Re: [Idr] Error in draft-ietf-idr-sdwan-edge-discovery use of Encapsulation Extended Community

[Susan Hares <[e-mail]>]

Linda:

The only valid Encapsulation Extended community is when the TEA would be: TEA (type +  Egress Address TLV).

You can have one of these choices
Route, Color-EC +  TEA with Egress Address TLV  + Sub-TLV – with an sub-underlay
Or
Route, TEA – with Egress Address TLV + Sub-TLV with sub-tunnel id (4 octets) + Color TLV
Or
Route,  Color-EC + (new) SDWAN-ID-EC (Egress tunnel, ID)

All of these choices require an adjustment to the text in draft-ietf-idr-sdwan-edge-discovery.

Sue


From: Linda Dunbar <[e-mail]>
Sent: Tuesday, February 27, 2024 11:01 PM
To: John Scudder <[e-mail]>
Cc: Robert Raszuk <[e-mail]>; [e-mail]; [e-mail]
Subject: RE: Error in draft-ietf-idr-sdwan-edge-discovery use of Encapsulation Extended Community

John, The Color Extended Community alone is not enough. For example, one SD-WAN edge has 5 routes (Route #1 ~#5) with 3 types of underlay paths (IPsec over Internet, SRv6 , and unsecure internet). Rou
External ([e-mail]<mailto:[e-mail]>)
  Report This Email<https://protection.inkyphishfence.com/report?id=bmV0b3JnMTA1ODY5MTIvc2hhcmVzQG5kemguY29tLzBlYzJjOGJmMmViMmYzYjhhZTI0MjlkMDRjYzc2N2VlLzE3MDkwOTI4ODYuMw==#key=0b2224e48af5346641bc7ea28be2ff77>  FAQ<https://www.godaddy.com/help/report-email-with-advanced-email-security-40813>  GoDaddy Advanced Email Security, Powered by INKY<https://www.inky.com/protection-by-inky>

John,

The Color Extended Community alone is not enough.
For example, one SD-WAN edge has 5 routes (Route #1 ~#5) with 3 types of underlay paths (IPsec over Internet, SRv6 , and unsecure internet).

Route #1 &  #2 have to be forwarded by SRv6, but Route #1 needs to use the SRv6 Red Color paths, Route #2 needs to use the SRv6 Blue Color paths.

In conclusion: SD-WAN routes (or customer traffic) need to have both Encapsulation Extended Community and the Color Extended Community.

Linda

From: John Scudder <[e-mail]<mailto:[e-mail]>>
Sent: Tuesday, February 27, 2024 9:14 PM
To: Linda Dunbar <[e-mail]<mailto:[e-mail]>>
Cc: Robert Raszuk <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: Error in draft-ietf-idr-sdwan-edge-discovery use of Encapsulation Extended Community

You could accomplish that using the Color Extended Community. See second-last paragraph of Section 8.

—John

On Feb 27, 2024, at 9:31 PM, Linda Dunbar <[e-mail]<mailto:[e-mail]>> wrote:

[External Email. Be cautious of content]

John,
Here is the SD-WAN scenario why simple Nexthop cannot do the job:

Suppose one SD-WAN edge has 3 client routes (#1, #2, #3)  and multiple underlay paths (public unsecure paths & private secure paths) to other peer nodes:
1) The client route #1 needs to be forwarded by a private path (such as network service provider's MPLS path),
2) The  client route #2 (at the same nextHop) can be forwarded by IPsec SA or MPLS (i.e., the Hybrid tunnel described in the document)
3) The client route #3 can be forwarded by unsecure path (such as web browsing traffic)

When this SD-WAN edge advertises Client Route #1, it needs to indicate the necessary encapsulation type to be MPLS.
When this SD-WAN edge advertises the Client Route #2, it needs to indicate the encapsulation type to be SD-WAN-Hybrid.
When the SD-WAN edge advertises the Client Route #3, it only needs to indicate the NextHop.

Linda

-----Original Message-----
From: John Scudder <[e-mail]<mailto:[e-mail]>>
Sent: Tuesday, February 27, 2024 6:37 PM
To: Linda Dunbar <[e-mail]<mailto:[e-mail]>>
Cc: Robert Raszuk <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: Error in draft-ietf-idr-sdwan-edge-discovery use of Encapsulation Extended Community

Hi Linda,

> On Feb 27, 2024, at 7:12 PM, Linda Dunbar <[e-mail]<mailto:[e-mail]>> wrote:
>
> Our intent of using Encapsulation Extended Community is to indicate
> that Client routes need to be forwarded by a tunnel, but there is too much information about the  Tunnel attributes to be included in the Client route advertisement and those attributes are associated with the WAN ports (instead with Client Routes).
>
> We need to interpret the "barebones" as a hook to inform the peer nodes to use information carried in  the second UPDATE to establish the tunnel for the Client routes.

I don’t see why you need any indication beyond the next hop. It’s both necessary (so that the recipient can find the route that has the tunnel information) and sufficient (because once it finds that route, it will see it includes tunnel information). This is exactly what Section 8 explains.

> I don't understand why RFC9012 doesn't allow this. What harm does it cause?

If RFC 9012 was still in draft, and you had suggested the idea above as a change to the spec, we could have had this discussion. But it’s moot now — RFC 9012 is what it is, and what it is, very specifically and precisely does *not* allow a tunnel type that has mandatory sub-TLVs to be used as an Encapsulation Extended Community, and does *not* require any additional information beyond the next hop to “glue” a client route to an underlay route that has a tunnel attribute.

If you want to use RFC 9012, it is what it is. If you think (for some reason I don’t yet understand) that you need to have an extra “hook” beyond the next hop, you can specify some new thing to do that.

—John