Subject: Re: [nvo3] Multi-subnet VNs [was Re: FW: New Version Notification for draft-yong-nvo3-frwk-dpreq-addition-00.txt]

From: "Vivek Kumar" <[email-masked]>
Date: Thu, 27 Dec 2012 09:02:13 +0000

Hi Kireeti,
 One clarification . When you say  "route if IP, bridge otherwise"  , did you mean that all IP packets should be routed even if they come without router MAC address ( MAC-DA doesn't match the router address) ?

Regards,
Vivek

Date: Wed, 26 Dec 2012 18:48:59 -0800
From: Kireeti Kompella <[email-masked]>
To: Lucy yong <[email-masked]>
Cc: Thomas Narten <[email-masked]>, "[email-masked]"
	<[email-masked]>,	Aldrin Isaac <[email-masked]>, "NAPIERALA,
	MARIA H" <[email-masked]>
Subject: Re: [nvo3] Multi-subnet VNs [was Re: FW: New Version
	Notification	for draft-yong-nvo3-frwk-dpreq-addition-00.txt]
Message-ID:
	<CABRz93VCm57rc59SdWNuDZuQRfbv_0=[email-masked]>
Content-Type: text/plain; charset="iso-8859-1"

Hi Lucy,

On Wed, Dec 26, 2012 at 8:33 AM, Lucy yong <[email-masked]> wrote:

>  Kireeti,****
>
> ** **
>
> It seems that you make EVPN and IPVPN orthogonal now: If IP, use IPVPN, if
> not, EVPN.****
>
> ** **
>
> Do you also see that the end system can be distinguished this way?****
>
> ** **
>
> Using IP VPN for all the IP applications is good in one way, but it
> requires the substantial changes on all the hosts/hypervisor and require
> the behavior changes on the VM/physical server. Giving millions VM/servers
> are there, will this realistic?   Why do we ask all the tenant systems to
> change behavior in order to use of IPVPN?
>

The only change needed is on the NVE.  If this resides in the
host/hypervisor, so be it.  The NVE has to change to implement IP VPN/EVPN.
 The additional change to "route if IP, bridge otherwise" is minor.

No change is needed on the VM/tenant system.

BTW, as an example, IRB (if my MAC, then route else bridge) is completely
transparent to the end host (VM, tenant system).

Kireeti.

IMO, IPVPN is very useful for many applications and it is also  necessary
> to support multi-tenancy in DC without changing tenant system behavior.***
> *
>
> ** **
>
> Thanks,****
>
> Lucy ****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Kireeti Kompella
> *Sent:* Friday, December 21, 2012 10:21 PM
> *To:* NAPIERALA, MARIA H
> *Cc:* Thomas Narten; [email-masked]; Aldrin Isaac
> *Subject:* Re: [nvo3] Multi-subnet VNs [was Re: FW: New Version
> Notification for draft-yong-nvo3-frwk-dpreq-addition-00.txt]****
>
> ** **
>
> Hi Maria,****
>
> ** **
>
> On Dec 20, 2012, at 13:36, "NAPIERALA, MARIA H" <[email-masked]> wrote:***
> *
>
> The question is what problem does EVPN solve? ****
>
>  Pure layer 2 traffic. Yes, it does exist, and needs to be dealt with
> properly. But just that. ****
>
> In the context of DC, EVPN can only address packets bridged in the same
> VLAN. If most packets are routed then EVPN, even if all the complexity
> problems are addressed, doesn't achieve anything for the traffic that is
> routed. I believe it is the wrong tradeoff to design a solution around EVPN
> (i.e., around bridging).****
>
>  Agreed.****
>
> ** **
>
> Kireeti. ****
>
> _______________________________________________
> nvo3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nvo3
>
>

-- 
Kireeti

---

From: Lucy yong <[email-masked]>
Date: Thu, 27 Dec 2012 17:08:56 +0000

Very good question. I am confused too. All the traffic from a VM/server has IP and MAC header. Thus, they are all IP packets.
Lucy

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Vivek Kumar
> Sent: Thursday, December 27, 2012 3:02 AM
> To: [email-masked]; [email-masked]
>  One clarification . When you say  "route if IP, bridge otherwise"  ,
> did you mean that all IP packets should be routed even if they come
> without router MAC address ( MAC-DA doesn't match the router address) ?
> 
> Regards,
> Vivek
> 
>

---

From: Robert Raszuk <[email-masked]>
Date: Thu, 27 Dec 2012 18:13:41 +0100

> Very good question. I am confused too. All the traffic from a VM/server has IP and MAC header. Thus, they are all IP packets.

Interesting ... if they are *all* IP packets then why do we need EVPN at all ???

Cheers,
R.

---

From: Lucy yong <[email-masked]>
Date: Thu, 27 Dec 2012 17:19:07 +0000

Because L2 Ethernet Service has the nature of "plug and play" and much less configuration and maintenance. It has no request to the host. An IP host uses arp to find the destination MAC and everything goes.

Lucy 

> Robert Raszuk
> Sent: Thursday, December 27, 2012 11:14 AM
> To: Lucy yong
> Cc: Vivek Kumar; [email-masked]; [email-masked]
> > Very good question. I am confused too. All the traffic from a
> VM/server has IP and MAC header. Thus, they are all IP packets.
> > Lucy
>

---

From: Jakob Heitz <[email-masked]>
Date: Thu, 27 Dec 2012 18:38:24 +0000

If a router were to route an IP packet that was not
addressed to it on the MAC layer, it would cause a
new interesting category of routing loops. Not the
kind I'd like to study, so let's not do that.

--
Jakob Heitz.

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Lucy yong
> Sent: Thursday, December 27, 2012 9:09 AM
> To: Vivek Kumar; [email-masked]; [email-masked]
> > > problems are addressed, doesn't achieve anything for the 
> traffic that
> > is

---

From: Lucy yong <[email-masked]>
Date: Thu, 27 Dec 2012 18:59:59 +0000

I agree. But you have other complexity to deal with. Destination TS on the same subnet may be behind that router. 

Lucy

> From: Jakob Heitz [mailto:[email-masked]]
> Sent: Thursday, December 27, 2012 12:38 PM
> To: Lucy yong; Vivek Kumar; [email-masked]; [email-masked]
> Subject: RE: [nvo3] Multi-subnet VNs [was Re: FW: New Version
> > > > In the context of DC, EVPN can only address packets bridged in
> the
> > > same

---

From: Kireeti Kompella <[email-masked]>
Date: Thu, 27 Dec 2012 19:10:26 -0800

If you "route if IP, bridge otherwise", the Ethernet header for IP packets is pretty much just framing; the DA shouldn't matter. To avoid confusion, have the NVE be the gateway router, and also respond to all ARPs with its own MAC.  Then all IP frames will have a DA of the NVE. That keeps things clean, and "route if IP, bridge otherwise" falls out naturally. 

Kireeti

---

From: "Vivek Kumar" <[email-masked]>
Date: Fri, 28 Dec 2012 03:19:45 +0000

Hi Kireeti,
      This mean that IP packet will always undergo routing even if someone just want L2 based service. The L2 and L3 service in nvo-dataplane-requirement draft  gives both option of forwarding. Even a IP packet can be forwarded by using L2 header information. But your proposal of making "All IP packet route" takes away the flexibility of L2 forwarding IP packets  .

Regards,
Vivek

-----Original Message-----
From: Kireeti Kompella [mailto:[email-masked]] 
Sent: Friday, December 28, 2012 8:40 AM
To: Vivek Kumar
Cc: [email-masked]
Subject: Re: Multi-subnet VNs [was Re: FW: New Version Notification for draft-yong-nvo3-frwk-dpreq-addition-00.txt]

Kireeti

---

From: Lucy yong <[email-masked]>
Date: Fri, 28 Dec 2012 17:32:54 +0000

Hi Kireeti,

Thank you to make it clear. 

You can implement this way for "route if IP". However, this prohibits some other use cases. For some heavy policy enforced inter-subnet routing, operator may want to place gateway router in few places for easier management, i.e. not on every NVE, and use L2 overlay to bridge TSes and gateway router. In this scenario, the gateway router does not have the way to control ARP protocol behavior in L2 overlay. To make it work, the gateway router has to control its own ARP message reply. IMO: this is also a useful use case, and use bridge and route for IP.

Furthermore, to implement this way, essentially you have p2p virtual link between a TS and NVE, which may be applicable for some use cases but not other.   

Regards,
Lucy

> Kireeti Kompella
> Sent: Thursday, December 27, 2012 9:10 PM
> To: Vivek Kumar
> Cc: [email-masked]
> If you "route if IP, bridge otherwise", the Ethernet header for IP
> packets is pretty much just framing; the DA shouldn't matter. To avoid
> confusion, have the NVE be the gateway router, and also respond to all
> ARPs with its own MAC.  Then all IP frames will have a DA of the NVE.
> That keeps things clean, and "route if IP, bridge otherwise" falls out
> naturally.
> 
> Kireeti
>