3.1.1. FIB Construction Example

This section is non-normative and provides a worked example of how a FIB might be constructed using OSPF and IS-IS extensions. It is based on the process described in Section 3.1.¶

• Router E is SR-MPLS capable, so it advertises a Segment Routing Global Block (SRGB) using [RFC8665] or [RFC8667].¶
• When Router E advertises the Prefix-SID SID(E) of prefix P(E), it also advertises the encapsulation endpoint address and the tunnel type of any tunnel used to reach E using [ISIS-ENCAP] or [OSPF-ENCAP].¶

• If A and E are in different domains, then the information is flooded into both domains and any intervening domains.¶

  • The OSPF Tunnel Encapsulations TLV [OSPF-ENCAP] or the IS-IS Tunnel Encapsulation Type sub-TLV [ISIS-ENCAP] is flooded domain wide.¶
  • The OSPF SID/Label Range TLV [RFC8665] or the IS-IS SR-Capabilities sub-TLV [RFC8667] is advertised domain wide so that router A knows the characteristics of router E.¶

  • When router E advertises the prefix P(E):¶

    • If router E is running IS-IS, it uses the extended reachability TLV (TLVs 135, 235, 236, 237) and associates the IPv4/IPv6 or IPv4/IPv6 Source Router ID sub-TLV(s) [RFC7794].¶
    • If router E is running OSPF, it uses the OSPFv2 Extended Prefix Opaque Link-State Advertisement (LSA) [RFC7684] and sets the flooding scope to Autonomous System (AS) wide.¶
  • If router E is running IS-IS and advertises the IS-IS Router CAPABILITY TLV (TLV 242) [RFC7981], it sets the "Router ID" field to a valid value or includes an IPv6 TE Router ID sub-TLV (TLV 12), or it does both. The "S" bit (flooding scope) of the IS-IS Router CAPABILITY TLV (TLV 242) is set to "1".¶

• Router A programs the FIB entry for prefix P(E) corresponding to the SID(E) according to whether a pop or swap action is advertised for the prefix as follows:¶

  • If the No-PHP (NP) Flag in OSPF or the Persistent (P) Flag in IS-IS is clear:¶

    • pop the top label¶

  • If the No-PHP (NP) Flag in OSPF or the Persistent (P) Flag in IS-IS is set:¶

    • swap the top label to a value equal to SID(E) plus the lower bound of the SRGB of E¶

When forwarding the packet according to the constructed FIB entry, the router encapsulates the packet according to the encapsulation as advertised using the mechanisms described in [ISIS-ENCAP] or [OSPF-ENCAP]. It then sends the packets towards the next hop NHi.¶

Note that [RFC7510] specifies the use of port number 6635 to indicate that the payload of a UDP packet is MPLS, and port number 6636 for MPLS-over-UDP utilizing DTLS. However, [ISIS-ENCAP] and [OSPF-ENCAP] provide dynamic protocol mechanisms to configure the use of any Dynamic Port for a tunnel that uses UDP encapsulation. Nothing in this document prevents the use of an IGP or any other mechanism to negotiate the use of a Dynamic Port when UDP encapsulation is used for SR-MPLS, but if no such mechanism is used, then the port numbers specified in [RFC7510] are used.¶

3.2.1. Packet Forwarding with Penultimate Hop Popping

The description in this section assumes that the label associated with each Prefix-SID is advertised by the owner of the Prefix-SID as a Penultimate Hop-Popping (PHP) label. That is, if one of the IGP flooding mechanisms is used, the NP-Flag in OSPF or the P-Flag in IS-IS associated with the Prefix-SID is not set.¶

 +-----+       +-----+       +-----+       +-----+       +-----+
 |  A  +-------+  B  +-------+  C  +-------+  D  +-------+  H  |
 +-----+       +--+--+       +--+--+       +--+--+       +-----+
                  |             |             |
                  |             |             |
               +--+--+       +--+--+       +--+--+
               |  E  +-------+  F  +-------+  G  |
               +-----+       +-----+       +-----+


      +--------+
      |IP(A->E)|
      +--------+                 +--------+        +--------+
      |  UDP   |                 |IP(E->G)|        |IP(G->H)|
      +--------+                 +--------+        +--------+
      |  L(G)  |                 |  UDP   |        |  UDP   |
      +--------+                 +--------+        +--------+
      |  L(H)  |                 |  L(H)  |        |Exp Null|
      +--------+                 +--------+        +--------+
      | Packet |     --->        | Packet |  --->  | Packet |
      +--------+                 +--------+        +--------+

In the example shown in Figure 3, assume that routers A, E, G, and H are capable of SR-MPLS while the remaining routers (B, C, D, and F) are only capable of forwarding IP packets. Routers A, E, G, and H advertise their Segment Routing related information, such as via IS-IS or OSPF.¶

Now assume that router A (the Domain ingress) wants to send a packet to router H (the Domain egress) via the explicit path {E->G->H}. Router A will impose an MPLS label stack on the packet that corresponds to that explicit path. Since the next hop toward router E is only IP capable (B is a legacy transit node), router A replaces the top label (that indicated router E) with a UDP-based tunnel for MPLS (i.e., MPLS-over-UDP [RFC7510]) to router E and then sends the packet. In other words, router A pops the top label and then encapsulates the MPLS packet in a UDP tunnel to router E.¶

When the IP-encapsulated MPLS packet arrives at router E (which is a transit node capable of SR-MPLS), router E strips the IP-based tunnel header and then processes the decapsulated MPLS packet. The top label indicates that the packet must be forwarded toward router G. Since the next hop toward router G is only IP capable, router E replaces the current top label with an MPLS-over-UDP tunnel toward router G and sends it out. That is, router E pops the top label and then encapsulates the MPLS packet in a UDP tunnel to router G.¶

When the packet arrives at router G, router G will strip the IP-based tunnel header and then process the decapsulated MPLS packet. The top label indicates that the packet must be forwarded toward router H. Since the next hop toward router H is only IP capable (D is a legacy transit router), router G would replace the current top label with an MPLS-over-UDP tunnel toward router H and send it out. However, since router G reaches the bottom of the label stack (G is the penultimate node capable of SR-MPLS on the path), this would leave the original packet that router A wanted to send to router H encapsulated in UDP as if it was MPLS (i.e., with a UDP header and destination port indicating MPLS) even though the original packet could have been any protocol. That is, the final SR-MPLS has been popped exposing the payload packet.¶

To handle this, when a router (here it is router G) pops the final SR-MPLS label, it inserts an explicit NULL label [RFC3032] before encapsulating the packet in an MPLS-over-UDP tunnel toward router H and sending it out. That is, router G pops the top label, discovers it has reached the bottom of stack, pushes an explicit NULL label, and then encapsulates the MPLS packet in a UDP tunnel to router H.¶

3.2.2. Packet Forwarding without Penultimate Hop Popping

Figure 4 demonstrates the packet walk in the case where the label associated with each Prefix-SID advertised by the owner of the Prefix-SID is not a Penultimate Hop-Popping (PHP) label (e.g., the NP-Flag in OSPF or the P-Flag in IS-IS associated with the Prefix-SID is set). Apart from the PHP function, the roles of the routers are unchanged from Section 3.2.1.¶

 +-----+       +-----+       +-----+        +-----+        +-----+
 |  A  +-------+  B  +-------+  C  +--------+  D  +--------+  H  |
 +-----+       +--+--+       +--+--+        +--+--+        +-----+
                  |             |              |
                  |             |              |
               +--+--+       +--+--+        +--+--+
               |  E  +-------+  F  +--------+  G  |
               +-----+       +-----+        +-----+

      +--------+
      |IP(A->E)|
      +--------+                 +--------+
      |  UDP   |                 |IP(E->G)|
      +--------+                 +--------+        +--------+
      |  L(E)  |                 |  UDP   |        |IP(G->H)|
      +--------+                 +--------+        +--------+
      |  L(G)  |                 |  L(G)  |        |  UDP   |
      +--------+                 +--------+        +--------+
      |  L(H)  |                 |  L(H)  |        |  L(H)  |
      +--------+                 +--------+        +--------+
      | Packet |     --->        | Packet |  --->  | Packet |
      +--------+                 +--------+        +--------+

As can be seen from the figure, the SR-MPLS label for each segment is left in place until the end of the segment where it is popped and the next instruction is processed.¶

3.2.3. Additional Forwarding Procedures

Non-MPLS Interfaces:

Although the description in the previous two sections is based on the use of Prefix-SIDs, tunneling SR-MPLS packets is useful when the top label of a received SR-MPLS packet indicates an Adjacency SID and the corresponding adjacent node to that Adjacency SID is not capable of MPLS forwarding but can still process SR-MPLS packets. In this scenario, the top label would be replaced by an IP tunnel toward that adjacent node and then forwarded over the corresponding link indicated by the Adjacency SID.¶

When to Use IP-Based Tunnels:

The description in the previous two sections is based on the assumption that an MPLS-over-UDP tunnel is used when the next hop towards the next segment is not MPLS enabled. However, even in the case where the next hop towards the next segment is MPLS capable, an MPLS-over-UDP tunnel towards the next segment could still be used instead due to local policies. For instance, in the example as described in Figure 4, assume F is now a transit node capable of SR-MPLS while all the other assumptions remain unchanged; since F is not identified by a SID in the stack and an MPLS-over-UDP tunnel is preferred to an MPLS LSP according to local policies, router E replaces the current top label with an MPLS-over-UDP tunnel toward router G and sends it out. (Note that if an MPLS LSP was preferred, the packet would be forwarded as native SR-MPLS.)¶

IP Header Fields:

When encapsulating an MPLS packet in UDP, the resulting packet is further encapsulated in IP for transmission. IPv4 or IPv6 may be used according to the capabilities of the network. The address fields are set as described in Section 2. The other IP header fields (such as the ECN field [RFC6040], the Differentiated Services Code Point (DSCP) [RFC2983], or IPv6 Flow Label) on each UDP-encapsulated segment SHOULD be configurable according to the operator's policy; they may be copied from the header of the incoming packet; they may be promoted from the header of the payload packet; they may be set according to instructions programmed to be associated with the SID; or they may be configured dependent on the outgoing interface and payload. The TTL field setting in the encapsulating packet header is handled as described in [RFC7510], which refers to [RFC4023].¶

Entropy and ECMP:

When encapsulating an MPLS packet with an IP tunnel header that is capable of encoding entropy (such as [RFC7510]), the corresponding entropy field (the source port in the case of a UDP tunnel) MAY be filled with an entropy value that is generated by the encapsulator to uniquely identify a flow. However, what constitutes a flow is locally determined by the encapsulator. For instance, if the MPLS label stack contains at least one entropy label and the encapsulator is capable of reading that entropy label, the entropy label value could be directly copied to the source port of the UDP header. Otherwise, the encapsulator may have to perform a hash on the whole label stack or the five-tuple of the SR-MPLS payload if the payload is determined as an IP packet. To avoid recalculating the hash or hunting for the entropy label each time the packet is encapsulated in a UDP tunnel, it MAY be desirable that the entropy value contained in the incoming packet (i.e., the UDP source port value) is retained when stripping the UDP header and is reused as the entropy value of the outgoing packet.¶

Congestion Considerations:

Section 5 of [RFC7510] provides a detailed analysis of the implications of congestion in MPLS-over-UDP systems and builds on Section 3.1.3 of [RFC8085], which describes the congestion implications of UDP tunnels. All of those considerations apply to SR-MPLS-over-UDP tunnels as described in this document. In particular, it should be noted that the traffic carried in SR-MPLS flows is likely to be IP traffic.¶