LARGE SCALE IP ROUTING LECTURE BY SEBASTIAN GRAF

Transcription

1 LARGE SCALE IP ROUTING LECTURE BY SEBASTIAN GRAF MODULE 05 MULTIPROTOCOL LABEL SWITCHING (MPLS) AND LABEL DISTRIBUTION PROTOCOL (LDP) 1 by Xantaro

2 IP Routing In IP networks, each router makes an independent forwarding decision IP address in header is analyzed and longest match routing lookup is done Choose next hop for the IP packet (hop-by-hop model) IP header contains more information than needed to simply choose next hop Longest Match Lookup was quite resource intensive in the past as there are multiple possible matches 2 by Xantaro

3 Longest Match Lookup Revisited Consider the following routing table /32, nexthop = /26, nexthop = /28, nexthop = A Router will convert these addresses to binary <= last octet has to be 70 to match <= last octet can be between 64 and 127 to match <= last octet can be between 64 and 79 to match The bit boundary ( ) identifies which part of an incoming packet has to match in order to follow this route The first prefix has a prefix length of 32 bits, therefore the whole address has to match to follow this route For the second route, the first 26 bits have to match in order to follow that route Similar, the third route can be followed if an incoming packet matches the first 28 bits 3 by Xantaro

4 Longest Match Lookup Revisited Example 1 Destination address of incoming packet is converted to binary and compared All red positions have to be the same for an incoming packet to get a match route 1: route 2: route 3: Example 1 : IP Destination = incoming: route 1 does not match, because the last octet is not equal to route 2 matches because the last octet starts with 01 route 3 matches because the last octet starts with 0100 In this case route 2 and 3 matches, but route 3 is selected, because it is considered to be a better match route 3 subnet mask length is /28 which is longer than /26 of route 2 4 by Xantaro

5 Longest Match Lookup Revisited Example 2 Destination address of incoming packet is converted to binary and compared All red positions have to be the same to get a match route 1: route 2: route 3: Example 1 : IP Destination = incoming: route 1 matches because the last octet is equal to route 2 matches because the last octet starts with 01 route 3 matches because the last octet starts with 0100 In this case all routes match, but route 1 is selected, because it is considered to be a better match route 1 subnet mask length is /32 which is longer than /26 of route 2 and /28 of route 3 5 by Xantaro

6 Longest Match Lookup Revisited Example 3 Destination address of incoming packet is converted to binary and compared All red positions have to be the same to get a match route 1: route 2: route 3: Example 1 : IP Destination = incoming: route 1 does not match because the last octet is not equal to route 2 matches because the last octet starts with 01 route 3 does not match because the last octet does not start with 0100 In this case only route 3 matches, so the packet will follow this path 6 by Xantaro

7 MPLS Overview In the 90s routing tables and traffic started to grow exponential in the Internet routing systems were considered to not keep pace with this development A simpler forwarding mechanism should reduce the load on routers forwarding based on a label attached to a packet each label results in exactly one forwarding decision (no longest match) concept borrowed from ATM networks Multiprotocol Label Switching (MPLS) is a base technology that integrates the label forwarding paradigm with network layer routing MPLS WG within IETF chartered in 1997 to support multilayer switching Simplify prefix lookup for forwarding decisions Improves price/performance of network layer routing Improves scalability Provides greater flexibility in delivery of (new) routing services MPLS Layer-2/Layer-3 VPNs Traffic Engineering 7 by Xantaro

8 Tao of MPLS MPLS architecture has two separated components: Forwarding Plane and Control Plane MPLS network consists of Label Edge Router (LER) or Provider Edge (PE) router Label Switching Router (LSR) or Provider (P) router Packet transport is done from one PE to another PE using a unidirectional tunnel known as Label Switched Path (LSP) Packets entering MPLS network are classified into Forwarding Equivalence Classes (FECs) which are mapped to LSPs Packet forwarding on LSRs is based on labels, not on IP header information similar to other layer-2 forwarding mechanisms (ATM, FR, ) no reclassification of packets once labeled 8 by Xantaro

9 MPLS Tunnel Label Switched Path (LSP) is an unidirectional tunnel from ingress LER (head end) to egress LER (tail end) via zero or more transit LSRs Transit LSRs will make a forwarding decision only based on MPLS labels Ingress and egress LER make a forwarding decision based on traditional lookups e.g. IP destination address Transit routers do not even need to understand the payload protocol 9 by Xantaro

10 Forwarding Plane Mechanisms Forwarding Decisions are based on labels, i.e. fixed length, locally significant identifier used to represent a Label Switch Path (LSP) Two LSRs agree that packets belonging to a certain LSP are labeled when transmitted from one of them to the other Mapping from label L to forwarding equivalence class F is called label binding Label L becomes outgoing label of the upstream LSR and ingress label of the downstream LSR 10 by Xantaro

11 Label Encapsulation Label format depends on the encapsulation type Label stack entries appear after the data link header, but before any network layer header Type Code 0x8847 used for Ethernet, HDLC, GRE, LLC/SNAP (e.g. ATM or Frame Relay) LSRs always forward packets based on the label at the top of the stack More than one label can be used (label stack) 32 bit length 20 bit label value 3 experimental bits used for CoS (nowadays called Traffic Class) Bottom of Stack bit (set to one for the last label of a label stack) Time to Live (same as with IP Routing) 11 by Xantaro

12 Label Operation Label operations are only done at the top of the label stack LSR and LERs can perform various label operations on a packet Push: Add a new label to the packet Pop: Remove label from the label stack Swap: Replace label with a new label Multiple Push: Add multiple labels to the packet Swap and Push: Replace existing label with a new label, and then push another label on top 12 by Xantaro

13 Control Plane Mechanisms Label Switched Paths are dynamically established using a label distribution protocol to exchange label/fec bindings MPLS architecture always uses downstream-assigned labels Different protocols capable of label distribution are available Label Distribution Protocol (LDP) Constraint-Routing LDP (CR-LDP) => deprecated Resource Reservation Protocol (RSVP) Border Gateway Protocol (BGP) Also static allocation is possible but does not scale well 13 by Xantaro

14 Label Distribution: Routing Convergence Label Distribution is not routing. IGP convergence is a prerequisite! 14 by Xantaro

15 Label Distribution: Label Assignment Labels are distributed between routers and can afterwards be used forwarding These labels only have a local significance the same labels may be reused by multiple routers e.g. R2 may use Label 218 for a different prefix than R3 15 by Xantaro

16 MPLS Packet Forwarding LSRs forward packets based on labels In this example R3 still has to learn all routes, but it can forward based on labels Longest Prefix match only done on R1 and R5, but not on R3 16 by Xantaro

17 Penultimate Hop Popping (PHP) When egress LSR receives a labeled packet it must first lookup the top label to detect, that it is the egress LSR remove the top label forward the packet based on another label or layer-3 header Penultimate Hop Popping avoids two lookups Label at top of the stack is removed by upstream neighbor of egress LSR Signaling is done using implicit null label some routers do this per default, others have to be configured to do that On modern platforms the double lookup is usually no longer a problem but many networks are still built with PHP enabled for historic reasons 17 by Xantaro

18 MPLS Frame Forwarding with PHP Penultimate LSRs pops upper-most label and forwards frame There is never a label with value 3 (implicit null) encoded 18 by Xantaro

19 Time-to-Live (TTL) In IP forwarding, the Time-to-Live (TTL) value in the IP header is decremented by one while passing through a router Protection against forwarding loops Provides additional functions (multicast scoping and traceroute) In MPLS, the TTL is copied from the label or the IP packet immediately underneath it. Each intermediate LSR decrements the TTL by one. if the TTL becomes zero the packet is discarded as with IP routing MPLS TTL should be copied into the IP header TTL field when it emerges from the LSP (default) however this can be changed to hide core network. 19 by Xantaro

20 Downstream vs. upstream upstream and downstream are relative terms referring to the packet flow for a certain prefix or FEC downstream is referring to the direction of traffic flow upstream is identifying the router that has sent a packet to the local router /24 R1 R /24 R1 is the downstream router for R2 to reach prefix /24 R2 is the upstream router from the perspective of R1 for prefix /24 R2 is the downstream router from the perspective of R1 for prefix /24 R1 is the upstream router from the perspective of R2 for prefix /24 For Label Assignment that means R1 has to assign a label for /24 and inform R2 about that R2 has to assign a label for /24 and inform R1 about that 20 by Xantaro

21 Label Distribution Label Assignment downstream unsolicited: downstream LSR advertises label bindings for all destinations reachable via itself downstream-on-demand : upstream LSRs explicitly asks for label binding Label Retention Mode liberal label retention: LSR keeps track of all bindings whether they are learned from the next hop or not conservative label retention: LSR only keeps bindings that are actually used and discards all bindings not learned from next hop and thus not used for forwarding Label Distribution Mode independent: label allocation is done independent of other LSRs ordered: labels are allocated only after bindings from other LSRs are received Which of these principals is used depends on protocol and platform 21 by Xantaro

22 Label Assignment downstream unsolicited: downstream LSR advertises label bindings for all destinations reachable via itself /24 R1 Please use Label if you send traffic for prefix /24 to me R /24 downstream-on-demand : upstream LSRs explicitly asks for label binding /24 R1 Please give me a label that I should use for prefix /24 Please use Label if you send traffic for prefix /24 to me R /24 LDP uses downstream unsolicited, whereas RSVP used downstream-on-demand 22 by Xantaro

23 Liberal Retention Mode R1 knows according to IGP metric that R3 is the best next-hop to reach R4 therefore it will use R3 as next-hop for prefix /24 it will also use label 567 to forward traffic to R3 With liberal retention mode, R1 will also store Label 678 this is beneficial in case of network convergence, when R2 becomes the best next-hop for prefix /24 in case of failure on R3 in case the metric changes so that R2 becomes the best next-hop / /24 = Label 567 R1 R /24 = Label 345 R / /24 = Label 678 R /24 = Label by Xantaro

24 Conservative Retention Mode With conservative retention mode, R1 will discard Label 678, as it is not used for forwarding this save resources on R1 but is bad in case of network convergence, as there is no backup LSP remember that memory on the control plane is usually not an issue these days therefore liberal retention mode is usually been used / /24 = Label 567 R1 R /24 = Label 345 R / /24 = Label 678 R /24 = Label by Xantaro

25 Independent Label Distribution With independent Label Distribution Mode, a LSR will advertise a label for a prefix that is known by the IGP regardless of whether the downstream LSR has already done that In our example, R3 and R2 advertised a Label to R1 for prefix /24, although the downstream LSR R4 has not done that yet (e.g. because it is busy with other operation) This speeds up the establishment of Label Switch Paths, but can create black-hole routing, as there is no end-to-end LSP /24 = Label 567 R /24 R R / /24 = Label 678 R2 25 by Xantaro

26 Ordered Label Distribution With ordered Label Distribution Mode, a LSR will advertise a label for a prefix that is known by the IGP only, if it already got a label binding from it s downstream LSR In our example, R3 and R2 advertised a Label to R1 for prefix /24, only after they have received a Label binding from their downstream LSR R4 for this prefix This slows down the establishment of Label Switch Paths, but ensures no end-toend LSPs / /24 = Label 567 R1 R /24 = Label 345 R / /24 = Label 678 R /24 = Label by Xantaro

27 LDP Overview Label Distribution Protocol (LDP) is a protocol defined for dynamically distribution label according to MPLS architecture Defines procedures and messages to establish an LSP Creates Forwarding Equivalence Classes (FEC) No traffic-engineering supported LDP does not perform routing relies on OSPF or ISIS for SPF calculation LDP is defined in RFC 5036 (which obsoletes RFC 3036) 27 by Xantaro

28 Relationship between LDP and IGP LDP establishes Label Switched Paths (LSPs) which always follow the interior gateway protocol (IGP) shortest path LDP only installs LSPs when both IGP and LDP are enabled Policies can be used to control LSP establishment by filtering labels received from or sent to other routes LDP-established LSPs cannot traverse AS boundaries mainly because ISIS and OSPF cannot cross these boundaries as well IGP convergence time defines a lower bound on LDP convergence time During network re-convergence, traffic maybe blackholed 28 by Xantaro

29 LDP Operation LDP message types include Discovery (Hello) Initialization Advertisements (e.g. Label mapping/request or address messages) Notification 29 by Xantaro

30 LDP Label Space and LDP Sessions Label Space defines on which scope a label is valid Per-interface label space - label X has a different meaning depending on which interface it is received Per-Platform label space - label X has the same meaning for a router regardless over which interface it is received - usually in Ethernet based MPLS networks, systems make use of a per platform label space LDP Identifier Used to identify label space (consists of Router ID and label space ID) LDP sessions exist between label switch routers to support label exchange between them A separate LDP session is used for each label space but as usually each router only has one label space, only one session is required 30 by Xantaro

31 LDP Neighbor Discovery LDP uses a discovery mechanism to find potential LDP peers Basic discovery Used to find neighbors directly connected at the link Periodically send LDP Link Hellos on all router multicast address as UDP packets to port 646 Extended discovery Used to locate neighbors not directly connected Periodically send LDP Targeted Hellos to a specific address as UDP packets to port 646 Receipt of Hello packet indentifies Hello adjacency LDP Hello packets include Common Hello Parameters TLV 31 by Xantaro

32 LDP Session Establishment Exchange of LDP Discovery messages between LSR triggers session setup LDP sessions are established based on label spaces LDP session is always initiated by the router with the higher transport address (active node); other one is passive node Active node establishes TCP connection (called transport connection) to port 646 between LDP transport addresses Active node sends LDP Initialization message to negotiate session parameters 32 by Xantaro

33 Maintaining LDP Adjacencies LDP session with peer has one or more Hello adjacencies depending on the number of links that share the same label space Hello adjacency maintained by receipt of LDP Discovery Hellos which are periodically sent (hello timer) If hold timer expires, LDP concludes that peer no longer wants to use this label space for that interface LDP also includes a mechanism to monitor integrity of the LDP session LDP messages must be received within keepalive period If no exchange of LDP messages required, at least a keepalive messages is sent 33 by Xantaro

34 Label Distribution and Management LDP peer advertises IPv4 interface addresses for all LDP-enabled interfaces Uses LDP Address messages and Address Withdraw messages Allows receiving LSR to associate future label advertisements with physical next-hop address for local router Label values are advertised using Label Mapping messages and Label Withdraw message Information stored away in Label Information Base (LIB) 34 by Xantaro

35 Example for active LDP sessions This example shows a router that has LDP neighbors on 2 interfaces note that both neighbors use the same Label space ID seems like it is the same neighbor on both links show ldp interface Interface Label space ID Nbr count Next hello ge-0/0/ :0 1 3 ge-0/0/ :0 1 2 show ldp interface extensive Interface Label space ID Nbr count Next hello ge-0/0/ :0 1 0 Hello interval: 5, Hold time: 15, Transport address: Local hello interval: 5, Index: 67 Hello Sent: 2809, Received: 2818 ge-0/0/ :0 1 3 Hello interval: 5, Hold time: 15, Transport address: Local hello interval: 5, Index: 68 Hello Sent: 2818, Received: by Xantaro

36 Example for LDP Label database Displays entries in the LDP database (label information base) For each neighbor a router will store labels received from a neighbor (input) and labels send to a neighbor (output) show ldp database Input label database, : :0 Label Prefix / / / /32 Output label database, : :0 Label Prefix / / / /32 36 by Xantaro

37 LDP input Database in human language The input label database tells our local router Munich which labels it should use when it wants to send traffic towards the LDP neighbor if Munich wants to send packets via this neighbor it has to use label 3 if traffic is going to /32 (Penultimate Hop Popping) use label if traffic is going to use label if traffic is going to use label if traffic is going to Munich may receive different label bindings for the same destination from another router IGP will decide which next-hop (and thus) label to use show ldp database Input label database, : :0 Label Prefix / / / /32 37 by Xantaro

38 LDP output Database in human language The out label database tells the other router which labels it should use if it wants to send traffic to the local router Munich if the remote router wants to send packets to the local router Munich it has to use label if traffic is going to use label if traffic is going to use label 3 if traffic is going to /32 (Penultimate Hop Popping) use label if traffic is going to Munich will advertise the same labels to other neighbors therefore it does not matter on which incoming interface a packet is received it always results in the same action (per platform label space) show ldp database Output label database, : :0 Label Prefix / / / /32 38 by Xantaro

39 Recap : ibgp / IGP relation After IGP convergence R3 and R1 can establish an ibgp session Once the ibgp session is created, R1 sends a prefix towards R3 using it s loopback address as next-hop R3 will do a recursive routing lookup by checking it s routing table for the next-hop of than it will use the resolved next-hop ( ) for the prefix As traffic from R3 towards /24 will hit R2, it also needs to know the next hop R2 needs to have an ibgp session with R1 as well (not shown here) IGP IGP Loopback /32 Loopback /32 Loopback /32 R / / / /30 R2 ibgp Prefix /24 Next-Hop R3 39 by Xantaro

40 ibgp / IGP relation with MPLS After IGP convergence R3 and R1 can establish an ibgp session Once the ibgp session is created, R1 sends a prefix towards R3 using it s loopback address as next-hop R3 will do a recursive routing lookup by checking it s routing table for the next-hop of if it finds a Label Binding 456 from R2 to reach , it can use this label to forward the packet R2 performs forwarding based on the Label 456 and knows that it should forward to packet to R1 and swap the label to 123 As a consequence, R2 does not need to know Prefix /24 (it also does not need to run BGP) as it forwards based on the MPLS label, not the IP header IGP IGP Loopback /32 Loopback /32 Loopback /32 Prefix /32 = Label 123 Prefix /32 = Label by Xantaro R1 R2 ibgp Prefix /24 Next-Hop R3

41 ibgp / IGP packet flow with MPLS Here you can see the packet flow after IGP, LDP and BGP convergence 1. R3 receives an IP Packet with Destination Address R3 makes a routing lookup and finds a BGP route towards with next-hop of R1 s loopback address R3 received a label binding from R2 for /32 and the label to use is R3 pushed Label 456 and sends the packet to R2 5. R2 makes a forwarding decision based on Label 456. The decision is to swap the label to 123 and send the Packet to R1 6. R1 pops the label and makes a forwarding decision based on the destination address If R1 would advertise routes towards R3, all routers could use the same labels for forwarding R2 is not impacted on the number of BGP routes between R1 and R3 DST: R1 Label 123 DST: R2 Label 456 DST: R3 DST: by Xantaro

42 ibgp / IGP packet flow with MPLS and PHP R1 may optionally advertise Label value 3 towards R2 to reach /32 this is a special label called implicit-null that instructs the upstream LSR (in this case R2) to pop the outer label In this case R1 does not need to pop the label before doing the IP lookup Depending on the routing platform this may increase performance modern platforms do no longer need this, but many still use that as default A label value of 3 must never be seen on a packet in the forwarding plane! Prefix /32 = Label 3 Prefix /32 = Label 456 DST: R1 DST: R2 Label 456 DST: R3 DST: by Xantaro

43 Special MPLS Labels The following special labels are currently defined Value Description defined in 0 IPv4 Explicit Null RFC Router Alter Label RFC IPv6 Explicit Null RFC Implicit Null RFC Unassigned 7 Entropy Label Indicator RFC Unassigned 13 GAL RFC OAM Alert RFC Extension Label RFC7274 Routing Platforms may choose a strategy to allocate labels for prefixes and services using values larger than by Xantaro