BGP Flowspec for IETF Network Slice Traffic Steering
Jie Dong
Huawei Technologies
jie.dong@huawei.com
Ran Chen
ZTE Corporation
chen.ran@zte.com.cn
Subin Wang
China Telecom
wangsb6@chinatelecom.cn
Wenying Jiang
China Mobile
jiangwenying@chinamobile.com
21 October 2024
IDR Working Group
BGP Flow Specification (Flowspec) provides a mechanism to distribute traffic flow specifications and the forwarding actions to be performed to the specific traffic flows. A set of Flowspec components are defined to specify the matching criteria that can be applied to the packet, and a set of BGP extended communities are defined to encode the actions a routing system can take on a packet which matches the flow specification.
An IETF Network Slice enables connectivity between a set of Service Demarcation Points (SDPs) with specific Service Level Objectives (SLOs) and Service Level Expectations (SLEs) over a common underlay network. To meet the connectivity and performance requirements of network slice services, network slice service traffic may need to be mapped to a corresponding Network Resource Partition (NRP). The edge nodes of the NRP needs to identify the traffic flows of specific connectivity constructs of network slices, and steer the matched traffic into the corresponding NRP, or a specific path within the corresponding NRP.
BGP Flowspec can be used to distribute the matching criteria and the forwarding actions to be preformed on network slice service traffic. The existing Flowspec components can be reused for the matching of network slice services flows at the edge of an NRP. New components and traffic action may need to be defined for steering network slice service flows into the corresponding NRP. This document defines the extensions to BGP Flowspec for IETF network slice traffic steering (NS-TS).

Introduction
BGP Flow Specification (Flowspec) [RFC8955] [RFC8956] and BGP Flow Specification Version 2 [I-D.ietf-idr-fsv2-ip-basic] provide the BGP based mechanism to distribute traffic flow specifications and the forwarding actions to be performed to the matched traffic flows. A set of Flowspec components are defined to specify the matching criteria that is applied to the packet, and a set of Traffic Filtering Action are defined to encode the actions a routing system can take on a packet which matches the flow specification.
[RFC9543] defines the term "IETF Network Slice" and discusses the general framework for requesting and operating IETF Network Slices, their characteristics, and the necessary system components and interfaces. As described in [RFC9543], an IETF Network Slice enables connectivity between a set of Service Demarcation Points (SDPs) with specific Service Level Objectives (SLOs) and Service Level Expectations (SLEs) over a common underlay network. To meet the connectivity and performance requirements, network slice services may need to be mapped to a Network Resource Partition (NRP). An NRP is a collection of resources (bufferage, queuing, scheduling, etc.) in the underlay network. Each NRP can be identified using a unique NRP ID in control plane and management plane. The NRP ID may also be encapsulated in data packet to guide the NRP-specific packet forwarding. The edge nodes of an NRP needs to identify the traffic flows of specific connectivity constructs of network slices, and steer the matched packets into the corresponding NRP, so that the packet can be forwarded via either a shortest path or a Traffic Engineering (TE) path within the NRP.
BGP Flowspec can be used to distribute the matching criteria and the forwarding actions to be preformed on specific network slice services. The existing Flowspec components can be reused for the matching of network slice service flows. New components and traffic actions may need to be defined for steering network slice service flows into the corresponding NRP. This document defines the extensions to BGP Flowspec for IETF Network Slice Traffic Steering (NS-TS).

Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

Matching Rules for Network Slice Traffic
A set of traffic matching rules can be used as the criteria to match the traffic flows of specific connectivity constructs of IETF network slice. The BGP Flowspec components as defined in
[RFC8955] [RFC8956] can be used to specify the matching rules for network slice service packets.
In some cases, such as for multi-domain network slices, data packets of a network slice are encapsulated with data plane NRP ID in a upstream network domain using the mechanisms as described in [I-D.ietf-6man-enhanced-vpn-vtn-id]. Then the ingress edge node of the downstream network domain may perform traffic matching based on the NRP ID in the packets, so that the packets can be steered into a corresponding NRP in the local domain. A new Flow component called NRP ID component is defined for this purpose.

NRP ID Component
The format of the NRP ID component follows the Flowspec encoding as defined in [I-D.ietf-idr-fsv2-ip-basic], which consists of 1-octet type field, 1-octet length field, and variable value field. The type of NRP ID component is to be assigned by IANA. The format of the value field is shown as below:
  1                   2                   3                   4
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |g|         Flags              |            Reserved            |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                            NRP ID                             |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Where
- Flags: 2-octet flag field. The first (most significant) bit is defined in this document, the rest of the flag bits SHOULD be set to zero on transmission and MUST be ignored on receipt.
  Global bit (g): When set, it indicates the NRP ID to be matched is a global unique NRP ID; otherwise the NRP ID is a domain significant NRP ID. The g bit is used for an NRP which span multiple network domains, and a global NRP ID has been coordinated among these domains.
- Reserved: 2-octet reserved bits. It SHOULD be set to zero on transmission and MUST be ignored on receipt.
- NRP ID: A 4-octet identifier which is used to identify an NRP.

Network Slice Traffic Steering Actions
For data packets which match the flow specification of a network slice, specific forwarding actions need to be applied. When the network slice service flows are mapped to an NRP in the underlay network, the packets of the flows need to be forwarded in the corresponding NRP using either a shortest (BE) path or a Traffic Engineering (TE) path.
This section describes several actions to be performed on packets which match the flow specification of a network slice.

Traffic Steering to NRP BE Path
Packets of a network slice service flow can be steered into an NRP and forwarded to the NRP egress node following the shortest path with the NRP. In this case, the identifier of the NRP needs to be carried in the packet so that the packet forwarding will be performed using the set of resources allocated to the NRP. Depends on the type of the data plane NRP specific identifier, there are two options of this traffic steering.

Redirect to NRP specific Resource-aware Segment
When resource-aware SR segments [I-D.ietf-spring-resource-aware-segments] are used to represent the network resources allocated to an NRP, packets of a network slice could be steered into an NRP BE path by encapsulating the packets with an resource-aware segment of the egress node in the NRP. For SRv6 data plane, this could be achieved using the redirect-to-ip action defined in [I-D.ietf-idr-flowspec-redirect-ip]. The mechanism for SR-MPLS data plane will be specified in a future version.

Encapsulate-NRP-ID Action
When a data plane NRP ID [I-D.ietf-teas-nrp-scalability] is used to identify the set of network resources allocated to an NRP, packets of a network slice service flow could be steered into an NRP BE path by encapsulating the NRP ID together with the IP address or the SR SID of the egress node in the NRP.
For encapsulating the NRP ID to the matched packets, a new BGP extended community is defined for the "Encapsulate-NRP-ID" action. The format of this extended community is as below:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |   Sub-Type    |E|           Flags             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            NRP ID                             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
          Figure 1. The format of Encapsulate-NRP-ID action
where:
- Type: 0x80. It belongs to the Generic Transitive Extended Community Type as defined in [RFC9184].
- Sub-type: 1 octet to be assigned by IANA.
- Flags: 2-octet flag field. The first bit is defined in this document. The rest of the flags are unused, which SHOULD be set to zero on transmission and MUST be ignored on receipt.
  Encapsulate (E) bit: When set, it indicates the NRP ID MUST be encapsulated with an outer header to the packet. Otherwise the NRP ID replaces the NRP ID in the existing header of the packet.
- NRP ID: A 4-octet identifier which is used to identify an NRP.
If a packet matches the flow specification of an IETF network slice, and the traffic actions associated with the flow specification is the Encapsulate-NRP-ID action, then the packet is encapsulated with an NRP ID in the packet header. The Encapsulate-NRP-ID action MAY be used together with the "Rediect-to-IP" action as defined in [I-D.ietf-idr-flowspec-redirect-ip], in that case the destination address of the outer IP header is set to the IP address in the redirect to IP next-hop action. The IPv6 encapsulation of NRP ID is specified in [I-D.ietf-6man-enhanced-vpn-vtn-id]. The encapsulation of NRP-ID in other data plane is for further study and out of the scope of this document.

Traffic Steering to NRP TE Path
Packets of a network slice can be steered into a TE path within the corresponding NRP. In an SR network, the network slice traffic can be steered into an SR Policy [RFC9256] which is associated with the corresponding NRP.
In SR networks where the NRP is instantiated using NRP specific resource-aware segments [I-D.ietf-spring-resource-aware-segments], the segment list of the SR policy are built with resource-aware SR segments which represents the set of network resources allocated to the NRP on different network segments.
In SR networks where the data plane NRP-ID is used to identify the set of network resources allocated to the NRP, the mechanism as defined in[I-D.ietf-idr-sr-policy-nrp] provides the BGP SR Policy extensions to associate an SR Policy candidate path with an NRP-ID.
In both the above two cases, the mechanism defined in [I-D.ietf-idr-ts-flowspec-srv6-policy] could be used to steer traffic to an SR Policy which is associated with an NRP.

Security Considerations
The security considerations of BGP [RFC4271] and BGP Flowspec [RFC8955] [RFC8956] apply to this document.

IANA Considerations
IANA is requested to assign a new type code point from "Flow Spec Component Types" registry.
      Type Value      IPv4 Name     IPv6 Name     Reference
      ----------     ----------    ----------    -------------
       TBA1            NRP ID        NRP ID      This document

IANA is requested to assign a new sub-type from "Generic Transitive Extended Community Sub-Types" registry.
      Value            Description                Reference
      -----     ---------------------------     -------------
      TBA2      Flowspec Encapsulate-NRP-ID     This document

Acknowledgments
The authors would like to thank Haisheng Wu, Haibo Wang and Shunwan Zhuang for the review and discussion of this document.

Normative References
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119

Informative References
[RFC8955]
[RFC8956]
[I-D.ietf-idr-fsv2-ip-basic]
[RFC9543]
[RFC8174]
[I-D.ietf-6man-enhanced-vpn-vtn-id]
[I-D.ietf-spring-resource-aware-segments]
[I-D.ietf-idr-flowspec-redirect-ip]
[I-D.ietf-teas-nrp-scalability]
[RFC9184]
[RFC9256]
[I-D.ietf-idr-sr-policy-nrp]
[I-D.ietf-idr-ts-flowspec-srv6-policy]
[RFC4271]