest-path based protection. 207 For example, a demand from A to Z, transported over the shortest 208 paths provided by the SPRING architecture, benefits from management- 209 free local protection by having each node along the path 210 automatically pre-compute and pre-install a backup path for the 211 destination Z. Upon local detection of the failure, the traffic is 212 repaired over the backup path in sub-50 milliseconds. 214 The backup path computation SHOULD support the following 215 requirements: 217 o 100% link, node, and SRLG protection in any topology. 219 o Automated computation by the IGP. 221 o Selection of the backup path such as to minimize the chance for 222 transient congestion and/or delay during the protection period, as 223 reflected by the IGP metric configuration in the network. 225 3.1. Management-free Bypass Protection 227 One way to provide local repair is to enforce a fail-over along the 228 shortest path around the failed component. 230 In case of link protection, the point of local repair will create a 231 repair path avoiding the protected link and merging back to primary 232 path at the nexthop. 234 In case of node protection, the repair path will avoid the protected 235 node and merge back to primary path at the next-nexthop. 237 In case of SRLG protection, the repair path will avoid members of the 238 same SRLG of the protected link and merge back to primary path just 239 after. 241 In our example, C protects destination Z against a failure of CD link 242 by enforcing the traffic over the bypass {CH, HD}. The resulting end- 243 to-end path between A and Z, upon recovery against the failure of CD, 244 is depicted in Figure 2. 246 B * * *C------D * * *E 247 *| | * / * \ / |* 248 * | | */ * \/ | * 249 A | | /* * /\ | Z 250 \ | | / * * / \ | / 251 \| |/ **/ \|/ 252 F------G------H------I 254 Figure 2: Bypass protection around link CD 256 3.2. Management-free Shortest Path Based Protection 258 An alternative protection strategy consists in management-free local 259 protection, aiming at providing a repair for the destination based on 260 the shortest path to the destination. 262 In our example, C protects Z, that it initially reaches via CD, by 263 enforcing the traffic over its shortest path to Z, considering the 264 failure of the protected component. The resulting end-to-end path 265 between A and Z, upon recovery against the failure of CD, is depicted 266 in Figure 3. 268 B * * *C------D------E 269 *| | * / | \ / |\ 270 * | | */ | \/ | \ 271 A | | /* | /\ | Z 272 \ | | / * | / \ | * 273 \| |/ *|/ \|* 274 F------G------H * * *I 276 Figure 3: Shortest path protection around link CD 278 4. Managed Local Protection 280 There may be cases where a management free repair does not fit the 281 policy of the operator. For example, in our illustration, the 282 operator may not want to have CD and CH used to protect each other 283 due the BW availability in each link and that could not suffice to 284 absorb the other link traffic. 286 In this context, the protection mechanism MUST support the explicit 287 configuration of the backup path either under the form of high-level 288 constraints (end at the next-hop, end at the next-next-hop, minimize 289 this metric, avoid this SRLG...) or under the form of an explicit 290 path. 292 We discuss such aspects for both bypass and shortest path based 293 protection schemes. 295 4.1. Managed Bypass Protection 297 Let us illustrate the case using our reference example. For the 298 demand from A to Z, the operator does not want to use the shortest 299 failover path to the nexthop, {CH, HD}, but rather the path {CG, GH, 300 HD}, as illustrated in Figure 4. 302 B * * *C------D * * *E 303 *| * \ / * \ / |* 304 * | * \/ * \/ | * 305 A | * /\ * /\ | Z 306 \ | * / \ * / \ | / 307 \| */ \*/ \|/ 308 F------G * * *H------I 310 Figure 4: Managed Bypass Protection 312 The computation of the repair path SHOULD be possible in an automated 313 fashion as well as statically expressed in the point of local repair. 315 4.2. Managed Shortest Path Protection 317 In the case of shortest path protection, the operator does not want 318 to use the shortest failover via link CH, but rather reach H via {CG, 319 GH}, for example, due to delay, BW, SRLG or other constraint. 321 The resulting end-to-end path upon activation of the protection is 322 illustrated in Figure 5. 324 B * * *C------D------E 325 *| * \ / | \ / |\ 326 * | * \/ | \/ | \ 327 A | * /\ | /\ | Z 328 \ | * / \ | / \ | * 329 \| */ \|/ \|* 330 F------G * * *H * * *I 332 Figure 5: Managed Shortest Path Protection 334 The computation of the repair path SHOULD be possible in an automated 335 fashion as well as statically expressed in the point of local repair. 337 The computation of the repair path based on a specific constraint 338 SHOULD be possible on a per-destination prefix base. 340 5. Loop Avoidance 342 It is part of routing protocols behavior to have what are called 343 "transient routing inconsistencies". This is due to the routing 344 convergence that happens in each node at different times and during a 345 different lapse of time. 347 These inconsistencies may cause routing loops that last the time that 348 it takes for the node impacted by a network event to converge. These 349 loops are called "microloops". 351 Usually, in a normal routing protocol operations, microloops do not 352 last long enough and in general they are noticed during the time it 353 takes for the network to converge. However, with the emerging of 354 fast-convergence and fast-reroute technologies, microloops may be an 355 issue in networks where sub-50 millisecond convergence/reroute is 356 required. Therefore, the microloop problem needs to be addressed. 358 A set of technologies preventing and addressing microloops have been 359 proposed (e.g.: [I-D.ietf-rtgwg-uloop-delay]). 361 Networks may be affected by microloops during convergence depending 362 of their topologies. Detecting microloops can be done during 363 topology computation (e.g.: SPF computation) and therefore 364 microloops-avoidance techniques may be applied. An example of such 365 technique is to compute microloop-free path that would be used during 366 network convergence. 368 The SPRING architecture SHOULD provide solutions to prevent the 369 occurrence of microloops during convergence following a change in the 370 network state. Traditionally, the lack of packet steering capability 371 made difficult to apply efficient solutions to microloops. A SPRING 372 enabled router could take advantage of the increased packet steering 373 capabilities offered by SPRING in order to steer packets in a way 374 that packets do not enter such loops. 376 6. Co-existence of multiple resilience techniques in the same 377 infrastructure 379 The operator may want to support several very different services on 380 the same packet-switching infrastructure. As a result, the SPRING 381 architecture SHOULD allow for the co-existence of the different use 382 cases listed in this document, in the same network. 384 Let us illustrate this with the following example: 386 o Flow F1 is supported over path {C, CD, E} 388 o Flow F2 is supported over path {C, CD, I} 390 o Flow F3 is supported over path {C, CD, Z} 392 o Flow F4 is supported over path {C, CD, Z} 394 It should be possible for the operator to configure the network to 395 achieve path protection for F1, management free shortest path local 396 protection for F2, managed protection over path {CG, GH, Z} for F3, 397 and management free bypass protection for F4. 399 7. Security Considerations 401 This document describes requirements for the SPRING architecture to 402 provide resiliency in SPRING networks. As such it does not introduce 403 any new security considerations compared to the ones related to the 404 SPRING architecture defined in [RFC7855] and 405 [I-D.ietf-spring-segment-routing]. 407 8. IANA Considerations 409 This document does not request any IANA allocations. 411 9. Manageability Considerations 413 This document provides use cases. Solutions aimed at supporting 414 these use cases should provide the necessary mechanisms in order to 415 allow for manageability as described in [RFC7855] and 416 [I-D.ietf-spring-segment-routing]. 418 Manageability concerns the computation, installation and 419 troubleshooting of the repair path. Also, necessary mechanisms 420 SHOULD be provided in order for the operator to control when a repair 421 path is computed, how it has been computed and if it's installed and 422 used. 424 10. Contributors 426 Pierre Francois contributed to the writing of the first version of 427 this document. 429 11. Acknowledgements 431 Authors would like to thank Stephane Litkowski and Alexander 432 Vainshtein for the comments and review of this document. 434 12. References 436 12.1. Normative References 438 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 439 Requirement Levels", BCP 14, RFC 2119, 440 DOI 10.17487/RFC2119, March 1997, 441 . 443 [RFC7855] Previdi, S., Ed., Filsfils, C., Ed., Decraene, B., 444 Litkowski, S., Horneffer, M., and R. Shakir, "Source 445 Packet Routing in Networking (SPRING) Problem Statement 446 and Requirements", RFC 7855, DOI 10.17487/RFC7855, May 447 2016, . 449 12.2. Informative References 451 [I-D.ietf-rtgwg-uloop-delay] 452 Litkowski, S., Decraene, B., Filsfils, C., and P. 453 Francois, "Microloop prevention by introducing a local 454 convergence delay", draft-ietf-rtgwg-uloop-delay-02 (work 455 in progress), June 2016. 457 [I-D.ietf-spring-segment-routing] 458 Filsfils, C., Previdi, S., Decraene, B., Litkowski, S., 459 and R. Shakir, "Segment Routing Architecture", draft-ietf- 460 spring-segment-routing-09 (work in progress), July 2016. 462 Authors' Addresses 464 Clarence Filsfils (editor) 465 Cisco Systems, Inc. 466 Brussels 467 BE 469 Email: cfilsfil@cisco.com 470 Stefano Previdi (editor) 471 Cisco Systems, Inc. 472 Via Del Serafico, 200 473 Rome 00142 474 Italy 476 Email: sprevidi@cisco.com 478 Bruno Decraene 479 Orange 480 FR 482 Email: bruno.decraene@orange.com 484 Rob Shakir 485 Google, Inc. 486 1600 Amphitheatre Parkway 487 Mountain View, CA 94043 489 Email: robjs@google.com