Proxy MPLS Echo Request
Extracted elements (29)
A new Return Code 19 ('Replying router has FEC mapping for topmost FEC') was introduced because existing RFC 4379 Return Codes do not cover a transit Proxy LSR: the standard transit codes describe how a packet would transit, which is inappropriate since the Proxy Ping Request carries no information about the input interface.
Proxy MPLS Echo Request was created to address two scalability problems with P2MP LSP diagnostics: the automatic replication of MPLS Echo Requests as they traverse a large P2MP tree produces an unwieldy number of replies back to the root, and LDP-based P2MP/MP2MP LSPs (RFC 6388) require a leaf-to-root tracing capability not available in standard LSP Ping.
The Proxy LSR is designed to be stateless with respect to LSP Ping responses: it sends MPLS Echo Requests on behalf of the initiator but does not maintain state to handle the corresponding replies. Responders send their replies directly to the initiator (or a Reply-to address the initiator supplies), keeping the Proxy LSR out of the return path.
Proxy Ping only allows testing a FEC stack consisting of a single FEC; the initiator cannot specify the label assigned to that FEC, nor cause additional labels to be pushed onto the label stack of the actual MPLS Echo Request.
The Proxy Ping procedures are restricted to LSP Ping FEC types where MPLS Echo Request/Reply are IP-encapsulated and the Echo Reply can be sent out-of-band over IP. Remote pinging over in-band control channels is explicitly out of scope.
A Proxy LSR MUST be capable of filtering source addresses to validate initiators. If a configured filter rejects an address, an MPLS Echo Request MUST NOT be sent and the event SHOULD be logged.
An MPLS Proxy Ping Request MUST contain a Proxy Echo Parameters TLV. The Destination IP Address in that TLV MUST be from the range 127/8 for IPv4 or ::ffff:7f00:0/104 for IPv6.
If a targeted Proxy LSR does not understand the LSP Ping Echo Request at all, it MUST drop the message and MUST NOT send any message back to the initiator.
If the Explicit DSCP flag is set but the Proxy LSR does not permit explicit DSCP control, the Proxy LSR MUST include the Proxy Echo Parameters TLV (with the Explicit DSCP flag cleared) in the Proxy Ping Reply and MUST set the Return Code to 17.
If the MPLS Echo Request source address is not set to the Proxy Request source address, the initiator MUST include a Reply-to Address TLV containing the source address to use. The Reply-to Address MUST be IP reachable via the Proxy LSR.
If the source IP address of an MPLS Proxy Ping Request is not IP-reachable by the Proxy LSR, the Proxy Request MUST NOT be acted upon.
If the TTL specified in the Proxy Echo Parameters TLV is outside the range [1,255], the Return Code MUST be set to 17 ('Proxy Ping parameters need to be modified') and, unless Reply Mode is 1, an MPLS Proxy Ping Reply SHOULD be sent.
The Proxy LSR MUST check whether a received MPLS Proxy Ping Request arrived via exception path (IP TTL expiry, IP destination set to a loopback address, or label TTL expiry). Packets arriving via any of these paths MUST be treated as Unauthorized; a Proxy Ping Reply MAY be sent with Return Code 16.
When MTU testing, if the MPLS Echo Request is transported as an IP datagram the IP header DF bit MUST be set to prevent fragmentation. The Proxy LSR must also set the DF bit when the MPLS Payload Size field in the Proxy Echo Parameters TLV is non-zero.
Four new Return Codes are assigned: 16 ('Proxy Ping not authorized'), 17 ('Proxy Ping parameters need to be modified'), 18 ('MPLS Echo Request could not be sent'), 19 ('Replying router has FEC mapping for topmost FEC').
Four roles are defined: Initiator (sends MPLS Proxy Ping Request), Proxy LSR (destination of the Proxy Ping Request and originator of the actual MPLS Echo Request), Receiver(s) (LSRs that receive the Echo Request), and Responder (any LSR that answers an Echo Request or Proxy Ping Request). The initiator and responder may be the same LSR.
The Proxy Echo Parameters TLV serves two mutually exclusive operating modes: (1) controlling attributes for composing and sending an MPLS Echo Request (no reply information is returned), or (2) querying the Proxy LSR for FEC information via Proxy Flags (which suppresses Echo Request sending). The Proxy Flags field selects the mode.
Two new MPLS LSP Ping message types are defined: Type 3 (MPLS Proxy Ping Request) and Type 4 (MPLS Proxy Ping Reply). They use the existing RFC 4379 packet format. Proxy Ping messages use UDP destination port 3503.
IANA created the 'Next Hop Address Type Registry' with Standards Action allocation. Types 1-4 (IPv4/IPv6 Numbered/Unnumbered) are carried over from RFC 4379 DSMAP; Types 6-7 (IPv4/IPv6 Protocol Adj, no interface field) are new. A coordination note requires that any code point assigned here without a counterpart in the Downstream Address Mapping Registry must be marked Reserved in that registry.
IANA created the 'Proxy Echo Parameters Sub-TLVs' registry with Sub-Type 0 (Reserved) and Sub-Type 1 (Next Hop). Allocation policy follows the rules in RFC 4379 Section 7.2.
IANA created the 'Proxy Flags' registry for the Proxy Echo Parameters TLV, with Standards Action allocation policy. Initial bits: 0 (Request for FEC Neighbor Address info), 1 (Request for Downstream Mapping), 2 (Request for Downstream Detailed Mapping), 3 (Explicit DSCP Request); bits 4-15 unassigned.
MPLS Proxy Ping is intended for use within a single service provider network. If the network also carries Internet traffic, Proxy Ping messages SHOULD be discarded at ingress points where IP packets are received from other administrations, using source address filtering or by filtering all MPLS ping messages on UDP port 3503.
MPLS Proxy Ping Request messages received via IP TTL expiry or label TTL expiry MUST NOT be acted upon, preventing the mechanism from being weaponized via TTL-based injection attacks.
Proxy Ping Requests are limited to FEC-based specification, ensuring only valid MPLS Echo Request messages can be created. The document asserts that no label-spoofing attacks are possible through this mechanism.
The Downstream Neighbor Address TLV mirrors the Upstream structure: Dnst Addr Type (1 octet), Local Addr Type (1 octet), MBZ (2 octets), Downstream Address (0/4/16 octets), Local Address (0/4/16 octets). Multiple instances may appear in a Proxy Ping Reply, one per downstream neighbor.
The Next Hop Sub-TLV (Sub-Type 1) encodes a specific next hop for Echo Request forwarding: Addr Type (1 octet), MBZ (3 octets), Next Hop IP Address (4 or 16 octets), Next Hop Interface (0, 4, or 16 octets). Seven address types are defined, including IPv4/IPv6 Numbered (types 1/3), Unnumbered (types 2/4), and Protocol Adj (types 6/7, no interface field).
The Proxy Echo Parameters TLV has a fixed 12-octet header: Address Type (1 octet), Reply Mode (1 octet), Proxy Flags (2 octets), TTL (1 octet), Requested DSCP (1 octet), Source UDP Port (2 octets), Global Flags (2 octets), MPLS Payload Size (2 octets). This is followed by a variable-length Destination IP Address (4 octets for IPv4, 16 for IPv6) and optional sub-TLVs.
The Reply-to Address TLV encodes the desired MPLS Echo Request IP source address: Address Type (1 octet, type 1=IPv4 or 3=IPv6), MBZ (3 octets), Reply-to Address (4 or 16 octets).
The Upstream Neighbor Address TLV encodes: Upst Addr Type (1 octet), Local Addr Type (1 octet), MBZ (2 octets), Upstream Address (0/4/16 octets per type), Local Address (0/4/16 octets per type). Address types: 0=no address, 1=IPv4, 3=IPv6. The upstream address MUST be the address used in the protocol exchange that established the label binding.