Active Operations, Administration, and Maintenance (OAM) for Use in Generic Network Virtualization Encapsulation (Geneve)
Extracted elements (21)
A source-only IPv6 address from the Dummy IPv6 Prefix (100:0:0:1::/64) is used as the destination in the inner IP header to generate an exception and a reply message to the request, ensuring OAM packets are not forwarded beyond the receiving NVE.
IP encapsulation is chosen for active OAM in Geneve because it meets all the stated requirements and is a well-known approach already used in MPLS networks (RFC 8029). The destination UDP port number in the inner UDP header identifies the specific OAM protocol, leveraging existing demultiplexing conventions.
The Management VNI is terminated on the tenant-facing side rather than the DC-network-facing side so that Geneve encap/decap functionality is included in its scope. This allows a repeated ICMP echo request/reply test to detect intermittent problems in Geneve encap/decap hardware that would otherwise be missed if the Management VNI were handled as a special case at the DC-network-facing interface.
Active OAM messages in a Geneve overlay network are exchanged between two Geneve tunnel endpoints (NVEs). Testing end-to-end between tenants is explicitly out of scope. The document applies only to NVE-to-NVE OAM within the Geneve overlay.
A packet received over the control channel MUST be forwarded if and only if it is sent onto the control channel of the concatenated Geneve tunnel; otherwise it MUST be terminated locally.
For IPv4, the inner IP destination address MUST be set to the loopback address 127.0.0.1/32. For IPv6, the destination address MUST be selected from the Dummy IPv6 Prefix 100:0:0:1::/64 (RFC 9780).
It is RECOMMENDED that the default value 1 be used as the Management VNI.
OAM test packets MUST NOT be forwarded to a tenant system.
OAM test packets MUST share the same fate as the data traffic of the monitored Geneve tunnel, being in-band with the monitored traffic and following the same overlay and transport paths as data payload packets in the forward direction.
OAM test packets SHOULD be transmitted on a VNI that doesn't have any tenants (the Management VNI) to conform to the requirement that OAM test packets not be forwarded to tenant systems.
The control channel of a Geneve tunnel MUST NOT carry tenant data. A system supporting this specification MUST NOT forward a packet received over the control channel to any tenant.
The encapsulation of OAM control messages and data packets in the underlay network MUST be indistinguishable.
The Management VNI SHOULD be terminated on the tenant-facing side of the Geneve encapsulation/decapsulation functionality (not the DC-network-facing side) so that Geneve encap/decap functionality is included in its scope.
The presence of an OAM control message in a Geneve packet MUST be unambiguously identifiable to Geneve functionality, such as at endpoints of Geneve tunnels.
The TTL or Hop Limit in the inner IP header MUST be set to 255 per RFC 5082 (GTSM). The receiver of an active OAM Geneve packet with IP/UDP encapsulation MUST drop packets whose TTL/Hop Limit is not 255.
There MUST be a way to encode entropy information into the underlay forwarding scheme so that OAM packets take the same data-flow paths as the transit traffic flows.
Active OAM over a Management VNI in the Geneve network uses IP encapsulation. The Protocol Type field of the Geneve header MUST be set to 0x0800 (IPv4) or 0x86DD (IPv6). Protocols such as BFD and STAMP use UDP transport, and the destination UDP port number in the inner UDP header identifies the OAM protocol.
ICMP and ICMPv6 are cited as examples of active OAM protocols providing on-demand defect detection and failure localization. ICMP control messages immediately follow the inner IP header encapsulated in Geneve. ICMP extensions for Geneve networks use mechanisms defined in RFC 4884.
The Management VNI is a dedicated VNI used as a Geneve control channel carrying only OAM control and management data between tunnel endpoints, with no tenant traffic. The default Management VNI value is 1, though a configured VNI MAY be used.
Active OAM in Geneve inherits security considerations from RFC 8926. A system MUST provide control to limit the rate of Geneve OAM packets punted to the Geneve control plane to avoid overloading it. Any packet received with an inner TTL/Hop Count other than 255 MUST be discarded (per the General TTL Security Mechanism, RFC 5082).
Active OAM in Geneve uses a layered encapsulation: Outer IPvX Header / Outer UDP Header / Geneve Header / Inner IPvX Header / Inner UDP Header / Active OAM Packet. The inner UDP destination port identifies the OAM protocol (e.g., BFD or STAMP).