rfc3107.txt

BCAST Implementation for NS2


RFC 3107          Carrying Label Information in BGP-4           May 2001


   A BGP speaker that is capable of handling multiple routes to a
   destination (as described above) should use the Capabilities Optional
   Parameter, as defined in [BGP-CAP], to inform its peers about this
   capability.  The value of this capability is 4.

6. When the BGP Peers are not Directly Adjacent

   Consider the following LSR topology: A--B--C--D.  Suppose that D
   distributes a label L to A.  In this topology, A cannot simply push L
   onto a packet's label stack, and then send the resulting packet to B.
   D must be the only LSR that sees L at the top of the stack.  Before A
   sends the packet to B, it must push on another label, which was
   distributed by B.  B must replace this label with yet another label,
   which was distributed by C.  In other words, there must be an LSP
   between A and D.  If there is no such LSP, A cannot make use of label
   L.  This is true any time labels are distributed between non-adjacent
   LSRs, whether that distribution is done by BGP or by some other
   method.

   This document does NOT specify any procedure for ensuring in real
   time that label distribution between non-adjacent LSRs is done only
   when the appropriate MPLS infrastructure exists in the network or
   networks connecting the two LSRs.  Ensuring that the proper
   infrastructure exists is an issue for network management and
   operation.

7. Security Considerations

   When an LSR A is directly connected to an LSR B via a point-to-point
   interface, then when A receives packets over that interface, it knows
   that they come from B.  This makes it easy for A to discard any
   packets from B whose top labels are not among the labels that A
   distributed to B.  That is, A can easily ensure that B only uses
   those labels which it is entitled to use.  This technique can be used
   to prevent "label spoofing", i.e., the situation in which an LSR
   imposes a label which has not been properly distributed to it.

   The procedures discussed in this document would commonly be used when
   the label distribution peers are separated not merely by a point-to-
   point link, but by an MPLS network.  This means that when an LSR A
   processes a labeled packet, it really has no way to determine which
   other LSR B pushed on the top label.  Hence it cannot tell whether
   the label is one which B is entitled to use.  In fact, when Route
   Reflectors are in use, A may not even know the set of LSRs which
   receive its label mappings.  So the previous paragraph's technique
   for preventing label spoofing does not apply.





Rekhter & Rosen             Standards Track                     [Page 5]

RFC 3107          Carrying Label Information in BGP-4           May 2001


   It is possible though to use other techniques to avoid label spoofing
   problems.  If, for example, one never accepts labeled packets from
   the network's "external" interfaces, and all the BGP-distributed
   labels are advertised via IBGP, then there is no way for an untrusted
   router to put a labeled packet into the network.  One can generally
   assume that one's IBGP peers (or the IBGP peers of one's Route
   Reflector) will not attempt label spoofing, since they are all under
   the control of a single administration.

   This condition can actually be weakened significantly.  One doesn't
   need to refuse to accept all labeled packets from external
   interfaces.  One just needs to make sure that any labeled packet
   received on an external interface has a top label which was actually
   distributed out that interface.

   Then a label spoofing problem would only exist if there are both
   trusted and untrusted systems out the same interface.  One way to
   avoid this problem is simply to avoid this situation.

8. Acknowledgments

   Thanks to Ravi Chandra, Enke Chen, Srihari Ramachandra, Eric Gray and
   Liam Casey for their comments.

9. References

   [BGP-4]       Rekhter, Y. and T. Li, "A Border Gateway Protocol 4
                 (BGP-4)", RFC 1771, March 1995.

   [BGP-CAP]     Chandra, R. and J. Scudder, "Capabilities Advertisement
                 with BGP-4", RFC 2842, May 2000.

   [BGP-MP]      Bates, T., Rekhter, Y, Chandra, R. and D. Katz,
                 "Multiprotocol Extensions for BGP-4", RFC 2858, June
                 2000.

   [BGP-RR]      Bates, T. and R. Chandra, "BGP Route Reflection: An
                 alternative to full mesh IBGP", RFC 1966, June 1996.

   [MPLS-ARCH]   Rosen, E., Vishwanathan, A. and R. Callon,
                 "Multiprotocol Label Switching Architecture" RFC 3031,
                 January 2001.

   [MPLS-ENCAPS] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y.,
                 Farinacci, D., Li, T. and A. Conta, "MPLS Label Stack
                 Encoding", RFC 3032, January 2001.





Rekhter & Rosen             Standards Track                     [Page 6]

RFC 3107          Carrying Label Information in BGP-4           May 2001


10. Authors' Addresses

   Yakov Rekhter
   Juniper Networks
   1194 N. Mathilda Avenue
   Sunnyvale, CA 94089

   EMail: [e-mail]


   Eric Rosen
   Cisco Systems, Inc.
   250 Apollo Drive
   Chelmsford, MA 01824

   EMail: [e-mail]



































Rekhter & Rosen             Standards Track                     [Page 7]

RFC 3107          Carrying Label Information in BGP-4           May 2001


11.  Full Copyright Statement

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Rekhter & Rosen             Standards Track                     [Page 8]