Subject: General question re: VRFs and FIBs...

From: "Luyuan Fang (lufang)" <[email-masked]>
Date: Mon, 26 Sep 2011 14:14:02 -0500

Derick,

Rob is right. 
It is for VPN security/protection to have separate RIB and FIB
structures.

Cheers,
Luyuan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of [email-masked]
Sent: Monday, September 26, 2011 3:00 PM
To: [email-masked]
Subject: L3VPN Digest, Vol 87, Issue 5

If you have received this digest without all the individual message
attachments you will need to update your digest options in your list
subscription.  To do so, go to 

https://www.ietf.org/mailman/listinfo/l3vpn

Click the 'Unsubscribe or edit options' button, log in, and set "Get
MIME or Plain Text Digests?" to MIME.  You can set this option
globally for all the list digests you receive at this point.

Send L3VPN mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www.ietf.org/mailman/listinfo/l3vpn
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of L3VPN digest..."

Today's Topics:

   1. General question re: VRFs and FIBs... (Derick Winkworth)
   2. Re: General question re: VRFs and FIBs... (Robert Raszuk)

----------------------------------------------------------------------

Message: 1
Date: Mon, 26 Sep 2011 10:01:21 -0700 (PDT)
From: Derick Winkworth <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: General question re: VRFs and FIBs...
Message-ID:
	<[email-masked]>
Content-Type: text/plain; charset="iso-8859-1"

All:

I'm trying to find an archived discussion or presentation discussing why
exactly the industry generally settled on having a separate FIB table
for each VRF vs having one table with a column that identifies the VRF
instance?

I'm not finding it, but I'm guessing its because of performance issues?
?

Any pointers would be great or perhaps someone on the list knows why?

Thanks!

Derick
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.ietf.org/mail-archive/web/l3vpn/attachments/20110926/55df24e
8/attachment.htm>

------------------------------

Message: 2
Date: Mon, 26 Sep 2011 19:40:19 +0200
From: Robert Raszuk <[email-masked]>
To: Derick Winkworth <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: General question re: VRFs and FIBs...
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Hi Derick,

As I recall main driver for separate RIB and FIB structures (as opposed 
to single one with index used for sharing) was customer isolation and 
separation.

If you crash one customer's RIB/FIB rest of customers can't be impacted.

It is as close as virtual/logical routers without multiplying all other 
router's resources N number of times.

Rgs,
R.

> All:
>
> I'm trying to find an archived discussion or presentation discussing
why exactly the industry generally settled on having a separate FIB
table for each VRF vs having one table with a column that identifies the
VRF instance?
>
> I'm not finding it, but I'm guessing its because of performance
issues?
>
> Any pointers would be great or perhaps someone on the list knows why?
>
> Thanks!
>
> Derick

------------------------------

_______________________________________________
L3VPN mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/l3vpn

End of L3VPN Digest, Vol 87, Issue 5
************************************

---

From: Saku Ytti <[email-masked]>
Date: Tue, 27 Sep 2011 09:48:46 +0300

On 26 September 2011 22:14, Luyuan Fang (lufang) <[email-masked]> wrote

> It is for VPN security/protection to have separate RIB and FIB

Disclaimer, I have very little understanding of router internals.

I guess this is hardware dependent? And pretty much same problem
domain as VLAN in switches, which already should give us clue there
isn't exactly single solution to the problem. Some switches don't even
allow colliding MAC addresses in unique VLAN, which speaks volumes of
implementation in that device.

But if we do have single flat FIB, how do we perform lookup against
it? Do we offer IP address as key to trie lookup and declare miss if
ultimate hit was for wrong VRF? This would be very costly lookup. And
if VRF A has two entries and VRF B has two million entries, does VRF A
suffer due to aggregate FIB?
What is cost of changing this aggregate FIB?

If we first do lookup for VRF/VLAN then lookup in single structured
FIB which contains only eligible addresses, the lookup itself can be
implemented exactly same as if you had no VLAN/VRF support at all, no
new magic need to be implemented in hardware for that part (only the
previous part of looking up the VLAN/VRF).

But exactly how this FIB will look in some modern chip like ezchip,
xelerated or trio probably does not 100% translate to either of these
(I've understood that allowing FIB to live in relatively slow DRAM has
needed some changes how the data is presented).
It would be interesting if CSCO/JNPR/ALU or someone who has designed
modern routers would give presentation in nanog/ripe on how modern
routers works.

-- 
  ++ytti