Directory-Assisted Transparent Interconnection of Lots of Links (TRILL) Encapsulation
Extracted elements (18)
A server acting as an edge node can use its own MAC address as the source MAC in frames from hosted VMs; the egress target node then uses directory-provided IP-to-MAC mapping to deliver to the correct VM, effectively hiding VM MAC addresses from local bridges.
Non-RBridge TRILL encapsulation avoids the nickname exhaustion problem: all TRILL-ENs attached to one RBridge can share one TRILL nickname, allowing large data centers with hundreds of thousands of virtual switches to operate without exhausting the TRILL nickname space or overwhelming IS-IS.
The TRILL-EN concept moves the TRILL encapsulation function to end nodes (virtual switches) assisted by a pull directory, rather than requiring every end node to be a full RBridge participant in IS-IS routing, enabling scalability in large data centers.
When virtual switches pre-encapsulate frames destined for remote edge RBridges, the outer MAC destination becomes the local ingress RBridge MAC address, preventing local bridged LAN switches from needing to store MAC entries for remote hosts and dramatically reducing MAC table sizes.
Item 8 of Section 4.6.2 of the TRILL base protocol specification [RFC6325] specifies that an RBridge port can be configured to accept TRILL-encapsulated frames from a neighbor that is not an RBridge, enabling interoperability with TRILL-ENs.
When a TRILL-encapsulated packet reaches an ingress RBridge, that RBridge performs normal TRILL processing and forwards the pre-encapsulated packet to the RBridge specified by the egress nickname field, with no special handling required for TRILL-EN-originated packets.
A combination of authentication and encryption is RECOMMENDED between the directory and TRILL-EN to protect against false mappings being injected via an attacked directory-to-TRILL-EN path.
A TRILL-EN MUST support TRILL ES-IS [RFC8171] in order to pull (MAC and VLAN) <-> Edge RBridge mapping from directory servers.
An RBridge port should not be configured to accept encapsulated TRILL data frames on a link where it does not have an RBridge adjacency unless the end stations on that link are trusted.
A TRILL Encapsulating Node (TRILL-EN) is a node that performs TRILL encapsulation but does not participate in RBridge IS-IS routing. It obtains egress RBridge nicknames from a directory service via TRILL ES-IS.
Upon receiving or locally generating a native Ethernet frame, the TRILL-EN checks the (MAC and VLAN) <-> Edge RBridge mapping table and performs TRILL encapsulation if the entry is found; if no mapping is found and no directory reply is received, the frame is dropped or forwarded natively depending on configuration.
When a TRILL-EN adds a TRILL header to a data packet, the ingress RBridge nickname field is set to the nickname of the Appointed Forwarder (AF) for the data packet's VLAN. The TRILL-EN determines the AF by snooping on IS-IS Hellos from edge RBridges.
Directory-assisted encapsulation by TRILL-ENs involves those nodes spoofing edge RBridges; however, TRILL's hop count in the TRILL header prevents persistent loops, and a Reverse Path Forwarding Check prevents multiplication of multidestination packets.
If the path between the directory and a TRILL-EN is attacked, false mappings can cause packets to be sent to wrong destinations, potentially violating security policy; end-to-end encryption and authentication from source to destination end station should be considered as an additional defense.
TRILL-ENs can forge both outer and inner MAC addresses of packets they send, and because they pre-encapsulate, they can also send data in any VLAN—they must be trusted nodes to enforce VLAN-based security policies.
TRILL-ENs necessarily learn the MAC addresses of TRILL edge RBridges and egress RBridge nicknames, which reveals substantial topology information about the TRILL domain and represents a potential security risk if TRILL-ENs are compromised.
Untrusted TRILL-ENs can forge arbitrary ingress and egress nicknames in TRILL headers, causing incorrect data-plane MAC learning at egress RBridges and directing future traffic to wrong RBridges. RBridge ports must only accept TRILL-encapsulated frames from trusted end stations.
A TRILL-encapsulated frame constructed by a TRILL-EN consists of an outer Ethernet header, a TRILL header (including ingress and egress RBridge nicknames), an inner Ethernet header with InnerDA and InnerSA fields, payload, and FCS.