Some Performance Tweaks for SP Network
Presented By: Priya Ranjan KarnAgenda•Challenges Faced By Service Providers••••••••

IGP convergence time
Increasing Labels within the SP Network
Suboptimal Unicast Routing
Optimal Performance of RR (Route-Reflector)
Increasing size of Global Routing Table
Need for IPv6 and dual stack networks
Load Balancing and Redundancy in Multicast Network

Some Strategies to adopt for Overcoming the Challenges(Based on several tests and implementation within an SP Network)•••••••

Speeding Your IGP Convergence with LFA
Filters to limit labels assignment for IGP routes
uRPF
BGP Table-Map
BGP Route Aggregation
6PE and 6VPE
Anycast RP

Loop Free Alternate (LFA)
Challenge•••

Even after detecting a failure of the current path, the IGP(OSPF/IS-IS) still have to run the SPF to choose the next available bestpath.
This results in delay for packet forwarding to restart.
IGP’s like OSPF/IS-IS doesn’t have concept of feasible successors or backup path.

Solution•••

LFA helps IGP’s to find and install usable backup loop free paths, which helps to quickly switch (within 50 ms) to a backup pathwhen primary path fails.
LFA helps the Packet Forwarding Engine to correct a path failure before it receives recomputed path from Routing Engine.
LFA can be configured in two ways for the IGPs.

Per-Link•••

IGP calculates a backup next hop for all prefixes that uses the same link (same next-hop).
Advantage is, it consumes fewer CPU cycles and memory than Per-Prefix LFA.
Disadvantage however, is that once the primary link fails, suddenly put a lot of burden to the backup link.

Loop Free Alternate (LFA)CISCO(config)# router ospf 1
CISCO(config-ospf)# address-family ipv4
CISCO(config-ospf)# area 0
CISCO(config-ospf-ar)# fast-reroute per-linkPer-Prefix•••

IGP calculates an LFA path for every individual prefixes.
Disadvantage is, It requires more CPU cycles and memory.
Advantage is, offers better load balancing as traffic is spread across to different backup paths.

CISCO(config)#router ospf 1
CISCO(config-ospf)#address-family ipv4
CISCO(config-ospf)#area 0
CISCO(config-ospf-ar)#fast-reroute per-prefix

Loop Free Alternative (LFA)Label Allocation
Challenge••

Service Provider’s might have some edge devices which are not capable of handling higher number of labels, which can cause scaling issue.
As we know, by default LDP allocates labels for all IGP learned routes, resulting unwanted label assignments in the SP core.

Solution•••

Forwarding in MPLS requires labels only for PE’s loopback addresses.
Label allocation filtering can help SP’s for temporary scaling their MPLS network.
There are two options to accomplish this:
Allocate global Prefix-list- Allocates label for only those routes that match the prefix-list
Allocate global Host-route- Allocates labels for only for IGP learned route that are /32.
CISCO(config)#mpls ldp
CISCO(config-ldp)#address-family ipv4 label local allocate for host-routes
ORCISCO(config-ldp)#address-family ipv4 label local allocate for HOST -----à

where, HOST is a prefix-list or access-list

Label Allocation

Unicast Reverse Path Forwarding (uRPF)
Challenge•••

Generally when the router receives a unicast IP packet, it only cares about one thing, the destination address.
It is possible for the attackers to exploit this behavior and spoof the source IP address to send packets that would have otherwise been
dropped by the firewall or an access-list.
Results in Suboptimal Routing and computing overhead for the transit routers most of the times.

Solution••uRPF feature prevents above mentioned spoofing attacks.
It helps Routers to drop packets whose source address is unknow to them at the edge of the network.

Unicast Reverse Path Forwarding (uRPF)•uRPF can be configured to an interface of the router in one of below modes.

• Strict mode: Strict mode performs two checks for all incoming packets on an interface before forwarding them•

Do I have a matching entry for the source in the routing table?

AND

•
•

Do I use the same interface to reach this source as which I received this packet?
Generally not feasible for SP network, as they have asymmetric traffic flows.
CISCO(config)#interface HundredGigE0/0/1/0
CISCO(config-if)#ipv4 verify unicast source reachable-via rx• Loose Mode: Loose mode will perform only a single check when it receive an IP packet on an uRPF configured interface.
••

Do I have a matching entry for the source in the routing table?
Feasible for SP network as it helps in optimal routing for edge and transit devices.
CISCO(config)#interface HundredGigE0/0/1/0
CISCO(config-if)#ipv4 verify unicast source reachable-via any

BGP Table-Map
Challenge••

Unnecessary downloading or installing of certain BGP routes to the RIB or FIB on a RR( Route-Reflector),which is not on the data plane.
Making use of routers that are fit for compute but not for traffic forwarding.

Solution•••BGP table-map is a feature that allows us to filter the BGP routes marked for installation into the RIB.
A scenario where we could use table-map could be an RR that doesn’t need to be in the data plane but has to host the control plane).
Optimizes the performance of RR’s.

BGP Table-Map

BGP Table-Map

BGP Route Aggregation
Challenge• Increasing size of Global routing table.
• Routing instability due to flapping routes.

Solution• Route Aggregation decreases the size of the global routing table.
• Route Aggregation can help in rapid routing table lookups and prevent TCAM resource exhaustion for network
devices.
• Also Route Aggregation positively impacts routing stability.

BGP ROUTE AGGREGATION••••••

If AS-1 router advertised de-aggregatedprefixes to its e-BGP peers.
And If any of customer link goes down,AS-1 will advertises the withdrawal ofprefix to its eBGP Peers.
As a result, all internet routers with full
BGP table view removes network fromtheir FIB table, which in turn adds totheir compute load.
Again if the customer link comes up, theprefix is re-injected to AS-1 and readvertised to its eBGP peers, howeverconnectivity to the internet might not
be immediately available for thecustomer due to BGP propagation
delays.
Now if AS-1 advertises aggregates to its
eBGP peers and if any prefix becomes
unreachable, the prefix will only be
withdrawn from iBGP of AS-1.
The routing tables of the upstream are
not impacted as there are no network
updates sent from AS-1 to its eBGP
Peers.

6PE and 6VPE
Challenge••••

Need to deliver IPv6 Services over and IPv4-only MPLS Core.
One way of doing to would be to move to a dual stack solution.
It would involve implementing an IPv6 IGP, MP-BGP and IPv6 LDP (or MPLS-TE) for you ‘n’ number of MPLS boxes.
Other work around would be supporting IPv6 over the same IPv4 MPLS network with minimal changes.

Solution•••••

6PE (RFC-4798) and 6VPE ( RFC-4659) allows us to run IPv6 over an IPv4-only MPLS core where only the PE’s are dual stack.
Minimal operational, capital cost and risk as no impact on existing IPv4 and MPLS services.
MPLS Provider Routers (P) doesn’t need to be IPv6 aware.
Only Provider Edge (PE) requires upgrade - as 6PE and 6VPE router can be the existing PE router
Both 6PE and 6VPE exploit the fact that as long as a packet somehow can be forwarded along an LSP from ingress to egress PE, P routers
do not care about anything but the transport label.

6PE (IPv6 Provider Edge)•

6PE uses the global IPv6 routing table on the PE(i.e. the peering to the CE is under address-family ipv6 unicast).

•

The neighborship between PE’s is also under address-family ipv6 unicast.

•However the peers are an IPv4 address with send-label ( send NLRI + MPLS label to the peer) enabled.

•

The LSP’s between the PE is based on the IPv4 so the next hop addresses are IPv4 addresses.

•

When a PE router advertises an IPv6 prefix through MP-BGP to another PE, it embeds the IPv4 address in the IPv6 next hop address.

•

This is how a PE knows which IPv4 address (and thus which label) to use to get to the other PE.

•

A value of ::FFFF: is prepended to the IPv4 next hop, which is an IPv4-mapped IPv6 address.

6PE (IPv6 Provider Edge)

6PE-PE’s Output

6PE-CE’s Output

6VPE (IPv6 VPN Provider Edge)•6VPE uses VRF’s on the PE (i.e. the peering to the CE is under address-family ipv6 vrf <vrf_name> ).

•The neighborship between PE’s is under address-family vpnv6 unicast but the peers being an IPv4 address.

•

The LSP’s between the PE is based on the IPv4 so the next hop addresses are IPv4 addresses.

•When a PE advertises an IPv6 prefix through MP-BGP to another PE , it embeds the IPv4 address in the IPv6 next hop address.

•

This is how the PE knows which IPv4 address (and thus which label) to use to get to the other PE.

•A value of ::FFFF: is prepended to the IPv4 next hop, which is an IPv4-mapped IPv6 address.

6VPE (IPv6 VPN Provider Edge)

6VPE-PE’s Output

6VPE-CE’s Output

Anycast RP (Rendezvous Point)•

An RP (Rendezvous Point) acts as the meeting place for sources and receivers for multicast data in multicast network.

Challenge•

Although there are multiple ways of achieving RP redundancy still the delay in case of failovers is based on the RP/BSR/MA advertismentintervals which are not fast ( default upto 60 seconds).

Solution•••••Anycast RP is the failover based on the IGP running in the multicast domain which be really fast (especially when used with BFD andLFA).
Anycast RP solution also provides shared-tree load balancing among any number of active RPs in a multicast domain.
RP’s in the multicast domain share the same unicast IP address.
PIM join/prune as well the source registration message are sent to the closest RP based on the unicast routing table.
In order for all the RP’s in the multicast domain to be synchronized with each other regarding PIM join/prune and source registration
infromation, Anycast RP in conjunction with MSDP (Multicast Source Discovery Protocol) defined in RFC 3618 is to be used.

Anycast RP

QUESTIONS?

Thank YOU !!