OSPF-Based Layer 1 VPN Auto-Discovery
Extracted elements (23)
CE-to-PE link TE attributes are not advertised via normal OSPF-TE procedures because CEs are outside of the provider TE domain; instead they are carried in the TE Link TLV within the L1VPN LSA.
OSPF-based L1VPN auto-discovery is particularly useful in networks where BGP is not typically used, complementing the BGP-based approach in RFC 5195.
The PE TE Address field in the L1VPN Info TLV must match a valid PE TE Router ID or numbered TE Link ID so that CEs attached to this PE can be resolved in the Traffic Engineering Database (TED), enabling computation of TE paths toward the CEs across the provider domain.
OSPF speakers that do not support the L1VPN auto-discovery application (such as P routers) participate in the L1VPN LSA flooding process but should ignore the LSA contents, per RFC 5250 Opaque LSA handling rules.
P routers that do not originate or maintain PITs still participate in flooding all L1VPN LSAs and maintain them in their LSDB, which is identified as a scalability concern in large networks.
A single L1VPN Info TLV MUST be present in the L1VPN LSA. If more than one L1VPN Info TLV is present, only the first TLV is processed and the others MUST be ignored on receipt.
Each PE MUST originate a separate L1VPN LSA with AS flooding scope for each local CE-to-PE link. The LSA MUST be originated each time a PE restarts and every time there is a change in the PIT entry associated with a local CE-to-PE link.
Every time a PE receives a new, removed, or modified L1VPN LSA, the PE MUST check whether it maintains a PIT associated with the L1VPN specified in the L1VPN globally unique identifier field.
For unnumbered PE TE links, the Link Local Identifier field MUST contain a value advertised per RFC 4203 in a Link Local/Remote Identifiers link sub-TLV. For numbered links, this field MUST be set to 0.
If a PE maintains a PIT for the L1VPN specified in a received L1VPN LSA, the PE SHOULD add, remove, or modify the PIT entry associated with each of the advertised CE-to-PE links accordingly. An implementation MAY choose to not remove or modify the PIT according to local policy.
The L1VPN LSA MUST include a single L1VPN Info TLV and MAY include a single TE Link TLV as per RFC 3630 and RFC 4203. If more than one L1VPN Info TLVs and/or TE Link TLVs are found in the LSA, the subsequent TLVs SHOULD be ignored by the receiving PEs.
The LS Type field of the L1VPN LSA MUST be set to 11, indicating an Autonomous System scoped Opaque LSA per RFC 5250.
The Opaque Type field of the L1VPN LSA MUST be set to 5.
The Padding field MUST be less than 4 bytes long, and MUST NOT be present when the L1VPN Auto-discovery information field is already 4-byte aligned.
The PE TE Address field MUST carry an address advertised by the LSA originator per RFC 3630, either the Router Address TLV or Local interface IP address link sub-TLV.
PEs advertise local <CPI, PPI> tuples in L1VPN LSAs. In steady state, all PEs associated with a particular L1VPN will have identical local PITs for that L1VPN, enabling full mesh knowledge of remote PE-to-CE links.
The L1VPN Info TLV (type 1, variable length) carries the L1VPN Globally Unique Identifier (64-bit), PE TE Address (32-bit IPv4), Link Local Identifier (32-bit), L1VPN Auto-Discovery Information, and optional padding for 4-byte alignment.
The L1VPN LSA is a new type of AS-scoped Opaque LSA (LS Type 11, Opaque Type 5) used to carry L1VPN auto-discovery information. It contains a mandatory L1VPN Info TLV and an optional TE Link TLV.
IANA assigned Opaque Type value 5 for the L1VPN LSA in the OSPF Opaque LSA type registry.
For end-to-end authentication, OSPF's neighbor-to-neighbor authentication can be augmented with RFC 2154, which supports signing and authentication of LSAs.
Security issues are limited to within the OSPF domain; mechanisms to deliver VPN membership information to CEs are out of scope. The approach reuses RFC 2328 and RFC 5250 security mechanisms, including OSPF authentication, LSA origination rate limiting, and database overflow protection.
The L1VPN Info TLV has a 2-byte Type field, 2-byte Length field (excluding TLV header and padding), followed by a 64-bit L1VPN Globally Unique Identifier, 32-bit PE TE Address, 32-bit Link Local Identifier, variable-length L1VPN Auto-Discovery Information, and optional padding.
The L1VPN LSA header includes LS age, Options, LS Type (11), Opaque Type (1 byte), Opaque ID (3 bytes), Advertising Router (32-bit), LS Sequence Number (32-bit), LS checksum (16-bit), and Length (16-bit), followed by L1VPN Info TLV and optional TE Link TLV.