Deterministic Networking (DetNet) Data Plane: IP over MPLS
Extracted elements (21)
A single incoming DetNet MPLS flow MAY be treated as a single DetNet IP flow without examination of IP headers, allowing simplified egress processing. Alternatively, normal DetNet IP flow identification per RFC 8939 Section 5.1 may be applied.
DetNet IP flows and non-DetNet IP packets are identical on the wire, making the specification applicable to any node supporting IP over DetNet MPLS. This avoids requiring end systems to signal whether they are DetNet-aware.
Edge nodes can serve as DetNet service proxies for non-DetNet-aware end systems by initiating and terminating DetNet service for the application's IP flows. There is essentially no difference in data plane processing between relay nodes and edge nodes, though Controller Plane operation may differ.
The three main differences of mapping IP to DetNet MPLS (compared to plain MPLS) are: (1) mandatory flow identification for forwarding decisions rather than FEC-based forwarding, (2) the d-CW is mandatory for MPLS encapsulation, and (3) DetNet-flow-specific traffic treatment is required during forwarding.
The primary difference between this document and RFC 8964 (DetNet MPLS) is that relay nodes are at the edges of the MPLS domain and function as T-PEs, whereas in RFC 8964 the T-PEs are located at the end systems and MPLS spans the whole DetNet service. MPLS service sub-layer functions are not provided over the DetNet IP network.
Use of Layer 4 transport protocols (e.g., for multipath) is explicitly out of scope of this document, both for single flows and aggregate flows.
A DetNet relay node acting as ingress T-PE that sends a DetNet IP flow over a DetNet MPLS network MUST map the DetNet IP flow (as identified per RFC 8939) into a single MPLS DetNet flow and MUST process it in accordance with the procedures defined in RFC 8964.
An implementation MUST support the provisioning for handling any packet flows received via the DetNet MPLS data plane as DetNet IP flows via configuration, which MAY include support from PREOF on the incoming DetNet MPLS flow.
PRF MAY be supported at the MPLS level for DetNet IP flows sent over a DetNet MPLS network, and aggregation MAY be supported as defined in Section 4.4 of RFC 8964.
The provisioning of the mapping of DetNet IP flows to DetNet MPLS flows MUST be supported via configuration, e.g., via the Controller Plane.
Traffic treatment for DetNet IP flows received over the DetNet MPLS data plane MUST follow Section 5.3 of RFC 8939 (DetNet IP Traffic Treatment Procedures).
When a DetNet IP flow is sent over DetNet MPLS, a DetNet relay node MUST ensure that the provisioned DetNet IP traffic treatment is provided at the forwarding sub-layer as described in Section 5.2 of RFC 8964.
A single S-Label (DetNet service label) is used to support a single App-flow per Section 5.1 of RFC 8964. The IP six-tuple is mapped to the S-Label; various IP fields may be mapped or ignored when translating from IP to MPLS.
DetNet IP flows are treated as App-flows from the DetNet MPLS perspective. The IP payload (IP header plus next-protocol header) is encapsulated with a DetNet Control Word (d-CW) and MPLS labels, carried over a link or sub-network layer (L2, TSN, or UDP/IP).
DetNet relay nodes act as T-PEs (Terminating Provider Edges) at the boundaries of the MPLS domain, responsible for mapping DetNet flows at the service sub-layer between the IP and MPLS DetNet data planes. An S-PE (Switching Provider Edge) may sit in the middle of the domain.
PREOF (Packet Replication, Elimination, and Ordering Functions) can be provided at the MPLS service sub-layer for DetNet IP flows. The egress T-PE MAY be provisioned to apply PREOF on the incoming DetNet MPLS flow before treating packets as DetNet IP flows.
Transit nodes within the MPLS domain are MPLS TE LSP aware and perform switching based solely on MPLS labels; they do not require any specific knowledge of the DetNet service or corresponding DetNet flow identification.
Application flows can be protected through encryption such as IPsec (RFC 4301) for IP flows or MACsec (IEEE 802.1AE-2018) for IP-over-Ethernet flows. This document does not add or modify any header information from a data plane perspective.
DetNet flows are identified on a per-flow basis, which may provide Controller Plane attackers with additional information about data flows compared to Controller Planes that do not include per-flow identification. This is an inherent property of DetNet and should be assessed when evaluating DetNet suitability for a given use case.
To protect against DoS attacks, excess traffic from malicious or malfunctioning devices can be mitigated through policing and shaping at the input of a DetNet domain. To prevent delay attacks by external entities, DetNet allows for mitigation of man-in-the-middle attacks through authentication and authorization of devices within the DetNet domain.
The DetNet IP over MPLS encapsulation stack is: IP flow (NProto + IP) as App-flow, followed by the DetNet Control Word (d-CW), followed by MPLS Labels, followed by the link/sub-network layer (L2, TSN, or UDP/IP/L2). The d-CW is mandatory for all MPLS encapsulation of DetNet flows.