Huawei Technologies

Huawei Bld., No.156 Beiqing Rd. Beijing 100095 China lizhenbin@huawei.com

Huawei Technologies

Divyashree Techno Park, Whitefield Bangalore, Karnataka 560066 India dhruv.ietf@gmail.com

Juniper

200 Somerset Corporate Boulevard, , Suite 4001 Bridgewater, NJ 08807 USA cmargaria@juniper.net

Juniper

200 Somerset Corporate Boulevard, , Suite 4001 Bridgewater, NJ 08807 USA cbarth@juniper.net

Huawei Technologies

Huawei Bld., No.156 Beiqing Rd. Beijing 100095 China jescia.chenxia@huawei.com

Huawei Technologies

Huawei Bld., No.156 Beiqing Rd. Beijing 100095 China zhuangshunwan@huawei.com

Dissemination of the traffic flow specifications was first introduced in the BGP protocol via RFC 5575. In order to distribute the flow specifications from PCE controller to network device without BGP protocol it is desirable to extend PCEP with flow specification information. This document specifies a set of extensions to PCEP to support dissemination of flow specifications. The extensions include the instantiation, updation and deletion of flow specifications. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

Dissemination of the traffic flow specifications was first introduced in the BGP protocol . The traffic flow specification is comprised of traffic filtering rules and actions. The routers which received the flow specification can take advantage of the ACL (Access Control List) or firewall capabilities in the router's forwarding path. The routers can classify the packets according to the traffic filtering rules and shape, rate limit, filter, or redirect packets based on the actions. The flow specification carried by BGP can be used to automate inter-domain coordination of traffic filtering to mitigate (distributed) denial-of-service attacks and can also be used to provide traffic filtering in the context of a BGP/MPLS VPN service. also defines that a flow specification received from an external autonomous system will need to be validated against unicast routing before being accepted. describes a modification to the validation procedure defined in for the dissemination of BGP flow specifications. The modification proposed enables flow specifications to be originated from a centralized BGP route controller. defines the extensions to OSPF to distribute flow specifications in the networks that only deploy an IGP (Interior Gateway Protocol) (e.g., OSPF). It also defines the validation procedures for imposing the filtering information on the routers. describes the Path Computation Element Protocol (PCEP). PCEP defines the communication between a Path Computation Client (PCC) and a Path Control Element (PCE), or between PCE and PCE, enabling computation of Multiprotocol Label Switching (MPLS) for Traffic Engineering Label Switched Path (TE LSP) characteristics. Stateful pce specifies a set of extensions to PCEP to enable stateful control of TE LSPs between and across PCEP sessions in compliance with . It includes mechanisms to effect LSP state synchronization between PCCs and PCEs, delegation of control of LSPs to PCEs, and PCE control of timing and sequence of path computations within and across PCEP sessions and focuses on a model where LSPs are configured on the PCC and control over them is delegated to the PCE. describes the setup, maintenance and teardown of PCE- initiated LSPs under the stateful PCE model, without the need for local configuration on the PCC, thus allowing for a dynamic network that is centrally controlled and deployed. In case PCE is used to initiate tunnels via PCEP, it is desirable to use the same protocol to also distribute the flow specifications to describe what data flows on those tunnels. Thus, in order to distribute the flow specifications from PCE controller to network device, PCEP is extended with flow specification information in this document. introduces the architecture for PCE as a central controller and describes how PCE can be viewed as a component that perfor computation to place 'flows' within the network and decide how these flows are routed. This document specifies a set of extensions to PCEP to support dissemination of flow specifications. The flow specifications can be disseminated between PCEP peers such as from PCE to PCC or between PCEs . The extensions include the creation, updation and withdrawal of flow specifications via PCEP. The values of flow filtering rules and actions mainly refer to the BGP flow specification and IGP specification. This document extends new actions which are redirecting to LSP (refered by Symbolic Path Name, IPv4 LSP, or IPv6 LSP).

This document uses the terms defined in and . This document uses the terms defined in : PCC, PCE, PCEP Peer. The following term is from . It is used frequently throughout this document: Flow Specification (FlowSpec): A flow specification is an n-tuple consisting of several matching criteria that can be applied to IP traffic, including filters and actions. Each FlowSpec consists of a set of filters and a set of actions.

A PCC or PCE indicates its ability to support PCE FlowSpec during the PCEP Initialization Phase via "PCE FlowSpec Capability" TLV (see details in Section 5.1.1). This section introduces the procedure to support PCE FlowSpec as follows: Firstly both the PCE and PCC advertise the PCE FlowSpec Capability during the PCE session initiation phase. On the PCEP session with PCE FlowSpec Capability PCE communicates with PCC to create, update and withdraw PCE FlowSpec. [Editor's Note - The procedure about PCE FlowSpec synchronization, the session failure process, etc. will be specified in the future version.]

During PCEP session establishment, both the PCC and the PCE must announce their support of PCEP extensions for FlowSpec defined in this document. A PCEP Speaker (PCE or PCC) includes the "PCE FlowSpec Capability" TLV, described in , in the OPEN Object to advertise its support for PCEP extensions for PCE FlowSpec Capability. The presence of the PCE FlowSpec Capability TLV in PCE's OPEN message indicates that the PCE can support distribute the FlowSpec to PCC. The presence of such Capability TLV in PCC's OPEN Object indicates that the PCC can be in support of Flowspec functionality to instantiate the FlowSpec according to the PCE's indication and can apply the FlowSpec to the incoming packets. If PCE has such capability TLV and PCC has no such capability TLV PCE MUST NOT send the PCE messages with FlowSpec information. And if PCC receives such messages it should send PCErr message to PCE. [Editor's Note - PCE discovery via IGP should also be extended for this.]

To instantiate a FlowSpec which is comprised of a set of FlowSpec filter rules and actions, the PCE sends a new PCEP message (called FlowSpec message) to the PCC. The FlowSpec message MUST include the SRP object, a new FLOW object (see details in ) and a new ACTION object (see details in ). FLOW object carries a set of FlowSpec filter rules. A list of ACTION objects specify a set of FlowSpec actions. To update the FlowSpec actions of a specified FlowSpec which has been created, the same PCEP message "FlowSpec" is used. The PCE sends a FlowSpec message to the PCC. The FlowSpec message MUST include the SRP object, FLOW object and ACTION object. To delete the specified FlowSpec which has been created, the PCE sends a FlowSpec message to the PCC with a flag indicating the removal action. The FlowSpec message MUST include the SRP object (with R flag set) and FLOW object.

specify the flow specification synchronization mechanism for managing of flow specification (FLOWSPEC-DB) at node (PCC) aligning with FLOWSPEC-DB at PCE on initial session UP or session flap and specifies the required Path Computation Element Communication Protocol (PCEP) extensions. This includes full synchronization as well as optimizations such as synchronization avoidance and incremental synchronization.

As defined in , a PCEP message consists of a common header followed by a variable-length body made of a set of objects that can be either mandatory or optional. An object is said to be mandatory in a PCEP message when the object must be included for the message to be considered valid. For each PCEP message type, a set of rules is defined that specify the set of objects that the message can carry. An implementation MUST form the PCEP messages using the object ordering specified in this document. To support the PCEP FlowSpec functionality one new PCEP messages is introduced.

A FlowSpec message which is also referred to as FlowSpec message is a PCEP message sent by a PCE to a PCC to trigger creation, modification or deletion of a FlowSpec. The Message-Type field of the PCEP common header for the FlowSpec message is TBD17 (to be assigned by IANA). The FlowSpec message MUST include the SRP and the FLOW objects. If FlowSpec message is used to create or update the FlowSpec, it MUST include the ACTION objects too. If FlowSpec message is used to delete the FlowSpec the ACTION objects SHOULD NOT be carried and the SRP object is set with the R flag. A FlowSpec is identified by a PCEP specific identifier FS-ID. The format of a FlowSpec message for creation or deletion of FlowSpec is as follows:

::= Where: ::= [] ::= (| ) ::= ::= Where: ::=[]]]>

The SRP object defined in can be used in this document to correlate FlowSpec requests sent by the PCE with the error reports sent by the PCC. Every FlowSpec requests from the PCE sends a new SRP-ID-NUMBER as described in . This number is unique per PCEP session and is incremented each time an FlowSpec operation (creation, update, deletion etc) is requested from the PCE. The value of the SRP-ID-NUMBER MAY be echoed back by the PCC in PCErr messages to allow for correlation between requests made by the PCE and errors generated by the PCC. Procedure of dissemination of FlowSpec from PCE share the same number space of the SRP-ID-NUMBER with procedure of stateful PCE. The FLOW and ACTION objects are new objects introduced in this document.

The PCEP objects defined in this document are compliant with the PCEP object format defined in . New TLVs about FlowSpec filtering rules are defined. The value portion of the new TLVs can reuse the structure defined in and . New TLVs about FlowSpec actions are also defined. The value portion of the new TLVs can reuse the structure defined in . This document also defines two new actions: Redirect to IPv4 LSP and Redirect to IPv6 LSP.

The PCE-FLOWSPEC-CAPABILITY TLV is an optional TLV associated with the OPEN Object to exchange PCE FlowSpec capability of PCEP speakers. Its format is shown in the following figure:

The type of the TLV is TBD18 (to be assigned by IANA) and it has a fixed length of 2 octets. The value field is set to default value 0. The inclusion of this TLV in an OPEN object indicate that the sender can perform FlowSpec handling in PCEP.

The FLOW object MUST be present within FlowSpec messages. The FLOW object carries a set of FlowSpec filter rules. FLOW Object-Class is TBD19 (to be assigned by IANA). FLOW Object-Type is 1. The format of the FLOW object is as follows:

FS-ID(32-bit): A PCEP-specific identifier for the FlowSpec information. A PCE creates an unique FS-ID for each FlowSpec that is constant for the lifetime of a PCEP session. All subsequent PCEP messages then address the FlowSpec by the FS-ID. The values of 0 and 0xFFFFFFFF are reserved. Flow Filter TLVs(variable): The FLOW object body has a variable length and may contain one or more additional TLVs. The following flow filter types are supported:

and specify the above types for BGP. The encoding for "Destination Prefix" is described in as - Encoding: <type (1 octet), prefix length (1 octet), prefix> In PCEP, the type of flow filter is identified by the type field in the TLV header, TBD1 in case of Destination Prefix. The length field in the TLV header (as per ) is the length of the value portion in octets without padding. The value portion for "Destination IPv4 Prefix" is made up of 1 octet of prefix length followed by the prefix, padded to 4-byte alignment for the TLV. Similarly for all encoding defined in and , the value portion of the PCEP TLV uses the BGP encoding but without the type octet and pad it to 4-byte alignment. allow identificatiion of a VPN information in PCEP via a Route Distinguisher (RD) and encoded in ROUTE-DISTINGUISHER TLV. This TLV MAY be included in the FLOW object to identify the flow filter infomration, say a IPv4 destination prefix, is a VPNv4 destination prefix belonging to the VPN identified by the RD.

The ACTION object MUST be present within FlowSpec messages when creating or updating the FlowSpec. The ACTION object carries a set of FlowSpec actions. ACTION Object-Class is TBD20 (to be assigned by IANA). ACTION Object-Type is 1. The format of the ACTION object body is:

The ACTION object body has a variable length and may contain one or more additional TLVs. The following FlowSpec action types are supported:

IANA maintains the "Path Computation Element Protocol (PCEP) Numbers" registry at <http://www.iana.org/assignments/pcep>. This document requests IANA actions to allocate code points for the protocol elements defined in this document.

IANA maintains a subregistry for PCEP messages called "PCEP Messages". Each PCEP message has a message type value. This document defines a new PCEP message type value.

Each PCEP object has an Object-Class and an Object-Type. IANA maintains a subregistry called "PCEP Objects". This document defines the following new PCEP Object-classes and Object-values:

IANA maintains a subregistry called "PCEP TLV Type Indicators". This document defines the following new PCEP TLVs.

TBD.

TBD.

Once PCE initiate tunnels, it needs to further decide what data needs to flow on the newly created tunnel, a flow specification can be created at the ingress to redirect the flow to the LSP as shown below.