RFC 7734
Support for Shortest Path Bridging MAC Mode over Ethernet VPN (EVPN)
Support for Shortest Path Bridging MAC Mode over Ethernet VPN (EVPN) 🎀
okay bestie, grab your coffee because this is RFC 7734 💅✨ here's the title block, all the facts up front:
- Number and title: RFC 7734, "Support for Shortest Path Bridging MAC Mode over Ethernet VPN (EVPN)" 🦋
- Authors: D. Allan, Ed. (no affiliation is listed for them in the header 🙈), J. Tantsura (Ericsson), D. Fedyk (HPE), and A. Sajassi (Cisco) 👑
- Category: Standards Track 🌸 (the Status section confirms it's an Internet Standards Track document)
- Date: January 2016 📅
- ISSN: 2070-1721 💜
- Obsoletes and updates: the header has no Obsoletes or Updates entries, so nothing is listed there 🫶
Abstract ✨
okay so this doc is about how Ethernet Shortest Path Bridging MAC mode (SPBM) can team up with Ethernet VPN (EVPN) so it can interwork with Provider Backbone Bridging Provider Edges (PBB PEs) 🌈, the stuff covered in the PBB-EVPN solution (RFC 7623). The trick is operational isolation of each Ethernet network attached to an EVPN core, while still supporting full interworking between the different variations of Ethernet networks. it's giving unity 💖
Status of This Memo 🧚
so this is an Internet Standards Track doc 💅 It's a product of the IETF, which means it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) ✨. If you want more on Internet Standards, check Section 2 of RFC 5741. Info about the current status of this doc, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc7734 🔗
Copyright Notice ⚖️
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🌷
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please actually read those, bestie, because they describe your rights and restrictions for this doc. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🫶
Table of Contents 📖
1. Introduction ....................................................3
1.1. Requirements Language ......................................3
2. Conventions Used in This Document ...............................3
2.1. Terminology ................................................3
3. Solution Overview ...............................................4
4. Elements of Procedure ...........................................5
4.1. PE Configuration ...........................................5
4.2. DF Election ................................................6
4.3. Control-Plane Interworking ISIS-SPB to EVPN ................6
4.4. Control-Plane Interworking EVPN to ISIS-SPB ................7
4.5. Data-Plane Interworking SPBM Island or PBB PE to EVPN ......8
4.6. Data-Plane Interworking EVPN to SPBM Island ................8
4.7. Data-Plane Interworking EVPN to PBB PE .....................8
4.8. Multicast Support ..........................................8
5. Other Aspects ...................................................8
5.1. Transit ....................................................8
6. Security Considerations .........................................9
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................10
Acknowledgments ...................................................11
Authors' Addresses ................................................111. Introduction 🧚
okay so this doc describes how Ethernet Shortest Path Bridging MAC mode (SPBM) [IEEE.802.1Q], along with Provider Backbone Bridging Provider Edges (PBB PEs) and Provider Backbone Bridged Networks (PBBNs), can be supported by Ethernet VPNs (EVPNs). The vibe: each SPBM island is operationally isolated, but you still get full L2 connectivity between the different types of PBBNs wherever you want it 🦋. Each SPBM island uses its own control-plane instance and multipathing design, be it multiple equal-cost tree sets or multiple spanning trees 🌸.
The goal is to let past, current, and emerging future versions of Ethernet get seamlessly interconnected 🌈. That way, large-scale, geographically diverse numbers of Ethernet end systems can be fully supported with EVPN as the unifying system 🌍💜
1.1. Requirements Language 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. (these are the official BCP 14 words, so treat them seriously 👑)
2. Conventions Used in This Document 📚
2.1. Terminology 💅
Terms used in this document are used as specified in IEEE 802.1Q-2014, which incorporates earlier IEEE 802.1 projects. Here's the glossary, bestie 🫶
BEB: Backbone Edge Bridge
BGP: Border Gateway Protocol
B-MAC: Backbone MAC
B-VID: Backbone VLAN ID
CE: Customer Edge
DA: Destination Address
DF: Designated Forwarder
ESI: Ethernet Segment Identifier
EVPN: Ethernet VPN
IB-BEB: A BEB that has both an I-component (customer-layer VLAN-aware
bridge) and a B-component (backbone-layer VLAN-aware bridge)
ISIS-SPB: IS-IS as extended for SPB
I-SID: Backbone Service Instance Identifier
NLRI: Network Layer Reachability Information
PBB: Provider Backbone Bridging as in Clauses 25 and 26 of
[IEEE.802.1Q]
PBBN: Provider Backbone Bridged Network
PBB PE: Co-located BEB and EVPN PE
PE: Provider Edge
SPB: Shortest Path Bridging
SPBM: Shortest Path Bridging MAC mode as in Clauses 27 and 28 of
[IEEE.802.1Q]
SPBM-PE: Co-located SPBM<->EVPN interworking function and EVPN PE3. Solution Overview 🦋
okay so the EVPN solution for SPBM, as specified in [IEEE.802.1Q], includes control-plane interworking in the PE 💖. It maps ISIS-SPB [RFC6329] information elements into the EVPN Next Layer Reachability Information (NLRI), and vice versa. This means each PE has to act both as an EVPN BGP speaker and as an ISIS-SPB edge node 🧚. There are also procedures for configuring the PE's forwarding operations, so an arbitrary number of EVPN-attached SPBM islands can be interconnected without any topological or multipathing dependencies ✨. This model also lets PBB PEs as defined in [RFC7623] communicate seamlessly with the SPBM islands 🌈.
+--------------+ +----+ +---+
| | |PBB |---|CE2|
| | |PE3 | +---+
+-----+ +----+ | | +----+
| |-----|SPBM| | |
|SPBM | |PE1 | | IP/MPLS |
+---+ |NTWK1| +----+ | Network |
|CE1|-| | | |
+---+ | | +----+ | |
| |-----|SPBM| | | +----+ +-----+
+-----+ |PE2 | | | |SPBM| |SPBM | +---+
+----+ | | |PE5 |---|NTWK2|-|CE3|
+--------------+ +----+ +-----+ +---+Figure 1: PBB and SPBM EVPN Network 🖼️
Figure 1 illustrates the generalized space this memo addresses 🌷. SPBM networks may be multihomed onto an IP/MPLS network that implements EVPN, so they can interconnect with other SPBM networks and/or PBB PEs 💜. Each SPBM network can have its own unique multipathing configuration, because the backbone VLAN ID (B-VID) configuration (which is how multipathing is performed in SPBM) is not propagated across the IP/MPLS network implementing EVPN 🙌. Just like with PBB networking, the B-VID is local to the SPBM network. So in SPBM, a B-MAC associated with the B-VID is advertised with the supported I-SIDs at the PBB gateway 🎀.
Each EVPN is identified by a route target. I-SID-based load-balancing, as specified in [RFC7623], allows multiple gateways per B-VID (each with different I-SIDs) across the EVPN, and it's supported by the interworking between PBBNs and SPBM networks 🍓. But SPBM only allows a single active designated forwarder (DF) per B-VID, as described below 👑. The route target identifies the set of SPBM islands and PBB PEs that are allowed to communicate 🦋. Each SPBM island is administered to have an Ethernet Segment ID (ESI) Label extended community associated with it 💅.
BGP acts as a common repository of the I-Component Service ID (I-SID) attachment points for the set of attached PEs and SPBM islands. This is in the form of {B-MAC address, I-SID, Tx-Rx-attribute} tuples 📦. BGP distributes I-SID information into each SPBM island based on locally registered interest 🌈. If an SPBM island has no Backbone Edge Bridges (BEBs) registering interest in a particular I-SID, information about that I-SID from other SPBM islands, PBB PEs, or PBBNs MUST NOT be leaked into the local ISIS-SPB routing system 🙅♀️. For each B-VID in an SPBM island, a single SPBM-PE MUST be elected the DF for the B-VID 🧚. An SPBM-PE can be a DF for more than one B-VID 💖. This is described further in Section 4.2 ✨. The SPBM-PE originates IS-IS advertisements as if it were an IB-BEB that proxies for the other SPBM islands and PBB PEs in the EVPN defined by the route target. The PE typically won't actually host any I-components, though 🫶.
An SPBM-PE that is a DF for a B-VID MUST strip the B-VID tag information from frames relayed towards the EVPN 🧹. The DF MUST also insert the appropriate B-VID tag information into frames relayed towards the SPBM island, based on the local I-SID/B-VID bindings advertised in ISIS-SPB 🎀.
4. Elements of Procedure 💅
A PE MUST implement and perform the following procedures. no skipping, bestie 👑
4.1. PE Configuration 🌸
At SPBM island commissioning, a PE is configured with:
- The route target for the service instance. A route target is defined as identifying the set of SPBM islands, PBBNs, and PBB PEs that are to be interconnected by the EVPN 🦋.
- The unique ESI for the SPBM island. Mechanisms for deriving a unique ESI for the SPBM island are out of scope 🙈.
The following is configured as part of commissioning an ISIS-SPB node:
- A Shortest Path Source ID (SPSourceID) used for algorithmic construction of multicast addresses. Note this is required for SPBM BEB operation, independent of the EVPN operation 🌈.
- The set of B-VIDs used in the SPBM island, and the multipathing algorithm IDs to use for each. The set of B-VIDs and multipathing algorithms used can be different in different domains. Therefore, the B-VID is local to an SPBM domain and is removed for frames carried over the IP/MPLS network 🍓.
A Type 1 Route Distinguisher for the node can be auto-derived. The actual procedure is out of scope for this document 💜.
4.2. DF Election 👑
PEs self-appoint themselves for the role of DF for a B-VID for a given SPBM island 🧚. The procedure used is as per Section 8.5 (Designated Forwarder Election) of [RFC7432] 🦋.
A PE that assumes the role of DF for a given B-VID is responsible for originating specific information into BGP from ISIS-SPB, and vice versa 💖. A PE that ceases to perform the role of DF for a given B-VID is responsible for withdrawing the associated information from BGP and ISIS-SPB, respectively ✨. The actual information exchanged is outlined in the following sections 🫶.
to be continued in part 2, bestie 💜 the next bit covers Sections 4.3 onward, plus the rest of the doc 🌈
4.3. Control-Plane Interworking ISIS-SPB to EVPN 🎀
okay so this one is about what happens when a PE gets an SPBM service identifier and unicast address sub-TLV inside an ISIS-SPB MT capability TLV 🧚 first it checks whether it's the DF for the B-VID in that sub-TLV. bestie, the DF check is everything here 💅
If it is the DF and there's new or changed info, it creates a MAC/IP advertisement route NLRI for each new I-SID in the sub-TLV. If something changed and it affects an existing NLRI, that NLRI gets modified the same way ✨ When it creates or modifies the NLRI, it makes sure of a few things:
- the Route Distinguisher is set to that of the PE. 💖
- the ESI is that of the SPBM island. 🌸
- the Ethernet Tag ID contains the I-SID (including the Tx/Rx attributes) copied from the SPBM service identifier and unicast address sub-TLV. The encoding of I-SID information is as per Figure 2. (See [RFC6329] for details on the T bit and R bit.) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|T|R| Reserved | I-SID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 2: I-SID Encoding in the Ethernet Tag ID Field 🍓
- the MAC address is copied from the SPBM service identifier and unicast address sub-TLV 🫶
- a locally assigned MPLS label (which may be common with other NLRI originated by the PE and is used to map EVPN traffic to the SPBM network) 🔥
Now the flip side: say a PE becomes the DF for a B-VID while the network is already running. Same deal, but this time it processes the IS-IS database to build the NLRI that goes with its new role 👑
If the BGP database already has NLRI for the I-SID, and this is the first time the SPBM island has shown interest in that I-SID, the NLRI gets processed into an updated set of SPBM service identifier and unicast address sub-TLVs for the PE to advertise 💜
The ISIS-SPB info also keeps a local table up to date. That table is indexed by I-SID and tells you the associated B-VID, so frames coming in from EVPN get handled properly 🌈 When one I-SID is tied to more than one B-VID, only one entry is allowed in the table. ngl the rules for preventing that are out of scope for this memo, so we're leaving that one for another day 🙈
4.4. Control-Plane Interworking EVPN to ISIS-SPB ✨
When a PE gets a BGP NLRI with new info, it checks whether it's the elected DF that should pass that info into ISIS-SPB. It does this by checking if the I-SID in the Ethernet Tag ID maps locally to the B-VID it's the elected DF for 🦋 Heads up: if no BEBs in the SPB island have said they're interested in the I-SID, it won't be associated with any B-VID locally, so it won't matter to us 🙃 If the I-SID is of local interest to the SPBM island and the PE is the DF for the B-VID that the I-SID is locally mapped to, then a SPBM service identifier and unicast address sub-TLV gets constructed or updated for advertisement into ISIS-SPB 💅
The NLRI that gets advertised into ISIS-SPB is also used to fill a local forwarding table. That table is indexed by B-MAC + I-SID and points to the label stack to impose on the SPBM frame. The bottom label in that stack is the one taken from the NLRI 🎀
4.5. Data-Plane Interworking SPBM Island or PBB PE to EVPN 🧚
When a PE gets a frame from the SPBM island in a B-VID that it's the DF for, it looks up the B-MAC/I-SID info to figure out which label stack to add to the frame for forwarding in the EVPN. Then it strips the B-VID info from the frame, adds the label info, and forwards the resulting MPLS packet 🚀
4.6. Data-Plane Interworking EVPN to SPBM Island 💖
When a PE gets a packet from the EVPN, it can infer the B-VID to overwrite in the SPBM frame from the I-SID or by other means (such as via the bottom label in the MPLS stack) 🌸
If the frame has a local multicast destination address (DA), the PE overwrites the SPSourceID in the frame with the local SPSourceID 🦋
4.7. Data-Plane Interworking EVPN to PBB PE 🫶
A PBB PE actually has no attached PBBN and no concept of B-VID, so there's no frame processing to do here 🙌
A PBB PE is required to accept SPBM-encoded multicast DAs as if they were PBB-encoded (i.e., using the Backbone Service Instance Group address) for multicast DAs. The only info it cares about is that it's a multicast frame and the I-SID encoded in the lower 24 bits 🍓
4.8. Multicast Support 🌈
Within a PBBN domain, Ethernet unicast and multicast end services are supported ✨ PBB can tunnel multicast traffic in unicast PBB frames when it uses head-end replication. That's the only form of multicast traffic interworking this document supports 💅 Native PBB multicast forwarding over EVPN, PE replication, or optimizing PBB multicast across the EVPN are not addressed by this memo, so no spoilers there 🤫
5. Other Aspects 🎀
5.1. Transit 🦋
Any PE that doesn't need to take part in the tandem calculations at the B-MAC layer can use the IS-IS overload bit to exclude SPBM tandem paths and act as a pure interworking platform 👑
6. Security Considerations 🚨
Okay bestie, this section is seriously important, so read it carefully 😭
Security issues tied to incorrect interconnection of customer LANs can't be directly handled by implementations of this document, because they need misconfiguration in the Shortest Path Bridging domains to happen first. The identifiers that get administered have global significance to the larger system. EVPN relays them transparently and they're only policed in the SPBM domains. So you have to be really careful when you sync the identifiers that need to match for inter-domain operation 🥹
Only two identifiers unique to this solution get provisioned at an SPBM-PE when service turns up: the route target and the ESI. The ESI needs to be unique and shared by all SPBM-PEs connected to a common SPBM network or PBBN, or else parts of the overall network won't share reachability. (The EVPN will assume that separate networks are interconnected by SPBM.) 💀 Security issues come up when SPBM domains get incorrectly cross-connected through EVPN. That leads to black-holing or incorrect delivery of data, along with privacy issues. This error can happen when the wrong RT value gets provisioned at an SPBM-PE, or when the RT is associated with the wrong interface. You can avoid it by consistency-checking the route target provisioning at SPBM-PEs whenever you add or change a service 🔐
The behavior that's most destructive to the overall system is frequent changes to the DF elections for a given ESI. That happens if SPBM-PEs keep having their links go up and down in such a way that they get cut off from and reconnected to either the IP/MPLS network or the attached SPBM network. Either scenario causes a ton of control-plane traffic, since DF-associated info keeps getting advertised and withdrawn from both the SPBM and BGP control planes 😵💫 Dual-homing SPBM-PEs on both networks would make this scenario much less likely 💜
The issues with securing the BGP control plane (independent of this particular memo) are covered in the Security Considerations section of [RFC4761]. 🫶
7. References 📚
7.1. Normative References 💅
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4761] Kompella, K., Ed., and Y. Rekhter, Ed., "Virtual Private
LAN Service (VPLS) Using BGP for Auto-Discovery and
Signaling", RFC 4761, DOI 10.17487/RFC4761, January 2007,
<http://www.rfc-editor.org/info/rfc4761>.
[RFC6329] Fedyk, D., Ed., Ashwood-Smith, P., Ed., Allan, D., Bragg,
A., and P. Unbehagen, "IS-IS Extensions Supporting IEEE
802.1aq Shortest Path Bridging", RFC 6329,
DOI 10.17487/RFC6329, April 2012,
<http://www.rfc-editor.org/info/rfc6329>.
[RFC7432] Sajassi, A., Ed., Aggarwal, R., Bitar, N., Isaac, A.,
Uttaro, J., Drake, J., and W. Henderickx, "BGP MPLS-Based
Ethernet VPN", RFC 7432, DOI 10.17487/RFC7432, February
2015, <http://www.rfc-editor.org/info/rfc7432>.7.2. Informative References 🦋
[IEEE.802.1Q]
IEEE, "IEEE Standard for Local and metropolitan area
networks--Bridges and Bridged Networks", IEEE 802.1Q-2014,
DOI 10.1109/ieeestd.2014.6991462, December 2014.
[RFC7623] Sajassi, A., Ed., Salam, S., Bitar, N., Isaac, A., and W.
Henderickx, "Provider Backbone Bridging Combined with
Ethernet VPN (PBB-EVPN)", RFC 7623, DOI 10.17487/RFC7623,
September 2015, <http://www.rfc-editor.org/info/rfc7623>.Acknowledgments 💖
The authors would like to thank Peter Ashwood-Smith, Martin Julien, and Janos Farkas for their detailed reviews of this document 🙌✨
Authors' Addresses 🧚
Dave Allan (editor)
Ericsson
300 Holger Way
San Jose, CA 95134
United States
Email: david.i.allan@ericsson.com
Jeff Tantsura
Ericsson
300 Holger Way
San Jose, CA 95134
United States
Email: jeff.tantsura@ericsson.com
Don Fedyk
Hewlett-Packard Enterprise
153 Taylor Street
Littleton, MA 01460
United States
Email: don.fedyk@hpe.com
Ali Sajassi
Cisco
170 West Tasman Drive
San Jose, CA 95134
United States
Email: sajassi@cisco.com📦 where this page comes from
- ietf: rfc7734 2016-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms