An Architectural Introduction to the Locator/ID Separation Protocol (LISP)
draft-ietf-lisp-introduction-13
Note: This ballot was opened for revision 11 and is now closed.
(Adrian Farrel) Discuss
Discuss (2015-03-03 for -12)
Thank you for this document. It is really helpful to have a clear introduction to LISP, and I appreciate the hard work that has gone into producing this text. I have a small Discuss that is easily fixed. The essence is that you should limit this document to a description of LISP and not try to use it to bash other solutions. In Section 4.2 On the contrary BGP is a push architecture, where the required network state is pushed by means of BGP UPDATE messages to BGP speakers. You will be aware of RFC 5291 and the use of ORF to make BGP a pull-mode protocol. (I won't say to you that LISP is push mode because a Map-Reply pushes the mapping information from the map server to the client :-) So, my advice is to describe LISP in this document and to not make comments about other systems. It isn't a beauty contest and it isn't wise to try to say "my system is better/different from yours". The solution is to just remove this sentence. Similarly in 7.1 BGP is the standard protocol to implement inter-domain routing. With BGP, routing information are propagated along the network and each autonomous system can implement its own routing policy that will influence the way routing information are propagated. The direct consequence is that an autonomous system cannot precisely control the way the traffic will enter the network. As opposed to BGP, a LISP site can strictly impose via which ETRs the traffic must enter the the LISP site network even though the path followed to reach the ETR is not under the control of the LISP site. Let's not get into the "BGP this, BGP that" debate. Just remove the first paragraph and the first four words of the second paragraph. That way you avoid all contention and write a document about LISP.
Comment (2015-03-03 for -12)
No email
send info
send info
I have a few questions and editorial nits I hope you will pick up as additional polish. Some of the nits come from Deborah's review as AD in-training --- Section 1 I'm really not comfortable with your text... "Indeed and as pointed out by the unpublished Internet Draft by Noel Chiappa [Chiappa]" This isn't a stable reference and I don't think you need it. You could either rely on the later reference to RFC 4984, reference RFC 6830 itself, or take out the aside "and as... ... [Chiappa]" --- Section 1 has LISP creates two separate namespaces, EIDs (End-host IDentifiers) and RLOCs (Routing LOCators), both are typically syntactically identical to the current IPv4 and IPv6 addresses. The "typically" here opens a bit of door. RFC 6830 explains this in the definitions of EID, but seems to be clear that an RLOC is an IP address. If you are opening up the RLOC to be something other than an IP address (a MAC address or even something else?) then how do you deal with: - lack of ICMP - non-uniqueness Possibly you can say that this is "not my problem" since the problem would already exist in the routing system that handles the non-IP addresses. But maybe, for an introduction to the topic this is over- reaching towards the many potential applications rather than the basic explanation of the architecture? But in your own definitions in Section 2, you have Endpoint IDentifier (EID): EIDs are IPv4 or IPv6 addresses used to uniquely identify nodes irrespective of their topological location and are typically routed intra-domain. Routing LOcator (RLOC): RLOCs are IPv4 or IPv6 addresses assigned topologically to network attachment points and typically routed inter-domain. Neither of which offers any possiblitity to vary "always" into "typically". The again, 3.2 has... EIDs are typically -but not limited to- IPv4 or IPv6 addresses ...and... With LISP, the core uses RLOCs, an RLOC is typically -but not limited to- an IPv4 or IPv6 address Some concistency is needed! In 3.4.1 you finally get there... Typical mappings in LISP bind EIDs in the form of IP prefixes with a set of RLOCs, also in the form of IPs. IPv4 and IPv6 addresses are encoded using the appropriate Address Family Identifier (AFI) [RFC3232]. However LISP can also support more general address encoding by means of the ongoing effort around the LISP Canonical Address Format (LCAF) [I-D.ietf-lisp-lcaf]. Why don't you talk about everything in terms of IP adresses and then add a section somewhere near the end to talk about LCAF? --- Section 1 introduces "overlay" and "underlay". I think that a certain class of network engineer understands these concepts really well. And, in my experience, another class has no idea what you are talking about! This would probably show very easily on a simple diagram showing the overlay and underlay networks. But perhaps the summary in the Introduction is launching in a bit deep nd fast? This is probably the hardest part of the document to write: how do you summarise what you haven't yet talked about? There are some bits, however, that really need work. For example... o EIDs have meaning only in the overlay network unless they are leaked into the underlay network. The overlay is the encapsulation relationship between LISP-capable routers. Furthermore EIDs are not assigned from the reserved address blocks. So they have meaning only in one place, unless they have meaning in more than one place? :-) And what is a "resrved address block"? --- Section 3.2 With LISP, LISP sites (edge) and the core of the Internet are interconnected by means of LISP-capable routers (e.g., border routers) using tunnels. I don't think this is right. It is true that LISP sites and the core of the Internet are interconnected by means of LISP-capable routers But the tunnels connect those border routers. So you probably need... LISP sites (at the edge of the Internet) are connected to the core of the Internet by means of LISP-capable routers (e.g., border routers). LISP sites are connected across the core of the Internet using tunnels between the LISP-capable routers. --- Section 3.2 OLD A typically distributed database, called the Mapping System, stores mappings between EIDs and RLOCs. NEW A database which is typically distributed, called the Mapping System, stores mappings between EIDs and RLOCs. --- 3.2 Such LISP capable routers, in most cases, only require a software upgrade. That's a little disconcerting. Can you add to "in most cases"? --- 4.1 Time-To-Live (TTL): Each mapping contains a TTL set by the ETR, upon expiration of the TTL the ITR has to refresh the mapping by sending a new Map-Request. Typical values for TTL defined by LISP are 24 hours. Presumably it doesn't *have to*. It can choose to delete it and not refresh it. Maybe this should be worded as MUST NOT use after the expiration of the TTL. --- Section 5 says The separation between locators and identifiers in LISP was initially proposed for traffic engineering purpose where LISP sites can change their attachment points to the Internet (i.e., RLOCs) without impacting endpoints or the Internet core. RFC 6830 says Creation of LISP was initially motivated by discussions during the IAB-sponsored Routing and Addressing Workshop held in Amsterdam in October 2006 (see [RFC4984]). RFC 4984 says The primary goal of the workshop was to develop a shared understanding of the problems that the large backbone operators are facing regarding the scalability of today's Internet routing system. I conclude that Section 5 here is somewhat wrong. --- Section 7.1 "the possibility for a site to issue a different mapping for each remote site, implementing so precise routing policies." Suggest "the possibility for a site to support a different mapping policy for each remote site." --- I think some examination of the classification of normative and informative references would be useful. For example, RFC 6836 is used only in 3.4.3.1 and is Normative. I think that is fine because it is where to go for a definition of LISP+ALT. But 3.4.3.2 defines LISP-DDT by means of a reference to [I-D.ietf-lisp-ddt] which turns out to be Informative. --- Appendix A "The LISP system.." Haven't seen a "LISP system" defined. Suggest "The LISP architecture.." --- Appendix A "A small group of like-minded personnel from various scattered locations within Cisco, spontaneously formed immediately after that workshop, to work on an idea that came out of informal discussions at the workshop and on various mailing lists." Suggest deleting this sentence (unless you want this to look like a Cisco-only initiative).
(Spencer Dawkins) Yes
Comment (2015-03-03 for -12)
No email
send info
send info
I'm a Yes because this draft is helpful to the largely uninitiated (that would include me), but I was consistently encountering questions that Adrian's Discuss and Comments answered, so I'd encourage you to work through his Comments, as well as his Discuss. Beyond that: In this text: 3.3.1. LISP Encapsulation ITRs encapsulate data packets towards ETRs. LISP data packets are encapsulated using UDP (port 4341), the source port is usually selected by the ITR using a 5-tuple hash of the inner header (so to be consistent in case of multi-path solutions such as ECMP [RFC2992]) and ignored on reception. would you ever use "virtual xTRs" with the same outermost IP addresses? If not, fine, but if so, would you need to use different destination ports to disambiguate them? Or does the Instance ID provide enough isolation to meet this need? I ask because adding virtual hosts to HTTP was a drag, so best for me to ask early! Further in the same paragraph, in this text: A particularity of LISP is that UDP packets should include a zero checksum [RFC6935] [RFC6936] that it is not verified in reception, LISP also supports non-zero checksums that may be verified. This decision was made because the typical transport protocols used by the applications already include a checksum, by neglecting the additional UDP encapsulation checksum xTRs can forward packets more efficiently. I'm wobbling between "should include a zero checksum" and "also supports non-zero checksums". Is that text saying something like this? LISP data packets are often encapsulated in UDP packets that include a zero checksum [RFC6935] [RFC6936] that is not verified when it is received, because LISP data packets typically include an inner transport protocol header with a non-zero checksum. By omitting the additional outer UDP encapsulation checksum, xTRs can forward packets more efficiently. If LISP data packets are encapsulated in UDP packets with non-zero checksums, the outer UDP checksums are verified when the UDP packets are received, as part of normal UDP processing.
(Brian Haberman) Yes
(Jari Arkko) No Objection
(Alia Atlas) (was Discuss) No Objection
Comment (2015-04-14)
No email
send info
send info
Thanks for addressing my discuss and comments. I support Adrian's discuss. In a similar vein: In Sec 3.2: Please either remove the claim of "Such LISP capable routers, in most cases, only require a software upgrade." or explain how you can justify the need to add and remove new encapsulations and handle the various flag triggers and caching at line rate. There is no need for such marketing in this document. 1) Sec 1, second paragraph: "LISP creates two separate namespaces, EIDs (End-host IDentifiers) and RLOCs (Routing LOCators), both are typically syntactically identical to the current IPv4 and IPv6 addresses." What does "typically" mean? As far as I'm aware, they are syntactically identical. This is reiterated in Sec 3.2; are you just trying to preserve the point of architectural freedom? I've found the third instance of insisting that the EID or RLOC now is only "typically" an IPv4 or IPv6 address. Please lose "typically". Minorly, the , before both should be a ;. 2) top paragraph of p.4: "The initial motivation in the LISP effort is to be found in the routing scalability problem [RFC4984], where, if LISP is completely deployed, the Internet core is populated with RLOCs while Traffic Engineering mechanisms are pushed to the Mapping System." Instead of "LISP is completely deployed" to "LISP were to be completely deployed" - making it subjunctive. 3) Last paragraph in Sec 1: "This document describes the LISP architecture, its main operational mechanisms as its design rationale." I think you mean "This document describes the LISP architecture and its main operational mechanisms as well as its design rationale." 4) In Sec 3.1, second paragraph: "Locator/Identifier split: By decoupling the overloaded semantics of the current IP addresses the Internet core can be assigned identity meaningful addresses and hence, can use aggregation to scale." I assume that you mean "topologically meaningful addresses" instead of "identity meaningful addresses".
(Richard Barnes) No Objection
Comment (2015-03-04 for -12)
No email
send info
send info
I would also find this document much improved if the authors could address Adrian's comments, as well as those in Radia's SECDIR review.
(Benoît Claise) No Objection
(Stephen Farrell) No Objection
(Joel Jaeggli) No Objection
(Ted Lemon) No Objection
(Kathleen Moriarty) (was Discuss) No Objection
Comment (2015-04-14)
No email
send info
send info
Please do look at the other suggestions from the review as they should help clarify a few points in the draft and provide the background needed for an introduction draft. While the edits in the security section help enough that I'll let it go, the other problems were not highlighted here and will rely on subsequent drafts elaborating on the threats and security considerations besides DoS. I haven't read the threats draft yet, so hopefully that covers the full set. Thanks. https://www.ietf.org/mail-archive/web/secdir/current/msg05415.html