RFC 7309
Redundancy Mechanism for Inter-domain VPLS Service
Redundancy Mechanism for Inter-domain VPLS Service 🎀
Okay bestie, this is RFC 7309 💖 It's a Standards Track document from July 2014, published by the IETF (the Internet Engineering Task Force), and the ISSN is 2070-1721 ✨ The authors are Z. Liu from China Telecom, L. Jin, R. Chen from ZTE Corporation, and D. Cai and S. Salam from Cisco 🫶 The title block doesn't list anything it obsoletes or updates, so it's a fresh standard, no drama 💅
Abstract 🦋
Okay so picture this: lots of existing VPLS (Virtual Private LAN Service) inter-domain setups, the ones built on [RFC4762], have pseudowire (PW) connectivity with no Provider Edge (PE) node redundancy at all, or PE redundancy inside just one domain 😭 That's a seriously high risk of service interruption, because at least one domain won't have PE node redundancy. This doc describes an inter-domain VPLS solution that gives PE node redundancy across domains 🔥
Status of This Memo 🌸
This is an Internet Standards Track document, so it's officially a standard, not just vibes ✨ It comes from the IETF and represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 5741 💜
Info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc7309 🍓
Copyright Notice 🌈
The copyright belongs to the IETF Trust and the people listed as authors, with copyright dated 2014 and all rights reserved 💅
This document is covered by BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info as they stood on the publication date. Please read those carefully, because they spell out what you can and can't do with this doc 🙈 Any Code Components pulled out of this document have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, also as described in the Simplified BSD License.
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Conventions Used in This Document . . . . . . . . . . . . . . 3
3. Motivation . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Network Use Case . . . . . . . . . . . . . . . . . . . . . . 4
5. PW Redundancy Application Procedure for Inter-domain
Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.1. ICCP Switchover Condition . . . . . . . . . . . . . . . . 6
5.1.1. Inter-domain PW Failure . . . . . . . . . . . . . . . 6
5.1.2. PE Node Isolation . . . . . . . . . . . . . . . . . . 6
5.1.3. PE Node Failure . . . . . . . . . . . . . . . . . . . 6
5.2. Inter-domain Redundancy with Two PWs . . . . . . . . . . 6
5.3. Inter-domain Redundancy with Four PWs . . . . . . . . . . 7
6. Management Considerations . . . . . . . . . . . . . . . . . . 9
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10
9. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 10
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
10.1. Normative references . . . . . . . . . . . . . . . . . . 10
10.2. Informative references . . . . . . . . . . . . . . . . . 101. Introduction ✨
Okay so, lots of existing VPLS deployments based on [RFC4762] have PW connectivity with no Provider Edge (PE) node redundancy, or PE redundancy with only a single domain. That's a high risk of service interruption, since at least one domain won't offer PE node redundancy 😬 This document describes an inter-domain VPLS solution that provides PE node redundancy across domains. 💖 The redundancy mechanism gives you PE node redundancy and link redundancy in both domains, which is giving main character energy 👑
Quick definitions bestie: "PE" throughout the document refers to a routing and bridging capable PE defined in [RFC4762], Section 10 🧚 A "domain" here means an autonomous system (AS) or some other administrative domain 🌸
The solution leans on the Inter-Chassis Communication Protocol (ICCP) [RFC7275] to coordinate between the two redundant edge nodes, plus the PW Preferential Forwarding Status Bit [RFC6870] to negotiate PW status 🦋 Here's the best part: there's no change to any protocol message formats and no new protocol options introduced. It's all reusing existing protocol building blocks to get the job done. It also defines the implementation behavior needed for the function to actually work, so it's not just vibes, it's the full plan ✨
2. Conventions Used in This Document 🎀
Okay this part is the vocab check 💅 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶
3. Motivation 💜
Inter-AS VPLS offerings are widely deployed in service provider networks today 🌈 Typically, the Autonomous System Border Router (ASBR) and its associated physical links that connect the domains carry a whole multitude of services. So it's important to provide PE node and link redundancy, to keep availability high and meet end customer service level agreements (SLAs) 😭
Several current inter-AS VPLS deployments are built like inter-AS option A, described in [RFC4364], Section 10, where a Virtual Local Area Network (VLAN) is used to hand off services between two domains 🍓 In these setups, PE node/link redundancy is achieved using Multi-Chassis Link Aggregation (MC-LAG) and ICCP [RFC7275]. But this comes with two restrictions on the interconnection: the two domains must be interconnected using Ethernet links, and the links must be homogeneous, i.e., the same speed, in order to be aggregated 🙈 Those two conditions can't always be guaranteed in live deployments. For example, lots of scenarios use packet over Synchronous Optical Networking (SONET) / Synchronous Digital Hierarchy (SDH), which totally rules out MC-LAG as a redundancy mechanism 💀 So from a technical point of view, it's desirable to use PWs to interconnect the VPLS domains and offer resiliency with PW redundancy mechanisms 🔥
Multiprotocol Border Gateway Protocol (MP-BGP) can be used for VPLS inter-domain protection, as described in [RFC6074], using either option B or option C inter-AS models 🦋 However, with that approach the protection time relies on BGP control-plane convergence. In deployments with tight SLA requirements on availability, that mechanism may not give you the failover time you want 😬 Also, in certain situations MP-BGP isn't deployed for VPLS at all. The redundancy solution in this document reuses ICCP [RFC7275] and PW redundancy [RFC6718] to get fast convergence ⚡
Now, in the case where label switched multicast isn't used for VPLS multicast [RFC7117], this solution behaves better than inter-AS option B 👑 With option B, each PE has to do ingress replication to all other PEs in its local domain as well as the remote domain. With the ICCP solution, the PE only replicates to local PEs and to the ASBR. The ASBR then sends traffic point to point to the remote ASBR, and that remote ASBR replicates to its own local PEs. So the replication load gets distributed, and it's more efficient than option B 🧚
Two PW redundancy modes defined in [RFC6718], independent mode and master/slave mode, are applicable in this solution 🌸 To keep control-plane separation between the two domains, operators tend to prefer independent mode 🫶 Master/slave mode offers some enhanced capabilities, so it's included in this document too ✨
4. Network Use Case 🦋
Okay so there are two network use cases for VPLS inter-domain redundancy: the two-PWs redundancy case and the four-PWs redundancy case 💖
Figure 1 shows an example use case with two inter-domain PWs. PE3/PE4/PE5/PE6 may be ASBRs of their respective AS, or VPLS PEs within its own AS 🎀 PE3 and PE4 belong to one redundancy group (RG), and PE5 and PE6 belong to another RG 🌈 A deployment example of this use case is where there are only two physical links between two domains, with PE3 physically connected to PE5 and PE4 physically connected to PE6 🍓
+---------+ +---------+
+---+ | +-----+ | active PW1 | +-----+| +---+
|PE1|---|-| PE3 |-|-----------------|--| PE5 ||----|PE7|
+---+\ |/+-----+ | | +-----+\ /+---+
| \ / | * | | * | |\ / |
| \| | |ICCP| |ICCP| | | \ |
| / \ | * | | * | |/ \ |
+---+/ |\+-----+ | | +-----+/ \+---+
|PE2|---|-| PE4 |-|-----------------|--| PE6 ||----|PE8|
+---+ | +-----+ | standby PW2 | +-----+| +---+
| | | |
| | | |
| RG1 | | RG2 |
+---------+ +---------+
operator A network operator B networkFigure 1
Figure 2 shows a four-PWs inter-domain VPLS redundancy use case 🧚 Again, PE3/PE4/PE5/PE6 may be ASBRs of their respective AS, or VPLS PEs within its own AS ✨ A deployment example of this one is where there are four physical links between two domains, and four PEs are physically connected to each other with four links 💅
+---------+ +---------+
+---+ | +-----+ | | +-----+| +---+
|PE1|---|-| PE3 |-|--------PW1------|--| PE5 ||----|PE7|
| | | | |-|-PW3\ /------|--| || | |
+---+\ |/+-----+ | \ / | +-----+\ /+---+
| \ / | * | \ / | * | |\ / |
| \| | |ICCP| X |ICCP| | | \ |
| / \ | * | / \ | * | |/ \ |
+---+/ |\+-----+ | / \ | +-----+/ \+---+
| | | | |-|-PW4/ \------|--| || | |
|PE2|---|-| PE4 |-|----PW2----------|--| PE6 ||----|PE8|
+---+ | +-----+ | | +-----+| +---+
| | | |
| | | |
| RG1 | | RG2 |
+---------+ +---------+
operator A network operator B networkFigure 2
To be continued in part 2 🫶✨
5. PW Redundancy Application Procedure for Inter-domain Redundancy ✨
okay so bestie, PW redundancy procedures are spelled out in Section 9.1 of [RFC7275] 💅. When a PE node runs into a failure, the other PE takes over 🦋. This document reuses the PW redundancy mechanism from [RFC7275] 🎀, but with new ICCP switchover conditions, which we'll get to in the next section 🫶.
There are two PW redundancy modes defined in [RFC6870] 🌸: Independent mode and Master/Slave mode 💜. For the inter-domain four-PW scenario, PEs MUST make sure the same mode is supported on the two ICCP peers in the same RG 🔥. You can do this with manual configuration at the ICCP peers 🍓. Other ways of making sure things stay consistent are out of scope for this document 🙈.
5.1. ICCP Switchover Condition
5.1.1. Inter-domain PW Failure
okay so when a PE gets advertisements from the active PE in the same RG saying all the inter-domain PW status has flipped to DOWN/STANDBY, and it has the highest priority (after the advertising PE), it SHOULD advertise active state for all of its associated inter-domain PWs 👑✨.
5.1.2. PE Node Isolation
when a PE detects failure of all PWs to the local domain, it SHOULD advertise standby state for all its inter-domain PWs so the remote PE switches over 🧚💀.
5.1.3. PE Node Failure
when a PE node detects that the active PE in the same RG has gone down, and the local PE has redundant PWs for the affected services and has the highest priority (after the failed PE), it SHOULD advertise the active state for all associated inter-domain PWs 😭🌈.
5.2. Inter-domain Redundancy with Two PWs
bestie, in this use case, the recommended setup looks like this 🎀:
- ICCP deployment option: ICCP is deployed on VPLS edge nodes in both domains;
- PW redundancy mode: independent mode only;
- Protection architectures: 1:1 (1 standby, 1 active).
the switchover rules from Section 5.1 apply 💖. Before deploying this inter-domain VPLS, the operators should negotiate to configure the same PW high/low priority at two PW endpoints 🤝. The inter-domain VPLS relationship normally involves a contractual process between operators, and setting up PW roles is part of that deal 📜. For example, in Figure 1, PE3 and PE5 must both have higher/lower priority than PE4 and PE6 🫠; otherwise, both PW1 and PW2 will end up in standby state 😵.
5.3. Inter-domain Redundancy with Four PWs
so in this use case there are two ways to protect things: 1:1 and 3:1 protection 🦋. The inter-domain PWs that connect to the same PE should have proper PW priority so they advertise the same active/standby state 💅. For example, in Figure 2, both PW1 and PW3 connect to PE3 and should advertise active/standby state together 🫶.
For the 1:1 protection model, here's the vibe:
- ICCP deployment option: ICCP is deployed on VPLS edge nodes in both domains;
- PW redundancy mode: independent mode only;
- Protection architectures: 1:1 (1 standby, 1 active).
the switchover rules from Section 5.1 apply 🔥. Here the operators don't need to coordinate the inter-domain PW priority at all 🙌. The PE that detects one PW DOWN SHOULD set the other PW to STANDBY if one is available, and then sync the updated state to its ICCP peer 🔄. When a PE detects that the PWs from its ICCP peer PE are DOWN or STANDBY, it SHOULD switch over as described in Section 5.1.1 ✨.
There are two variants of the 3:1 protection model, which we'll call options A and B 🧚. The implementation MUST support option A and MAY support option B 🌸. Option B is useful when the two legacy PEs in one domain don't support the function in this document 🍓. Those two legacy PEs still need to support the PW redundancy defined in [RFC6870] and be configured as slave nodes 🐣.
For option A of the 3:1 protection model, support for the Request Switchover status bit [RFC6870] is REQUIRED 🔥. Here's how it goes:
- ICCP deployment option: ICCP is deployed on VPLS edge nodes in both domains;
- PW redundancy mode: Independent mode with 'request switchover' bit support;
- Protection architectures: 3:1 (3 standby, 1 active).
in this case, the PE's procedure for PW failure follows Section 6.3 of [RFC6870], plus these additions 🎀:
- When the PE detects failure of the active inter-domain PW, it SHOULD switch to the other local standby inter-domain PW if one is available, and send an updated LDP PW status message with the 'request switchover' bit set on that local standby inter-domain PW to the remote PE 🚀;
- Local and remote PEs SHOULD also update the new PW status to their ICCP peers, using Application Data Messages with the PW-RED Synchronization Request TLV for the corresponding service, so both PE sides have the latest PW status 🫶;
- While waiting for the acknowledgement, the PE that sent the 'request switchover' bit might get a switchover request from its ICCP peer's PW remote endpoint through ICCP synchronization 👀. The PE MUST compare IP addresses with that PW remote peer. The PE with the higher IP address SHOULD ignore the request and keep waiting for the acknowledgement from its peer in the remote domain 🙃. The PE with the lower IP address SHOULD clear the 'request switchover' bit, set the 'Preferential Forwarding' local status bit, and update the PW status to its ICCP peer 💜;
- The remote PE that receives the 'request switchover' bit SHOULD acknowledge the request and activate the PW only when it's ready to take over as described in Section 5.1; otherwise, it SHOULD ignore the request 🥺.
PE node isolation failure and PE node failure are covered in Section 5.1 💖.
For option B of the 3:1 protection model, master/slave mode support is required and SHOULD work like this 🌈:
- ICCP deployment option: ICCP is deployed on VPLS edge nodes in only one domain;
- PW redundancy mode: master/slave only;
- Protection architectures: 3:1 (3 standby, 1 active).
when master/slave PW redundancy mode is in use, the network operators of the two domains must agree on which domain's PEs will be master, and configure the devices to match 🤝. The inter-domain PWs that connect to one PE should have higher PW priority than the PWs on the other PE in the same RG 👑. The PE's procedure for PW failure goes like this:
- The PE with higher PW priority should only enable one PW as active, and the other PWs stay in standby state 😤;
- When the PE detects an active PW DOWN, it SHOULD enable the other local standby PW to be active, with preference 🏃♀️. Only when both inter-domain PWs connected to the PE are DOWN should the ICCP peer PE in the same RG SHOULD switch over as described in Section 5.1 💀.
PE node isolation failure and PE node failure are described in Section 5.1 🫶.
6. Management Considerations 🎀
when you deploy the inter-domain redundancy mechanism from this document, consistent provisioning is REQUIRED for it to work properly 📋. Both domains must use the same use case (Section 5.2 or Section 5.3) 💅. Within each section, all of the described modes and options must be provisioned identically, both within each RG and between the RGs ✨. Also, for the two-PW redundancy options in Section 5.2, the two operators must negotiate to configure the same high/low PW priority at the two PW endpoints 🤝. If the provisioning is inconsistent, the inter-domain redundancy mechanism may not work properly 😬.
7. Security Considerations 🔐
this one's serious bestie 🫢. Besides the security properties of [RFC7275] for the ICCP control plane, and [RFC4762] and [RFC6870] for the PW control plane, this document adds extra security considerations for the ICCP control plane 🛡️.
In this document, ICCP is deployed between two PEs or ASBRs. The two PEs or ASBRs SHOULD only be connected by a network that is well managed and whose service levels and availability are highly monitored 📡. The operator should make sure this is the case 👑.
State flapping on the inter-domain and intra-domain PWs may cause security threats or be exploited to create denial-of-service attacks 😱🚨. For example, excessive PW state flapping (e.g., from a malicious peer PE's implementation) may lead to excessive ICCP exchanges 💀. Implementations SHOULD provide mechanisms to perform control-plane policing and mitigate these kinds of attacks 🛑🔒.
8. Acknowledgements 💜
The authors would like to thank Sami Boutros, Giles Heron, Adrian Farrel, Andrew G. Malis, and Stephen Kent for their valuable comments 🫶✨.
9. Contributors 🌸
Daniel Cohn Email: daniel.cohn.ietf@gmail.com
Yubao Wang ZTE Corporation
Nanjing, China Email: wang.yubao@zte.com.cn
10. References 📚
10.1. Normative references
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC6870] Muley, P. and M. Aissaoui, "Pseudowire Preferential
Forwarding Status Bit", RFC 6870, February 2013.
[RFC7275] Martini, L., Salam, S., Sajassi, A., Bocci, M.,
Matsushima, S., and T. Nadeau, "Inter-Chassis
Communication Protocol for Layer 2 Virtual Private Network
(L2VPN) Provider Edge (PE) Redundancy", RFC 7275, June
2014.10.2. Informative references
[RFC4364] Rosen, E. and Y. Rekhter, "BGP/MPLS IP Virtual Private
Networks (VPNs)", RFC 4364, February 2006.
[RFC4762] Lasserre, M. and V. Kompella, "Virtual Private LAN Service
(VPLS) Using Label Distribution Protocol (LDP) Signaling",
RFC 4762, January 2007.
[RFC6074] Rosen, E., Davie, B., Radoaca, V., and W. Luo,
"Provisioning, Auto-Discovery, and Signaling in Layer 2
Virtual Private Networks (L2VPNs)", RFC 6074, January
2011.
[RFC6718] Muley, P., Aissaoui, M., and M. Bocci, "Pseudowire
Redundancy", RFC 6718, August 2012.
[RFC7117] Aggarwal, R., Kamite, Y., Fang, L., Rekhter, Y., and C.
Kodeboniya, "Multicast in Virtual Private LAN Service
(VPLS)", RFC 7117, February 2014.Authors' Addresses 💌
Zhihua Liu
China Telecom
109 Zhongshan Ave.
Guangzhou 510630
P.R.China
EMail: zhliu@gsta.com
Lizhong Jin
Shanghai
P.R.China
EMail: lizho.jin@gmail.com
Ran Chen
ZTE Corporation
NO.19 East Huayuan Road
Haidian District Beijing 100191
P.R.China
EMail: chen.ran@zte.com.cn
Dennis Cai
Cisco
3750 Cisco Way,
San Jose, California 95134
USA
EMail: dcai@cisco.com
Samer Salam
Cisco
595 Burrard Street, Suite:2123
Vancouver, BC V7X 1J1
Canada
EMail: ssalam@cisco.com📦 where this page comes from
- ietf: rfc7309 2014-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms