Provisioning, Auto-Discovery, and Signaling in Layer 2 Virtual Private Networks (L2VPNs)
Extracted elements (25)
Single-sided provisioning enables moving an Attachment Circuit from one PE to another without reconfiguring the remote endpoint. However, it imposes a greater burden on the discovery mechanism because each AC name must be advertised individually, with no aggregation possible.
The EBGP redistribution with multi-segment PWs inter-AS approach (Section 4.2) restricts LDP/L2TPv3 signaling sessions to terminate on a small set of ASBRs rather than a full mesh across the AS boundary. This allows standard authentication procedures to be applied on a manageable set of inter-provider sessions and reduces the number of cross-AS control connections.
A non-distributed PE (performing both U-PE and N-PE functions) can interoperate with distributed VPLS N-PE/U-PE pairs by advertising exactly one local U-PE per VPLS in the discovery procedure. If all PEs in a VPLS advertise one local U-PE, the resulting signaling is identical to standard non-distributed VPLS (Section 3.2.3).
BGP-AD (this document) and VPLS-BGP (RFC 4761) share AFI=25, SAFI=65. The NLRI length is used as a demultiplexer: BGP-AD NLRIs are exactly 12 bytes (8-byte RD + 4-byte VSI-ID); VPLS-BGP NLRIs are 17 bytes. Implementations of BGP-AD MUST ignore NLRIs longer than 12 bytes to coexist with RFC 4761.
Every Forwarder in a PE must be associated with an Attachment Identifier that is unique within that PE. The combination <PE router, AI> must be globally unique.
For BGP-based VPLS auto-discovery, the VPLS-id Extended Community MUST be transitive. Two subtypes are defined: a Two-octet AS Specific Extended Community and an IPv4 Address Specific Extended Community, ensuring globally collision-free VPLS identifier allocation.
For VPLS LDP signaling, the SAII MUST be set to the PE_addr (VSI-ID without the RD) of the sending PE to enable signaling of the reverse half of the PW. The VPLS-id is encoded in the AGI field and the remote PE_addr in the TAII field.
If a PE receives a BGP update from which any required element (NLRI, next hop, VPLS-id Extended Community, or RT) is absent, the update should be ignored.
In the Colored Pools model, if a pool already has a pseudowire connecting to an AC at the same remote PE with the same AI as the incoming SAI, the receiving PE MUST send a Label Release or CDN with Status Code 'Attachment Circuit already bound to remote Attachment Circuit' to prevent duplicate PWs between a given pair of pools.
When a PE receives a Label Mapping message (LDP) or ICRQ (L2TP) for an AC already bound to a PW with a different remote PE, it MUST send a Label Release or CDN with Status Code 'Attachment Circuit bound to different PE'. If the AC is already bound but the remote AI differs from the SAI/SAII in the incoming message, the PE sends a release with 'Attachment Circuit bound to different remote Attachment Circuit'.
Double-sided provisioning requires each Attachment Circuit to be configured with a local name, a remote PE address, and a remote name. The local name is sent as the SAII, the remote name as the TAII, and the AGI is null. If local and remote names are equal, the PWid FEC element may be used instead of the Generalized ID FEC element.
For Distributed VPLS signaling from U-PE to N-PE, the AGI is set to the VPN-id, the SAII is set to the PW number, and the TAII is null. For N-PE-to-U-PE signaling, the SAII is null and the TAII is set to the PW number relative to that VPLS and U-PE.
In Distributed VPLS, U-PEs have only a single signaling connection to their N-PE. Each U-PE-to-U-PE PW is composed of three spliced segments: U-PE-to-N-PE (U-PW), N-PE-to-N-PE (N-PW), and N-PE-to-U-PE (U-PW). N-PEs perform PW switching to stitch segments together.
Single-sided provisioning with discovery requires each AC to be provisioned only with a VPN-ID (sent as AGI) and a locally unique AII; only one endpoint needs a remote name. BGP auto-discovery distributes <VPN-id, local AII> pairs, allowing PEs to discover remote peers without pre-configuring their addresses.
The Colored Pools partial mesh model extends full-mesh by allowing each pool to be configured with separate 'import RTs' and 'export RTs'. During BGP auto-discovery, export RTs replace the color in BGP Update messages. A pool creates a PW to every other pool that has a matching import RT, enabling hub-and-spoke and other asymmetric topologies.
The signaling framework uses three fields to identify pseudowire endpoints: Attachment Group Identifier (AGI), Source Attachment Individual Identifier (SAII), and Target Attachment Individual Identifier (TAII). The SAI is the concatenation of AGI and SAII; the TAI is the concatenation of AGI and TAII. The AGI functions as a VPN-ID shared by all PWs in a given L2VPN instance.
AGI Type 1 and AII Type 1 are assigned in the RFC 4446 registries for 'Attachment Group Identifier (AGI) Type' and 'Attachment Individual Identifier (AII) Type', corresponding to the 8-byte and 4-byte formats defined in this document for VPLS and VPWS.
IANA assigned AFI=25 (L2VPN) and SAFI=65 (VPLS) for L2VPN NLRI, shared with RFC 4761. The same AFI and SAFI are used for both VPLS and VPWS auto-discovery as defined in this document.
Two BGP Extended Community values are assigned for L2VPN identifiers: 0x000A in the Two-octet AS Specific Extended Community registry (Two-octet AS specific Layer 2 VPN Identifier) and 0x010A in the IPv4 Address Specific Extended Community registry (Layer 2 VPN Identifier). Both are from the transitive range.
Two L2TP Result Codes for the CDN message are registered: Code 27 ('Attachment Circuit bound to different PE') and Code 28 ('Attachment Circuit bound to different remote Attachment Circuit'), added to the L2TP Result Code Values registry defined by RFC 3438.
Two LDP status codes are assigned: 0x00000030 ('Attachment Circuit bound to different PE') and 0x0000002D ('Attachment Circuit bound to different remote Attachment Circuit'), added to the STATUS CODE NAME SPACE registry defined by RFC 5036.
This document does not introduce additional security issues beyond those already covered in the referenced protocol specifications. Signaling security is addressed in RFC 5036, RFC 4447, RFC 3931, and RFC 4667. BGP-based auto-discovery security, including inter-AS considerations, is covered in RFC 4364. Automated security mechanisms for L2VPNs are identified as recommended future work.
For VPLS, the AGI field in the LDP Generalized ID FEC is encoded as Type=1, Length=8, followed by 8 bytes of VPLS-id. Each AII (SAII and TAII) is encoded as Type=1, Length=4, followed by a 4-byte PE address or VSI identifier.
For VPWS (Colored Pools) LDP signaling, the AGI is encoded as Type=1, Length=8, 8-byte VPWS identifier. The TAII is Type=1, Length=4, 4-byte remote pool number. The SAII is Type=1, Length=4, 4-byte local pool number. The same AGI Type (1) and AII Type (1) are used for both VPLS and VPWS.
The BGP NLRI for VPLS auto-discovery is encoded as: Length (2 octets) | Route Distinguisher (8 octets) | PE_addr (4 octets), giving a payload length of 12 bytes. Each PE advertises one such NLRI per VSI, with BGP next hop set to its own loopback address.