LISP – A Next-Generation Networking Architecture BRKRST-3045 Darrel Lewis, Technical Lead LISP darlewis@cisco.com LISP - A Next Generation Routing Architecture • AGENDA LISP Overview LISP Operations LISP Deployment Examples LISP Status LISP Summary LISP References BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Overview LISP Overview • Original Motivation… • An IP address “overloads” location and identity – Today… “addressing follows topology” – Efficient aggregation is only available for Provider Assigned (PA) addresses – Ingress Traffic Engineering usually requires Provider Independent (PI) addresses and the injection of “more specifics” :: this limits route aggregation compactness – IPv6 does not fix this • Route scaling issues drive system costs higher – Forwarding plane (FIB) requires expensive memory – Route scaling “drivers” are also seen in Data Centers and for Mobility :: not just the Internet DFZ BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public “… routing scalability is the most important problem facing the Internet today and must be solved … ” Internet Architecture Board (IAB) October 2006 Workshop (written as RFC 4984) 5 LISP Overview • Identity and Location :: an Overloaded Concept in Routing Today… DFZ Routing Table Site 1 Enterprise eBGP 64.1.0.0/17 64.1.0.0/16 12.0/8 AS 200 12. 0/8 64.1.0.0/17 Tier 1 SP 64.1.0.0/16 Site 2 AS 100 64.1.0.0/16 12.1.1.2/30 Location Identity 13.0/8 AS 300 13. 0/8 eBGP 64.1.128.0/17 64.1.0.0/16 BRKRST-3045 IPv4 Internet 13.1.1.2/30 Commodity SP © 2014 Cisco and/or its affiliates. All rights reserved. 64.1.0.0/16 Site 3 64.1.128.0/17 Transit SP Cisco Public 6 LISP Overview • Identity and Location :: an Overloaded Concept in Routing Today… • Let’s put ID address and Locator address in different databases • Let’s create a “level of indirection” between ID and LOCATION in the network! LISP Mapping System DFZ Site 1 AS 200 12. 0/8 Enterprise Clear Separation at the Network Layer:: •who/what you are looking for vs. … •how to best get thereSite 2 Tier 1 SP AS 100 64.1.0.0/16 12.1.1.2/30 Location Two Approaches:: IPv4 Internet •Translations (e.g. NAT) 13.1.1.2/30 Identity vs. … •Tunnels (e.g. GRE, Site 3 IPsec, MPLS) AS 300 13. 0/8 Commodity SP Transit SP BRKRST-3045 Routing Table © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public What if Locator/ID Separation worked on a GLOBAL Scope? No need to carry all routing in the Forwarding Plane! 7 LISP Overview • Identity and Location :: an Overloaded Concept in Routing Today… • Let’s scale the ID address databases to 1010 and allow it to hold any prefix length (e.g. /32) • Let’s provide a mechanism to provide on-the-fly resolution of ID and locator • High scale design, and ability Enterprise to change locator for fixed ID enables Mobility! LISP Mapping System DFZ Routing Table Site 1 AS 200 12. 0/8 Tier 1 SP Site 2 AS 100 64.1.0.0/16 12.1.1.2/30 Location IPv4 Internet 13.1.1.2/30 Identity AS 300 13. 0/8 Site 3 Commodity SP Transit SP BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 LISP Overview • LISP :: A Routing Architecture – Not a Feature LISP changes the routing architecture to implement a level of indirection between a hosts IDENTITY and its LOCATION in the network LISP changes the current ROUTING Architecture • Changes lead to DISRUPTION • Disruption leads to OPPORTUNITIES • LISP allows both SPs and Enterprises to do remarkably different things than allowed by traditional approaches • LISP enables NEW services (VPNs, IPv6, Mobility, “cloud”) in one, common, simple architecture BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 LISP Overview • LISP :: A Routing Architecture – Not a Feature Uses pull vs. push routing LISP use-cases are complimentary ‒ OSPF and BGP are push models; routing stored in the forwarding plane ‒ Simplified multi-homing with Ingress traffic Engineering; no need for BGP ‒ LISP is a pull model; Analogous to DNS; massively scalable ‒ Address Family agnostic support An over-the-top technology ‒ End-host mobility without renumbering ‒ Address Family agnostic Enables IP Number Portability ‒ Incrementally deployable ‒ End systems can be unaware of LISP Deployment simplicity ‒ No DNS changes; “name == EID” binding An Open Standard ‒ Minimal CPE changes ‒ Some new core infrastructure components © 2014 Cisco and/or its affiliates. All rights reserved. ‒ Never change host IP’s; No renumbering costs ‒ Session survivability ‒ No host changes BRKRST-3045 ‒ Virtualization support Cisco Public ‒ Being developed in the IETF ‒ No Cisco Intellectual Property Rights on Protocol 10 LISP Operations LISP Operations • Main attributes of LISP EID-to-RLOC mapping LISP namespaces EID Space ‒ EID (Endpoint Identifier) is the IP address of a host – just as it is today xTR Non-LISP Prefix w.x.y.1 x.y.w.2 z.q.r.5 z.q.r.5 Next-hop e.f.g.h e.f.g.h e.f.g.h e.f.g.h PxTR RLOC Space xTR Network-based solution Address Family agnostic No host changes Incrementally deployable (support LISP and non-LISP) Minimal configuration No DNS changes BRKRST-3045 RLOC w.x.y.1 x.y.w.2 z.q.r.5 z.q.r.5 MS/MR ‒ RLOC (Routing Locator) is the IP address of the LISP router for the host ‒ EID-to-RLOC mapping is the distributed architecture that maps EIDs to RLOCs EID a.a.a.0/24 b.b.b.0/24 c.c.c.0/24 d.d.0.0/16 xTR EID Space Support for mobility © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 LISP Operations • LISP :: Mapping Resolution “Level of Indirection” DNS analog LISP “Level of Indirection” is analogous to a DNS lookup ‒ DNS resolves IP addresses for URL Answering the “WHO IS” question [ who is lisp.cisco.com ] ? DNS Server host DNS Name-to-IP URL Resolution [153.16.5.29, 2610:D0:110C:1::3 ] ‒ LISP resolves locators for queried identities Answering the “WHERE IS” question [ where is 2610:D0:110C:1::3 ] ? LISP LISP Mapping router System [ locator is 128.107.81.169, 128.107.81.170 ] BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Identity-to-locator Mapping Resolution 13 LISP Operations • LISP IPv4 EID / IPv4 RLOC Data Packet Header Example IPv4 Outer Header: ITR supplies RLOCs UDP Header: LISP Header: IPv4 Inner Header: Host supplies EIDs BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 LISP Operations • LISP Encapsulation Combinations – IPv4 and IPv6 Supported IPv4 Outer Header IPv4 Outer Header UDP LISP UDP LISP IPv4 Inner Header IPv4/IPv4 IPv6 Inner Header IPv6 Outer Header IPv6 Outer Header UDP LISP UDP LISP IPv4 Inner Header IPv4/IPv6 IPv6/IPv4 Q: Doesn’t encapsulation cause MTU issues? IPv6 Inner Header IPv6/IPv6 A: It can… But preparation limits issues… ‒ Encapsulation overhead is 36B IPv4 and 56B IPv6 ‒ LISP supports “stateful” (PMTUD) and “stateless” (fragmentation) options ‒ Tunnel/MTU issues are well known (GRE, IPsec, etc.) and are usually operationally tractable BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 LISP Operations • LISP Data Plane :: Ingress/Egress Tunnel Router (xTR) ETR – Egress Tunnel Router ‒ Receives packets from core-facing interfaces ‒ De-cap and deliver packets to local EIDs at site ETR ITR PI EID-prefix 2001:db8:1::/48 Provider C 12.0.0.0/8 xTR-1 ITR ETR ITR xTR-3 packet flow packet flow ETR S Provider A 10.0.0.0/8 Provider B 11.0.0.0/8 Provider D 13.0.0.0/8 xTR-2 PI EID-prefix 2001:db8:2::/48 ETR ITR xTR-4 Site 1 Router ITR –LISP Ingress Tunnel LISP Site 2 D ‒ Receives packets from site-facing interfaces ‒ Encap to remote LISP sites, or native-fwd to non-LISP sites BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 LISP Operations • LISP Data Plane :: Unicast Packet Flow Map-Cache Entry EID-prefix: 2001:db8:2::/48 Locator-set: 12.0.0.2, priority: 1, weight: 50 13.0.0.2, priority: 1, weight: 50 This policy controlled by the destination site 7 2001:db8:1::1 -> 2001:db8:2::1 ETR ITR PI EID-prefix 2001:db8:1::/48 3 LISP Site 1 xTR-3 11.0.0.2 -> 12.0.0.2 packet flow 2001:db8:1::1 -> 2001:db8:2::1 packet flow Provider B 11.0.0.0/8 ITR xTR-2 Provider D 13.0.0.0/8 BRKRST-3045 PI EID-prefix 2001:db8:2::/48 ETR ITR xTR-4 LISP Site 2 D 11.0.0.2 -> 12.0.0.2 1 DNS entry: D.abc.com AAAA 6 13.0.0.2 11.0.0.2 2001:db8:1::1 -> 2001:db8:2::1 2 ITR 12.0.0.2 5 xTR-1 ETR Provider C 12.0.0.0/8 10.0.0.2 ETR S Provider A 10.0.0.0/8 2001:db8:1::1 -> 2001:db8:2::1 2001:db8:2::1 © 2014 Cisco and/or its affiliates. All rights reserved. 4 Cisco Public 17 LISP Operations • LISP Data Plane :: Ingress/Egress Tunnel Router (xTR) ! router lisp Identical configs on both xTRs! locator-set SITE2 12.0.0.2 priority 1 weight 50 13.0.0.2 priority 1 weight 50 exit ! ETR eid-table default instance-id 0 Provider A ETR Provider C database-mapping 2001:db8:2::/48 locator-set SITE212.0.0.0/8 10.0.0.0/8 ITR ITR 10.0.0.2 exit 12.0.0.2 PI EID-prefix PI EID-prefix xTR-1 xTR-3 ! 2001:db8:2::/48 2001:db8:1::/48 packet flow packet flow ipv6 itr map-resolver 66.2.2.2 ipv6 itr ETR ETR ipv6 etr map-server 66.2.2.2 key S3cr3t-2 Provider B Provider D ITR ITR ipv6 etr 11.0.0.0/8 13.0.0.0/8 13.0.0.2 xTR-4 exit xTR-2 11.0.0.2 ! LISP Site 1 LISP Site 2 ip route 0.0.0.0 0.0.0.0 12.0.0.1 (or 13.0.0.1) ! S BRKRST-3045 D © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 LISP Operations • LISP Control Plane :: Introduction LISP Control Plane Provides On-Demand Mappings ‒ Control Plane is separate from the Data Plane (UDP 4342 vs UDP 4341) ‒ Map-Resolver and Map-Server (similar to DNS Resolver and DNS Server) ‒ LISP Control Plane Messages for EID-to-RLOC resolution ‒ Distributed databases and map-caches hold mappings BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 LISP Operations • LISP Control Plane :: Map-Server/Map-Resolver (MS/MR) Mapping System MR ETR ITR PI EID-prefix 2001:db8:1::/48 MR – Map-Resolver Provider A 10.0.0.0/8 Provider B 11.0.0.0/8 ‒SForwards Map-Request to Mapping System LISP Site 1 11.0.0.2 ‒ Sends Negative Map-Replies in response to Map-Requests for non-LISP sites © 2014 Cisco and/or its affiliates. All rights reserved. xTR-3 packet flow packet flow xTR-2 ITR 12.0.0.2 xTR-1 ETR ETR Provider C 12.0.0.0/8 10.0.0.2 ITRfrom ITR ‒ Receives Map-Request BRKRST-3045 MS Cisco Public MS – Map-Server Provider D ‒ 13.0.0.0/8 LISP site PI EID-prefix 2001:db8:2::/48 ETR ITR ETRs register their EID prefixes here; 13.0.0.2 xTR-4 requires configured “lisp site” policy, LISP Site 2 D authentication key ‒ Receives Map-Requests via Mapping System, forwards them to registered ETRs 20 LISP Operations • LISP Control Plane :: Map-Server/Map-Resolver (MS/MR) Mapping System LISP Site Mapping-Database (ETR) MR MS ‒ EID-to-RLOC mappings in all ETRs for local LISP site ‒ ETR is “authoritative” for its EIDs, sends Map-Replies to ITRs ‒ ETRs can tailor policy based on Map-Request source ETR ITR PI EID-prefix 2001:db8:1::/48 Provider A 10.0.0.0/8 10.0.0.2 LISPSMap Cache (ITR) LISP Site 1 xTR-2 xTR-3 packet flow packet flow Provider B 11.0.0.0/8 ITR ITR 12.0.0.2 xTR-1 ETR ETR Provider C 12.0.0.0/8 ETR Provider D 13.0.0.0/8 ITR 13.0.0.2 11.0.0.2 PI EID-prefix 2001:db8:2::/48 xTR-4 ‒ Only stores mappings for sites the ITR is currently sending packets to LISP Site 2 D ‒ Populated by receiving Map-Replies from ETRs ‒ ITRs must respect Map-Reply policy (TTLs, RLOC up/down status, RLOC priorities/weights BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 LISP Operations • LISP Control Plane :: Control Plane Messages Control Plane Control Plane EID Registration ‒ Map-Register message Sent by ETR to Map-Server to register its associated EID prefixes • Specifies RLOC(s) to be used by the MS when forwarding Map-Requests to the ETR Control Plane “Data-triggered” mapping services ‒ Map-Reply message ‒ Map-Request message Sent by an ETR to an ITR Sent by an ITR to Map-Resolver to • learn an EID/RLOC mapping • test an RLOC for reachability • refresh a mapping before TTL expiration • respond to a Solicit Map-Request (SMR) • as a Solicit Map-Request (SMR) to signal site change © 2014 Cisco and/or its affiliates. All rights reserved. ‒ Map-Notify message Sent by Map-Server to an ETR to Sent by an ETR (with “S” bit set) BRKRST-3045 • in response to valid map-request to provide EID/RLOC mapping and site ingress policy for the requested EID Cisco Public • acknowledge successful registration of an EDI prefix 22 LISP Operations Other sites… • LISP Control Plane :: Map-Register 12.0.0.2 -> 66.2.2.2 LISP Map-Register (udp 4342) SHA2 HMAC 2001:db8:2::/48 12.0.0.2, 13.0.0.2 Mapping System MR MS 66.2.2.2 ETR ITR PI EID-prefix 2001:db8:1::/48 Provider A 10.0.0.0/8 Provider B 11.0.0.0/8 ITR S LISP Site 1 xTR-2 ITR 12.0.0.2 xTR-1 xTR-3 PI EID-prefix 2001:db8:2::/48 ETR Provider D 13.0.0.0/8 ITR 13.0.0.2 11.0.0.2 1 ETR Provider C 12.0.0.0/8 10.0.0.2 ETR 2 xTR-4 LISP Site 2 12.0.0.2 -> 66.2.2.2 D 1 LISP Map-Register ... BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 LISP Operations 3 11.0.0.2 -> 66.2.2.2 Mapping LISP ECMSystem (udp 4342) MR Is 2001:db8:2::1 a LISP Destination? ETR ITR PI EID-prefix 2001:db8:1::/48 2 Provider B 11.0.0.0/8 BRKRST-3045 Provider D 13.0.0.0/8 11.0.0.2 6 1 DNS entry: D.abc.com AAAA packet flow packet flow xTR-2 Map-Cache Entry EID-prefix: 2001:db8:2::/48 Locator-set: 2001:db8:2::1 © 2014 Cisco and/or its affiliates. All rights reserved. ITR 12.0.0.2 xTR-1 2001:db8:1::1 -> 2001:db8:2::1 ETR Provider C 12.0.0.0/8 10.0.0.2 ITR LISP Site 1 66.2.2.2 Provider A 10.0.0.0/8 ETR S 11.0.0.2 / 2001:db8:2::1 Map-Request (udp 4342) nonce MS 11.0.0.2 / 2001:db8:2::1 Map-Request (udp 4342) nonce 66.2.2.2 -> 12.0.0.2 LISP ECM (udp 4342) 4 • LISP Control Plane :: Map-Request/Map-Reply xTR-3 PI EID-prefix 2001:db8:2::/48 12.0.0.2 ETR ->11.0.0.2 Map-Reply ITR (udp 4342) 13.0.0.2 xTR-4 nonce / TTL 2001:db8:2::/48 12.0.0.2 [1, 50] 13.0.0.2 [1, 50] 5 LISP Site 2 D 12.0.0.2, priority: 1, weight: 50 13.0.0.2, priority: 1, weight: 50 Cisco Public 24 LISP Operations • LISP Control Plane :: Map-Request/Proxy-Map-Reply 2 MR ETR ITR LISP Site 1 PI EID-prefix packet66.2.2.2 flow ->11.0.0.22001:db8:2::/48 packet flow xTR-2 Provider B 11.0.0.0/8 Provider D 13.0.0.0/8 11.0.0.2 4 ITR 12.0.0.2 xTR-1 ITR ETR Provider C 12.0.0.0/8 10.0.0.2 ETR S 66.2.2.2 Provider A 10.0.0.0/8 1 LISP Map-Register (udp 4342) SHA2 HMAC Proxy-Bit Set 2001:db8:2::/48 12.0.0.2, 13.0.0.2 MS 11.0.0.2 / 2001:db8:2::1 Map-Request (udp 4342) nonce PI EID-prefix 2001:db8:1::/48 12.0.0.2 -> 66.2.2.2 11.0.0.2 -> 66.2.2.2 Mapping LISP ECMSystem (udp 4342) Map-Cache Entry xTR-3 Map-Reply (udpETR 4342) nonceITR / TTL 2001:db8:2::/48 13.0.0.2 xTR-4 12.0.0.2 [1, 50] 13.0.0.2 [1, 50] 3 LISP Site 2 D EID-prefix: 2001:db8:2::/48 Locator-set: 12.0.0.2, priority: 1, weight: 50 13.0.0.2, priority: 1, weight: 50 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 LISP Operations Notes: • LISP Control Plane :: Map-Request/Negative-Map-Reply ‒ When an ITR queries for a destination that is 2 not in the Mapping System, the Map-Resolver returns an NMR. 11.0.0.2 -> 66.2.2.2 Mapping LISP ECMSystem (udp 4342) MR Is 2001:db7:1::1 a LISP Destination? ITR PI EID-prefix 2001:db8:1::/48 10.0.0.2 xTR-1 packet flow Provider B 11.0.0.0/8 ITR LISP Site 1 66.2.2.2 Provider A 10.0.0.0/8 ETR S MS 11.0.0.2 / 2001:db7:1::1 Map-Request (udp 4342) nonce ETR xTR-2 ‒ A TTL of 1-minute or 15-minutes is set depending on the space covered by the NMR. Provider C 12.0.0.0/8 ETR 13.0.0.0/8 ITR ITR 12.0.0.2 66.2.2.2 -> 11.0.0.2 PI EID-prefix xTR-3 Negative-Map-Reply 3 2001:db8:2::/48 packet flow (udp 4342) nonce / TTL ETR 2001:8000::/21 Provider D 11.0.0.2 2001:db8:1::1 -> 2001:db7:1::1 1 4 Map-Cache Entry EID-prefix: 2001:8000::/21 forward-native BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public NOTE: 13.0.0.2 xTR-4 The actual “covering prefix” returned in an NMR depends on the number and distribution of EID prefixes in the Mapping System. The NMR prefix will cover the shortest prefix that doesn’t cover any LISP Sites in the Mapping System LISP Site 2 D 26 LISP Operations • LISP Control Plane :: MS/MR Configuration example Mapping System MR MS 66.2.2.2 ! ETR Provider A router lisp 10.0.0.0/8 ITR site ALL 10.0.0.2 authentication-key ******* PI EID-prefix xTR-1 eid-prefix 2001:db8::/32 accept-more-specifics 2001:db8:1::/48 packet flow exit ! ETR ipv6 map-server Provider B ITR ipv6 map-resolver 11.0.0.0/8 exit 11.0.0.2 xTR-2 Alternative ! S LISP Site 1 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public Provider C 12.0.0.0/8 12.0.0.2 ! router lisp site Site-1 authentication-key S3cr3t-1 eid-prefix 2001:db8:1::/48 exit ! site Site-2 authentication-key S3cr3t-2 eid-prefix 2001:db8:2::/48 exit ! !-:: more LISP site configs ! ipv6 map-server ETR ipv6 map-resolver exit ITR ! PI EID-prefix xTR-3 2001:db8:2::/48 packet flow ETR Provider D 13.0.0.0/8 ITR 13.0.0.2 xTR-4 LISP Site 2 D 27 LISP Operations The LISP Beta Network uses DDT today… • LISP Control Plane :: Mapping-System Scaling LISP Delegated Database Tree ddt-root ddt-tld Scaling the LISP Mapping System ‒ Deploy multiple “stand-alone” Map-Servers” and register each LISP Site to all of them (up to eight) ‒ Deploy Map-Resolvers in an “Anycast” manner ‒ Or, deploy a “hierarchical” Mapping System - DDT MR MR MS MS DDT – Delegated Distributed Tree ‒ Hierarchy for Instance IDs and for EID Prefixes xTRs xTRs PxTRs MS/MRs PxTRs xTRs BRKRST-3045 xTRs ‒ DDT Nodes Return Map-Referral messages xTRs MS/MRs DDT MS/MRs xTRs xTRs MS/MRs xTRs MS/MRs ‒ DDT Map-Resolvers sends (ECM) Map-Requests xTRs DDT DDT DDT MS/MRs xTRs xTRs ‒ DDT Resolvers resolve the Map-Server’s RLOC iteratively xTRs ‒ Conceptually, similar to DNS (IN-ADDR hierarchy) but different prefix encoding, messages, etc. MS/MRs MS/MRs xTRs PxTRs xTRs © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 LISP Operations • LISP Internetworking :: Day-One Incremental Deployment Early Recognition ‒ Up-front recognition of an incremental deployment plan ‒ LISP will not be widely deployed day-one Interworking for: ‒ LISP-sites to non-LISP sites (e.g. the rest of the Internet) ‒ non-LISP sites to LISP-sites Proxy-ITR/Proxy-ETR are deployed today ‒ Infrastructure LISP network entity ‒ Creates a monetized service opportunity for infrastructure players BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 LISP Operations • LISP Internetworking :: Day-One Incremental Deployment Mapping System MR MS 66.2.2.2 PITR ETR ITR IPv6 Internet Provider A 10.0.0.0/8 10.0.0.2 PETR Provider C 12.0.0.0/8 ETR ITR 12.0.0.2 PI EID-prefix PI EID-prefix xTR-1 xTR-3 PETR – Proxy ETR 2001:db8:2::/48 2001:db8:1::/48 IPv4 Internet PITR – Proxy ITR ‒ Allows an EID in one AF [IPv4 or IPv6] ETR ETR ‒ Receives traffic from non-LISP Provider sites; B Provider D the opposite and RLOC [IPv6 or IPv4] to ITR ITR 13.0.0.0/8 encapsulates traffic to LISP sites11.0.0.0/8 reach non-LISP prefix in that same AF 13.0.0.2 11.0.0.2 xTR-2 S ‒ Advertises coarse-aggregate (AF-hop-over)xTR-4 EID prefixes LISP Site 1 LISP Site 2 D ‒ Allows LISP sites with uRPF restrictions ‒ LISP sites see ingress TE “day-one” to reach non-LISP sites BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 1 LISP Operations 2001:d:1::1 -> 2001:db8:2::1 • LISP Internetworking :: Day-One Incremental Deployment Mapping System MR Non-LISP v6 Site 2001:d:1::1 MS 66.2.2.2 2001:db8::/32 2001:db8:2::1 -> 2001:d:1::1 2001:f:f::1 2001:f:e::1 PITR ETR ITR PI EID-prefix 2001:db8:1::/48 LISP Site 1 2001:d:1::1 -> 2001:db8:2::1 ETR Provider C 12.0.0.0/8 ITR 12.0.0.2 xTR-1 xTR-3 IPv4 Internet Provider B 11.0.0.0/8 xTR-2 xTR-4 LISP Site 2 12.0.0.2 -> 12.9.2.1 D 2001:db8:2::1 -> 2001:d:1::1 2001:db8:2::1 -> 2001:d:1::1 5 © 2014 Cisco and/or its affiliates. All rights reserved. ITR 13.0.0.2 10.9.1.1 -> 12.0.0.2 2001:d:1::1 -> 2001:db8:2::1 PI EID-prefix 2001:db8:2::/48 ETR Provider D 13.0.0.0/8 11.0.0.2 2 BRKRST-3045 3 PETR 10.0.0.2 ITR S IPv6 Internet Provider A 10.0.0.0/8 ETR 6 Cisco Public ipv4 use-petr 12.1.1.1 4 31 LISP Deployment Examples LISP Operations • Public and Private LISP Deployment Models Private Model • “Private” LISP deployment support single Enterprises or Entities • LISP Enterprise deploys: - xTRs - Mapping System, if required - Proxy System, if required Public Model • “Public” LISP deployment supports the needs of multiple Enterprises • LISP Service Provider deploys “shared” Mapping System and Proxy System • LISP Enterprises subscribe to LISP SP, and deploy their own xTRs Global Examples ddt-root.org Stand-Alone Example LISP SP Private Enterprise Examples Enterprise C Enterprise A LISP SP LISP Ent Enterprise B CCC LISP SP NJEdge.Net PCCC MU CCM VXNet BCC InTouch LISP Beta Princeton LISP Ent BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 33 LISP Deployment Examples • LISP Deployment Examples… 1. Efficient Multihoming and Multi-AF (IPv4 and IPv6) 2. Efficient Virtualization and High-Scale VPNs 3. Data Center/Host Mobility 4. LISP-Mobile Node These examples highlight functionality integrated in LISP. All use-case – multi-homing, v6 transition, virtualization, and mobility work together! BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Deployment Examples • LISP Deployment Examples… 1. Efficient Multihoming and Multi-AF (IPv4 and IPv6) 2. Efficient Virtualization and High-Scale VPNs 3. Data Center/Host Mobility 4. LISP-Mobile Node BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Multihoming and Multi-AF • Inherent support for AF-agnostic operations IPv4 or IPv6 LISP Site RLOC GE0/0/0 10.1.1.2/30 To Enterprise Internal IPv4 or IPv6 Networks egress feature s ingress feature s LISP tx encap LISP 0 LISP rcv decap SP1 IPv4 IPv4 or IPv6 IPv6 2001:db8:e000:2::2 2001:db8:e000:2::1 To IPv4 or IPv6 Core PxTR MR/M RLOC namespace S 10.10.10.10 10.10.10.11 Default xTR-1 IPv4 Internet EIDs 172.16.1.2/24 2001:db8:a:1::2/64 SP2 10.10.30.11 IPv4 xTR-2 10.10.30.10 PxTR MR/M S GE0/0/0 10.2.1.2/30 IPv6 RLOC BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. 2001:db8:f000:2::2 2001:db8:f000:2::1 Cisco Public LISP Multihoming and Multi-AF • Inherent support for AF-agnostic operations LISP Site RLOC GE0/0/0 10.1.1.2/30 PxTR1#show ip lisp map-cache LISP IPv4 Mapping Cache for EID-table default (IID 0), 196 entries ---<skip>--172.16.1.0/24, uptime: 00:01:38, expires: 23:58:25, IPv6 via map-reply, complete Locator Uptime State Pri/Wgt 2001:db8:e000:2::2 2001:db8:e000:2::1 10.1.1.2 00:01:38 up 1/50 10.2.1.2 00:01:38 up 1/50 PxTR MR/M SP1 10.10.10.11 ---<skip>--S 10.10.10.10 IPv4 xTR-1 IPv4 Internet EIDs 172.16.1.2/24 2001:db8:a:1::2/64 SP2 10.10.30.11 IPv4 xTR-2 10.10.30.10 PxTR MR/M S GE0/0/0 10.2.1.2/30 IPv6 RLOC BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. 2001:db8:f000:2::2 2001:db8:f000:2::1 Cisco Public LISP Multihoming and Multi-AF • Inherent support for AF-agnostic operations LISP Site RLOC GE0/0/0 10.1.1.2/30 PxTR1#show ipv6 lisp map-cache LISP IPv6 Mapping Cache for EID-table default (IID 0), 13 entries ---<skip>--2001:DB8:A:1::/64, uptime: 00:01:38, expires: 23:58:25, via map-reply, complete IPv6 Locator Uptime State Pri/Wgt 2001:db8:e000:2::2 2001:db8:e000:2::1 10.1.1.2 00:01:38 up 1/50 10.2.1.2 00:01:38 up 1/50 PxTR MR/M SP1 10.10.10.11 ---<skip>--S 10.10.10.10 IPv4 xTR-1 IPv4 Internet EIDs 172.16.1.2/24 2001:db8:a:1::2/64 SP2 10.10.30.11 IPv4 xTR-2 10.10.30.10 PxTR MR/M S GE0/0/0 10.2.1.2/30 IPv6 RLOC BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. 2001:db8:f000:2::2 2001:db8:f000:2::1 Cisco Public LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF Support Efficient Multihoming Needs: ‒ Site connectivity to multiple providers for resiliency Internet ‒ Low OpEx/CapEx solution for Ingress TE ‒ Rapid IPv6 deployment, minimal disruption LISP Solution: ‒ LISP provides a streamlined solution for handling multiprovider connectivity and policy without BGP complexities LISP routers LISP Site Connecting IPv4 or IPv6 Islands over IPv6 or IPv4 Cores ‒ LISP encapsulation is Address Family agnostic, allowing for IPv6 over an IPv4 core, or IPv4 over an IPv6 core Benefits: ‒ OpEx-friendly multi-homing across different providers IPv6 Transition Support PxTR ‒ Simple policy management ‒ Ingress Traffic Engineering that actually “works” © 2014 Cisco and/or its affiliates. All rights reserved. xTR v6 ‒ No core network changes BRKRST-3045 v4v6 IPv4 Core v6 service ‒ Minimal configuration Cisco Public v6 IPv4 Internet IPv6 Interne t LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example NJEDge.Net PRODUCTION Target Market: • State of New Jersey Educational Entities (k-12, universities, colleges) Customer Site: http://njedge.net Customer Case Study: http://lisp.cisco.com LISP Services: • • • • BGP-free Multihoming IPv6 Internet Access Host Mobility Disaster-Recovery (adding now…) Inter-Departmental VPNs (adding next…) BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example More… v6 Some.. v6 IPv6 Internet Facebook Google Some.. v4 More… v4 IPv4 Internet Constituent Member Topologies… CPE Member 1 Default Route Or BGP Cisco Public CPE BGP CPE Member 3 CPE . . . Member 2 © 2014 Cisco and/or its affiliates. All rights reserved. Commodity SP BGP CPE BRKRST-3045 Tier 1 SP2 Tier 1 SP1 Default Route Transit SP Member N LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example Many more features be added here... Some.. v6can Before LISP… • Configuration complexity… • Uneven multihoming Some.. load shares… They wanted: IPv6 Internet Facebook Google v4 50%/50% They got: 90%/10% ? 80%/20% ? Never 50%/50% Constituent Member Topologies… IPv4 Internet CPE Member 1 Default Route Or BGP BGP CPE © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public CPE BGP CPE Member 3 CPE . . . Member 2 BRKRST-3045 Tier 1 SP2 Tier 1 SP1 Default Route router bgp 100 bgp router-id 172.16.2.1 bgp asnotation dot no bgp default ipv4-unicast bgp log-neighbor-changes neighbor 172.16.2.1 remote-as 300 <== eBGP to SP1 neighbor 172.16.1.2 remote-as 400 <== eBGP to SP2 ! More… address-family ipv4 v6 no synchronization redistribute ospf route-map populate-default neighbor 172.16.1.2 activate neighbor 172.16.1.2 route-map filter-out out neighbor 172.16.1.2 route-map filter-in in neighbor 172.16.1.2 maximum-prefix 450000 90 neighbor 172.16.2.1 activate neighbor 172.16.2.1 route-map filter-out out neighbor 172.16.2.1 route-map filter-in in neighbor 172.16.2.1 maximum-prefix 450000 90 no auto-summary exit-address-family More… ! v4 ip bgp-community new-format ip community-list standard outlist permit 100:123 ! route-map populate-default permit 10 Transit set origin igp SP set community 100:123 ! route-map filter-out permit 10 Commodity match community outlist ! SP route-map filter-in permit 10 match community inlist ! Member N LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example More… v6 Some.. v6 NJEDge.Net LISP Network Constituent Member Topologies… Google Some.. v4 MS/MR router lisp PxTR locator-set Site3 172.16.1.2 priority 1 weight 50 More… 172.16.2.2 priority 1 weight 50 v4 exit ! eid-table default Transit instance-id 0 database-mappingSP 10.1.1.0/24 locator-set Site3 exit ! SP2 Commodity ipv4 itr SP ipv4 etr ipv4 itr map-resolver 172.17.1.1 ipv4 etr map-server 172.17.1.1 key s3cr3t ipv4 use-petr 10.5.5.5 Default BGP Route ! IPv4 Internet CPE xTR Default Default Route Route Or BGP Default Route BGP xTR CPE Cisco Public xTR CPE xTR CPE Member 3 xTR CPE . . . Member 2 © 2014 Cisco and/or its affiliates. All rights reserved. Tier 1 Tier 1 SP1 Default Route Member 1 BRKRST-3045 NJEDge.Net LISP Network Facebook MS/MR PxTR Deploy LISP… • Configuration simplicity… IPv6 Internet Member N LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example NJEDge.Net LISP Network IPv6 Internet Non-LISP-to-LISP MS/MR PxTR Google Some.. v4 IPv4 EID Aggregate IPv4 Internet Advertisement CPE xTR LISP-to-LISP Member 1 Default Default Route Route Or BGP Commodity SP xTR CPE Default BGP Route xTR CPE Member 3 xTR CPE . . . Member 2 Cisco Public Transit SP Default Route BGP xTR CPE © 2014 Cisco and/or its affiliates. All rights reserved. More… v4 Tier 1 SP2 Tier 1 SP1 Default Route BRKRST-3045 NJEDge.Net LISP Network Facebook MS/MR PxTR Deploy LISP… • Configuration simplicity… More… v6 Some.. v6 Member N LISP Multihoming and Multi-AF • Efficient Multi-Homing and Multi-AF -- Customer Example IPv6 EID Aggregate Advertisement Some.. v6 NJEDge.Net LISP Network IPv6 Internet MS/MR PxTR Google Some.. v4 Non-LISP-to-LISP IPv4 Internet CPE xTR IPv6 EIDs Member 1 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public Transit SP Commodity SP Default Route BGP xTR CPE Member 2 xTR CPE Default BGP Route xTR CPE Member 3 xTR CPE . . . LISP-to-LISP Default Default Route Route Or BGP IPv6 EIDs More… v4 Tier 1 SP2 Tier 1 SP1 Default Route BRKRST-3045 NJEDge.Net LISP Network Facebook MS/MR PxTR Now NJEDge.Net is adding IPv6 for its members! More… v6 IPv6 EIDs Member N IPv6 EIDs LISP Deployment Examples • LISP Deployment Examples… 1. Efficient Multihoming and Multi-AF (IPv4 and IPv6) 2. Efficient Virtualization and High-Scale VPNs 3. Data Center/Host Mobility 4. LISP-Mobile Node BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP+GETVPN Config Guide: http://lisp.cisco.com LISP VPN/Virtualization • Efficient Virtualization and High-Scale VPNs – Overview Needs: ‒ Integrated Segmentation Legacy Site Legacy Site Legacy Site ‒ Global scale and interoperability ‒ Minimal Infrastructure disruption LISP Solution: LISP Site PxTR ‒ 24-bit LISP Instance-ID segments control plane and data plane, with VRF binding to the Instance-ID IP Network Benefits: ‒ Very high scale tenant segmentation ‒ Global mobility + high scale segmentation integrated in single IP solution ‒ IP-based “overlay” solution, transport independent ‒ No Inter-AS complexity BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public West DC East DC Mapping DB LISP VPN/Virtualization • Efficient Virtualization and High-Scale VPNs – Overview LISP VPNs Routing? or Tunneling? -- BOTH! Site to Site Routing Encapsulation • EID prefix virtualization • Tied to VRFs • Locators can be virtualized too BRKRST-3045 • Spoke to spoke connectivity • Optional local Internet offload (split-tunnel) • No IGP required to branch sites! © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public Cryptography Security • LISP Works with any crypto scheme • Locators or EIDs can be encrypted • LISP-SEC for control plane security LISP VPN/Virtualization • Efficient Virtualization and High-Scale VPNs – Overview LISP – Inherently scalability and virtualization, rapidly deployable ? Scalability (# of VPN site) Unconstrained ? VPN site-tosite routing Unnecessary Secure Segmentation 24-bit Instance ID with VRF Performance Optimal Path(P2P), Loadbalancing ? ? BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. • No protocol constraint • 100K concurrent site connections • No site-to-site routing required • No VPN route injection into core • LISP / Non-LISP site interworking through PxTR • 16M unique VPN classifiers • Used by LISP control plane and data plane • Optional data plane encryption with GETVPN • Shortest path between LISP sites • Equal cost/unequal cost loadbalancing Cisco Public 49 LISP VPN/Virtualization • Efficient Virtualization and High-Scale VPNs – Overview Generalized LISP Shared Model deployment MS/MR • Shared by multiple customers • Located in RLOC name space MS/MR EID Name Space (IPv4/IPv6) User Blue •EID 192.168.1.0/24 •IID 1 •VRF Blue User Red •EID 192.168.1.0/24 •IID 2 •VRF Red xTR1 Data EID EID RLOC IID 1 1 2 2 EID 192.168.1.0/24 192.168.2.0/24 192.168.1.0/24 192.168.2.0/24 RLOC xTR1 xTR3 xTR2 xTR3 xTR3 IID LISP Data EID 2 Hdr RLOC User Red •EID 192.168.2.0/24 •IID 2 •VRF Red xTR2 xTR (Multi-Tenant) • Accommodates single customer • Deployed for CPE Overlay model • Located at customer site © 2014 Cisco and/or its affiliates. All rights reserved. EID Name Space (IPv4/IPv6) User Blue •EID 192.168.2/24 •IID 1 •VRF Blue IID LISP 1 Hdr RLOC RLOC Name Space (IPv4/IPv6) xTR (Single Tenant) BRKRST-3045 LISP router Non LISP router Cisco Public • Accommodates multiple customers • Deployed for PE model • Located at Edge layer, DC or customer site 50 LISP VPN/Virtualization • Efficient Virtualization and High-Scale VPNs over a Public Core HQ VRF C, IID 3 VRF B, IID 2 LISP0. 2 To Enterprise VRF A, IID 1 Internal Networks Segmentation by physical, Layer 2, or Layer 3 means (e.g. 802.1Q, EVN, physically separate networks) KS xTR MSMR GM LISP0. 1 LISP0. 3 xTR MSMR GM To IPv4 or IPv6 Core RLOC namespace KS VRF B, IID 2 Default IPv4 Core • Single RLOC namespace • Default table (or RLOC VRF) xTR GM xTR GM xTR GM Site 3 Site 1 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Site 2 Cisco Public 51 LISP Use Cases :: Virtualization/VPNs • Customer Example :: Sony bit-drive X Y Services: IPv6 Internet X • IPv4, IPv6 Internet Access • GETVPN+LISP (encryption) • Data Center (Web, Mail, Storage) Y GW SONY Bit-Drive Services Initial deployment… IPv4 Internet MS/MR PxTR KS IPv6 access IID 1002 IID 1001 SMB X Site 1 SMB X Site 2 xTR IPv4/IPv6 EID Space BRKRST-3045 xTR IPv4/IPv6 EID Space SMB X Site 3 xTR IPv4/IPv6 EID Space © 2014 Cisco and/or its affiliates. All rights reserved. SMB Y Site 1 xTR IPv4/IPv6 EID Space Cisco Public SMB Y Site 2 xTR IPv4/IPv6 EID Space SMB Y Site 10 ... xTR IPv4/IPv6 EID Space ... 52 LISP Use Cases :: Virtualization/VPNs • Customer Example :: Sony bit-drive X Y Services: IPv6 Internet X • IPv4, IPv6 Internet Access • GETVPN+LISP (encryption) • Data Center (Web, Mail, Storage) Y IPv4 Internet GW SONY Bit-Drive Services VM VM VM VM VM VM VM VM VM VMware ESX VM VMware ESX Next plans… Y X MS/MR PxTR KS SONY Bit-Drive Data Center 1 SONY Bit-Drive Data Center 2 Data Center Virtualized Host/Cloud Service IPv6 access IID 1002 IID 1001 SMB X Site 1 SMB X Site 2 xTR IPv4/IPv6 EID Space BRKRST-3045 xTR IPv4/IPv6 EID Space SMB X Site 3 xTR IPv4/IPv6 EID Space © 2014 Cisco and/or its affiliates. All rights reserved. SMB Y Site 1 xTR IPv4/IPv6 EID Space Cisco Public SMB Y Site 2 xTR IPv4/IPv6 EID Space SMB Y Site 10 ... xTR IPv4/IPv6 EID Space ... 53 LISP Deployment Examples • LISP Deployment Examples… 1. Efficient Multihoming and Multi-AF (IPv4 and IPv6) 2. Efficient Virtualization and High-Scale VPNs 3. Data Center/Host Mobility 4. LISP-Mobile Node BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 54 LISP Data Center/Host Mobility • Data Center/Host Mobility – Overview Needs: ‒ VM-Mobility extending subnets and across subnets ‒ Move detection, dynamic EID-to-RLOC mappings, traffic redirection LISP Solution: ‒ OTV + LISP for VM-moves in extended subnets Data Center 1 LISP router LISP router VM move ‒ LISP for VM-moves across subnets VM Benefits: Data Center 2 Internet a.b.c.1 VM a.b.c.1 ‒ VM OS agnostic, seamless, integrated, global workload mobility ‒ Direct Path (no triangulation) ‒ Connections survive across moves ‒ No routing re-convergence, no DNS updates ‒ Global Scalability (cloud bursting) ‒ ARP elimination BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 55 LISP Data Center/Host Mobility LISP Host Mobility Config Guide: http://lisp.cisco.com • Data Center/Host Mobility – Host Move Scenarios Moves With LAN Extension Moves Without LAN Extension LISP Site LISP Site Non-LISP Site XTR XTR IPv4 Network Mapping DB Mapping DB DR Location or Cloud Provider DC IPv4 Network LAN Extension LISP-VM (XTR) LISP-VM (XTR) West-DC East-DC Routing for Extended Subnets West-DC East-DC IP Mobility Across Subnets Active-Active Data Centers Distributed Data Centers Disaster Recovery Cloud Bursting Application Members Distributed Application Members In One Location Broadcasts across sites BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 56 LISP Host-Mobility – First Hop Routing • No LAN Extension • SVI (Interface VLAN x) and HSRP configured as usual – Consistent GWY-MAC configured across all dynamic subnets • The lisp mobility <dyn-eid-map> command enables proxy-arp functionality on the SVI – The LISP-VM router services first hop routing requests for both local and roaming subnets • Moving hosts always talk to a local gateway with the same MAC interface vlan 100 interface Ethernet2/4 ip address 10.2.0.5/24 ip address 10.1.0.6/24 lisp mobility roamer lisp mobility ip roamer proxy-arp ip proxy-arp hsrp 101 hsrp 101 mac-address 0000.0e1d.010c mac-addressip0000.0e1d.010c 10.2.0.1 ip 10.2.0.1 A B C interface vlan 200 interface vlan 100 ip address 10.2.0.8/24 ip address 10.3.0.7/24 lisp mobility roamer lisp mobility roamer ip proxy-arp ip proxy-arp hsrp 201 hsrp 201 mac-address 0000.0e1d.010c mac-address 0000.0e1d.010c ip 10.3..0.1 D ip 10.3.0.1 LISP-VM (xTR) HSRP Active BRKRST-3045 West-DC 10.2.0.0 /24 HSRP Active HSRP ARP GWY-MAC © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public East-DC 10.3.0.0 /24 10.2.0.2 HSRP ARP GWY-MAC 57 Host-Mobility and Multi-homing • ETR Updates – Across LISP Sites 6 10.2.0.0/16 – RLOC A, B 10.2.0.2/32 – RLOC C, D Map-Notify 10.2.0.2/32 <C,D> Routing Table: 10.2.0.0/16 – Local 10.2.0.2/32 – Null0 10 Null0 host routes indicate the host is “away” Mapping DB 5.1.1.1 5 B 2 9 10.2.0.0 /16 8 West-DC Map-Notify 10.2.0.2/32 <C,D> BRKRST-3045 5.2.2.2 7 A Map-Register 10.2.0.2/32 <C,D> 4 Routing Table: 10.3.0.0/16 – Local 10.2.1.0/24 – Null0 10.2.0.2/32 – Local Routing Table: 10.2.0.0/16 – Local 10.2.0.2/32 – Null0 C © 2014 Cisco and/or its affiliates. All rights reserved. Y 10.2.0.2 Cisco Public 58 10.3.0.0 /16 East-DC Y X D 3 1 Routing Table: 10.3.0.0/16 – Local 10.2.1.0/24 – Null0 10.2.0.2/32 – Local Map-Notify 10.2.0.2/32 <C,D> Refreshing the Map Caches Map Cache @ ITR 1. ITRs and PITRs with cached mappings continue to send traffic to the old locators 10.2.0.0/16 – RLOC A,B 1. The old xTR knows the host has moved (Null0 route) LISP site ITR 10.2.0.2/32 – RLOC C,D 2. Old xTR sends Solicit Map Request (SMR) messages to any encapsulators sending traffic to the moved host Mapping DB 3. The ITR then initiates a new map request process A 4. An updated map-reply is issued from the new location 5. The ITR Map Cache is updated B C LISP-VM (xTR) East-DC 10.3.0.0 /16 West-DC 10.2.0.0 /16 Traffic now flows shortest path X Y Y 10.2.0.2 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. D Cisco Public 60 Z LISP Data Center/Host Mobility PRODUCTION • Data Center/Host Mobility – Customer Example MPLS Core, Across Subnets – Topology Customer-A Site 2 CE2 CE4 ITR/ETR ITR/ETR PE4 PE2 Customer-A Site 4 Customer-A MPLS-VPN Customer-A Site 1 MPLS Core PE1 CE1 PE3 CE3 ITR/ETR ITR/ETR PE5 MS/MR 172.17.0.0/16 CE5 Blue/DC 1 (Location 1) PE6 CE6 ITR/ETR 172.17.0.0/24 DYNAMIC EID BRKRST-3045 Customer-A Site 3 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public MS/MR CE7 ITR/ETR CE8 Blue/DC 2 (Location 2) 172.18.0.0/16 LISP Data Center/Host Mobility • Data Center/Host Mobility – Customer Example PRODUCTION IOS router lisp default Configurations instance-id 0 MPLS Core, Across Subnetseid-table – LISP (Sites and MS/MRs) database-mapping 172.16.1.0/24 10.1.1.2 pri 1 wei 100 exit Customer-A Customer-A ! Site 2 Site 4 CE2 CE4 ipv4 itr ipv4 etr ITR/ETR ITR/ETR IOS PE4 PE2 ipv4 itr map-resolver 10.1.5.1 Customer-A router lisp ipv4 itr map-resolver 10.1.6.1 RLOC 10.1.1.2 MPLS-VPN ! ipv4 etr map-server 10.1.5.1 key s3cr3t Customer-A Customer-A site DCs ipv4 etr map-server 10.1.6.1 key s3cr3t PE3 PE1 MPLS Core Site 1 Site 3 authentication-key DCs3cr3t ! CE3 CE1 eid-prefix 172.17.0.0/16 accept-more-specifics ITR/ETR ITR/ETR eid-prefix 172.18.0.0/16 RLOC 10.1.5.1 PE5 RLOC 10.1.6.1 PE6 EID 172.16.1.0/24 exit ! MS/MR CE5 MS/MR CE7 site CE8 Site-1 CE6 authentication-key s3cr3t eid-prefix 172.16.1.0/24 exit Blue/DC 1 Blue/DC 2 ITR/ETR ITR/ETR ! 172.17.0.0/16 (Location 1) 172.18.0.0/16 (Location 2) --<more sites>--ipv4 map-server ipv4 map-resolver exit 172.17.0.0/24 ! DYNAMIC EID BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public NX-OS LISP Data Center/Host Mobility PRODUCTION NX-OS ip lisp itr-etr ip lisp database-mapping 172.17.0.0/16 10.2.5.1 p 1 w 50 ip lisp database-mapping 172.17.0.0/16 10.2.5.5 p 1 w 50 • Data Center/Host Mobility – Customer Example ip lisp itr-etr ip lisp database-mapping 172.18.0.0/16 10.2.6.1 p 1 w 50 ip lisp database-mapping 172.18.0.0/16 10.2.6.5 p 1 w 50 ip lisp itr map-resolver 10.1.5.1 lisp itr map-resolver 10.1.5.1 ip lispCore, itr map-resolver 10.1.6.1 Subnets – LISP Configurationsip(Data MPLS Across Centers) ip lisp itr map-resolver 10.1.6.1 ip lisp etr map-server 10.1.5.1 key DCs3cr3t ip lisp etr map-server 10.1.5.1 key DCs3cr3t ip lisp etr map-server 10.1.6.1 key DCs3cr3t ip lisp etr map-server 10.1.6.1 key DCs3cr3t Customer-A Customer-A lisp Site dynamic-eid CUST-A-ROAM 2 CE2 database-mapping 172.17.0.0/24 10.2.5.1 p 1 w 50 database-mapping 172.17.0.0/24 10.2.5.5 p 1 w 50 ITR/ETR PE2 map-notify-group 239.1.1.1 RLOC 10.1.1.2 interface vlan 100 ip address 172.17.0.2/24 (or 172.17.0.3/24) Customer-A lisp mobility CUST-A-ROAM PE1 Site 1 ip proxy-arp CE1 hsrp 101 ITR/ETR mac-address 0000.0e1d.010c RLOC 10.1.5.1 172.16.1.0/24 EID ip 172.17.0.1 MS/MR CE5 RLOC-A 10.2.5.1 172.17.0.0/16 BRKRST-3045 Blue/DC 1 (Location 1) © 2014 Cisco and/or its affiliates. All rights reserved. Site 4 lisp dynamic-eid CUST-A-ROAMCE4 database-mapping 172.17.0.0/24 10.2.6.1 p 1 w 50 ITR/ETR PE4 database-mapping 172.17.0.0/24 10.2.6.5 p 1 w 50 map-notify-group 239.2.2.2 Customer-A MPLS-VPN interface vlan 100 ip address 172.17.0.4/24 (or 172.17.0.5/24) Customer-A PE3 CUST-A-ROAM lisp mobility MPLS Core Site 3 CE3 ip proxy-arp hsrp 101 ITR/ETR mac-address 0000.0e1d.010c RLOC 10.1.6.1 PE6 ip 172.17.0.1 PE5 CE6 MS/MR CE7 10.2.5.5 RLOC-B RLOC-C 10.2.6.1 ITR/ETR Cisco Public ITR/ETR CE8 10.2.6.5 RLOC-D Blue/DC 2 (Location 2) 172.18.0.0/16 LISP Data Center/Host Mobility PRODUCTION • Data Center/Host Mobility – Customer Example MPLS Core, Extending Subnets – Initial State Customer-A Site 2 CE2 CE4 ITR/ETR ITR/ETR PE4 PE2 Customer-A Site 4 Customer-A MPLS-VPN Customer-A Site 1 MPLS Core PE1 CE1 PE3 CE3 ITR/ETR ITR/ETR EID 172.16.1.0/24 PE5 map-cache EID-prefix: 172.17.0.12/32 Locator-set: 10.2.5.1, priority: 1, weight: 50 10.2.5.5, priority: 1, weight: 50 MS/MR CE5 Blue/DC 1 (Location 1) the server is here PE6 CE6 RLOC-A 10.2.5.1 172.17.0.0/16 BRKRST-3045 Customer-A Site 3 CE7 10.2.5.5 RLOC-B RLOC-C 10.2.6.1 ITR/ETR 172.17.0.12/32 © 2014 Cisco and/or its affiliates. All rights reserved. MS/MR Cisco Public ITR/ETR CE8 10.2.6.5 RLOC-D Blue/DC 2 (Location 2) 172.18.0.0/16 LISP Data Center/Host Mobility PRODUCTION • Data Center/Host Mobility – Customer Example MPLS Core, Extending Subnets – After the move Customer-A Site 2 CE2 CE4 ITR/ETR ITR/ETR PE4 PE2 Customer-A Site 4 Customer-A MPLS-VPN Customer-A Site 1 MPLS Core PE1 CE1 PE3 CE3 ITR/ETR ITR/ETR EID 172.16.1.0/24 map-cache EID-prefix: 172.17.0.12/32 Locator-set: 10.2.6.1, priority: 1, weight: 50 10.2.5.1, 10.2.6.5, priority: 1, weight: 50 10.2.5.5, 172.17.0.0/16 Customer-A Site 3 PE5 MS/MR CE5 RLOC-A 10.2.5.1 Blue/DC 1 (Location 1) PE6 CE6 MS/MR CE7 CE8 10.2.5.5 RLOC-B RLOC-C 10.2.6.1 ITR/ETR ITR/ETR 10.2.6.5 RLOC-D Blue/DC 2 (Location 2) 172.18.0.0/16 the server moves here 172.17.0.12/32 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP Status LISP Status IETF LISP WG: http://tools.ietf.org/wg/lisp/ • LISP RFCs and notable drafts… RFCs Draft Locator/ID Separation Protocol (LISP) base document RFC 6830 LISP Map Server RFC 6833 LISP Interworking RFC 6832 LISP Multicast Target LISP Canonical Address Format (draft-ietf-lisp-lcaf-04) Active Working Group Document LISP Deployment (draft-ietf-lisp-deployment-11) Active Working Group Document LISP SEC (draft-ietf-lisp-sec-05) Active Working Group Document RFC 6831 LISP DDT (draft-fuller-lisp-ddt-01) Active Working Group Document LISP Internet Groper RFC 6835 LISP Introduction (draft-ietf-lisp-introduction-03) Active Working Group Document LISP Map Versioning RFC 6834 LISP Mobile Node (draft-meyer-lisp-mn-10) Related Working Group Document LISP+ALT RFC 6836 RFC 7052 LISP NAT-Traversal (draft-ermagan-lisp-nat-traversal05) Related Working Group Document LISP MIB LISP Network Element Deployment Considerations RFC 7215 LISP GPE (draft-lewis-lisp-gpe) Related Working Group Document LISP Deployment (draft-ietf-lisp-deployment-12) RFC-Editor’s Queue LISP Based FlowMapping for Scaling NVF (draft-barakai-lisp-nvf-04) Related Internet Draft LISP Reliable Transport (draft-kouvelas-lisp-reliable-transport-00) Related Internet Draft BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 68 LISP Status • LISP Beta Network – international deployments LISP Community Operated: – More than 5+ years of operation… – More than ~600 Sites, 40 countries… Interoperable LISP implementations: – Cisco • IOS (ISR, ISRG2, 7200) and IOS-XE (ASR1K, CSR1KV) • Cisco IOS-XR (CRS3, ASR9K) • Cisco NX-OS (N7K) – AVM “FRITZ!Box” – OpenWrt – Open Source • FreeBSD: OpenLISP • Linux: Aless, LISPmob, OpenWrt • Android http://www.lisp4.net http://www.lisp.intouch.eu/ http://vinciconsulting.com/vxnet http:/lisp.isarnet.net/ and more… Plus some others… ;-) BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 69 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Features:: By operating System Features IOS IOS-XE NX-OS IOS-XR Cat 6K roadmap ASR9k roadmap v4 only 5.3.0 v4 only shared shared roadmap roadmap ASM 15.2(1)SY roadmap roadmap roadmap testing testing testing roadmap roadmap Roles: - ITR/ETR PITR/PETR MS/MR RTR AF Support - EID v4/v6 - RLOC v4/v6 Virtualization - Shared/Parallel Mobility - ESM/ASM - Multi-Hop Multicast NAT-Traversal BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public roadmap 70 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Releases :: IOS Platforms Hardware Software Notes/Caveats ISRG1 Engineering Build: ISRs are EOS/EOL (Cisco support rules apply). - 1800 Series - 2800 Series - 3800 Series Mainline Build: ISRG2 - 800 Series 1900 Series 2900 Series 3900 Series BRKRST-3045 - 15.3(3)XB12 - 15.4(2)T Engineering: LISP features require “datak9” or “securityk9” license http://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.htm l - 15.3(3)XB12 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 71 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Releases :: IOS-XE Platforms Hardware Software Notes/Caveats ASR1K Mainline Build: LISP features require “Advanced IP Services” or “Advanced Enterprise Services” license - 1001 Series 1002 Series 1004 Series 1006 Series 1013 Series - 3.12.0S (15.4-2.S) Engineering Build: - 3.10.01xb.S http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-seriesaggregation-services-routers/product_bulletin_c25-448387.html http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/csa/configuration/xe3s/asr903/csa-xe-3s-asr-903-book/csa-cfg-sw-activation.html - 4451-X CSR1KV - Cisco CSR1KV - Amazon Web Srvc Mainline Build: - 3.12.0S (15.4-2.S) Engineering Build: - 3.10.01xb.S BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public LISP features require “Premium” license http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/csr100 0Vswcfg/csroverview.html http://www.cisco.com/c/dam/en/us/products/collateral/routers/cloud-services-router1000v-series/sales-tool-c96-730727.pdf 72 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Releases :: NX-OS Platforms Hardware Software Notes/Caveats Nexus 7000 Mainline Build: The Transport Services license must be installed to enable LISP - 6.2(8) http://www.cisco.com/c/en/us/products/collateral/switches/nexus-7000-seriesswitches/data_sheet_c78-437306.html Nexus 7700 Mainline Build: - 6.2(8) LISP requires EPLD updated so that FE Bridge is at version 186.008: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/epld/epld_rn_60.html#wp152570 Requires M1-32 LC modules. F1 modules and the F2e LC module can be used for LISP using proxy forwarding to an installed M1-32 LC module. Beginning with NX-OS 7.1.0, F3 modules will also support LISP BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 73 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Releases :: IOS-XR Platforms Hardware Software Notes/Caveats ASR 9000 Mainline Build: LISP features available in base image - 5.2.0 Requires Typhoon line cards: http://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregationservices-routers/116726-qanda-product-00.html CRS 3 Mainline Build: Supports basic LISP xTR and PxTR functionality only - 5.2.0 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 74 Cisco Releases (http://lisp.cisco.com) LISP Status • LISP Software – Available Releases :: CATOS Platforms Hardware Software Notes/Caveats Catalyst 6500 Mainline Build: Requires Sup2T supervisor engine and WS-X690440GE or WS-X6908-10G line cards Supports xTR (IPv4-only RLOC), shared mode virtualization, PxTR, MS and MR - 15.1.2-SY2 Catalyst 6800 Mainline Build: - 15.1.2-SY2 BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 6880-X (semi-fixed chassis) - supported on all ports at FCS: 15.1(2)SY1 for the baseboard and 15.1(2)SY2 for the port cards 6807-XL (modular chassis) - supported with Sup2T and 6900 series line cards (6908 and 6904) at FCS: 15.1(2)SY1 (not supported natively on Sup2T, need 6900 modules for encap/decap) Supports xTR (IPv4-only RLOC), shared mode virtualization, PxTR, MS and MR 75 1. 2. 3. 4. LISP Summary • Part of the LISP Solution Space Multihoming IPv6 Transition Virtualization/VPN Mobility IPv4 Core xTR IPv4 Network xTR IPv4 Core v4 LISP is an Architecture… BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 76 1. 2. 3. 4. LISP Summary • Part of the LISP Solution Space IPv6 Network Multihoming IPv6 Transition Virtualization/VPN Mobility IPv6 Core xTR v6 IPv4 Network xTR IPv4 Core v4 LISP is an Architecture… BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 77 1. 2. 3. 4. LISP Summary • Part of the LISP Solution Space IPv6 Network Multihoming IPv6 Transition Virtualization/VPN Mobility IPv6 Core xTR v6 IPv4 Network xTR IPv4 Core v4 LISP is an Architecture… BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 78 1. 2. 3. 4. LISP Summary • Part of the LISP Solution Space IPv6 Network Multihoming IPv6 Transition Virtualization/VPN Mobility IPv6 Core xTR v6 IPv4 Network xTR IPv4 Core v4 LISP is an Architecture… BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 79 LISP References LISP References • LISP Sessions at Cisco Live US 2014… Session Sunday, 18 May TECRST-3191 - Advanced - LISP Technical Seminar 8:00 AM - 5:00 PM LTRRST-2014 - Routing for Host/VM-Mobility Using LISP 8:00 AM - 12:00 PM TECCRS-2003 - Advanced WAN Design Topics 8:00 AM - 5:00 PM TECDCT-2181 - Deployment Considerations for Interconnecting Distributed Virtual Data Centers 8:00 AM - 5:00 PM TECDCT-2432 - Virtualized Multi-service Data Center (VMDC) Architectures & Orchestration for Cloud 8:00 AM - 5:00 PM TECDCT-3297 - Operating and Deploying NX-OS Nexus Devices in the Network Infrastructure 1:00 PM - 5:00 PM Session Tuesday, 20 May LTRRST-2014 - Routing for Host/VM-Mobility Using LISP 8:00 AM - 12:00 PM BRKDCT-2131 - Mobility and Virtualization in the Data Center with LISP and OTV 8:00 AM - 9:30 AM BRKDCT-2335 - Design consideration for security services spanned across Data Center Interconnect 8:00 AM - 9:30 AM BRKRST-3045 - Advanced - LISP - A Next Generation Networking Architecture 12:30 PM - 2:30 PM BRKSEC-2054 - Group Encryption Transport (GET) Your VPNs Secured 12:30 PM - 2:30 PM BRKDCT-2337 - Virtual Services for Scalable Multi-tenant Cloud Architectures 12:30 PM - 2:30 PM BRKDCT-3060 - Deployment Challenges with Interconnecting Data Centres 3:00 PM - 5:00 PM BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 81 LISP References • LISP Sessions at Cisco Live US 2014… Session Wednesday, 21 May BRKDCT-3434 - Enabling a Secure Hybrid Cloud Extension with CSR 1000V and LISP 8:00 AM - 9:30 AM BRKRST-2044 - Enterprise Multi-Homed Internet Edge Architectures 8:00 AM - 9:30 AM BRKRST-3047 - Troubleshooting LISP 1:30 PM - 3:30 PM CCSDCT-1100 - Simplifying Data-Center migration using LISP, from 42 years to 2 years 3:00 PM - 4:00 PM BRKDCT-2328 - Evolution of Network Overlays in Data Center Clouds 4:00 PM - 5:30 PM Session Thursday, 21 May BRKDCT-3237 - Versatile architecture using Nexus 7000 with a mix of F and M modules to deliver FEX, FabricPath, Multihop FCoE, MPLS and LISP all at the same time 12:30 PM - 2:00 PM BRKARC-2023 - Building Hybrid Clouds with the CSR 1000v 12:30 PM - 2:00 PM BRKRST-2045 - Advancements in L3 VPN over IP in the WAN 2:30 PM - 2:00 PM BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 82 LISP References • LISP Information LISP Mailing Lists Cisco LISP Questions ……………… lisp-support@cisco.com IETF LISP Working Group ………… lisp@ietf.org LISP Interest (public) ………………. lisp-interest@puck.nether.net LISPmob Questions ………………... users@lispmob.org LISP Information BRKRST-3045 Cisco LISP Site ……………………. http://lisp.cisco.com (IPv4 and IPv6) Cisco LISP Marketing Site ………... http://www.cisco.com/go/lisp/ LISP Beta Network Site …………… http://www.lisp4.net or http://www.lisp6.net LISP DDT Root ……………………... http://www.ddt-root.org IETF LISP Working Group ……...… http://tools.ietf.org/wg/lisp/ © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 83 Participate in the “My Favorite Speaker” Contest Promote Your Favorite Speaker and You Could be a Winner • Promote your favorite speaker through Twitter and you could win $200 of Cisco Press products (@CiscoPress) • Send a tweet and include – Your favorite speaker’s Twitter handle – Two hashtags: #CLUS #MyFavoriteSpeaker • You can submit an entry for more than one of your “favorite” speakers • Don’t forget to follow @CiscoLive and @CiscoPress • View the official rules at http://bit.ly/CLUSwin BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 84 Complete Your Online Session Evaluation • Give us your feedback and you could win fabulous prizes. Winners announced daily. • Complete your session evaluation through the Cisco Live mobile app or visit one of the interactive kiosks located throughout the convention center. Don’t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 85 Continue Your Education • Demos in the Cisco Campus • Walk-in Self-Paced Labs • Table Topics • Meet the Engineer 1:1 meetings BRKRST-3045 © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public 86