BGP-MPLS IP Virtual Private Network (VPN) Extension for IPv6 VPN
Extracted elements (23)
IPv4-mapped IPv6 addresses are used in the BGP Next Hop field to signal IPv4 tunneling preference, enabling IPv6 VPN service to operate over an IPv4-only backbone without requiring separate signaling mechanisms.
The IPv6 VPN service is designed to be independent of whether the core runs IPv4 or IPv6, so that VPN service is undistinguishable to customers before and after a backbone migration from IPv4 to IPv6.
The VPN-IPv6 address family prepends an 8-octet Route Distinguisher to IPv6 addresses to allow distinct routes to common IPv6 prefixes across VPNs, mirroring the VPN-IPv4 approach. This ensures that the same address used in two different VPNs results in two completely different routes.
In Multi-AS approach (b), exchange of labeled VPN-IPv6 routes between ASBRs MUST be carried out per RFC 2545 (BGP-IPv6) and RFC 3107 (MPLS-BGP). Both IPv4 and IPv6 peering between ASBRs are supported.
Multi-AS approach (c) requires all participating ASes to use either all IPv4 tunneling or all IPv6 tunneling, unlike approaches (a) and (b) which allow a mix of IPv4 and IPv6 tunneling across different ASes.
When IPv4 and IPv6 VPN services are both supported over an IPv4 core, the same single set of MP-BGP peering relationships and the same single PE-PE tunnel mesh MAY be used for both, reducing operational complexity.
A BGP speaker SHALL advertise a link-local address in the Next Hop field if and only if it shares a common subnet with the peer the route is being advertised to; in all other cases only the global IPv6 address shall be advertised.
AFI and SAFI fields in MP_REACH_NLRI MUST be set to AFI=2 (IPv6) and SAFI=128 (MPLS labeled VPN-IPv6) when advertising IPv6 VPN routes.
In order for two PEs to exchange labeled IPv6 VPN NLRIs, they MUST use BGP Capabilities Negotiation (capability code 1, multiprotocol BGP) with AFI=2 and SAFI=128 to confirm both sides can properly process such NLRIs.
The ingress PE Router MUST tunnel IPv6 VPN data over the backbone towards the egress PE router identified as the BGP Next Hop for the corresponding destination IPv6 VPN prefix.
To ensure interoperability, all systems implementing this VPN architecture MUST support tunneling using MPLS LSPs established by LDP.
When distributing IPv6 VPN routes, the advertising PE router MUST assign and distribute MPLS labels with the IPv6 VPN routes; PE routers distribute Labeled IPv6 VPN routes, not bare IPv6 VPN routes.
When the BGP Next Hop field contains an IPv4-mapped IPv6 address, the ingress PE MUST use IPv4 tunneling unless explicitly configured otherwise.
When the BGP Next Hop IPv6 address is not encoded as an IPv4-mapped address, the ingress PE MUST use IPv6 tunneling.
When tunneling is done using MPLS LSPs, the ingress PE MUST directly push the LSP tunnel label on the label stack of the labeled IPv6 VPN packet without prepending any IPv4 or IPv6 header.
A VPN-IPv6 address is a 24-octet quantity, beginning with an 8-octet Route Distinguisher (RD) and ending with a 16-octet IPv6 address. The RD allows creation of distinct routes to a common IPv6 address prefix across different VPNs.
IPv6 VPN encapsulation supports multiple tunneling techniques: MPLS-in-IP, MPLS-in-GRE, MPLS-in-L2TPv3, and IPsec-secured variants, reusing the same encapsulation methods as IPv4 BGP/MPLS VPNs. IPsec Transport Mode is used to secure IPv4 or GRE tunnels between PE routers.
Link-local unicast addresses may be used on PE-CE links but are never advertised via MP-BGP to remote PEs. Global unicast and Unique Local IPv6 Unicast Addresses are supported for reachability across IPv6 VPN sites and may be advertised via MP-BGP.
This document specifies use of BGP AFI value 2 (IPv6) with SAFI value 128 (MPLS-labeled VPN address) to represent the 'VPN-IPv6 Labeled Addresses' address family. Both values were already registered; no new IANA action was required.
Security considerations for the transport of IPv6 reachability information using BGP from RFC 2545 Section 5 apply to these extensions. The same data plane, control plane, and PE/P device security considerations from RFC 4364 Section 13 apply equally to IPv6 VPNs.
For IPv4 transport, the BGP Next Hop field contains a VPN-IPv6 address with RD set to zero and the 16-octet IPv6 field encoded as an IPv4-mapped IPv6 address containing the advertising speaker's IPv4 address.
For IPv6 transport, the BGP Next Hop Network Address field contains a VPN-IPv6 address with RD set to zero and the 16-octet field set to the advertising speaker's global IPv6 address. Length is 24 octets for global-only, 48 octets when a link-local address is also included.
VPN IPv6 NLRI is encoded with AFI=2 (IPv6) and SAFI=128 (MPLS labeled VPN-IPv6). The NLRI prefix consists of an 8-octet Route Distinguisher followed by an IPv6 prefix, carried in MP_REACH_NLRI.