Carrying Label Information for BGP FlowSpec

Introduction This section provides the background for proposing a new action for BGP Flow specification that push/pops MPLS or swaps MPLS tags. For those familiar with BGP Flow specification (, , , , and MPLS () can skip this background section. provides updates to to resolve unclear sections in text and conflicts with interactions of filtering actions.

Background defines the flow specification (FlowSpec) that is an n-tuple consisting of several matching criteria that can be applied to IP traffic. The matching criteria can include elements such as source and destination address prefixes, IP protocol, and transport protocol port numbers. A given IP packet is said to match the defined flow if it matches all the specified criteria. also defines a set of filtering actions, such as rate limit, redirect, marking, associated with each flow specification. A new Border Gateway Protocol Network Layer Reachability Information (BGP NLRI) (AFI/SAFI: 1/133 for IPv4, AFI/SAFI: 1/134 for VPNv4) encoding format is used to distribute traffic flow specifications. [Note: updates .] specifies the way in which the label mapping information for a particular route is piggybacked in the same Border Gateway Protocol Update message that is used to distribute the route itself. Label mapping information is carried as part of the Network Layer Reachability Information (NLRI) in the Multiprotocol Extensions attributes. The Network Layer Reachability Information is encoded as one or more triples of the form <length, label, prefix>. The NLRI contains a label is indicated by using Subsequent Address Family Identifier (SAFI) value 4. describes a method in which each route within a Virtual Private Network (VPN) is assigned a Multiprotocol Label Switching (MPLS) label. If the Address Family Identifier (AFI) field is set to 1, and the SAFI field is set to 128, the NLRI is an MPLS-labeled VPN-IPv4 address.

MPLS Flow Specification Deployment In BGP VPN/MPLS networks when flow specification policy rules exist on multiple forwarding devices in the network bound with labels from one or more LSPs, only the ingress LSR (Label Switching Router) needs to identify a particular traffic flow based on the matching criteria for flow. Once the flow is match by the ingress LSR, the ingress LSR steers the packet to a corresponding LSP (Label Switched Path). Other LSRs of the LSP just need to forward the packet according to the label carried in it.

Terminology This section contains definitions of terms used in this document.

Flow Specification (FlowSpec): A flow specification is an n-tuple consisting of several matching criteria that can be applied to IP traffic, including filters and actions. Each FlowSpec consists of a set of filters and a set of actions.

Overview of Proposal This document proposes adding a BGP-FS action in an extended community alters the label switch path associated with a matched flow. If the match does not have a label switch path, this action is skipped. The BGP flow specification (BGP-FS) policy rule could match on the destination prefix and then utilize a BGP-FS action to adjust the label path associated with it (push/pop/swap tags.) Or a BGP-FS policy rule could match on any set of BGP-FS match conditions associated with a BGP-FS action that adjust the label switch path (push/pop/swap). provides a match BGP-FS that may be used with this action to match and direct MPLS packets. Example of Use: Forwarding information for the traffic from IP1 to IP2 in the Routers: ) --> out(Label2) ASBR1: in(Label2) --> out(Label3) ASBR2: in(Label3) --> out(Label4) PE2: in(Label4) --> out(--)]]> Labels allocated by flow policy process: | |<------AS2----->| +-----+ +-----+ +-----+ +-----+ VPN 1,IP1..| PE1 |====|ASBR1|----|ASBR2|====| PE2 |..VPN1,IP2 +-----+ +-----+ +-----+ +-----+ | LDP LSP1 | | LDP LSP2 | | -------> | | -------> | |-------BGP VPN Flowspec LSP---->| (Label1) (Label2) (Label3) (Label4) Figure 1: Usage of FlowSpec with Label ]]> BGP-FS rule1 (locally configured): Note: The following Extended Communities are added/deleted

Protocol Extensions In this document, BGP is used to distribute the FlowSpec rule bound with label(s). A new label-action is defined as BGP extended community value based on Section 7 of . Label-action is described below: The use and the meaning of these fields are as follows:

Type: the same as defined in
OpCode: Operation code
- When the Opcode field is set to 0, the label stack entry Should be pushed on the MPLS label stack.
- When the OpCode field is set to 1, the label stack entry is invalid, and the router SHOULD pop the existing outermost MPLS tag in the packet.
- When the OpCode field is set to 2, the router SHOULD swap the label stack entry with the existing outermost MPLS tag in the packet. If the packet has no MPLS tag, it just pushes the label stack entry.
- The OpCode 0 or 1 may be used in some SDN networks, such as the scenario described in .
- The OpCode 2 can be used in traditional BGP MPLS/VPN networks.
Reserved: all zeros.
Order: A FlowSpec rule MAY include one or more ordering label-action(s). If multiple label action extended communities are associated with a BGP-FS Rule, this gives the order of this in the list. The Last action received for an order will be used.
Label: the same as defined in .
Bottom of Stack (S): the same as defined in . It SHOULD be invalid, and set to zero by default. It MAY be modified by the forwarding router locally.
Time to Live (TTL): the same as defined in. It MAY be modified by the forwarding router locally.
Experimental Use (Exp): the same as defined in . It MAY be modified by the forwarding router according to the local routing policy.

IANA Considerations For the purpose of this work, IANA should allocate the following Extended community:

TBD1 for label-action

Security considerations This extension to BGP does not change the underlying security issues inherent in the existing BGP.

Acknowledgement The authors would like to thank Shunwan Zhuang, Zhenbin Li, Peng Zhou and Jeff Haas for their comments.