SR Path Ingress Protection
Huaimo Chen
Futurewei
Boston, MA
USA
huaimo.chen@futurewei.com
Mehmet Toy
Verizon
USA
mehmet.toy@verizon.com
Aijun Wang
China Telecom
Beiqijia Town, Changping District
Beijing
102209
China
wangaj3@chinatelecom.cn
Zhenqiang Li
China Mobile
32 Xuanwumen West Ave, Xicheng District
Beijing
100053
China
lizhengqiang@chinamobile.com
Lei Liu
Fujitsu
USA
liulei.kddi@gmail.com
Xufeng Liu
Volta Networks
McLean
VA
USA
xufeng.liu.ietf@gmail.com
2022
This document describes extensions to Border Gateway Protocol (BGP) for protecting the ingress node of a Segment Routing (SR) tunnel or path.

Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

Introduction
The fast protection of a transit node of a Segment Routing (SR) path or tunnel is described in [I-D.bashandy-rtgwg-segment-routing-ti-lfa] and [I-D.hu-spring-segment-routing-proxy-forwarding]. [RFC8424] presents extensions to RSVP-TE for the fast protection of the ingress node of a traffic engineering (TE) Label Switching Path (LSP). However, these documents do not discuss any protocol extensions for the fast protection of the ingress node of an SR path or tunnel.
This document fills that void and specifies protocol extensions to Border Gateway Protocol (BGP) for the fast protection of the ingress node of an SR path or tunnel. Ingress node and ingress, fast protection and protection as well as SR path and SR tunnel will be used exchangeably in the following sections.

Terminologies
The following terminologies are used in this document.
SR: Segment Routing
SRv6: SR for IPv6
SRH: Segment Routing Header
SID: Segment Identifier
CE: Customer Edge
PE: Provider Edge
LFA: Loop-Free Alternate
TI-LFA: Topology Independent LFA
TE: Traffic Engineering
BFD: Bidirectional Forwarding Detection
VPN: Virtual Private Network
L3VPN: Layer 3 VPN
FIB: Forwarding Information Base
PLR: Point of Local Repair
BGP: Border Gateway Protocol
IGP: Interior Gateway Protocol
OSPF: Open Shortest Path First
IS-IS: Intermediate System to Intermediate System

SR Path Ingress Protection Example
To protect against the failure of the (primary) ingress node of a (primary) SR path, a backup ingress node is configured or selected and is different from the (primary) ingress node. A backup SR path from the backup ingress node is computed and installed. Primary ingress and ingress as well as primary SR path and SR path will be used exchangeably.
Figure 1 shows an example of protecting ingress PE1 of a SR path, which is from ingress PE1 to egress PE3.

Protecting Ingress PE1 of SR Path PE1-P1-PE3

             *******  *******
         [PE1]-----[P1]-----[PE3]            PE1 Ingress
         / |        |& &&&&&  | \            PEx Provider Edge
        /  |        |&        |  \           CEx Customer Edge
   [CE1]   |        |&        |   [CE2]      Px  Non Provider Edge
        \  |        |&        |  /           *** SR Path
         \ | &&&&&& |&        | /            &&& Backup Path
         [PE2]-----[P2]-----[PE4]

In normal operations, CE1 sends the traffic with destination PE3 to ingress PE1, which imports the traffic into the SR path.
When CE1 detects the failure of ingress PE1, it switches the traffic to backup ingress PE2, which imports the traffic from CE1 into a backup SR path. The backup path is from the backup ingress PE2 to the egress PE3. When the traffic is imported into the backup path, it is sent to the egress PE3 along the path.

Behavior after Ingress Failure
After the failure of the ingress of an SR path happens, there are a couple of different ways to detect the failure. In each way, there may be some specific behavior for the traffic source (e.g., CE1) and the backup ingress (e.g., PE2).
In one way, the traffic source (e.g., CE1) is responsible for fast detecting the failure of the ingress (e.g., PE1) of an SR path. Fast detecting the failure means detecting the failure in a few or tens of milliseconds. The backup ingress (e.g., PE2) is ready to import the traffic from the traffic source into the backup SR path installed.
In normal operations, the source sends the traffic to the ingress of the SR path. When the source detects the failure of the ingress, it switches the traffic to the backup ingress, which delivers the traffic to the egress of the SR path via the backup SR path.
In another way, the backup ingress is responsible for fast detecting the failure of the ingress of an SR path.
In normal operations, the source (e.g., CE1) sends the traffic to the ingress (e.g., PE1) and may send the traffic to the backup ingress (e.g., PE2).
It sends the traffic to the backup ingress (e.g., PE2) after the ingress fails.
The backup ingress does not import any traffic from the source into the backup SR path in normal operations.
When it detects the failure of the ingress, it imports the traffic from the source into the backup SR path.

Extensions to BGP
For a SR path from a primary ingress node to an egress node, a backup ingress node is selected to protect the failure of the primary ingress node of the SR path. This section describes the extensions to BGP for representing the information for protecting the primary ingress node in a BGP UPDATE message and distributing the information to the backup ingress node. The information includes a SR backup path.
[I-D.ietf-idr-segment-routing-te-policy] specifies a way of representing a SR path in a BGP UPDATE message and distributing the SR path to the ingress node of the SR path.
This is extended to represent the information for protecting the primary ingress by defining a few of new Sub-TLVs.

SR Path Ingress Protection Sub-TLV
A new Sub-TLV, called SR Path Ingress Protection Sub-TLV, is defined. When a UPDATE message is sent to the backup ingress node for protecting the primary ingress node of a SR path, the message contains this Sub-TLV. Its format is illustrated below.

SR Path Ingress Protection Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  Type (TBD1)  |        Length (variable)      |  Flags      |A|
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 ~                                                               ~
 ~                        Sub-TLVs (optional)                    ~
 ~                                                               ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: TBD1 is to be assigned by IANA.
Length: Variable.
Flags: 1 octet. One flag is defined.
  Flag A: 1 bit. It is set to
    1: request a backup ingress to let the forwarding entry for the backup SR path be Active.
    0: request a backup ingress to let the forwarding entry for the backup SR path be inactive initially and to make the entry be active after detecting the failure of the primary ingress node of the primary SR path.
A few optional Sub-TLVs are defined, which are Primary Ingress Sub-TLV, Service Sub-TLV and Traffic Description Sub-TLV.

Primary Ingress Sub-TLV
A Primary Ingress Sub-TLV indicates the IP address of the primary ingress node of a primary SR path. It has two formats: one for primary ingress node IPv4 address and the other for primary ingress node IPv6 address, which are illustrated below.

Primary Ingress IPv4 Address Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (1)   |   Length (4)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |            Primary Ingress IPv4 Address (4 octets)            |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (1 suggested) is to be assigned by IANA.
Length: 4.
Primary Ingress IPv4 Address: 4 octets. It represents an IPv4 host address of the primary ingress node of a primary SR path.

Primary Ingress IPv6 Address Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (2)   |  Length (16)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |            Primary Ingress IPv6 Address (16 octets)           |
 ~                                                               ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (2 suggested) is to be assigned by IANA.
Length: 16.
Primary Ingress IPv6 Address: 16 octets. It represents an IPv6 host address of the primary ingress node of a primary SR path.

Service Sub-TLV
A Service Sub-TLV contains a service ID or label to be added into a packet to be carried by a SR path. It has three formats: the first one for the service identified by a label, the second one for the service identified by a service identifier (ID) of 32 bits, and the third one for the service identified by a service identifier (ID) of 128 bits. Their formats are illustrated below.

Service Label Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (3)   |   Length (4)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |        zero           |       Service Label (20 bits)         |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (3 suggested) is to be assigned by IANA.
Length: 4.
Service Label: the least significant 20 bits. It represents a label of 20 bits.

32 Bits Service ID Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (4)   |   Length (4)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                        Service ID (4 octets)                  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (4 suggested) is to be assigned by IANA.
Length: 4.
Service ID: 4 octets. It represents a Service Identifier (ID) of 32 bits.

128 Bits Service ID Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (5)   |  Length (16)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                        Service ID (16 octets)                 |
 ~                                                               ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (5 suggested) is to be assigned by IANA.
Length: 16.
Service ID: 16 octets. It represents a Service Identifier (ID) of 128 bits.

Traffic Description Sub-TLVs
A Traffic Description Sub-TLV describes the traffic to be imported into a backup SR path. Five Traffic Description Sub-TLVs are defined. Two of them are FEC Sub-TLVs and the others are interface Sub-TLVs.
Two FEC Sub-TLVs are IPv4 and IPv6 FEC Sub-TLVs. Their formats are illustrated below.

IPv4 FEC Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (6)   |Length(variable|
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |IPv4 Prefix Len|          IPv4 Prefix                          ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 ~   (Optional) Virtual Network ID (2 octets)                    ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (6 suggested) is to be assigned by IANA.
Length: Variable.
IPv4 Prefix Len: Indicates the length of the IPv4 Prefix.
IPv4 Prefix: IPv4 Prefix rounded to octets.
Virtual Network ID: 2 octets. This is optional. It indicates the ID of a virtual network.

IPv6 FEC Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (7)   |Length(variable|
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |IPv6 Prefix Len|          IPv6 Prefix                          ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 ~   Optional Virtual Network ID (2 octets)                      ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (7 suggested) is to be assigned by IANA.
Length: Variable.
IPv6 Prefix Len: Indicates the length of the IPv6 Prefix.
IPv6 Prefix: IPv6 Prefix rounded to octets.
Virtual Network ID: 2 octets. This is optional. It indicates the ID of a virtual network.
An Interface sub-TLV indicates the interface from which the traffic is received and imported into the backup SR path/tunnel. It has three formats: one for interface index, the other two for IPv4 and IPv6 address, which are illustrated below.

Interface Index Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (8)   |   Length (4)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |                   Interface Index (4 octets)                  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (8 suggested) is to be assigned by IANA.
Length: 4.
Interface Index: 4 octets. It indicates the index of an interface.

Interface IPv4 Address Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |    Type (9)   |   Length (4)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |               Interface IPv4 Address (4 octets)               |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (9 suggested) is to be assigned by IANA.
Length: 4.
Interface IPv4 Address: 4 octets. It represents the IPv4 address of an interface.

Interface IPv6 Address Sub-TLV

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |   Type (10)   |  Length (16)  |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |               Interface IPv6 Address (16 octets)              |
 ~                                                               ~
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: Its value (10 suggested) is to be assigned by IANA.
Length: 16.
Interface IPv6 Address: 16 octets. It represents the IPv6 address of an interface.

Backup Ingress Behavior
When a backup ingress node receives a UPDATE message containing the information for protecting the primary ingress node of a SR path, it installs a forwarding entry in its FIB based on the information. The information is encoded in a SR policy of the following structure:

  SR Policy SAFI NLRI: <Distinguisher, Policy-Color, Endpoint>
  Attributes:
      Tunnel Encaps Attribute (23)
          Tunnel Type (15): SR Policy
              SR Path Ingress Protection Sub-TLV
                  Primary Ingress Sub-TLV
                  Service Sub-TLV
                  Traffic Description Sub-TLV
              Preference Sub-TLV
              Binding SID Sub-TLV
              Explicit NULL Label Policy (ENLP) Sub-TLV
              Priority Sub-TLV
              Policy Name Sub-TLV
              Segment List Sub-TLV
                  Weight Sub-TLV
                  Segment Sub-TLV
                  Segment Sub-TLV
                  ...
              ...

Where:
o: SR Policy SAFI NLRI is defined in [I-D.ietf-idr-segment-routing-te-policy].
o: Tunnel Encapsulation Attribute is defined in [I-D.ietf-idr-tunnel-encaps].
o: Tunnel Type of SR Policy is defined in [I-D.ietf-idr-segment-routing-te-policy].
o: SR Path Ingress Protection, Primary Ingress, Service and Traffic Description Sub-TLVs are defined in this document.
o: Preference, Binding SID, ENLP, Priority, Policy Name, Segment List, Weight and Segment Sub-TLVs are defined in [I-D.ietf-idr-segment-routing-te-policy].
After receiving a SR policy with a SR Path Ingress Protection Sub-TLV, the backup ingress node will install one or more candidate paths into its "BGP table". Another module such as SRPM will choose one or more paths and install the forwarding entries for them in the data plane.
The forwarding entries for the paths installed in the data plane will be set to be inactive if the flag A in the SR Path Ingress Protection Sub-TLV is zero. When the primary ingress node fails, these forwarding entries are set to be active. The failure of the primary ingress may be detected by the backup ingress node through using a mechanism such as BFD. The IP address of the primary ingress in the Primary Ingress Sub-TLV may be used for detecting the failure of the primary ingress node.
If the flag A in the SR Path Ingress Protection Sub-TLV is one, then the forwarding entries for the paths installed in the data plane will be set to be active.
When there is a Service Sub-TLV in the SR Path Ingress Protection Sub-TLV, the ID or Label in the Service Sub-TLV will be included in the forwarding entries. When a packet is imported into a backup SR path using the forwarding entries, the service ID or Label is pushed first and then the sequence of segments represented in the Segment List Sub-TLV.

Security Considerations
Protocol extensions defined in this document do not affect the BGP security other than those as discussed in the Security Considerations section of [RFC5575].

Acknowledgements
The authors of this document would like to thank Dhruv Dhody for the comments.

IANA Considerations

BGP Tunnel Encapsulation Attribute Sub-TLVs
Under Existing Registry Name: "BGP Tunnel Encapsulation Attribute Sub-TLVs", IANA is requested to assign a new Sub-TLV value for SR Path Ingress Protection as follows:

  Value     sub-TLV Name                           Reference
  -----    ------------------------------------    --------------
  TBD1     SR Path Ingress Protection Sub-TLV      This Document

Ingress Protection Information Sub-TLVs
A new registry called "Ingress Protection Information Sub-TLVs" is defined in this document. IANA is requested to create and maintain new registry:
o: Ingress Protection Information Sub-TLVs
Initial values for the registry are given below. The future assignments are to be made through IETF Review [RFC5226].

  Value     sub-TLV Name                            Reference
  -----    -------------------------------------    --------------
   0       Reserved
   1       Primary Ingress IPv4 Address Sub-TLV     This Document
   2       Primary Ingress IPv6 Address Sub-TLV     This Document
   3       Service Label Sub-TLV                    This Document
   4       32 Bits Service ID Sub-TLV               This Document
   5       128 Bits Service ID Sub-TLV              This Document
   6       IPv4 FEC Sub-TLV                         This Document
   7       IPv6 FEC Sub-TLV                         This Document
   8       Interface Index Sub-TLV                  This Document
   9       Interface IPv4 Address Sub-TLV           This Document
   10      Interface IPv6 Address Sub-TLV           This Document
  11-255   Unassigned

Normative References

Informative References
[I-D.bashandy-rtgwg-segment-routing-ti-lfa]
[I-D.hu-spring-segment-routing-proxy-forwarding]
[RFC8424]
[I-D.ietf-idr-segment-routing-te-policy]
[I-D.ietf-idr-tunnel-encaps]
[RFC5226]