Subject: RE: Basic LDP Question

From: "Suryanarayana, Ananth" <[email-masked]>
Date: Fri, 31 May 2002 13:43:26 -0400

traditional IP forwarding is a hopbyhop basis and hence very difficult
manage the path taken by a packet (end-too-end)... I think MPLS is like
source-routing, but with much more control over the packet flow.. and one of
the other uses is for seting up vpns using multiple label header stacks,
which is much more simple and efficient then maintaining IP over IP
tunnels..

Ananth

-----Original Message-----
From: Shahram Davari [mailto:[email-masked]]
Sent: Friday, May 31, 2002 1:28 PM
To: [email-masked]'
Cc: [email-masked]'
Subject: Basic LDP Question

Hi,

What problem a mp2p LDP-based MPLS network is trying to solve (like the one
used in RFC2547) that can't be done with pure IP forwarding?

Note: Don't tell me fast forwarding, because we can do fast IP lookup as
well.

Yours,
Shahram

---

From: [email-masked]
Date: Fri, 31 May 2002 12:50:32 -0500

MPLS is not like source routing.  if you use LDP, it is very much like 
IP routing.  Also, source routing is true only if you use "explicit 
routing".

Ananth

> From: ananth [mailto:[email-masked]]
> Sent: Friday, May 31, 2002 12:43 PM
> To: Shahram.Davari; mpls
> Cc: ananth; ppvpn
> Subject: RE: Basic LDP Question
> 
>

---

From: Shahram Davari <[email-masked]>
Date: Fri, 31 May 2002 10:48:19 -0700

1) My question was explicitly related to LDP which can't do source-routing.
2) I was thinking of MPLS over IP not IP over IP.

-Shahram

> From: Suryanarayana, Ananth [mailto:[email-masked]]
> Sent: Friday, May 31, 2002 1:43 PM
> To: Shahram Davari; [email-masked]'

---

From: "Suryanarayana, Ananth" <[email-masked]>
Date: Fri, 31 May 2002 13:52:31 -0400

If MPLS over IP is used, how can the overlapping VPN IP address be handled..
In case of multiple labels, the label would distinguish the overlapping
address spaced packets correctly , isn't it?

Ananth

-----Original Message-----
From: Shahram Davari [mailto:[email-masked]]
Sent: Friday, May 31, 2002 1:48 PM
To: 'Suryanarayana, Ananth'; [email-masked]'
Cc: [email-masked]'
Subject: RE: Basic LDP Question

-Shahram

---

From: Shahram Davari <[email-masked]>
Date: Fri, 31 May 2002 10:54:48 -0700

> If MPLS over IP is used, how can the overlapping VPN IP 

By the MPLS label above IP.

> address spaced packets correctly , isn't it?

No.

-Shahram

---

From: Shahram Davari <[email-masked]>
Date: Fri, 31 May 2002 11:14:53 -0700

LDP path is the same as IP path, and can change over time, therefore is not predictable.

-Shahram
> From: Sukanta ganguly [mailto:[email-masked]]
> Sent: Friday, May 31, 2002 2:03 PM
> To: Suryanarayana, Ananth; Shahram Davari; [email-masked]'
> Sharam,
>   LDP helps to lay out the path the packet will travel
> from ingress to egress of the MPLS path. It is not
> exactly source based routing but a predictive path is
> built for the packets with certain colors.
> 
> Ananth,
>   MPLS itself can be a VPN path when
> security/encryption is associated with the packet. So
> don't think of it has a IP-VPN enclosed in an MPLS
> VPN. They do not overlap. However, I have heard of
> talks of MPLS VPN on top of IP VPN. This could be due
> to the fact that an IPVPN already exists and MPLS
> based paths are new addition. 
> 
> SG
> 
> 
> 
> --- "Suryanarayana, Ananth" <[email-masked]>
> wrote:
> > 
> > > manage the path taken by a packet (end-too-end)...
> > I think 
> > > MPLS is like
> > > source-routing, but with much more control over
> > the packet 
> > > flow.. and one of
> > > the other uses is for seting up vpns using
> > multiple label 
> > > header stacks,
> > > What problem a mp2p LDP-based MPLS network is
> > trying to solve 
> > > (like the one
> > > Note: Don't tell me fast forwarding, because we
> > can do fast 
> > > IP lookup as
> > > well.
> > > 
> > > Yours,
> > > Shahram
> > > 
> > 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com
>

---

From: Shahram Davari <[email-masked]>
Date: Fri, 31 May 2002 11:59:59 -0700

I thought you have found another "good" reason. For spoofing see my
email response to Yakov.

-Shahram

> From: Vijay Bollapragada [mailto:[email-masked]]
> Sent: Friday, May 31, 2002 2:53 PM
> To: Shahram Davari
> Cc: [email-masked]'; [email-masked]'
> On Fri, 31 May 2002, Shahram Davari wrote:
> 
> > Vijay,
> > 
> > I know all this. The question was: 
> > 
> > "Why use LDP instead of IP?". 
> 
> The argument of not using IP is "spoofing" as yakov pointed out
> also, section 7 of 
> 
> http://search.ietf.org/internet-drafts/draft-ietf-ppvpn-gre-ip
> -2547-01.txt
> 
> Vijay
> 
> 
> > If you have an answer please provide.
> > 
> > -Shahram
> > 
> > > From: Vijay Bollapragada [mailto:[email-masked]]
> > > Sent: Friday, May 31, 2002 2:34 PM
> > > To: Shahram Davari
> > > Cc: [email-masked]'; [email-masked]'
> > > On Fri, 31 May 2002, Shahram Davari wrote:
> > > 
> > > > Vijay,
> > > 
> > > > But LDP does not give you the TE ability. So why use LDP?
> > > 
> > > Agreed, that LDP does not give the ability to do TE, I only 
> > > said use MPLS
> > > in the core, not necassarily LDP :-) but in any case, Here is 
> > > what 2547
> > > draft says about using LDP for the top label..
> > > 
> > > Section 4.3.2
> > > 
> > > "All that matters for the VPN architecture is that some 
> label switched
> > > path between the router and its BGP next hop exists.  
> > > However, to ensure
> > > interoperability  among systems which implement this VPN 
> architecture,
> > > all such systems must support LDP [MPLS-LDP]."
> > > 
> > > Of course, once could use many other mechanisms to get 
> the vpn_labeled
> > > packet from one edge PE to another edge PE, Interoperability 
> > > is the key
> > > here.
> > > 
> > > Thanks,
> > > Vijay
> > > 
> > > 
> > > 
> > > > 
> > > > > From: Vijay Bollapragada [mailto:[email-masked]]
> > > > > Sent: Friday, May 31, 2002 2:06 PM
> > > > > To: Shahram Davari
> > > > > Cc: [email-masked]'; [email-masked]'
> > > > > Subject: Re: Basic LDP Question
> > > > > 
> > > > > 
> > > > > In the 2547 case, typically u have 2 labels, the vpn_label 
> > > > > (bottom label)
> > > > > and the top label is the label to get the packet to the far 
> > > > > end PE, Now,
> > > > > LDP is used for this top label.
> > > > > 
> > > > > I think u are questioning why use LDP for this bottom_label 
> > > > > and why not
> > > > > simply encapsulate the MPLS packet in IP to get the packet to 
> > > > > the next_hop
> > > > > PE. If this is your Q, You are absolutely correct and 
> > > this is what the
> > > > > following draft talks about
> > > > > 
> > > > > http://search.ietf.org/internet-drafts/draft-ietf-ppvpn-gre-ip
> > > > > -2547-01.txt
> > > > > 
> > > > > IMHO, this is certainly do-able but MPLS in the core give us 
> > > > > the ability
> > > > > to do things like Traffic Enginnering
> > > > 
> > > > 
> > > > -Shahram
> > > > 
> > > >  which are quite a challenge over
> > > > > pure IP.
> > > > > 
> > > > > Thanks,
> > > > > Vijay
> > > > > 
> > > > > 
> > > > > 
> > > > > On Fri, 31 May 2002, Shahram Davari wrote:
> > > > > 
> > > > > > Hi,
> > > > > > 
> > > > > > What problem a mp2p LDP-based MPLS network is trying to 
> > > > > solve (like the one used in RFC2547) that can't be done with 
> > > > > pure IP forwarding?
> > > > > > 
> > > > > > Note: Don't tell me fast forwarding, because we can do fast 
> > > > > IP lookup as well.
> > > > > > 
> > > > > > Yours,
> > > > > > Shahram
> > > > > > 
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
>

---

From: [email-masked]
Date: Sat, 1 Jun 2002 00:14:45 +0100

Shahram Davari wrote 31 May 2002 19:40
> To: 'Yakov Rekhter'
> Cc: Giles Heron; [email-masked]'; [email-masked]'
> > > in IP also you can do ACL.
> > 
> > yes, but it has its own cost/complexity.
> 
> Sure, but using LDP you are forced to run some kind of OAM, to detect
> mis-config of LSRs. So nothing is gained. The cost/complexity 
> of filtering is
> replaced with cost/complexity of OAM.
> 
> -Shahram
NH=> I am not sure you are capturing all the issues here Shahram.  Some P
LSRs do load-balancing based on IP address hashing as a sort of TE function
because LDP just gives SPF and so leads to networks that are
traffic/topology sensitive.  This gives rise to the additional points:
-	might this not also be considered a security issue itself from a
customer perspective, ie VPN customer IP pkts are looked at for sorting into
different streams?
-	what about the added processing load this creates on the P routers
involved?
-	does it not break the simple 'label forwarding' paradigm that seems
to be the raison detre for MPLS?
-	and don't we effectively get back to IP fowarding now.....albeit
with an inability to do IP forwarding because the P routers don't have the
IP routes (of the VPNs)

To which you can now add your OAM issue because yes we have to fault-manage
these entities since they do fail...and this now includes the load-balancing
functions.

Further:
-	given we can't give any solid SLAs to such VPNs when based on LDP
(because of the VPN population pkt merging issue);
-	so to compensate we have to over-engineer and hope;
-	VPN topologies are invariably long-holding....so their LSPs really
need decoupling from the IGP in case it flexes routes or misbehaves;

In view of all these factors perhaps it might have been wiser to make
ER/signalled LSPs the interworking default for VPNs rather than LDP in
rfc2547.

regards, Neil

---

From: [email-masked]
Date: Sat, 1 Jun 2002 00:14:38 +0100

Vijay,

You wrote Vijay Bollapragada 31 May 2002 19:34
> "All that matters for the VPN architecture is that some label switched
> interoperability  among systems which implement this VPN architecture,
> Of course, once could use many other mechanisms to get the vpn_labeled
NH=> So are you saying the only reason for LDP is because there is a need to
run VPN services composed of (i) multiple vendors and (ii) multiple SPs
across a population of P routers?  Can you (or anyone else) identify some of
these cases please?

regards, Neil