RFC 6512
Using Multipoint LDP When the Backbone Has No Route to the Root
RFC 6512: Using Multipoint LDP When the Backbone Has No Route to the Root 🎀
- Number: RFC 6512
- Category: Standards Track
- Date: February 2012
- ISSN: 2070-1721
- Publisher: Internet Engineering Task Force (IETF)
- Authors: IJ. Wijnands (Cisco Systems), E. Rosen (Cisco Systems), M. Napierala (AT&T), N. Leymann (Deutsche Telekom)
- Obsoletes / Updates: none listed in the title block
Abstract ✨
Okay so, MP LSPs (Point-to-Multipoint and Multipoint-to-Multipoint Label Switched Paths, "MP LSPs") get built with a control protocol, and that protocol has a field holding the address of a "root node". Every intermediate node is expected to look that address up in its routing table. The problem is that if the route to the root is a BGP route and the middle nodes live in a BGP-free core, that lookup just doesn't work 😭. This document explains how to build an MP LSP through a BGP-free core anyway. The root address gets temporarily swapped for an address the middle nodes do know, one that sits on the path to the true root. Iconic problem-solving, honestly 💅
Status of This Memo 📜
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
Info about the current status of this document, any errata, and how to give feedback on it can be found at http://www.rfc-editor.org/info/rfc6512. 🔗
Copyright Notice ©️
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Table of Contents 🗂️
1. Introduction ....................................................3
2. The Recursive Opaque Value ......................................5
2.1. Encoding ...................................................5
2.2. Procedures .................................................5
3. The VPN-Recursive Opaque Value ..................................6
3.1. Encoding ...................................................6
3.2. Procedures .................................................7
3.2.1. Non-Segmented Inter-AS P-Tunnels ....................7
3.2.2. Limited Carrier's Carrier Function ..................9
4. IANA Considerations ............................................10
5. Security Considerations ........................................10
6. Acknowledgments ................................................10
7. References .....................................................11
7.1. Normative References ......................................11
7.2. Informative References ....................................111. Introduction 🦋
Okay so the document [mLDP] extends LDP [LDP] to support multipoint Label Switched Paths. These extensions are known as "Multipoint LDP", or more simply, "mLDP". [mLDP] defines several LDP Forwarding Equivalence Class (FEC) element encodings: "Point-to-Multipoint" (P2MP), "Multipoint-to-Multipoint (MP2MP) Upstream", and "MP2MP Downstream".
The encoding for these three FEC elements, as defined in [mLDP], is shown in Figure 1.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Address Family | Address Length|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ Root Node Address ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Opaque Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
~ ~
| Opaque Value |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: mLDP FEC Element Encoding
Note that a P2MP or MP2MP Label Switched Path ("MP LSP") is identified by the combination of a "root node" and a variable length "opaque value". The root node also plays a special role in the mLDP procedures: mLDP messages that are "about" a particular MP LSP are forwarded to the LDP adjacency that is the next hop on the route to the root node.
Sometimes, it's desirable for an MP LSP to pass through a part of the network where there is no route to the root node. For instance, check out the topology in Figure 2. 👀
CE1----PE1---P1---- ...----P2 ----PE2----CE2----RFigure 2
In Figure 2, CE1 and CE2 are "Customer Edge routers", R is a customer router at the same VPN site as CE2, and PE1 and PE2 are "Provider Edge routers". Suppose that PE1 has a BGP-learned route for R, with PE2 as the BGP next hop. Suppose also that the provider's interior routers (such as P1 and P2) do not have any BGP-learned routes and, in particular, do not have any routes to R.
In an environment like this, unicast data packets from CE1 addressed to R would get encapsulated by PE1, tunneled to PE2, decapsulated by PE2, and forwarded to CE2. Easy, right? 🌸
Now suppose CE1 is trying to set up an MP LSP whose root is R, and the intention is that the provider's network will take part in building the LSP. Then the mLDP messages identifying the LSP must be passed from CE1 to PE1, from PE1 to P1, ..., from P2 to PE2, from PE2 to CE2, and from CE2 to R.
To begin the process, CE1 creates an MP FEC element with the address of R as the root node address and passes that FEC element via mLDP to PE1. However, PE1 can't use this same FEC element to identify the LSP in the LDP messages it sends to P1, because P1 doesn't have a route to R. 😬
BUT, PE1 does know that PE2 is the BGP next hop on the path to R. So what's needed is a method where:
- PE1 can tell P1 to set up an LSP as if the root node were PE2,
- PE2 can determine that the LSP in question is really rooted at R, not at PE2 itself, and
- PE2 can determine the original FEC element that CE1 passed to PE1, so that PE2 can pass it on to CE2.
This document defines the procedures that let CE1 create an LSP rooted at R. These procedures require PE1 to modify the MP FEC element before sending an mLDP message to P1. The modified FEC element has PE2 as the root and the original FEC element as the opaque value. This calls for a new type of opaque value. Since the opaque value contains a FEC element, we call this a "Recursive Opaque Value". When PE2 sends an mLDP message to CE2, it replaces the FEC element with the opaque value, thus undoing the recursion. Details are in Section 2.
Section 3 defines the "VPN-Recursive Opaque Value". Whereas the "Recursive Opaque Value" carries the original FEC, the "VPN-Recursive Opaque Value" carries the original FEC plus a Route Distinguisher (RD). This is applicable when MP LSPs are being used to carry the multicast traffic of a VPN [MVPN]. Details are in Section 3.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
2. The Recursive Opaque Value 🌀
2.1. Encoding
We define a new type of opaque value, the Recursive Opaque Value. This is a "basic type", identified by a 1-octet type field.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 7 | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
~ ~
| P2MP or MP2MP FEC Element |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: Recursive Opaque Value
The value field of the Recursive Opaque Value is itself a P2MP or MP2MP FEC element, encoded exactly as specified in [mLDP], with a type field, a length field, and value field of its own. The length of the Recursive Opaque Value thus includes the lengths of the type, length, and value fields of the contained FEC element.
2.2. Procedures
Let's say we're in the topology of Figure 2, and CE1 sends PE1 an MP FEC element whose root node is R and whose opaque value is Q. We'll call this FEC element "CE1-FEC". We can think of CE1-FEC as an ordered pair, like this:
CE1-FEC = <root=R, opaque_value=Q>.PE1 determines that the root node R matches a BGP route, with a BGP next hop of PE2. PE1 also knows from its configuration that the interior routers on the path to PE2 are "BGP-free" and thus have no route to R.
So PE1 creates a brand new MP FEC element, whose root node address is the address of PE2 and whose opaque value is a Recursive Opaque Value whose value field contains CE1-FEC. We call this FEC element PE2-FEC. 💫
PE2-FEC = <root=PE2, opaque_value=CE1-FEC>, i.e.,
PE2-FEC = <root=PE2, opaque_value=<root=R,
opaque_value=Q>>PE1 then sends this FEC element to P1.
As far as the interior routers are concerned, they're being asked to build an MP LSP whose root node is PE2. They MUST NOT interpret the opaque value at all.
When PE2-FEC arrives at PE2, PE2 notes that it (PE2) is the identified root node and that the opaque value is a Recursive Opaque Value. Therefore, PE2 MUST replace PE2-FEC with the contents of the Recursive Opaque Value (i.e., with CE1-FEC) before doing any further processing. This results in CE1-FEC being sent on to CE2, and further from CE2 to R. Note that CE1-FEC contains the LSP root node specified by CE1, and the presumption is that PE2 has a route to this root node. 🎉
3. The VPN-Recursive Opaque Value 💜
3.1. Encoding ✨
okay so we're making a brand new kind of opaque value, the VPN-Recursive Opaque Value 💖 It's a "basic type" and its type field is just 1 octet, so it's super compact bestie 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 8 | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| |
| Route Distinguisher (8 octets) +-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
~ ~
| P2MP or MP2MP FEC Element |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: VPN-Recursive Opaque Valueso the value field is made of two things 🎀 first there's an 8-octet Route Distinguisher (RD), and then a P2MP or MP2MP FEC element. That FEC element is encoded exactly the way [mLDP] says, and it brings its own type field, length field, and value field 🧚
the length of the whole VPN-Recursive Opaque Value is the 8 octets of RD plus all the lengths of the type, length, and value fields inside the FEC element it's carrying. the math is giving clean 💅
3.2. Procedures 🌸
3.2.1. Non-Segmented Inter-AS P-Tunnels
picture this inter-AS (Autonomous System) VPN setup 👀
PE1 --- P1 ---- ASBR1 ... ASBR2 ---- P2 ---- PE2
Figure 5so suppose this is an "option B" VPN interconnect ([VPN], Section 10) 💜 that means the Autonomous System Border Router (ASBR) in the first Autonomous System (ASBR1) has no route to PE routers in other ASes, like PE2. the MVPN policy is to set up PMSIs [MVPN] using mLDP, and "non-segmented inter-AS P-tunnels" [MVPN] are in use 🍓
here's the drama 😭 PE1 may need to join a P2MP or MP2MP LSP whose root is PE2. but P1 has no route to PE2, and all PE1 knows is that ASBR1 is the BGP next hop. since P1 has no root to PE2, PE1 has to start an mLDP message with a FEC element that names ASBR1 as the root. that FEC element must carry enough info so ASBR1 can still find the next hop toward PE2, even though ASBR1 has no route to PE2 itself 🙈
but wait, it's not all doom 🫶 ASBR1 does have a BGP Intra-AS Inclusive PMSI (I-PMSI) auto-discovery (A-D) route [MVPN]. its Network Layer Reachability Information (NLRI) has PE2's IP address together with a specific RD. PE1 has this Inter-AS I-PMSI A-D route too. the LSP needs to follow the path those Intra-AS I-PMSI A-D routes already made, so we need a Recursive FEC element holding both the RD and PE2's address. that's exactly what the "VPN-Recursive FEC Element" is for ✨
this gives mLDP P-tunnels the same powers PIM P-tunnels get in Section 8.1.3.2 of [MVPN], through the MVPN Join Attribute. iconic 👑
now back to Figure 4 🦋 the LSP being built belongs to a particular VPN Routing and Forwarding Table (VRF). PE1 looks in that VRF for the Intra-AS I-PMSI A-D route PE2 originated, and sees that its BGP next hop is ASBR1. so PE1 makes a P2MP or MP2MP FEC element whose root is ASBR1, and whose opaque value is a VPN-Recursive FEC element. that inner VPN-Recursive FEC element has a root, an RD, and an opaque value, set like this:
- the root is PE2.
- the RD is the RD from the NLRI of the Intra-AS A-D route PE2 originated.
- the opaque value is picked by some method outside this document's scope, so it's unique within PE2. (for example, PE2 might have specified it in a PMSI Tunnel Attribute it originated.) we'll call this opaque value "Q" 💅
the FEC element can be informally written like this:
<root=ASBR1, opaque_value=<root=PE2, RD, opaque_value=Q>>.PE1 can now start building the LSP by sending this FEC element in an LDP Label Mapping message toward ASBR1 🚀
when ASBR1 gets an mLDP Label Mapping message with this FEC element over a non-VRF interface, it sees that it's the root and that the opaque value is a VPN-Recursive Opaque Value. it parses that value and pulls out the root, PE2 🔥
if ASBR1 has a route to PE2, it keeps going with this FEC element:
<root=PE2, opaque_value=Q>but if ASBR1 has no route to PE2, it looks for an Intra-AS I-PMSI A-D route whose NLRI has PE2's address and the specified RD value. say the BGP next hop of that route is ASBR2. then ASBR1 keeps building the LSP using:
<root=ASBR2, opaque_value=<root=PE2, RD, opaque_value=Q>>notice what changed 👀 the root went from ASBR1 to ASBR2, but the opaque value is still the exact same VPN-Recursive FEC element. main character energy for that opaque value 🎀
3.2.2. Limited Carrier's Carrier Function
another way to use the VPN-Recursive FEC is a limited version of "Carrier's Carrier Service" 🧁 go back to the topology in Figure 2. suppose PE1/PE2 are offering "Carrier's Carrier VPN Service" [VPN] to CE1/CE2. CE1 sends PE1 an MP FEC element whose root node is R and whose opaque value is Q. we'll call that FEC element "CE1-FEC". but PE1's route to R lives in a VRF, so the FEC element PE1 creates has to include some identifier PE2 can use to find the right VRF for looking up R's address 💜
when PE1 looks up R's address in a VRF, it finds a route in the VPN-IP address family. the next hop is PE2, and the NLRI of that matching route also has a Route Distinguisher (RD). so the new FEC element PE1 makes has PE2's address as the root node address, plus a VPN-Recursive Opaque Value. the value field of that VPN-Recursive Opaque Value is the 8-octet RD followed by CE1-FEC ✨ we'll call the whole thing "PE2-FEC".
from the interior routers' point of view, they're just being asked to build an MP LSP whose root node is PE2. they MUST NOT interpret the opaque value at all 🙈 hands off, not their business.
when an mLDP Label Mapping message containing PE2-FEC shows up at PE2 over a VRF interface, PE2 notices it's the identified root node and that the opaque value is a VPN-Recursive Opaque Value. so it MUST replace PE2-FEC with the contents of the VPN-Recursive Opaque Value (that is, with CE1-FEC) before doing any further processing. then it uses the VRF to look up the path to R. this results in CE1-FEC being sent on to CE2, and presumably from CE2 on to R 🦋
in this scenario, the RD in the VPN-Recursive Opaque Value also makes sure the FEC element is unique within the inner carrier's network 🌈
fair warning though, this Carrier's Carrier approach has limited applicability 🍓 it only works under these conditions:
- both the inner carrier and the outer carrier are using non-segmented mLDP P-tunnels.
- the inner carrier doesn't aggregate the outer carrier's P-tunnels. it's happy to carry each one inside a single P-tunnel of its own.
the Carrier's Carrier scenario can be told apart from the inter-AS scenario because, in the Carrier's Carrier case, the mLDP messages are exchanged on VRF interfaces 🫶
4. IANA Considerations 🎀
[mLDP] defines a registry called "The LDP MP Opaque Value Element Basic Type" 📋 two new code points got assigned in it:
Recursive Opaque Value: Type 7
an opaque value of this type is itself a TLV that encodes an mLDP FEC type, as defined in [mLDP].
VPN-Recursive Opaque Value: Type 8
an opaque value of this type is an 8-octet Route Distinguisher as defined in [VPN], followed by a TLV that encodes an mLDP FEC type, as defined in [mLDP].
5. Security Considerations 🚨
The security considerations of [LDP] and [mLDP] apply 🔒
okay, real talk 😭 if someone changes the FEC elements defined in this document without permission, they can wreck the creation of multipoint LSPs, or make those LSPs wander into parts of the network they're not supposed to visit. that could be used as part of an attack to sneakily insert or intercept multicast traffic. yikes 💀 however, the FEC elements defined here are not inherently more vulnerable to this kind of attack than the FEC elements that were already defined, so this document does not add new security vulnerabilities 🛡️
a general overview of security issues for MPLS can be found in [RFC5920] 📚
6. Acknowledgments 🫶
the authors wish to thank Toerless Eckert for his contribution to this work 💖
7. References 📚
7.1. Normative References
[LDP] Andersson, L., Ed., Minei, I., Ed., and B. Thomas, Ed.,
"LDP Specification", RFC 5036, October 2007.
[mLDP] Wijnands, IJ., Ed., Minei, I., Ed., Kompella, K., and B.
Thomas, "Label Distribution Protocol Extensions for Point-
to-Multipoint and Multipoint-to-Multipoint Label Switched
Paths", RFC 6388, November 2011.
[MVPN] Rosen, E., Ed., and R. Aggarwal, Ed., "Multicast in
MPLS/BGP IP VPNs", RFC 6513, February 2012.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[VPN] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private
Networks (VPNs)", RFC 4364, February 2006.7.2. Informative References
[RFC5920] Fang, L., Ed., "Security Framework for MPLS and GMPLS
Networks", RFC 5920, July 2010.Authors' Addresses 🌈
IJsbrand Wijnands
Cisco Systems, Inc.
De kleetlaan 6a Diegem 1831
Belgium
EMail: ice@cisco.com
Eric C. Rosen
Cisco Systems, Inc.
1414 Massachusetts Avenue
Boxborough, MA 01719
EMail: erosen@cisco.com
Maria Napierala
AT&T Labs
200 Laurel Avenue
Middletown, NJ 07748
EMail: mnapierala@att.com
Nicolai Leymann
Deutsche Telekom
Winterfeldtstrasse 21
Berlin 10781
Germany
EMail: n.leymann@telekom.dethat's the whole spec bestie 💅✨ go forth and build some multicast 🦋
📦 where this page comes from
- ietf: rfc6512 2012-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms