Segment Routing Replication for Multipoint Service Delivery
updated by
- rfc-9960 — Segment Routing Point-to-Multipoint Policy
Extracted elements (28)
H.Encaps.Red used to steer a replicated packet to a downstream node is intentionally independent of the Replication segment itself — it is purely a traffic-engineering mechanism applied per branch. This separation allows some branches to use explicit paths while others use shortest-path routing, without coupling these choices to the Replication segment definition.
The IPv6 Hop Limit Threshold was introduced as an optional per-Replication-segment parameter to mitigate the risk of non-replication transit nodes generating storms of ICMPv6 Time Exceeded errors when a packet's Hop Limit expires before reaching all leaf nodes, which could overwhelm the root node.
The Replication-ID is defined as a variable-length field (not fixed at 32 bits) to allow future extensions or use-case-specific modifications. The length is specified in the signaling mechanism (e.g., SR P2MP policy) rather than hardcoded in the forwarding plane specification.
The Replication segment is designed so that replication to non-adjacent downstream nodes does not require state on transit routers. Transit nodes forward replicated packets based solely on the IPv6 locator unicast prefix (or MPLS forwarding), while only replication nodes hold Replication state.
OAM ping is possible for leaf or bud node Replication-SIDs (directly or via transit replication nodes), but pinging a transit node's Replication-SID directly is not possible because transit nodes do not process Upper-Layer headers. A transit replication node will replicate Echo Requests to all downstream nodes; nodes with incorrect checksums will drop them.
Traceroute to a leaf or bud node Replication-SID is not possible because ICMPv6 Time Exceeded messages are prohibited for Replication-SIDs (mirroring the multicast restriction of RFC 4443). This is an inherent limitation of the End.Replicate behavior.
When H.Encaps.Red is used to steer a replicated packet on a traffic-engineered path to a downstream node, the operator must ensure the MTU on the path is sufficient to account for the additional SRv6 encapsulation. This also applies when the root node's upstream placed the Replication-SID in the header.
A replication node MAY use an Anycast-SID or BGP PeerSet-SID in the segment list to send a replicated packet to one downstream replication node in a set of Anycast nodes, if and only if all nodes in the set have an identical Replication-SID and reach the same set of receivers.
An implementation of a Replication segment for SRv6 MUST enforce the same ICMPv6 error message restrictions as RFC 4443 Section 2.4 (which prohibits ICMPv6 errors for packets destined to multicast addresses), with the same two exceptions: Packet Too Big messages and ICMPv6 Parameter Problem with Code 2.
If a Replication segment has an IPv6 Hop Limit Threshold configured, a replication node MUST discard an incoming packet with a local Replication-SID if the IPv6 Hop Limit in the packet is less than the threshold, and log this in a rate-limited manner.
If a root node encodes a context-SID in an SRH with an optional HMAC SRH TLV (RFC 8754), it MUST set the 'D' bit as defined in RFC 8754 Section 2.1.2, because the Replication-SID is not part of the segment list in the SRH.
If HMAC TLV verification fails on a Replication-SID implementation, it MUST NOT originate an ICMPv6 Parameter Problem message with code 0. The failure SHOULD be logged (rate-limited) and the packet SHOULD be discarded.
If local provisioning is used to stitch Replication segments, a chain of Replication segments SHOULD NOT form a loop. If a control plane is used, the control plane specification MUST prevent loops or detect and mitigate loops in steady state.
The IPv6 Hop Limit Threshold SHOULD be set so that an incoming packet can be replicated to the furthest leaf node. A root node encapsulating a payload SHOULD set the IPv6 Hop Limit via local policy to allow packets to reach the furthest leaf.
The source of an OAM ping to a leaf or bud node via a transit replication node's Replication-SID MUST compute the ICMPv6 Echo Request checksum using the Replication-SID of the target leaf or bud node as the DA, not the transit node's SID.
When processing a packet destined to a local End.Replicate Replication-SID, the IPv6 Hop Limit MUST be decremented and MUST be non-zero for the packet to be replicated. If Hop Limit is less than or equal to 1, the packet is discarded without sending an ICMPv6 Time Exceeded message.
When two H.Encaps operations would otherwise be needed on a root node — one for the service (MVPN/EVPN) and one for replication steering to a downstream node — they SHOULD be combined for optimization to avoid extra IPv6 encapsulation.
A bud node is both a replication node and a leaf node of a multipoint service. Its Replication segment contains a non-empty list of replication branches as well as a leaf role indicator, so it both replicates packets downstream and locally delivers the payload.
A Replication segment is a local segment instantiated at a replication node, identified by the tuple <Replication-ID, Node-ID>. It includes a Replication-SID (SR-MPLS label or SRv6 SID), a set of downstream nodes, and a Replication state (RS) which is a list of replication branches, each abstracting to a <downstream node, downstream Replication-SID> tuple.
End.Replicate ('Endpoint with replication and/or decapsulate') is the SRv6 endpoint behavior defined by this document. When a packet arrives with a local Replication-SID as DA, the node replicates the packet per the RS by reusing the outer IPv6 header and writing the downstream Replication-SID into the outer IPv6 DA, then submits each copy to the egress IPv6 FIB for forwarding.
For SR-MPLS, the active Replication-SID triggers a POP of that label and RS lookup. For each downstream branch, the node PUSHes the downstream Replication-SID plus an optional segment list. At a leaf or bud node, the Replication-SID is processed with a NEXT operation and the payload is delivered per local configuration.
The Replication state (RS) for SRv6 End.Replicate contains: Node-Role (Head, Transit, Leaf, or Bud), an optional IPv6 Hop Limit Threshold (default zero), and a Replication-List of entries each specifying a downstream node identifier, downstream Replication-SID, and an optional Segment-List. For a leaf node, the replication list is zero length.
IANA assigned codepoint 75 (hex 0x004B) for End.Replicate behavior in the 'SRv6 Endpoint Behaviors' registry within the 'Segment Routing' registry group. The change controller is IETF and the reference is RFC 9524.
An attacker can forge an IPv6 packet with a victim's source address, a Replication-SID as DA, and a low Hop Limit to cause forwarding nodes to generate a storm of ICMPv6 Time Exceeded messages toward the victim. The IPv6 Hop Limit Threshold check in Section 2.2 can help mitigate this attack.
An attacker that subverts ingress filters cannot use a stack of Replication segments for amplification or link exhaustion attacks because Replication segment trees always terminate at a leaf or bud node resulting in decapsulation. However, an attacker could still inject traffic to receivers within a P2MP service.
Incorrect provisioning of Replication segments without a control plane can result in a looping chain, causing a packet storm until MPLS TTL (SR-MPLS) or IPv6 Hop Limit (SRv6) decrements to zero. A control plane such as PCE should be used to prevent loops.
SR domain protection requires filtering on external interfaces: for SR-MPLS, disable MPLS on external edge interfaces; for SRv6, configure inbound IACLs on each edge interface to drop packets with a DA in the SID prefix block S/s, and implement BCP 38/84 anti-spoofing recommendations. Failure to do so allows outsiders to exploit replication services.
The ICMPv6 Parameter Problem Code 2 exception (for unknown mandatory options) creates a potential DoS vector: an attacker can send packets with a spoofed source address, a Replication-SID as DA, and an extension header with an unknown mandatory option type, causing a flood of ICMPv6 responses to overwhelm the spoofed source. Future extensions adding new extension headers must account for this.