Protection of UNIs and E-NNIs
Zehavit Alon
Nurit Sprecher
September 2009
Slide 1
Recap
•
•
The subject of Inter-network Ethernet Service Protection
was introduced during the meeting in May in:
http://www.ieee802.org/1/files/public/docs2009/new-alonservice-protection-in-interconnectned-areas-0509-v01.ppt
Two possible topologies were introduced and compared
Mesh
Ring
The comparison
indicted that
mesh is superior
to ring.
Slide 2
May, 2008
Recap (cont’d)
•
The mesh topology has advantages and drawbacks:
– Advantages
▪
▪
Direct (single-hop) connectivity between the attached networks ensuring
a short path and low latency during transmission between the attached
networks
Capability to enable efficient and simple load-sharing across all the
(direct) links with optimum resource utilization
– Drawback
Any protection event (i.e. switchover or revert) in the interconnected zone
affects the topology of at least one of the attached networks.
Slide 3
May, 2008
Drawback overcome
Full Mesh
Partial Mesh
• Note: A construct with 5 links is also supported. The left side operates like the
partial mesh topology while the right side behaves like the full mesh topology.
Slide 4
May, 2008
Drawback overcome (cont’d)
The full mesh construct benefits from the advantages of the
mesh. It minimizes the effects of protection events within the
interconnected zone on the topology of the related attached
networks, reducing them to the level of inevitable effects:
– Each protected VLAN is transported over one of the links traversing
the interconnected zone.
– Topology changes in the attached network are minimized by (when
possible) using the connectivity between the node in the same
network.
Slide 5
May, 2008
Reminder and definitions
• The protection mechanism provides local protection of
Ethernet services (VLANs) between network boundaries.
TG
TG
TG
Interconnected
Zone
TG
Interconnected
Zone
TG
TG
Interconnected
Zone
Interconnected
Zone
TG
TG
Example route
• The nodes, ports, and links connecting the adjacent networks
are referred to as the interconnected zone.
• The node in each of the networks which at any given moment
conveys traffic from the network to the interconnected zone,
as well as from the interconnected zone to the network, is
referred to as the traffic gateway (TG).
Slide 6
May, 2008
Requirements
• Protect against any single failure or degradation of a facility
(link or node) in the interconnected zone
• Support all standard Ethernet frames: 802.1D, 802.1Q,
802.1ad, 802.1ah
• Support interconnection between different network types
(e.g. CN-PBN, PBN-PBN, PBN-PBBN, PBBN-PBBN, etc.)
• Provide 50ms protection switching
• Provide a clear indication of the protection state
• Maintain an agnostic approach regarding
– the Ethernet technology running on each of the interconnected
networks, and
– the protection mechanism deployed by each of the interconnected
networks
Slide 7
May, 2008
Requirements (cont’d.)
• Avoid modification of the protocols running inside each of the
interconnected networks
• Ensure that multicast and broadcast frames are delivered
only once over the interconnected zone
• Allow load-balancing between the interfaces that connect the
networks to ensure efficient utilization of resources
• Minimize the effects of protection events within the
interconnected zone on the topology of the related attached
networks, reducing them to the level of unavoidable effects
Slide 8
May, 2008
Solution Principles
Failure effects
• When a traffic gateway node fails, changes in the attached
network (to which the node belongs) are inevitable.
• A new node becomes the traffic gateway replacing the failed
traffic gateway.
Slide 9
May, 2008
Solution Principles
Failure effects
• When a link between traffic gateway nodes fails, a bypass
route may (when possible) be established between the nodes
to prevent changes in the attached network (replacing the
failed link, while keeping the traffic gateways).
Slide 10 May, 2008
Solution Principles
Node roles
• For each protected VLAN, a node in one network is
connected to the nodes in the other network. This node,
referred to as the master, is responsible for selecting the link
over which the traffic will be conveyed between the networks.
• The master is connected to two nodes in the adjacent
network. These two nodes follow the master’s decisions and
are referred to as slaves.
M
S
S
Slide 11 May, 2008
Solution Principles
Node roles (cont’d)
• The master can be protected by a redundant node which may
replace the master as the decision-making node. This node is
referred to as the deputy. The deputy is connected to the
same two slaves as the master.
SD M
S SD
SM D
S SM
The role of each node
(master, deputy, and slave)
is set for each VLAN by
administrative configuration.
The same node may function as a master node for some VLANs (blue), as a
deputy node for other VLANs (red), and as a slave for other VLANs (green),
thus enabling load-sharing between the nodes.
• The master and deputy are referred to as control nodes.
Slide 12 May, 2008
Solution Principles
Port configurations
In the control nodes, one of the ports connecting the networks
is configured as working, the other as protection.
• The working port is the preferred port (administratively enabled) for
conveying traffic in the absence of other considerations.
(A consideration that precedes port configuration is the preservation of
the traffic gateway.)
• The slaves have no configurations on these ports.
Master
Slave1
W
P
W
P
Deputy
Slide 13 May, 2008
Slave2
Solution Principles
Additional (optional) connectivity
The nodes on the same network may also be connected:
• Slave nodes - provide a means to bypass a failed link without
changing the traffic gateway.
• Control nodes (master and deputy) provide direct health monitoring
between the control nodes.
Slide 14 May, 2008
Master
Slave1
Deputy
Slave2
Solution Principles
Additional port configuration
The ports connecting the control nodes to each other are
configured as internal. This also applies to the ports
connecting the slave nodes to each other. Internal ports are
optional.
• An internal port may be configured on all node types (master, deputy, and
slave).
• The state “absent” is used when there is no internal port. (This state
distinguishes the configuration from that in which an existing internal link
failed. In both cases, the port does not receive a message form its peer.)
Master
Slave1
W
I
I
P
I
W
P
I
Deputy
Slide 15 May, 2008
Slave2
Solution Highlights
Master
• The master becomes a traffic gateway:
– Always when it operates in revertive mode
– If the deputy is not already a traffic gateway in non-revertive mode
• The master chooses the port for conveying traffic according
to:
– Existence of a traffic gateway amongst the slaves
– Port configuration and link states (in the absence of a traffic gateway)
Master
Slave1
W
I
I
P
I
W
P
I
Deputy
Slide 16 May, 2008
Slave2
Solution Principles
Slaves
A slave that receives a request to become a traffic gateway
from a control node will:
– become a traffic gateway:
▪ when there is an internal link, and the other slave is not a traffic gateway
▪ when the internal link is absent
– become an intermediate node in a bypass that redirects traffic to the
other slave
▪ when there is an internal link, and the other slave is a traffic gateway
Master
Slave1
W
I
I
P
I
W
P
I
Deputy
Slide 17 May, 2008
Slave2
The master behaves
in the same way.
The slave decides
whether or not to
form a bypass.
Solution Highlights
Deputy
• The deputy becomes a traffic gateway:
– immediately, when it looses connectivity with the master (when the control
nodes are connected)
– when there is no traffic gateway amongst the slaves for a predetermined
period of time (which indicates that there is no traffic gateway amongst the
control nodes) and the control nodes are not connected
• The deputy chooses the port to convey traffic according to:
– the existence of a traffic gateway amongst the slaves
– port configuration and link states (in the absence of a traffic gateway)
Master
Slave1
W
I
I
Slave1
W
P
I
P
W
P
I
W
P
Deputy
Slide 18 May, 2008
Master
Slave2
Deputy
Slave2
Solution principles
Revertive modes
Revertive mode is supported by the control nodes at 2 levels:
port level and node level
• Port-level revertive mode
Traffic is restored to the
configured working port.
Note: Port revertive may have an effect
on the attached networks - TG changed.
• Node-level revertive mode
Traffic is restored to the master
after it recovers from a failure.
Note: Node revertive may have an effect
on the attached networks - TG changed.
Slide 19 May, 2008
M
W
P1
P
P2
S
1
I
I
I
I
D
W
P1
P
P2
M
W
P1
P
P2
S
2
S
1
I
I
I
I
D
W
P1
P
P2
S
2
Transition table
Facility failure
State
M
M
S1
D
S2
S1
D
S2
M-S1
S1-S2
D-S2
M-D
M-S2
D-S1
M
Link
recovers
recovers
Node
revertive
mode
Link
revertive
mode
M
D
M-S1
D-S1
M-S2
-
-
M-S2-S1
-
-
-
-
-
-
-
D-S1
-
D-S2
-
-
M-S2
D-S1
-
-
D-S1-S2
-
-
-
M-S2
D-S1
-
M-S1
M-S2
D-S2
-
-
M-S1
-
-
-
-
M-S1-S2
-
-
M-S1
D-S1
-
D-S1
-
D-S2
M-S1
-
-
-
-
-
-
D-S2-S1
M-S1
-
-
M-S1
M-S2-S1
D-S1
M-S2
-
M-S1
-
M-S1
-
-
M-S1
-
-
M-S1
D-S1
-
M-S1-S2
D-S2
M-S2
-
M-S1
M-S2
M-S2
-
-
-
-
-
-
D-S1
-
D-S1-S2
-
D-S2
M-S2
D-S1
-
D-S2
-
-
-
D-S2
M-S2
-
-
M-S1
D-S2-S1
-
D-S2
M-S1
D-S1
-
D-S1
D-S1
-
-
-
M-S1
D-S1
-
M-S1
Note 1: A bypass to a failed link always goes through a slave (never through a control node).
Note 2: The last two columns are for constructs that only have five links. (The control nodes are not
connected.)
Note 3: The scenario in which there are only four links can be reached, when applicable, by
removing the S1 S2 connectivity.
Slide 20 May, 2008
State machine
• Each node retains its own state (TG or not) and the states
(active/standby) of its ports (P1, P2, and I) which are part of
the interconnected zone.
• The node is updated on the state of the peer ports and the
nodes connected to it via information received over the links
connected to the other nodes.
• Each node may change its own state and the state of its ports
according to the configuration, the state of the node and the
ports, and according to the information received.
S
P1
S S
M
P2
A A
I
S S
S
Slide 21 May, 2008
S S
D
Selected Scenarios
Slide 22
Start Up
Master
Entity Local
Remote
node
C
u Node Standby
r
W Standby
r
e
P
Standby
n
t
I
Standby
N
e
w
port
S
The master changes its state
The slave receives a request on P1
to active, becomes a traffic
to become a traffic gateway. It
The master
receivesthe
an indication
gateway,
and chooses
changes its state to active to
from
the
slave
that
it
became
a
Beginning
working port to convey
become
a traffic gateway, and
trafficItgateway
using
P1. Itstart when all nodes
Theport
scenario
traffic.
creates new
chooses the port on which the
does
not
change
its
state
or
the
are
started
for
the
first
time;
no
messages and sends them
request arrived (P1) for conveying
messages
sendstraffic
over its
is ports.
conveyed. The nodes start
over theitports
traffic. It creates new messages
with all ports in standby; none acts
and sends them over its ports.
as a traffic gateway.
S
S
M
S
S
S
Node
Active
W
Active
S
A
S
A
P
Standby
S
S
I
Standby
S
S
W
P
Remote
node
C
u Node Standby
r
W Standby
r
e
P
Standby
n
t
I
Standby
port
S
S
S
S
S
A
S S
S
1
Entity Local
A
S S
N
e
w
End
The mater and Slave 1 are traffic
gateways; they use the link
connecting the working port of
the master and P1 of Slave1.
The deputy and Slave 2 are aware
of the situation. They do not
convey traffic.
S
D
P
S S
W
P
I
Slide 23 May, 2008
S
S
S
Active
A
A
P2
Standby
S
S
I
Standby
S
S
S S
S S
I
P1
P2
S
2
Node
The deputy receives an indication
from the master that it is a traffic
gateway plus an indication from the
slave on the working port that it is
also a traffic gateway. The deputy
does not change its state and the
messages it sends over its ports.
S
Active
The slave receives an indication from the
master that it is a traffic gateway but does
not receive a request to become a traffic
gateway. It also receives an indication from
the other slave that it too is a traffic
gateway. The slave does not change its
state and the messages it sends over its
ports.
Local
C
u Node Standby
r
P1 Standby
r
e
P2 Standby
n
t
I
Standby
Node
N
e
w
S
A
P1
Entity
S S
W
S
A
Slave 2
S
S S
Remote
node port
C
u Node Standby
r
P1 Standby
r
e
P2 Standby
n
t
I
Standby
Node
I
A
S S
I
A
S
P2
A
S S
I
Deputy
Entity Local
A
A
S S
A
A
S S
P1
Slave 1
N
e
w
P1
P2
I
Remote
node
port
A
S
S
S
S
A
S
S
Link fails
Master
Entity
Local
Remote
node
C
u Node Active
r
W
Active
r
e
Standby
P
n
t
I
Standby
N
e
w
port
A
The link connecting the master and
The master does not receive
Slave 1 failed.
The slave that acts as a traffic
health messages from Slave 1
gateway loses connectivity with
and realizes that it lost
the master. After a short while, it
Beginning
connectivity with it. It chooses
receives a request over the
The scenario starts with traffic
the protection port to convey
internal port indicating that the
being
conveyed
between
the
traffic.
other slave is using it as a bypass.
master and Slave 1 using the
It activates the internal port.
working port of the master and P1
of the slave.
A
S
M
S
S
S
Node
Active
W
Standby
P
Active
S
S
I
Standby
S
S
W
S S
A A
A
A S
P
P2
A A
S
I
P1
A S
S
1
I
A
A S
S
A A
S
Slave 1
Entity
C
u Node Active
r
P1
Active
r
e
P2 Standby
n
t
I
Standby
N
e
w
End
The master and Slave 1 are
traffic gateways. Slave 2 is used
as an intermediate node in a
bypass created between the
master and Slave 1.
Local
Remote
port
port
A
A
S
S
S
S
A
Active
P1
Standby
P2
Standby
S
S
I
Active
S
A
Entity
S
S
SS SA
I
A
S
S
S
A
S
Node
N
e
w
node
Slave 2
node
C
u Node Standby
r
W Standby
r
e
P
Standby
n
t
I
Standby
Remote
Node
Deputy
Entity
Local
W
P
I
Slide 24 May, 2008
D
W
P
S S
S S
S S
A
S S
I
P1
P2
S
2
Local
C
u Node Standby
r
P1 Standby
r
e
P2 Standby
n
t
I
Standby
Remote
node
Port
port
A
S
A
S
S
A
S
Node Standby
The slave receives a request on P1 to become a traffic
gateway. It is aware of the fact that the slave connected
through the internal port is a traffic gateway. It activates
the internal port but does not become a traffic gateway. It
will pass all packets received on P1 to the internal port.
Packets received from the attached network will be
dropped. It creates new messages and sends them over its
ports.
N
e
w
P1
Active
A
A
P2
Standby
S
S
I
Active
S
S
Slave fails
Master
Entity
Local
Remote
node
C
u Node Active
r
W
Active
r
e
Standby
P
n
t
I
Standby
N
e
w
port
A
The slave acting as the TG of this
The master does not receive
network fails.
health messages from Slave 1
The realizes
master receives
an indication
and
that it lost
Beginning
from the
slave
it became
a
connectivity
with
it. that
It chooses
Theport
scenario
traffic gateway
using
P2. Itstarts with traffic
the protection
port to
convey
between the
does not
change itsbeing
state conveyed
or the
traffic.
master
and Slave 1 using the
messages it sends over
its ports.
working port of the master and
P1 of the slave.
A
S
M
S
S
S
Node
Active
W
Standby
P
Active
S
S
I
Standby
S
S
W
Local
node
C
u Node Standby
r
W Standby
r
e
P
Standby
n
t
I
Standby
port
S
S
S
A
S
A S
S
1
Entity
C
u Node Active
r
P1
Active
r
e
P2 Standby
n
t
I
Standby
A S
N
e
w
D
P
S S
W
P
I
Slide 25 May, 2008
The deputy receives an indication
from the master that it is a traffic
gateway as well as an indication from
the slave on the protection port that it
too is a traffic gateway. The deputy is
aware that it is not connected to Slave
1. It does not change its state and the
messages it sends over its ports.
A
A
S
S
S
S
P2
S S
A
A
S S
A
I
P1
P2
S
2
C
u Node Standby
r
P1 Standby
r
e
P2 Standby
n
t
I
Standby
Node
N
e
w
port
P1
Entity Local
SAS S
W
node
Slave 2
S
S S
Remote
I
End
The master and Slave 2 act as
traffic gateways using the link
connecting the protection port of
the master and P1 of Slave 2.
The deputy and Slave 2 are
aware of the situation. They do
not convey traffic.
S
Local
Node
I
A
A S
S
I
A
P1
P2
A A
S
I
Remote
A A
P
Deputy
Entity
S S
A A
Slave 1
The slave receives a request on P1 to
become traffic gateway. It does not have
connectivity with Slave 1, so it change its
state to active to become a traffic
gateway, and chooses the port on which
the request arrived (P1) to convey traffic.
It creates new messages and sends them
over its ports.
N
e
w
Remote
node
port
A
S
A
S
S
A
S
Node
Active
P1
Active
A
A
P2
Standby
S
S
I
Standby
S
S
Master fails
Master
Entity Local
Remote
node
C
u Node Active
r
Active
W
r
e
Standby
P
n
t
Standby
I
port
A
A
S
S
S
S
Node
N
e
w
Slave 1 senses that it lost
connectivity with the master and it
receives a request to become a
The master acting as the TG of Beginning
this
traffic gateway on P2. Since it is
network fails.
The scenario starts with traffic
a traffic gateway, it only
being conveyed betweenalready
the
needs
master and Slave 1 using
the to deactivate P1 and activate
creates new messages and
working port of the master P2.
andIt
P1
sends them over its ports.
of Slave 1.
M
W
A S
A
P
P2
A S
I
W
A A
P1
A A
S
1
I
A S
P
S
A S
I
Slave 1
Entity
C
u Node Active
r
P1
Active
r
e
P2 Standby
n
t
I
Standby
N
e
w
End
The deputy is a traffic gateway
and conveys traffic using its
working port. Slave 1 is a traffic
gateway of the attached network
and it conveys traffic using P2.
Node
N
e
w
node
port
A
A
S
S
S
S
Active
P1
Standby
P2
Standby
A
A
I
Standby
A
S
Slave 2
Remote
node
C
u Node Standby
r
W Standby
r
e
P
Standby
n
t
I
Standby
Remote
Node
Deputy
Entity Local
Local
port
S
A S
S S
I
A
S
S
S
A
S
D
Entity
W
P
A S
A
S
A S
S
S S
S S
I
P1
P2
S
2
C
u Node Standby
r
P1 Standby
r
e
P2 Standby
n
t
I
Standby
Active
Node
W
Active
A
S
P
Standby
S
S
I
Standby
Slide 26 May, 2008
The deputy senses that the master
failed. It becomes a traffic gateway
and uses the port that is connected to a
slave which is a traffic gateway (if
there is such). It creates new
messages and send them over its
ports.
Local
N
e
w
P1
P2
I
Remote
node
port
A
S
S
S
A
S
Proposal
Start a new project in the IEEE 802.1 aimed at
defining a protection mechanism for Ethernet
services in UNI/E-NNI (interconnected networks).
• Adopt the proposed topologies.
• The mechanism should comply with the requirements
introduced in this presentation.
Slide 27 May, 2008
Thank you
zehavit.alon@nsn.com
nurit.sprecher@nsn.com
Slide 28
Backup
Slide 29
Flow
Chart
M
S1 M failed
S1 failed
M-S2-S1
D
S2
S2 failed
D failed
M-S2 failed ||
S1-S2 failed ||
S2 failed
M
D
S1
D-S1-S2
S2
D-S1 failed ||
S1-S2 failed ||
S1 failed
M1-S1 failed
M
S1
M-S1
D
D-S2 failed
M
S2
S1
D-S2
D
S2
M failed
D failed
S2 failed ||
LRM && S1 recovered
S1 failed
LRM && M-S1 recovered ||
S2 failed
M
D
S1
M-S2
NRM && M recovered ||
D failed
M
S2
D
M-S2 failed
M-S1 failed ||
S1-S2 failed ||
S1 failed
M
S1
D-S1
S2
D-S1 failed
S1
M
S2
D
S1
S2 failed
D
M-S1-S2
S1 failed
M failed
D failed
Slide 30 May, 2008
M failed
D-S2-S1
S1-S2 failed ||
D-S2 failed ||
S2 failed
S1 failed
S2