Ingress Replication Tunnels in Multicast VPN
updates
Extracted elements (28)
A single control-plane operation (modifying the RT and PTA of the Leaf A-D route) simultaneously joins the new UMH and prunes the old one, so a child cannot stagger these events. The parent-continues and switch-parents-delay timers are therefore required to implement 'make before break' UMH switching at the data plane.
A single unicast tunnel between two nodes (e.g., an LDP MP2P LSP or RSVP-TE P2P LSP) may carry traffic for multiple IR P-tunnels simultaneously, as well as unicast traffic. The P-tunnel label at the top of the label stack is the sole mechanism by which a receiving child node distinguishes which IR P-tunnel a packet belongs to.
The identity of the ingress PE is inferred from the P-tunnel label rather than the IP source address of the encapsulating header. Using the IP source address is unreliable for segmented P-tunnels (where the source may be an intermediate node), may differ from the MVPN signaling address, and cannot yield the ingress VRF needed for extranet (RFC 7900) duplicate-prevention procedures.
Unlike all other P-tunnel types, the IR P-tunnel identifier does not appear in the PTA's Tunnel Identifier field at all; instead, the IR P-tunnel is identified by the NLRI of the advertising A-D route. This is because IR P-tunnels have no pre-existing setup protocol with its own tree-identifier syntax — BGP A-D routes are both the setup and the identifier.
An IR P-tunnel can instantiate only a single PMSI because two different advertising A-D routes (with different NLRIs) cannot advertise the same IR P-tunnel. To bind multiple customer multicast flows to a single IR P-tunnel, the ingress PE must use an I-PMSI A-D route or an S-PMSI A-D route with wildcards (RFC 6625).
If an egress PE joined an IR P-tunnel via the Intra-AS I-PMSI A-D route procedures (Section 4.1.2), it cannot infer the ingress PE from the P-tunnel label, so the 'Discarding Packets from Wrong PE' procedure of RFC 6513 Section 9.1.1 cannot be applied. Duplicate prevention then requires Single Forwarder Selection or native PIM procedures.
A Leaf A-D route joining an IR P-tunnel MUST identify the UMH by attaching an IP-address-specific (or IPv6-address-specific) Route Target, with the UMH's IP address in the Global Administrator field. The MPLS Label field of the PTA MUST be set to a non-zero value.
An intermediate node originating two Leaf A-D routes with different route keys MUST specify distinct non-zero MPLS labels in their respective PTAs, unless all three conditions hold: same parent node, same forwarding set of downstream neighbors, and identical per-downstream encapsulation for both P-tunnels.
At any given time, a router MUST consider itself to have only a single parent node on a given IR P-tunnel and MUST discard traffic that arrives on that P-tunnel from a different parent node.
For an Intra-AS I-PMSI A-D route with IR Tunnel Type, the label in the PTA's MPLS Label field MUST NOT appear in the MPLS Label field of any PTA carried by any other route originated by the same router.
Section 4 of RFC 6515 MUST be applied when a PTA is carried in a Leaf A-D route, to determine whether the Tunnel Identifier field carries an IPv4 or IPv6 address. When neither of the applicable conditions hold, the Tunnel Identifier field MUST be ignored upon reception.
The parent-continues timer MUST be longer than the switch-parents-delay timer. Both timers are specific to a given IR P-tunnel.
To support RFC 7900 extranet 'Do Not Deliver Packets from the Wrong P-tunnel' procedures, the MPLS labels in Leaf A-D routes from a given egress PE MUST be unique for the ordered triple <root, root RD, parent node>, where root RD is taken from the RD field in the IR P-tunnel identifier.
When a child node switches its UMH by modifying the RT of its Leaf A-D route, the old UMH MUST continue transmitting to the child for the duration of the parent-continues timer. Concurrently, the child MUST run the switch-parents-delay timer and MUST continue accepting packets from the old UMH until it expires.
When a router installs an S-PMSI A-D route after the corresponding Leaf A-D route is already installed and the Leaf A-D route's RT still identifies that router, it MUST apply the same procedures it would have followed had the S-PMSI A-D route been installed first. Implementers MUST NOT assume events occur in the expected order.
When a router joins a set of IR P-tunnels via an Intra-AS I-PMSI A-D route (Leaf Information Required bit not set), the MPLS Label field of the PTA MUST be set to a non-zero value and the label-to-I-PMSI binding MUST be one to one.
When an egress PE originates two Leaf A-D routes each identifying a different IR P-tunnel with different roots, the egress PE MUST NOT specify the same MPLS label in both PTAs. The same MPLS label MUST NOT be assigned to two IR P-tunnels that have different roots.
When an IR P-tunnel is identified in an S-PMSI A-D route or an Inter-AS I-PMSI A-D route, the Leaf Information Required bit of the PTA's Flags field MUST be set.
When the Leaf Information Required bit is set in a PTA specifying IR, the Tunnel Identifier field has no significance and MUST be ignored upon reception. Its length MUST still equal the length of an IP address in the SP backbone's address space, and it is RECOMMENDED that it be set to a routable address of the PTA's constructor.
When the MPLS Label field of a PTA is not significant (e.g., in S-PMSI A-D or Inter-AS I-PMSI A-D routes specifying IR), it SHOULD be set to zero upon transmission and MUST be ignored upon reception.
Whenever an egress node changes the Route Target of a Leaf A-D route (i.e., changes its parent node on a segmented P-tunnel), it MUST also change the MPLS label specified in the Leaf A-D route's PTA. This allows the egress node to distinguish packets from the old parent versus the new parent during the changeover.
An IR P-tunnel is a P2MP tree whose nodes are BGP speakers (PE routers, ASBRs, or ABRs). A parent node transmits multicast data to each child by labeling the packet with a P-tunnel label assigned by the child, then unicasting the packet through any P2P or MP2P unicast tunnel to that child — no Layer 2, IP, or MPLS multicast is used.
The 'parent-continues' timer governs how long an old UMH continues transmitting to a child after the child's Leaf A-D route is withdrawn or its RT changes to identify a new UMH. It SHOULD default to 60 seconds and SHOULD be configurable.
The 'switch-parents-delay' timer governs how long a child node continues to accept packets from the old UMH after modifying its Leaf A-D route's RT. It SHOULD default to 30 seconds, SHOULD be configurable, and expires early if a packet from the new UMH is received.
To join an advertised IR P-tunnel when the Leaf Information Required bit is set, a router determines its UMH (from the P2MP Segmented Next Hop Extended Community or the route's next hop), then originates a Leaf A-D route with the IR P-tunnel identifier as the route key, an IP-address-specific RT identifying the UMH, and a PTA with Tunnel Type IR and a non-zero MPLS label (the P-tunnel label).
When a PTA (PMSI Tunnel Attribute) identifies an IR P-tunnel, its Tunnel Type field is set to the value 6, meaning 'Ingress Replication'. This is the sole indicator that a given A-D route refers to an IR P-tunnel.
When the PTA Tunnel Type is IR and either the PTA is in a Leaf A-D route or the Leaf Information Required bit is not set, the Tunnel Identifier field MUST contain a routable IP address of the route's originator. The parent node uses this address to determine which unicast tunnel to use to send data along the IR P-tunnel to that originator.
No security considerations are raised by this document beyond those already discussed in RFC 6513 and RFC 6514.