Hi,
To prepare for WGLC, I did a shepherd review.
IDnits showed a few issues. Please also see my embedded comments/questions at
the end of this email.
Most of the comments/questions are editorial. The quoted text are indented,
while my comments/questions are not.
A big comment is about the structure of the document - it seems that section
12, 16 and 19 should/could all be folded into section 11.
Thanks.
Jeffrey
---------------------
This document describes procedures for Ethernet VPN (EVPN), a BGP
MPLS-based solution which addresses the requirements specified in the
corresponding RFC - "Requirements for Ethernet VPN (EVPN)". This
document obsoletes RFC7432 (BGP MPLS-Based Ethernet VPN) and updates
RFC8214 (Virtual Private Wire Service Support in Ethernet VPN).
Spell out the RFC number 7209 for the requirements?
This document describes procedures for a BGP MPLS-based solution
called Ethernet VPN (EVPN) to address the requirements specified in
[RFC7209]. Please refer to [RFC7209] for the detailed requirements
and motivation. EVPN requires extensions to existing IP/MPLS
protocols as described in this document. In addition to these
extensions, EVPN uses several building blocks from existing MPLS
technologies.
Perhaps add an informational reference to RFC8365 for the non-MPLS data plane?
Ethernet Tag: Used to represent a BD that is configured on a given
ES for the purposes of DF election and <EVI, BD> identification
for frames received from the CE. Note that any of the following
may be used to represent a BD: VIDs (including Q-in-Q tags),
^^^^^^^^^^^^^^^^^
configured IDs, VNIs (Virtual Extensible Local Area Network
(VXLAN) Network Identifiers), normalized VIDs, I-SIDs (Service
Instance Identifiers), etc., as long as the representation of the
BDs is configured consistently across the multihomed PEs attached
to that ES.
Perhaps change the ^^^^^^^^^ text to "as an Ethernet Tag"?
P-tunnel: A tunnel through the network of one or more service
providers. In this document, P-tunnels are instantiated as
bidirectional multicast distribution trees.
"P-tunnels are instantiated as bidirectional multicast distribution trees":
That does not sound right. Might as well remove it.
DCB: Domain-wide Common Block (of labels), as in
[I-D.ietf-bess-mvpn-evpn-aggregation-label].
RFC9573
AC: Attachment Circuit.
Can we explain the difference between the AC and the link?
In one of unrelated discussions Jorge corrected my mixed use of the term.
It's good to explain the difference here.
As indicated in [RFC7209], each Ethernet segment needs a unique
identifier in an EVPN.
Only an MHES needs a unique identifier, right?
When a customer site is connected to one or more PEs via a set of
Ethernet links, then this set of Ethernet links constitutes an
"Ethernet segment". For a multihomed site, each Ethernet segment
(ES) is identified by a unique non-zero identifier called an Ethernet
Segment Identifier (ESI). An ESI is encoded as a 10-octet integer in
line format with the most significant octet sent first. The
following two ESI values are reserved:
- ESI {0x00} (repeated 10 times), or ESI 0, denotes a single-homed
site.
- ESI {0xFF} (repeated 10 times) is known as MAX-ESI and is reserved.
In general, an Ethernet segment SHOULD have a non-reserved ESI that
Only Multi-homing ES should have a non-reseved ESI, right?
is unique network wide (i.e., across all EVPN instances on all the
PEs). If the CE(s) constituting an Ethernet segment is (are) managed
by the network operator, then ESI uniqueness should be guaranteed;
however, if the CE(s) is (are) not managed, then the operator MUST
configure a network-wide unique ESI for that Ethernet segment. This
is required to enable auto-discovery of Ethernet segments and
Designated Forwarder (DF) election.
...
* Type 3 (T=0x03) - This type indicates a MAC-based ESI Value that
can be auto-generated or configured by the operator. The ESI
Value is constructed as follows:
- System MAC address (6 octets). The PE MAC address MUST be
encoded in the high-order 6 octets of the ESI Value field.
- Local Discriminator value (3 octets). The Local Discriminator
value MUST be encoded in the low-order 3 octets of the ESI
Value.
This mechanism could be used only if it produces ESIs that satisfy
the uniqueness requirement specified above.
* Type 4 (T=0x04) - This type indicates a router-ID ESI Value that
can be auto-generated or configured by the operator. The ESI
Value is constructed as follows:
- Router ID (4 octets). The system router ID MUST be encoded in
the high-order 4 octets of the ESI Value field.
- Local Discriminator value (4 octets). The Local Discriminator
value MUST be encoded in the 4 octets next to the IP address.
- The low-order octet of the ESI Value SHOULD be set to 0x00.
This mechanism could be used only if it produces ESIs that satisfy
the uniqueness requirement specified above.
For type 3 and type 4, if the ESI values are auto-generated, how do the
MHES PEs generate the same ESI values? Different PEs will have different
system mac addresses and router IDs; and how do PEs auto-generate the same
Local Discriminator?
* Type 5 (T=0x05) - This type indicates an Autonomous System
(AS)-based ESI Value that can be auto-generated or configured by
the operator. The ESI Value is constructed as follows:
- AS number (4 octets). This is an AS number owned by the system
and MUST be encoded in the high-order 4 octets of the ESI Value
field. If a 2-octet AS number is used, the high-order extra
octets will be 0x0000.
- Local Discriminator value (4 octets). The Local Discriminator
value MUST be encoded in the 4 octets next to the AS number.
- The low-order octet of the ESI Value will be set to 0x00.
This mechanism could be used only if it produces ESIs that satisfy
the uniqueness requirement specified above.
For type 5, if the ESI values are auto-generated, how do PEs on the same
MHES auto-generate the same local discriminator value so that they have the
same ESI?
If a bridged network is multihomed to more than one PE in an EVPN
network via switches, then the support of All-Active redundancy mode
requires the bridged network to be connected to two or more PEs using
a LAG.
Is there a pointer to some documents about a bridged network connecting
to PEs using a LAG?
6. Ethernet Tag ID
An Ethernet Tag ID is a 32-bit field containing either a 12-bit or
24-bit identifier that identifies a particular broadcast domain
(e.g., a VLAN) in an EVPN instance. The 12-bit identifier is called
the VLAN ID (VID). An EVPN instance consists of one or more
broadcast domains (one or more VLANs). VLANs are assigned to a given
EVPN instance by the provider of the EVPN service. A given VLAN can
itself be represented by multiple VIDs. In such cases, the PEs
participating in that VLAN for a given EVPN instance are responsible
for performing VLAN ID translation to/from locally attached CE
devices.
The following subsections discuss the relationship between broadcast
domains (e.g., VLANs), Ethernet Tag IDs (e.g., VIDs), and MAC-VRFs as
well as the setting of the Ethernet Tag ID, in the various EVPN BGP
routes (defined in Section 8), for the different types of service
interfaces described in [RFC7209].
The following Ethernet Tag ID value is reserved:
* Ethernet Tag ID {0xFFFFFFFF} is known as MAX-ET.
6.1. VLAN-Based Service Interface
I've always struggled with the term "service interface" - especially the
"interface" part because of links/ACs/interfaces.
Is "service model" a better terminology?
6.2. VLAN Bundle Service Interface
With this service interface, an EVPN instance corresponds to multiple
broadcast domains (e.g., multiple VLANs); however, only a single
bridge table is maintained per MAC-VRF, which means multiple VLANs
share the same bridge table. This implies that MAC addresses MUST be
unique across all VLANs for that EVI in order for this service to
work. In other words, there is a many-to-one mapping between VLANs
and a MAC-VRF, and the MAC-VRF consists of a single bridge table.
Furthermore, a single VLAN must be represented by a single VID --
e.g., no VID translation is allowed for this service interface type.
The MPLS-encapsulated frames MUST remain tagged with the originating
VID. Tag translation is NOT permitted. The Ethernet Tag ID in all
EVPN routes MUST be set to 0.
How is selective multicast forwarding achieved in this case?
Suppose ingress PE1 has (s,g) with VID1, egress PE2 has (s,g) receivers with
VID2 but not with VID1. Would PE1 still send the traffic to PE2?
I assume PE2 should not send the traffic to its CEs because they are
in different broadcast domains, but it still does get traffic from PE1
and then discard.
6.3. VLAN-Aware Bundle Service Interface
...
Broadcast, unknown unicast, or multicast (BUM) traffic is sent only
to the CEs in a given broadcast domain;
Does the above apply to the vlan-bundle case? I assume so.
In the case where a single VLAN is represented by different VIDs on
different CEs and thus VID translation is required, a normalized
Ethernet Tag ID (VID) (i.e., a unique network-wide VID in context of
the EVI) MUST be carried in the EVPN BGP routes. Furthermore, the
advertising PE SHOULD advertise the MPLS Label in the Ethernet A-D
^^^^^^
per EVI and Inclusive Multicast routes and MPLS Label1 in the MAC/IP
Advertisement routes representing both the Ethernet Tag ID and the
EVI, so that upon receiving an MPLS-encapsulated packet, the
advertising PE can identify the corresponding bridge table from the
MPLS EVPN label and perform Ethernet Tag ID translation ONLY at the
disposition PE ...
Why SHOULD not MUST? It seems that MUST needs to be used.
The Route Distinguisher MUST be set to the RD of the MAC-VRF that is
advertising the NLRI. An RD MUST be assigned for a given MAC-VRF on
a PE. This RD MUST be unique across all MAC-VRFs on a PE. It is
RECOMMENDED to use the Type 1 RD [RFC4364]. The value field
comprises an IP address of the PE (typically, the loopback address)
followed by a number unique to the PE.
What about an IPv6 core?
7.10.1. Auto-derivation from the Ethernet Tag (VLAN ID)
For the "Unique VLAN EVPN" scenario (Section 4), it is highly
desirable to auto-derive the RT from the Ethernet Tag (VLAN ID). The
procedure for performing such auto-derivation is as follows:
* The Global Administrator field of the RT MUST be set to the
Autonomous System (AS) number with which the PE is associated.
* The 12-bit VLAN ID MUST be encoded in the lowest 12 bits of the
Local Administrator field, with the remaining bits set to zero.
For VLAN-based and VLAN Bundle services, the RT may also be auto-
derived as per the above rules but replacing the 12-bit VLAN ID with
a 16-bit Ethernet Tag ID configured for the BD. If the Ethernet Tag
ID length is 24 bits, the RT for the MAC-VRF can be auto-derived as
per [RFC8365] section 5.1.2.1.
For the VLAN-based services, does the above mean that an Ethernet TAG ID
is provisioned even though it is not signaled?
[RFC8214] defines and requires this extended community ("L2-Attr"),
to be included with per-EVI Ethernet A-D routes when multihoming is
enabled.
Usage and applicability of this Extended community to Bridging is
clarified here.
Is it now required for EVPN?
As described in Section 8.4, support of Ethernet A-D per EVI route is
OPTIONAL. However, this route is MANDATORY when sending the L2-Attr
Extended Community and its per-ESI-and-EVI attributes.
Is the "support" for sending, handling upon receiving, or both?
A received L2 MTU of zero means that no MTU checking against the
local MTU is needed. A received non-zero MTU from a remote PE MUST
be checked against the local MTU, and if there is a mismatch, the
local PE MUST NOT add the remote PE as the EVPN destination for any
of the corresponding service instances.
When the L2-Attr Extended Community is received from a remote PE, the
control word C flag MUST be checked against local control word
enablement. If there is a mismatch, the local PE MUST NOT add the
remote PE as the EVPN destination for any of the corresponding
service instances.
When the L2-Attr Extended Community is received from a remote PE,
flow label F flag MUST be checked against local flow label
enablement. If there is a mismatch, the local PE MUST NOT add the
remote PE as the EVPN destination for any of the corresponding
service instances. The Flow label capability signaling is further
described in Section 18.1.
Does the above mean a router MUST support the handling of received
A-D per EVI routes?
What does "for any of the corresponding service instances"?
Specifically, "any of" is a bit confusing. Isn't the route for *one particular*
service instance (EVI/BD)?
In order to achieve the fast convergence referred to in Section 8.2,
BGP speakers MAY prioritise advertisement, processing and
redistribution of routes based on relative scale of priority vs.
expected or average scale.
What does "relatvie scale of priority vs. ..." mean, specifically the
"vs" part. Should it be "and" - "based on relative priority and
expected/average scale"?
1. Ethernet A-D per ES (Mass-Withdraw Route Type 1) and Ethernet
Segment (Route Type 4) are lower scale, highly convergence
affecting and MAY be handled in first order of priority.
2. Ethernet A-D per EVI, Inclusive Multicast Ethernet Tag route, and
IP Prefix route, as defined in [RFC9136], are sent for each
Bridge or AC at medium scale, may be convergence affecting and
MAY be handled in second order of priority.
3. Very highly scalable routes, such as MAC advertisement routes
(zero and non-zero IP portion), Multicast Join Sync and Multicast
Leave Sync routes, as defined in [RFC9251], are considered
'individual routes' and MAY be handled in the last order of
priority.
--------------------
7.13.1. Best Path Selection for MAC/IP Advertisement routes
...
4. If, amongst the candidate routes received, at least one was
received with a highest sequence number in the MAC Mobility
extended community, remove from consideration the routes not tied
for highest sequence number.
Note that this rule does not apply to routes with the Default
Gateway extended community, and the selection process skips this
step for any 2 or more routes after (2) above.
5. If, amongst the candidate routes received, at least one was
received with a higher degree of preference, remove from
consideration the routes not tied for higher degree of
preference, as defined in Section 9.1.1 of [RFC4271].
6. If the steps above do not produce a single route, the rest of the
rules in [RFC4271] apply.
The above steps do not seem to lead to ECMP. Rather, a single route is always
chosen because of the following last step in 9.1.2 of RFC4271:
g) Prefer the route received from the lowest peer address.
However, how does the following paragraph take effect, and why does the
default gateway EC make a difference?
If Steps 1-2 leave Equal Cost Multi-Paths (ECMP) among multiple MAC/
IP Advertisement routes with the Default Gateway extended community,
and ECMP is enabled by policy, then multiple paths MAY be used to
reach a given MAC/IP Advertisement route.
7.13.2. Best Path Selection for Ethernet A-D per EVI routes
This section summarizes the best path selection for Ethernet A-D per
EVI routes routes. The criteria MUST be applied in the order
specified.
1. For non-zero ESI routes, the EVPN Multi-Homing procedures in
[RFC8214] and Section 8.4 of this document for Aliasing and
Backup path are followed:
1. If at least one of the candidate routes was received with the
EVPN Layer 2 Attributes extended community, remove from
consideration the routes without the EVPN Layer 2 Attributes
extended community.
Why should we select a best path for the Ethernet A-D per EVI route?
Shouldn't all those routes for the same MHES considered equally?
Is it that BGP inherently does best route selection and we want to make
sure that the routes with the layer2 attribute are selected?
2. P and B flags are considered for the selection of the routes
when sending traffic to a remote Ethernet Segment.
Does the above mean the selection of the mac/ip routes should consider
the P/B flags in the Ethernet A-D routes? Then should it be part of 7.13.1
instead of here?
Note that this rule does not apply to routes with ESI 0, and the
selection process skips this step.
The above paragraph could be removed, because "non-zero ESI" was mentioned
at the very beginning of step 1.
2. If more than one candidate routes remain for each remote PE (ESI
0 or attached to the same ES) steps 4-5 in Section 7.13.1 are
followed.
Step 4 of 7.13.1 is about the sequence number in the mac mobility EC.
Why is that applicable to Ethernet A-D per EVI routes in this step 2 here
in 7.13.2?
8.1.1. Constructing the Ethernet Segment Route
The Route Distinguisher MUST be a Type 1 RD [RFC4364]. The value
field comprises an IP address of the PE (typically, the loopback
address) followed by a number unique to the PE.
What about an IPv6 core?
.. This
label MUST be a downstream assigned MPLS label if the advertising PE
is using ingress replication for receiving multicast, broadcast, or
unknown unicast traffic from other PEs. If the advertising PE is
using P2MP MPLS LSPs for sending multicast, broadcast, or unknown
unicast traffic, then this label MUST be an upstream assigned MPLS
label, unless DCB allocated labels are used. The usage of this label
is described in Section 8.3.
The above is better rewritten as follows:
The label is assigned from the adveritsing PE's label space, and used
by other PEs to send BUM traffic via ingress replication to the
advertising PE, or used by the advertising PE to send BUM traffic via BIER or
P2MP LSPs, unless DCB labels [RFC9573] are used. The usage of this label
is described in Section 8.3.
-----------------------------
8.3.1. ESI Label Assignment
The following subsections describe the assignment procedures for the
ESI label, which differ depending on the type of tunnels being used
to deliver multi-destination packets in the EVPN network.
The assignment is actually the same for both IR and P2MP. It's the use
of the label that is different depending on the tunnel type.
The Non-DF PEs that operate in All-Active redundancy mode and that
use P2MP LSPs to send BUM traffic advertise an upstream assigned ESI
label in the set of Ethernet A-D per ES routes for their common
attached ES. ...
The DF PE that operates in Single-Active redundancy mode and that
uses P2MP LSPs to send BUM traffic should advertise an upstream
assigned ESI label in the set of Ethernet A-D per ES routes for its
attached ES, just as described in the previous paragraph.
I assume the PEs always advertise that ESI label, regardless of the DF
role, because the role could dynamically change and it'd be too late
to advertise depending on the role change?
Support of this route is OPTIONAL. However, this route is MANDATORY
when sending the L2-Attr Extended Community and its per-ESI-and-EVI
attributes used in Aliasing and Backup path computations above.
I find the above paragraph is a bit confusing and perhaps not needed.
By "support", I assume it means the sending of the route (and every router
needs to be able to process the route). The sending of the route is
needed only when aliasing and backup path is needed.
By "its", I assume it means "the route's" not "the L2-Attr Extended Community".
With the above understanding, perhaps the paragraph could be updated as follows:
The sending of this route, along with the L2-Attr Extended Community
and the per-ESI-and-EVI attributes, is MANDATORY if and only if the
Aliasing and/or Backup procedures are used.
--------
Note that the above allows the Ethernet A-D per EVI route to be
advertised with one of the following granularities:
* One Ethernet A-D route per <ESI, Ethernet Tag ID> tuple per
MAC-VRF. This is applicable when the PE uses MPLS-based
disposition with VID translation or may be applicable when the PE
uses MAC-based disposition with VID translation.
So is it that in this case, it is not really per-EVI but per <EVI, Tag ID>?
* One Ethernet A-D route for each <ESI> per MAC-VRF (where the
Ethernet Tag ID is set to 0). This is applicable when the PE uses
MAC-based disposition or MPLS-based disposition without VID
translation.
Is it that the encoding difference between the per-ES and per-EVI route
is only the Ethernet Tag ID? The per-ES route's tag is always MAX-ET,
while the per-EVI route's tag is either 0 or a non-MAX-ET value?
8.5. Designated Forwarder Election
Consider a CE that is a host or a router that is multihomed directly
to more than one PE in an EVPN instance on a given Ethernet segment.
In this scenario, only one of the PEs, referred to as the Designated
Forwarder (DF), is responsible for certain actions:
* Sending broadcast and multicast traffic for a given EVI to that
CE.
* If the flooding of unknown unicast traffic (i.e., traffic for
which a PE does not know the destination MAC address, see
Section 12) is allowed, sending unknown unicast traffic for a
given EVI to that CE.
* If the multihoming mode is Single-Active, sending (known) unicast
traffic for a given EVI to that CE.
Note that this behavior, which allows selecting a DF at the
granularity of <ES, EVI> for is the default behavior in this
specification.
What does "this behavior" refer to? Why do you say "this behavior allows ..."?
Perhaps change it to the following?
Note that the DF selection is at the granularity of <ES, EVI> in this
document.
-------------------
Assuming a redundancy group of N PE nodes, the PE with ordinal i
is the DF for an <ES, EVI> when (V mod N) = i, where V is the
Ethernet tag for that EVI. For VLAN-Aware Bundle service, then
the numerically lowest Ethernet tag in that EVI MUST be used in
the modulo function.
Do you mean "normalized Ethernet Tag ID for that EVI", even though it may need
to provisioned (different VLAN-ID may be used at different sites) but not
signaled in the case of vlan-base service?
4. For each EVPN instance, a second list of the IP addresses of all
^^^^^^^^^^^^^^^^^^^^^^
the PE nodes connected to the Ethernet segment is built. The PE
which was determined as DF above is removed from that ordered
candidate list, forming a backup redundancy group of M PE nodes.
Every remaining PE is then given a second ordinal indicating its
position in the secondary ordered list according to the same
criteria as in step 3 above.
The second ordinals are used to determine which PE nodes will be
the BDF for a given EVPN instance on the Ethernet segment, using
the same modulo rule as above, (V mod M) = i.
I think it can be "For each set of EVPN instance that share the same
(V mod N)", right?
In the case of link or port failure, the affected PE withdraws
its Ethernet Segment route. This will re-trigger the service
carving procedures on all the PEs in the redundancy group: the
expected new-DF will be BDF previously calculated in step 5.
I suppose that the above text assumes the affected PE was the DF.
It should be made clear.
The use of BDF is only described in "14.1.1. Single-Active Redundancy Mode".
Does that mean that BDF election is only needed for Single-Active ESes?
8.6. Signaling Primary and Backup DF Elected PEs
Once the Primary and Backup DF Elected PEs for a given <ES, EVI> are
determined, the multi-homed PEs for that ES will each advertise an
Ethernet A-D per EVI route for that EVI and each will include an
L2-Attr extended community with the P and B bits set to reflect the
advertising PE's role for that EVI.
Can "DF Elected PE" be replaced by "DF PE"?
8.7. Interoperability with Single-Homing PEs
Let's refer to PEs that only support single-homed CE devices as
single-homing PEs. For single-homing PEs, all the above multihoming
procedures can be omitted; however, to allow for single-homing PEs to
fully interoperate with multihoming PEs, some of the multihoming
procedures described above SHOULD be supported even by single- homing
PEs:
* procedures related to processing Ethernet A-D routes for the
purpose of fast convergence (Section 8.2 ("Fast Convergence")), to
let single-homing PEs benefit from fast convergence
* procedures related to processing Ethernet A-D routes for the
purpose of aliasing (Section 8.4 ("Aliasing and Backup Path")), to
let single-homing PEs benefit from load balancing
* procedures related to processing Ethernet A-D routes for the
purpose of a backup path (Section 8.4 ("Aliasing and Backup
Path")), to let single-homing PEs benefit from the corresponding
convergence improvement
I find this section strange.
A single-homing PE does not need to originate Ethernet A-D routes,
but it certainly should process those routes originated from MH PEs,
just like one MH PE should process those routes from other MH PEs.
Do we really need this section? There is no difference between
a single-homing PE and a MH PE wrt processing those routes from other MH PEs.
To illustrate this with an example, consider two PEs (PE1 and PE2)
connected to a multihomed Ethernet segment ES1. All-Active
redundancy mode is assumed. A given MAC address M1 is learned by PE1
but not PE2. On PE3, the following states may arise:
T1 When the MAC/IP Advertisement route from PE1 and the set of
Ethernet A-D per ES routes and Ethernet A-D per EVI routes from
PE1 and PE2 are received, PE3 can forward traffic destined to
M1 to both PE1 and PE2.
...
T3 After T1, PE3 receives the set of Ethernet A-D per ES routes
and Ethernet A-D per EVI routes from PE1 and PE2...
Remove the first sentence in T3? It is already talked about at T1
and is not changing at T3.
The IP Address field in the MAC/IP Advertisement route may optionally
carry one of the IP addresses associated with the MAC address. This
provides an option that can be used to minimize the flooding of ARP
or Neighbor Discovery (ND) messages over the MPLS network and to
remote CEs. This option also minimizes ARP (or ND) message
processing on end-stations/hosts connected to the EVPN network. A PE
may learn the IP address associated with a MAC address in the control
or management plane between the CE and the PE. Or, it may learn this
binding by snooping certain messages to or from a CE. When a PE
learns the IP address associated with a MAC address of a locally
connected CE, it may advertise this address to other PEs by including
it in the MAC/IP Advertisement route. The IP address may be an IPv4
address encoded using 4 octets or an IPv6 address encoded using
16 octets. For ARP and ND purposes, the IP Address Length field MUST
^^^^^^^^^^^^^^^^^^^^^^^^
be set to 32 for an IPv4 address or 128 for an IPv6 address.
Remove the "For ARP and ND purposes"?
Furthermore, even if all PEs of a given EVPN instance do act as a
default gateway for that EVPN instance, but only some, but not all,
of these PEs have sufficient (routing) information to provide
inter-subnet routing for all the inter-subnet traffic originated
within the subnet associated with the EVPN instance, then when such a
PE advertises in the EVPN control plane its default gateway MAC
address using the MAC/IP Advertisement route and indicates that such
a route is associated with the default gateway, the route MUST carry
a valid downstream assigned label.
Each PE that receives this route and imports it as per procedures
specified in this document follows the procedures in this section
when replying to ARP Requests that it receives.
Each PE that acts as a default gateway for a given EVPN instance that
receives this route and imports it as per procedures specified in
^^^^^^^^^^^^^^^^^^^
this document MUST create MAC forwarding state that enables it to
apply IP forwarding to the packets destined to the MAC address
carried in the route.
What's the reason for this ^^^^^^^ condition? Shouldn't a default GW PE
always be prepared to for IP traffic?
* The PE that has advertised the MAC route without Default Gateway
extended community, upon receiving the route with Default Gateway
extended community, SHALL withdraw its route and SHOULD raise an
alarm.
* MAC Mobility extended community SHALL NOT be attached to routes
which also have Default Gateway extended community on the sending
side and SHALL be ignored on the receiving side.
Should an alarm be raised like in the first case?
Procedures are required for a given PE to flood broadcast or
multicast traffic received from a CE and with a given Ethernet tag to
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
the other PEs in the associated <EVI, BD> (EVPN instance).
This ^^^^^^^^^^^^ text seems redundant and could be removed.
* If the PE that originates the advertisement uses ingress
replication for the P-tunnel for EVPN, the route MUST include the
PMSI Tunnel attribute with the Tunnel Type set to Ingress
Replication and the Tunnel Identifier set to a routable address of
Since a receiving PE uses the next hop of the route instead of this
tunnel identifier to resolve the route to an LSP, why should the
identifier be routable? I think the real condition should be that
the label is allocated from the default label space of the router
identified by the next hop address.
the PE. The PMSI Tunnel attribute MUST carry a downstream
assigned MPLS label. This label is used to demultiplex the
broadcast, multicast, or unknown unicast EVPN traffic received
over an MP2P tunnel by the PE. A PE receiving an Inclusive
^^^^^^^^^^^^^^^^^^^
Multicast Ethernet Tag route (with ingress replication as
P-tunnel) SHOULD use the Next Hop field of the MP_REACH_NLRI
attribute when resolving the route to an LSP.
It's not only MP2P - P2P is the same, right? I think the ^^^^^^^ text
should be removed.
12. Processing of Unknown Unicast Packets
The procedures in this document do not require the PEs to flood
unknown unicast traffic to other PEs. If PEs learn CE MAC addresses
via a control-plane protocol, the PEs can then distribute MAC
addresses via BGP, and all unicast MAC addresses will be learned
prior to traffic to those destinations.
However, if a destination MAC address of a received packet is not
known by the PE, the PE may have to flood the packet.
Perhaps change the "However, if a ..." to "If the CE MAC addresses are only
learned via data plane learning, and the ..."?
... When flooding,
one must take into account "split-horizon forwarding" as follows: The
principles behind the following procedures are borrowed from the
split-horizon forwarding rules in VPLS solutions [RFC4761] [RFC4762].
When a PE capable of flooding (say PEx) receives an unknown
destination MAC address, it floods the frame. If the frame arrived
from an attached CE, PEx must send a copy of that frame on every
Ethernet segment (belonging to that EVI) for which it is the DF,
other than the Ethernet segment on which it received the frame. In
addition, the PE must flood the frame to all other PEs participating
in that EVPN instance. If, on the other hand, the frame arrived from
another PE (say PEy), PEx must send a copy of the packet on each
Ethernet segment (belonging to that EVI) for which it is the DF. PEx
MUST NOT send the frame to other PEs, since PEy would have already
done so. Split-horizon forwarding rules apply to unknown MAC
addresses.
Doesn't this rule apply to BM traffic as well?
The PEs in a particular EVPN instance may use ingress replication
using RSVP-TE P2P LSPs or LDP MP2P LSPs for sending unknown unicast
traffic to other PEs. Or, they may use RSVP-TE P2MP or LDP P2MP for
sending such traffic to other PEs.
Perhaps change the paragraph to the following?
The PEs in a particular EVPN instance may use any multipoint transport
for sending unknown unicast traffic to other PEs, including but not
limited to ingress replication (e.g., RSVP-TE P2P LSPs, LDP MP2P LSPs,
SR P2P policies), RSVP-TE/mLDP/SR P2MP, or BIER.
----------------------
12.1. Ingress Replication
12.2. P2MP MPLS LSPs
Instead of having the 12.1 and 12.2 sections, perhaps just say that
the flooding of the unknown unicast traffic follows the same procedures
in Section 11, and empahsizes that:
"... if the MAC address is
a unicast MAC address, the PE MUST treat the packet as an unknown
unicast packet"
13.1. Forwarding Packets Received from a CE
When a PE receives a packet from a CE with a given Ethernet Tag, it
^^^^^^^^^^^^^^^^^^^^^^^^^^
must first look up the packet's source MAC address. In certain
environments that enable MAC security, the source MAC address MAY be
used to validate the host identity and determine that traffic from
the host can be allowed into the network. Source MAC lookup MAY also
be used for local MAC address learning.
How about change the first sentence to:
When a PE receives a packet from a CE, it must first look up the packet's
source MAC address in the corresponding Bridge Table.
-------------------
If the MAC address is unknown and if the administrative policy on the
PE requires flooding of unknown unicast traffic, then:
* The PE MUST flood the packet to other PEs. The PE MUST first
encapsulate the packet in the ESI MPLS label as described in
Section 8.3.
Add "if needed" before "as described in Section 8.3"?
If ingress replication is used, the packet MUST be replicated to
each remote PE, with the VPN label being the MPLS label advertised
by the remote PE in a PMSI Tunnel attribute in the Inclusive
Multicast Ethernet Tag route for the <EVI, BD> associated with the
received packet's Ethernet tag.
If P2MP LSPs are being used, the packet MUST be sent on the P2MP
LSP of which the PE is the root, for the <EVI, BD> associated with
^^^^^^^^^^^^^^^^^^^^^^^^
the received packet's Ethernet tag. If the same P2MP LSP is used
for all the BD's in the EVI, then all the PEs in the EVI MUST be
the leaves of the P2MP LSP. If a different P2MP LSP is used for a
given BD in the EVI, then only the PEs in that BD MUST be the
leaves of the P2MP LSP. The packet MUST be encapsulated in the
P2MP LSP label stack.
What about mp2mp?
14.1. Load Balancing of Traffic from a PE to Remote CEs
When a remote PE imports a MAC/IP Advertisement route for a given ES
in a MAC-VRF, it MUST examine all imported Ethernet A-D routes for
that ESI in order to determine the load- balancing characteristics of
the Ethernet segment.
14.1.1. Single-Active Redundancy Mode
For a given ES, if a remote PE has imported the set of Ethernet A-D
per ES routes from at least one PE, where the "Multihoming redundancy
mode" in the ESI Label extended community is set to 1, then that
remote PE MUST deduce that the ES is operating in Single-Active
redundancy mode.
This means that for a given <EVI, BD>, a given MAC address is
reachable only via the PE announcing the associated MAC/IP
Advertisement route - this PE will also have advertised an Ethernet
A-D per EVI route for that <EVI, BD> with an L2-Attr extended
community in which the P bit is set.
If we strictly follow the above, when the current primary PE
fails, the backup PE should not be used until we receive MAC/IP from it,
right? Perhaps change it to the following?
This means that for a given <EVI, BD>, a given MAC address is
reachable only via one of the PEs, which advertises an Ethernet
A-D per EVI route for that <EVI, BD> with an L2-Attr extended
community in which the P bit is set.
-----------------------------
* A PE detecting a locally attached MAC address for which it had
previously received a MAC/IP Advertisement route with the same
zero Ethernet segment identifier (single-homed scenarios)
advertises it with a MAC Mobility extended community with the
sequence number set properly. In the case of single-homed
scenarios, there is no need for ESI comparison. ESI comparison is
done for multihoming in order to prevent false detection of MAC
moves among the PEs attached to the same multihomed site.
Why are the last two sentences in the above paragraph needed?
"with the same zero ESI" indicates that an ESI comparison was done.
A PE receiving a MAC/IP Advertisement route for a MAC address with a
different Ethernet segment identifier and a higher sequence number
^^^^^^^^^
than that which it had previously advertised withdraws its MAC/IP
Advertisement route. ...
Should it be "different or zero"?
15.2. Sticky MAC Addresses
There are scenarios in which it is desired to configure some MAC
addresses as static so that they are not subjected to MAC moves. In
such scenarios, these MAC addresses are advertised with a MAC
Mobility extended community where the static flag is set to one and
the sequence number is set to zero. If a PE receives such
advertisements, then it MAY program to drop any received frames with
that MAC SA over its local ACs. When a PE later learns the same MAC
address(es) via local learning for remote PEs or via a different ES
for the advertising PE, then the PE MUST alert the operator and MAY
drop the received frames.
What does the last sentence in the paragraph mean? Specifically, I have
trouble parsing "via local learning for remote PEs" and "via a differen
ES for the advertising PE".
I tried to interpret it as following. Please let me know if that's correct.
... When the receiving PE later learns the same MAC address via local
learning, or when the advertising PE learns it on a different
local/remote ES, then the PE MUST alert ...
---------------------
[RFC9135] describes symmetric and asymmetric IRB operation where an
access-facing IRB interface is associcated with each subnet (i.e.,
VLAN). Each of these IRB interfaces is configured with a MAC address
(typically Anycast) and an Anycast IP address. The MAC address
associated with an IRB interface should be considered as sticky MAC
address and be programmed as such for local ACs. If this MAC address
is not Anycast, then it is advertised with both Gateway Extended EC
and MAC Mobility EC with static flag set; however, if it is Anycast,
then no EVPN MAC/IP route advertisement is needed
Does the above paragraph miss a period or more content in the above paragraph?
It seems that a static/sticky MAC address is associated with a particular AC,
so what does it mean by that the MAC address associated with the IRB is to
"be programmed as such for local ACs"??
[RFC9136] describes interfaceful IRB interfaces that each is
configured with a MAC address. This MAC address for each of these
core-facing IRB interfaces should be considered as a sticky MAC
address and be advertised with static flag of one and sequence number
of zero and be programmed as a sticky MAC.
Is it that all IRB MAC addresses should be considered as static/sticky?
What is a core-facing IRB interface? RFC9136 does not seem to talk about it.
RFC9135 does mention access-facing IRBs, but does it mean that a BD has
two IRB interfaces, or is it that it only has one IRB, just that in some
cases the traffic goes out of an IRB interface will be forwarded towards
the ACs while in some other cases will be forwarded towards core?
15.3. Loop Protection
The EVPN MAC Duplication procedure in Section 15.1 prevents an
endless EVPN MAC/IP route advertisement exchange for a duplicate MAC
between two (or more) PEs. This helps the control plane settle,
however, when there is backdoor link (loop) between two or more PEs
attached to the same BD, BUM frames being sent by a CE are still
endlessly looped within the BD through the backdoor link and among
the PEs. This may cause unpredictable issues in the CEs connected to
the affected BD.
Can you provide an example of the backdoor link (loop)?
Is it the sites normally don't run STP through the EVPN core that may break
the loop?
16. Multicast and Broadcast
The PEs in a particular EVPN instance may use ingress replication or
P2MP or MP2MP LSPs to send multicast traffic to other PEs.
Add a reference to RFC9624 for EVPN with BIER?
It's a bit strange that this section is not together with Section 11.
More comments below.
16.1. Ingress Replication
The PEs may use ingress replication for flooding BUM traffic as
described in Section 11 ("Handling of Multi-destination Traffic"). A
given broadcast packet must be sent to all the remote PEs. However,
a given multicast packet for a multicast flow may be sent to only a
subset of the PEs. Specifically, a given multicast flow may be sent
to only those PEs that have receivers that are interested in the
multicast flow. Determining which of the PEs have receivers for a
given multicast flow is done using the procedures of [RFC9251].
This section talks about flooding, and refers to RFC9251 for selective
forwarding in the case of IR. I don't see why it can't be part of Section 11.
16.2. P2MP or MP2MP LSPs
A PE may use an "Inclusive" tree for sending a BUM packet. This
terminology is borrowed from [RFC7117].
A variety of transport technologies may be used in the service
provider (SP) network. For Inclusive P-multicast trees, these
transport technologies include point-to-multipoint LSPs created by
RSVP-TE or Multipoint LDP (mLDP) or BIER.
16.2.1. Inclusive Trees
An Inclusive tree allows the use of a single multicast distribution
tree, referred to as an Inclusive P-multicast tree, in the SP network
to carry all the multicast traffic from a specified set of EVPN
instances on a given PE. A particular P-multicast tree can be set up
to carry the traffic originated by sites belonging to a single EVPN
instance, or to carry the traffic originated by sites belonging to
several EVPN instances. The ability to carry the traffic of more
than one EVPN instance on the same tree is termed 'Aggregation', and
the tree is called an Aggregate Inclusive P-multicast tree or
Aggregate Inclusive tree for short. The Aggregate Inclusive tree
needs to include every PE that is a member of any of the EVPN
instances that are using the tree. This implies that a PE may
receive BUM traffic even if it doesn't have any receivers that are
interested in receiving that traffic.
An Inclusive or Aggregate Inclusive tree as defined in this document
is a P2MP tree. A P2MP or MP2MP tree is used to carry traffic only
for EVPN CEs that are connected to the PE that is the root of the
tree.
The procedures for signaling an Inclusive tree are the same as those
in [RFC7117], with the VPLS A-D route replaced with the Inclusive
Multicast Ethernet Tag route. The P-tunnel attribute [RFC7117] for
an Inclusive tree is advertised with the Inclusive Multicast Ethernet
Tag route as described in Section 11 ("Handling of Multi-destination
Traffic"). Note that for an Aggregate Inclusive tree, a PE can
"aggregate" multiple EVPN instances on the same P2MP LSP using
upstream labels or DCB allocated labels
[I-D.ietf-bess-mvpn-evpn-aggregation-label]. The procedures for
aggregation are the same as those described in [RFC7117], with VPLS
A-D routes replaced by EVPN Inclusive Multicast Ethernet Tag routes.
Section 16.1 talks about selective tree and refers to RFC9251;
Section 16.2 does not talk about selective tree, so it's strange that there
is a standout subsection 16.2.1 specifially for inclusive tree.
It would makes sense to refer to RFC9572 for selective tree in the case of
P2MP/BIER.
Again, I believe this entire section, and Section 19 (DCB labels)
should be moved into Section 11.
The Ethernet A-D per ES routes should be used by an implementation to
optimize the withdrawal of MAC/IP Advertisement routes. When a PE
receives a withdrawal of a particular Ethernet A-D route from an
advertising PE, it SHOULD consider all the MAC/IP Advertisement
routes that are learned from the same ESI as in the Ethernet A-D
route from the advertising PE as having been withdrawn. This
optimizes the network convergence times in the event of PE-to-CE
failures.
The above is not exactly correct. Those MAC/IP routes from the advertising
PE are still considered for the aliasing purposes, so they're not considered
as withdrawn.
18.1. Flow Label
Flow label is used to add entropy to divisible flows, and creates
ECMP load-balancing in the network. The Flow label MAY be used in
EVPN networks to achieve better load-balancing in the network, when
transit nodes perform deep packet inspection for ECMP hashing. The
following rules apply:
Can we add a referece for the Flow Label?
* When F-bit is set to 1, the PE announces the capability of both
sending and receiving flow label for known unicast.
Can we clarify it is the F-bit of which attribute?
Is it in the EVPN Layer 2 Attributes?
Googl search showed an AI Overview mentioning "The F-bit (also known as the
Flow Label bit) is part of the Flow Label TLV (Type-Length-Value) used for
flow-aware transport of MPLS pseudowires", and there is a Flow Label sub-TLV in
RFC6391.
If the PE is capable itself of supporting Flow Label, then:
- upon receiving the F-bit set (F=1) from a remote PE, it MUST
send known unicast packets to that PE with Flow labels;
- alternately, upon receiving the F-bit unset (F=0) from a
remote PE, it MUST NOT send known unicast packets to that PE
with Flow labels.
Remove "alternatively,"?
* The Flow Label MUST NOT be used for EVPN-encapsulated BUM packets.
...
* When sending EVPN-encapsulated packets over a P2MP LSP (either
RSVP-TE or mLDP), flow label SHOULD NOT be used. This is
independant of any F-bit signalling in the L2-Attr Extended
Community which would still apply to unicast.
This is for BUM traffic, right? There is a bullet about BUM not using
Flow label already.
19. Use of Domain-wide Common Block (DCB) Labels
I think this should be folded into Section 11.
In fact, a reference to RFC9573 may be enough.
The use of DCB labels as in
[I-D.ietf-bess-mvpn-evpn-aggregation-label] is RECOMMENDED in the
following cases:
RFC9573.
* BIER tunnels: As described in [I-D.ietf-bier-evpn], the use of
RFC9624
labels with BIER tunnels in EVPN networks is similar to aggregate
tunnels, since the ingress PE uses upstream allocated labels to
identify the BD. As described in [I-D.ietf-bier-evpn], DCB labels
can be allocated instead of upstream labels in the PMSI Tunnel
Attribute so that the number of labels required on the egress PEs
can be reduced.
BIER-EVPN actually does not talk about DCB labels - it assumes upstream-assigned
labels. It is RFC9573 that talks about DCB for both MVPN and EVPN.
Juniper Business Use Only
_______________________________________________
BESS mailing list -- [email protected]
To unsubscribe send an email to [email protected]
