Transparent Interconnection of Lots of Links (TRILL): Pseudo-Nickname for Active-Active Access
Extracted elements (27)
Different member RBridges of an RBv use different distribution trees (via the Coordinated Multicast Trees mechanism in RFC 7783 and the Affinity sub-TLV) to ingress multi-destination frames, resolving RPF check violations that would otherwise drop traffic when multiple members ingressframes using the shared pseudo-nickname.
MAC address flip-flopping occurs when the same source MAC and VLAN are ingressed by different member RBridges of an active-active edge group, causing remote egress RBridges to continuously update their MAC-to-nickname mapping. Using a shared pseudo-nickname for all member RBridges as the ingress nickname eliminates flip-flopping because all ingressed frames appear to come from the same virtual RBridge.
To reduce traffic disruption from nickname changes, the vDRB SHOULD attempt to reuse the pseudo-nickname recently advertised by member RBridges in their PN-LAALP-Membership APPsub-TLVs. The candidate with the most supporting LAALPs is chosen; ties are broken by smallest nickname value.
RBridges that do not implement the OE (Occupy Exclusively) feature ignore the OE-flag and treat it as zero. To avoid misconfiguration, RBridges in an AAE group SHOULD NOT assert the OE-flag if any member does not implement it; practical consistency is expected since AAE group members are typically from the same vendor.
Two AAE methods (this document's pseudo-nickname approach and RFC 7782's multiple MAC attachments approach) can coexist in the same TRILL campus for different AAE groups. Deploying both requires all TRILL switches to support both methods, including the Affinity sub-TLV (RFC 7176, RFC 7783) for this document's method.
Before egressing a multi-destination TRILL Data packet out of an RBv port, a member RBridge MUST perform an ingress nickname filtering check: if the packet's ingress nickname matches the pseudo-nickname associated with that RBv port, the packet MUST NOT be egressed, preventing loopback to the originating CE.
Each member RBridge of an RBv SHOULD advertise the RBv's pseudo-nickname with maximum priority (0xFF) in a Nickname sub-TLV within its TRILL IS-IS LSP, alongside its regular nicknames, to prevent the pseudo-nickname from being claimed by a higher-priority RBridge.
If any VLAN in an LAALP is mapped to a Fine-Grained Label (FGL) by edge RBridges, the mapping MUST be identical for all edge RBridge ports in that LAALP; otherwise, unicast FGL TRILL Data packets may be mapped into different VLANs depending on which member egresses them.
Member RBridges SHOULD share learned {Data Label, MAC address, ingress nickname} correspondences with other members of the same LAALP via ESADI-LSPs using MAC-RI TLVs, to avoid unnecessary flooding when returning traffic arrives at a different member than the one that originally learned the address.
OAM packets MUST NOT use the pseudo-nickname as the ingress nickname except when responding to an OAM message that used the RBv's pseudo-nickname as the egress nickname. Using the pseudo-nickname in originated OAM messages would cause responses to be delivered to an arbitrary member RBridge.
Pseudonode LSP(s) MUST NOT be created for an RBv, since it is not a physical node. The tree root priority of the RBv's pseudo-nickname MUST be set to 0, and this nickname MUST NOT be listed in the 's' nicknames used to determine distribution tree roots.
The PN-MAC-RI-LAALP-INFO-START / PN-MAC-RI-LAALP-INFO-END boundary APPsub-TLV pair MUST occur within one TRILL GENINFO TLV. A lone END without a preceding START is ignored; if end-of-ESADI-LSP is reached after a START without encountering an END, end-of-LSP is treated as an implicit END.
VLAN membership MUST be identical across all RBridge ports in an LAALP. TRILL switches MUST disable ports connected to an LAALP with inconsistent VLAN configuration, as inconsistencies can cause packet loss or non-shortest paths when remote RBridges route return traffic based on the shared pseudo-nickname.
When a member RBridge receives a multi-destination TRILL Data packet on an RBv port, it MUST NOT egress it out of RBv ports where it is not the DF for the packet's Inner.VLAN. This prevents duplicate frame delivery to multiply-attached CEs.
When a unicast TRILL Data packet arrives at a member RBridge with the pseudo-nickname as egress nickname and the destination MAC is not locally reachable, the RBridge SHOULD re-encapsulate the packet with the destination member RBridge's regular nickname as the new egress nickname (tunnel forwarding) to reach the correct member.
When ingressing native frames from RBv ports, member RBridges MUST use the RBv's pseudo-nickname (not their regular nickname) as the ingress nickname in TRILL encapsulation. For frames received on non-RBv access ports, the regular nickname is used.
A Virtual RBridge (RBv) represents a group of edge RBridges to which at least one CE is multiply attached via an LAALP. It is identified campus-wide by a single pseudo-nickname distinct from any physical RBridge's regular nickname(s). Member RBridges use this pseudo-nickname as the ingress nickname when ingressing frames received on RBv ports.
LAALP IDs identify an AAE RBridge group campus-wide and must be unique across the campus. An 8-byte LAALP ID is an MC-LAG or DRNI identifier per IEEE 802.1AX Section 6.3.2. The meaning of LAALP IDs of other lengths is reserved for future documents.
The Designated Forwarder (DF) per VLAN is elected within each RBv to prevent duplicate delivery of multi-destination frames to CE(s). The DF is chosen per VLAN per LAALP by sorting member RBridges on SHA-256(System ID | LAALP ID) and assigning VLAN n to the RBridge at position (n mod k), where k is the number of members.
The RBv member discovery algorithm groups LAALPs into RBvs by: first isolating LAALPs with OE-flag=1 into exclusive RBvs, then iteratively grouping remaining LAALPs that share exactly the same set of multihomed RBridges into a common RBv, processing in descending order of member count with ties broken by ascending LAALP ID.
The vDRB (Designated RBridge of an RBv) is the member RBridge with the largest IS-IS System ID considered as an unsigned integer. The vDRB is responsible for selecting an available nickname as the pseudo-nickname for the RBv and announcing it via PN-RBv APPsub-TLV in E-L1FS FS-LSPs.
IANA allocated four code points in the 'TRILL APPsub-TLV Types under IS-IS TLV 251 Application Identifier 1' registry: type 2 (PN-LAALP-Membership), type 3 (PN-RBv), type 4 (PN-MAC-RI-LAALP-INFO-START), and type 5 (PN-MAC-RI-LAALP-INFO-END), all referencing RFC 7781.
Authenticity of IS-IS PDU contents (including the TRILL APPsub-TLVs defined here) is enforced using IS-IS security mechanisms per RFC 5310. Security for extensions carried by TRILL ESADI is addressed in RFC 7357's Security Considerations.
Because deployed LAALPs are proprietary and may lack authentication, a rogue RBridge that joins an active-active edge group can disrupt traffic. It could control approximately 1/N of unicast traffic flowing into or out of the group, all multi-destination traffic in VLANs for which it becomes DF, and could manipulate DF election by changing its System ID.
The PN-LAALP-Membership APPsub-TLV (type=2) carries a list of LAALP RECORDs, each containing: OE flag (1 bit), RESV (7 bits), Size (1 byte), Reusing Pseudo-Nickname (2 bytes), and variable-length LAALP ID. Distributed in E-L1FS FS-LSPs as a sub-TLV of TRILL GENINFO TLV.
The PN-RBv APPsub-TLV (type=3) is sent by the vDRB and contains: RBv's Pseudo-Nickname (2 bytes), LAALP ID Size (1 byte), and n variable-length LAALP IDs. Length must equal 3 + n*k; if not, the sub-TLV is corrupt and MUST be ignored.
Two boundary APPsub-TLVs bracket MAC-RI TLVs in ESADI-LSPs: PN-MAC-RI-LAALP-INFO-START (type=4) carries the LAALP ID (variable, 8 bytes for MC-LAG/DRNI), and PN-MAC-RI-LAALP-INFO-END (type=5) has zero-length body. The START/END pair MUST occur within a single TRILL GENINFO TLV.