Multicast VPN Using Bit Index Explicit Replication (BIER)
Extracted elements (22)
Although BIER does not explicitly build and maintain multicast tunnels, MVPN procedures treat BIER as if it were a type of tunnel (Tunnel Type 0x0B). One can conceptually think of an implicit P2MP tunnel from each BFIR to all BFERs, enabling reuse of existing MVPN multi-VPN aggregation procedures without protocol changes.
BIER is scoped to a single IGP domain, but MVPN traffic may traverse multiple IGP domains. The document leverages existing MVPN P-tunnel segmentation (at ASBRs or ABRs) to allow BIER to cover individual segments, with segmentation points acting as BFERs of one BIER domain and BFIRs of the next.
The LIR-pF method (Section 2.2.2) greatly reduces the number of S-PMSI A-D routes a BFIR must originate (potentially just one wildcard route instead of one per C-flow), but cannot be used with segmented P-tunnels because it does not allow the BFIR to assign a distinct label to each C-flow, which is required for label-based segment switching.
If a BFER's Leaf A-D route PTA specifies a sub-domain different from the one being used for transmitting the packet, the bit for that BFER cannot be determined and that BFER will not receive the packet. Sub-domain consistency between ingress PTA and Leaf A-D route is required for correct delivery.
Procedures to support MVPN customers using Bidirectional PIM (BIDIR-PIM) are explicitly out of scope for this document.
A BFIR SHOULD NOT set the LIR-pF flag unless it knows that all BFERs in the BIER domain (or at least all BFERs to which it needs to transmit) support this flag. Support for LIR-pF is OPTIONAL.
If a PTA specifying tunnel type BIER is attached to an x-PMSI A-D route, the route MUST NOT be distributed beyond the boundaries of a BIER domain; all routers receiving the route must be in the same BIER domain as the originator.
If two PTAs contain the same BFR-prefix in their Tunnel Identifier fields, the labels carried in those PTAs MUST come from the same label space (per RFC 5331 Section 7).
In the Leaf A-D route's PTA when BIER is used: tunnel type MUST be BIER, MPLS Label SHOULD be zero, sub-domain-id MUST match the corresponding value from the matching x-PMSI A-D route's PTA, BFR-id MUST be set to the egress PE's BFR-id, and BFR-prefix MUST be set to the egress PE's BFR-prefix.
The MPLS Label field in the PTA MUST contain an upstream-assigned non-zero MPLS label assigned by the BFIR constructing the PTA. Failure to follow label assignment constraints cannot be detected by the protocol and may result in improper handling of data packets by egress PE routers.
To determine the set of BFERs for a given C-flow using the LIR method, a BFIR MUST originate a (C-S,C-G) S-PMSI A-D route with a PTA and MUST set the Leaf Information Required (LIR) flag; BFERs that need to receive the flow respond with Leaf A-D routes.
When two x-PMSI A-D routes from the same BFIR do not carry the same set of RTs, do not have the same AFI, originate from different VRFs (for extranet), differ on the Extranet Separation community, or (with segmented P-tunnels) have non-identical NLRIs, their respective PTAs MUST contain different MPLS label values.
When using the LIR-pF method, the BFIR MUST originate a wildcard S-PMSI A-D route with the LIR-pF flag set, tunnel type BIER, and a non-zero MPLS label. A BFIR MUST NOT use this method unless it knows all relevant BFERs support the LIR-pF flag.
At a BFER acting as a P-tunnel segmentation boundary, the upstream-assigned MPLS label (which the BFIR assigns distinctly per C-flow per Section 2.1 constraints) is used to select the correct next P-tunnel segment for the packet, enabling label-based switching at segmentation points without per-flow multicast state.
At a BFER that is an egress PE, the upstream-assigned label is looked up in the context of the packet's BFIR-prefix to determine the egress VRF; the egress PE then uses the payload IP header, VRF multicast state, the label, and BFR-prefix to decide if the packet must be forwarded out one or more VRF interfaces.
On the data plane, to transmit an MVPN packet via BIER, the ingress PE (BFIR) pushes the upstream-assigned MPLS label from the matching x-PMSI A-D route's PTA onto the packet's label stack, then encapsulates the packet in a BIER header, forwarding per RFC 8279 and RFC 8296 procedures.
The Leaf A-D route carries a PTA that communicates the egress PE's (BFER's) BFR-prefix and sub-domain-id back to the ingress PE (BFIR), enabling the BFIR to construct the BIER BitString for forwarding. The BFR-prefix in the Leaf A-D route PTA need not match any other IP address in the route.
The PMSI Tunnel Attribute (PTA) for BIER contains: Flags (1 octet), Tunnel Type 0x0B (1 octet), MPLS Label (3 octets), and a Tunnel Identifier comprising Sub-domain-id (1 octet), BFR-id (2 octets), and BFR-prefix (4 or 16 octets for IPv4 or IPv6 respectively).
When a BFER receives a BIER-encapsulated MVPN packet, the BIER layer passes to the multicast flow overlay: the sub-domain-id and BFIR-id from the BIER header (or BIFT-id as an implementation choice), and the payload MPLS packet whose top label is the upstream-assigned label interpreted in the context of the BFIR-id and sub-domain-id.
IANA assigned codepoint 0x0B to 'BIER' in the 'P-Multicast Service Interface Tunnel (PMSI Tunnel) Tunnel Types' registry.
The procedures of this document do not, in themselves, provide privacy, integrity, or authentication for the control plane or the data plane. Security considerations for BIER are addressed in RFC 8279 and RFC 8296; VPN-related security considerations are addressed in RFC 4364, RFC 6513, and RFC 6514.
The Tunnel Identifier field in the BIER PTA has three subfields: Sub-domain-id (1 octet identifying the BIER sub-domain), BFR-id (2 octets, the BFR-id of the PTA-constructing router in that sub-domain), and BFR-prefix (4 octets for IPv4 /32 or 16 octets for IPv6 /128). IPv4 vs. IPv6 is inferred from the total PTA length.