RFC 8380
Directory-Assisted Transparent Interconnection of Lots of Links (TRILL) Encapsulation
RFC 8380 💖
Directory-Assisted Transparent Interconnection of Lots of Links (TRILL) Encapsulation 🎀
Okay bestie, so the authors are L. Dunbar (Huawei), D. Eastlake 3rd (Huawei), and R. Perlman (Dell/EMC). It's a Standards Track document, published in May 2018, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates. 🧚
Internet Engineering Task Force (IETF) L. Dunbar
Request for Comments: 8380 D. Eastlake 3rd
Category: Standards Track Huawei
ISSN: 2070-1721 R. Perlman
Dell/EMC
May 2018Abstract ✨
So the big idea here is that data center networks can level up when non-RBridge nodes do the TRILL (Transparent Interconnection of Lots of Links) encapsulation themselves, with a directory service helping them out. It's giving teamwork 🫶
Status of This Memo 💅
This is an Internet Standards Track document. 🌸
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. 💜
Info about the current status of this document, any errata, and how to give feedback on it lives at https://www.rfc-editor.org/info/rfc8380. 🦋
Copyright Notice 🌈
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 🔥
Table of Contents 🍓
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. Directory Assistance to Non-RBridge .............................3
4. Source Nickname in Encapsulation by Non-RBridge Nodes ...........6
5. Benefits of a Non-RBridge Performing TRILL Encapsulation ........6
5.1. Avoid Nickname Exhaustion Issue ............................6
5.2. Reduce MAC Tables for Switches on Bridged LANs .............6
6. Manageability Considerations ....................................7
7. Security Considerations .........................................7
8. IANA Considerations .............................................9
9. References .....................................................9
9.1. Normative References .....................................10
9.2. Informative References ...................................10
Acknowledgments ...................................................10
Authors' Addresses.................................................101. Introduction 💖
So this doc explains how data center networks can benefit when non-RBridge nodes do TRILL encapsulation with help from a directory service, and it also lays out a method for them to actually do it. ✨
[RFC7067] and [RFC8171] describe the framework and methods that let edge RBridges look up (MAC and VLAN) <-> Edge RBridge mappings from a directory service. The alternative is flooding unknown destination MAC addresses across the whole TRILL domain, which is not the vibe 😭 If it has the directory info it needs, any node, even a non-RBridge one, can do the TRILL data packet encapsulation. This document covers the perks of that and a scheme for non-RBridge nodes to do it. 🦋
2. Conventions Used in This Document 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 💅
Here's the glossary, bestie 📚
- AF: Appointed Forwarder RBridge port [RFC8139].
- Bridge: A device compliant with IEEE 802.1Q. In this document, Bridge is used interchangeably with Layer 2 switch.
- DA: Destination Address.
- ES-IS: End System to Intermediate System [RFC8171].
- Host: A physical server or a virtual machine running applications. A host usually has at least one IP address and at least one MAC address.
- IS-IS: Intermediate System to Intermediate System [RFC7176].
- SA: Source Address.
- TRILL-EN: TRILL Encapsulating Node. A node that performs the TRILL encapsulation but doesn't participate in an RBridge's IS-IS routing.
- VM: Virtual Machine.
3. Directory Assistance to Non-RBridge 🧚
With directory assistance [RFC7067] [RFC8171], a non-RBridge node can figure out if a data packet needs to cross the RBridge domain and, if so, which egress RBridge to use. It's literally a cheat code 🙈
Let's say the RBridge domain boundary starts at network switches (not virtual switches embedded on servers). Check out Figure 1 for a high-level look at a typical data center network 👑 A directory can help virtual switches embedded on servers do the encapsulation with a proper TRILL header, by giving them the nickname of the egress RBridge edge that the destination is attached to. The rest of the info needed to encapsulate can be learned either by listening to TRILL ES-IS and/or IS-IS Hellos [RFC7176] [RFC8171], which show the MAC address and nickname of the right local edge RBridges, or by configuration. ⭐
If the directory doesn't know whether a destination is attached to one or more edge RBridges, the non-RBridge node can forward the data frames natively, meaning without any TRILL header. Or, if the directory is known to be complete, the non-RBridge node can discard those data frames. Choose your fighter 💀
\ +-----------+ +-----------+ /
\ +/----------+ | +/----------+ | TRILL /
\ |Aggregation| | |Aggregation| | Domain /
\ | 11 | + --- | N1 | + /
\ +-----------+/ +-----------+/ /
\ / \ / \ /
\ / \ / \ /
Top- \ +---+ +---+ +---+ +---+ /
of- --> \- |T11|... |T1x| |T21| .. |T2y|---/
Rack +---+ +---+ +---+ +---+
Switches | | | |
+-|-+ +-|-+ +-|-+ +-|-+
| |... | V | | V | .. | V | <- vSwitch
+---+ +---+ +---+ +---+
| |... | V | | V | .. | V |
+---+ +---+ +---+ +---+
| |... | V | | V | .. | V |
+---+ +---+ +---+ +---+Figure 1: TRILL Domain in a Typical Data Center Network 🌸
When a TRILL-encapsulated data packet reaches the ingress RBridge, that RBridge just does its usual TRILL processing and forwards the pre-encapsulated packet to whichever RBridge is named in the egress nickname field of the TRILL header. When an ingress RBridge gets a native Ethernet frame in an environment with complete directory information, it doesn't flood or forward the data frames when the destination MAC address in them is unknown. Iconic restraint 👑
When all the end nodes attached to an ingress RBridge pre-encapsulate with a TRILL header for traffic crossing the TRILL domain, the ingress RBridge doesn't need to encapsulate any native Ethernet frames for the TRILL domain. The attached nodes can connect to multiple edge RBridges by having multiple ports or through a bridged LAN. All RBridge edge ports connected to one bridged LAN can receive and forward pre-encapsulated traffic, which can really boost overall network utilization ✨ That said, it's still necessary to, for example, designate AF ports so that multi-destination packets from the TRILL campus only egress through one RBridge. Not everything gets to be a free-for-all 🙃
Item 8 of Section 4.6.2 of the TRILL base protocol specification [RFC6325] specifies that an RBridge port can be configured to accept TRILL-encapsulated frames from a neighbor that is not an RBridge. 🦋
When a TRILL frame arrives at an RBridge whose nickname matches the destination nickname in the TRILL header of the frame, the processing is exactly the normal kind. As specified in [RFC6325], the RBridge decapsulates the received TRILL frame and forwards the decapsulated frame to the target attached to its edge ports. When the destination MAC address of the decapsulated Ethernet frame isn't in the egress RBridge's local MAC attachment tables, the egress RBridge floods the decapsulated frame to all attached links in the frame's VLAN, or drops the frame (if the egress RBridge is configured with that policy). Two options, both valid, both served with main character energy 🎀
We call a node that, as specified herein, only performs TRILL encapsulation but doesn't participate in RBridge's IS-IS routing a TRILL Encapsulating Node (TRILL-EN). The TRILL-EN can pull (MAC and VLAN) <-> Edge RBridge mappings from directory servers [RFC8171]. To do this, a TRILL-EN MUST support TRILL ES-IS [RFC8171]. Non-negotiable, bestie 🫶
When a TRILL-EN receives or locally generates a native Ethernet frame, it checks the (MAC and VLAN) <-> Edge RBridge mapping and performs the corresponding TRILL encapsulation if the mapping entry is found, as shown in Figure 2. If the destination MAC address and VLAN of the received Ethernet frame don't exist in the mapping table and there is no positive reply from pull requests to a directory, the Ethernet frame is dropped or forwarded in native form to an edge RBridge, depending on the TRILL-EN configuration. 🧚
+------------+--------+---------+---------+--+-------+---+
|OuterEtherHd|TRILL HD| InnerDA | InnerSA |..|Payload|FCS|
+------------+--------+---------+---------+--+-------+---+
|
| |<Inner Ether Header> |
|
|
| +-------+ TRILL +------+
| | RB1 |---------->| RB2 | Decapsulate
| +-------+ domain +------+ TRILL header
v ^ |
+---------->| |
| V
+--------+ +--------+
Non-RBridge node: |TRILL-EN| |TRILL-EN|
Encapsulate TRILL | 1 | | 2 |
Header for data +--------+ +--------+
Frames to traverse TRILL domain.Figure 2: Data Frames from a TRILL-EN 💜
4. Source Nickname in Encapsulation by Non-RBridge Nodes 🌈
The TRILL header includes a Source RBridge's Nickname (ingress) and a Destination RBridge's Nickname (egress). When a TRILL-EN adds a TRILL header to a data packet, the ingress RBridge nickname field in the TRILL header is set to the nickname of the AF for that data packet's VLAN. The TRILL-EN figures out the AF by snooping on IS-IS Hellos from the edge RBridges on its link, the same way the RBridges on the link determine the AF [RFC8139]. A TRILL-EN is free to send the encapsulated data frame to any of the edge RBridges on its link. Main character energy, no cap 👑
5. Benefits of a Non-RBridge Performing TRILL Encapsulation ✨
okay so this section is the "why bother" part 💅 It's all about why you'd want a non-RBridge node to do the TRILL encapsulation itself. Spoiler: it's giving efficiency 🦋
5.1. Avoid Nickname Exhaustion Issue
bestie, picture a big data center with hundreds of thousands of virtualized servers 😭 If you put the TRILL boundary at every server's virtual switch, you end up with a TRILL domain containing hundreds of thousands of RBridge nodes. That could cause TRILL nickname exhaustion and make life really hard for IS-IS 💀
Okay but here's the other option: put the boundary at aggregation switches, each with lots of virtualized servers hanging off it. That limits how many RBridge nodes live in the TRILL domain, BUT now the edge RBridges have to maintain super huge (MAC and VLAN) <-> Edge RBridge mapping tables. Not ideal, ngl 🙈
The fix is letting non-RBridge nodes pre-encapsulate data frames with TRILL headers 🎀 Then your TRILL domain can keep a reasonable number of RBridge nodes even in a massive data center. All the TRILL-ENs attached to one RBridge can share a single TRILL nickname, and boom, the nickname exhaustion problem is avoided ✨👑
5.2. Reduce MAC Tables for Switches on Bridged LANs
so when hosts in a VLAN (or subnet) are spread across multiple edge RBridges, and each edge RBridge has multiple VLANs enabled, the switches on the bridged LANs hanging off those edge RBridges get exposed to every MAC address across all the enabled VLANs. Yikes 😬
Let's do the math, because it's wild 🧮 Say an Access Switch has 40 physical servers attached, and each server runs 100 VMs. That's 4000 hosts under one Access Switch. If hosts/VMs can move anywhere, the worst case is that all 4000 VMs sit in different VLANs, meaning the Access Switch has 4000 VLANs enabled. If each VLAN has 200 hosts, this Access Switch's MAC table could potentially hold 200 * 4000 = 800,000 entries. Main character energy, but not in a good way 💀
Here's the glow-up 🌸 If the virtual switches on the servers pre-encapsulate data frames destined for hosts on remote edge RBridges, then the outer MAC destination address of those TRILL-encapsulated frames is the MAC address of a local RBridge edge, namely the ingress RBridge. So the switches on the local bridged LAN don't need MAC entries for remote hosts attached to other edge RBridges. Iconic 🦋
Now, the TRILL traffic coming from nodes on other RBridges gets decapsulated and does carry the true source and destination MACs. One simple way to stop local bridges from learning those remote MACs (if that's a problem for you) is to turn off this data-plane learning on local bridges 🙅♀️ With help from a directory, the local bridges can be pre-configured with the MAC addresses of local hosts. They can always send frames with unknown destination MAC addresses to the ingress RBridge.
But if a server is spinning up a huge number of VMs, the number of remote MAC addresses could get massive. If you can't disable learning and pre-configure the local bridges' MAC tables, AND all your important traffic is IP, there's one solid trick: use the server's own MAC address to hide the MAC addresses of the attached VMs 🫶 The server acting as an edge node puts its own MAC address in the source MAC address field of packets originated by a host (or VM). When the Ethernet frame reaches the target edge node (the egress), that node can deliver the packet to the right destination host based on the packet's IP address. Very often the target edge node talks to the embedded VMs through a Layer 2 virtual switch. In that case, the target edge node can build the proper Ethernet header with help from the directory, and the directory supplies the correct host IP to MAC mapping 💖
6. Manageability Considerations
real quick 🎀 Directory assistance [RFC8171] is REQUIRED so a non-TRILL node can pre-encapsulate packets headed toward remote RBridges. TRILL-ENs get the same configuration options as any pull directory client. See Section 4 of [RFC8171] for the details 📚
Oops, that was a sneaky one. The word "REQUIRED" up there is a BCP 14 key word, so it stays in capitals. Carry on 💅
7. Security Considerations
okay, bestie, put on your seatbelt 😭🔥 This section is SERIOUS, and I'm not even going to pretend it isn't.
If the TRILL-ENs aren't trusted, they can forge arbitrary ingress and egress nicknames in the TRILL Headers of the TRILL Data packets they build. With data-plane learning, when an egress RBridge decapsulates a TRILL Data packet, it associates the inner source MAC address with the ingress nickname in the TRILL Header (assuming that MAC address is unicast). So if those nicknames get forged, incorrect learning happens, and future traffic for that inner source MAC gets sent to the wrong RBridge for egress 💀 That's why an RBridge port should not be configured to accept encapsulated TRILL data frames on a link where it doesn't have an RBridge adjacency, unless the end stations on that link are trusted. Not a vibe 🚫
Like any end station, TRILL-ENs can forge the outer MAC addresses of packets they send. (See Section 6 of [RFC6325].) And since they do the pre-encapsulation, they can forge inner MAC addresses too 🙈
Pre-encapsulation also means TRILL-ENs can send data in any VLAN. So they must be trusted if you want to enforce a security policy based on VLANs. (See Section 6.1 of [RFC6325].) No trust, no VLAN policy. Periodt. 🌈
Directory-assisted encapsulation by TRILL-ENs basically means those TRILL-ENs are spoofing the edge RBridges they're connected to. That's yet another reason TRILL-ENs should be trusted nodes 🫣 The good news: this spoofing can't cause traffic to loop forever, because TRILL has a hop count in the TRILL header [RFC6325]. If there's a loop, a TRILL packet caught in it (that is, an encapsulated frame) gets discarded ✨ (The potentially scarier case is multidestination packets, compared with known unicast, where copies could multiply at forks in the distribution tree. For those, a Reverse Path Forwarding Check is also used [RFC6325] to discard packets that seem to be on the wrong link or when there's disagreement about the distribution tree 🌳)
The mechanism in this document requires a TRILL-EN to know the MAC address(es) of the TRILL edge RBridge(s) it's attached to, plus the egress RBridge nickname that the destination of its packets is reachable from. With that info, TRILL-ENs can learn a LOT about the TRILL domain's topology 👀 So there could be a real security risk when TRILL-ENs aren't trusted or are compromised.
If the path between the directory and a TRILL-EN gets attacked, false mappings can be sent to the TRILL-EN. Then its packets go to the wrong destinations, which could violate security policy about which end stations should receive what data 😱 So a combination of authentication and encryption is RECOMMENDED between the directory and the TRILL-EN. The entities involved need to authenticate properly with each other, provide session encryption, keep their security patch levels up to date, and configure their systems to allow minimal access and minimal running processes, to protect sensitive information 🔐
For extra protection against data being misdelivered for any reason (including the scenario above), end-to-end encryption and authentication should be considered 🦋 That means encryption and authentication from the source end station all the way to the destination end station.
For Pull Directory and TRILL ES-IS security considerations, see [RFC8171].
8. IANA Considerations
No IANA actions here, so this one's a quick and easy slay 💅 This document has no IANA actions.
9. References
9.1. Normative References
Here are the normative references, bestie 📚 I've kept the details exactly as they are:
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC6325] Perlman, R., Eastlake 3rd, D., Dutt, D., Gai, S., and A.
Ghanwani, "Routing Bridges (RBridges): Base Protocol
Specification", RFC 6325, DOI 10.17487/RFC6325, July 2011,
<https://www.rfc-editor.org/info/rfc6325>.
[RFC7176] Eastlake 3rd, D., Senevirathne, T., Ghanwani, A., Dutt,
D., and A. Banerjee, "Transparent Interconnection of Lots
of Links (TRILL) Use of IS-IS", RFC 7176,
DOI 10.17487/RFC7176, May 2014,
<https://www.rfc-editor.org/info/rfc7176>.
[RFC8139] Eastlake 3rd, D., Li, Y., Umair, M., Banerjee, A., and F.
Hu, "Transparent Interconnection of Lots of Links (TRILL):
Appointed Forwarders", RFC 8139, DOI 10.17487/RFC8139,
June 2017, <https://www.rfc-editor.org/info/rfc8139>.
[RFC8171] Eastlake 3rd, D., Dunbar, L., Perlman, R., and Y. Li,
"Transparent Interconnection of Lots of Links (TRILL):
Edge Directory Assistance Mechanisms", RFC 8171,
DOI 10.17487/RFC8171, June 2017,
<https://www.rfc-editor.org/info/rfc8171>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.9.2. Informative References
And the informative one, which is more of a "good to know" vibe 🌸
[RFC7067] Dunbar, L., Eastlake 3rd, D., Perlman, R., and I.
Gashinsky, "Directory Assistance Problem and High-Level
Design Proposal", RFC 7067, DOI 10.17487/RFC7067, November
2013, <https://www.rfc-editor.org/info/rfc7067>.Acknowledgments
big thank-yous to these lovelies for their contributions 🫶🧚
Igor Gashinsky
Ben Nevin-JenkinsAuthors' Addresses
and here are the brilliant minds behind it all 👑 Contact details are copied exactly as published 💜
Linda Dunbar
Huawei Technologies
5340 Legacy Drive, Suite 175
Plano, TX 75024
United States of America
Phone: +1-469-277-5840
Email: linda.dunbar@huawei.com
Donald Eastlake 3rd
Huawei Technologies
155 Beaver Street
Milford, MA 01757
United States of America
Phone: +1-508-333-2270
Email: d3e3e3@gmail.com
Radia Perlman
Dell/EMC
2010 256th Avenue NE, #200
Bellevue, WA 98007
United States of America
Email: Radia@alum.mit.eduand that's a wrap on RFC 8380, bestie!! 🌈✨💖
📦 where this page comes from
- ietf: rfc8380 2018-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms