| RFC 8957 | MPLS FL | January 2021 |
| Bryant, et al. | Standards Track | [Page] |
RFC 8372 ("MPLS Flow Identification Considerations") describes the requirement for introducing flow identities within the MPLS architecture. This document describes a method of accomplishing this by using a technique called "Synonymous Flow Labels" in which labels that mimic the behavior of other labels provide the identification service. These identifiers can be used to trigger per-flow operations on the packet at the receiving label switching router.¶
This is an Internet Standards Track document.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc8957.¶
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
[RFC8372] ("MPLS Flow Identification Considerations") describes the requirement for introducing flow identities within the MPLS architecture.This document describes a method of providing the required identification by using atechnique called "Synonymous Flow Labels (SFLs)" inwhich labels that mimic the behavior of other MPLS labels provide theidentification service. These identifiers can be used to triggerper-flow operations on the packet at the receiving label switchingrouter.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶
An SFL is defined to be a label that causes exactly the samebehavior at the egress Label Edge Router (LER) as the label itreplaces, except that it also causes one or more additional actions that havebeen previously agreed between the peer LERs to be executed on the packet. There are many possible additional actions, such asmeasuring the number of received packets in a flow,triggering an IP Flow Information Export (IPFIX)[RFC7011] capture, triggering other types of deep packet inspection, or identifying the packet source. For example, ina Performance Monitoring (PM) application, the agreed action could berecording the receipt of the packet by incrementing a packetcounter. This is a natural action in many MPLS implementations, andwhere supported, this permits the implementation of high-qualitypacket loss measurement without any change to the packet-forwardingsystem.¶
To illustrate the use of this technology, we start by consideringthe case where there is anapplication label in the MPLS label stack.As a first example, let us consider apseudowire (PW)[RFC3985] on which it is desired to makepacket loss measurements. Two labels, synonymous with the PW labels, are obtainedfrom the egress terminating provider edge (T-PE). By alternatingbetween these SFLs and using them in place of the PW label, the PWpackets may be batched for counting without any impact on the PWforwarding behavior[RFC8321] (note thatstrictly only one SFL is needed in this application, but that is an optimization that is a matter forthe implementor). The method of obtaining these additionallabels is outside the scope of this text; however,one control protocol that provides a method of obtaining SFLs is described in[MPLS-SFL-CONTROL].¶
Next, consider an MPLS application that is multipoint to point, such asa VPN. Here, it is necessary to identify a packet batch from aspecific source. This is achieved by making the SFLs sourcespecific, so that batches from one source are marked differently frombatches from another source. The sources all operate independentlyand asynchronously from each other, independently coordinating withthe destination. Each ingress LER is thus able to establish its own SFLto identify the subflow and thus enable PM per flow.¶
Finally, we need to consider the case where there is no MPLSapplication label such as occurs when sending IP over a Label Switched Path(LSP), i.e., there is a single label in the MPLS label stack. In this case, introducing an SFL that was synonymous with the LSP labelwould introduce network-wide forwarding state. This would not beacceptable for scaling reasons. Therefore, we have no choice but tointroduce an additional label. Where penultimate hop popping (PHP)is in use, the semantics of this additional label can be similar tothe LSP label. Where PHP is not in use, the semantics are similar toan MPLS Explicit NULL[RFC3032]. In both ofthese cases, the label has the additional semantics of the SFL.¶
Note that to achieve the goals set out above, SFLs need to beallocated from the platform label table.¶
As noted inSection 3, it is necessary to consider two cases:¶
Figure 1 shows the case in which both an LSP label and an application label are present in the MPLS label stack. Traffic with no SFLfunction present runs over thenormal stack, and SFL-enabled flowsrun over the SFL stack with the SFL used to indicate the packetbatch.¶
+-----------------+ +-----------------+ | LSP | | LSP | | Label | | Label | | (May be PHPed) | | (May be PHPed) | +-----------------+ +-----------------+ | | | | | Application | | Synonymous Flow | | Label | | Label | +-----------------+ <= BoS +-----------------+ <= Bottom of Stack | | | | | Payload | | Payload | | | | | +-----------------+ +-----------------+"Normal" Label Stack Label Stack with SFL
At the egress LER, the LSP label is popped (if present). Then, the SFL is processed executing both the synonymous function and the corresponding application function.¶
The TTL and the Traffic Class bits[RFC5462] in the SFL label stack entry (LSE) would normally be set to the same value as would have been set in the labelthat the SFL is synonymous with. However, it is recognized that, if thereis an application need, these fields in the SFL LSEMAY be set to some other value. An example would be where it was desired to cause the SFL to trigger anaction in the TTL expiry exception path as part of the label action.¶
Figure 2 shows the case in which only an LSP label is present in the MPLS label stack. Traffic with no SFL function present runs over the"normal" stack, and SFL-enabled flows run over the SFL stack with theSFL used to indicate the packet batch. However, in this case, it isnecessary for the ingress Label Edge Router (LER) to first push the SFL and then to push the LSP label.¶
+-----------------+ | LSP | | Label | | (May be PHPed) | +-----------------+ +-----------------+ | LSP | | | <= Synonymous with | Label | | Synonymous Flow | Explicit NULL | (May be PHPed) | | Label | +-----------------+ <= BoS +-----------------+ <= Bottom of Stack | | | | | Payload | | Payload | | | | | +-----------------+ +-----------------+"Normal" Label Stack Label Stack with SFL
At the receiving Label Switching Router (LSR), it is necessary to consider two cases:¶
If the LSP label is present, it is processed exactly as it would normally be processed, and then it is popped. This reveals the SFL, which, in the case of the measurements defined in[RFC6374], is simply counted and then discarded. In this respect, the processing of the SFL is synonymous with an MPLS Explicit NULL. As the SFL is the bottom of stack, the IP packet that follows is processed as normal.¶
If the LSP label is not present due to PHP action in the upstreamLSR, two almost equivalent processing actions can take place.The SFL can be treated either 1) as an LSP label that was not PHPed and theadditional associated SFL action is taken when the label isprocessed or 2) as an MPLS Explicit NULL withassociated SFL actions. From the perspective of the measurementsystem described in this document, the behavior of the two approaches is indistinguishable; thus, either may be implemented.¶
The TTL and the Traffic Class considerations described inSection 4.1.1 apply.¶
There are cases where it is desirable to aggregate an SFL actionagainst a number of labels, for example, where it is desirable tohave one counter record the number of packets received over a groupof application labels or where the number of labels used by a singleapplication is large and the resultant increase in the number ofallocated labels needed to support the SFL actions maybecome too large to be viable. In these circumstances, it would benecessary to introduce an additional label in the stack to act as anaggregate instruction. This is not strictly a synonymous action inthat the SFL is not replacing an existing label but is somewhatsimilar to the single-label case shown inSection 4.2, and the samesignaling, management, and configuration tools would be applicable.¶
+-----------------+ | LSP | | Label | | (May be PHPed) | +-----------------+ +-----------------+ | LSP | | | | Label | | Aggregate | | (May be PHPed) | | SFL | +-----------------+ +-----------------+ | | | | | Application | | Application | | Label | | Label | +-----------------+ <=BoS +-----------------+ <= Bottom of Stack | | | | | Payload | | Payload | | | | | +-----------------+ +-----------------+"Normal" Label Stack Label Stack with SFL
The aggregate SFL is shown in the label stack depicted inFigure 3 as preceding the application label; however, the choice of positionbefore or after the application label will be application specific.In the case described inSection 4.1, by definition, the SFL has thefull application context. In this case, the positioning will dependon whether the SFL action needs the full context of the applicationto perform its action and whether the complexity of the applicationwill be increased by finding an SFL following the application label.¶
The introduction of an SFL to an existing flow may cause that flow to takea different path through the network under conditions of Equal-CostMultipath (ECMP). This, in turn, may invalidate certain uses ofthe SFL, such as performance measurement applications. Where this isa problem, there are two solutions worthy of consideration:¶
IETF concerns on pervasive monitoring are described in[RFC7258]. The inclusion of originating and/or flow information in a packet provides more identity information and hence potentially degrades the privacy of the communication to an attacker in a position to observe the added identifier. Whilst the inclusion of the additional granularity does allow greater insight into the flow characteristics, it does not specifically identify which node originated the packet unless the attacker can inspect the network at the point of ingress or inspect the control protocol packets. This privacy threat may be mitigated by encrypting the control protocol packets by regularly changing the synonymous labels or by concurrently using a number of such labels, including the use of a combination of those methods. Minimizing the scope of the identity indication can be useful in minimizing the observability of the flow characteristics. Whenever IPFIX or other deep packet inspection (DPI) technique is used, their relevant privacy considerations apply.¶
There areno new security issues associated with the MPLS data plane. Anycontrol protocol used to request SFLs will need to ensure thelegitimacy of the request, i.e., that the requesting node is authorizedto make that SFL request by the network operator.¶
This document has no IANA actions.¶