IPv4 and IPv6 Infrastructure Addresses in BGP Updates for Multicast VPN
updates
- rfc-6514 — BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs
Extracted elements (15)
A PMSI Tunnel Attribute in an I-PMSI A-D route identifies the default tunnel for a particular customer MVPN. The AFI of the enclosing MP_REACH_NLRI determines whether that tunnel carries IPv4 or IPv6 MVPN traffic, not whether the tunnel endpoint addresses are IPv4 or IPv6 (which is determined by the next hop address family).
The address family of PE (provider) addresses in MCAST-VPN routes is determined solely by the length of the address field (4 octets = IPv4, 16 octets = IPv6), not by the AFI field of the associated MP_REACH_NLRI/MP_UNREACH_NLRI attribute. This allows an SP with an IPv4 core to provide MVPN/IPv6 service, with PE addresses remaining 4-octet IPv4 even when AFI=2.
This document explicitly rejects the approach taken in RFC 4659 and RFC 4798, which required IPv4 PE addresses to be represented as IPv6-mapped IPv4 addresses when occurring in routes with IPv6 customer addresses. Instead, this specification follows the approach of RFC 4684 and RFC 5549, using native address lengths to distinguish IPv4 from IPv6 PE addresses.
If the MP_REACH_NLRI next hop contains an IPv4 address, all IP addresses in the PMSI Tunnel Attribute 'Tunnel Identifier' field MUST be IPv4. If the next hop is IPv6, all Tunnel Identifier IP addresses MUST be IPv6. Violations require treating the PMSI Tunnel Attribute as 'malformed' per RFC 6514 Section 5.
The address family of PE addresses in MCAST-VPN routes MUST NOT be inferred from the AFI field of the associated MP_REACH_NLRI/MP_UNREACH_NLRI attribute, because the SP's network address family is independent of the customer's address family.
To assign both IPv4 and IPv6 MVPN traffic to an I-PMSI tunnel, two I-PMSI A-D routes MUST be originated — one with AFI=1 and one with AFI=2. The same PMSI Tunnel attribute value may appear in both routes to reuse the same tunnel for both traffic types.
To carry an IPv6 PE address in the VRF Route Import Extended Community, an 'IPv6 Address Specific Extended Community' of type 'VRF Route Import' MUST be used rather than the IPv4 Address Specific form. This applies regardless of whether the extended community is attached to a VPN-IPv4 or VPN-IPv6 unicast route.
MCAST-VPN NLRI is carried in the NLRI field of MP_REACH_NLRI/MP_UNREACH_NLRI attributes. When the SAFI field has the MCAST-VPN value, AFI=1 indicates customer multicast addresses are IPv4 and AFI=2 indicates they are IPv6; this AFI applies only to customer addresses, not to PE infrastructure addresses.
The 'VRF Route Import Extended Community' defined in RFC 6514 is an 'IPv4 Address Specific Extended Community' and can carry only an IPv4 PE address. To carry an IPv6 PE address, an 'IPv6 Address Specific Extended Community' of type 'VRF Route Import' (code point 0x000b) must be used instead, independent of whether the hosting route is VPN-IPv4 or VPN-IPv6.
IANA has assigned code point 0x000b for 'VRF Route Import' in the 'IPv6 Address Specific Extended Community' registry, in the transitive communities portion of the namespace. References are to RFC 6515 and RFC 6514.
RFC 6515 does not introduce any security considerations beyond those already raised by RFC 6514 (BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs).
In the Intra-AS I-PMSI A-D route, the NLRI begins with a 1-octet route type, 1-octet NLRI length, 8-octet Route Distinguisher, and then the 'Originating Router's IP Address' field; its length (4 for IPv4, 16 for IPv6) is inferred from the NLRI length field (12 or 24, respectively). An NLRI length implying neither 4 nor 16 octets for the address field MUST be treated as 'incorrect'.
In the Leaf A-D Route, the 'Originating Router's IP Address' length is computed from the NLRI length minus the variable-length Route Key (which has its own length subfield). If the computed length is neither 4 nor 16, the attribute MUST be treated as 'incorrect' per RFC 4760 Section 7.
In the MP_REACH_NLRI 'Network Address of Next Hop' field, a PE address is preceded by a length field; length=4 means IPv4 and length=16 means IPv6. If the length is neither 4 nor 16, the MP_REACH_NLRI attribute MUST be treated as 'incorrect' per Section 7 of RFC 4760.
In the S-PMSI A-D Route, the 'Originating Router's IP Address' length is computed from the NLRI length minus the 8-octet RD and the variable-length multicast source and group fields (each with their own length subfields). If the computed length is neither 4 nor 16, the attribute MUST be treated as 'incorrect' per RFC 4760 Section 7.