Wildcards in Multicast VPN Auto-Discovery Routes
updated by
- rfc-7582 — Multicast Virtual Private Network (MVPN): Using Bidirectional P-Tunnels
- rfc-7900 — Extranet Multicast in BGP/IP MPLS VPNs
- rfc-8534 — Explicit Tracking with Wildcard Routes in Multicast VPN
updates
- rfc-6514 — BGP Encodings and Procedures for Multicast in MPLS/BGP IP VPNs
Extracted elements (24)
The (C-*,C-G) wildcard is restricted to ASM group addresses because the use case is binding flows along a customer PIM-SM shared tree or BIDIR-PIM tree to a single P-tunnel. SSM flows inherently identify a specific source, making the source wildcard semantically inappropriate for SSM.
The (C-S,C-*) wildcard is restricted to SSM group addresses because the use case is binding all SSM channels from a given source to a single P-tunnel. Using it for ASM would create ambiguity with shared-tree semantics where the source is not authoritative.
Using wildcards reduces the number of S-PMSI A-D routes a PE must originate, improving control-plane scalability. There is explicitly no impact on data-plane scalability because the number of P-tunnels is not reduced by wildcard use.
Wildcards in S-PMSI A-D route NLRIs were introduced because the base MVPN specifications required one S-PMSI A-D route per customer flow, with no way to bind multiple flows to a single tunnel in one advertisement or to designate a selective P-tunnel as a default. This document eliminates those restrictions by allowing C-S, C-G, or both to be replaced by a wildcard (C-*), enabling a single route to represent multiple or all customer flows.
The matching rules for S-PMSI A-D routes with wildcards are order-independent: the S-PMSI A-D route matched by a given (C-S,C-G) does not depend on the order in which routes were originated or received, only on their NLRI specificity according to the defined priority rules.
The procedures in this document apply only when the PMSI Tunnel Attribute of an S-PMSI A-D route specifies a unidirectional (point-to-multipoint) P-tunnel. The use of bidirectional (multipoint-to-multipoint) P-tunnels such as BIDIR-PIM trees is outside the scope of this document.
A PE that can originate S-PMSI A-D routes with any kind of wildcard SHOULD have the ability to interpret and correctly process all three kinds of wildcards: (C-*,C-G), (C-S,C-*), and (C-*,C-*).
A wildcard in a particular S-PMSI A-D route always refers only to multicast flows of the same address family (IPv4 or IPv6) as specified in the AFI field of the MP_REACH_NLRI attribute carrying the route.
An implementation MUST allow the set of Route Targets carried by a (C-*,C-*) S-PMSI A-D route to be specified by configuration. In the absence of a configured set, the route MUST carry the default set (same as VPN-IP unicast routes from that VRF).
For a given MVPN, a PE MUST NOT originate S-PMSI A-D routes with a particular kind of wildcard unless it is known a priori that all PEs attached to that MVPN have the ability to interpret and correctly process that kind of wildcard.
If a PE needs to transmit a (C-S,C-G) C-flow and it matches a (C-*,C-*) S-PMSI A-D route per Section 3.1, the PE MUST use the P-tunnel advertised in that route. A (C-S,C-G) cannot match both a (C-*,C-*) wildcard and any other wildcard simultaneously.
If a PE receives a (C-*,C-G) S-PMSI A-D route and can determine that C-G is an SSM group address, the PE SHOULD 'ignore' the route (not consider it for P-tunnel selection and not use its MPLS label values).
If a PE receives a (C-S,C-*) S-PMSI A-D route and can determine that C-G is not an SSM group address, the PE SHOULD 'ignore' this route. The (C-S,C-*) wildcard is specified only for SSM group addresses.
The ability to originate S-PMSI A-D routes with a particular kind of wildcard is OPTIONAL. However, if a PE has the ability to originate such routes, it MUST have the ability to interpret and correctly process S-PMSI A-D routes with that kind of wildcard.
When PIM is used as PE-PE control protocol and a PE needs to receive a (C-S,C-G) flow that matches a (C-*,C-*) S-PMSI A-D route per Section 3.2, the PE MUST join the P-tunnel specified in the PMSI Tunnel Attribute of that route.
When PIM is used as the PE-PE control protocol and a PE has (C-*,C-G) and/or (C-S,C-G) state matching an S-PMSI A-D route, the PE MUST join the P-tunnel specified in the PMSI Tunnel Attribute of that route.
(C-*,C-*) S-PMSI A-D routes represent a policy where a PE does not use I-PMSIs for any multicast data traffic from its MVPN sites. When combined with BGP C-multicast routing, this implements the 'S-PMSI only' model where no I-PMSIs are used for the given MVPN. A PE originates a (C-*,C-*) route only if provisioned with the policy to do so.
For (C-*,C-G) reception matching, a PE matches against a (C-*,C-G) S-PMSI A-D route from the upstream PE if PE1 determines PE2 is the upstream PE for C-G's C-RP, or PE2 has Source Active A-D routes for C-G without corresponding (C-S,C-G) state, or C-G is BIDIR-PIM, or Source Active A-D routes are not used. If no (C-*,C-G) match, fallback to (C-*,C-*) under the same conditions applies.
For data reception, a PE matches a (C-S,C-G) flow against installed S-PMSI A-D routes originated by the upstream PE, using the same priority order as for transmission: exact (C-S,C-G), then (C-S,C-*) for SSM, then (C-*,C-G) for ASM, then (C-*,C-*). Route selection is independent of the order routes were received.
For data transmission, a PE matches a (C-S,C-G) flow against originated S-PMSI A-D routes using a priority order: exact (C-S,C-G) match first; then (C-S,C-*) if C-G is SSM; then (C-*,C-G) if C-G is ASM; finally (C-*,C-*). The matched route's P-tunnel is used for transmission.
Three wildcard types are defined for the NLRI of an S-PMSI A-D route: (C-*,C-G) — source wildcard with group specified; (C-S,C-*) — source specified with group wildcard; and (C-*,C-*) — both source and group wildcarded. All other wildcard combinations are outside the scope of this document.
There are no additional security considerations introduced by this document beyond those already specified in the base MVPN specifications RFC 6513 and RFC 6514.
A source wildcard is encoded by setting the Multicast Source Length field to 0x00 and omitting the Multicast Source field entirely. A group wildcard is encoded by setting the Multicast Group Length field to 0x00 and omitting the Multicast Group field entirely.
The MCAST-VPN NLRI of an S-PMSI A-D route contains: RD (8 octets), Multicast Source Length (1 octet), Multicast Source (variable), Multicast Group Length (1 octet), Multicast Group (variable), and Originating Router's IP Address. In the base specification, source and group length fields are always non-zero.