Subject: Prefix overlapping issue for draft-bonica-l3vpn-orf-covering-prefixes-00

From: Xuxiaohu <[email-masked]>
Date: Thu, 7 Nov 2013 18:08:13 +0000

Hi co-author of this draft,

As I had mentioned at the mic, the mechanism proposed in this draft needs to consider the prefix overlapping issue which has been considered and addressed by LISP.

To Ron,

The default route on the spoke can not be resorted to address the potential issue caused by the prefix overlapping issue. The reason is that it's the longest-matching route 10/8, rather than the default route is used to route the packet destined for 10.10.10.10, in the case where a route for 10/8 has been returned to that spoke due to a request from that spoke for the longest-matching route for a given host address 10.0.0.1.  As a result, the traffic for 10.10.10.10 would be forwarded to the nexthop for 10/8 which in turn forward that traffic according to a more spefic route for 10.10.10.10. This is suboptimal. Assume the traffic volume for the destination of 10.10.10.10 is high, how to trigger a requtst for a "real" direct route to 10.10.10.10 if there exists a host route for 10.10.10.10/32 at the hub? One possible way is to always request a more specific route until a host route for the destination of the received packet is found at the spoke.

Since this issue has been disccussed at LISP WG many years before. I copy this email to LISP as well.

Best regards,
Xiaohu

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 9 Nov 2013 07:09:41 +0100

Hi Xiaohu,

While you are asking Ron directly you are cc-ing the lists so let me
clarify your observation ..

In each L3VPN context each PE advertise set of routes towards other
PEs. Those routes are most often advertised via RR.

I have never seen the case where RR or set of RRs would in any sort
summarize routes more then PEs advertise.

So if site has a host with the address of 10.10.10.10 which our high
bandwith flow is destined to PE (or PEs) connected to such site will
advertise the most specific subnet possible to reach 10.10.10.10.

And that is all what is needed here.

Based on the request from the v-spoke RR will return the longest match
which will have next hop pointing to one of PEs connected the end
site. I see really no problem there.

If customer/provider on purpose enforced that to get to 10.10.10.10
you need to traverse some other site (for example DMZ/firewall/service
XYZ) that is on purpose and we MUST honor it. This draft RFC7024 can
not modify such routing enforced by customer.

Best,
R.

PS. I see no relation to LISP here ;)

---

From: Xuxiaohu <[email-masked]>
Date: Sat, 9 Nov 2013 06:36:48 +0000

Hi Robert,

As long as there is a possibility of prefix overlapping within a given VPN instance, the mechanism defined in this draft would encounter the same problem that LISP had ever encountered.

Best regards,
Xiaohu
________________________________________
发件人: [email-masked] [[email-masked]] 代表 Robert Raszuk [[email-masked]]
发送时间: 2013年11月9日 14:09
收件人: Xuxiaohu
抄送: [email-masked]; [email-masked]
主题: Re: [lisp] Prefix overlapping issue for     draft-bonica-l3vpn-orf-covering-prefixes-00

Hi Xiaohu,

Best,
R.

PS. I see no relation to LISP here ;)
_______________________________________________
lisp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/lisp

---

From: Robert Raszuk <[email-masked]>
Date: Sat, 9 Nov 2013 07:51:23 +0100

Hi Xiaohu,

Prefix overlap within VPN is either on purpose injected into given VPN
or is due to VPN misconfiguration.

Detection or mitigation of this as far as I can see is outside of
scope of this draft.

LISP operates in global space, this draft operates in VPN space. Those
spaces while seemingly similar in reality have very different routing
characteristics.

Best,
R.

---

From: Dino Farinacci <[email-masked]>
Date: Fri, 8 Nov 2013 23:01:17 -0800

Can you guys give us context. Robert, you didn't copy [email-masked] with the original message/claim from Xiaohu. 

Dino

> On Nov 8, 2013, at 10:51 PM, Robert Raszuk <[email-masked]> wrote:
> 
> Hi Xiaohu,
>

---

From: Xuxiaohu <[email-masked]>
Date: Sat, 9 Nov 2013 16:33:45 +0000

Hi Dino,

the following is the original email:

++++++++++++++++++++++++

To Ron,

Best regards,
Xiaohu

++++++++++++++++++++++++++

________________________________________
发件人: [email-masked] [[email-masked]] 代表 Dino Farinacci [[email-masked]]
发送时间: 2013年11月9日 15:01
收件人: Robert Raszuk
抄送: Xuxiaohu; [email-masked]; [email-masked]
主题: Re: [lisp] 答复:  Prefix overlapping issue for draft-bonica-l3vpn-orf-covering-prefixes-00

Dino

---

From: Lucy yong <[email-masked]>
Date: Mon, 11 Nov 2013 07:00:59 +0000

When requesting covering prefix, it has the chance that a prefix may apply to more than on VPN site in the environment of VM mobility. If we just request a host or a set of host addresses, and give the rule that only PEs that has the host route replies the request. This may address the issue, isn't it? Otherwise, due to the response time difference, the ingress PE may send the packet to the wrong PE, isn't it? But if PE does not have host address visibility, this will not work. 

IMO: We need a solution to work w/ or w/o RR.

Lucy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Robert Raszuk
Sent: Saturday, November 09, 2013 12:51 AM
To: Xuxiaohu
Cc: [email-masked]; [email-masked]
Subject: Re: ??: [lisp] Prefix overlapping issue for draft-bonica-l3vpn-orf-covering-prefixes-00

Hi Xiaohu,

Prefix overlap within VPN is either on purpose injected into given VPN or is due to VPN misconfiguration.

Detection or mitigation of this as far as I can see is outside of scope of this draft.

LISP operates in global space, this draft operates in VPN space. Those spaces while seemingly similar in reality have very different routing characteristics.

Best,
R.

---

From: Robert Raszuk <[email-masked]>
Date: Mon, 11 Nov 2013 10:21:03 +0100

Hi Lucy,

Proposed solution works within a VPN context. It is not a general
design at this point.

I am actually looking what would be the optimal encoding to address
the VPN case particulary RFC7024 optimality as well as possibly to
also allow for other applications.

Enforcing to request host address will not work as PEs do not carry
host routes for VPNs .... at least those which are properly configured
:) Site addresses are advertised in blocks. Of course if site consists
of single tenant VM that would be host address - but this is rather
special case for one solution space.

To your point of sending to "wrong PE" I do not really see that. At
most it may be suboptimal PE for some duration of time ... not wrong
one. And the case will self-cure when more specific get's advertised
anyway.

Best regards,
R.

---

From: Lucy yong <[email-masked]>
Date: Mon, 11 Nov 2013 21:30:53 +0000

Hi Robert,

Please see inline.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Robert Raszuk
Sent: Monday, November 11, 2013 3:21 AM
To: Lucy yong
Cc: Xuxiaohu; [email-masked]; [email-masked]
Subject: Re: ??: [lisp] Prefix overlapping issue for draft-bonica-l3vpn-orf-covering-prefixes-00

Hi Lucy,

Proposed solution works within a VPN context. It is not a general design at this point.

I am actually looking what would be the optimal encoding to address the VPN case particulary RFC7024 optimality as well as possibly to also allow for other applications.
[Lucy] that is great to hear. Glad to work together on the solution.

Enforcing to request host address will not work as PEs do not carry host routes for VPNs .... at least those which are properly configured
:) Site addresses are advertised in blocks. Of course if site consists of single tenant VM that would be host address - but this is rather special case for one solution space.
[Lucy] Agree. My use cases are in DC and for VN overlay now. So requesting host address works there. But not work if PE does not have the host visibility. Our goal should target to address both cases. If it runs into too complex in BGP environment, we can scale back. Love to hear your proposal.

To your point of sending to "wrong PE" I do not really see that. At most it may be suboptimal PE for some duration of time ... not wrong one. And the case will self-cure when more specific get's advertised anyway.
[Lucy] This is what I mean. Agree that "suboptimal PE" only happens in a short period.

Regards,
Lucy

Best regards,
R.

On Mon, Nov 11, 2013 at 8:00 AM, Lucy yong <[email-masked]> wrote:
> Subject: Re: ??: [lisp] Prefix overlapping issue for 
> draft-bonica-l3vpn-orf-covering-prefixes-00
>
> Hi Xiaohu,
>