Support for Shortest Path Bridging MAC Mode over Ethernet VPN (EVPN)
Extracted elements (27)
A transit PE that does not need to participate in tandem calculations at the B-MAC layer can use the IS-IS overload bit to exclude itself from SPBM tandem paths and behave as a pure interworking platform, simplifying its role in the network.
Each SPBM island is operationally isolated with its own control-plane instance and multipathing design (multiple equal-cost tree sets or multiple spanning trees). This isolation permits past, current, and future versions of Ethernet to be seamlessly interconnected at scale via EVPN as the unifying system.
Only head-end replication (tunneling multicast in unicast PBB frames) is supported for multicast traffic interworking. Native PBB multicast forwarding over EVPN, PE replication, and optimized PBB multicast across EVPN are explicitly out of scope for this document.
The B-VID (backbone VLAN ID, which determines multipathing in SPBM) is kept local to each SPBM domain and is removed from frames carried over the IP/MPLS network. This allows each SPBM island to have a unique multipathing configuration without topological dependencies between islands.
A PBB PE has no attached PBBN and no concept of B-VID, so no frame processing for B-VID is required. However, it must interpret SPBM-encoded multicast DAs as PBB-encoded, treating only the I-SID encoded in the lower 24 bits as relevant.
SPBM multipathing configuration (B-VID assignments) is not propagated across the IP/MPLS EVPN core, enabling independent multipathing designs in each SPBM island. I-SID-based load-balancing per RFC 7623 allows multiple gateways per B-VID across the EVPN.
A PBB PE is required to accept SPBM-encoded multicast destination addresses as if they were PBB-encoded (i.e., using the Backbone Service Instance Group address), treating them as multicast frames with the I-SID encoded in the lower 24 bits.
A PE MUST implement and perform all the procedures defined in Section 4, covering PE configuration, DF election, control-plane interworking, and data-plane interworking.
An SPBM-PE that is a DF for a B-VID MUST strip the B-VID tag information from frames relayed towards the EVPN.
For each B-VID in an SPBM island, a single SPBM-PE MUST be elected the Designated Forwarder (DF) for that B-VID. An SPBM-PE can be DF for more than one B-VID.
If an SPBM island has no BEBs registering interest in a particular I-SID, information about that I-SID from other SPBM islands, PBB PEs, or PBBNs MUST NOT be leaked into the local ISIS-SPB routing system.
The DF MUST also insert the appropriate B-VID tag information into frames relayed towards the SPBM island, based on the local I-SID/B-VID bindings advertised in ISIS-SPB.
At PE commissioning, two items are configured: (1) the route target for the service instance, and (2) the unique ESI for the SPBM island. Additionally, ISIS-SPB commissioning requires an SPSourceID and the set of B-VIDs with their multipathing algorithm IDs.
BGP serves as a common repository of I-Component Service ID (I-SID) attachment points, stored as {B-MAC address, I-SID, Tx-Rx-attribute} tuples, and distributes I-SID information into each SPBM island based on locally registered interest.
Data-plane forwarding from EVPN to SPBM: the PE infers the B-VID to overwrite from the I-SID or from the bottom label in the MPLS stack. For local multicast DAs, the SPSourceID in the frame is overwritten with the local SPSourceID.
Data-plane forwarding from SPBM to EVPN: the DF PE strips B-VID from the received SPBM frame, looks up B-MAC/I-SID to determine the label stack, adds the label stack, and forwards the resulting MPLS packet into the EVPN.
Each EVPN instance is identified by a route target that defines the set of SPBM islands, PBBNs, and PBB PEs allowed to communicate. Each SPBM island is also assigned a unique Ethernet Segment ID (ESI) via an ESI Label extended community.
PEs self-appoint for the DF role per B-VID using the procedure in RFC 7432 Section 8.5. A PE becoming DF must originate information into BGP from ISIS-SPB; a PE ceasing to be DF must withdraw the associated information from both BGP and ISIS-SPB.
The ISIS-SPB information received by the DF is used to maintain a local table indexed by I-SID indicating the associated B-VID for processing EVPN-received frames. When an I-SID maps to more than one B-VID, only one entry is allowed; rules for preventing this are out of scope.
The SPBM-PE is a co-located SPBM-to-EVPN interworking function and EVPN PE. It acts both as an EVPN BGP speaker and as an ISIS-SPB edge node, mapping ISIS-SPB information elements into EVPN NLRIs and vice versa.
When a PE receives an SPBM service identifier and unicast address sub-TLV via ISIS-SPB MT capability TLV and is the DF for that B-VID, it creates or updates a MAC/IP advertisement route NLRI for each new or changed I-SID, setting the Route Distinguisher, ESI, Ethernet Tag ID (I-SID), MAC address, and a locally assigned MPLS label.
When a PE receives BGP NLRI with new information, it checks if it is the elected DF for the relevant I-SID/B-VID mapping, then constructs or updates SPBM service identifier and unicast address sub-TLVs for advertisement into ISIS-SPB, and populates a forwarding table indexed by B-MAC+I-SID pointing to the MPLS label stack.
Frequent DF election changes caused by SPBM-PE links repeatedly going up and down generate significant control-plane traffic as DF-associated information is advertised and withdrawn from both SPBM and BGP. Dual-homing SPBM-PEs on both networks minimizes this risk.
Provisioning an incorrect route target at an SPBM-PE, or associating the RT with the wrong interface, can cause incorrect cross-connection of SPBM domains via EVPN, resulting in black-holing or incorrect delivery of data with associated privacy implications. Consistency-checking RT provisioning during service additions and changes is recommended.
Security issues associated with incorrect interconnection of customer LANs cannot be directly addressed by this document, as they require misconfiguration in the SPBM domains. Identifiers administered globally are relayed transparently by EVPN and only policed within the SPBM domains, requiring careful synchronization.
The ESI must be unique and common to all SPBM-PEs connected to a common SPBM network or PBBN. An incorrect ESI causes portions of the network not to share reachability, and the EVPN will incorrectly assume separate networks are interconnected by SPBM.
The I-SID is encoded in the 32-bit Ethernet Tag ID field of the MAC/IP advertisement NLRI as follows: bit 31 = T (Transmit), bit 30 = R (Receive), bits 29-24 = Reserved, bits 23-0 = I-SID (24-bit Backbone Service Instance Identifier).