ietf routing (and switching) update

Cisco Public © 2011 Cisco and/or its affiliates. All rights reserved. 1 Cisco Expo

Cisco Expo 2011

IETF Routing (and Switching) Update Routing Protocols 25 years later.

Josef Ungerman, CCIE #6167

© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

•  Twitter www.twitter.com/CiscoCZ

•  Talk2cisco www.talk2cisco.cz/dotazy

•  SMS 732 488 666


•  Technical Activities Update IETF Summary

•  Fast Convergence IGP LFA FRR PIM MoFRR BGP PIC & Path Diversity

•  New Protocols SIDR and RPKI MPLS-TP TRILL

© 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Presentation_ID 4

“The mission of the IETF is make the Internet work better by producing high quality, relevant technical documents that influence the way people design, use, and manage the Internet.”

H. Alvestrand RFC 3935 A Mission Statement for the IETF October 2004 http://www.ietf.org/rfc/rfc3935.txt

IP Networks

their network.


The IETF is organized into 8 areas:

General (chaired by the IETF Chair)

Applications

Internet

Operations and Management

Real-time Applications and Infrastructure

Routing

Security

Transport

...for a total of more than 125 working groups!!


•  Routing Area bfd Bidirectional Forwarding Detection idr Inter-Domain Routing isis IS-IS for IP Internets ospf Open Shortest Path First IGP pim Protocol Independent Multicast rtgwg Routing Area Working Group l2vpn Layer 2 Virtual Private Networks l3vpn Layer 3 Virtual Private Networks mpls Multiprotocol Label Switching pwe3 Pseudowire Emulation Edge to Edge sidr Secure Inter-Domain Routing vrrp Virtual Router Redundancy Protocol

•  Internet Area lisp Locator/ID Separation Protocol (Internet Area) savi Source Address Validation Improvements softwire Softwires (like 6rd, 4rd) trill Transparent Interconnection of Lots of Links (Internet Area)


•  6 WG’s – MPLS, PWE3, L2VPN, L3VPN, CCAMP, PCE MPLS WG: •  Defines MPLS architecture and protocols (LDP, RSVP-TE) •  Over 70 RFCs published to date •  Mature set of IP/MPLS specifications •  New proposed extensions (over 20 new drafts) to support transport

migration to packet switching •  MPLS Transport Profile (MPLS-TP) as major work area •  Four MPLS-TP RFCs published (MPLS Generic Associated Channel,

RFC 5586) MPLS Generic Associated Channel - RFC 5586 MPLS-TP Requirements - RFC 5654 An Inband DCN For MPLS-TP - RFC 5718 MPLS –TP OAM Requirements- RFC 5860


•  In general, routing protocols are mature. Networks serve mission critical roles.

•  Convergence, Availability and Scalability Enhancements to routing protocols are now incremental and look to enhance Convergence, Availability and Scalability.

BFD, IP FRR, Loop Free Convergence, Path diversity for BGP PIC BGP Optional Attribute Error Handling and Advisory Message, BGP Bestpath Selection Criteria, BGP Graceful Shutdown BGP ADD_PATH, Virtual Aggregation, EIGRP DMVPN Scalability LISP – Internet routing hierarchy, scalability, geo independence

•  Security The network infrastructure’s security is being enhanced.

SIDR Origin Validation OSPFv2, IS-IS and EIGRP Authentication Keying and Authentication for Routing Protocols (KARP) WG


•  Reuse of Routing Technology Reliable delivery of information to any node in the network, and the ability to calculate loop free paths is now being applied to solve non-traditional problems. Layer 2 Routing

IS-IS L2 Extensions, TRILL, OTV Service Discovery and Distribution

BGP flow-spec, bmp, OSPF Transport Instance, Advertising Generic Information in IS-IS, Proximity and Service Advertisement Framework

•  Application of MPLS technologies MPLS-TP (Transport Profile) MPLS-TP OAM (inc. BFD for LSP) MPLS evolution – mLDP, mLACP, Inter-AS, PBB+VPLS,…


LFA (Loop-Free Alternate) Fast Reroute

aka. IPFRR (IP Fast Reroute)


Edge POP (Intra-POP)

Core (Inter-POP)

Classical convergence Few min. Few 10 sec.

Fast Convergence <1s

“MPLS-VPN BGP local convergence” ISIS / OSPF Fast Convergence

Fast ReRoute (Prefix Independent) <100ms

BGP PIC Edge

LFA FRR (connection-less)

MPLS TE FRR (connection oriented)


•  LSP/LSA generation is optimized

•  Flooding & passing is optimized

•  Support of incremental SPT and optimized for full SPT.

•  Prefix Prioritization Priority 1: IPTV sources Priority 2: High BGP next hop Priority 3: Other BGP next hop Priority 4: No customer traffic


•  A natural extension to ISIS or OSPF FC behavior Boosts ISIS convergence - <25msec -  Prefix Independence -  No new protocol extension -  Per-hop behavior (no network-wide requirement)

If the topology does not allow to compute IPFRR LFA - ISIS / OSPF FC behavior

•  ISIS or OSPF per-Link or per prefix LFA FRR is are simple command


S F

R1

D

Primary Path Backup Path

Route D (L:55) P NH: F, L: 33 B NH: R1, L: 66

R2

20

Route D (L:33) NH: F, L: 22

Route D (L:66) NH: F, L: 22

Route D (L:22) NH: D, L: pop


S F

R1

D

Route D P NH: F, L22

B NH: no LFA

Route D NH: S

R2

20

Route D NH: R3

R3

20

10 10

10

BRKIPM-3000 (Advanced LFA - a simple protection technique for IP/MPLS networks )


•  IGP FC: a fast IGP is one of the main building block for any FC deployments.

•  LFA FRR: is a intra POP natural extension for IGP FC.

•  MPLS TE FRR: is a inter POP natural extension for IGP FC.

PoP

PoP

PoP

PoP

PE

P

P

PoP


•  PIM Pre-Signalling of two independent joins router is connected to the source via two disjoint branches (requires two

plane design)

•  Upon failure detection, switch-over from primary to backup branch IGP detection: order of x00msec local detection or passive heartbeat: 50msec RTP sequence monitoring: zeroloss

IPTV source

Pop1

Pop2 PopN

Cisco Confidential 18 © 2010 Cisco and/or its affiliates. All rights reserved.

•  Leverage IP/MPLS infrastructure tight-SLA technologies IGP Fast Convergence MPLS TE FRR IP FRR Loop Free Alternative (LFA)

•  Optimize L3 PE forwarding plane for fast convergence BGP Prefix Independent Convergence IP Multicast PIM Fast Convergence Multicast only Fast ReRoute (MoFRR)


BGP PIC & Path Diversity

Prefix Independent Convergence


VPN 1 site B x.x.x.x/y

RD 1:1 RD 2:1

RD 3:1

RR1 RR2

RR4 RR3

PE1 PE2

PE3

CE2 CE1

VPN 1 site A

1.  link PE2-CE2 fails

If BGP PIC Edge implemented, then traffic goes PE1,PE2,PE3,CE2

BGP PIC Edge



RD 1:1 RD 2:1

RD 3:1

RR1 RR2

RR4 RR3

PE1 PE2

PE3

CE2 CE1

VPN 1 site A

6.  PE1 deletes path via PE2, now going via PE3

5.  RR1 and RR3 propagate withdraws

3.  PE2 withdraws paths

4.  RR2 and RR4 propagate withdraws

1.  link PE2-CE2 fails

If BGP PIC Edge implemented, then traffic goes PE1,PE2,PE3,CE2

2. Fast External Fallover scans BGP table, calculating new bestpaths



RD 1:1 RD 2:1

RD 3:1

RR1 RR2

RR4 RR3

PE1 PE2

PE3

CE2 CE1

VPN 1 site A

3.  PE1 withdraws paths

If BGP PIC Edge implemented, then traffic goes PE1,PE3,CE2

1.  link PE2 fails

2. The IGP does propagate the BGP NH failure


Aggregators (RRs, [confed] border routers) should advertise backup paths

backup-path-RR

PE3

RR1

Z/p

PE1

PE2 Z/p ! PE2

Z/p ! PE1

Z/p ! PE1 Z/p ! PE2

backup-path-edge

PE3

RR1

PE1 Z/p PR1

PR2 No next-hop-self

PE2

Z/p ! PR1 Z/p ! PR2

Additional-path


•  Initially BGP has been build to signal the best path only. For Fast Convergence, BGP need to signal multipath

and primary/backup path.

•  AF VPNv4 Unique RD: use Unique VPNv4 addresses. If using BGP policy (LP/MED, ...) then BGP Best External option allow to signalling the best eBGP learnt path (without withdrawing the received best internal path).

bgp advertise-best-external

•  AF IPv4 In some case BGP Add-path will be required

additional-paths {[receive][route-policy x]} + new Capability 69 in the BGP OPEN message

- 


Why SIDR?

•  Resiliency – eg. YouTube prefix hijack case http://www.networkworld.com/news/2009/011509-bgp-attacks.html

•  IPv4 Exhaustion & prefix trading security eg. Microsoft to buy Nortel’s IP space (7.5m USD – cca 11 USD per IP address) http://www.bbc.co.uk/news/technology-12859585

Current SIDR Work

•  Origin authentication only (AS_PATH tbd)

•  The RIRs maintain a database of all known address assignments

Route Origination Authorizations, or ROAs RPKI defined – X.509 certificates containing the

assigned AS and a prefix block

•  Each edge (eBGP) router in the network connects to a local server (database distributed through rsync over ssh)

•  Through this, the router determines if each advertisement is valid or not (local cache)

RIR

X.509 ROA

rsync

Srv

r-R

tr P

roto

col

Srv

r-R

tr P

roto

col

Srv

r-R

tr P

roto

col

Srv

r-R

tr P

roto

col


io_control thread Event thread Router thread

RPKI Cache

- Connection mgmt - Socket read/write - PDU processing and pfxv_table maintenance

Cache updates or Bestpath knob changes

- Event-driven prefix table walk to do validation + bestpath - Event-driven walk to calculate bestpath

- Update processing + in-line prefix validation

pfxv_table

bgp_pfxv_entry_t Key: <prefix/len>

bgp_pfxv_record_t Key: <prefix/len/maxlen> Sorted by maxlen

Prefix validation library

rpki-c2r library

Cache-to-router protocol Encoding / decoding routines

EFT/Beta available, tests show decent performance, ~10µs per prefix


MPLS-TP

Transport Profile


Working LSP

PE PE

Protect LSP

NMS for Network Management Control *

Client node Client node

MPLS-TP LSP (Static or Dynamic) Pseudowire

Client Signal

e2e and segment OAM Section Section

*Can use dynamic control plane (G.MPLS)

Connection Oriented, pre-determined working path and protect path Transport Tunnel 1:1 or 1+1 protection, switching triggered by in-band OAM, NMS for static provisioning, optional control plane for routing and signaling


MPLS-TP Standards Update !  11 IETF RFCs published

!  17 Working Group Drafts (4 in IETF editor’s Queue)

!  35 Individual Drafts Active 2008

History of T-MPLS and MPLS-TP

T-MPLS/PTN is not a standard!


IP/MPLS MPLS-TP T-MPLS/PTN Data Plane MPLS Forwarding MPLS Forwarding, with

- Bi-directional LSP - No PHP as default -  No ECMP -  Label 13 for OAM

Control Plane MPLS, Routing, TE & GMPLS

- Static provisioning - NMS -  GMPLS Control Plane

Static Only

OAM MPLS OAM Tools: - BFD (proactive) - LSP Ping (reactive) - VCCV

Extended MPLS OAM tools - New: AIS/RDI/LDI - New: Perforrmance Monitoring

Recovery Routing Protocols

MPLS-TE Fast Reroute

1+1, 1:1 and 1:n Path/Segment, Linear & Ring protection

Protection triggered by OAM

Based on ITU-T SONET/SDH-style Automatic Protection Switching

IP/MPLS MPLS-TP T-MPLS/PTN Compatibility with IP/MPLS YES YES NO

Compatibility with MPLS-TP YES YES NO

Easy migration to MPLS-TP or IP/MPLS YES YES NO

LTE suitable YES YES NO

Operational Impact:

Protocol Comparisons:


G-ACH OAM

Payload

GAL G-ACH OAM

Payload

GAL Label Label

G-ACH OAM

Payload

GAL Label

End-to-end LSP OAM

G-ACH OAM

Payload

Label PW Label

G-ACH OAM

Payload

Label

G-ACH OAM

Payload

Label Pseudowire OAM

PW Label PW Label

G-ACH OAM

Payload

GAL G-ACH OAM

Payload

GAL G-ACH OAM

Payload

GAL MPLS Section OAM

G-ACH OAM

Payload

GAL G-ACH OAM

Payload

GAL Label Label

MEP-to-MIP LSP OAM (TTL exp)

TTL=2 TTL=1


Function Description Tool

Continuity Check Checks ability to receive traffic BFD (Cisco CPT – 3.3ms hello)

Connectivity Verification Verifies that a packet reaches expected node BFD (proactive), LSP Ping (reactive)

Diagnostic Tests General diagnostic tests (e.g. looping traffic) New Route Tracing Discovery of intermediate and end points LSP Ping

Lock Instruct Instruct remote MEPs to lock path (only test/OAM traffic allowed) New

Lock Reporting Report a server-layer lock to a client-layer MEP New

Alarm Reporting Report a server-layer fault to a client-layer MEP New

Remote Defect Indication Report fault to remote MEP BFD

Client Failure Indication Client failure notification between MEPs PW Status

Packet Loss Measurement Ratio of packets not received to packets sent New

Packet Delay Measurement One-way / two-way delay (first bit sent to last bit received) New

!  Some functions require extensions to existing tools (e.g. BFD, LSP Ping)

!  Many proposals published as work group items yet


Multiservice Core"Aggregation" Edge" Core"Static MPLS-TP Access

IP/MPLS “Lite” Access

Ethernet Access

IP/MPLS “Lite” IP/MPLS IP/MPLS

L3 IP + Services Placement Circuit Emulation + Ethernet

Aggregation" Edge" Core"

Ethernet Access Static/Dynamic MPLS-TP IP/MPLS IP/MPLS

Static MPLS-TP Access

L3 IP + Services Placement


Next Generation

MWR

ME 3800X

ME 3600X

7600 ASR 9000

CPT50

CPT600

CPT200

UPD


TRILL

Transparent Interconnection of Lots of Links


•  Branches of trees never interconnect (no loop!!!)

!  Spanning Tree Protocol (STP) uses the same approach to build loop-free L2 logical topology

!  Over-subscription ratio exacerbated by STP algorithm

11 Physical Links (or Link Bundles)

5 Logical Links (or Link Bundles)


•  Assigned switch addresses to all TRILL/FabricPath enabled switches automatically (no user configuration required)

•  Compute shortest, pair-wise paths •  Support equal-cost paths between any TRILL/FabricPath

switch pairs

Plug-N-Play L2 IS-IS is used to manage forwarding topology

L1 L2

S1 S2 S3 S4

S11 S12 S42

L3

L4

FabricPath Routing Table

Switch IF

S1 L1

S2 L2

S3 L3

S4 L4

S12 L1, L2, L3, L4

… …

S42 L1, L2, L3, L4


•  TRILL/FabricPath header is imposed by the ingress switch •  Addresses assigned to ingress and egress switches are used

to make “Routing” decision •  No MAC learning required inside the L2 Fabric

Encapsulation to creates hierarchical address scheme

A C

S11 S42

C

A

DATA

C

A

DATA

TRILL/FabricPath

Header

Ingress Switch

S11

S42

Egress Switch

S11 " S42 TRILL/FabricPath Routing

L2 Bridging

A " C A " C

A " C


•  Support more than 2 active paths (up to 16) across the Fabric •  Increase bi-sectional bandwidth beyond port-channel •  High availability with N+1 path redundancy

Forwarding decision based on ‘TRILL/FabricPath Routing Table’

A

L1 L2

S1 S2 S3 S4

S11 S12 S42

L3

L4

C

Switch IF

… …

S42 L1, L2, L3, L4

MAC IF

A 1/1

… …

C S42 1/1


•  Several ‘Trees’ are rooted in key location inside the fabric •  All Switches in L2 Fabric share the same view for each ‘Tree’ •  Multicast traffic load-balanced across these ‘Trees’

Forwarding through distinct ‘Trees’

A C

Root for Tree #1

Root for Tree #2

Root for Tree #3

Root for Tree #4

Ingress switch for TRILL/ FabricPath decides which “tree” to be used and add tree number in the header


•  NHDA & NHSA are MAC addresses used to cross a legacy Ethernet Cloud

•  V = Version

•  R = Reserved

•  M = Multi-destination

•  Opl = Option Length

•  Hop_Count = TTL

•  Egress Nickname = ODA

•  Ingress Nickname = OSA


•  FabricPath bridges support multiple logical topologies over a single physical network, for example, by assigning different cost sets to the links

encoded Egress Bridge Nickname (ODA)

encoded Ingress Bridge Nickname (OSA) • Switch ID: Unique ID of each L2 Fabric device • Sub-Switch ID: to identify vPC+ pair (MC-LAG) • Tree ID: Unique ID of each distribution “Tree”

Tree ID = topology selector


TRILL FabricPath SPB (802.1aq ) OTV A-VPLS

Standard Yes (IETF, end 2010)

No (Cisco pre-standard TRILL)

Yes (IEEE, end 2011) IETF IETF

Data Plane VLAN + TRILL header

VLAN-like header (upgradable to

TRILL)

MAC Learning (QinQ, MAC-in-

MAC) IP MPLS PW

over IP

Outer MAC swapping hop-by-hop hop-by-hop end-to-end hop-by-

hop end-to-

end

Loop Avoidance TTL TTL, RFP RPF TTL, RPF TTL, RPF

Control Plane ISIS ISIS ISIS ISIS, PIM LDP, Mac Learning

Implementation 2011? 2010 2012? 2010 2011

IXP, Supercomputing MAN? DCI DCI


32 Chassis

16 Chassis

16-way ECMP

8,192 10GE user ports per System 512 10GE FabricPath ports per box

256 10GE FabricPath Ports

160 Tbps System Bandwidth (8K end-user 10GE ports)

Open I/O Slots for connectivity

Spine Switch

Edge Switch 16-port Etherchannel

Nexus 7000 (32x TGE – F1 modules)

HPC Requirements

•  HPC Clusters require high-density of compute nodes

•  Minimal over-subscription

•  Low server to server latency

FabricPath Benefits for HPC

!  FabricPath enables building a high-density fat-tree network

!  Fully non-blocking with FabricPath ECMP & port-channels

!  Minimize switch hops to reduce server to server latencies


Nexus 7000 or Nexus 5500

IXP Requirements !  Layer 2 Peering enables multiple

providers to peer their internet routers with one another

!  10GE non-blocking fabric

!  Scale to thousands of ports

FabricPath Benefits for IXP !  Transparent Layer 2 fabric

!  Scalable to thousands of ports

!  Bandwidth not limited by chassis / port-channel limitations

!  Simple to manage, economical to build

Provider A Provider B

Provider C Provider D


3.3S FEATURES

•  AS-PATH transparency

•  MED transparency

•  Next Hop transparency

•  IPv4 and IPv6 support

•  Unicast/Multicast support

•  4 bytes ASN support

•  HA (GR, SSO, ISSU) support (hardware: ASR1000 – 4/8/16GB DRAM)

•  Per customer policy support with per customer's policy dedicated RIBs

•  BFD for peer's liveness

•  CLI and XML support

•  All standard IOS BGP functionality, monitoring and debugging

AS1

AS2

AS3

AS4

AS5

AS6

BR

BR

BR

BR

BR

BR

Route Server eBGP

IXP

RS

neighbor <ipv4 | ipv6> route-server-client [context <x>]


•  More than 10 IETF WGs produced significant routing protocol work this last year.

•  Trends Convergence, Availability and Scalability

IGP LFA FRR PIM MoFRR BGP PIC & Path Diversity (LISP)

Security SIDR

Reuse of Routing Technology TRILL

Evolution of MPLS MPLS-TP (Transport Profile)

•  What should the future bring?


Prosíme, ohodno!te tuto p"edná#ku.

Kód p"edná#ky


•  Zájemci si mohou vyzkou!et dual-stack p"ístup na Internet

•  P"ipojte se k SSID CiscoExpov6 (otev"en# p"ístup) B$%né OS dostanou IPv6 adresu automaticky pomocí SLAAC a zjistí IPv6 adresy web& p"es b$%né DNS (Win7, Vista, MacOS, Linux, nov$j!í verze iPhone iOS, Android, Symbian)

•  Jak zjistím, %e mi IPv6 funguje? www.whatismyipv6.net - jaká je moje IPv6 adresa? www.kame.net - vidíte tan'ící %elvi'ku? Bez DNS: http://[2001:200:dff:fff1:216:3eff:feb1:44d7]

ShowIP add-on pro Firefox – uká%e IPv6 adresu serveru z DNS (AAAA záznam) Terminál: ping6 ipv6.google.com, ping6 2a00:1450:8002::6a

•  Co d$lat na IPv6 Internetu? www.v6.facebook.com - napi!te si status update po IPv6 ipv6.google.com - n$co si najd$te po IPv6 Zkoukn$te co se d$je – ipv6.novinky.cz, ipv6.lupa.cz, root.cz, ipv6.cnn.com,... Dal#í IPv6 tipy – mapy.cz, justice.cz, ietf.org, nic.cz, he.net, ipv6day.org

www.ipv6.cisco.com

ietf routing (and switching) update

Documents