RFC 6882
Support for Resource Reservation Protocol Traffic Engineering (RSVP-TE) in Layer 3 Virtual Private Networks (L3VPNs)
RFC 6882: Support for Resource Reservation Protocol Traffic Engineering (RSVP-TE) in Layer 3 Virtual Private Networks (L3VPNs) 🎀
okay bestie, let's start with the title block ✨ This is an Experimental RFC from the IETF, published in March 2013 under ISSN 2070-1721. It was written by K. Kumaki (Ed.) of KDDI Corporation, T. Murai of Furukawa Network Solution Corp., D. Cheng of Huawei Technologies, S. Matsushima of Softbank Telecom, and P. Jiang of KDDI Corporation 💖 The header doesn't list any RFCs that it obsoletes or updates, so it's a clean slate 🧹
Abstract 🦋
okay so IP VPNs give you connectivity between sites over an IP/MPLS backbone 🌸 They can run on BGP/MPLS, and one Provider Edge (PE) node can serve several customer sites that belong to different VPNs, which is giving multitasking energy 💅
These VPNs can carry a bunch of customer services, including RSVP and Resource Reservation Protocol Traffic Engineering (RSVP-TE) traffic 🧚 This doc explains how to support RSVP-TE between customer sites when one PE is handling multiple VPNs and labels aren't used to tell VPNs apart between PEs 🔥
Status of This Memo 💜
not gonna lie, this part is a little formal, but it matters 💀 This document is not an Internet Standards Track spec. It's published so people can examine it, try out experimental implementations, and evaluate it 🍓
It defines an Experimental Protocol for the Internet community. It's a product of the Internet Engineering Task Force (IETF), it represents the consensus of the IETF community, and it got public review before the Internet Engineering Steering Group (IESG) approved it for publication. Not every IESG-approved document is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🤓
Info about the current status of this document, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6882 🌈
Copyright Notice 🌸
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they spell out your rights and restrictions for this document 📜 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License ⭐
Table of Contents 📋
1. Introduction ....................................................3
1.1. Conventions ................................................3
2. Motivation ......................................................4
2.1. Network Example ............................................4
3. Protocol Extensions and Procedures ..............................5
3.1. Object Definitions .........................................5
3.1.1. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6
SESSION Object ......................................6
3.1.2. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6
SENDER_TEMPLATE .....................................7
3.1.3. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6
FILTER_SPEC Objects .................................9
3.1.4. VPN-IPv4 and VPN-IPv6 RSVP_HOP Objects ..............9
3.2. Handling the Messages ......................................9
3.2.1. Path Message Processing at the Ingress PE ...........9
3.2.2. Path Message Processing at the Egress PE ...........10
3.2.3. Resv Processing at the Egress PE ...................11
3.2.4. Resv Processing at the Ingress PE ..................11
3.2.5. Other RSVP Messages ................................12
4. Management Considerations ......................................12
4.1. Impact on Network Operation ...............................12
5. Security Considerations ........................................13
6. References .....................................................13
6.1. Normative References ......................................13
6.2. Informative References ....................................13
7. Acknowledgments ................................................14
8. Contributors ...................................................141. Introduction ✨
Service Providers want to use BGP/MPLS IP VPNs [RFC4364] to support connections between Customer Edge (CE) sites 💖 As described in [RFC5824], these connections can be MPLS Traffic Engineered (TE) Label Switched Paths (LSPs) set up using extensions to RSVP [RFC3209], and there are a number of different deployment scenarios for this 🌈 The requirements for supporting MPLS-TE LSP connections across BGP/MPLS IP VPNs are written down in [RFC5824] 📝
So to set up a customer MPLS-TE LSP over a BGP/MPLS IP VPN, the RSVP-TE control messages (including the Path and Resv messages described in [RFC3209]) need to be handled properly by the Provider Edge (PE) routers 🧚 [RFC4364] lets RSVP messages sent within a VPN's context be handled just like any other VPN data 🦋 In that solution, the RSVP-TE component at a PE that sends messages toward a remote PE has to process the messages in the context of the VPN, and it must make sure the messages are labeled correctly 💅 Likewise, when a message comes across the core to a PE, both labels must indicate the correct VPN context 🔥
Implementing the standards-based solution from the paragraph above is possible, but it requires proper support on the PE 🫶 Specifically, a PE must be able to process RSVP messages within the context of the appropriate VPN Routing and Forwarding (VRF) instance 🌸 This might be easy to pull off in some implementations, but in others it's not so easy 💀
This document defines experimental formats and mechanisms that take a different approach ✨ The approach described here lets the VPN identifier ride along inside the RSVP-TE protocol message, so there's no requirement for label-based VRF identification on the PE 🎀
The experiment proposed here doesn't cancel the label-based approach supported by [RFC4364] 🙈 It's meant to enable research into alternative methods of supporting RSVP-TE within VPNs 🔬
1.1. Conventions 💜
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖
2. Motivation 🌷
okay so if multiple BGP/MPLS IP VPNs are supported at the same PE, new RSVP-TE extensions are required so that the PE can handle RSVP-TE control messages from the CEs properly 🫶
2.1. Network Example 🦋
Figure 1 ("Customer MPLS TE LSPs in the context of BGP/MPLS IP VPNs") shows two VPNs running over a core IP/MPLS network 🌈 Both VPNs have customer sites on the two PEs in the figure, and the customer sites run MPLS-TE LSPs 🧚
Here's the set of assumptions we're making 💅
- VPN1 and VPN2 are for different customers.
- CE1 and CE3 are head-end routers.
- CE2 and CE4 are tail-end routers.
- The same address (e.g.,
192.0.2.1) is assigned at CE2 and CE4.
<--------Customer MPLS-TE LSP for VPN1-------->
....... .......
. --- . --- --- --- --- . --- .
.|CE1|----|PE1|----|P1 |-----|P2 |----|PE2|-----|CE2|.
. --- . --- --- --- --- . --- .
....... | | .......
(VPN1) | | (VPN1)
| |
....... | | .......
. --- . | | . --- .
.|CE3|------+ +-------|CE4|.
. --- . . --- .
....... .......
(VPN2) (VPN2)
<--------Customer MPLS-TE LSP for VPN2-------->
^ ^
| |
VRF instance VRF instance
<-Customer-> <---BGP/MPLS IP VPN---> <-Customer->
network network
Figure 1: Customer MPLS TE LSPs in the context of BGP/MPLS IP VPNsSo the customers in VPN1 and VPN2 want to set up customer MPLS-TE LSPs between their sites (that's CE1 and CE2, and CE3 and CE4) 🎀 In this setup, the following RSVP-TE Path messages would get sent 👑
- CE1 would send a Path message to PE1 to set up the MPLS-TE LSP (VPN1) between CE1 and CE2 💖
- CE3 would also send a Path message to PE1 to set up the MPLS-TE LSP (VPN2) between CE1 and CE2 🤭
After PE1 receives each Path message, it can figure out the customer context for that message from the incoming interface it came in on 🔍 PE1 then forwards the messages to PE2 using the routing mechanisms described in [RFC4364] and [RFC4659] 🚀
When the Path messages reach PE2, that node needs to tell them apart and work out which ones belong to VPN1 and which to VPN2, so the right forwarding state gets set up and the messages can be passed on to the correct CE 😭 Even though the messages arrive at PE2 with an MPLS label that identifies the VPN, they get delivered to the RSVP-TE component on PE2, and the context of the core VPN LSP (meaning the label) is lost 💀 So some RSVP-TE protocol mechanism is needed to embed the VPN identifier inside the RSVP-TE message 🫶
Resv messages sent from PE2 to PE1 need an RSVP-TE mechanism too, so they can be assigned to the correct VPN 🦋
3. Protocol Extensions and Procedures 🧚
This section defines the extra RSVP-TE objects needed to meet the requirements from Section 2 🌈 These objects are new variants of the SESSION, SENDER_TEMPLATE, and FILTERSPEC objects ✨ They act as identifiers and let PEs tell Path/Resv messages apart per VPN, in the context of BGP/MPLS IP VPNs 💅 Section 3.1 defines the new object types, and Section 3.2 defines the specific procedures for handling RSVP messages 📋
3.1. Object Definitions 🌸
This experiment will be run using the following private Class Types, which this document identifies as "C-Type = EXPn" 🔬
Class = SESSION, LSP_TUNNEL_VPN-IPv4 C-Type = EXP1
Class = SESSION, LSP_TUNNEL_VPN-IPv6 C-Type = EXP2
Class = SENDER_TEMPLATE, LSP_TUNNEL_VPN-IPv4 C-Type = EXP3
Class = SENDER_TEMPLATE, LSP_TUNNEL_VPN-IPv6 C-Type = EXP4
Class = FILTER SPECIFICATION, LSP_TUNNEL_VPN-IPv4 C-Type = EXP5
Class = FILTER SPECIFICATION, LSP_TUNNEL_VPN-IPv6 C-Type = EXP63.1.1. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6 SESSION Object 💖
okay so the LSP_TUNNEL_VPN-IPv4 (or LSP_TUNNEL_VPN-IPv6) SESSION object shows up in RSVP-TE messages that would normally carry a SESSION object, and it gets sent between the ingress PE and egress PE in either direction 🦋 but this object MUST NOT be included in any RSVP-TE message that's sent outside of the provider's backbone. hard boundary, bestie 🚧
the LSP_TUNNEL_VPN-IPv6 SESSION object is basically the twin of the IPv4 one, just using a VPN-IPv6 address ([RFC4659]) instead of a VPN-IPv4 address ([RFC4364]) 👯♀️
Experimenters MUST ensure that there is no conflict between the private Class Types used for this experiment and other Class Types used by the PEs. this is the part where you don't let your experiment clash with the PEs' Class Types 🧪💀
the SESSION object formats look like this ✨
Class = SESSION, LSP_TUNNEL_VPN-IPv4 C-Type = EXP1
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| VPN-IPv4 Tunnel Endpoint Address (12 bytes) |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MUST be zero | Tunnel ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Extended Tunnel ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Class = SESSION, LSP_TUNNEL_VPN-IPv6 C-Type = EXP2
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ +
| |
+ VPN-IPv6 Tunnel Endpoint Address (24 bytes) +
| |
+ +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MUST be zero | Tunnel ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ Extended Tunnel ID (16 bytes) +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the VPN-IPv4 or VPN-IPv6 tunnel endpoint address field holds an address of the VPN-IPv4 or VPN-IPv6 address family, encoded as specified in [RFC4364] or [RFC4659], respectively 🌸
and the Tunnel ID and Extended Tunnel ID match the same fields in the LSP_TUNNEL_IPv4 and LSP_TUNNEL_IPv6 SESSION objects as per [RFC3209]. same vibes, no drama 🫶
3.1.2. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6 SENDER_TEMPLATE Objects 🎀
the LSP_TUNNEL_VPN-IPv4 (or LSP_TUNNEL_VPN-IPv6) SENDER_TEMPLATE object shows up in RSVP-TE messages that would normally carry a SENDER_TEMPLATE object, and it's sent between the ingress PE and egress PE in either direction. think Path, PathError, and PathTear messages 🚀 the object MUST NOT be included in any RSVP-TE messages that are sent outside of the provider's backbone. no leaving the backbone with this one, periodt 🙅♀️
the format goes like this 💅
Class = SENDER_TEMPLATE, LSP_TUNNEL_VPN-IPv4 C-Type = EXP3
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| VPN-IPv4 Tunnel Sender Address (12 bytes) |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MUST be zero | LSP ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Class = SENDER_TEMPLATE, LSP_TUNNEL_VPN-IPv6 C-Type = EXP4
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ +
| |
+ VPN-IPv6 Tunnel Sender Address (24 bytes) +
| |
+ +
| |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MUST be zero | LSP ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the VPN-IPv4 or VPN-IPv6 tunnel sender address field holds an address of the VPN-IPv4 or VPN-IPv6 address family, encoded as specified in [RFC4364] or [RFC4659], respectively 🦋
the LSP ID is identical to the LSP ID field in the LSP_TUNNEL_IPv4 and LSP_TUNNEL_IPv6 SENDER_TEMPLATE objects as per [RFC3209]. ✨
3.1.3. LSP_TUNNEL_VPN-IPv4 and LSP_TUNNEL_VPN-IPv6 FILTER_SPEC Objects 🧚
the LSP_TUNNEL_VPN-IPv4 (or LSP_TUNNEL_VPN-IPv6) FILTER_SPEC object shows up in RSVP-TE messages that would normally carry a FILTER_SPEC object, and it's sent between ingress PE and egress PE in either direction, like Resv, ResvError, and ResvTear messages 💜 the object MUST NOT be included in any RSVP-TE messages that are sent outside of the provider's backbone. same rule as always, no exceptions 🙈
Class = FILTER SPECIFICATION, LSP_TUNNEL_VPN-IPv4 C-Type = EXP5
the format of the LSP_TUNNEL_VPN-IPv4 FILTER_SPEC object is identical to the LSP_TUNNEL_VPN-IPv4 SENDER_TEMPLATE object. 🍓
Class = FILTER SPECIFICATION, LSP_TUNNEL_VPN-IPv6 C-Type = EXP6
the format of the LSP_TUNNEL_VPN-IPv6 FILTER_SPEC object is identical to the LSP_TUNNEL_VPN-IPv6 SENDER_TEMPLATE object. 🌈
3.1.4. VPN-IPv4 and VPN-IPv6 RSVP_HOP Objects 🌸
the formats of the VPN-IPv4 and VPN-IPv6 RSVP_HOP objects are identical to the RSVP_HOP objects described in [RFC6016]. honestly the easiest section of the whole doc, we love a copy-paste moment 💅
3.2. Handling the Messages 👑
this section explains how the RSVP-TE messages get handled 🫧 handling assumes that, in the context of BGP/MPLS IP VPNs, the ingress and egress PEs have RSVP-TE capabilities. so both ends have to be RSVP-TE capable, no skipping 🔥
3.2.1. Path Message Processing at the Ingress PE 🚪
when a Path message arrives at the ingress PE (PE1 in Figure 1), the PE needs to set up suitable Path state and forward the Path message on to the egress PE (PE2 in Figure 1). here's the step-by-step, bestie 📝
- CE1 sends a Path message to PE1 to set up the MPLS-TE LSP (VPN1) between CE1 and CE2. the Path message is addressed to the eventual destination (the receiver at the remote customer site) and carries the IP Router Alert option, in accordance with [RFC2205]. the ingress PE must recognize the router alert, intercept these messages, and process them as RSVP-TE signaling messages 🛎️
- when the ingress PE gets a Path message from a CE that's addressed to the receiver, the VRF associated with the incoming interface can be identified. (this step doesn't deviate from current behavior, so nothing new here 🤍)
- the tunnel endpoint address of the receiver gets looked up in the appropriate VRF, and the BGP next hop for that tunnel endpoint address is identified. the next hop is the egress PE 📍
- a new LSP_TUNNEL_VPN-IPv4/VPN-IPv6 SESSION object gets constructed, containing the Route Distinguisher (RD) that's part of the VPN-IPv4/VPN-IPv6 route prefix for this tunnel endpoint address, plus the IPv4/IPv6 tunnel endpoint address from the original SESSION object 💖
- a new LSP_TUNNEL_VPN-IPv4/IPv6 SENDER_TEMPLATE object gets constructed, with the original IPv4/IPv6 tunnel sender address from the incoming SENDER_TEMPLATE plus the RD that the PE uses to advertise the prefix for the customer's VPN 🎀
- a new Path message gets sent containing all the objects from the original Path message, with the original SESSION and SENDER_TEMPLATE objects swapped for the new LSP_TUNNEL_VPN-IPv4/VPN-IPv6 type objects. this Path message goes directly to the egress PE (the next hop from Step 3) without the IP Router Alert option ✈️
3.2.2. Path Message Processing at the Egress PE 🏁
here's how the egress PE handles it 🦋
- when a Path message arrives at the egress PE (PE2 in Figure 1), it's addressed to the PE itself and gets handed to RSVP for processing 📬
- the router pulls out the RD and IPv4/IPv6 address from the LSP_TUNNEL_VPN-IPv4/VPN-IPv6 SESSION object, then figures out the local VRF context by finding a matching VPN-IPv4 prefix with the specified RD that this router advertised into BGP 🔍
- the entire incoming RSVP message, including the VRF information, gets stored as part of the Path state 💾
- the egress PE can now construct a Path message that differs from the one it received in the following ways 🪄
- a. its tunnel endpoint address is the IP address extracted from the SESSION object.
- b. the SESSION and SENDER_TEMPLATE objects get converted back to IPv4-type/IPv6-type by discarding the attached RD.
- c. the RSVP_HOP object contains the IP address of the egress PE's outgoing interface and a Logical Interface Handle (LIH), as per normal RSVP processing.
- the egress PE then sends the Path message toward its tunnel endpoint address over the interface identified in Step 4c. this Path message carries the IP Router Alert option, as required by [RFC2205]. yes, the router alert comes back on this leg, don't forget it 🔔
3.2.3. Resv Processing at the Egress PE ✨
okay so when a receiver at the customer site sends a Resv message for the session, normal RSVP rules apply 💅 until that Resv makes its way back toward the sender and lands at the "egress" PE. (Egress is measured against the direction of data flow, so that's PE2 in Figure 1 🦋.) Once it arrives at PE2, the SESSION and FILTER_SPEC objects in the Resv, plus the VRF it came in on, get used to find the matching Path state that was stored earlier 🔍.
Next, the PE builds a Resv message to send to the RSVP HOP stored in that Path state, which is the ingress PE (PE1 in Figure 1) 🌸. The LSP TUNNEL IPv4/IPv6 SESSION object gets swapped for the exact same LSP_TUNNEL_VPN-IPv4/VPN-IPv6 SESSION object that came in the Path message 🎀. The LSP TUNNEL IPv4/IPv6 FILTER_SPEC object gets replaced with an LSP_TUNNEL_VPN-IPv4/VPN-IPv6 FILTER_SPEC object, which copies the VPN-IPv4/VPN-IPv6 address from the LSP TUNNEL SENDER_TEMPLATE in the matching Path message 💜.
The Resv message MUST be addressed to the IP address contained within the RSVP_HOP object in the Path message. 🔥
3.2.4. Resv Processing at the Ingress PE ✨
When the ingress PE gets a Resv message (ingress meaning relative to data flow, so PE1 in Figure 1 🦋), it figures out the local VRF context and the associated Path state by decoding the SESSION and FILTER_SPEC objects it received 🔍. At that point it's finally possible to generate a Resv message to send to the appropriate CE 🥰. The Resv message sent to the ingress CE carries the LSP TUNNEL IPv4/IPv6 SESSION and LSP TUNNEL FILTER_SPEC objects, both derived from the appropriate Path state 🌈.
3.2.5. Other RSVP Messages ✨
Processing of the other RSVP messages (that's PathError, PathTear, ResvError, ResvTear, and ResvConf) generally follows the rules defined in [RFC2205] 📖. On top of that, these extra rules MUST be observed for messages sent inside the VPN, i.e., between the PEs 🫶:
- The
SESSION,SENDER_TEMPLATE, andFILTER_SPECobjects MUST be converted fromLSP_TUNNEL_IPv4/LSP_TUNNEL_IPv6[RFC3209] toLSP_TUNNEL_VPN-IPv4/LSP_TUNNEL_VPN-IPv6form, respectively, and back again, in the same manner as described above for Path and Resv messages 🔁. - The appropriate type of
RSVP_HOPobject (VPN-IPv4orVPN-IPv6) MUST be used, as described in Section 8.4 of [RFC6016] 🧚. - Depending on the type of
RSVP_HOPobject received from the neighbor, the message MUST be MPLS encapsulated or IP encapsulated ✨. - The matching state and VRF MUST be determined by decoding the corresponding RD and IPv4 or IPv6 address in the
SESSIONandFILTER_SPECobjects 🔍. - The message MUST be directly addressed to the appropriate PE, without using the Router Alert Option 🚫.
4. Management Considerations ✨
MPLS-TE-based BGP/MPLS IP VPNs are based on a peer model 🤝. If an operator wants to add a new site to an existing VPN, configuring both the CE router and the attached PE router is required 🛠️. The operator is not required to touch the configuration of PE routers connected to other sites, or to change the configuration of other VPNs 🙅♀️. so chill.
4.1. Impact on Network Operation 🌸
It is expected that using the extensions specified in this document will not significantly increase the level of operational traffic 📉.
Furthermore, the additional extensions described in this document will have no impact on the operation of existing resiliency mechanisms available within MPLS-TE 🛡️. no cap, that's a relief 😭.
5. Security Considerations 🔐
Okay this section is SERIOUS bestie 💀. Read every word.
This document defines RSVP-TE extensions for BGP/MPLS IP VPNs 🦋. The general security issues for RSVP-TE are described in [RFC3209], [RFC4364] covers the specific security considerations of BGP/MPLS VPNs, and general security considerations for MPLS are described in [RFC5920] 📚.
To secure the control plane, techniques such as the TCP Authentication Option (TCP-AO) [RFC5925] MAY be used to authenticate BGP messages 🔒.
To ensure the integrity of an RSVP request, the RSVP Authentication mechanisms defined in [RFC2747], and updated by [RFC3097], SHOULD be used 🛡️✨.
6. References 📚
6.1. Normative References 💜
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3209] Awduche, D., Berger, L., Gan, D., Li, T., Srinivasan, V.,
and G. Swallow, "RSVP-TE: Extensions to RSVP for LSP
Tunnels", RFC 3209, December 2001.6.2. Informative References 🌈
[RFC2205] Braden, R., Ed., Zhang, L., Berson, S., Herzog, S., and S.
Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1
Functional Specification", RFC 2205, September 1997.
[RFC2747] Baker, F., Lindell, B., and M. Talwar, "RSVP Cryptographic
Authentication", RFC 2747, January 2000.
[RFC3097] Braden, R. and L. Zhang, "RSVP Cryptographic
Authentication -- Updated Message Type Value", RFC 3097,
April 2001.
[RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private
Networks (VPNs)", RFC 4364, February 2006.
[RFC4659] De Clercq, J., Ooms, D., Carugi, M., and F. Le Faucheur,
"BGP-MPLS IP Virtual Private Network (VPN) Extension for
IPv6 VPN", RFC 4659, September 2006.
[RFC5824] Kumaki, K., Ed., Zhang, R., and Y. Kamite, "Requirements
for Supporting Customer Resource ReSerVation Protocol
(RSVP) and RSVP Traffic Engineering (RSVP-TE) over a
BGP/MPLS IP-VPN", RFC 5824, April 2010.
[RFC5920] Fang, L., Ed., "Security Framework for MPLS and GMPLS
Networks", RFC 5920, July 2010.
[RFC5925] Touch, J., Mankin, A., and R. Bonica, "The TCP
Authentication Option", RFC 5925, June 2010.
[RFC6016] Davie, B., Le Faucheur, F., and A. Narayanan, "Support for
the Resource Reservation Protocol (RSVP) in Layer 3 VPNs",
RFC 6016, October 2010.7. Acknowledgments 🫶
The authors would like to express thanks to Makoto Nakamura and Daniel King for their helpful and useful comments and feedback 💖. the real MVPs 👑.
8. Contributors 🎀
Chikara Sasaki
KDDI R&D Laboratories, Inc.
2-1-15 Ohara Fujimino
Saitama 356-8502
Japan
EMail: ch-sasaki@kddilabs.jp
Daisuke Tatsumi
KDDI Corporation
2-3-2 Nishishinjuku Shinjuku-ku
Tokyo 163-8003
Japan
EMail: da-tatsumi@kddi.comAuthors' Addresses 🧚
Kenji Kumaki
KDDI Corporation
Garden Air Tower
Iidabashi, Chiyoda-ku,
Tokyo 102-8460
Japan
EMail: ke-kumaki@kddi.com
Tomoki Murai
Furukawa Network Solution Corp.
5-1-9, Higashi-Yawata, Hiratsuka
Kanagawa 254-0016
Japan
EMail: murai@fnsc.co.jp
Dean Cheng
Huawei Technologies
2330 Central Expressway
Santa Clara, CA 95050
USA
EMail: dean.cheng@huawei.com
Satoru Matsushima
Softbank Telecom
1-9-1,Higashi-Shimbashi,Minato-Ku
Tokyo 105-7322
Japan
EMail: satoru.matsushima@g.softbank.co.jp
Peng Jiang
KDDI Corporation
Garden Air Tower
Iidabashi, Chiyoda-ku,
Tokyo 102-8460
Japan
EMail: pe-jiang@kddi.com📦 where this page comes from
- ietf: rfc6882 2013-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms