<?xml version="1.0" encoding="utf-8"?>
<?xml-model href="rfc7991bis.rnc"?> 
<!DOCTYPE rfc [
]>

<rfc
  xmlns:xi="http://www.w3.org/2001/XInclude"
  category="info"
  docName="draft-smn-idr-inter-domain-ibgp-01"
  ipr="trust200902"
  obsoletes=""
  updates=""
  submissionType="IETF"
  xml:lang="en"
  version="3">
<!-- [REPLACE] 
       * docName with name of your draft
     [CHECK] 
       * category should be one of std, bcp, info, exp, historic
       * ipr should be one of trust200902, noModificationTrust200902, noDerivativesTrust200902, pre5378Trust200902
       * updates can be an RFC number as NNNN
       * obsoletes can be an RFC number as NNNN 
-->

  <front>
    <title abbrev="Inter-Domain IBGP">Interconnecting domains with Multiprotocol IBGP</title>

    <seriesInfo name="Internet-Draft" value="draft-smn-idr-inter-domain-ibgp-00"/>
   
    <author fullname="Krzysztof G. Szarkowicz" initials="K" role="editor" surname="Szarkowicz">
      <organization>Juniper Networks</organization>
      <address>
        <postal>
          <city>Wien</city>
          <country>AT</country>
        </postal>        
        <email>kszarkowicz@juniper.net</email>  
      </address>
    </author>

    <author fullname="Israel Means" initials="I" surname="Means">
      <organization>ATT</organization>
      <address>
        <postal>
          <street>2212 Avenida Mara</street>
          <city>Chula Vista</city>
          <code>91914</code>
          <region>CA</region>
          <country>US</country>
        </postal>        
        <email>israel.means@att.com</email>
      </address>
    </author>  

    <author fullname="Moshiko Nayman" initials="M" surname="Nayman">
      <organization>Juniper Networks</organization>
      <address>
        <postal>
          <street>18 Buckingham Dr</street>
          <city>Manalapan</city>
          <code>07726</code>
          <region>NJ</region>
          <country>US</country>
        </postal>        
        <email>mnayman@juniper.net</email>  
      </address>
    </author>    
    
    <date year="2023"/>

    <area>General</area>
    <workgroup>IDR Working Group</workgroup>
    <!-- "Internet Engineering Task Force" is fine for individual submissions.  If this element is 
          not present, the default is "Network Working Group", which is used by the RFC Editor as 
          a nod to the history of the RFC Series. -->

    <keyword>Inter-domain</keyword>
    <keyword>Option 10A</keyword>
    <keyword>Option 10B</keyword>
    <keyword>Option 10C</keyword>
    <keyword>Option A</keyword>
    <keyword>Option B</keyword>
    <keyword>Option C</keyword>
    <keyword>MP-iBGP</keyword>

    <abstract>
      <t>This document relaxes the constraints specified in <xref target="RFC4364"/> and <xref target="RFC4456"/> allowing the building of Inter-domain L3VPN architecture with Multiprotocol internal BGP.</t>
    </abstract>
    
  </front>

  <middle>
    
    <section anchor="Introduction">
      <name>Introduction</name>
      <t>Service provides must often partition (or divide) the large network into smaller IGP (Interrior Gateway Protocol) domains interconnected via BGP (Border Gateway Protocol) only. This might be required for various reasons; for example:</t>
      <ul>
        <li>Separate geographic brown field networks: region 1, region 2, region 3 etc, for management or administrative purposes</li>
        <li>Avoid advertising unnecessary routes from domain 1 to domain 2 to improve network scale of PE (Provider Edge) nodes and RR (Route Reflector) per region</li>
        <li>Avoid advertising remote PE nodes loopback between regions, only DBR (Domain Boundary Router) nodes will advertise routes between regions using 'next-hop self' mechanism</li>
      </ul>
      <t>The advantage of dividing the large network into smaller IGP domains can be numerous, with important examples like:</t>
      <ul>
        <li>Per domain IGP (Interior Gateway Protocol) reduces blast radius during IGP errors or failures</li>
        <li>Per domain RR reduces the blast radius and BGP message exchange when RR fails</li>
      </ul>
      <t>At the same time, dividing the network can be impactful and result in unwanted behavior for both the operator and its customers. For example, some BGP attributes, such as LOCAL_PREF, are not sent to the EBGP (external BGP) peers but are sent to IBGP (internal BGP) peers. Also, depending on the actual requirements, operators can selectively choose, if they keep originator NEXT_HOP attribute or change the NEXT_HOP attribute to some local address. Further, Constrained Route Distribution (<xref target="RFC4684"/>) can be used to prevent DBR from sending VPN (Virtual Private Network) prefixes for VRFs (Virtual Routing and Forwarding instances) that are not locally attached to each region.</t>

      <t><xref target="RFC4364"/>, in Section 10, describes three multi-domain L3VPN (Layer 3 Virtual Private Network) architectures - commonly referenced as Option 10A, Option 10B, and Option 10C - restricted to the use cases, where the domains are distinct BGP domains and use different AS (Autonomous System) numbers, therefore, these architectures use EBGP peerings between the domains. However, many operators might divide the network into multiple IGP domains keeping single BGP domain, with one AS number used across the IGP domains. This implies IBGP peers between IGP domains. In multi-domain architecture there might be a need to modify the NEXT_HOP path attribute at the domain boundary. While this is the default behavior for EBGP (<xref target="RFC4271"/>, Section 5.1.3.), it is not recommended behavior for IBGP (<xref target="RFC4456"/>, Section 10, recommends keeping NEXT_HOP path attribute unmodified when reflecting the NLRIs - Network Layer Reachability Information - between IBGP peers).</t>

      <t>This document relaxes these constraints specified in <xref target="RFC4364"/> and <xref target="RFC4456"/>, allowing Inter-domain L3VPN architectures stitching multiple IGP domains with MP-IBGP (Multiprotocol internal BGP).</t>

      <section>
        <name>Requirements Language</name>
        <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL",
          "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT
          RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be
          interpreted as described in BCP 14 <xref target="RFC2119"/>
          <xref target="RFC8174"/> when, and only when, they appear in
          all capitals, as shown here.</t>
      </section>
    </section>

    <section>
      <name>Inter-domain L3VPN Option 10A with MP-IBGP</name>
      <t>Inter-domain L3VPN architecture based on so called Option 10A (<xref target="RFC4364"/>, Section 10, "a)" bullet point) relies on multiple logical interfaces (typically, sub-interfaces with unique VLAN - Virtual Local Area Network - per sub-interface) and multiple single-hop external BGP (SH-EBGP) peerings (single peering per sub-interface) between ASBRs (autonomous system boundary router), in an architecture as outlined in <xref target="Option-10A-E"/>. Each SH-EBGP peering is responsible for exchanging unicast IPv4 (AFI/SAFI=1/1) or unicast IPv6 (AFI/SAFI=2/1) NLRIs for single L3VPN service. Essentially, in this architecture ASBRs consider each other as CE (Customer Edge) devices. RRs within each AS depicted in <xref target="Option-10B-E"/> SHOULD be used. However, in small scale domains (for example, small access rings with few PEs), RR function could be placed on ASBRs, where multi-hop internal BGP (MH-IBGP) peerings are directly established between PEs and ASBRs.</t>
      <figure anchor="Option-10A-E">
        <name>Inter-AS L3VPN Option 10A</name>
        <artset>
          <artwork type="ascii-art">
                     SH-EBGP                     
 MH-IBGP   MH-IBGP    SAFI=1   MH-IBGP   MH-IBGP 
 SAFI=128  SAFI=128 ◀───────▶  SAFI=128  SAFI=128
◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶
nhs             nhs ◀───────▶ nhs             nhs
                    nhs   nhs                    
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
┌┴─┐ ╱        ╲ ┌────┐     ┌──┴─┐ ╱        ╲ ┌──┐
│  │╱          ╲│    ├─────┤    │╱          ╲│  │
│PE│  AS 64501  │ASBR├─────┤ASBR│  AS 64502  │PE│
│  │            │    ├─────┤    │            │  │
└┬─┘            └────┘     └──┬─┘            └──┘
  ─ ─ ─ ─ ─ ─ ─ ─ ┘            ─ ─ ─ ─ ─ ─ ─ ─ ┘     
          </artwork>
        </artset>
      </figure>
      <t>This architecture does not require an end-to-end LSP (label switched path) leading from a packet's ingress PE in one AS to its egress PE in another AS, as the user packets exchanged between ASBRs are native IP (no MPLS - Multiprotocol Label Switching - encapsulation) packets.  Hence, each ASBR has potentially multiple L3VPN service instances, and performs MPLS encapsulation/decapsulation, which is typical PE function. At the control plane level, each ASBR performs conversion between VPN-IPv4/VPN-IPv6 (SAFI=128) and unicast IPv4/IPv6 (SAFI=1) NLRIs. When these NLRIs are advertised by ASBR, NEXT_HOP attribute MUST be modified to self (nhs).</t>
      <t>In the original context described in <xref target="RFC4364"/>, domains are BGP domains with different ASs, therefore, multiple BGP peerings between two BGP domains are EBGP. However, Option 10A concept can be applied not only to BGP domains with different AS numbers, but as well as to IGP domains with the same AS number, as depicted in <xref target="Option-10A-1"/>.</t>
      <figure anchor="Option-10A-1">
        <name>Inter-Domain L3VPN Option 10A using IBGP</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP   MH-IBGP   SH-IBGP   MH-IBGP   MH-IBGP 
 SAFI=128  SAFI=128   SAFI=1   SAFI=128  SAFI=128
                    ◀───────▶                    
◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶
nhs             nhs ◀───────▶ nhs             nhs
                    nhs   nhs                    
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
┌┴─┐ ╱        ╲ ┌───┐       ┌─┴─┐ ╱        ╲ ┌──┐
│  │╱          ╲│   ├───────┤   │╱          ╲│  │
│PE│  AS 64500  │DBR├───────┤DBR│  AS 64500  │PE│
│  │            │   ├───────┤   │            │  │
└┬─┘            └───┘       └─┬─┘            └──┘
  ─ ─ ─ ─ ─ ─ ─ ─ ┘            ─ ─ ─ ─ ─ ─ ─ ─ ┘ 
          </artwork>
        </artset>
      </figure>
      <t>The main differences, compared to the original Inter-domain Option 10A, are:</t>
      <ul>
        <li>the BGP peering between two IGP domains are now IBGP (SAFI=1), and no longer EBGP (SAFI=1)</li>
        <li>DBRs become PEs with all BGP peerings (global and inside VRFs) using the same AS number</li>
      </ul>
      <t>Other aspects of the architecture are similar.</t>
    </section>
    <section>
      <name>Inter-domain L3VPN Option 10B with MP-IBGP</name>
      <t>Inter-domain L3VPN architecture based on so called Option 10B (<xref target="RFC4364"/>, Section 10, "b)" bullet point) relies on exchanging VPN-IPv4 (AFI/SAFI=1/128) or VPN-IPv6 (AFI/SAFI=2/128) NRLIs via direct SH-EBGP peering between ASBRs, in an architecture as outlined in <xref target="Option-10B-E"/>. RRs within each AS depicted in <xref target="Option-10B-E"/> SHOULD be used. However, in small scale domains (for example, small access rings with few PEs), RR function could be placed on ASBRs, where multi-hop internal BGP (MH-IBGP) peerings are directly established between PEs and ASBRs.</t>
      <figure anchor="Option-10B-E">
        <name>Inter-AS L3VPN Option 10B</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP   MH-IBGP   SH-EBGP   MH-IBGP   MH-IBGP 
 SAFI=128  SAFI=128  SAFI=128  SAFI=128  SAFI=128
◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶
nhs             nhs nhs   nhs nhs             nhs
                                                 
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
 │   ╱        ╲               │   ╱        ╲     
┌──┐╱          ╲┌─┴──┐     ┌────┐╱          ╲┌─┴┐
│PE│            │ASBR├─────┤ASBR│            │PE│
└──┘  AS 64501  └─┬──┘     └────┘  AS 64502  └─┬┘
 └ ─ ─ ─ ─ ─ ─ ─ ─            └ ─ ─ ─ ─ ─ ─ ─ ─          
          </artwork>
        </artset>
      </figure>
      <t>This architecture requires an end-to-end LSP leading from a packet's ingress PE in one AS to its egress PE in another AS.  Hence, at each ASBR, NEXT_HOP attribute MUST be modified to self (nhs), which results in new service label allocation, and programing of appropriate label forwarding entries in the data plane. On the ASBR-to-ASBR link between two ASs there is no additional 'labeled transport' (i.e., no LDP - Label Distribution Protocol, RSVP - Resource Reservation Protocol, SR - Segment Routing, ...) protocol - the packets are transmitted on the ASBR-to-ASBR link with single L3VPN service label.</t>
      <t>In the original context described in <xref target="RFC4364"/>, domains are BGP domains with different ASs, therefore, the BGP peering between two BGP domains is EBGP. However, Option 10B concept can be applied not only to BGP domains with different AS numbers, but also to IGP domains with the same AS number, as depicted in <xref target="Option-10B-1"/>.</t>
      <figure anchor="Option-10B-1">
        <name>Inter-Domain L3VPN Option 10B using IBGP, with separate DBRs</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP   MH-IBGP   SH-IBGP   MH-IBGP   MH-IBGP 
 SAFI=128  SAFI=128  SAFI=128  SAFI=128  SAFI=128
 SAFI=132  SAFI=132  SAFI-132  SAFI=132  SAFI=132
◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶
nhs             nhs nhs   nhs nhs             nhs
                                                 
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
 │   ╱        ╲               │   ╱        ╲     
┌──┐╱          ╲┌─┴─┐       ┌───┐╱          ╲┌─┴┐
│PE│            │DBR├───────┤DBR│            │PE│
└──┘  AS 64500  └─┬─┘       └───┘  AS 64500  └─┬┘
 └ ─ ─ ─ ─ ─ ─ ─ ─            └ ─ ─ ─ ─ ─ ─ ─ ─  
          </artwork>
        </artset>
      </figure>
      <t>Similar to the Inter-Domain Option 10A case, main differences, when comparing to the original Inter-domain Option 10B are:</t>
      <ul>
        <li>the BGP peering between two IGP domains are now IBGP (SAFI=128), and no longer EBGP (SAFI=128)</li>
        <li>DBRs become on-the-path route reflectors for SAFI=128</li>
      </ul>
      <t>This implies that DBR with RR function MUST change the NEXT_HOP attribute to self, when reflecting these NLRIs. This is not in accordance with <xref target="RFC4456"/>, Section 10 recommendation that RR SHOULD NOT modify the NEXT_HOP attribute, therefore, this document relaxes the recommendation from <xref target="RFC4456"/> by defining the use case, where RR MUST modify the NEXT_HOP attribute, when reflecting NRLIs over IBGP peerings.</t>
      <t>It is strongly advisable to control the exchange of VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs between domains via Constrained Route Distribution (<xref target="RFC4684"/>). Therefore, DBR-to-DBR SH-IBGP peering, in addition to SAFI=128, SHOULD include Route Target Constraint - RTC (SAFI=132) - as well, and DBRs SHOULD be provisioned to exchange between each other only desired RTCs. Please note, RTC MAY be used inside of each IGP domain, too, to control route distribution within IGP domains.</t>
      <t>Important aspect of the inter-domain conenctivity, when the domains are interconnected via multiple interconnection points, as depicted in <xref target="Option-10B-1-Loop"/>, is loop prevention. In classic Inter-AS Option 10B, with different AS numbers used in each BGP domain, and EBGP peerings between BGP domains, loop prevention is ensured by rejecting updates containig local AS number in the AS_PATH attribute. In the use case with multiple IGP domains and single BGP domain, each DBR is on-the-path RR, thus is associated with a CLUSTER_ID. One option for CLUSTER_ID alloaction is, that each DBR is configured with a unique CLUSTER_ID. Another option for CLUSTER_ID alloaction is that each DBR pair in the IGP domain uses unique CLUSTER_ID, as depicted in <xref target="Option-10B-1-Loop"/>. Using the first CLUSTER_ID allocation scheme, there is a risk of a BGP routing loop occurring, since all of the DBRs are reflecting prefixes as RRs in the same AS with next-hop self. To prevent the DBRs of the same IGP domain from accepting updates from each other, they SHOULD use the same CLUSTER_ID. In this case, a DBR will discard a prefix update that has the same CLUSTER_ID as itself in order to prevent routing information loops in BGP. For example, DBR1 and DBR2 configured with one CLUSTER_ID, while DBR3 and DBR4 have another single CLUSTER_ID. This mechanism, loop prevention based on CLUSTER_LIST filtering, is described in <xref target="RFC4456"/>, Section 10 - Avoiding Routing Information Loops.</t>

      <figure anchor="Option-10B-1-Loop">
        <name>Loop prevention in Inter-Domain L3VPN Option 10B using IBGP</name>
        <artset>
          <artwork type="ascii-art">
  MH-IBGP   MH-IBGP   SH-IBGP   MH-IBGP   MH-IBGP  
  SAFI=128  SAFI=128  SAFI=128  SAFI=128  SAFI=128 
  SAFI=132  SAFI=132  SAFI-132  SAFI=132  SAFI=132 
 ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶ 
 nhs             nhs nhs   nhs nhs             nhs 
                                                   
 ┌ ─ ─ ─ ─ ─ ─ ─ ─              ┌ ─ ─ ─ ─ ─ ─ ─ ─  
┌──┐            ┌─┴──┐       ┌────┐            ┌─┴┐
│PE│            │DBR1│───────┤DBR3│            │PE│
└──┘            └─┬──┘       └────┘            └─┬┘
 │  ╲          ╱    C         C │  ╲          ╱    
     ╲        ╱   │ l         l     ╲        ╱   │ 
 │    ╲      ╱      u         u │    ╲      ╱      
       ╲┌──┐╱     │ s         s       ╲┌──┐╱     │ 
 │      │RR│        t         t │      │RR│        
       ╱└──┘╲     │ e         e       ╱└──┘╲     │ 
 │    ╱      ╲      r         r │    ╱      ╲      
     ╱        ╲   │                 ╱        ╲   │ 
 │  ╱          ╲    A         B │  ╱          ╲    
┌──┐            ┌─┴──┐       ┌────┐            ┌─┴┐
│PE│  AS 64500  │DBR2├───────┤DBR4│  AS 64500  │PE│
└──┘            └─┬──┘       └────┘            └─┬┘
 └ ─ ─ ─ ─ ─ ─ ─ ─              └ ─ ─ ─ ─ ─ ─ ─ ─  
          </artwork>
        </artset>
      </figure>



      <t>When using IBGP, instead of EBGP, small variation of the architecture can be achieved, by collapsing two separate DBRs to single, collapsed DBR, as depicted in <xref target="Option-10B-2"/>.</t>
      <figure anchor="Option-10B-2">
        <name>Inter-Domain L3VPN Option 10B using IBGP, with collapsed DBR</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP   MH-IBGP   MH-IBGP   MH-IBGP 
 SAFI=128  SAFI=128  SAFI=128  SAFI=128
 SAFI=132  SAFI=132  SAFI=132  SAFI=132
◀───────▶ ◀───────▶ ◀───────▶ ◀───────▶
nhs             nhs nhs             nhs
                                       
 ┌ ─ ─ ─ ─ ─ ─ ─ ┐   ┌ ─ ─ ─ ─ ─ ─ ─ ┐ 
        ┌──┐               ┌──┐        
 │     ╱│RR│╲    │   │    ╱│RR│╲     │ 
      ╱ └──┘ ╲           ╱ └──┘ ╲      
 │   ╱        ╲  │   │  ╱        ╲   │ 
┌──┐╱          ╲┌─────┐╱          ╲┌──┐
│PE│            │ DBR │            │PE│
└──┘  AS 64500  └─────┘  AS 64500  └──┘
 └ ─ ─ ─ ─ ─ ─ ─ ┘   └ ─ ─ ─ ─ ─ ─ ─ ┘ 
          </artwork>
        </artset>
      </figure>
      <t>Similarly to the previous example, DBR MUST change the NEXT_HOP attribute to self, when reflecting VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs, and DBR SHOULD use RTC (SAFI=132) to control the exchange of VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs between domains. RTC MAY be used inside of each domain.</t>
    </section>

    <section>
      <name>Inter-domain L3VPN Option 10C with MP-IBGP</name>
      <t>Inter-domain L3VPN architecture based on so called Option 10C (<xref target="RFC4364"/>, Section 10, "c)" bullet point) relies on exchanging VPN-IPv4 (AFI/SAFI=1/128) or VPN-IPv6 (AFI/SAFI=2/128) NLRIs via MH-EBGP peering between BGP domains, without changing the NEXT_HOP attribute, and exchanging labeled unicast IPv4 or labeled unicast IPv6 (SAFI=4) host routes (PE loopbacks) via direct SH-EBGP peering between ASBRs, changing the NEXT_HOP attribute at the BGP domain boundaries, in an architecture as outlined in <xref target="Option-10C-E"/>. As in previous architectures, RRs within each AS depicted in <xref target="Option-10C-E"/> SHOULD be used. One of the main objectives of Option 10C architecture is to offload ASBRs from the task of maintaining/distributing VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs, without RR these NLRIs would need to be distributed via direct MH-EBGP peerings between PEs from different BGP domains. Such approach makes the design very impractical and not scalable, therefore, in Option 10C RRs SHOULD be deployed, and MH-EBGP peerings to distribute VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs between BGP domains SHOULD be established between RRs.</t>
      <figure anchor="Option-10C-E">
        <name>Inter-AS L3VPN Option 10C</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP             MH-EBGP             MH-IBGP 
 SAFI=128            SAFI=128            SAFI=128
◀───────▶ ◀───────────────────────────▶ ◀───────▶
nhs                                           nhs
      MH-IBGP        SH-EBGP        MH-IBGP      
       SAFI=4         SAFI=4         SAFI=4      
◀─────────────────▶ ◀───────▶ ◀─────────────────▶
nhs             nhs nhs   nhs nhs             nhs
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
 │   ╱        ╲               │   ╱        ╲     
┌──┐╱          ╲┌─┴──┐     ┌────┐╱          ╲┌─┴┐
│PE│            │ASBR├─────┤ASBR│            │PE│
└──┘  AS 64501  └─┬──┘     └────┘  AS 64502  └─┬┘
 └ ─ ─ ─ ─ ─ ─ ─ ─            └ ─ ─ ─ ─ ─ ─ ─ ─         
          </artwork>
        </artset>
      </figure>
      <t>This architecture requires an end-to-end LSP leading from a packet's ingress PE in one AS to its egress PE in another AS.  Hence, at each ASBR, NEXT_HOP attribute for labeled unicast IPv4 or labeled unicast IPv6 (SAFI=4) NLRI MUST be modified to self (nhs), which results in new transport label allocation, and programming of appropriate label forwarding entries in the data plane. In the packets traversing ASBR-to-ASBR link between two ASs, similar to the links within each AS, there is additional transport label at the top of the label stack in addition to the L3VPN service label. This transport label is exchanged via BGP peering with SAFI=4.</t>
      <t>In the original context described in <xref target="RFC4364"/>, domains are BGP domains with different AS numbers, therefore, the BGP peerings (both for SAFI=4 and SAFI=128) between two BGP domains are EBGP. However, Option 10C concept can be applied not only to BGP domains with different AS numbers, but as well to IGP domains with the same AS number, as depicted in <xref target="Option-10C-1"/>.</t>
      <figure anchor="Option-10C-1">
        <name>Inter-Domain L3VPN Option 10C using IBGP, with separate DBRs</name>
        <artset>
         <artwork type="ascii-art">
 MH-IBGP             MH-IBGP             MH-IBGP 
 SAFI=128            SAFI=128            SAFI=128
 SAFI=132            SAFI=132            SAFI=132
◀───────▶ ◀───────────────────────────▶ ◀───────▶
nhs                                           nhs
      MH-IBGP        SH-IBGP        MH-IBGP      
       SAFI=4         SAFI=4         SAFI=4      
◀─────────────────▶ ◀───────▶ ◀─────────────────▶
nhs             nhs nhs   nhs nhs             nhs
 ┌ ─ ─ ─ ─ ─ ─ ─ ─            ┌ ─ ─ ─ ─ ─ ─ ─ ─  
        ┌──┐      │                  ┌──┐      │ 
 │     ╱│RR│╲                 │     ╱│RR│╲       
      ╱ └──┘ ╲    │                ╱ └──┘ ╲    │ 
 │   ╱        ╲               │   ╱        ╲     
┌──┐╱          ╲┌─┴─┐       ┌───┐╱          ╲┌─┴┐
│PE│            │DBR├───────┤DBR│            │PE│
└──┘  AS 64500  └─┬─┘       └───┘  AS 64500  └─┬┘
 └ ─ ─ ─ ─ ─ ─ ─ ─            └ ─ ─ ─ ─ ─ ─ ─ ─  
          </artwork>
        </artset>
      </figure>
      <t>Again, the differences compared to the original Inter-domain Option 10C are:</t>
      <ul>
        <li>the peerings between two IGP domains are now IBGP, and no longer EBGP, for both single-hop BGP peering used to exchange labeled unicast IPv4 or labeled unicast IPv6 (SAFI=4) host routes (PE loopbacks), as well as multi-hop BGP peering used to exchange VPN-IPv4 (AFI/SAFI=1/128) or VPN-IPv6 (AFI/SAFI=2/128) NLRIs</li>
        <li>DBRs become on-the-path route reflectors for SAFI=4</li>
      </ul>
      <t>Remaining aspects of the architecture are similar. This implies that IGP domain boundary router (DBR) becomes inline (on-the-path) RR for labeled unicast IPv4 or labeled unicast IPv6 (SAFI=4) NLRIs, and MUST change the NEXT_HOP attribute to self, when reflecting these NLRIs. Again, this is not in accordance with <xref target="RFC4364"/>, Section 10 recommendation that RR SHOULD NOT modify the NEXT_HOP attribute, therefore, this document relaxes the recommendation from <xref target="RFC4456"/> by defining the use case, where RR MUST modify the NEXT_HOP attribute, when reflecting NRLIs over IBGP peerings</t>
      <t>As in Option 10B scenario, it is strongly advisable to control the exchange of VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs between domains via Constrained Route Distribution (<xref target="RFC4684"/>). Therefore, MH-IBGP peering between RRs in different IGP domains, in addition to SAFI=128, SHOULD include RTC (SAFI=132), and RRs SHOULD be provisioned to exchange between each other only desired RTCs. Please note, RTC MAY be used inside of each domain, too, to control route distribution within IGP domains.</t>
      <t>When using IBGP, instead of EBGP, a small variation of the architecture can be achieved, by collapsing two separate DBRs to single, collapsed DBR, as depicted in <xref target="Option-10C-2"/>.</t>
      <figure anchor="Option-10C-2">
        <name>Inter-Domain L3VPN Option 10C using IBGP, with collapsed DBR</name>
        <artset>
          <artwork type="ascii-art">
 MH-IBGP       MH-IBGP         MH-IBGP 
 SAFI=128      SAFI=128        SAFI=128
 SAFI=132      SAFI=132        SAFI=132
◀───────▶ ◀─────────────────▶ ◀───────▶
nhs                                 nhs
      MH-IBGP             MH-EBGP      
       SAFI=4              SAFI=4      
◀─────────────────▶ ◀─────────────────▶
nhs             nhs nhs             nhs
 ┌ ─ ─ ─ ─ ─ ─ ─ ┐   ┌ ─ ─ ─ ─ ─ ─ ─ ┐ 
        ┌──┐               ┌──┐        
 │     ╱│RR│╲    │   │    ╱│RR│╲     │ 
      ╱ └──┘ ╲           ╱ └──┘ ╲      
 │   ╱        ╲  │   │  ╱        ╲   │ 
┌──┐╱          ╲┌─────┐╱          ╲┌──┐
│PE│            │ DBR │            │PE│
└──┘  AS 64500  └─────┘  AS 64500  └──┘
 └ ─ ─ ─ ─ ─ ─ ─ ┘   └ ─ ─ ─ ─ ─ ─ ─ ┘ 
          </artwork>
        </artset>
      </figure>
      <t>Similarly to the previous example, DBR MUST change the NEXT_HOP attribute to self, when reflecting labeled unicast IPv4 or labeled unicast IPv6 (SAFI=4) NLRIs, and RR SHOULD use RTC (SAFI=132) to control the exchange of VPN-IPv4/VPN-IPv6 (SAFI=128) NLRIs between IGP domains. RTC MAY be used inside of each domain.</t>
    </section>

    <section anchor="IANA">
    <!-- All drafts are required to have an IANA considerations section. See RFC 8126 for a guide.-->
      <name>IANA Considerations</name>
      <t>This memo includes no request to IANA.</t>
    </section>
    
    <section anchor="Security">
      <!-- All drafts are required to have a security considerations section. See RFC 3552 for a guide. -->
      <name>Security Considerations</name>
      <t>To be added later.</t>
    </section>
    
    <!-- NOTE: The Acknowledgements and Contributors sections are at the end of this template -->
  </middle>

  <back>
    <references>
      <name>References</name>
      <references>
        <name>Normative References</name>
        
        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.2119.xml"/>
        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.4271.xml"/>
        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.8174.xml"/>

        <!-- The recommended and simplest way to include a well known reference -->
        
      </references>
 
      <references>
        <name>Informative References</name>

        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.4364.xml"/>
        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.4456.xml"/>
        <xi:include href="https://www.rfc-editor.org/refs/bibxml/reference.RFC.4684.xml"/>

      </references>
    </references>

    <section>
      <name>Acronyms and Abbreviations</name>
        <t>AFI: Address Family Identifier</t>
        <t>AS: Autonomous System</t>
        <t>ASBR: Autonomous System Boundary Router</t>
        <t>BGP: Border Gateway Protocol</t>
        <t>CE: Customer Edge</t>
        <t>DBR: Domain Boundary Router</t>
        <t>EBGP: External Border Gateway Protocol</t>
        <t>IBGP: Internal Border Gateway Protocol</t>
        <t>IGP: Interior Gateway Protocol</t>
        <t>IP: Internet Protocol</t>
        <t>IPv4: Internet Protocol version 4</t>
        <t>IPv6: Internet Protocol version 6</t>
        <t>L3VPN: Layer 3 Virtual Private Network</t>
        <t>LDP: Label Distribution Protocol</t>
        <t>LSP: Label Switched Path</t>
        <t>MH-IBGP: Multi-hop Internal Border Gateway Protocol</t>
        <t>MP-IBGP: Multiprotocol Internal Border Gateway Protocol</t>
        <t>MPLS: Multiprotocol Label Switching</t>
        <t>nhs: next-hop self</t>
        <t>NLRI: Network Layer Reachability Information</t>
        <t>PE: Provider Edge</t>
        <t>RR: Router Reflector</t>
        <t>RSVP: Resource Reservation Protocol</t>
        <t>RTC: Route Target Constraint</t>
        <t>SAFI: Subsequent Address Family Identifier</t>
        <t>SH-EBGP: Single-hop External Border Gateway Protocol</t>
        <t>SR: Segment Routing</t>
        <t>VLAN: Virtual Local Area Network</t>
        <t>VPN: Virtual Private Network</t>
        <t>VRF: Virtual Routing and Forwarding</t>
    </section>
    
    <section anchor="Acknowledgements" numbered="false">
      <name>Acknowledgements</name>
      <t>To be added later</t>
    </section>
    
    <section anchor="Contributors" numbered="false">
      <name>Contributors</name>
      <t>To be added later</t>
      <!-- [CHECK] it is optional to add a <contact> record for some or all contributors -->
    </section>
    
 </back>
</rfc>
