Redundancy Policy for Redundancy Protection
Fan Yang
Huawei
156 Beiqing Rd.
Beijing
100095
China
shirley.yangfan@huawei.com
Xuesong Geng
Huawei
156 Beiqing Rd.
Beijing
100095
China
gengxuesong@huawei.com
Tianran Zhou
Huawei
156 Beiqing Rd.
Beijing
100095
China
zhoutianran@huawei.com
Gyan Mishra
Verizon Inc.
gyan.s.mishra@verizon.com
25 July 2022
SPRING
This document introduces a variant of SR Policy called Redundancy Policy, in order to instruct the replication of service packets and assign more than one redundancy forwarding paths used for redundancy protection.

Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

Introduction
Redundancy protection [I-D.ietf-spring-sr-redundancy-protection] is a generalized protection mechanism by replicating and transmitting copies of flow packets on redundancy node over multiple different and disjoint paths, and further eliminating the redundant packets at merging node. This document introduces Redundancy Policy to support redundancy protection, which is a variant of SR Policy [I-D.ietf-spring-segment-routing-policy]. Redundancy Policy instructs the replication of service packets and assigns more than one equivalent forwarding paths used for redundancy protection. Redundancy Policy applies equally to both MPLS data plane (SR-MPLS) [RFC8660] and Segment Routing with IPv6 data plane (SRv6) [RFC8986].

Terminology and Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
The other terminologies used in this document are:
Redundancy Node: the start point of redundancy protection, where the network node replicates the flow packets.
Merging Node: the end point of redundancy protection, where the network node eliminates and ordering(optionally) the flow packets.
Redundancy Policy: an extended SR Policy which instructs more than one redundancy forwarding paths to support packet redundant transmission.

Redundancy Policy
Redundancy Policy is used to enable packet replication and instantiation more than one active ordered lists of segments between redundancy node and merging node to steer the same flow through different paths in an SR domain.

Identification of Redundancy Policy
Redundancy Policy is a variant of SR Policy and also identified through the tuple <headend, color, endpoint>. Specifically, a redundancy policy is identified by <redundancy node, color, merging node>. Redundancy node is specified as IPv4/IPv6 address of headend of Redundancy Policy, which is the node to perform packet replication. Merging node is specified as IPv4/IPv6 address of endpoint of Redundancy Policy, which is the node to perform packet elimination. The value of color specifies the intent of the redundancy policy is "redundancy protection for high reliability", which indicates service packets are replicated into multiple copies and carried on different forwarding paths .

Structure of Redundancy Policy
Redundancy policy shares the basic structure and elements with SR Policy and its information model is shown in the following:
Redundancy policy POL1 <R Node= R1, Color = 1, M Node = M1>
        Candidate-path CP1 <protocol-origin = 20, originator
                           = 100:1.1.1.1, discriminator = 1>
             Flag Redundancy
             Preference 200
             SID-List1 <SID11...SID1i>
             SID-List2 <SID21...SID2j>
        Candidate-path CP2 <protocol-origin = 20, originator
                           = 100:2.2.2.2, discriminator = 2>
             Preference 100
             Weight W3, SID-List3 <SID31...SID3i>

The Redundancy Policy POL1 is identified by the tuple <redundancy node, color, merging node>, in which R1 is the redundancy node, M1 is the merging node, and Color 1 represents the intent of redundancy protection. Two candidate-paths CP1 and CP2 instruct the ordered segment lists from redundancy node to merging node. In candidate path CP1, a new attribute Flag is added to indicate the type of candidate path. When the candidate path is indicated with the flag of redundancy, the attribute Weight is not applicable to the SID-Lists and all SID Lists of the candidate path are used for redundancy forwarding. Regarding the other attributes of candidate path such as originator, preference, priority, segment-list etc, the definitions apply the same as [I-D.ietf-spring-segment-routing-policy].

Flag of a Candidate Path
Flag is an optional attribute of a candidate path, which is used to indicate the type of a candidate path is for redundancy forwarding. When the candidate path with flag of redundancy is selected as the active candidate path, this SR Policy is identified as the Redundancy Policy. Flag of a candidate path is an 8-bit bitmap. The table below specifies the current definition of Flag:
+----------------------------------+
| Bitmap | Flag |   Description    |
+----------------------------------+
|   0    |  R   | Redundancy paths |
+----------------------------------+
|  1-7   |  U   |    Reserved      |
+----------------------------------+
Figure 2: Flag

Behavior of Redundancy Policy
When the SR policy is identified as a redundancy policy, network node uses rules to compute and select the valid active ordered segment-lists for redundancy forwarding. The specific rules are:
- The candidate paths are selected to determine the best path of an SR policy. Preference, Protocol-Origin, and other tie-breaking rules defined in section 2.9 of [I-D.ietf-spring-segment-routing-policy] are evaluated until only one valid best path is selected.
- In a redundancy policy, the candidate path with a flag of redundancy is always selected as the best path in the first place.
- When the selected active candidate path is with a flag of redundancy, all the segment-lists of the candidate path are used as the active segment-lists for redundancy forwarding, where each active segment-list carries an entire copy of service packets.
- Weight is not applicable for the segment-lists in a candidate path with a flag of redundancy. Redundancy policy has no purpose of weighted load-balancing.
- The candidate path without a flag of redundancy in the same SR policy with the candidate paths with a flag, is considered as the backup path, which allowing provisioning of multiple path options.
Take the information model in section 3.2 as an example, preference value 200 of CP1 is higher than preference value 100 of CP2, thus CP1 is selected as the active candidate path. Because CP1 is with the flag of redundancy, both Segment-List1 and Segment-List2 are selected as the active Segment-Lists for redundancy forwarding. After service packets are replicated, each segment-list forwards each replicas of service packets. When CP1 becomes invalid and fallbacks to CP2, CP2 provides the backup path to the redundancy forwarding.

BSID and Redundancy Policy
Redundancy policy can be optionally associated with a Binding Segment. Redundancy SID defined in [I-D.ietf-spring-sr-redundancy-protection] can be the Binding SID of redundancy policy. In other words, Redundancy SID triggers the instantiation of redundancy policy in the forwarding plane on redundancy node.

Steering into a Redundancy Policy
A packet is steered into a Redundancy Policy at a redundancy node in following ways:
- Incoming packets have an active SID matching the Redundancy SID at the redundancy node.
- Per-destination Steering: incoming packets match a BGP/Service route which recurses on a Redundancy Policy.
- Per-flow Steering: incoming packets match or recurse on a forwarding array of where some of the entries are Redundancy Policy.
- Policy-based Steering: incoming packets match a routing policy which redirects them on a Redundancy Policy.

Protocol Extensions
Similar to SR Policy, Redundancy Policy requires the control plane protocol extensions to distribute candidate paths and other information. New sub-TLVs are expected to be defined to encode new information of Redundancy Policy Candidate Paths in BGP [I-D.ietf-idr-segment-routing-te-policy] and PCEP [I-D.ietf-pce-segment-routing-policy-cp].

IANA Considerations
TBD

Security Considerations
TBD

Normative References

Informative References
[I-D.ietf-spring-sr-redundancy-protection]
[I-D.ietf-spring-segment-routing-policy]
[RFC8660]
[RFC8986]
[RFC2119]
[RFC8174]
[I-D.ietf-idr-segment-routing-te-policy]
[I-D.ietf-pce-segment-routing-policy-cp]