BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs
updated by
- rfc-6515 — IPv4 and IPv6 Infrastructure Addresses in BGP Updates for Multicast VPN
- rfc-6625 — Wildcards in Multicast VPN Auto-Discovery Routes
- rfc-7385 — IANA Registry for P-Multicast Service Interface (PMSI) Tunnel Type Code Points
- rfc-7441 — Encoding Multipoint LDP (mLDP) Forwarding Equivalence Classes (FECs) in the NLRI of BGP MCAST-VPN Routes
- rfc-7582 — Multicast Virtual Private Network (MVPN): Using Bidirectional P-Tunnels
- rfc-7899 — Multicast VPN State Damping
- rfc-7900 — Extranet Multicast in BGP/IP MPLS VPNs
- rfc-7902 — Registry and Extensions for P-Multicast Service Interface Tunnel Attribute Flags
- rfc-7988 — Ingress Replication Tunnels in Multicast VPN
- rfc-8534 — Explicit Tracking with Wildcard Routes in Multicast VPN
- rfc-9081 — Interoperation between Multicast Virtual Private Network (MVPN) and Multicast Source Directory Protocol (MSDP) Source-Active Routes
- rfc-9573 — MVPN/EVPN Tunnel Aggregation with Common Labels
Extracted elements (30)
Inter-AS I-PMSI A-D routes aggregate per-PE Intra-AS I-PMSI A-D routes so that outside an AS the granularity is <AS, MVPN> rather than <PE, MVPN>. This caps inter-AS routing state growth proportional to the number of participating ASes, not the number of PEs, making the design scalable for large MVPNs.
The VRF Route Import Extended Community encodes the PE's IP address in the Global Administrator field and a locally assigned 2-octet VRF identifier in the Local Administrator field, enabling the community to globally and uniquely identify a VRF without requiring cross-PE coordination of VRF identifiers.
If an MVPN uses option (a) of RFC 4364 Section 10 (VRF-to-VRF connections at AS boundaries), the notion of inter-AS tunnels does not apply and only the intra-AS MVPN auto-discovery/binding mechanisms are needed.
When the PMSI Tunnel Tunnel Type is PIM-SM or BIDIR-PIM, the P-Multicast Group SHOULD be the same address for all Intra-AS I-PMSI A-D routes for the same MVPN within a given AS. For PIM-SSM, RFC 4607 allows each PE to allocate the group locally without coordination with other PEs on the same MVPN.
A BGP route reflector that receives an Inter-AS I-PMSI A-D route via IBGP MUST NOT modify the Next Hop field of the MP_REACH_NLRI attribute when re-advertising into IBGP, because that Next Hop controls the flow of C-multicast routes per Section 11.2.
A Leaf A-D route originated into EBGP by an ASBR MUST include the PMSI Tunnel attribute with Tunnel Type set to Ingress Replication and a routable ASBR address in the Tunnel Identifier, MUST carry a downstream-assigned MPLS label, and MUST carry the NO_ADVERTISE Community to constrain its distribution scope.
A PE router with a VRF for a given MVPN MUST originate an Intra-AS I-PMSI A-D route and advertise it in IBGP, except when all connected sites are receiver-only and ingress replication is not used, or when all sites are sender-only with ingress replication.
An ASBR MUST be auto-configured with an ASBR Import RT whose Global Administrator field equals the IP address in the Next Hop of all Inter-AS I-PMSI A-D and S-PMSI A-D routes advertised by the ASBR, and whose Local Administrator field MUST be set to 0.
Each VRF on a PE MUST have a VRF Route Import Extended Community (C-multicast Import RT), and a PE originating unicast VPN-IP routes MUST include this community in the BGP Update unless it is known a priori that no addresses in the route could be multicast sources or C-RP.
If a unicast routing change causes a different UMH route to be selected for a C-S, the PE MUST re-originate all previously originated C-multicast routes for (C-S,C-G) for all C-G. Similarly, a UMH change for a C-RP requires re-origination of all (C-*,C-G) routes for groups using that RP.
The Intra-AS I-PMSI A-D route MUST carry the export Route Target used by the unicast routing. By default the advertising PE's BGP Update SHOULD carry the NO_EXPORT Community to constrain distribution within the AS; however, when non-segmented inter-AS P-tunnels are used the route MUST NOT carry NO_EXPORT.
Two BGP speakers MUST use BGP Capabilities Advertisement (capability code 1, multiprotocol BGP) with AFI 1 or 2 and SAFI MCAST-VPN before exchanging MCAST-VPN NLRIs, to ensure both peers can process them correctly.
When a C-PIM instance on a PE creates a new (C-*,C-G) state and the selected upstream PE for the C-RP is not local, the PE MUST originate a Shared Tree Join C-multicast route with the C-RP address in the Multicast Source field. Deletion of the state MUST result in withdrawal of the route.
When a PMSI Tunnel attribute or PE Distinguisher Labels attribute is determined to be malformed and the Partial bit is set in the received BGP Update, the router SHOULD treat the Update as though all routes in it had been withdrawn. An implementation MUST provide debugging facilities including at minimum logging an error when such an attribute is detected.
When an ASBR propagating a C-multicast route already has a route with the same MCAST-VPN NLRI, it SHALL NOT re-advertise the newly received route. Withdrawals are likewise suppressed if another route with the same NLRI remains.
Seven MCAST-VPN NLRI Route Types are defined: 1=Intra-AS I-PMSI A-D route, 2=Inter-AS I-PMSI A-D route, 3=S-PMSI A-D route, 4=Leaf A-D route, 5=Source Active A-D route, 6=Shared Tree Join route, 7=Source Tree Join route.
The PMSI Tunnel attribute's Tunnel Identifier encoding depends on Tunnel Type: RSVP-TE P2MP uses <Extended Tunnel ID, Reserved, Tunnel ID, P2MP ID> per RFC 4875; mLDP P2MP/MP2MP use FEC Elements; PIM-SM and BIDIR-PIM use <Sender Address, P-Multicast Group>; PIM-SSM uses <P-Root Node Address, P-Multicast Group>; Ingress Replication uses a unicast tunnel endpoint IP address.
The Source AS Extended Community is an AS-specific, transitive-across-AS-boundaries Extended Community. Its Global Administrator field MUST be the ASN of the PE and its Local Administrator field MUST be 0. A PE MUST attach it to unicast VPN-IP route advertisements when the MVPN uses BGP for C-multicast routes or segmented inter-AS tunnels.
The VRF Route Import Extended Community is an IP-address-specific, transitive Extended Community that uniquely identifies a VRF. Its Global Administrator field MUST be set to an IP address of the PE (e.g., loopback, common for all VRFs), and the Local Administrator field is a 2-octet number uniquely identifying the VRF within the PE.
Section 18 requests IANA assignments for: the MCAST-VPN SAFI value (for AFI 1 and 2), the MCAST-VPN Route Type registry (values 1–7 as defined in Section 4), the PMSI Tunnel Type registry (values 0–7 as defined in Section 5), and two new BGP Extended Community types (Source AS and VRF Route Import).
The MVPN control plane relies on BGP and inherits its security properties; implementations should apply BGP authentication (e.g., TCP MD5) on all MVPN BGP sessions. Malformed PMSI Tunnel or PE Distinguisher Labels attributes must be logged and affected routes treated as withdrawn, limiting the impact of crafted or corrupted BGP Updates on the multicast forwarding plane.
The C-Multicast Route NLRI (Shared Tree Join and Source Tree Join) carries an 8-octet RD, 4-octet Source AS, 1-octet Multicast Source Length, variable Multicast Source, 1-octet Multicast Group Length, and variable Multicast Group. For Shared Tree Join, Multicast Source contains the C-RP address; for Source Tree Join, the C-S address.
The Inter-AS I-PMSI A-D Route NLRI carries an 8-octet Route Distinguisher and a 4-octet Source AS field. Two-octet ASNs are encoded in the two low-order octets with the high-order octets set to zero.
The Intra-AS I-PMSI A-D Route NLRI carries an 8-octet Route Distinguisher (encoded per RFC 4364) followed by the Originating Router's IP Address. The <RD, Originating Router's IP Address> tuple uniquely identifies a multicast VRF.
The Leaf A-D Route NLRI carries a variable-length Route Key field (set to the full MCAST-VPN NLRI of the triggering Inter-AS I-PMSI or S-PMSI A-D route) followed by the Originating Router's IP Address. It is originated only when the triggering route's PMSI Tunnel attribute has the Leaf Information Required (L) bit set to 1.
The MCAST-VPN NLRI has a 1-octet Route Type field, a 1-octet Length field, and a variable-length Route Type specific field. It is carried in BGP using Multiprotocol Extensions with AFI 1 (IPv4) or 2 (IPv6) and SAFI MCAST-VPN; the AFI determines whether multicast source and group addresses are IPv4 or IPv6.
The PE Distinguisher Labels attribute is an optional transitive BGP attribute consisting of repeating <PE Address, 3-octet Label> tuples; the label value occupies the high-order 20 bits. It is malformed if the PE Address is not unicast, or if the length is not a multiple of 7 (IPv4 PE addresses) or 19 (IPv6 PE addresses). All PE addresses MUST use the same address family as the Originating Router's IP Address of the carrying route.
The PMSI Tunnel attribute is an optional transitive BGP attribute encoding: 1-octet Flags (bit 7 = Leaf Information Required), 1-octet Tunnel Type, 3-octet MPLS Label (high-order 20 bits = label value; zero means no label), and variable Tunnel Identifier. Tunnel Types 0–7 are defined: No tunnel, RSVP-TE P2MP LSP, mLDP P2MP LSP, PIM-SSM Tree, PIM-SM Tree, BIDIR-PIM Tree, Ingress Replication, mLDP MP2MP LSP.
The S-PMSI A-D Route NLRI carries an 8-octet RD, 1-octet Multicast Source Length, variable Multicast Source (C-S address), 1-octet Multicast Group Length, variable Multicast Group (C-G address or C-LDP MP Opaque Value Element), and Originating Router's IP Address. Source/Group Length values of 32 indicate IPv4, 128 indicate IPv6.
The Source Active A-D Route NLRI carries an 8-octet RD, 1-octet Multicast Source Length, variable Multicast Source, 1-octet Multicast Group Length, and variable Multicast Group. Routes with a Multicast Source Length of 0 are outside scope; routes with an SSM-range Multicast Group MUST NOT be advertised and MUST be discarded if received.