Subject: Re: [Idr] draft-bashandy-idr-bgp-repair-label-01: when does PE revert back to standard label?

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 14:03:28 -0400

I think the draft needs to state that a received native IP packet is NEVER sent using the repair label. Specifically, if the IP path to the CE is broken, a packet received as a native IP packet shoul be sent to the PE next hop using the regular label, not the repair label. The repair label should only be used for packets received from MPLS. 

--
Jakob Heitz.

On Mar 31, 2011, at 2:38 AM, "Jakob Heitz" <[email-masked]> wrote:

> After the link to the CE fails, the PE1 uses the repair label to send to PE2.
> If the link to the CE is never restored, does PE1 ever use the regular label again?
> 
> Suppose the CE is first attached to PE1 and PE2.
> Then it detaches from PE1 and attaches to PE3.
> It will never reattach to PE1.
> 
> Now, PE1 is stuck using the repair label to PE2.
> 
> --
> Jakob Heitz.
> 
> _______________________________________________
> Idr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/idr

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 02 Apr 2011 20:15:27 +0200

Hi Jakob,

> Now, PE1 is stuck using the repair label to PE2.

Not at all :)

The repair label of CE-PE2 is used as a backup path for CE-PE1 primary 
best path on PE1.

When the on the PE1 the link to CE fails we will switch to use backup 
only for the duration it takes routing protocol to remove the primary 
path CE-PE1 reachability and make the CE-PE2 as best path.

Keep in mind that we are protecting the best path of the net not the net 
itself.

Then such best will be unprotected till we get a new path via CE-PE3 and 
install it as backup or till the link comes up again and new best path 
CE-PE1 will be installed.

Cheers,
R.

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 02 Apr 2011 20:25:53 +0200

Hi Jakob,

> I think the draft needs to state that a received native IP packet is
> NEVER sent using the repair label. Specifically, if the IP path to
> the CE is broken, a packet received as a native IP packet shoul be
> sent to the PE next hop using the regular label, not the repair
> label. The repair label should only be used for packets received from
> MPLS.

The draft already states this:

    In a BGP free core, where traffic is tunneled between edge routers
    and edge routers assign labels to prefixes, BGP speakers advertise
    reachability information about prefixes and associate a local label
    with each prefix such as L3VPN [9], 6PE [10], and Softwire [8].

But thinking further I do not see perhaps anything wrong on attaching 
this attribute to unicast IPv4 and IPv6 AFIs where ASBRs and network 
between them are MPLS enabled.

In fact if we would explicitly permit this in 
draft-bashandy-idr-bgp-repair-label it will automatically address the 
problem as described in draft-xu-idr-best-external-loop-avoidance.

Thx,
R.

---

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 16:07:55 -0400

Your comment is orthogonal to mine. 

--
Jakob Heitz.

---

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 17:03:40 -0400

PE1 gets no new update from PE2, therefore will
continue to use the repair label to PE2.

Ahmed clarified it for me like this:
If PE1 receives a packet destined for a prefix advertised by CE, PE1 will push the primary label advertised by the primary egress PE (be it PE2 or any other PE) and then tunnel the packet to that PE.

I merely asked to have it clarified in the draft in my other email:

If no IP path exists to the CE (only mpls path):
For packets received as native IP, push the primary label.
For packets received as MPLS, push the repair label.

--
Jakob Heitz.

> -----Original Message-----
> From: Robert Raszuk [mailto:[email-masked]] 
> Sent: Saturday, April 02, 2011 11:15 AM
> To: Jakob Heitz
> Cc: idr
> Subject: Re: [Idr] draft-bashandy-idr-bgp-repair-label-01: 
> when does PE revert back to standard label?
> 
> Hi Jakob,
>

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 02 Apr 2011 23:09:44 +0200

Jakob,

> PE1 gets no new update from PE2, therefore will continue to use the
> repair label to PE2.

No update is required to be received from PE2. Loosing PE1's directly
attached path and recalculating all information already present in
control plane is already sufficient.

> Ahmed clarified it for me like this: If PE1 receives a packet
> destined for a prefix advertised by CE, PE1 will push the primary
> label advertised by the primary egress PE (be it PE2 or any other PE)
> and then tunnel the packet to that PE.

Yes, but only after the local control plane convergence happens.

> If no IP path exists to the CE (only mpls path): For packets received
> as native IP, push the primary label. For packets received as MPLS,
> push the repair label.

Nope. It does not matter what type of packets are received. Described in 
the other (non orthogonal) mail.

Cheers,
R.

>> -----Original Message----- From: Robert Raszuk
>> [mailto:[email-masked]] Sent: Saturday, April 02, 2011 11:15 AM
>> To: Jakob Heitz Cc: idr Subject: Re: [Idr]
>> draft-bashandy-idr-bgp-repair-label-01: when does PE revert back to
>> standard label?
>>
>> Hi Jakob,
>>
>>> Suppose the CE is first attached to PE1 and PE2. Then it detaches
>>> from PE1 and attaches to PE3. It will never reattach to PE1.
>>>
>> The repair label of CE-PE2 is used as a backup path for CE-PE1
>> primary best path on PE1.
>>
>> When the on the PE1 the link to CE fails we will switch to use
>> backup only for the duration it takes routing protocol to remove
>> the primary path CE-PE1 reachability and make the CE-PE2 as best
>> path.
>>
>> Keep in mind that we are protecting the best path of the net not
>> the net itself.
>>
>> Then such best will be unprotected till we get a new path via
>> CE-PE3 and install it as backup or till the link comes up again and
>> new best path CE-PE1 will be installed.
>>
>> Cheers, R.
>>

---

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 17:13:04 -0400

> Sent: Saturday, April 02, 2011 2:10 PM
> To: Jakob Heitz
> Cc: idr

That causes the repair label to be used towards PE2.

> Yes, but only after the local control plane convergence happens.

Not necessary.

> the other (non orthogonal) mail.

Not described.
Please read carefully and understand before answering.

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 02 Apr 2011 23:30:35 +0200

Jakob,

> That causes the repair label to be used towards PE2.

No. You need to realize that control plane trigger is not equal to data 
plane trigger. Those are two totally separate message paths with 
different forwarding outcome.

Any sort of FRR uses data plane/forwarding event to trigger really fast 
prefix independent switchover (usually less then 50ms) to a backup path.

However control plane is much slower. But will eventually in 100s of ms 
converge completely removing the original directly connected best path 
and it's protection via PE2.

It is really very simple.

>> Yes, but only after the local control plane convergence happens.

;)

>> Nope. It does not matter what type of packets are received.
>> Described in the other (non orthogonal) mail.
>
> Not described.

I did, but apparently my answer was a little bit implicit but I hoped 
you will parse it. So let me try again ...

The draft says black on white:

"and associate a local label with each prefix such as L3VPN [9], 6PE 
[10], and Softwire [8]"

it directly means to me that as written it is not applicable to IPv4 and 
IPv6 non mpls protection.

And as suggested that can be fixed extending the scope of the draft to 
make it applicable also to unicast IPv4 and IPv6 as this is not only 
safe, but also desired in mpls networks where best external is injected.

R.

---

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 17:59:16 -0400

Robert,

You are talking about something quite different.
Please understand the scenario I described
and answer it directly.

I'll describe it again, using the diagram from the draft:
I will add another CE, CE2. CE2 will send an IP packet to CE.

Initial topology:

         +--------------------------+
         |                          |   +-----CE2
         |      BGP free Core       |  /
         |                          | /
         |      +------------------PE1----+
         |     /                    |      \
         |    /                     |       \
         |   /                      |        \
         |  /                       |         \
         | /                        |          *
        PE3                         |          CE....... VPN prefix
         | \                        |          *          (P/p)
         |  \                       |         /
         |   \                      |        /
         |    \                     |       /
         |     \                    |      /
         |      +------------------PE2----+
         |                          |
         |                          |
         +--------------------------+

CE detaches from PE1 and attaches to PE3.

         +--------------------------+
         |                          |   +-----CE2
         |      BGP free Core       |  /
         |                          | /
         |      +------------------PE1
         |     /                    |
         |    /                     |
         |   /                      |
         |  /                       |
         | /                        |
        PE3                         |          CE....... VPN prefix
       / | \                        |          *          (P/p)
      +  |  \                       |         /|
      |  |   \                      |        / |
      |  |    \                     |       /  |
      |  |     \                    |      /   |
      |  |      +------------------PE2----+    |
      |  |                          |          |
      |  |                          |          |
      |  +--------------------------+          |
      |                                        |
      +----------------------------------------+

If PE3 sends an MPLS packet to PE1, PE1 uses the repair label to send to PE2.
If CE2 sends an IP packet to PE1, PE1 should use the primary label to send it to PE2.
It should NEVER use the repair label to send that packet.

The reason? If the link PE2 - CE were to fail, PE2 would not use the backup to PE3.

         +--------------------------+
         |                          |   +-----CE2
         |      BGP free Core       |  /
         |                          | /
         |      +------------------PE1
         |     /                    |
         |    /                     |
         |   /                      |
         |  /                       |
         | /                        |
        PE3                         |          CE....... VPN prefix
       / | \                        |          *          (P/p)
      +  |  \                       |          |
      |  |   \                      |          |
      |  |    \                     |          |
      |  |     \                    |          |
      |  |      +------------------PE2         |
      |  |                          |          |
      |  |                          |          |
      |  +--------------------------+          |
      |                                        |
      +----------------------------------------+

--
Jakob Heitz.

> Sent: Saturday, April 02, 2011 2:31 PM
> To: Jakob Heitz
> Cc: idr

---

From: Robert Raszuk <[email-masked]>
Date: Sun, 03 Apr 2011 00:24:04 +0200

Hi Jakob,

> If PE3 sends an MPLS packet to PE1, PE1 uses the repair label to send
> to PE2. If CE2 sends an IP packet to PE1, PE1 should use the primary
> label to send it to PE2. It should NEVER use the repair label to send
> that packet.
>

Nope - sorry.

1st point: We are working here to protect against single failure not
double failure like in your example.

Now direct answer with sequence of events including time scale for 
better description:

- -10ms CE2 communicates via PE1 with CE without any protection
-  0ms CE is getting re-homed from PE1 to PE3
-  20ms PE1 on data plane is starting to use a backup label and nh=PE2
- 300ms PE1 converges control plane and starts to use primary label as
   advertised by PE2 (in the same time all network is recalculating as
   well removing CE via PE1 path)
- @ next failure - PE2-CE fails PE2 will already have a backup via PE3
   in it's data plane using backup label as advertised by PE3.

Rgs,
R.

---

From: Jakob Heitz <[email-masked]>
Date: Sat, 2 Apr 2011 20:23:39 -0400

> Sent: Saturday, April 02, 2011 3:24 PM
> To: Jakob Heitz
> Cc: idr

It's not a double failure.

> -  20ms PE1 on data plane is starting to use a backup label and nh=PE2

It uses repair label for packets received from PE3. (MPLS)
It uses primary label for packets received from CE2. (native IP)

>    well removing CE via PE1 path)

still:
It uses repair label for packets received from PE3. (MPLS)
It uses primary label for packets received from CE2. (native IP)