An Architectural Introduction to the Locator/ID Separation Protocol (LISP)

Note: This ballot was opened for revision 11 and is now closed.

(Adrian Farrel) Discuss

Discuss (2015-03-03 for -12)
Thank you for this document. It is really helpful to have a clear
introduction to LISP, and I appreciate the hard work that has gone into
producing this text.

I have a small Discuss that is easily fixed. The essence is that you 
should limit this document to a description of LISP and not try to use
it to bash other solutions.

In Section 4.2

   On the contrary BGP is a
   push architecture, where the required network state is pushed by
   means of BGP UPDATE messages to BGP speakers.

You will be aware of RFC 5291 and the use of ORF to make BGP a pull-mode

(I won't say to you that LISP is push mode because a Map-Reply pushes 
the mapping information from the map server to the client :-)

So, my advice is to describe LISP in this document and to not make
comments about other systems. It isn't a beauty contest and it isn't
wise to try to say "my system is better/different from yours".

The solution is to just remove this sentence.

Similarly in 7.1

   BGP is the standard protocol to implement inter-domain routing.  With
   BGP, routing information are propagated along the network and each
   autonomous system can implement its own routing policy that will
   influence the way routing information are propagated.  The direct
   consequence is that an autonomous system cannot precisely control the
   way the traffic will enter the network.

   As opposed to BGP, a LISP site can strictly impose via which ETRs the
   traffic must enter the the LISP site network even though the path
   followed to reach the ETR is not under the control of the LISP site.

Let's not get into the "BGP this, BGP that" debate. Just remove the 
first paragraph and the first four words of the second paragraph. That
way you avoid all contention and write a document about LISP.
Comment (2015-03-03 for -12)
No email
send info
I have a few questions and editorial nits I hope you will pick up as
additional polish. Some of the nits come from Deborah's review as AD


Section 1

I'm really not comfortable with your text... "Indeed and as pointed out
by the unpublished Internet Draft by Noel Chiappa [Chiappa]"

This isn't a stable reference and I don't think you need it. You could
either rely on the later reference to RFC 4984, reference RFC 6830 
itself, or take out the aside "and as... ... [Chiappa]"


Section 1 has

   LISP creates two separate namespaces, EIDs (End-host IDentifiers) and
   RLOCs (Routing LOCators), both are typically syntactically identical
   to the current IPv4 and IPv6 addresses.

The "typically" here opens a bit of door.

RFC 6830 explains this in the definitions of EID, but seems to be clear
that an RLOC is an IP address.

If you are opening up the RLOC to be something other than an IP address 
(a MAC address or even something else?) then how do you deal with:
- lack of ICMP
- non-uniqueness

Possibly you can say that this is "not my problem" since the problem 
would already exist in the routing system that handles the non-IP
addresses. But maybe, for an introduction to the topic this is over-
reaching towards the many potential applications rather than the basic
explanation of the architecture?

But in your own definitions in Section 2, you have 

   Endpoint IDentifier (EID):  EIDs are IPv4 or IPv6 addresses used to
      uniquely identify nodes irrespective of their topological location
      and are typically routed intra-domain.

   Routing LOcator (RLOC):  RLOCs are IPv4 or IPv6 addresses assigned
      topologically to network attachment points and typically routed

Neither of which offers any possiblitity to vary "always" into

The again, 3.2 has...

   EIDs are typically -but
   not limited to- IPv4 or IPv6 addresses


   With LISP, the core uses RLOCs, an RLOC is typically -but not limited
   to- an IPv4 or IPv6 address

Some concistency is needed!

In 3.4.1 you finally get there...

   Typical mappings in LISP bind EIDs in the form of IP prefixes with a
   set of RLOCs, also in the form of IPs.  IPv4 and IPv6 addresses are
   encoded using the appropriate Address Family Identifier (AFI)
   [RFC3232].  However LISP can also support more general address
   encoding by means of the ongoing effort around the LISP Canonical
   Address Format (LCAF) [I-D.ietf-lisp-lcaf].

Why don't you talk about everything in terms of IP adresses and then add
a section somewhere near the end to talk about LCAF?


Section 1 introduces "overlay" and "underlay". I think that a certain
class of network engineer understands these concepts really well. And,
in my experience, another class has no idea what you are talking about!

This would probably show very easily on a simple diagram showing the
overlay and underlay networks.

But perhaps the summary in the Introduction is launching in a bit deep
nd fast? This is probably the hardest part of the document to write:
how do you summarise what you haven't yet talked about? There are some
bits, however, that really need work. For example...

   o  EIDs have meaning only in the overlay network unless they are
      leaked into the underlay network.  The overlay is the
      encapsulation relationship between LISP-capable routers.
      Furthermore EIDs are not assigned from the reserved address

So they have meaning only in one place, unless they have meaning in more
than one place? :-)   And what is a "resrved address block"?


Section 3.2

   With LISP, LISP sites (edge) and the core of the Internet are
   interconnected by means of LISP-capable routers (e.g., border
   routers) using tunnels.

I don't think this is right.

It is true that
  LISP sites and the core of the Internet are interconnected by means
  of LISP-capable routers

But the tunnels connect those border routers. So you probably need...

   LISP sites (at the edge of the Internet) are connected to the core
   of the Internet by means of LISP-capable routers (e.g., border 
   routers).  LISP sites are connected across the core of the Internet
   using tunnels between the LISP-capable routers.


Section 3.2


   A typically distributed database, called the Mapping System, stores
   mappings between EIDs and RLOCs.


   A database which is typically distributed, called the Mapping System,
   stores mappings between EIDs and RLOCs.



   Such LISP capable routers, in most cases, only require a software

That's a little disconcerting. Can you add to "in most cases"?



   Time-To-Live (TTL):  Each mapping contains a TTL set by the ETR, upon
      expiration of the TTL the ITR has to refresh the mapping by
      sending a new Map-Request.  Typical values for TTL defined by LISP
      are 24 hours.

Presumably it doesn't *have to*. It can choose to delete it and not
refresh it. Maybe this should be worded as MUST NOT use after the 
expiration of the TTL.


Section 5 says

   The separation between locators and identifiers in LISP was initially
   proposed for traffic engineering purpose where LISP sites can change
   their attachment points to the Internet (i.e., RLOCs) without
   impacting endpoints or the Internet core.

RFC 6830 says 

   Creation of LISP was initially motivated by discussions during the
   IAB-sponsored Routing and Addressing Workshop held in Amsterdam in
   October 2006 (see [RFC4984]).

RFC 4984 says

   The primary goal of
   the workshop was to develop a shared understanding of the problems
   that the large backbone operators are facing regarding the
   scalability of today's Internet routing system.

I conclude that Section 5 here is somewhat wrong.


Section 7.1

"the possibility for a site to issue a different mapping for each
   remote site, implementing so precise routing policies."

Suggest "the possibility for a site to support a different mapping
policy for each remote site."


I think some examination of the classification of normative and 
informative references would be useful.

For example, RFC 6836 is used only in and is Normative. I think
that is fine because it is where to go for a definition of LISP+ALT. But defines LISP-DDT by means of a reference to [I-D.ietf-lisp-ddt]
which turns out to be Informative.

Appendix A
"The LISP system.."
Haven't seen a "LISP system" defined. Suggest "The LISP architecture.."


Appendix A
"A small group of like-minded personnel from various scattered locations
within Cisco, spontaneously formed immediately after that workshop, to 
work on an idea that came out of informal discussions at the workshop
and on various mailing lists."

Suggest deleting this sentence (unless you want this to look like a 
Cisco-only initiative).

(Spencer Dawkins) Yes

Comment (2015-03-03 for -12)
No email
send info
I'm a Yes because this draft is helpful to the largely uninitiated (that would include me), but I was consistently encountering questions that Adrian's Discuss and Comments answered, so I'd encourage you to work through his Comments, as well as his Discuss.

Beyond that:

In this text:

3.3.1.  LISP Encapsulation

   ITRs encapsulate data packets towards ETRs.  LISP data packets are
   encapsulated using UDP (port 4341), the source port is usually
   selected by the ITR using a 5-tuple hash of the inner header (so to
   be consistent in case of multi-path solutions such as ECMP [RFC2992])
   and ignored on reception.  
would you ever use "virtual xTRs" with the same outermost IP addresses?
If not, fine, but if so, would you need to use different destination ports to disambiguate them? Or does the Instance ID provide enough isolation to meet this need?

I ask because adding virtual hosts to HTTP was a drag, so best for me to ask early!
Further in the same paragraph, in this text:

   A particularity of LISP is that UDP
   packets should include a zero checksum [RFC6935] [RFC6936] that it is
   not verified in reception, LISP also supports non-zero checksums that
   may be verified.  This decision was made because the typical
   transport protocols used by the applications already include a
   checksum, by neglecting the additional UDP encapsulation checksum
   xTRs can forward packets more efficiently.
I'm wobbling between "should include a zero checksum" and "also supports non-zero checksums". Is that text saying something like this?

   LISP data packets are often encapsulated in UDP packets that
   include a zero checksum [RFC6935] [RFC6936] that is not verified 
   when it is received, because LISP data packets typically include
   an inner transport protocol header with a non-zero checksum. By 
   omitting the additional outer UDP encapsulation checksum, xTRs 
   can forward packets more efficiently. If LISP data packets are 
   encapsulated in UDP packets with non-zero checksums, the outer
   UDP checksums are verified when the UDP packets are received, as
   part of normal UDP processing.

(Brian Haberman) Yes

(Jari Arkko) No Objection

(Alia Atlas) (was Discuss) No Objection

Comment (2015-04-14)
No email
send info
Thanks for addressing my discuss and comments.

I support Adrian's discuss.  In a similar vein:

In Sec 3.2: Please either remove the claim of "Such LISP capable
routers, in most cases, only require a software upgrade." or explain
how you can justify the need to add and remove new encapsulations and
handle the various flag triggers and caching at line rate.  There is
no need for such marketing in this document.

1) Sec 1, second paragraph:
   "LISP creates two separate namespaces, EIDs (End-host IDentifiers) and
   RLOCs (Routing LOCators), both are typically syntactically identical
   to the current IPv4 and IPv6 addresses."
   What does "typically" mean?  As far as I'm aware, they are
   syntactically identical.  This is reiterated in Sec 3.2; are you just
   trying to preserve the point of architectural freedom?  I've found the
   third instance of insisting that the EID or RLOC now is only "typically" 
   an IPv4 or IPv6 address. Please lose "typically".  Minorly, the ,
   before both should be a ;.

2) top paragraph of p.4:
  "The initial motivation in the LISP effort is to be found in the
   routing scalability problem [RFC4984], where, if LISP is completely
   deployed, the Internet core is populated with RLOCs while Traffic
   Engineering mechanisms are pushed to the Mapping System."

   Instead of "LISP is completely deployed" to "LISP were to be
   completely deployed" - making it subjunctive.  

3) Last paragraph in Sec 1:
   "This document describes the LISP architecture, its main
   operational mechanisms as its design rationale."

   I think you mean 

   "This document describes the LISP architecture and its main
   operational mechanisms as well as its design rationale."

4) In Sec 3.1, second paragraph:
   "Locator/Identifier split: By decoupling the overloaded semantics
      of the current IP addresses the Internet core can be assigned
      identity meaningful addresses and hence, can use aggregation to
   I assume that you mean "topologically meaningful addresses" instead
   of "identity meaningful addresses".

(Richard Barnes) No Objection

Comment (2015-03-04 for -12)
No email
send info
I would also find this document much improved if the authors could address Adrian's comments, as well as those in Radia's SECDIR review.

(Benoît Claise) No Objection

(Stephen Farrell) No Objection

(Joel Jaeggli) No Objection

(Ted Lemon) No Objection

(Kathleen Moriarty) (was Discuss) No Objection

Comment (2015-04-14)
No email
send info
Please do look at the other suggestions from the review as they should help clarify a few points in the draft and provide the background needed for an introduction draft.  While the edits in the security section help enough that I'll let it go, the other problems were not highlighted here and will rely on subsequent drafts elaborating on the threats and security considerations besides DoS.  I haven't read the threats draft yet, so hopefully that covers the full set.  Thanks.