idnits 2.17.1 draft-lz-bess-srv6-service-capability-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 84: '... MUST be ignored and propagated unmo...' RFC 2119 keyword, line 183: '... implementations SHOULD provide a mech...' RFC 2119 keyword, line 245: '...hat BGP session, that BGP speaker MUST...' Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 11, 2021) is 1017 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'RFC7911' is mentioned on line 122, but not defined == Outdated reference: A later version (-15) exists of draft-ietf-bess-srv6-services-07 Summary: 1 error (**), 0 flaws (~~), 3 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 BESS WG Y. Liu 3 Internet-Draft Z. Zhang 4 Intended status: Standards Track ZTE Corporation 5 Expires: January 12, 2022 E. Metz 6 KPN 7 July 11, 2021 9 SRv6-based BGP Service Capability 10 draft-lz-bess-srv6-service-capability-01 12 Abstract 14 This draft describes the problems that may be encountered during the 15 deployment of SRv6-based BGP services and the possible solutions. 17 Status of This Memo 19 This Internet-Draft is submitted in full conformance with the 20 provisions of BCP 78 and BCP 79. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF). Note that other groups may also distribute 24 working documents as Internet-Drafts. The list of current Internet- 25 Drafts is at https://datatracker.ietf.org/drafts/current/. 27 Internet-Drafts are draft documents valid for a maximum of six months 28 and may be updated, replaced, or obsoleted by other documents at any 29 time. It is inappropriate to use Internet-Drafts as reference 30 material or to cite them other than as "work in progress." 32 This Internet-Draft will expire on January 12, 2022. 34 Copyright Notice 36 Copyright (c) 2021 IETF Trust and the persons identified as the 37 document authors. All rights reserved. 39 This document is subject to BCP 78 and the IETF Trust's Legal 40 Provisions Relating to IETF Documents 41 (https://trustee.ietf.org/license-info) in effect on the date of 42 publication of this document. Please review these documents 43 carefully, as they describe your rights and restrictions with respect 44 to this document. Code Components extracted from this document must 45 include Simplified BSD License text as described in Section 4.e of 46 the Trust Legal Provisions and are provided without warranty as 47 described in the Simplified BSD License. 49 Table of Contents 51 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 52 2. the Co-existence Scenario . . . . . . . . . . . . . . . . . . 2 53 3. SRv6-based BGP Service Capability . . . . . . . . . . . . . . 5 54 4. Security Considerations . . . . . . . . . . . . . . . . . . . 6 55 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 56 6. Normative References . . . . . . . . . . . . . . . . . . . . 6 57 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7 59 1. Introduction 61 [I-D.ietf-bess-srv6-services] defines procedures and messages for 62 SRv6-based services. When an egress PE is enabled for BGP Services 63 over SRv6 data-plane, it signals one or more SRv6 Service SIDs 64 enclosed in SRv6 Service TLV(s) within the BGP Prefix-SID 65 Attribute[RFC8669] attached to MP-BGP NLRIs. In other words, instead 66 of defining new AFI/SAFIs for SRv6-based services to separate the 67 SRv6-based service and MPLS-based service routes completely, this 68 proposal leverages the existing AFI/SAFIs of MPLS-based services . 70 There're two methods to encode SRv6 service SIDs in the 71 advertisement. 73 The first method, SRv6 Service SIDs are encoded as a whole in the 74 SRv6 Services TLVs and the MPLS Label field(s) of the corresponding 75 NLRI is set to Implicit NULL. 77 The second method is referred to as the Transposition Scheme in 78 [I-D.ietf-bess-srv6-services], the function and/or the argument part 79 of the SRv6 SID is encoded in the MPLS Label field of the NLRI and 80 the SID value in the SRv6 Services TLV carries only the locator part 81 of the SID. 83 [RFC8669] specifies that unknown TLVs in the BGP Prefix attribute 84 MUST be ignored and propagated unmodified. PEs that only support 85 MPLS may discard SRv6 Services TLV in the BGP Prefix attribute and 86 treat the label in the NLRI as VPN route label for MPLS VPN. 88 This draft describes the problems that may be encountered during the 89 deployment of SRv6-based services and the possible solutions. 91 2. the Co-existence Scenario 93 In the progress of network upgrading, some of the legacy devices that 94 only support MPLS/SR-MPLS will coexist with the new devices capable 95 of SRv6 for a long time. 97 As shown in Figure 1, PE1 is a legacy device that only supports MPLS- 98 based services. PE2 and PE3 support both MPLS-based and SRv6-based 99 services. There may be route reflector in the network to reflect the 100 service routes. S-RR is a service route reflector that supports both 101 MPLS and SRv6. 103 +-----+ 104 ................|S-RR |.................. 105 : +-----+ : 106 : : 107 : : 108 : : 109 : : 110 : +----------------+ : 111 : | |-------PE2...: 112 PE1-------| Backbone | : 113 | |-------PE3...: 114 +----------------+ 116 Figure 1: the Co-existence Scenario 118 On PE3, a SRv6 service SID sid-1 and a MPLS VPN route label label-1 119 are assigned for overlay service 1. 121 The SRv6 service SID and a MPLS VPN route label for the service 1 are 122 advertised in separate UPDATE messages. ADD-PATH[RFC7911] is used to 123 avoid path hiding. S-RR reflects both SRv6-VPN route and MPLS-VPN 124 route to PE1. Since PE1 only supports MPLS, it may discard the SRv6 125 Service TLV(s) in the BGP Prefix attribute and treat the SRv6-based 126 route as a MPLS-based route for service 1, then there're two MPLS- 127 based routes for the same service 1 on PE1. 129 Depending on whether the Transposition Scheme is used, the following 130 two scenarios are described separately. 132 Scenario 1: 134 If the Transposition Scheme is used, the function and/or argument 135 part of sid-1 is encoded in the MPLS Label field of the NLRI of the 136 SRv6-based service route. 138 PE1 may choose the route which is originally the SRv6-based route and 139 use the label field in the NLRI of this route as MPLS VPN label for 140 packet encapsulation. 142 Unless the allocation of SRv6 SIDs and MPLS labels on PE3 is aligned 143 to ensure compatibility, the interpretation of the function and/or 144 argument of the SRv6 SID (sid-1 in the example) will lead to 145 incorrect forwarding of the traffic. In the example above, at PE3 146 packets may 1) be sent to the wrong service instance, in case the 147 sid-1 function and/or argument value corresponds to an existing MPLS 148 label, or 2) be dropped, in case the value of sid-1 does not 149 correspond to an allocated MPLS label. 151 Scenario 2: 153 Sid-1 is encoded as a whole in the SRv6 Services TLV and the MPLS 154 Label field of the corresponding NLRI is set to Implicit NULL. 156 If the SRv6 Services TLV in the UPDATE messages is discarded by PE1, 157 from PE1's aspect, it has received a MPLS service route with an 158 Implicit NULL label. 160 How to deal with the MPLS-based route with an Implicit NULL label is 161 not standardized, different vendors may have different processing 162 procedures which are unpredictable, e.g, set the route to invalid, 163 send the packet to service 1 without the service route label or 164 something else. 166 On PE2, only SRv6-based service is configured. 168 PE1 may receive SRv6 service routes from PE2 which supports SRv6 169 only, and discard the SRv6 Service TLV(s) in the BGP Prefix attribute 170 and treat the function and/or argument part of SRv6 service SID as a 171 MPLS VPN route label. PE1 may 1) not send packets to PE2 since 172 there's no LSP between PE1 and PE2 2) send packets encapsulated in 173 IPv6 to PE2 if there's route to PE2. 175 If the label field in the NLRI is Implicit NULL, how PE1 deals with 176 it is unpredictable. 178 Overall, in the co-existence scenario, if the SRv6-based service 179 routes are advertised to legacy devices, it may result in service 180 failure and/or abnormal extra traffic flows in the network. 182 To avoid these problems, [I-D.ietf-bess-srv6-services] specifies that 183 implementations SHOULD provide a mechanism to control advertisement 184 of SRv6-based BGP service routes on a per neighbor and per service 185 basis. 187 This can be done by configuration. First the network operator must 188 obtain whether the PEs in the network are capable of SRv6-based 189 services. Then the operator should config on PEs or route reflectors 190 based on each PE's capability, the configuration is per neighbor. 192 If there's a service route reflector, configurations on S-RR should 193 ensure that the SRv6 service routes would not be reflected to legacy 194 devices like PE1 that don't support SRv6. 196 If there's no route reflector in the network, which neighbors can the 197 SRv6 service routes be advertised to should be specified when 198 configuring SRv6 services on the PEs. 200 The above method may be feasible in small-scale networks, but are not 201 applicable to large-scale networks. 203 The main reasons are: 205 a) The per neighbor configuration need to change with the device 206 capability. When a PE is upgraded to support SRv6-based services or 207 rolled back to an old version that only supports MPLS, the 208 configuration on its neighbors or the RR should be changed to add 209 this PE to or exclude it from the advertisement of SRv6-based BGP 210 service routes. 212 Although this may be done automatically by the network management 213 system, it is still not a easy job in a large-scale network and is 214 not flexible enough. 216 b) The additional steps of device capability acquisition and 217 capability based configuration increase the fault probability and 218 troubleshooting difficulty. If the service from PE1 to PE3 fails, 219 the operator needs to confirm the capability for SRv6-based service 220 of the two devices, and then check the configuration on PE3 or RR to 221 make sure that the SRv6-based service route is not advertised to PE1. 223 c) There is no standard solution for the network operator to obtain 224 the PE's capability for SRv6-based services. If there are devices 225 from multiple vendors in the network, there may be interconnection 226 problems. 228 3. SRv6-based BGP Service Capability 230 If the BGP speaker can obtain the capability for SRv6-based services 231 of its peers, the advertisement of SRv6-based BGP service routes can 232 be controlled. 234 [RFC5492] defines the "Capabilities Optional Parameter". A BGP 235 speaker can include a Capabilities Optional Parameter in a BGP OPEN 236 message. This allows BGP speakers to communicate capabilities. The 237 Capabilities Optional Parameter is a triple that includes a one-octet 238 Capability Code, a one-octet Capability length, and a variable-length 239 Capability Value. 241 This document defines a Capability Code for SRv6-based BGP service 242 capability. If a BGP speaker has not sent the SRv6-based BGP service 243 capability in its BGP OPEN message on a particular BGP session, or if 244 it has not received the SRv6-based BGP service capability in the BGP 245 OPEN message from its peer on that BGP session, that BGP speaker MUST 246 NOT send on that session any UPDATE message that includes the SRv6 247 service TLVs. Like other capabilities, if the capability for 248 SRv6-based services is enabled or removed, an established session 249 needs to be reset to resend the OPEN message. 251 In this way, the advertisement of SRv6-based BGP service routes is 252 controlled without per neighbor configuration, which makes it easier 253 to implement and manage in the network. 255 In the co-existence scenario, the SRv6-based service routes would 256 only be exchange between devices that support it based on this 257 capability. There would not be no UPDATE message that includes the 258 SRv6 service TLV received by legacy devices. 260 Back to the scenario in Figure 1, since PE1 only supports MPLS and 261 has not sent the SRv6-based BGP service capability in the OPEN 262 message, the S-RR will not reflect the SRv6-based service routes of 263 PE2 or PE3 to PE1, while the MPLS service routes from PE3 are 264 reflected to PE1. So PE1 wouldn't receive any SRv6 SRv6-based 265 service routes that may be misinterpretted, and the MPLS-based 266 service between PE1 and PE3 is unaffected. 268 4. Security Considerations 270 This extension to BGP does not change the underlying security issues 271 inherent in [RFC5492] and [I-D.ietf-bess-srv6-services]. 273 5. IANA Considerations 275 This document defines a new Capability Codes option, named "SRv6 276 Service Capability" with an assigned value to indicate that a 277 BGP speaker supports SRv6-based services. The length of this 278 capability is 1. 280 6. Normative References 282 [I-D.ietf-bess-srv6-services] 283 Dawra, G., Filsfils, C., Talaulikar, K., Raszuk, R., 284 Decraene, B., Zhuang, S., and J. Rabadan, "SRv6 BGP based 285 Overlay Services", draft-ietf-bess-srv6-services-07 (work 286 in progress), April 2021. 288 [RFC5492] Scudder, J. and R. Chandra, "Capabilities Advertisement 289 with BGP-4", RFC 5492, DOI 10.17487/RFC5492, February 290 2009, . 292 [RFC8669] Previdi, S., Filsfils, C., Lindem, A., Ed., Sreekantiah, 293 A., and H. Gredler, "Segment Routing Prefix Segment 294 Identifier Extensions for BGP", RFC 8669, 295 DOI 10.17487/RFC8669, December 2019, 296 . 298 Authors' Addresses 300 Liu Yao 301 ZTE Corporation 302 Nanjing 303 China 305 Email: liu.yao71@zte.com.cn 307 Zhang Zheng 308 ZTE Corporation 309 Nanjing 310 China 312 Email: zhang.zheng@zte.com.cn 314 Eduard Metz 315 KPN 316 Netherlands 318 Email: etmetz@gmail.com