Label Switched Path (LSP) Ping/Traceroute for Segment Routing (SR) Egress Peer Engineering Segment Identifiers (SIDs) with MPLS Data Plane

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 29 January 2025.¶

Copyright Notice

Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Egress Peer Engineering (EPE) as defined in [RFC9087] is an effective mechanism to select the egress peer link based on different criteria. In this scenario, egress peers may belong to a completely different ownership. The EPE-SIDs provide means to represent egress peer nodes, links, sets of links and sets of nodes. Many network deployments have built their networks consisting of multiple Autonomous Systems, either for the ease of operations or as a result of network mergers and acquisitions. The inter-AS links connecting any two Autonomous Systems could be traffic-engineered using EPE-SIDs in this case, where there is single ownership but different AS numbers. It is important to validate the control plane to forwarding plane synchronization for these SIDs so that any anomaly can be detected easily by the network operator. EPE-SIDs may also be used in ingress SR policy [RFC9256]to choose exit points where the remote AS belongs to completely different ownership. This scenario is out of scope of this document.¶

   +---------+      +------+
   |         |      |      |
   |    H    B------D      G
   |         | +---/| AS 2 |\  +------+
   |         |/     +------+ \ |      |---L/8
   A   AS1   C---+            \|      |
   |         |\\  \  +------+ /| AS 4 |---M/8
   |         | \\  +-E      |/ +------+
   |    X    |  \\   |      K
   |         |   +===F AS 3 |
   +---------+       +------+

In this reference diagram, EPE-SIDs are configured on AS1 towards AS2 and AS3 and advertised in BGP-LS [RFC9086]. In certain cases the EPE-SIDs advertised by the control plane may not be in synchronization with the label programmed in the data plane. For example, on C a PeerAdj SID could be advertised to indicate it is for the link C->D. Due to some software anomaly, the actual data forwarding on this PeerAdj SID could be happening over the C->E link. If E had relevant data paths for further forwarding the packet, this kind of anomaly will go unnoticed by the network operator. A detailed example of a correctly programmed state and an incorrectly programmed state along with a description of how the incorrect state can be detected is described in Appendix A. A FEC definition for the EPE-SIDs will define the details of the control plane association of the SID. The data plane validation of the SID will be done during the MPLS traceroute procedure. When there is a multi-hop EBGP session between the ASBRs, PeerNode SID is advertised, and the traffic MAY be load-balanced between the interfaces connecting the two nodes. In the reference diagram, C and F could have a PeerNode-SID advertised. When the OAM packet is received on F, it needs to be validated that the packet came from one of the two interfaces connected to C.¶

This document provides Target Forwarding Equivalence Class (FEC) stack TLV definitions for EPE-SIDs. This solution requires that the node constructing the target FEC stack can determine the type of the SIDs along the path of the LSP. Other procedures for MPLS Ping and Traceroute as defined in [RFC8287] section 7 and clarified by [RFC8690] are applicable for EPE-SIDs as well.¶

2. Theory of Operation

[RFC9086] provides mechanisms to advertise the EPE-SIDs in BGP-LS. These EPE-SIDs may be used to build Segment Routing paths as described in [I-D.ietf-idr-segment-routing-te-policy] or using Path Computation Element Protocol (PCEP) extensions as defined in [RFC8664]. Data plane monitoring for such paths which consist of EPE-SIDs will use extensions defined in this document to build the Target FEC stack TLV. The MPLS Ping and Traceroute procedures MAY be initiated by the head-end of the Segment Routing path or a centralized topology-aware data plane monitoring system as described in [RFC8403]. The extensions in [I-D.ietf-idr-segment-routing-te-policy] and [RFC8664] do not define how to carry the details of the SID that can be used to construct the FEC. Such extensions are out of the scope for this document. The node initiating the data plane monitoring may acquire the details of EPE-SIDs through BGP-LS advertisements as described in [RFC9086]. There may be other possible mechanisms to learn the definition of the SID from controller. Details of such mechanisms are out of scope for this document.¶

The EPE-SIDs are advertised for inter-AS links which run EBGP sessions. [RFC9086] does not define the detailed procedures to operate EBGP sessions in a scenario with unnumbered interfaces. Therefore, these scenarios are out of scope for this document. Anycast and multicast addresses are not in the scope of this document. During AS migration scenario procedures described in [RFC7705] may be in force. In these scenarios, if the local and remote AS fields in the FEC as described in Section 4 carries the globally configured ASN and not the "local AS" as defined in [RFC7705], the FEC validation procedures may fail.¶

As described in Section 1, this document defines FEC stack TLVs for EPE-SIDs, that can be used in detecting MPLS data plane failures [RFC8029]. This mechanism applies to paths created across across ASes of co-operating administrations. If the ping or traceroute packet enters a non co-operating AS domain, it might be dropped by the routers in the non co-operating domain. Although complete path validation cannot be done across, non co-operating domains, it still provides useful information that the ping/traceroute packet entered a non co-operating domain.¶

4. FEC Definitions

Three new sub-TLVs are defined for the Target FEC Stack TLV (Type 1), the Reverse-Path Target FEC Stack TLV (Type 16), and the Reply Path TLV (Type 21).¶

            Sub-Type    Sub-TLV Name
            --------  ---------------
             TBD1      PeerAdj SID Sub-TLV
             TBD2      PeerNode SID Sub-TLV
             TBD3      PeerSet SID Sub-TLV

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |Type = TBD2                    |          Length               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |               Local AS Number (4  octets)                     |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote AS Number (4 octets)                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Local BGP router ID (4 octets)                   |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote BGP Router ID (4 octets)                  |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |Type = TBD1                    |          Length               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       | Adj-Type      |            RESERVED                           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |               Local AS Number (4  octets)                     |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote AS Number (4 octets)                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Local BGP router ID (4 octets)                   |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote BGP Router ID (4 octets)                  |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Local Interface address (4/16 octets)            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote Interface address (4/16 octets)           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |Type = TBD3                    |          Length               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Local AS Number (4  octets)                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Local BGP router ID (4 octets)                   |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   No.of elements in set       |          Reserved             |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote AS Number (4 octets)                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote BGP Router ID (4 octets)                  |
       ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++


        One element in set consists of below details
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote AS Number (4 octets)                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |              Remote BGP Router ID (4 octets)                  |
       ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++

5. EPE-SID FEC validation

When a remote ASBR of the EPE-SID advertisement receives the MPLS OAM packet with top FEC being the EPE-SID, it MUST perform validity checks on the content of the EPE-SID FEC sub-TLV. The basic length check should be performed on the received FEC.¶

 PeerAdj SID
 -----------
 if Adj type = 1 Length should be 28 octets
 If Adj type =2 Length should be 52 octets

 PeerNode SID
 -------------
 Length = ( 20 + No.of IPv4 interface pairs * 8  +
          No.of IPv6 interface pairs * 32 ) octets

 PeerSet SID
 -----------
 Length = (9 + No.of elements in the set *
          (8 + No.of IPv4 interface pairs * 8 +
           No.of IPv6 interface pairs * 32)) octets

If a malformed FEC sub-TLV is received, then a return code of 1, "Malformed echo request received" as defined in [RFC8029] MUST be sent. The below section is appended to the procedure given in Section 7.4 point 4a of [RFC8287].¶

    Else, if the Label-stack-depth is 0 and the Target FEC Stack sub-TLV
    at FEC-stack-depth is TBD1 (PeerAdj SID sub-TLV), {

        Set the Best-return-code to 10, "Mapping for this FEC is not
        the given label at stack-depth  if any below
        conditions fail:

               -  Validate that the receiving node's BGP Local AS matches
                  with the remote AS field in the received PeerAdj SID
                  FEC sub-TLV.

               -  Validate that the receiving node's BGP Router-ID
                  matches with the Remote Router ID field in the
                  received PeerAdj SID FEC.

               -  Validate that there is a EBGP session with a peer
                  having local AS number and BGP Router-ID as
                  specified in the Local AS number and Local Router-ID
                  field in the received PeerAdj SID FEC sub-TLV.

        If the Remote interface address is not zero, validate the
        incoming interface.
        Set the Best-return-code to 35 "Mapping for this FEC is not
        associated with the incoming interface"  [RFC8287] if any below
        conditions fail:

               -  Validate the incoming interface on which the OAM
                  packet was receieved, matches with the remote
                  interface specified in the PeerAdj SID FEC sub-TLV

        If all above validations have passed, set the return code to 3
        "Replying router is an egress for the FEC at stack-depth"
        }

    Else, if the Target FEC sub-TLV at FEC-stack-depth is TBD2
         (PeerNode SID sub-TLV), {

        Set the Best-return-code to 10, "Mapping for this FEC is not
        the given label at stack-depth  if any below
        conditions fail:

           -  Validate that the receiving node's BGP Local AS matches
              with the remote AS field in the
              received PeerNode SID FEC sub-TLV.

           -  Validate that the receiving node's BGP Router-ID matches
              with the Remote Router ID field in the received
              PeerNode SID FEC.

           -  Validate that there is a EBGP session with a peer
              having local AS number and BGP Router-ID as
              specified in the Local AS number and Local Router-ID
              field in the received PeerNode SID FEC sub-TLV.

        If all above validations have passed, set the return code to 3
        "Replying router is an egress for the FEC at stack-depth".
    }
    Else, if the Target FEC sub-TLV at FEC-stack-depth is TBD3
         (PeerSet SID sub-TLV), {

        Set the Best-return-code to 10, "Mapping for this FEC is not
        the given label at stack-depth"  if any below
        conditions fail:

           -  Validate that the Receiving Node BGP Local AS matches
              with one of the remote AS field in the received PeerSet
              SID FEC sub-TLV.

           -  Validate that the Receiving Node BGP Router-ID matches
              with one of the  Remote Router ID field in the received
              PeerSet SID FEC sub-TLV.

           -  Validate that there is a EBGP session with a peer having
              local AS number and BGP Router-ID as
              specified in the Local AS number and Local Router-ID
              field in the received PeerSet SID FEC sub-TLV.

        If all above validations have passed, set the return code to 3
        "Replying router is an egress for the FEC at stack-depth"
        }

6. IANA Considerations

IANA is requested to allocate three new Target FEC stack sub-TLVs from the "Sub-TLVs for TLV types 1,16 and 21" subregistry in the "TLVs" registry of the "Multi-Protocol Label switching (MPLS) Label Switched Paths (LSPs) Ping parameters" namespace.¶

• PeerAdj SID Sub-TLV : TBD1¶

• PeerNode SID Sub-TLV: TBD2¶

• PeerSet SID Sub-TLV : TBD3¶

The three lowest free values from the Standard Tracks range should be allocated if possible.¶

7. Security Considerations

The EPE-SIDs are advertised for egress links for Egress Peer Engineering purposes or for inter-AS links between co-operating ASes. When co-operating domains are involved, they can allow the packets arriving on trusted interfaces to reach the control plane and get processed.¶

When EPE-SIDs are created for egress TE links where the neighbor AS is an independent entity, it may not allow packets arriving from external world to reach the control plane. In such deployments MPLS OAM packets will be dropped by the neighboring AS that receives the MPLS OAM packet.¶

In MPLS traceroute applications, when the AS boundary is crossed with the EPE-SIDs, the FEC stack is changed. [RFC8287] does not mandate that the initiator upon receiving an MPLS Echo Reply message that includes the FEC Stack Change TLV with one or more of the original segments being popped remove a corresponding FEC(s) from the Target FEC Stack TLV in the next (TTL+1) traceroute request.¶

If an initiator does not remove the FECs belonging to the previous AS that has traversed, it may expose the internal AS information to the following AS being traversed in traceroute.¶

Appendix A. APPENDIX

This section describes an example of correctly programmed state and incorrectly programmed state and provides details on how the new sub-TLVs described in this document can be used to validate the correctness. Consider the diagram from Figure 1,¶

Correctly programed state:¶

• • C assigns label 16001 and binds it to adjacency C->E¶

• • C signals label 16001 is bound to adjacency C->E (e.g. via BGP-LS)¶

• • Controller/Ingress programs an SR path that has SID/label 16001 to steer packet on the exit point from C onto adjacency C->E¶

• • Using MPLS trace procedures defined in this document, the PeerAdj SID Sub-TLV is populates with entities to be validated by C when OAM packet reaches it.¶

• • C receives the OAM packet, it validates the top label (16001) is indeed corresponding to the entities populated in the PeerAdj SID Sub-TLV¶

Incorrectly programed state:¶

• • C assigns label 16001 and binds it to adjacency C->D¶

• • The controller learns of PeerAdj SID label 16001 is bound to adjacency C->E (e.g. via BGP-LS) – this could be a software bug on C or on controller¶

• • Controller/Ingress programs an SR path that has SID/label 16001 to steer packet on the exit point from C onto adjacency C->E¶

• • Using MPLS trace procedures defined in this document, the PeerAdj SID Sub-TLV is populates with entities to be validated by C (including local/remote interface address of C->E) when OAM packet reaches it.¶

• • C receives the OAM packet, it validates the top label (16001) is NOT bound to C->E as populated in the PeerAdj SID Sub-TLV and can respond with the respective error code¶

Authors' Addresses