| BESS Working Group | H. Jeng |
| Internet-Draft | AT&T |
| Intended status: Standards Track | L. Jalil |
| Expires: September 7, 2015 | Verizon |
| R. Bonica | |
| Juniper Networks | |
| K. Patel | |
| Cisco Systems | |
| L. Yong | |
| Huawei Technologies | |
| March 6, 2015 |
Covering Prefixes Outbound Route Filter for BGP-4
draft-ietf-bess-orf-covering-prefixes-06
This document defines a new Outbound Route Filter (ORF) type, called the "Covering Prefixes ORF (CP-ORF)". CP-ORF is applicable in Virtual Hub-and-Spoke VPNs. It also is applicable in BGP/MPLS Ethernet VPN (EVPN) networks.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 7, 2015.
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
A BGP [RFC4271] speaker can send Outbound Route Filters (ORF) [RFC5291] to a peer. The peer uses ORFs to filter routing updates that it sends to the BGP speaker. Using ORF, a BGP speaker can realize a "route pull" paradigm, in which the BGP speaker, on demand, pulls certain routes from the peer.
This document defines a new ORF-type, called the "Covering Prefixes ORF (CP-ORF)". A BGP speaker sends a CP-ORF to a peer in order to pull routes that cover a specified host address. A prefix covers a host address if it can be used to forward traffic towards that host address. Section 3 provides a more complete description of covering prefix selection criteria.
CP-ORF is applicable in Virtual Hub-and-Spoke VPNs [RFC7024] [RFC4364]. It also is applicable BGP/MPLS Ethernet VPN (EVPN) [RFC7432] networks.
This document uses the following terms:
RFC 5291 augments the BGP ROUTE-REFRESH message so that it can carry ORF entries. When the ROUTE-REFRESH message carries ORF entries, it includes the following fields:
The ROUTE-REFRESH message also contains a list of ORF entries. Each ORF entry contains the following fields:
The ORF entry may also contain Type-specific information. Type-specific information is present only when the Action is equal to ADD or REMOVE. It is not present when the Action is equal to REMOVE-ALL.
When the BGP ROUTE-REFRESH message carries CP-ORF entries, the following conditions MUST be true:
Figure 1 depicts the encoding of the CP-ORF type-specific information.
+--------------------------------+
| Sequence (32 bits) |
+--------------------------------+
| Minlen (8 bits) |
+--------------------------------+
| Maxlen (8 bits) |
+--------------------------------+
| VPN Route Target (64 bits) |
+--------------------------------+
| Import Route Target (64 bits) |
+--------------------------------+
| Route Type (8 bits) |
+--------------------------------+
| Host Address |
| (0, 32, 48 or 128 bits) |
| ....
+--------------------------------+
Figure 1: CP-ORF Type-specific Encoding
The CP-ORF recipient uses the following fields to select routes matching the CP-ORF:
See Section 3 for details.
The CP-ORF recipient marks routes that match CP-ORF with the Import Route Target before advertising those routes to the CP-ORF originator. See Section 3 for details.
If the ROUTE-REFRESH AFI is equal to IPv4:
If the ROUTE-REFRESH AFI is equal to IPv6:
If the ROUTE-REFRESH AFI is equal to L2VPN, the value of Route Type MUST be one of the following values, taken from IANA EVPN Registry [IANA.EVPN]:
If the ROUTE-REFRESH AFI is equal to L2VPN and the value of Route Type is equal to Ethernet Autodiscovery Route, Inclusive Multicast Route, or Ethernet Segment Route:
If the ROUTE-REFRESH AFI is equal to L2VPN and the value of Route Type is equal to MAC/IP Advertisement Route:
According to [RFC4271], every BGP speaker maintains a single Loc-RIB. For each of its peers, the BGP speaker also maintains an Outbound Filter and an Adj-RIB-Out. The Outbound Filter defines policy that determines which Loc-RIB entries are processed into the corresponding Adj-RIB-Out. Mechanisms such as RT-Contstrain [RFC4684] and ORF [RFC5291] enable a router's peer to influence the Outbound Filter. Therefore, the Outbound Filter for a given peer is constructed using a combination of the locally configured policy and the information received via RT-Constrain and ORF from the peer.
Using this model we can describe the operations of CP-ORF as follows:
When a BGP speaker receives a ROUTE-REFRESH message that contains a CP-ORF, and that ROUTE-REFRESH message violates any of the encoding rules specified in Section 2, the BGP speaker MUST ignore the entire ROUTE-REFRESH message. It SHOULD also log the event. However, an implementation MAY apply logging thresholds to avoid excessive messaging or log file overflow.
Otherwise, the BGP speaker processes each CP-ORF entry as indicated by the Action field. If the Action is equal to ADD, the BGP speaker adds the CP-ORF entry to the Outbound Filter associated with the peer in the position specified by the Sequence field. If the Action is equal to REMOVE, the BGP speaker removes the CP-ORF entry from the Outbound Filter. If the Action is equal to REMOVE-ALL, the BGP speaker removes all CP-ORF entries from the Outbound Filter.
Whenever the BGP speaker applies an Outbound Filter to a route contained in its Loc-RIB, it evaluates the route in terms of the CP-ORF entries first. It then evaluates the route in terms of the remaining, non-CP-ORF entries. The rules for the former are described below. The rules for the latter are outside the scope of this document.
The following route types can match a CP-ORF:
In order for an IPv4-VPN route or IPv6-VPN route to match a CP-ORF, all of the following conditions MUST be true:
The BGP speaker ignores Route Distinguishers when determining whether a prefix matches a host address. For example, assume that a CP-ORF carries the following information:
Assume also that Loc-RIB contains routes for the following IPv4-VPN prefixes, and that all of these routes carry an RT whose value is the same as the CP-ORF VPN Route Target:
Only the prefix 3:192.0.2.0/89 matches the CP-ORF. The prefix 1:0.0.0.0/64 does not match, because its length (64) is less than the CP-ORF Minlen (1) plus the length of an L3VPN Route Distinguisher (64). If Loc-RIB did not contain the prefix 3:192.0.2.0/89, 2:192.0.2.0/88 would match the CP-ORF. However, because Loc-RIB also contains a more specific covering route (3:192.0.2.0/89), 2:192.0.2.0/88 does not match. Only 3:192.0.2.0/89 satisfies all of the above listed match criteria. Note that the matching algorithm ignored Route Distinguishers.
In order for an EVPN route to match a CP-ORF, all of the following conditions MUST be true:
In addition, if the CP-ORF Route Type is equal to MAC/IP Advertisement Route, the following conditions also MUST be true:
If a route matches the selection criteria of a CP-ORF entry, and it does not violate any subsequent rule specified by the Outbound Filter (e.g., rules that reflect local policy, or rules that are due to RT-Constrains), the BGP speaker places the route into the Adj-RIB-Out. In Adj-RIB-Out, the BGP speaker adds the CP-ORF Import Route Target to the list of Route Targets that the route already carries. The BGP speaker also adds a Transitive Opaque Extended Community [RFC4360] with subtype equal to CP-ORF (0x03). As a result of being placed in Adj-RIB-Out, the route is advertised to the peer associated with the Adj-RIB-Out.
Receiving CP-ORF entries with REMOVE or REMOVE-ALL Actions may cause a route that has previously been installed in a particular Adj-RIB-Out be excluded from that Adj-RIB-Out. In this case, as specified in [RFC4271], "the previously advertised route in that Adj-RIB-Out MUST be withdrawn from service by means of an UPDATE message".
RFC 5291 states that a BGP speaker should respond to a ROUTE REFRESH message as follows:
"If the When-to-refresh indicates IMMEDIATE, then after processing all the ORF entries carried in the message the speaker re-advertises to the peer routes from the Adj-RIB-Out associated with the peer that have the same AFI/SAFI as what is carried in the message, and taking into account all the ORF entries for that AFI/SAFI received from the peer. The speaker MUST re-advertise all the routes that have been affected by the ORF entries carried in the message, but MAY also re-advertise the routes that have not been affected by the ORF entries carried in the message."
When the ROUTE-REFRESH message includes only CP-ORF entries, the BGP speaker MUST re-advertise routes that have been affected by these CP-ORF entries. It is RECOMMENDED not to re-advertise the routes that have not been affected by the CP-ORF entries.
The behavior when the ROUTE-REFRESH message includes one or more CP-ORF entries and one or more ORF entries of a different type remains unchanged from that described in RFC 5291.
In a Virtual Hub-and-Spoke environment, VPN sites are attached to Provider Edge (PE) routers. For a given VPN, a PE router acts in exactly one of the following roles:
To illustrate CP-ORF operation in conjunction with Virtual Hub-and-Spoke assume the following:
All of these PEs advertise RED-VPN routes to a route reflector (RR). They mark these routes with a route target, which we will call RT-RED. In particular, PE1 advertises a RED-VPN route to a prefix that we will call P. P covers a host address, that we will call H.
For the purpose of illustration also assume that the PEs and the RRs use Route Target Constraint [RFC4684].
V-hub1 serves the RED-VPN. Therefore, V-hub1 advertises a VPN IP default route for the RED-VPN to the RR, carrying the route target RT-RED-FROM-HUB1.
V-spoke1 establishes a BGP session with the RR, negotiating the CP-ORF capability, as well as the Multiprotocol Extensions Capability [RFC4760]. Upon establishment of the BGP session, the RR does not advertise any routes to V-spoke1. The RR will not advertise any routes until it receives either a ROUTE-REFRESH message or a BGP UPDATE message containing a Route Target Membership NLRI [RFC4684].
Immediately after the BGP session is established, V-spoke1 sends the RR a BGP UPDATE message containing a Route Target Membership NLRI. The Route Target Membership NLRI specifies RT-RED-FROM-HUB1 as its route target. In response to the BGP-UPDATE message, the RR advertises the VPN IP default route for the RED-VPN to V-spoke1. This route carries the route target RT-RED-FROM-HUB1. V-spoke1 subjects this route to its import policy and accepts it because it carries the route target RT-RED-FROM-HUB1.
Now, V-spoke1 begins normal operation, sending all of its RED-VPN traffic through V-hub1. At some point, V-spoke1 determines that it might benefit from a more direct route to H. (Criteria by which V-spoke1 determines that it needs a more direct route to H are beyond the scope of this document.)
In order to discover a more direct route, V-spoke1 assigns a unique numeric identifier to H. V-spoke1 then sends a ROUTE-REFRESH message to the RR, containing the following information:
Upon receipt of the ROUTE-REFRESH message, the RR MUST ensure that it carries all routes belonging to the RED-VPN. In at least one special case, where all of the RR clients are V-spokes and none of the RR clients are V-hubs, the RR will lack some or all of the required RED-VPN routes. So, the RR sends a BGP UPDATE message containing a Route Target Membership NLRI for VPN-RED to all of its peers. This causes the peers to advertise VPN-RED routes to the RR, if they have not done so already.
Next, the RR adds the received CP-ORF to the Outbound Filter associated with V-spoke1. Using the procedures in Section 3, the RR determines whether any of the routes in its Loc-RIB satisfy the selection criteria of the newly updated Outbound Filter. If any routes satisfy the match criteria, they are added to the Adj-RIB-Out associated with V-spoke1. In Adj-RIB-Out, the RR adds RT-RED-FROM-HUB1 to the list of Route Targets that the route already carries. The RR also adds a Transitive Opaque Extended Community [RFC4360] with subtype equal to CP-ORF. Finally, RR advertises the newly added routes to V-spoke1. In this example, the RR advertises P to V-Spoke1 with a next-hop of PE1.
V-spoke1 subjects the advertised routes to its import policy and accepts them because they carry the route target RT-RED-FROM-HUB1.
V-spoke1 may repeat this process whenever it discovers another flow that might benefit from a more direct route to its destination.
When applying Multicast VPN [RFC6513][RFC6514] procedures, routes bearing a Transitive Opaque Extended Community [RFC4360] with subtype equal to CP-ORF MUST NOT be used to determine Eligible Upstream Multicast Hops (UMH).
In a EVPN environment, CE devices are attached to Provider Edge (PE) routers. A CE can be a host, a router or a switch. For a given EVPN Instance (EVI), a PE router acts in exactly one of the following roles:
To illustrate CP-ORF operation in the EVPN environment assume the following:
All of these PEs advertise RED-EVI routes to a RR. They mark these routes with a route target, which we will call RT-RED. In particular, PE1 advertises a RED-EVI route to a MAC Address that we will call M.
The RED-EVI VRFs on all of these PEs are provisioned to import EVPN routes that carry RT-RED.
Since DMG1 acts as a DMG for RED-EVI, DMG1 advertises a Unknown MAC Route (UMR) for the RED-EVI to the RR, carrying the route target RT- RED. The UMR is characterized as follows:
Spoke1 establishes a BGP session with the RR, negotiating the CP-ORF capability, as well as the Multiprotocol Extensions Capability [RFC4760]. Upon establishment of the BGP session, the RR does not advertise any routes to Spoke1. The RR will not advertise any routes until it receives a ROUTE-REFRESH message.
Immediately after the BGP session is established, Spoke1 sends the RR a ROUTE REFRESH message containing the following information:
The ROUTE REFRESH message also contains four ORF entries. The first ORF entry contains the following information:
The second ORF entry contains the following information:
The third ORF entry contains the following information:
The fourth ORF entry contains the following information:
In response to the ROUTE REFRESH message, the RR advertises the following to V-spoke1:
All of these routes carries the route target RT-RED. Spoke1 subjects these routes to its import policy and accepts them because they carry the route target RT-RED.
Now, Spoke1 begins normal operation, sending all of its RED-VPN traffic through DMG1. At some point, Spoke1 determines that it might benefit from a more direct route to M. (Criteria by which Spoke1 determines that it needs a more direct route to M are beyond the scope of this document.)
In order to discover a more direct route, Spoke1 assigns a unique numeric identifier to M. V-spoke1 then sends a ROUTE-REFRESH message to the RR, containing the following information:
Next, the RR adds the received CP-ORF to the Outbound Filter associated with Spoke1. Using the procedures in Section 3, the RR determines whether any of the routes in its Loc-RIB satisfy the selection criteria of the newly updated Outbound Filter. If any routes satisfy the match criteria, they are added to the Adj-RIB-Out associated with Spoke1. The RR adds a Transitive Opaque Extended Community [RFC4360] with subtype equal to CP-ORF. Note that as these routes are added to the Adj-RIB-Out, the RR does not change the list of Route Targets that the route already carries. Finally, RR advertises the newly added routes to V-spoke1. In this example, the RR advertises M to V-Spoke1 with a next-hop of PE1.
Spoke1 subjects the advertised routes to its import policy and accepts them because they carry the route target RT-RED.
Spoke1 may repeat this process whenever it discovers another flow that might benefit from a more direct route to its destination.
Note that in general an EVI may have more than one DMG, in which case each spoke would receive a UMR from each of them. The spoke should follow its local route selection procedures to select one of them as the "best", and use the selected one.
Each CP-ORF consumes memory and compute resources on the device that supports it. Therefore, in order to obtain optimal performance, BGP speakers periodically evaluate all CP-ORFs that they have originated and remove unneeded CP-ORFs. The criteria by which a BGP speaker identifies unneeded CP-ORF entries is a matter of local policy, and is beyond the scope of this document.
This memo uses code points from the first-come-first-served range of the following registries:
| Registry | Code Point |
|---|---|
| BGP Outbound Route Filtering (ORF) Types | CP-ORF (65) |
| Transitive Opaque Extended Community Sub-Type | CP-ORF (0x03) |
IANA is requested to update the above mentioned registry entries so that they include a stable reference to this memo.
Each CP-ORF consumes memory and compute resources on the device that supports it. Therefore, a device supporting CP-ORF takes the following steps to protect itself from oversubscription:
Security considerations for BGP are presented in RFC4271 while further security analysis of BGP is found in [RFC6952].
The following individuals contributed to the development of this document:
The authors wish to acknowledge Han Nguyen, James Uttaro and Alvaro Retana for their comments and contributions.
| [IANA.AFI] | IANA, "Address Family Numbers", . |
| [IANA.EVPN] | IANA, "Ethernet VPN (EVPN)", . |
| [IANA.SAFI] | IANA, "Subsequent Address Family Identifiers (SAFI) Parameters", . |
| [RFC4364] | Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private Networks (VPNs)", RFC 4364, February 2006. |
| [RFC6952] | Jethanandani, M., Patel, K. and L. Zheng, "Analysis of BGP, LDP, PCEP, and MSDP Issues According to the Keying and Authentication for Routing Protocols (KARP) Design Guide", RFC 6952, May 2013. |