Enhancement for Monitoring VRF's Loc-RIB

Introduction The generation of BGP Adj-RIB-In, Loc-RIB, and Adj-RIB-Out comes from BGP route exchange and route policy processing . BGP Monitoring Protocol (BMP) provides the monitoring of BGP Adj-RIB-In , BGP Loc-RIB , and BGP Adj-RIB-Out . Using BMP Loc-RIB , the Peer Address field of a Per-Peer header is Zero-filled, and the Peer Distinguisher value of a VPN route information is setted to the route distinguisher or unique locally defined value of the particular instance the Loc-RIB belongs to. The following usecase is used as an example to describe the problems faced by the current solution. Figure 1: Monitoring VRF's Loc-RIB PE1, PE2, and PE3 establish BGP VPNv4 peer sessions with the RR, as shown in the above figure, PE1 receives multiple VPNv4 routes with the address prefix P1: Figure 2: VPNv4 Routes in PE1 The above 4 routes carry the route target RT1 and the import route target of the VPN instance VPN11 of PE1 is RT1, VPN11 of PE1 will selects one route from the 4 routes as the best route, for example, the route with RD22, and import the route with RD22 to the routing table of the VPN instance VPN11 of PE1. Figure 3: VPN Routes in the routing table of the VPN instance VPN11 PE1 uses the solution defined in RFC9069 to report the Loc-RIB route information in VPN11 to the BMP server. The RD of VPN11 on PE1 Peer Address: 0.0.0.0 Peer BGP ID: 10.10.10.1 --> The router-id of the VRF instance VPN11 ]]> Figure 4: The Loc-RIB routing information in VPN11 to the BMP server PE1 reports the Loc-RIB routing information in VPN11 to the BMP server through an RM message. Problem: After obtaining the above route information via the RM message, the BMP server cannot deduce the remote VPN instance information corresponding to the VPN route information because the reported information does not contain the remote device address and the RD of the remote VPN instance. When reporting the Loc-RIB routing information in VPN11 to the BMP server by using an RM message, PE1 reports the remote device address and the RD of the remote VPN instance by using TLVs newly added in this draft.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

TLV Encoding This section describes a solution based on BMPv4 TLVs . Section 2.1 describes a BMPv4 TLV used to convey the Remote VRF Information TLV. Section 2.2 and 2.3 introduces optional TLVs to report the label/SRv6 ID carried in the remote VPN route.

Remote VRF Information TLV The format of the Remote VRF Information TLV is defined as follows: Figure 5: The format of the Remote VRF Information TLV Where:

Information Type: indicates a Remote VRF Information TLV, the value is TBD1.
Information Length: It indicates the length of the value of the Remote VRF Information TLV and excludes the 2 octets of the index field.
Index: The Index field is 2-byte long of which the top-most bit, G-bit, is used to flag a Group Index. It is defined in .
AFI: address family information
SAFI: sub-address family information
Remote BGP ID: remote peer address or BGP ID or Originater
Remote Route Distinguisher: indicates the RD of the remote VPN instance.

A BMP speaker that supports this extension MAY attach the Remote VRF Information TLV to BMP Route Monitoring messages carrying VRF Loc-RIB routes. When included, all fields of this TLV MUST follow the encoding defined in Figure 5. A BMP collector MAY ignore this TLV without breaking interoperability with existing BMP processing.

Applicability to EVPN Type-5 / IRB Inter-VRF Route Leaking The Remote VRF Information TLV defined in this section applies equally to EVPN Loc-RIB reporting for EVPN Route Type 5 (IP Prefix Route) RFC7432 routes that have been leaked between EVPN Instances (EVIs) via Integrated Routing and Bridging (IRB), by setting AFI=25 and SAFI=70 in the TLV. No change to the wire format defined in Figure 5 is required. This addresses the dynamic inter-VRF route leaking (IVRL) gap noted in , which defines per-EVI counters that quantify how many routes were leaked into a given EVI, but does not itself identify which remote EVI each leaked route came from. The TLV defined in this document supplies that missing detail. The two mechanisms are intended to be used together rather than as alternatives.

VPN Label TLV In some usecases, the label carried in the remote VPN route needs to be reported. Therefore, the following TLV are defined in this document: Figure 6: The format of the VPN Label TLV Where:

Information Type: indicates a VPN Label TLV, the value is TBD2.
Information Length: indicates the length of the value of the VPN Label TLV, it excludes the 2 octets of the index field.
Index: The Index field is 2-byte long of which the top-most bit, G-bit, is used to flag a Group Index. It is defined in .
MPLS Label for Remote VPN Route: indicates the MPLS Label of the remote VPN route.

The VPN Label TLV is OPTIONAL. A speaker that implements the Remote VRF Information TLV MAY additionally include this TLV to report the MPLS label carried in the original remote VPN route. If present, the MPLS Label field MUST be encoded as shown in Figure 6.

VPN SRv6 SID TLV In some usecases, the SRv6 ID carried in the remote VPN route needs to be reported. Therefore, the following TLV are defined in this document: Figure 7: The format of the VPN SRv6 SID TLV Where:

Information Type: indicates a VPN SRv6 SID TLV, the value is TBD3.
Information Length: indicates the length of the value of the VPN SRv6 SID TLV, it excludes the 2 octets of the index field.
Index: The Index field is 2-byte long of which the top-most bit, G-bit, is used to flag a Group Index. It is defined in .
SRv6 SID for Remote VPN Route: indicates the SRv6 SID of the remote VPN route.

The VPN SRv6 SID TLV is OPTIONAL. A speaker that implements the Remote VRF Information TLV MAY additionally include this TLV to report the SRv6 SID carried in the original remote VPN route. If present, the SRv6 SID field MUST occupy 16 octets as shown in Figure 7.

Operations As described in section 1, when PE1 reports the Loc-RIB routing information in VPN11 to the BMP server through an RM message, PE1 reports the remote device address and the RD of the remote VPN instance through the Remote VRF Information TLV defined in this draft, as shown in the following: The RD of VPN11 on PE1 Peer Address: 0.0.0.0 Peer BGP ID: 10.10.10.1 --> The router-id of the VRF instance VPN11 Remote BGP ID: 10.10.10.2 --> The remote peer address or BGP ID or Originater Remote Route Distinguisher: RD22 --> The RD of the remote VPN instance ]]> Figure 8: The Loc-RIB routing information in VPN11 to the BMP server After obtaining the above route information via the RM message, the BMP server can deduce the remote VPN instance information corresponding to the VPN route information via the reported information in the Remote VRF Information TLV. In some usecases, the label/SRv6 ID carried in the remote VPN route needs to be reported, as described in section 1, when PE1 reports the Loc-RIB routing information in VPN11 to the BMP server through an RM message, it can report the label/SRv6 ID carried in the remote VPN route as following: The RD of VPN11 on PE1 Peer Address: 0.0.0.0 Peer BGP ID: 10.10.10.1 --> The router-id of the VRF instance VPN11 Remote BGP ID: 10.10.10.2 --> The remote peer address or BGP ID or Originater Remote Route Distinguisher: RD22 --> The RD of the remote VPN instance (Optional)Label: L22 or (Optional)SRv6 SID: SID22 ]]> Figure 9: The Loc-RIB routing information in VPN11 to the BMP server The same applies to EVPN Route Type 5 routes leaked between EVIs via IRB. Consider PE1 hosting EVI11 (RD11, import RT1) with a symmetric-IRB L3VNI, and PE2 hosting EVI21 (RD21, export RT1) whose locally attached CE advertises IP Prefix P1 as an EVPN Route Type 5. PE1 imports P1 into EVI11 via IRB. Reporting the Loc-RIB routing information in EVI11 with the Remote VRF Information TLV gives: The RD of EVI11 on PE1 Peer Address: 0.0.0.0 Peer BGP ID: 10.10.10.1 --> The router-id of EVI11 on PE1 AFI: 25, SAFI: 70 Remote BGP ID: 10.10.10.2 --> The remote peer address or BGP ID Remote Route Distinguisher: RD21 --> The RD of the remote EVI ]]> Figure 10: The Loc-RIB routing information in EVI11 to the BMP server Without the TLV, the BMP server sees only that P1 is present in EVI11 with a next hop of PE2, and cannot determine that it was leaked in from EVI21 specifically.

IANA Considerations TBD

Security Considerations The same considerations as in Section 11 of apply to this document. Implementations of this protocol SHOULD require that sessions only be established with authorized and trusted monitoring devices. It is also believed that this document does not introduce any additional security considerations.