Label Switched Path (LSP) Ping Mechanisms for EVPN and Provider Backbone Bridging EVPN (PBB-EVPN)
Extracted elements (24)
The egress PE can distinguish EVPN VPWS from regular EVPN instances because the EVI identified by the RD for EVPN VPWS is different from the EVI assigned for EVPN, allowing the same Ethernet A-D sub-TLV format to serve both use cases.
The GAL and IP ACH Channel header are used at the egress PE to distinguish OAM ping packets from data packets, allowing the PE to determine whether the incoming packet is an IPv4 or IPv6 OAM packet without inspecting payload contents.
The new sub-TLVs do not introduce new privacy concerns because the TLV fields contain the same information already present in data packets and EVPN routes, making no new data exposure possible via LSP Ping.
LSP Ping operations for unicast data plane connectivity checks in EVPN are similar to those in PBB-EVPN, except that EVPN checks are for C-MAC addresses while PBB-EVPN checks are for B-MAC addresses.
The procedures from RFC 6425 for preventing congestion of Echo Responses (Echo Jitter TLV) and limiting Echo Reply to a single egress node (P2MP Responder Identifier TLV) can be applied to LSP Ping in EVPN and PBB-EVPN when using P2MP P-trees for BUM traffic.
MPLS Echo Request IP/UDP packets MUST be encapsulated with the Transport and EVPN label(s) followed by the GAL (RFC 5586) as the bottommost label, followed by a G-ACh header carrying the IPv4 (0x0021) or IPv6 (0x0057) Channel Type.
The Ethernet Tag field value in the EVPN Ethernet A-D sub-TLV MUST be set to the reserved MAX-ET value for the per-ES context, and MUST be set to the non-reserved value for the per-EVI context.
The Target FEC Stack sub-TLVs MAY be used to validate that an identifier for a given EVPN is programmed at the target node, making their use optional but supported for all four EVPN FEC types.
The total length of the EVPN IP Prefix sub-TLV MUST be either 32 bytes (IPv4) or 56 bytes (IPv6). The IP prefix and gateway IP address MUST be from the same IP address family.
The two new Return Codes (37 and 38) SHOULD be included in the Echo Reply message by a PE in response to an Echo Request message in EVPN and PBB-EVPN networks.
When a per-ES EVPN A-D route for a multihomed ES is advertised with different RD values, the RD value used in the EVPN Ethernet A-D sub-TLV MUST be the RD value received for the EVI in the per-ES EVPN A-D route.
For Aggregate Inclusive P2MP P-tree, the Echo Request uses a label stack of [P2MP P-tree Transport label, upstream-assigned EVPN Inclusive Multicast label, GAL] with IP ACH Channel header, allowing both labels to jointly identify the L2 service.
For ingress replication, the Echo Request is sent using a label stack of [Transport label, Inclusive Multicast label] to each egress PE. The Inclusive Multicast label is the downstream-assigned label announced by the egress PE and is the inner label in the MPLS label stack.
Return Code 37 is used when the replying router is egress for the FEC but BUM packets are dropped on the ES corresponding to the ESI received in the EVPN Ethernet A-D sub-TLV because of Split Horizon Group filtering.
Return Code 38 is used when the replying router is egress for the FEC but BUM packets are forwarded because there is no ES corresponding to the ESI received in the EVPN Ethernet A-D sub-TLV.
The EVPN Ethernet Auto-Discovery sub-TLV (sub-type 44) is based on the EVPN Ethernet A-D route advertisement and applies only to EVPN. Fields include Route Distinguisher (8 octets), Ethernet Tag ID (4 octets), Ethernet Segment Identifier (10 octets), and Must Be Zero (2 octets).
The EVPN Inclusive Multicast sub-TLV (sub-type 43) verifies multicast connectivity state on peer PEs in EVPN and PBB-EVPN networks. Fields include Route Distinguisher (8 octets), Ethernet Tag ID (4 octets), IP Addr Len (1 octet), and Originating Router's IP Addr (4 or 16 octets).
The EVPN IP Prefix sub-TLV (sub-type 45) identifies the IP prefix for an EVI under test at a peer PE, derived from the IP Prefix route (RT-5). Total length MUST be either 32 bytes for IPv4 or 56 bytes for IPv6. Fields include RD (8 octets), Ethernet Tag ID, ESI (10 octets), IP Prefix Len, IP Prefix (4 or 16 octets), and GW IP Address (4 or 16 octets).
The EVPN MAC/IP sub-TLV (sub-type 42) identifies the target MAC, MAC/IP binding for ARP/ND, or IP address for an EVI under test at an egress PE. Fields include Route Distinguisher (8 octets), Ethernet Tag ID (4 octets), Ethernet Segment Identifier (10 octets), MAC Addr Len, MAC Address (6 octets), IP Addr Len, and optional IP Address (0, 4, or 16 octets).
To emulate traffic from a multihomed site in EVPN Echo Requests, an EVPN Ethernet A-D sub-TLV and an ESI Split Horizon Group MPLS label immediately preceding the GAL in the MPLS label stack are included. When using P2MP P-tree, the Split Horizon label is upstream assigned.
IANA assigned four new sub-TLV types in the 'Sub-TLVs for TLV Types 1, 16, and 21' subregistry within the MPLS LSPs Ping Parameters name space: sub-type 42 (EVPN MAC/IP), 43 (EVPN Inclusive Multicast), 44 (EVPN Ethernet Auto-Discovery), and 45 (EVPN IP Prefix).
IANA assigned two new Return Codes in the 'Return Codes' registry of the MPLS LSPs Ping Parameters name space: value 37 (Split Horizon Group filtering drop) and value 38 (BUM forwarded due to no matching ES).
LSP Ping for EVPN/PBB-EVPN faces the same security threats as baseline LSP Ping (RFC 8029): DoS via excessive Echo Requests, obfuscation of MPLS data plane state by spoofing/hijacking/replaying Echo messages, and unauthorized network topology disclosure. The same mitigations from RFC 8029 apply.
The EVPN MAC/IP sub-TLV wire format carries: Route Distinguisher (8 octets), Ethernet Tag ID (4 octets), Ethernet Segment Identifier (10 octets), Must Be Zero (1 octet), MAC Addr Len (1 octet), MAC Address (6 octets), Must Be Zero (1 octet), IP Addr Len (1 octet), and IP Address (0, 4, or 16 octets).