Bidirectional Forwarding Detection (BFD) for Generic Network Virtualization Encapsulation (Geneve)
Extracted elements (21)
BFD for Geneve defines two encapsulation formats — one with an inner Ethernet/IP/UDP header and one with an inner IP/UDP header — because the Geneve payload may be either an Ethernet frame or an IP packet, and the BFD encapsulation selection mirrors how the VAP encapsulates data packets.
The outer IP header and inner IP header may be of different address families: an outer IPv6 header with an inner IPv4 header, and an outer IPv4 header with an inner IPv6 header, are both explicitly permitted, providing deployment flexibility in mixed-stack environments.
A BFD session can only be established between two VAPs that are mapped to the same VNI and that use the same way to encapsulate data packets. Due to N-to-1 mapping between VAPs and VNIs, multiple BFD sessions between two NVEs for the same VNI are allowed.
An implementation MAY use the inner UDP source port number to aid in demultiplexing incoming BFD Control packets when Your Discriminator is zero, for both Ethernet-payload and IP-payload encapsulation modes.
BFD for Geneve MUST be used within a Traffic-Managed Controlled Environment (TMCE) unless BFD is really congestion controlled, due to the complexity and immaturity of the BFD congestion control mechanism.
If the BFD packet is received with a non-zero Your Discriminator, the BFD session MUST be demultiplexed only with the Your Discriminator as the key.
If the BFD packet is received with Your Discriminator set to 0, the BFD session SHOULD be identified using the VNI number and the inner Ethernet/IP header (source MAC, source IP, destination MAC, destination IP); if identification fails, the packet MUST be dropped.
If the BFD packet with IP payload is received with Your Discriminator set to 0, the BFD session SHOULD be identified using the VNI number and inner IP header (source IP and destination IP); if identification fails, incoming BFD Control packets MUST be dropped.
If the VAP of the originating NVE has no IP address, then the Source IP MUST be 0.0.0.0 for IPv4 or ::/128 for IPv6; if the terminating NVE VAP has no IP address, Destination IP MUST be 127.0.0.1 for IPv4 or ::1/128 for IPv6.
In the Geneve header for BFD with Ethernet payload: the O bit MUST be set to 1 (control message), the C bit MUST be set to 0 (no critical option), and the Protocol Type field MUST be set to 0x6558 (Ethernet frame).
In the Geneve header for BFD with IP payload: the O bit MUST be set to 1, the C bit MUST be set to 0, and the Protocol Type field MUST be set to 0x0800 (IPv4) or 0x86DD (IPv6) depending on the address family of the inner IP packet.
The BFD packet MUST be carried inside the inner Ethernet frame of the Geneve packet when the VAP encapsulates Ethernet data frames.
The TTL for IPv4 or Hop Limit for IPv6 MUST be set to 255, in accordance with RFC 5881 for single-hop BFD, for both inner Ethernet and inner IP encapsulation modes.
The VNI field in the Geneve header MUST be set to the VNI number that the originating VAP is mapped to, for both encapsulation modes.
When validating a received BFD packet with Ethernet payload, the destination IP, UDP destination port, and TTL/Hop Limit of the inner IP packet MUST be validated; if validation fails, the packet MUST NOT be processed by BFD.
When validating a received BFD packet with IP payload, the UDP destination port and TTL/Hop Limit of the inner IP packet MUST be validated; if validation fails, the packet MUST NOT be processed by BFD.
For BFD with inner Ethernet payload, the inner Ethernet header Destination MAC MUST be the MAC address of a VAP of the terminating NVE, and Source MAC MUST be the MAC address of a VAP of the originating NVE.
Considering Geneve does not have any inherent security mechanisms, BFD authentication as specified in RFC 5880 is RECOMMENDED to be utilized to protect BFD sessions over Geneve tunnels.
There SHOULD be a mechanism to control the maximum number of active BFD sessions between the same pair of NVEs, since N VAPs per NVE can result in N-squared BFD sessions that could overload the NVE. It is recommended to run N sessions covering all N VAPs instead.
When the VAP encapsulates Ethernet frames, the BFD Control packet is carried inside an inner Ethernet frame within the Geneve packet, structured as: Outer Ethernet Header / Outer IPvX Header / Outer UDP Header / Geneve Header / Inner Ethernet Header / Inner IPvX Header / Inner UDP Header / BFD Control Packet / Outer Ethernet FCS.
When the VAP encapsulates IP packets, the BFD Control packet is carried inside an inner IP packet within the Geneve packet, structured as: Ethernet Header / Outer IPvX Header / Outer UDP Header / Geneve Header / Inner IPvX Header / Inner UDP Header / BFD Control Packet / FCS.