| Internet-Draft | EVPN Context Label | August 2020 |
| Wang & Song | Expires 21 February 2021 | [Page] |
EVPN is designed to provide a better VPLS service than [RFC4761] and [RFC4762], and EVPN indeed introduced many new features which couldn't be achieved in those old VPLS implementions. But EVPN didn't inherit all features of old VPLS, and a few issues arises for EVPN only.¶
Some of these issues can be imputed to the MP2P nature of EVPN labels. The PW label in old VPLS is a label for P2P VC, so it contains more context than a identifier in dataplane for it's VSI instance.But the EVPN label just identifies it's VSI instnace and it can't stand for the ingress PE in dataplane. So the following issues arises with MPLS EVPN service:¶
This document introduces a compound label stack to take advantage of both P2P VC and MP2P evpn labels.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 21 February 2021.¶
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
This document uses the following acronyms and terms:¶
EVPN is designed to provide a better VPLS service than RFC4761/RFC4762, and EVPN indeed introduced many new features which couldn't be achieved in those old VPLS implemention.But EVPN didn't inherit all features of old VPLS, and a few issues arises for EVPN only.¶
Some of these issues can be imputed to the MP2P nature of EVPN labels. The PW label in old VPLS is a label for P2P VC, so it contains more context than an identifier in dataplane for it's VSI instance. But the EVPN label just identifies it's VSI instnace and it can't stand for the ingress PE in dataplane. So the following issues arises with MPLS EVPN service:¶
So this document introduces an compound label stack to take advantage of both P2P VC and MP2P EVPN labels.¶
In order to add as much context as old VPLS to EVPN data packet, We can construct an infrastructure by a full-mesh of context-VCs among the EVPN PEs.¶
Take the context-VCs between PE-i and PE-j as an example, VC-ij is the context-VC from PE-i to PE-j, and VC-ji is the context-VC from PE-j to PE-i. The VC-ij identifies the PE-i node on PE-j. The VC-ji identifies PE-j node on PE-i. The VC-label for VC-ij is called as L-ij, and the VC-label for VC-ji is called as L-ji.¶
So the PE-i can push the L-ij onto the EVPN data packet for PE-j to distinguish the packet of PE-i from other data packets. Because that the L-ij identifies the ingress PE of the data packet.¶
There are two styles of context-VC in this draft. One style is named as shared context-VC, the other style is named as per-EVI context VC.¶
The shared context-VCs are dedicated to identify the context for a data packet while the EVPN label still identifies the EVPN instance.¶
Note that typically a shared context VC can be shared by all EVPN instances between it's ingress PE and egress PE. In other words, we don't have to establish a dedicated mesh of context VCs for each specified EVPN service. So we called the shared context VCs as a common infrastructure for those EVPN services.¶
The per-EVI context VCs are used to identify both the context (typically the ingress-PE) and the EVPN instance for a data packet at the same time. In other words, we have to establish a dedicated set of per-EVI context VCs for each specified EVPN service.¶
The IMET route per [RFC7432] have a corresponding route-type in MVPN. It is, in effect, the Intra-AS I-PMSI route per [RFC6514]. The difference between them is that an IMET route won't handle a responding Leaf A-D route, but an Intra-AS I-PMSI route will.¶
The Leaf A-D route per [I-D.ietf-bess-evpn-bum-procedure-updates] is required for per-EVI context VCs. In this draft, we use the Leaf A-D route with IR-PTA to establish per-EVI context-VCs. The Leaf A-D route is generated for an IMET route.¶
It is an update for [RFC7432]. The backward compatibility will be described in Section 4.4.¶
PE1 will construct a Leaf A-D route with IR-PTA for EVI1 in response to an IMET route R1 with IR-PTA. The IMET route R1 is received from PE2 previously. The key fields of the IMET route is included in the "Route Key" field of the Leaf A-D route (say R2) along with the ORIP of PE1 itself. We call the ORIP of PE1 itself as the Leaf A-D route's "self-ORIP" in order to distinguish it from the Leaf A-D route's Root-ORIP. So the "Route Type sepcific" field of the Leaf A-D route is per <EVI1, PE2> basis.¶
The MPLS label field in the IR-PTA of the Leaf A-D route is allocated per <EVI1, PE2> basis in per-platform label space on PE1. So the per-EVI context VC can identify the EVI1 too.¶
Note that PE1 may already advertise an IMET route R3 to PE2 before the advertisement of above Leaf A-D route.¶
Note that the per <EVI,Ingress PE> basis label allocation (see Section 4.1.1) may consume too many labels in per-platform label space. Sometimes we want to use the same EVPN label in all Leaf A-D routes and IMET routes of the same EVI. So we allocate a context-specific label (CSL) for a context VC in this section.¶
The EVPN label is still allocated from per-platform label space, and it identifies the EVPN instance as per [RFC7432]. But it also identifies a context label space CLS1. The VC label of the context VC is allocated in CLS1. So we say that the VC label is a context-specific VC label.¶
The encapsulation of the Context-Specific VC Label is illustrated as the following figure:¶
+---------------------------------+ | underlay ethernet header | +---------------------------------+ | PSN tunnel label | +---------------------------------+ | EVPN label | +---------------------------------+ | Context VC Label | +---------------------------------+ | overlay ethernet or IP header | +---------------------------------+
Note that the Context-VC Label here is not the Context Label Space (CLS) ID of the EVPN Label. But the EVPN label is the CLS-ID of the Context-VC Label. That's why the Context Label Space ID EC (see section 3.1 of [I-D.ietf-bess-mvpn-evpn-aggregation-label]) is not appropriate for such encapsulation.¶
We introduce a new BGP Extended Community called Context-specific Label (CSL) Entry Extended Community, the CSL-Entry EC was used to carry the downstream-assigned context-specific VC labels.¶
CSL-Entry Extended Community is a new Transitive Opaque EC with the following structure (Sub-Type value to be assigned by IANA):¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x03 or 0x43 | Sub-Type | CSL-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CSL-Value | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "sub-type" field of the CSL-Entry EC has a different codepoint from the CLS-ID EC. The CSL-Value of the CSL-Entry EC is a MPLS label in a context-specific label space identified by the PTA label. And the MPLS label in the CSL-Entry EC will be pushed onto the label stack before the PTA label by the ingress PE. Typically, the MPLS label of the CSL-Entry EC is a downstream assigned label, which means that it will be used as an outgoing label by the PE receiving the CSL-Entry EC, not as incomming label.¶
When constructing the Leaf A-D route, the IR-PTA label is the EVPN Label, as per [RFC7432]. But the CSL-value in the CSL-Entry EC is a label (say L1) that is allocated per TPE basis in CLS1. In fact, L1 is the context-specific VC label of the context VC of that ingress TPE. That's why the context VC is called as CSL-based context VC. So the CLS1-specific VC label need to be pushed onto the label stack before EVPN Label (which identifies CLS1) on ingress PEs.¶
Note that when the PTA label is changed to a new value (caused by the BGP nexthop rewriting) by the SPE nodes, the CSL-Entry in the same EVPN route won't be rewrite. This is similar to the behavior of ESI Label EC of EAD per ES route.¶
Note that when an ingress PE sends traffic, it imposes the CSL before it imposes the PTA label of the same EVPN route. That's the obvious difference from the Context Label Space ID EC (see section 3.1 of [I-D.ietf-bess-mvpn-evpn-aggregation-label]).¶
Note that the CSL-Entry ECs (for different EVIs) received from the same TPE may be the same label, because that all EVLs on the same PE may identify the same Context-specific Label Space (CLS). So we can select a single EVI to use the Leaf A-D route with CSL-Entry EC in such case. This EVI is called as administrating EVI (admin-EVI). The context VC label carried in the Leaf A-D routes of the admin-EVI will be used to take the place of the PTA label of the IMET route with the same ORIP in all other ordinary EVIs in such case.¶
Note that all other ordinary EVIs don't have to use the Leaf A-D routes with IR-PTA in their signalling procedures, they can use ordinary IMET routes instead. The admin-EVI need to be configured on all EVPN-PEs in such case.¶
The admin EVIs may allocate the VC labels of its context VCs in the per-platform label space.¶
Even if these VC labels are allocated in the per-platform label space, The CSL-Entry EC is still necessary.¶
Because that the Context VC is not expected to be used to determine the forwarding path of the data packet. They just identify the context of the data packet (typically the ingress PE of the data packet). So they should not be rewritten even when the nexthop of the EVPN route is rewriten. When the Leaf routes use PTA label (instead of CSL-entry EC) to carry the Context VC Label, The PTA label will be rewritten on SPE nodes. It is just not our expectation.¶
Note that the SPEs don't have to recognize the CSL-Entry EC, because that it's a transitive opaque EC. The EVPN label of the admin-EVIs in the PTA is unuseful. But they should also be included so as to pass though the SPE nodes.¶
T1: ===R3(IMET)======>
PE1----------------------------PE2
T2: <==R1(IMET)=======
T3: ===R2(Leaf A-D)==>
PE2 receives (at time T3) the responding Leaf A-D route (say R2) of the IMET route R1 which is previously (at time T2) advertised by itself, and PE2 preiously (at time T1) received an IMET route R3 whose ORIP is the same as the self-ORIP of R2 . Given that R1,R2 and R3 both have a IR-PTA, PE2 SHOULD use R2 to install the Ingress Replication List (IRL) item for PE1 instead, and R3 will not used to install the IRL-item for PE1 from then on.¶
Note that when R2 included a CSL-Entry EC, the CSL-value of the CSL-Entry EC will be used as the outgoing label of the IRL-item. The MPLS label of the IR-PTA will be used as the context label (CL) of the CSL-Entry in NHLFE. No ILM entry will be installed for the CSL of R2 on PE2.¶
Note that when PE2 sent R1 (at time T2) to other PEs(including PE1), it will set the LIR flag of R1 to one. At the same time, PE2 will add an import RT (say RT1) to the EVPN instance. When PE1 send R2 (at time T3) to PE2 as R1's reply, PE1 will add the same RT1 to R2, because PE1 assumes that RT1 should have been added to the EVPN instance by PE2 as an import RT. Otherwise PE2 wouldn't set the LIR flag to one during the advertisement of R1.¶
In [RFC7432], the LIR flag of IMET route is required to be zero when it is advertised and to be ignored on receipt.¶
It means that the LIR flag is reserved by [RFC7432], but it technically can be used in the future. What should the LIR flag be restrained in the future use is no more severer than any other reserved PTA flags in the IMET routes.¶
So when PE2 set the LIR flag to one in the IMET route and send it to PE1, PE2 won't expect that the IMET route must be responded by a Leaf A-D. When the corresponding Leaf A-D route can't be received from PE1, the IMET route from PE1 still be used as per [RFC7432]. But when PE1 is a new PE following this draft, PE1 will indeed respond a Leaf A-D route for the IMET route.¶
The EVPN S-PMSI routes for (C-*,C-*) may be a succedaneum of IMET routes. Such EVPN S-PMSI route is called wildcard S-PMSI route in these document. The LIR flag of wildcard S-PMSI route is not reserved. So there won't be any controversial issues on the compatibilities of Leaf A-D route responsing. But we prefer the IMET routes, because the IMET routes with non-zero LIR flag won't conflict with [RFC7432] either.¶
PEs3--------RR2--------+
PEh------CE3
CE1----PEs1--------RR1--------+
/
CE2----PEs2-------/
Now take above use case for example, there are three spoke PEs and one hub PE. The spoke PEs are PEs1, PEs2 and PEs3. The hub PE is PEh. Two of the spoke PEs (PEs1 and PEs2) are connected to the same RR group and the third one connects to another RR group.¶
Although we can advertise different EVPN labels for different RR groups, we can't advertise different EVPN labels for PEs1 and PEs2 in the form of current IMET routes.¶
But PEh can request PEs1 or PEs2 to push the label of the context VC from them to PEh. Benefit from the context VC label, PEh can distinguish where the packet from, in other words, PEh can decide where the packet can't be sent to.¶
The signaling for the hub PE to request the spoke PE to push the context VC label will be the CSL-Entry EC, regardless of the label-space type of the context VC label.¶
Note that although PEs1 and PEs2 can receive EVPN routes from each other, they won't import these routes because of the hub/spoke behaviors.¶
We use CSL-based per-EVI context-VCs(see Section 4.1.2) to do per-ingress statistics.¶
Note that The per-platform label space can be used as CLS1 at the same time. In such case, the inner context-VC label is similar to the downstream-assigned ESI-label in ILM-lookup behavior. Such context-VC is very similar to the shared context VC too.¶
Note that when PE1 sends a Leaf A-D route with a CSL-Entry EC to PE2, but PE2 don't recognize the CSL-Entry EC, then PE2 will encapsulate the EVPN label without the inner context-VC label. If CLS1 is actually identical to the per-platform label space, this will work as well as [RFC7432], although the per-ingress statistics can't be executed.¶
Note that legacy PEs will not send a Leaf A-D route in response to an IMET route even if the LIR flag in the IMET route is set to one. So when legacy PEs and new PEs following this section coexist in the same EVI, they can interwork well, but only the new PEs can do per-ingress statistics.¶
LEAF1--------REPLICATOR1--------RNVE1
/
LEAF2-----------/
When REPLICATOR1 node recieves an IMET Route with AR-role = AR-LEAF from LEAF1 node, REPLICATOR1 SHOLD respond to it with an Leaf A-D route with AR-PTA. The MPLS label field of the AR-PTA (say AR-PTA Label) will be allocated following the same rules as the IR-PTA Label in Section 4.1. When AR-LEAF1 receives above Leaf A-D route, the Leaf A-D route is treated as a Replicator-AR route for the same ORIP, then the control-plane procedures follows [I-D.ietf-bess-evpn-optimized-ir]. When REPLICATOR1 receives data packets from the AR-PTA Label, REPLICATOR1 will do source-squelching for LEAF1, which means that these data packets will not be forwarded back to LEAF1.¶
Note that the old Replicator-AR route (from AR-REPLICATOR) which is in terms of IMET route will not be installed in dataplane by MPLS EVPN AR-LEAF. Because that the Leaf A-D route (from AR-RPELICATOR) will take it's place on AR-LEAF node. But the old Regular-IR route (from AR-REPLICATOR) should still be installed by MPLS EVPN AR-LEAFs.¶
As what is discussed in Section 4.4, the wildcard S-PMSI route can be used to replace the IMET route between AR-REPLICATOR and its AR-LEAFs.¶
/--------SPE1-------\
CE1-----TPE1 TPE2-----CE2
\--------SPE2-------/
Now take above use case for example, the two SPEs are the egress nodes of an anycast SR-MPLS tunnel. The anycast SR-MPLS tunnel is used to transport flows from TPE1 to either SPE1 or SPE2 according to load balancing procedures. So SPE1 and SPE2 have to advertise the same EVPN label independently for a given EVPN route.¶
When TPE2 send a MAC/IP advertisement route (say R8) to SPE1 and SPE2, a "Downstream Context-specific Label Space (CLS) ID Extended Community" can be included in R8 along with an EVPN label (say EVL4).¶
The downstream-CLS ID Extended Community is a new Transitive Opaque EC with the following structure (Sub-Type value to be assigned by IANA):¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0x03 or 0x43 | Sub-Type |O| ID-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ID-Value | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Note that although the downstream-CLS ID EC is highly similar to the Context Label Space ID Extended Community (see section 3.1 of [I-D.ietf-bess-mvpn-evpn-aggregation-label]) in their encodings, they have absolutely different behaviors in data-plane. The CLS-ID EC should be treated as an incomming label in data-plane, but the downstream-CLS ID EC should be treated as an outgoing label in data-plane. So they couldn't share the same code-point in the signalling procedures.¶
When SPE1 and SPE2 receive R8 from TPE2, they should advertise R8 to TPE1 independently, and the next-hop of R8 should be changed to the common anycast node address (say IP_12) of SPE1 and SPE2 before the advertisement. But SPE1 and SPE2 can simply keep R8's EVPN label (the EVL4 from TPE2) unchanged.¶
The contex-VC label (say VCL4) in the "downstream-CLS ID EC" is also kept unchanged. But the O bit of the "downstream-CLS ID EC" is rewritten to 0.¶
Note that although the EVL4 and VCL4 is unchanged, a CLS-specific ILM whose label operation is "label swapping" should also be installed, because that the outgoing PSN tunnel information should be resolved.¶
Note that the two outgoing-labels of the label-swapping have the same value (EVL4 and VCL4) as the two incomming-labels. The VCL4 is an optional outgoing-label because that the O bit of its "Downstream-CLS ID EC" is 1.¶
The label stack on the anycast SR-MPLS tunnel is constructed by TPE1 as the following:¶
+---------------------------------+
| underlay ethernet header |
+---------------------------------+
| Anycast SR-TL = SR_LSP_to_SPEs |
+---------------------------------+
| Context-VC Label = VCL4 |
+---------------------------------+
| EVPN label = EVL4 |
+---------------------------------+
| overlay ethernet or IP header |
+---------------------------------+
Note that the SR Tunnel Label (TL) in the label stack is the anycast SR-LSP label from TPE1 to the SPE1 or SPE2. And the VCL4 in the label stack is mandatory (from the viewpoint of TPE1) because that the O bit of its "Downstream-CLS ID EC" is 0.¶
Note that the context-VC is constructed (on SPE1 and SPE2) in per-platform label space, and VC labels from TPE2 to SPE1 and SPE2 will be the same value (VCL4). so the label stacks (from the viewpoint of TPE1) are the same for SPE1 and SPE2. That's why the anycast tunnel from TPE1 to SPE1 and SPE2 can be used for R8 by TPE1.¶
When SPE1/SPE2 receives that data packet, then SPE1/SPE2 will perform CLS-specific ILM lookup for the EVPN label in the "TPE2-specific label space" which is identified by the context-VC label VCL4. The label operation will be "swapping", and the new outgoing EVPN label will be the same value (as EVL4). Note that the optional (from the viewpoint of SPE1/SPE2) VCL4 is suggested to be absent in the label stack.¶
When TPE2 don't advertise the Downstream-CLS ID EC to SPE1 and SPE2, They have to generate that EC by themselves.¶
In such case, TPE2 should advertise the OPE TLV for R8. And a context-VC infrastructure should be established previously. The context-VC infrastructure should assure that the context-VCs from TPE2 to any other TPEs/SPEs have the same VCL value.¶
Then the SPE1 can set the ID-Value of the Downstream-CLS ID EC to the VCL of the contex VC from TPE2 to itself. The ID-Type of the Downstream-CLS ID EC is set to 0. The O bit of the Downstream-CLS ID EC is set to 0. So the same Downstream-CLS ID EC can be generated by the SPEs independently.¶
It is feasible for such context-VC infrastructure to be implemented on the basis of Kompella VPLS signalling or BGP SR signaling. But it will be better for the admin-EVI (as the context-VC infrastructure) and EVPN VPLS to use the same signalling framework.¶
So we can just transplant the SRGB or VE-Block configuration model into the admin-EVI but the admin-EVI still use the signalling framework of Section 5.4.1.¶
This section will be added in future versions.¶
This document introduces two new Transitive Opaque Extended Communities "Downstream CLS ID Extended Community" and "Context-Specific Label Entry Extended Community". An IANA request will be submitted later for two code-points in the BGP Transitive Opaque Extended Community Sub-Types registry.¶
The authors would like to thank the following for their comments and review of this document:¶
Benchong Xu.¶