TRILL over IP dra-ie-trill-over-ip-02.txt

IETF 92, Dallas Margaret Wasserman [email protected] Dacheng Zhang, Donald Eastlake, Document Summary

• “TRILL over IP” treats an IP network as a link connecng TRILL switch ports, thus providing a method to connected TRILL sites into a single TRILL campus. • Two Scenarios are described in the dra – Remote Office Scenario – IP Backbone Scenario • Specifies encapsulaon, security, and transport consideraons including congeson, MTU, fat flows, recursive ingress, …

March 2015 TRILL over IP 2 Changes from -01

• Changes primarily movated by the hardware support required for high data rates: – Security: Use of IPsec instead of DTLS due to beer hardware support available for IPsec. This change is in the current Version -02. – Encapsulaon: Use of alternave encapsulaons with beer hardware support, planned for next version -03. • Also Secon 6 on Port Configuraon added in -02.

March 2015 TRILL over IP 3 Security

• Dra now specifies IPsec ESP (Encapsulang Security Protocol) in Tunnel Mode. – Some details needs to be filled in such as • mandatory to implement crypto algorithms • details of default keying and key negoaon. – Use of ESP Tunnel Mode supports use of IPsec appliances separate from the actual RBridge port hardware.

RBridge RBridge TRILL over IPsec IP TRILL over IP Port with Security IP Port Security Roung Appliance

March 2015 TRILL over IP 4 IPsec ESP in Tunnel Mode

Link Header IP Header Link Header TRILL over IP IP Header encapsulaon IPsec ESP TRILL Data or IS-IS IP Header Payload TRILL over IP Link Trailer encapsulaon TRILL Data or IS-IS Payload Without security With security Link Trailer

March 2015 TRILL over IP 5 Encapsulaon

• The current dra only specifies direct UDP encapsulaon. But there is beer fast path hardware support and more flexibility with other encapsulaons such as VxLAN. – “UDP encapsulaon” is really TRILL over UDP over IP. TRILL Data versus IS-IS is indicated by desnaon UDP socket. – “VxLAN encapsulaon” with current VxLAN [RFC7348] is really TRILL over Ethernet over VxLAN over UDP over IP. TRILL Data versus IS-IS is indicated by EtherType but the Ethernet DA&SA are 12 bytes of wasted space. – Other encapsulaons are being developed in other working groups. We might oponally use those but there is no proposal to develop an encapsulaon in the TRILL WG

March 2015 TRILL over IP 6 Encapsulaon

- Desnaon Port disnguishes Link Header TRILL Data and TRILL IS-IS IP Header - Source Port Provides entropy UDP Header Link Header TRILL Data or TRILL IS-IS Payload IP Header Link Trailer UDP Header VxLAN Header

- Source Port Provides entropy Ethernet Header TRILL Data or TRILL - Ethertype disnguishes TRILL IS-IS Payload Data and TRILL IS-IS Link Trailer

March 2015 TRILL over IP 7 Encapsulaon • Proposal: – The inial mode for a TRILL over IP port would be to exchange Hellos and E-L1CS LSPs using UDP encapsulaon. • This is a small enough amount of traffic it can be done in soware. – What data encapsulaons a port is willing to use, in priority order, can be adversed in Hellos or E-L1CS LSPs. Can vary between ports due to port hardware. – Data connecvity (adjacency) is established if TRILL switches have a common supported and enabled encapsulaon. – A TRILL over IP port could also be configured to always use a specified encapsulaon for all TRILL communicaons.

March 2015 TRILL over IP 8 Other Work Remaining

• Other work remaining includes: – QoS Consideraons are absent (how to map TRILL packet priority to IP) – Middle Box Consideraons secon is empty.

March 2015 TRILL over IP 9 Feedback? Quesons?

Back up slides

THE TRILL ENCAPSULATION ARCHITECTURE

March 2015 TRILL over IP 11 TRILL Link Encapsulaons

• A TRILL link protocol encapsulaon needs to: – Get a TRILL