RFC 9655

Egress Validation in Label Switched Path Ping and Traceroute Mechanisms

📅 published November 2024, from ietf

Egress Validation in Label Switched Path Ping and Traceroute Mechanisms 💖

okay bestie, let's start with the header facts 🎀 This is RFC 9655, a Standards Track document, so it's an actual Internet standard and not just a vibe 👑. It was published in November 2024 with ISSN 2070-1721. The IETF is the publisher. D. Rathi (Nokia) and S. Hegde (Juniper Networks Inc.) are the editors, since "(Ed.)" means editor, and K. Arora is writing as an individual contributor. Z. Ali and N. Nainar are from Cisco Systems, Inc. The header doesn't list anything this RFC obsoletes or updates, so it isn't replacing or patching any older RFCs 🧚

Abstract 🌸

okay so the MPLS ping and traceroute tools from RFC 8029, plus the Segment Routing extensions in RFC 8287, are highly valuable for checking that the control plane and the data plane are in sync 🔥 But sometimes only some of the intermediate or transit nodes have been upgraded to run those checks. A basic MPLS ping and traceroute can go along any path without checking the control plane state at all, and RFC 8029 backs that up with the Nil Forwarding Equivalence Class (FEC) 💅 The procedures in RFC 8029 mostly work when Nil FEC is an intermediate FEC in the FEC stack. It gets messy when every label in the label stack uses Nil FEC 😭

This doc adds a new Type-Length-Value (TLV) as an extension to the existing Nil FEC. It then explains how MPLS ping and traceroute work using Nil FEC with that extension to fix those problems ✨

Status of This Memo 📜

This is an Internet Standards Track document, which means it's official 👑

This document is a product of the Internet Engineering Task Force (IETF), and it represents the consensus of the IETF community. It went through public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check out Section 2 of RFC 7841 🌈

Info about the current status of this document, any errata, and how to send feedback is at https://www.rfc-editor.org/info/rfc9655 🦋

Copyright Notice ⭐

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 🫶 Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Revised BSD License 💜

Table of Contents 🍓

   1.  Introduction
     1.1.  Requirements Language
   2.  Problem with Nil FEC
   3.  Egress TLV
   4.  Procedure
     4.1.  Sending Egress TLV in MPLS Echo Request
       4.1.1.  Ping Mode
       4.1.2.  Traceroute Mode
       4.1.3.  Detailed Example
     4.2.  Receiving Egress TLV in MPLS Echo Request
   5.  Backward Compatibility
   6.  IANA Considerations
     6.1.  New TLV
     6.2.  New Return Code
   7.  Security Considerations
   8.  References
     8.1.  Normative References
     8.2.  Informative References
   Acknowledgements
   Authors' Addresses

1. Introduction ✨

okay so segment routing lets you build explicit paths using one or more Link-State IGP Segments or BGP Segments defined in [RFC8402]. For some use cases, TE paths get built with the mechanisms in [RFC9256], which stack the labels that represent the nodes and links on the explicit path. Controllers are often deployed to build paths across multi-domain networks. In those setups, the headend routers may have the link-state database for their own domain, but they may not know the FEC tied to the labels the controller uses to build paths across multiple domains. A very useful Operations, Administration, and Maintenance (OAM) requirement is being able to ping and trace these paths 🧭

[RFC8029] describes a simple and efficient mechanism for detecting data plane failures in MPLS Label Switched Paths (LSPs) 🔍 It defines a probe message called an "MPLS echo request" and a response message called an "MPLS echo reply" for returning the result of the probe. SR-related extensions for these are specified in [RFC8287]. [RFC8029] provides mechanisms primarily to validate the data plane and secondarily to verify the consistency of the data plane with the control plane. It also lets you traverse Equal-Cost Multipaths (ECMPs) and validate each of the ECMP paths 💅 The Target FEC Stack TLV [RFC8029] contains sub-TLVs that carry information about the label. That information gets validated on each node for traceroute and on the egress for ping. Using the Target FEC Stack TLV requires all nodes in the network to have implemented the validation procedures, but all intermediate nodes may not have been upgraded to support validation procedures. In those cases, it's really useful to be able to traverse the paths in ping/traceroute mode without having to obtain the FEC for each label 🙈

A simple MPLS echo request/reply mechanism lets you traverse the SR Policy path without validating the control plane state. [RFC8029] supports this mechanism with FECs like the Nil FEC and the Generic FECs (i.e., Generic IPv4 prefix and Generic IPv6 prefix). However, there are challenges in reusing the Nil FEC and Generic FECs for validation of SR Policies [RFC9256]. The Generic IPv4 prefix and Generic IPv6 prefix FECs are used when the protocol advertising the label is unknown. The information carried in the Generic FECs is the IPv4 or IPv6 prefix and prefix length, so the Generic FEC types perform an additional control plane validation. However, the Generic FECs and their relevant validation procedures are not thoroughly detailed in [RFC8029]. The use case mostly specifies inter-AS (Autonomous System) VPNs as the motivation. Certain aspects of SR, such as anycast Segment Identifiers (SIDs), need clear guidelines on how the validation procedure should work. Also, the Generic FECs may not be widely supported, and if transit routers haven't been upgraded to validate Generic FECs, traceroute may fail 😭 On the other hand, the Nil FEC consists of the label, and there's no other associated FEC information. The Nil FEC is used to traverse the path without validation in cases where the FEC isn't defined or routers aren't upgraded to support the FECs. So it can check any combination of segments on any data path 🌸 The procedures described in [RFC8029] are mostly applicable when the Nil FEC is an intermediate FEC in the FEC stack. Challenges arise when all labels in the label stack are represented using the Nil FEC.

Section 2 discusses the problems with using the Nil FEC in an MPLS ping/traceroute procedure, and Sections 3 and 4 cover the simple extensions needed to solve the problem 🎀

The problems and solutions in this document apply to the MPLS data plane. Segment Routing over IPv6 (SRv6) is out of scope here 🦋

1.1. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🔥

2. Problem with Nil FEC 🔍

The purpose of the Nil FEC, as described in [RFC8029], is to make sure transit tunnel information stays hidden and, in some cases, to avoid false negatives when the FEC information is unknown 🧚

This document uses a Nil FEC to represent the complete label stack in an MPLS echo request message in ping and traceroute mode. A single Nil FEC is used in the MPLS echo request message no matter how many segments are in the label stack. Section 4.4.1 of [RFC8029] notes:

|  If the outermost FEC of the Target FEC stack is the Nil FEC, then
|  the node MUST skip the Target FEC validation completely.

When a router in the label stack path receives an MPLS echo request message, there's no definite way to tell whether it's the intended egress router. The Nil FEC doesn't carry any information, and the router performs no validation, so there's a high possibility the packet gets misforwarded to an incorrect destination, but the MPLS echo reply might still return success 😭

To fix this, it's necessary to include additional information along with the Nil FEC in the MPLS echo request message in both ping and traceroute modes, and to perform minimal validation on the egress/destination router 💅 This lets the router send appropriate success and failure information to the headend router of the SR Policy. This supplementary information should help report transit router details to the headend router, which an offline application can use to validate the traceroute path 🌈

So including egress information in the MPLS echo request messages for ping and traceroute modes will make it possible to validate the Nil FEC on the egress router and confirm the correct destination ✨ Egress information can verify any combination of segments on any path without requiring upgrades to transit nodes 🫶 The Egress TLV can be silently dropped if it isn't recognized. Alternatively, it may be stepped over, or an error message may be sent (per [RFC8029] and the clarifications in [RFC9041] regarding code points in the range 32768-65535) 🙈

If a transit node doesn't recognize the Egress TLV and chooses to silently drop or step over it, the headend will keep sending the Egress TLV in the next echo request message. If the egress recognizes the Egress TLV, egress validation will be executed at the egress 🔥 If a transit node doesn't recognize the Egress TLV and chooses to send an error message, the headend will log that message for informational purposes and keep sending echo requests with the Egress TLV, with the TTL incremented 💖 If the egress node doesn't recognize the Egress TLV and chooses to silently drop or step over it, egress validation won't be done, and the ping/traceroute procedure will proceed as if the Egress TLV were never received 💀

3. Egress TLV ✨

okay so the Egress TLV is an optional TLV 💅 it MAY be included in an MPLS echo request message, and if it's there it MUST show up before the Target FEC Stack TLV in the packet 🎀 this one is only for LSP ping/traceroute requests generated by the headend node of an LSP or SR Policy that's being verified 🦋 when there are multiple Nil FECs in the Target FEC Stack TLV, the Egress TLV must be added to match the ultimate egress of the label stack 🌸 explicit paths can be built using Node-SID, Adj-SID, Binding SID, etc. ✨ the Address field of the Egress TLV must be derived from the path egress/destination 💖 here's the format, it's giving very clean layout 👑

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Type = 32771 (Egress TLV)  |          Length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                      Address (4 or 16 octets)                 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 1: Egress TLV 🧚

Type: 32771 (Section 6.1) 🍓

Length: variable, bestie 🫶 it's 4 octets for IPv4 addresses and 16 octets for IPv6 addresses. Length does not count the Type and Length fields themselves.

Address: this field carries a valid 4-octet IPv4 address or a valid 16-octet IPv6 address 💜 the address can come from the egress of the path and corresponds to the last label in the label stack or the SR Policy Endpoint field [SR-POLICY-BGP] 🔥

4. Procedure 💅

this section covers the parts of LSP ping and traceroute operations that need extra thought beyond what's in [RFC8029] 🌈

4.1. Sending Egress TLV in MPLS Echo Request ✨

as I mentioned earlier, when the sender node builds an echo request with a Target FEC Stack TLV, the Egress TLV, if present, MUST appear before the Target FEC Stack TLV in the MPLS echo request packet 🎀

4.1.1. Ping Mode 🦋

when the sender node builds an echo request with a Target FEC Stack TLV that has a single Nil FEC for the last segment of the SR Policy path, the sender node MUST add an Egress TLV with the address taken from the SR Policy Endpoint field [SR-POLICY-BGP] 💖 the Label value in the Nil FEC MAY be set to zero when a single Nil FEC covers multiple labels in the label stack 🌸 if the endpoint isn't specified or is equal to zero (Section 8.8.1 of [RFC9256]), the sender MUST use the address for the last segment of the SR Policy in the Address field of the Egress TLV 😭 a few specific cases for deriving that Address field:

if the last SID in the SR Policy is an Adj-SID, the Address field is derived from the node at the remote end of that adjacency 🍓
if the last SID in the SR Policy is a Binding SID, the Address field is derived from the last node of the path that the Binding SID represents 🧚

4.1.2. Traceroute Mode 🌸

when the sender node builds an echo request with a Target FEC Stack TLV that contains a Nil FEC for the last segment of the SR Policy's segment list, the sender node MUST add an Egress TLV with the address taken from the SR Policy Endpoint field [SR-POLICY-BGP] 💅

there's no requirement to do this, but an implementation MAY send multiple Nil FECs if that's easier for it 🫶 if the SR Policy headend sends multiple Nil FECs, the last one MUST correspond to the Egress TLV 🔥 the Label value in the Nil FEC MAY be set to zero for the last Nil FEC 💜 if the endpoint isn't specified or is equal to zero (Section 8.8.1 of [RFC9256]), the sender MUST use the address for the last segment endpoint of the SR Policy path, meaning the ultimate egress is used as the address in the Egress TLV 👑

4.1.3. Detailed Example 🎀

                     ----R3----
                    /  (1003)  \
         (1001)    /            \(1005)     (1007)
           R1----R2(1002)        R5----R6----R7(address X)
                   \            /     (1006)
                    \   (1004) /
                     ----R4----

Figure 2: Egress TLV Processing in Sample Topology 🦋

okay picture this: an SR Policy on router R1 going to destination X, with label stack 1002, 1004, 1007 🌈 segment 1007 belongs to R7, which has address X configured locally on it ✨

first, a ping echo request. it has a Target FEC Stack TLV with the Nil FEC sub-TLV, and an Egress TLV goes in front of the Target FEC Stack TLV 💖 the Address field holds X (the locally configured address on R7) 🧚 X could be IPv4 or IPv6, so the Length field in the Egress TLV is either 4 or 16 octets depending on which one it is 🫶

next, an echo request in a traceroute packet. this one has a Target FEC Stack TLV with the Nil FEC sub-TLV covering the whole label stack (1002, 1004, 1007) 💅 again the Egress TLV sits before the Target FEC Stack TLV, and the Address field holds X (the locally configured address on destination R7) 🌸 same deal here: X could be IPv4 or IPv6, so the Length is 4 or 16 octets 😭 and if the destination/endpoint is set to zero (like with a color-only SR Policy), the sender should use the endpoint of segment 1007, the last segment in the segment list, as the address for the Egress TLV 👑

4.2. Receiving Egress TLV in MPLS Echo Request 🔥

any node that gets an MPLS echo request and processes it is called the "receiver" 💖 for ping, the actual destination/egress is the receiver, and for traceroute, every node is a receiver 🦋 this document doesn't change how a node handles the Nil FEC (as defined in [RFC8029]) when it receives an MPLS echo request with a Target FEC Stack TLV 🌈 and the Egress TLV doesn't affect validation of the Target FEC Stack sub-TLV at FEC-stack-depth if that sub-TLV is something other than a Nil FEC ✨

the Egress TLV processing on the receiver MUST still be done as follows. quick note: <RSC> means the Return Subcode 🎀

if the Label-stack-depth is greater than 0 and the Target FEC Stack sub-TLV at FEC-stack-depth is a Nil FEC, set Best-return-code to 8 ("Label switched at stack-depth <RSC>") and Best-rtn-subcode to Label-stack-depth, to report transit switching in the MPLS echo reply message 🧚
if the Label-stack-depth is 0 and the Target FEC Stack sub-TLV at FEC-stack-depth is a Nil FEC, do an exact-match lookup of the Egress TLV's Address field against any locally configured interface or loopback address 🫶 a. if the Egress TLV address lookup succeeds, set Best-return-code to 36 ("Replying router is an egress for the address in the Egress TLV for the FEC at stack depth <RSC>") (Section 6.2) in the MPLS echo reply message 💅 b. if the Egress TLV address lookup fails, set Best-return-code to 10 ("Mapping for this FEC is not the given label at stack-depth <RSC>") 😭
sometimes multiple Nil FECs (one for each label in the stack) go out along with the Egress TLV from the SR Policy headend 🌸 when the packet reaches the egress, the number of labels in the received packet (size of stack-R) becomes zero, or a label with the Bottom-of-Stack bit set to 1 gets processed 🔥 at that point all Nil FEC sub-TLVs MUST be removed, and the Egress TLV MUST be validated 👑

5. Backward Compatibility 🌈

the extensions in this document are backward compatible with the procedures in [RFC8029] 💖 a router that doesn't support the Egress TLV just ignores it and uses the Nil FEC procedures from [RFC8029] 🦋

when the egress node on the path doesn't support these extensions, egress validation won't be done, and Best-return-code is set to 3 ("Replying router is an egress for the FEC at stack-depth <RSC>") with Best-rtn-subcode set to stack-depth in the MPLS echo reply message 🧚

when the transit node on the path doesn't support these extensions, Best-return-code is set to 8 ("Label switched at stack-depth <RSC>") with Best-rtn-subcode set to Label-stack-depth, to report transit switching in the MPLS echo reply message 🫶

6. IANA Considerations 🎀

6.1. New TLV 💜

IANA has added the following entry to the "TLVs" registry within the "Multiprotocol Label Switching (MPLS) Label Switched Paths (LSPs) Ping Parameters" registry group [IANA-MPLS-LSP] ✨

                    +=======+============+===========+
                    | Type  | TLV Name   | Reference |
                    +=======+============+===========+
                    | 32771 | Egress TLV | RFC 9655  |
                    +-------+------------+-----------+

Table 1: TLVs Registry 🌸

6.2. New Return Code 🔥

IANA has added the following entry to the "Return Codes" registry within the "Multiprotocol Label Switching (MPLS) Label Switched Paths (LSPs) Ping Parameters" registry group [IANA-MPLS-LSP] 💅

         +=======+==================================+===========+
         | Value | Meaning                          | Reference |
         +=======+==================================+===========+
         | 36    | Replying router is an egress for | RFC 9655  |
         |       | the address in the Egress TLV    |           |
         |       | for the FEC at stack depth <RSC> |           |
         +-------+----------------------------------+-----------+

Table 2: Return Codes Registry 👑

7. Security Considerations 💀

this one is serious, bestie: the document defines an extra TLV for MPLS LSP ping and conforms to the mechanisms in [RFC8029] 🙈 all the security considerations defined in [RFC8287] apply to this document 😭 this document does not introduce any additional security challenges to be considered 🫶

8. References 🌈

8.1. Normative References 📚

okay bestie, these are the receipts 🧾 the stuff this doc relies on to work at all, so you need the exact details:

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.

[RFC8029] Kompella, K., Swallow, G., Pignataro, C., Ed., Kumar, N., Aldrin, S., and M. Chen, "Detecting Multiprotocol Label Switched (MPLS) Data-Plane Failures", RFC 8029, DOI 10.17487/RFC8029, March 2017, https://www.rfc-editor.org/info/rfc8029. 🔥

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174. 💅

[RFC8287] Kumar, N., Ed., Pignataro, C., Ed., Swallow, G., Akiya, N., Kini, S., and M. Chen, "Label Switched Path (LSP) Ping/Traceroute for Segment Routing (SR) IGP-Prefix and IGP-Adjacency Segment Identifiers (SIDs) with MPLS Data Planes", RFC 8287, DOI 10.17487/RFC8287, December 2017, https://www.rfc-editor.org/info/rfc8287. ✨

[RFC8402] Filsfils, C., Ed., Previdi, S., Ed., Ginsberg, L., Decraene, B., Litkowski, S., and R. Shakir, "Segment Routing Architecture", RFC 8402, DOI 10.17487/RFC8402, July 2018, https://www.rfc-editor.org/info/rfc8402. 🦋

[RFC9041] Andersson, L., Chen, M., Pignataro, C., and T. Saad, "Updating the MPLS Label Switched Paths (LSPs) Ping Parameters IANA Registry", RFC 9041, DOI 10.17487/RFC9041, July 2021, https://www.rfc-editor.org/info/rfc9041. 🌸

[RFC9256] Filsfils, C., Talaulikar, K., Ed., Voyer, D., Bogdanov, A., and P. Mattes, "Segment Routing Policy Architecture", RFC 9256, DOI 10.17487/RFC9256, July 2022, https://www.rfc-editor.org/info/rfc9256. 👑

8.2. Informative References 🧚

these ones are more like bonus reading. super helpful, not strictly required to get the vibe 🫶

[IANA-MPLS-LSP] IANA, "Multiprotocol Label Switching (MPLS) Label Switched Paths (LSPs) Ping Parameters", http://www.iana.org/assignments/mpls-lsp-ping-parameters.

[SR-POLICY-BGP] Previdi, S., Filsfils, C., Talaulikar, K., Ed., Mattes, P., and D. Jain, "Advertising Segment Routing Policies in BGP", Work in Progress, Internet-Draft, draft-ietf-idr-sr-policy-safi-10, 7 November 2024, https://datatracker.ietf.org/doc/html/draft-ietf-idr-sr-policy-safi-10. 🍓

Acknowledgements 🎀

the authors wanted to thank Stewart Bryant, Greg Mirsky, Alexander Vainshtein, Sanga Mitra Rajgopal, and Adrian Farrel for their careful review and comments. 🙈 literally the best shoutout energy, and they deserve it 💖

Authors' Addresses 🌈

Deepti N. Rathi (editor) Nokia Manyata Embassy Business Park Bangalore 560045 Karnataka India Email: deepti.nirmalkumarji_rathi@nokia.com

Shraddha Hegde (editor) Juniper Networks Inc. Exora Business Park Bangalore 560103 Karnataka India Email: shraddha@juniper.net

Kapil Arora Individual Contributor Email: kapil.it@gmail.com

Zafar Ali Cisco Systems, Inc. Email: zali@cisco.com

Nagendra Kumar Nainar Cisco Systems, Inc. Email: naikumar@cisco.com

📦 where this page comes from

ietf: rfc9655 2024-11
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms