Difference between revisions of "VPP/Segment Routing for IPv6"

From fd.io
< VPP
Jump to: navigation, search
(Initial content)
 
m ("vpp sr steer" does not require the "sr policy" command to be declared after configuring "via".)
 
(10 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
This example shows how to use the VPP platform for IPv6 segment routing.
+
VPP has an up-to-date implementation of [https://tools.ietf.org/html/draft-filsfils-spring-srv6-network-programming SRv6 Network Programming].
 +
 
 +
This example shows how to use the VPP platform to setup a L3VPN with SRv6. For further information regarding the SRv6 implementation and CLI please visit the [https://docs.fd.io/vpp/17.07/srv6_doc.html doxygen documentation]. For further information on SRv6, tutorials and videos please visit [https://www.segment-routing.net www.segment-routing.net].
  
 
__TOC__
 
__TOC__
  
−
=== Introduction ===
+
== Introduction ==
 +
 
 +
Segment Routing changes the way packets are forwarded inside a network, enabling network operators to have better control on the path followed by the packets. In Segment Routing-enabled networks, packets are routed through sequence of segments, which are stored within the packet headers. The packets will always follow the shortest path up to each segment. In this way, no state is maintained in the network.
 +
 
 +
Segment Routing can be applied to either the MPLS or the IPv6 dataplane. The IPv6 flavor of Segment Routing — a.k.a SRv6 — uses an IPv6 Routing Extension header, called ''Segment Routing header'' (SRH), where each segment is encoded as an IPv6 address. An ordered list of segments is thus encoded as an ordered list of IPv6 addresses in the SRH. The current ''active segment'' is the IPv6 ''Destination Address'' of the packet, while the next segment to be processed is indicated in the ''Segments Left'' field of the SRH. Upon completion of a segment, this field is updated to point to the next segment and the new ''active segment'' is copied in the ''Destination Address'' field of the IPv6 header.
 +
 
 +
On an SRv6-enabled node, the available segments are referred to as ''Local SIDs''. Each of them is associated with a processing function on the local node, which may range from advancing to the next SID in the SRH up to complex user-defined behaviors.
 +
 
 +
In this example we will leverage SRv6 to create an L3VPN overlay for both IPv4 and IPv6 traffic, while also providing underlay optimization.
 +
 
 +
Note that SRv6 is not limited to this use-case. Please read the [https://docs.fd.io/vpp/17.07/srv6_doc.html doxygen documentation] for further information.
 +
 
 +
== Topology Diagram ==
 +
 
 +
[[File:SRv6 L3VPN.png|x400px]]
 +
 
 +
Our topology is simply going to be four VPP nodes with both, an IPv4 and IPv6 clients and servers attached to this core network. The 'core' network is running IPv6 only.
 +
 
 +
== L3VPN for IPv6 traffic ==
 +
 
 +
[[File:SRv6 L3VPN IPv6 traffic.png|thumb|upright=1.5|SRv6 L3VPN IPv6 traffic]]
 +
 
 +
In this example what we will do is on C1 create a SR Policy with only one SID list. This SID list will be <C2::, C4::6>. The SR policy will be using encapsulation.
 +
On C1 I will add an steering policy to steer all the L3 traffic destined to B::/112 via the BindingSID of the SR policy we just created before.
 +
 
 +
On C2 I will create one SR LocalSID with behavior End. (Endpoint)
 +
 
 +
On C4 I will create one SR LocalSID with behavior End.DX6 (Endpoint with Decapsulation and IPv6 cross-connect).
 +
 
 +
Note that this is a L3VPN for all traffic from A:: to B::. In this example the returning path is not shown. The user must create another SR policy at C4 with the appropriate SR LocalSIDs at the different nodes for the returning path.
 +
 
 +
==== Configuration on C1 ====
 +
 
 +
vpp# set sr encaps source addr C1::
 +
vpp# sr policy add bsid C1::999:1 next C2:: next C4::6 encap
 +
vpp# sr steer l3 B::/112 via bsid C1::999:1
  
−
Segment routing changes the way packets are forwarded inside a network to enable network operators to have better control on the path followed by the packets.
+
This configuration can be verified with the CLI:
  
−
Segment Routing can be applied to the IPv6 architecture, with a new type of routing extension header. A segment is encoded as an IPv6 address. An ordered list of segments is encoded as an ordered list of IPv6 addresses in the routing extension header. The segment to process is indicated by a pointer in the routing extension header. Upon completion of a segment, the pointer is incremented.
+
  vpp# show sr pol
 +
  SR policies:
 +
  [0].- BSID: c1::999:1
 +
Behavior: Encapsulation
 +
Type: Default
 +
FIB table: 0
 +
Segment Lists:
 +
  [0].- < c2::, c4::6 > weight: 1
 +
-----------
 +
vpp# show sr steering policies
 +
SR steering policies:
 +
Traffic SR policy BSID
 +
L3 b::/112 c1::999:1
  
−
The topology and VPP debug CLI configuration below show how to configure an IPv6 segment routing network.
+
==== Configuration on C2 ====
  
−
=== VIRL File ===
+
vpp# sr localsid address C2:: behavior end
  
−
It can be tedious to configure this scenario manually. For help, see the example:
+
This configuration can be verified with the CLI:
 +
vpp# show sr localsid
 +
SRv6 - My LocalSID Table:
 +
=========================
 +
Address: c2::
 +
Behavior: End
 +
Good traffic: [0 packets : 0 bytes]
 +
Bad traffic:  [0 packets : 0 bytes]
 +
--------------------
  
−
[[VPP/IPv6 SR VIRL topology file|IPv6 SR VIRL topology file]]
+
Note that each SR LocalSID has counters for good and bad processed traffic. These counters can be cleared with
 +
vpp# clear sr localsid counters
  
−
The example page is a VIRL topology description in plain text. You will need to store the text to a file and give it the <tt>.virl</tt> extension.
+
==== Configuration on C3 ====
  
−
The <tt>iosv-1</tt>, <tt>iosv-2</tt>, and <tt>iosv-4</tt> nodes are virtual IOS Classic routers, which could be easily replaced with Linux hosts or other network devices capable of sending IPv6 ICMP echo requests.
+
''None''
  
−
=== Topology Diagram ===
+
==== Configuration on C4 ====
  
−
[[File:IPv6 Segment Routing Topology.jpg|IPv6 Segment Routing Topology]]
+
vpp# sr localsid address C4::6 behavior end.dx6 GigabitEthernet0/5/0 B:C5::B
 +
vpp# show sr localsid
 +
SRv6 - My LocalSID Table:
 +
=========================
 +
Address: c4::6
 +
Behavior: DX6 (Endpoint with decapsulation and IPv6 cross-connect)
 +
Iface:  GigabitEthernet0/5/0
 +
Next hop: b:c5::b
 +
Good traffic: [6686 packets : 678832 bytes]
 +
Bad traffic:  [0 packets : 0 bytes]
 +
--------------------
  
−
=== Configuration ===
+
== L3VPN for IPv4 traffic ==
  
−
==== iosv-1 relevant configuration ====
+
[[File:SRv6 L3VPN IPv4 traffic.png|thumb|upright=1.5|SRv6 L3VPN IPv4 traffic]]
  
−
interface GigabitEthernet0/1
+
In this example what we will do is on C1 create a SR Policy with only one SID list. This SID list will be <C2::, C4::4>. The SR policy will be using encapsulation.
−
  description to vpp-1
+
On C1 I will add an steering policy to steer all the L3 traffic destined to 2.2.2.0/24 via the BindingSID of the SR policy we just created before.
−
  ipv6 address ::A:1:1:0:6/126
+
−
! route to iosv-2
+
−
ipv6 route ::A:1:1:0:16/128 ::A:1:1:0:7
+
−
! route to iosv-4
+
−
ipv6 route ::A:1:1:0:22/128 ::A:1:1:0:7
+
  
−
==== iosv-2 relevant configuration ====
+
On C2 I will create one SR LocalSID with behavior End. (Endpoint)
  
−
interface GigabitEthernet0/1
+
On C4 I will create one SR LocalSID with behavior End.DX4 (Endpoint with Decapsulation and IPv4 cross-connect).
−
  description to vpp-2
+
−
  ipv6 address ::A:1:1:0:16/126
+
−
!
+
−
ipv6 route ::A:1:1:0:6/128 ::A:1:1:0:17
+
  
−
==== iosv-4 relevant configuration ====
+
Note that this is a L3VPN for all traffic from 1.1.1.0/24 to 2.2.2.0/24. In this example the returning path is not shown. The user must create another SR policy at C4 with the appropriate SR LocalSIDs at the different nodes for the returning path.
  
−
interface GigabitEthernet0/1
+
==== Configuration on C1 ====
−
  description to vpp-2
+
−
  ipv6 address ::A:1:1:0:22/126
+
−
! Route to iosv-1
+
−
ipv6 route ::A:1:1:0:6/128 ::A:1:1:0:23
+
  
−
==== vpp-1 relevant configuration ====
+
vpp# set sr encaps source addr C1::
 +
vpp# sr policy add bsid C1::999:2 next C2:: next C4::4 encap
 +
vpp# sr steer l3 2.2.2.0/24 via bsid C1::999:2
  
−
set interface ip address GigabitEthernet0/4/0 ::a:1:1:0:7/126
+
==== Configuration on C2 ====
−
set interface state GigabitEthernet0/4/0 up
+
−
set interface ip address GigabitEthernet0/5/0 ::a:1:1:0:b/126
+
−
set interface state GigabitEthernet0/5/0 up
+
−
set interface ip address GigabitEthernet0/6/0 ::a:1:1:0:e/126
+
−
set interface state GigabitEthernet0/6/0 up
+
−
set interface ip address GigabitEthernet0/7/0 ::a:1:1:0:12/126
+
−
set interface state GigabitEthernet0/7/0 up
+
−
sr tunnel src 0::a:1:1:0:6 dst 0::a:1:1:0:16/128 next 0::a:1:1:0:f next 0::a:1:1:0:1a next 0::a:1:1:0:16 tag 0::a:1:1:0:7 InPE 1 clean
+
−
sr tunnel src 0::a:1:1:0:6 dst 0::a:1:1:0:22/128 next 0::a:1:1:0:f next 0::a:1:1:0:1a next 0::a:1:1:0:22 tag 0::a:1:1:0:7 InPE 1 clean
+
  
−
==== vpp-3 relevant configuration ====
+
vpp# sr localsid address C2:: behavior end
  
−
set interface ip address GigabitEthernet0/4/0 ::a:1:1:0:f/126
+
Note here that this is the same SR LocalSID as the one created for the L3VPN for IPv6 traffic. Hence, you don't need to type this again.
−
set interface state GigabitEthernet0/4/0 up
+
−
set interface ip address GigabitEthernet0/5/0 ::a:1:1:0:1b/126
+
−
set interface state GigabitEthernet0/5/0 up
+
−
comment { to avoid dropping all SR traffic due to source rpf check failures }
+
−
ip route add ::a:1:1:0:6/128 via drop
+
−
ip route add ::a:1:1:0:16/128 via drop
+
−
ip route add ::a:1:1:0:22/128 via drop
+
  
−
==== vpp-2 relevant configuration ====
+
==== Configuration on C3 ====
  
−
set interface ip address GigabitEthernet0/4/0 ::a:1:1:0:1a/126
+
''None''
−
set interface state GigabitEthernet0/4/0 up
+
−
set interface ip address GigabitEthernet0/5/0 ::a:1:1:0:1e/126
+
−
set interface state GigabitEthernet0/5/0 up
+
−
set interface ip address GigabitEthernet0/6/0 ::a:1:1:0:17/126
+
−
set interface state GigabitEthernet0/6/0 up
+
−
set interface ip address GigabitEthernet0/7/0 ::a:1:1:0:23/126
+
−
set interface state GigabitEthernet0/7/0 up
+
−
sr tunnel src 0::a:1:1:0:16 dst 0::a:1:1:0:6/128 next 0::a:1:1:0:1b next 0::a:1:1:0:e next 0::a:1:1:0:6 tag 0::a:1:1:0:17 InPE 1 clean
+
  
−
==== vpp-4 relevant configuration ====
+
==== Configuration on C4 ====
  
−
  set interface ip address GigabitEthernet0/4/0 ::a:1:1:0:13/126
+
  vpp# sr localsid address C4::4 behavior end.dx4 GigabitEthernet0/6/0 2.2.2.2
−
set interface state GigabitEthernet0/4/0 up
+
vpp# show sr localsid
−
set interface ip address GigabitEthernet0/5/0 ::a:1:1:0:1f/126
+
SRv6 - My LocalSID Table:
−
  set interface state GigabitEthernet0/5/0 up
+
=========================
 +
Address: c4::4
 +
Behavior: DX4 (Endpoint with decapsulation and IPv4 cross-connect)
 +
Iface: GigabitEthernet0/6/0
 +
Next hop: 2.2.2.2
 +
Good traffic: [0 packets : 0 bytes]
 +
Bad traffic: [0 packets : 0 bytes]
 +
  --------------------

Latest revision as of 08:55, 15 August 2023

VPP has an up-to-date implementation of SRv6 Network Programming.

This example shows how to use the VPP platform to setup a L3VPN with SRv6. For further information regarding the SRv6 implementation and CLI please visit the doxygen documentation. For further information on SRv6, tutorials and videos please visit www.segment-routing.net.

Introduction

Segment Routing changes the way packets are forwarded inside a network, enabling network operators to have better control on the path followed by the packets. In Segment Routing-enabled networks, packets are routed through sequence of segments, which are stored within the packet headers. The packets will always follow the shortest path up to each segment. In this way, no state is maintained in the network.

Segment Routing can be applied to either the MPLS or the IPv6 dataplane. The IPv6 flavor of Segment Routing — a.k.a SRv6 — uses an IPv6 Routing Extension header, called Segment Routing header (SRH), where each segment is encoded as an IPv6 address. An ordered list of segments is thus encoded as an ordered list of IPv6 addresses in the SRH. The current active segment is the IPv6 Destination Address of the packet, while the next segment to be processed is indicated in the Segments Left field of the SRH. Upon completion of a segment, this field is updated to point to the next segment and the new active segment is copied in the Destination Address field of the IPv6 header.

On an SRv6-enabled node, the available segments are referred to as Local SIDs. Each of them is associated with a processing function on the local node, which may range from advancing to the next SID in the SRH up to complex user-defined behaviors.

In this example we will leverage SRv6 to create an L3VPN overlay for both IPv4 and IPv6 traffic, while also providing underlay optimization.

Note that SRv6 is not limited to this use-case. Please read the doxygen documentation for further information.

Topology Diagram

SRv6 L3VPN.png

Our topology is simply going to be four VPP nodes with both, an IPv4 and IPv6 clients and servers attached to this core network. The 'core' network is running IPv6 only.

L3VPN for IPv6 traffic

SRv6 L3VPN IPv6 traffic

In this example what we will do is on C1 create a SR Policy with only one SID list. This SID list will be <C2::, C4::6>. The SR policy will be using encapsulation. On C1 I will add an steering policy to steer all the L3 traffic destined to B::/112 via the BindingSID of the SR policy we just created before.

On C2 I will create one SR LocalSID with behavior End. (Endpoint)

On C4 I will create one SR LocalSID with behavior End.DX6 (Endpoint with Decapsulation and IPv6 cross-connect).

Note that this is a L3VPN for all traffic from A:: to B::. In this example the returning path is not shown. The user must create another SR policy at C4 with the appropriate SR LocalSIDs at the different nodes for the returning path.

Configuration on C1

vpp# set sr encaps source addr C1::
vpp# sr policy add bsid C1::999:1 next C2:: next C4::6 encap
vpp# sr steer l3 B::/112 via bsid C1::999:1

This configuration can be verified with the CLI: 

vpp# show sr pol
SR policies:
[0].-	BSID: c1::999:1
	Behavior: Encapsulation
	Type: Default
	FIB table: 0
	Segment Lists:
  	[0].- < c2::, c4::6 > weight: 1
-----------
vpp# show sr steering policies
SR steering policies:
Traffic		SR policy BSID
L3 b::/112	c1::999:1

Configuration on C2

vpp# sr localsid address C2:: behavior end

This configuration can be verified with the CLI: 

vpp# show sr localsid
SRv6 - My LocalSID Table:
=========================
	Address: 	c2::
	Behavior: 	End
	Good traffic: 	[0 packets : 0 bytes]
	Bad traffic:  	[0 packets : 0 bytes]
--------------------

Note that each SR LocalSID has counters for good and bad processed traffic. These counters can be cleared with 

vpp# clear sr localsid counters

Configuration on C3

None

Configuration on C4

vpp# sr localsid address C4::6 behavior end.dx6 GigabitEthernet0/5/0 B:C5::B
vpp# show sr localsid
SRv6 - My LocalSID Table:
=========================
	Address: 	c4::6
	Behavior: 	DX6 (Endpoint with decapsulation and IPv6 cross-connect)
	Iface:  	GigabitEthernet0/5/0
	Next hop: 	b:c5::b
	Good traffic: 	[6686 packets : 678832 bytes]
	Bad traffic:  	[0 packets : 0 bytes]
--------------------

L3VPN for IPv4 traffic

SRv6 L3VPN IPv4 traffic

In this example what we will do is on C1 create a SR Policy with only one SID list. This SID list will be <C2::, C4::4>. The SR policy will be using encapsulation. On C1 I will add an steering policy to steer all the L3 traffic destined to 2.2.2.0/24 via the BindingSID of the SR policy we just created before.

On C2 I will create one SR LocalSID with behavior End. (Endpoint)

On C4 I will create one SR LocalSID with behavior End.DX4 (Endpoint with Decapsulation and IPv4 cross-connect).

Note that this is a L3VPN for all traffic from 1.1.1.0/24 to 2.2.2.0/24. In this example the returning path is not shown. The user must create another SR policy at C4 with the appropriate SR LocalSIDs at the different nodes for the returning path.

Configuration on C1

vpp# set sr encaps source addr C1::
vpp# sr policy add bsid C1::999:2 next C2:: next C4::4 encap
vpp# sr steer l3 2.2.2.0/24 via bsid C1::999:2

Configuration on C2

vpp# sr localsid address C2:: behavior end

Note here that this is the same SR LocalSID as the one created for the L3VPN for IPv6 traffic. Hence, you don't need to type this again.

Configuration on C3

None

Configuration on C4

vpp# sr localsid address C4::4 behavior end.dx4 GigabitEthernet0/6/0 2.2.2.2
vpp# show sr localsid
SRv6 - My LocalSID Table:
=========================
	Address: 	c4::4
	Behavior: 	DX4 (Endpoint with decapsulation and IPv4 cross-connect)
	Iface:  	GigabitEthernet0/6/0
	Next hop: 	2.2.2.2
	Good traffic: 	[0 packets : 0 bytes]
	Bad traffic:  	[0 packets : 0 bytes]
--------------------
Retrieved from "https://wiki.fd.io/index.php?title=VPP/Segment_Routing_for_IPv6&oldid=12363"