PIM Join/ Prune Attributes for LISP Environments using Underlay Multicast
Cisco
venggovi@cisco.com
Cisco
svenaas@cisco.com
Routing
Internet Engineering Task Force
template
This document specifies an extension to PIM Receiver RLOC Join/ Prune attribute that supports the
construction of multicast distribution trees where the root and
receivers are located in different Locator/ID Separation Protocol
(LISP) sites and are connected using underlay IP Multicast. This attribute allows the receiver site to signal
the underlay multicast group to the control plane of the root ITR (Ingress Tunnel Router).
Introduction
The construction of multicast distribution trees where the root and
receivers are located in different LISP sites is defined in
.
specifies that (root-EID, G) data packets are to be LISP-
encapsulated into (root-RLOC, G) multicast packets.
defines PIM J/P attribute extensions to construct multicast distribution trees.
This document extends the Receiver ETR RLOC PIM J/P attribute
to facilitate the
construction of underlay multicast trees for (root-RLOC, G).
Specifically, the assignment of the underlay multicast group needs to be done in consonance with
the downstream xTR nodes and avoid unnecessary replication or traffic hairpinning.
Since the Receiver RLOC Attribute defined in only
addresses the Ingress Replication case, an extension of the scope of that PIM J/P attribute is defined by this draft to include
scenarios where the underlay uses Multicast transport. The scope extension proposed here complies
with the base specification .
This document uses terminology defined in , such as EID,
RLOC, ITR, and ETR.
Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119.
When LISP based Multicast trees can be built using IP Multicast in the underlay, the mapping between
the overlay group address and the underlay group address becomes a very crucial engineering decision:
- Flexible mapping of overlay to underlay group ranges:
- Three different types of overlay to underlay group mappings are possible: Many to one mapping: Many (root-EID, G) flows originating from a RLOC can be mapped to the same underlay (root-RLOC, G-u) flow. One to many mapping: Conversely the same overlay flow can be mapped to two or more flows e.g. (root-RLOC, G-u1) and (root-RLOC, G-u2) to cater to the requirements of downstream xTR nodes. One to one mapping: Every (root-EID, G) flow is mapped to a different (root-RLOC, G-u) flow.
The overlay can use ASM while the underlay can use SSM ranges.
- Multicast Address Range constraints:
-
It is possible that under certain circumstances, differnt subsets of xTRs subscribing to the same overlay
multicast stream would be constrained to use different underlay multicast mapping ranges.
This definitely involves a trade-off between replication and the flexibility in
assigning address ranges and could be required in certain situations further below.
- Inter-site PxTR:
-
When multiple LISP sites are connected through a LISP based transit, the site border node
interconnects the site-facing interfaces and the external LISP based core. Under such circumstances,
there could be different ranges of multicast group addresses used for building the (S-RLOC, G) trees
inside the LISP site and the external LISP based core. This is desired for various reasons:
- Hardware resource restrictions:
- Platform limitations could force engineering decisions to be made on restricting multicast address ranges in the underlay.
- Other Use-cases:
- TBD
Editorial Note: Comments from Stig: There should be some text indicating that the group address used should ideally only be used for LISP encapsulation (if ASM), and perhaps that it is preferrable to use an SSM group. Also, that the group obviously must be a group that the underlay supports/allows. I think it is also worth noting that ideally, different ETRs should request the same group.
Acknowledgements
The authors would like to thank Dino Farinacci and Victor Moreno for their valuable comments.
Contributors
Cisco
sankt@cisco.com
Cisco
kumaram3@cisco.com
IANA Considerations
No new requests to IANA
Security Considerations
There is perhaps a new attack vector where an attacker can send a bunch of joins with different group addresses. It may interfere with other multicast traffic if those group addresses overlap. Also, it may take up a lot of resources if replication for thousands of groups are requested. However PIM authentication (?) should come to the rescue here. TBD
Since explicit tracking would be done, perhaps it is worth enforcing that for each ETR RLOC (the RLOC used as the source of the overlay join), there could be a configurable number of maximum permissible group(s). TBD
Ed Note: To be addressed - Comments from Stig: Regarding security considerations and PIM authentication. The only solution we have here is to use IP-Sec to sign the J/P messages. I dont know if anyone has tried to us IPSec between LISP RLOCs. Are there any LISP security mechanisms that would help here for authenticating LISP encapsulated messages between xTRs?