text:
I just received my second little black bag order today. I'm so excited to share with everyone even though this order is for a friend's birthday ^.^. Ya know, I just start loving little black bag website now because they are so convenient and always have great deals. Although I live in Canada and I have to pay shipping & tax but overall, it's still cheaper than buying stuff here ^.^
So let's have a look ^,^
So this is the packaging and items inside the box :). The Mistique bag is the main character!
And here is the princess!
First Little Black Bag. But this bag is like the perfect bag you want to carry it around with you across the country!
You can fit in a wallet, a notebook or mini ipad :o, a small makeup bag, pen and everything that is essential. The bag is not heavy either which I like :).
The price is unbeatable. If I get hired at Guess store, I'll definitely order another one for myself :).
They have 2 colour: orange & black. I'll probably get the black one.
Normally when you order, you have a choice of either getting a bundle which they will add extra items together with your bag or you buying the single bag. It's always better deal when you buy the bundle ;). Well, I have to say that, I would prefer the bundle deal but depend on what extra items you're going to get. So my bundle includes:
A stone ring. This one I'm so sure that my friend will love it. It's just her style!
My fingers are little small for this ring even though you can stretch it. It's great for bigger fingers.
The price for this ring is about $20. It was in the bundle so I paid about extra $10 to get the whole things. The ring is one of them ;)
Then I got this necklace. It's very pretty!
The necklace string is long so it's very suitable for sweater top or sleeveless top. Pretty funky. Look great on almost tops
As well the bundle came with a Pixi nail polish which I'd also like to try. The colour of the nail polish is quite pretty too ^.^
|Pixi Nail Polish
So that's all for my second Little Black Bag order.
It's pretty simple to be a VIP member of Little Black Bag. You only need to pay $9.95 for the membership but they give you a $10 credit so you can buy item from there whenever you like. The good thing for being a member is that you get the maximum discount ^.^
Click on the icon if you'd like to have a look (referral icon)
I hope you enjoy my post and I'll see you soon again ^.^


text:
Visionaire is a fashion and art publication that is published three times a year in limited quantities. Each issue explores a theme and the content and format changes with each issue, with contributing artists collaborating with Visionaire to create their interpretations of the theme.
Issue 56 of Visionaire recently released in a limited quantity of 3,000 copies worldwide. The theme of the issue is Solar – and true to it's theme – the white cover, and black and white photographs inside, change to color when exposed to sunlight. Yoko Ono, Mario Sorrenti, Alex Katz, Olaf Breuning, Inez Van Lamsweerde & Vindooh Matadin, Peter Lindbergh, and Ryan McGinley are some of the artists contributing to this extraordinary issue.
I would love to get my hands on a copy of this. The makers of Visionaire are truly visionary and they always find a way to delight the senses in presenting art and fashion. You can purchase your copy online on the Visionaire Web Store.
Similar Posts:
- Visionaire N° 55 "Surprise"
- Y is For YSL
- Sneaker Freaker Issue #20 Out Now!
- Gap Design Editions by Doo.Ri, Thakoon & Rodarte
- YSL Introduces Spring/Summer 2010 Manifesto VI

subset: commoncrawl


text:
About Wallstone
'Our Focus, Your Future'
We work with executives, small business owners and individuals alike to help them build a Financial Plan that revolves around them. We do this through a clearly defined and transparent process delivering personalised solutions based on each individual's personal circumstances.
We offer a unique proposition which we believe truly adds value to you and your family, no matter what stage in life you're at. Everything we do at Wallstone revolves around YOU, your goals, dreams and aspirations and what needs to be done to achieve these.
Everyone is different and that's why our culture here at Wallstone is different – we're here to understand YOU, and how you want your money to work for you. We're here to put in place a plan for you and not some life insurance company. We're here to help you understand and not confuse you with complicated investment and product jargon.
Your Financial Bucket
Our Team
Gerry Moran
Gerry has been working as a Financial Services professional for over 18 years in various roles advising clients in all areas of wealth accumulation and wealth management. Gerry graduated from the University of Limerick with a BA Hons Degree in 1997, is a Qualified Financial Adviser (QFA) and also holds the internationally recognised designation of Certified Financial PlannerTM.
Ruairí McMahon
Ruairí has over twenty seven years experience in the financial services industry. He has worked with a number of Ireland's leading life assurance companies, investment and private banking firms. He has been providing financial advice to clients since 2000. He specialises in the areas of retirement planning and wealth management. Ruairí graduated from the University of Limerick with BA European Studies in 1991, is a Qualified Financial Advisor ("QFA") and holds the internationally recognised designation of Certified Financial PlannerTM.
Diarmuid Corcoran
Diarmuid joined the Wallstone team in 2017 and has a wealth of experience in the financial sector. With responsibility for Protection and Risk Management solutions at Wallstone, Diarmuid leads with his experience from companies such as PricewaterhouseCoopers, BDO Accountants & Allied Irish Bank. Diarmuid graduated from UCD in 2006 with a Hons Degree in Commerce and is also a member of the Institute of Chartered Accountants Ireland and the Institute of Bankers
Why Choose Wallstone?
Wallstone is a customer focused financial planning firm. We are here to help YOU and not to generate profits for some life assurance company. Our financial advisors are highly qualified and having each worked in industry for over 20 years, they each possess a wealth of experience and expertise in advising clients in financial matters. Wallstone has very strong business affiliations with a number of established accountancy firms in Limerick.
We provide unbiased, independent financial advice that is customised for you. We offer you advice on all aspects of financial planning and can also arrange financial products from a broad number of product providers. We can help you take control of your finances and offer clear, flexible and transparent solutions. We can provide you with direction and meaning to your financial decisions
If you are saving for retirement, we can help you put in place a plan to help ensure that you will have enough money when you stop working to maintain your standard of living. You will have peace of mind knowing that you are saving enough and are making prudent investment decisions.
So you have decided to stop working and have received your pension plan retirement options but cannot navigate through the complexity. As retirement planning experts, we can outline your retirement options in a jargon free manner and then recommend the most appropriate option(s) for you. We can then recommend and arrange your purchase of an annuity or investment into an Approved Retirement Fund.
If you have money to invest, be it a regular amount or a lump sum, in a pension plan, Approved Retirement Fund or personal wealth, we have a solution. We identify and arrange suitable investments specific to your requirements as cost and tax-efficient as possible.
We can help you identify potential risks to your financial security and the potential risks to your family and business and help you take precautionary steps to control the financial impact by having appropriate protection cover in place e.g. life assurance both personal and for your business and income protection for you.
If you need help in planning your finances and cannot work out if you will have enough money, for example, to retire or pay for University Fees at a future date . We can help you by setting out a financial road-map for you which will show you where your financial position needs to be and how best to get there from your current location. We use cash-flow modelling software to better illustrate your possible financial future and address and plan for potential shortcomings.
Tom & Betty – Their experience of Wallstone.
Financial Planning
At Wallstone, we truly believe that Personal Financial Planning can help you meet your life goals through the proper management of your finances. Life goals may include purchasing a house, saving for university education, planning for retirement or financial independence.
A Financial Plan can help you work out where you are now, what you need in the future and what you must do to reach your goals. In essence a Financial Plan is a 'Financial Road Map' which sets out where you want to get to and how best to get there from your current location.
Personal Financial Planning provides direction and meaning to your financial decisions. It allows you to understand how each financial decision you make affects other areas of your finances. By viewing each financial decision as part of the overall plan, you can consider its short and long term effects on your life goals. You can also adapt more easily to life changes and feel more secure that your goals are on track.
The process adopted at Wallstone involves gathering relevant personal and financial information, setting life goals and identifying their financial cost, examining your current financial situation and developing a strategy or plan for how you can meet your goals given your current and future plans.
At Wallstone, we use Financial Planning Software to enable you visualise future cashflow requirements based on your key lifetime goals.
We can help you to answer the BIG questions that interest you most:
Questions like…
- How much do I need to earn, save or sell my business for in order to give me what I want out of life?
- When, precisely, can I afford to stop doing the things that have become a drag…and start to do the things I really enjoy?
- What do I have to do to ensure I NEVER run out of money?
- Exactly what level of investment return do I need to achieve my objectives?
A true Financial Plan is however always a 'Work In Progress' as it is constantly changing as our lives change. Hence, a review of the Personal Financial Plan is carried out periodically to monitor your progress towards your goals and to review your situation and adjust the recommendations, if needed, as your changes occur.
See 'Your Financial Bucket ' video
Retirement Planning & Pensions
Not exactly the most exciting topic in the world, but nonetheless, it's either 'Urgent' or 'Important', depending on what stage in life you are at! At Wallstone, we specialise in helping clients take back control of their retirement arrangements and provide solutions unique to them.
Did you know that you can invest your pension funds directly in commercial or residential property, public or private equity or even gold is at a fraction of cost of a traditional insured arrangement? All this in a tax exempt environment.
We offer a clear, flexible and transparent solution that puts you in control, providing online access to your account and up-to-the-minute portfolio valuations at a very competitive cost. So if you are a small business owner thinking about the future or a highflying professional taking about retiring, you need to talk to us. We will help to answer the big questions like;
Will I be all right?
Can I afford to?
How much is enough?
Wallstone – taking the Pain out of Pensions!
At Wallstone, we adopt a sensible and a straightforward approach to saving and investing and believe in four key principles;
Diversification is key;
Risk and return are related;
Capital markets work;
Costs Matter;
We listen to what each individual is trying to achieve and recommend a suitable portfolio aligned to their goals and objectives. We can provide you with access to fund managers from around the globe or can organise passive portfolios for those who want to have a more direct input into managing their wealth. For further information, feel free to browse our Investment Process and Philosophy document below or check out our Pension Model Portfolios designed to deliver returns consistent with your attitude to investment risk and return.
Protection & Risk Management
Life Cover
Term assurance provides low cost life and/or serious illness cover for a fixed premium over a specified term of years. The cost and the sum assured remain fixed for the entire term. At the end of the term the policy simply lapses. Your premiums have produced no monetary return, but they have provided peace of mind both for you and your dependants. There are two main types:
- Level Term
In this case the sum insured remains the same for the term of the policy.
- Convertible Term
This provides the same basic insurance cover as level term assurance, but with an option to convert the policy into another type at a later stage without having to undergo a medical examination or additional proof of good health at that time. The extra cost for convertible term compared with level term is typically about 5-10% depending on age and smoking status.
A guide to life insurance cover
Serious Illness
Also known as Critical Illness Cover or Specified Illness Cover it provides a Lump Sum in the event of Critical Illness. A critical illness policy normally pays out a tax free lump sum on the diagnosis of certain specified critical illnesses. Most policies will pay out following the diagnosis of heart disease, stroke, renal failure, cancer, paralysis, major organ transplant and coronary artery bypass surgery as well as a range of other conditions. The financial consequences of suffering a major life changing illness can be very substantial. The one-off payment from this type of policy is designed to help you cope with these costs which will typically include the need to adapt your home or car and/or undertake training for a different occupation.
A guide to serious illness cover
Income Protection
Income Protection is different from Redundancy cover, a s it covers you against an accident or ill health, rather than against losing your job and distinct from Critical Illness as it pays you an income rather than a lump sum.
The amount of benefit that is paid out from an income protection plan is set when the policy is taken out. Benefit can also be called cover or sum assured. There is a maximum benefit which will vary from one insurer to another but is normally around 75% of gross income. The benefit is normally paid monthly to the policyholder after a set deferment period and is not taxable. This type of policy is pure protection insurance so there is no cash in value at any time.
Estate and Succession Planning
Estate and Succession Planning is essential where you have accumulated wealth over your lifetime and you are considering gifting assets during your lifetime or leaving assets to your family or others on death. Failure to plan could result in a forced sale of a gifted or inherited asset and result in significant tax and legal costs when you die.
We help you create an inventory of your assets and outline your possible future needs and cash requirements. This will assist us in advising you on the timing and affordability of any gift planning.
Before gifting assets, it is prudent to plan, to ensure that assets are transferred in the most tax efficient manner. In conjunction with your Tax Advisor, we will ascertain if any reliefs or exemptions are available. Failing to plan may result in these assets being reduced by Capital Acquisition Tax (CAT) in the form of inheritance or gift tax. The dual effect of CAT rates increasing and the CAT tax free thresholds reducing over the last number of years means estate planning has become a consideration for a greater number of people.
CAT Thresholds
Tax treatment of ARF on death
We review your estate plan with you on a regular basis as adjustments may be required from time to time to reflect changes to your will, beneficiaries, value of assets, tax and legal matters.
There are five compelling reasons for business succession planning:
1) Tax
A succession plan can reduce, and sometimes completely avoid, taxes and insure that the family and important employees get what they deserve, instead of what is left after taxes.
2) Risk
The longer owners wait to design and implement a succession plan, the greater the risk that the plan will not meet their goals.
3) Options
The longer succession planning is delayed, the fewer options owners have to meet their goals.
4) Control
By planning for succession, the business owner retains control over the outcome.
5) Value
When a business owner does not implement a succession plan before he or she is disabled or dies, the value of the business often drops rapidly.
The succession planning process, in its simplest form, has three stages:
(1) Identify the goals.
(2) Determine how best to meet the goals.
(3) Implement the plan.
A good succession plan will:
1) meet the needs and goals of the business owner; and
2) meet the needs of the other important stakeholders in the business.
A good planning process will:
1) involve all of the major stakeholders; and
2) retain the relationships necessary for the business to succeed and for the owner to be happy.
The goal is to design a plan that will meet the expectations and hopes of the business owner. Often the most important goals are to keep the business and family together. Therefore, it is critical to include these important stakeholders in the process.
Succession planning is difficult for a number of reasons. It raises issues of inevitable life changes, of mortality, and of changes in key personal relationships.
Why Use a CFP® ?
Anyone can call themselves a "financial planner". However, only those who have fulfilled the certification and renewal requirements of the CFP Board can display the CERTIFIED FINANCIAL PLANNER™ certification marks. When choosing a financial planner, you need to be confident that the individual you select to assist you map out a financial plan is both competent and ethical. In Ireland, the Financial Planning Standards Board Ireland Limited ("FPSB Ireland") administers the CERTIFIED FINANCIAL PLANNER™ certification programme.
To obtain CFP certification, individuals must meet rigorous initial certification requirements adapted to Irish marketplace needs by FPSB Ireland. To maintain their right to use the CFP marks, CFP professionals must complete ongoing renewal requirements.
The initial CERTIFIED FINANCIAL PLANNER™ certification process rests on the 'Four Es' (Education, Examination, Experience and Ethics). To become certified to use the CFP marks, an individual must meet country-specific requirements in the following areas:
Education: Candidates for CFP certification must master theoretical and practical personal financial planning knowledge by completing a comprehensive course of study which is approved by FPSB Ireland.
Examination: Candidates for CFP certification must pass a comprehensive CFP Certification Examination that tests their ability to apply integrated financial planning knowledge to real world client situations. Based on regular research of what planners do, the CFP Certification Examination covers the financial planning process, tax planning, employee benefits and retirement planning, estate planning, investment management and insurance.
Experience: Candidates for CFP certification must have a minimum of three years' experience in the personal financial planning process prior to being awarded CFP certification to ensure that they possess financial counselling skills in addition to personal financial planning knowledge.
Ethics: As a final step to certification, candidates for CFP certification must agree to abide by a strict Code of Ethics that defines their ethical responsibilities to the public, clients and employers. CERTIFIED FINANCIAL PLANNER™ professionals must disclose any investigations or legal proceedings related to their professional or business conduct and agree to act fairly, diligently and with integrity, offering clients professional services that are objective and based on clients' needs. CFP professionals must disclose in writing to clients information about their sources of compensation and conflicts of interest.
Continuing Education: CERTIFIED FINANCIAL PLANNER™ professionals are required to maintain technical competence and fulfill ethical obligations. Every two years, they must complete at least 30 hours of continuing education to stay current with developments in the personal financial planning profession. At least two of these hours must be spent studying or discussing the CERTIFIED FINANCIAL PLANNER™ professional's Code of Ethics and/or Professional Practice Standards. In addition to the continuing education requirement, CFP professionals must disclose any public, civil, criminal or disciplinary actions that may have been taken against them during the certification period. CFP Certificants must also submit an Annual Renewal Declaration to retain certification.
Share this page
Tel. +353 61 440044
email. email@example.com


text:
Temporarily out-of-stock.
Call for more information.
Protect your shield hand from stray sword blows with a 1/4 inch bar stock, welded cage-style shield basket.
The 1 inch tabs make attaching the basket to any shield, metal or wood, an easy task. The 1 inch diameter grip and 2 inches of clearance allow for large hands and heavy gloves. The shield baskets are 5 inches in length for maximum coverage.
This item is not eligible for Regular Shipping due to size or wieght.
All prices are in USD
Copyright 2018 Renstore,
Contact Us (520) 721-8346.
Sitemap |
Ecommerce Hosting by BigCommerce


text:
Hello! This message is intended for FIRST NRG 4055 team members. If you are receiving it, you are registered to the team's public site and please disregard.
*FIRST NRG 4055 team members, mentors, and parent contributors:* If haven't already registered with Rachel, please email Rachel's school email the following information for the new site.
First name
Last name
Username you would like to log in with: e-mail address
(Rachel will assign you a temporary password with which you can log in and change to what ever you would like)
* * *FIRST NRG 4055 Mentors and Officers:* If you haven't done so already, please email Rachel categories or topics into which you would like to have information and discussions organized.


text:
craftybloggingJanuary 31, 2007
I used to post more about my crafts. But then I sort of stopped crocheting, and so there was nothing more to blog about. But then a friend-of-a-friend in San Francisco heard about my upcoming visit and was in need of a new yarmulke/kippah and suggested that we do an exchange of crafts. Little did he know that I blogged back in September about a fantasy I had of some sort of exchange of homemade Jewish ritual objects among the queers. Mostly I wanted to knit my crafts for others and felt sort of weird and silly about selling them to strangers. Well, hurray. In exchange for a beautiful driftwood mezuzah for my new apartment, I knitted a yarmulke on the plane ride over.
OK, so here's my call again folks. If you want a kippah, choose your colors, size, and name your trade. It's as good as yours. Saltyfemme at gmail.


text:
Garik Kharlamov
Snezhnaya koroleva 2. PerezamorozkaHD
IMDb: 6.4
1h 18min
Snow queen casts a curse on her mirror making people see the worst in themselves.
Actors: Ivan Okhlobystin, Anna Shurochkina, Garik Kharlamov, Anna Khilkevich, Olga Zubkova, Fyodor Dobronravov, Aleksandr Uman, Igor Bortnik, Aleksey Likhnitskiy, Roman Yunusov, Diomid Vinogradov, Mikhail Tikhonov, Aleksandr Gudkov, Ramilya Iskander, Valeriya Nikolaeva
Kikoriki. Legend of the Golden DragonSD
IMDb: 6.1
The lovably simple residents of peaceful Kikoriki Island are thrown kicking and screaming into big adventure, when their resident scientist invents an amazing device - ...
Genres: Animation
Actors: Vadim Bochanov, Mikhail Chernyak, Garik Kharlamov, Sergey Mardar, Vladimir Maslakov, Dmitriy Nagiev, Svetlana Pismichenko, Vladimir Postnikov, Elena Shulman, Anton Vinogradov
The Snow Queen 3HD
IMDb: 5.9
80 min
The rare gift of getting into all kinds of trouble is their family trait. What else can you expect from the ones raised among trolls ...
Actors: Dee Bradley Baker, Lori Gardner, Devin Bailey Griffin, Jason Griffith, Graham Halstead, Laurie Hymes, Vanessa Johansson, Garik Kharlamov, Samara Naeymi, Ivan Okhlobystin, Scott Rayow, Alyson Leigh Rosenfeld, Eileen Stevens, Billy Bob Thompson, Marc Thompson


text:
How to forestall the dangers manifest in the lineup of troops on both sides of the border between Syria and Jordan? It is the kind of situation in which a mistaken signal or isolated incident could lead to tragic conflict and broadening war. The best tht outsiders can do is to keep hands off while the adversaries, in the words of UN Secretary-General Waldheim, "exercise restrain and take urgent measures to resolve differences peacefully."
What has to be overcome is an Arab/Islamic tangle of which the Syrian-Jordanian tension is only a symptom. Such tangles have come and gone before. This time there is a new and difficult core: Iraq's invasion of Iran. Whatever the rights or wrongs of Iraq's stated territorial claims, practically nobody relishes the thought of its going on to take control of Iran's oil and become dominant in the Middle East. This feeling extends not only to the two Arab states (Syria and Libya) supporting non-Arab Iran but to the many Arab states backing Iraq to various degrees in the present combat.
One factor in a possible Iraq ascendancy is the elimination of Egypt from its fromer Arab leadership role. Egypt remains ostracized for making a peace with Israel that has not brought justice to the Palestinians in Israeli-occupied Arab territories.
Iraq's war supporters, prominently including Jordan, appeal to Arabism and sticking withe Iraqis as Arabs. Syria appeals to Islam and sticking with the Iranians as Muslims. Thus, even though there have been no basic differences between Syria and Jordan in recent years, they can indulge in mutual accusations. Jordan suggests Syria is anti-Arab. Syria suggests Jordan is anti-Islam. and this kind of wrangle figures in the situation splitting the recent Arab League summit meeting in Amman, which was boycotted by several states led by Syria.
As for Syria's display of troops on the Jordanian border, this becomes part of the wider context as an effort to cause concern in Iraq and divert it from its iranian adventure. Iraqis argue that they have already taken account of such a Syrian threat by keeping most of their troopst at home, thus at the same time trying to explain sending too few troops to Iran to speedily achieve their aims.
A further twist to the tangle comes with Syria and the Soviet Union drawing attention to their 20-year friendship treaty by holding ratification ceremonies in Damascus. The announced agreement includes a provision for each country to consult with the other -- though without necessarily committing military aid -- if the peace or security of either one is threatened. Moscow does not want to see Iraq swallowing Iran's oil any more than Syria does. But it also doesn't mind keeping the waters somewhat roiled.
The other superpower, the United States, is immediately called on by Jordan, which takes the Syrian threat as an excuse to ask for speeded delivery of ammunition and spare parts, though it is thought to be quite well stocked anyway. A State Department spokesman says additional shipments will be considered for the standard diplomatic reason of preventing war.
The latter goal will be better served by neither Moscow nor Washington upping their roles in a quintessentially Arab imbroglio. It is to be hoped the US official was right who said there are no plans "to open the Pentagon's floodgates" for Jordan.


text:
James ? (Mississauga, Ontario)
Install Vista from USB Flash Drive
A few weeks ago my brother was in town and we were at a Toronto Raptors game and someone came up and introduced themselves, says they saw one of our sessions and enjoyed it. I always like meeting people and things like that are fun. Today I was at the grocery store buying some things and something similar happened. I am standing in the checkout line and a young guy comes up and asks if I am Rodney from Microsoft. I said yes and he mentions he recognizes the shoes 🙂 We get to talking and he tells me about how he is deploying Vista in his test lab from a USB drive.
Now a few weeks ago at TechReady, our internal technical training event, we saw a demo by a couple of Technical Sales Professionals from Microsoft Peru. In their demo they did an install of Vista from a USB Flash drive. I was amazed at how fast it installed and had planned on playing with it at home but you know how that goes sometimes. Speaking with James, he told me how easy it was and I took some notes in OneNote Mobile on my Moto Q.
It goes like this, buy the fastest 4GB USB flash drive you can get your mitts on, work a little magic on it, copy the contents of the Vista DVD and ta-da, your done! So what is "a little magic"? Open up a command prompt and run the DiskPart command and then
a) list disk (this lists the disk numbers)
b) select disk x (make sure you choose the right disk!)
c) clean
d) create partition primary
e) select partition 1
f) active
g) format fs=fat32
h) assign
i) exit
All that is left is to copy the contents from the install DVD to the flash drive and then boot from USB and 5-10 minutes later (depending on hardware) you have a completed installation! James even mentioned how he is now using the Automated Installation Kit to customize the install and is planning to add some common applications as well.
I paid for my groceries and left and it hit me when I got out to my car, we didn't swap contact info! James, if you read this get in contact with me! I want to give you full credit for telling me your story!


text:
Tip your cops well Monday, and you could help send competitors to the Northern California Special Olympics.
San Francisco Police Department "waiters" will be participating in a "Tip-a-Cop" fundraiser at the Hard Rock Café at Pier 39 on Fisherman's Wharf Monday from 11 a.m. to 4 p.m. and 4 p.m. to 9 p.m., according to the Police Department.
Their tips will go to providing sports training and competition for children and adults with developmental disabilities.


text:
NVO3 Workgroup Ali Sajassi INTERNET-DRAFT Samer Salam Intended Status: Standards Track Keyur Patel Cisco Nabil Bitar Verizon Wim Henderickx Alcatel-Lucent Expires: April 22, 2013 October 22, 2012 A Network Virtualization Overlay Solution using E-VPN draft-sajassi-nvo3-evpn-overlay-01 Abstract This document describes how E-VPN can be used as an NVO solution and explores the various tunnel encapsulation options and their impact on the E-VPN control-plane and procedures. In particular, the following three encapsulation options are analyzed: MPLS over GRE, VXLAN and NVGRE. Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/1id-abstracts.html The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html Sajassi et al. Expires April 22, 2013 [Page 1]
INTERNET DRAFT E-VPN Overlay October 22, 2012 Copyright and License Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . 4 2 E-VPN Main Features . . . . . . . . . . . . . . . . . . . . . . 5 2.1 Multi-homed Ethernet Segment Auto-Discovery . . . . . . . . 5 2.2 Fast Convergence and Mass Withdraw . . . . . . . . . . . . . 5 2.3 Split-Horizon . . . . . . . . . . . . . . . . . . . . . . . 5 2.4 Aliasing . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.5 DF Election . . . . . . . . . . . . . . . . . . . . . . . . 6 3 Encapsulation Options for E-VPN Overlays . . . . . . . . . . . . 7 3.1 MPLS over GRE . . . . . . . . . . . . . . . . . . . . . . . 7 3.1.1 Benefits of MPLS over GRE . . . . . . . . . . . . . . . 7 3.2 VXLAN/NVGRE Encapsulation . . . . . . . . . . . . . . . . . 8 3.2.1 Impact on E-VPN Routes for VXLAN/NVGRE Encapsulation . . 8 3.2.2 Impact on E-VPN Procedures for VXLAN/NVGRE Encapsulation . . . . . . . . . . . . . . . . . . . . . 9 22.214.171.124 NVE with No Redundancy . . . . . . . . . . . . . . . 9 188.8.131.52 NVE with Active/Standby Redundancy . . . . . . . . . 10 188.8.131.52 NVE with All-Active Redundancy . . . . . . . . . . . 10 3.2.3 Support for Multicast . . . . . . . . . . . . . . . . . 13 3.2.4 Inter-AS Challenges . . . . . . . . . . . . . . . . . . 13 4 Comparison between MPLSoGRE and VXLAN/NVGRE Encapsulation . . . 14 5 Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . . 15 6 Security Considerations . . . . . . . . . . . . . . . . . . . . 15 7 IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 15 8 References . . . . . . . . . . . . . . . . . . . . . . . . . . 15 8.1 Normative References . . . . . . . . . . . . . . . . . . . 15 8.2 Informative References . . . . . . . . . . . . . . . . . . 15 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 16 Sajassi et al. Expires April 22, 2013 [Page 2]
INTERNET DRAFT E-VPN Overlay October 22, 2012 Sajassi et al. Expires April 22, 2013 [Page 3]
INTERNET DRAFT E-VPN Overlay October 22, 2012 1 Introduction In the context of this document, a Network Virtualization Overlay (NVO) is a solution to address the requirements of a multi-tenant data center, especially one with virtualized hosts (i.e. Virtual Machines or VMs). The key requirements of such a solution as described in [Problem-Statement] are: - Isolation of network traffic per tenant - Support of large number of tenants (tens or hundreds of thousands) - Extending L2 connectivity among different VMs belonging to a given tenant segment (subnet) across different PODs within a data center or between different data centers The underlay network for NVO solutions is assumed to provide IP connectivity. This document describes how E-VPN can be used as an NVO solution and explores the various tunnel encapsulation options for E-VPN over IP, and their impact on the E-VPN control-plane and procedures. Note that the use of E-VPN as an NVO solution does not necessarily mandate that the BGP control-plane be running on the NVE. This may not be desirable, for e.g., when the NVE resides on the hypervisor. For such scenarios, it is still possible to leverage the E-VPN solution by using XMPP, or alternative mechanisms, to extend the control-plane to the NVE as discussed in [L3VPN-ENDSYSTEMS]. The possible encapsulation options for E-VPN overlays that are analyzed in this document are: - MPLS over GRE - VXLAN and NVGRE Before getting into the description of the different encapsulation options for E-VPN over IP, it is important to highlight the E-VPN solution main features, how those features are currently supported, and any impact that the encapsulation may have on those features. 1.1 Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [KEYWORDS]. Sajassi et al. Expires April 22, 2013 [Page 4]
INTERNET DRAFT E-VPN Overlay October 22, 2012 2 E-VPN Main Features In this section, we will recap the main features of E-VPN, to highlight the encapsulation dependencies. The section only describes the features and functions at high-level. For more details, the reader is to refer to [E-VPN]. 2.1 Multi-homed Ethernet Segment Auto-Discovery E-VPN NV Edge devices (NVEs) connected to the same Ethernet segment (e.g. server) can automatically discover each other with minimal to no configuration through the exchange of BGP routes. 2.2 Fast Convergence and Mass Withdraw E-VPN defines a mechanism to efficiently and quickly signal, to remote NVEs, the need to update their forwarding tables upon the occurrence of a failure in connectivity to an Ethernet segment. This is done by having each NVE advertise an Ethernet A-D Route per Ethernet segment for each locally attached segment. Upon a failure in connectivity to the attached segment, the NVE withdraws the corresponding Ethernet A-D route. This triggers all NVEs that receive the withdrawal to update their next-hop adjacencies for all MAC addresses associated with the Ethernet segment in question. If no other NVE had advertised an Ethernet A-D route for the same segment, then the NVE that received the withdrawal simply invalidates the MAC entries for that segment. Otherwise, the NVE updates the next-hop adjacencies to point to the backup NVE(s). 2.3 Split-Horizon Consider a station that is multi-homed to two or more NVEs on an Ethernet segment ES1, with all-active redundancy. If the station sends a multicast, broadcast or unknown unicast packet to a particular NVE, say NE1, then NE1 will forward that packet to all or subset of the other NVEs in the E-VPN instance. In this case the NVEs, other than NE1, that the station is multi-homed to MUST drop the packet and not forward back to the station. This is referred to as "split horizon" filtering. In order to achieve this split horizon function, every multicast, broadcast or unknown unicast packet is encapsulated with an MPLS label that identifies the Ethernet segment of origin (i.e. the segment from which the frame entered the E-VPN network). This label is referred to as the ESI MPLS label, and is distributed using the "Ethernet A-D route per Ethernet Segment". This route is imported by the PEs connected to the Ethernet Segment and also by the PEs that have at least one E-VPN instance in common with the Ethernet Segment in the route. The disposition PEs rely on the value of the ESI MPLS label to determine whether or not a flooded Sajassi et al. Expires April 22, 2013 [Page 5]
INTERNET DRAFT E-VPN Overlay October 22, 2012 frame is allowed to egress a specific Ethernet segment. 2.4 Aliasing In the case where a station is multi-homed to multiple NVEs, it is possible that only a single NVE learns a set of the MAC addresses associated with traffic transmitted by the station. This leads to a situation where remote NVEs receive MAC advertisement routes, for these addresses, from a single NVE even though multiple PEs are connected to the multi-homed segment. As a result, the remote PEs are not able to effectively load-balance traffic among the NVEs connected to the multi-homed Ethernet segment. This could be the case, for e.g. when the PEs perform data-path learning on the access, and the load- balancing function on the station hashes traffic from a given source MAC address to a single PE. Another scenario where this occurs is when the PEs rely on control plane learning on the access (e.g. using ARP), since ARP traffic will be hashed to a single link in the LAG. To alleviate this issue, E-VPN introduces the concept of 'Aliasing'. Aliasing refers to the ability of an NVE to signal that it has reachability to a given locally attached Ethernet segment, even when it has learnt no MAC addresses from that segment. The Ethernet A-D route per EVI is used to that end. Remote PEs which receive MAC advertisement routes with non-zero ESI SHOULD consider the advertised MAC address as reachable via all PEs which have advertised reachability to the relevant Segment using Ethernet A-D routes with the same ESI (and Ethernet Tag if applicable) and with the Active- Standby flag reset. 2.5 DF Election Consider a station that is a host or a VM that is multi-homed directly to more than one NVE in an E-VPN on a given Ethernet segment. One or more Ethernet Tags may be configured on the Ethernet segment. In this scenario only one of the PEs, referred to as the Designated Forwarder (DF), is responsible for certain actions: - Sending multicast and broadcast traffic, on a given Ethernet Tag on a particular Ethernet segment, to the station. - Flooding unknown unicast traffic (i.e. traffic for which an NVE does not know the destination MAC address), on a given Ethernet Tag on a particular Ethernet segment to the station, if the environment requires flooding of unknown unicast traffic. This is required in order to prevent duplicate delivery of multi- destination frames to a multi-homed host or VM, in case of all-active Sajassi et al. Expires April 22, 2013 [Page 6]
INTERNET DRAFT E-VPN Overlay October 22, 2012 redundancy. 3 Encapsulation Options for E-VPN Overlays 3.1 MPLS over GRE The E-VPN data-plane is modeled as an E-VPN MPLS client layer sitting over an MPLS PSN tunnel. The Split-Horizon and Aliasing functions of E-VPN are tied to the MPLS client layer. In order to keep the E-VPN procedures intact and data-plane operation as is, an ideal encapsulation would allow the E-VPN MPLS client layer to be carried over an IP PSN tunnel transparently - i.e., without any changes. The existing standards-based GRE encapsulation as defined by [RFC2890] and [RFC2784] provides such a solution: 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |C| |K|S| Reserved0 | Ver | Protocol Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Key | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ The Key field can be used to provide 32-bit entropy field. The C (Checksum Present) and S (Sequence Number Present) bits in the GRE header are set to zero. The K bit is set to 1. [MPLSoUDP] discusses using a UDP header instead of the GRE header to transport MPLS client layer over an IP PSN tunnel. The main advantage for doing so is for better load-balancing capabilities over existing IP networks, where some core routers can perform ECMP based on the UDP header but not based on the GRE Key field. However, the routers that are capable of supporting [NVGRE] encapsulation, can also perform load-balancing based on the GRE key which accommodates a 32- bit entropy value; whereas, UDP encapsulation accommodates a 16-bit entropy value. 3.1.1 Benefits of MPLS over GRE The benefits of using the MPLS over GRE encapsulation are as follows: - Uses existing standard for transporting MPLS over IP. - Uses E-VPN control plane (BGP routes and attributes), as well as E-VPN procedures and functions exactly as is. - Consistent with L3VPN over IP (RFC 4797) - The MPLS label can be a global value (instead of downstream Sajassi et al. Expires April 22, 2013 [Page 7]
INTERNET DRAFT E-VPN Overlay October 22, 2012 assigned) just like VXLAN or NVGRE service-instance ID. - Provides seamless interoperability with E-VPN PEs. There is no need for a gateway device. 3.2 VXLAN/NVGRE Encapsulation If either the VXLAN or NVGRE encapsulation were to be used with the E-VPN control plane, there will be an impact on the E-VPN client layer and the associated procedures and BGP routes. In order to assess this impact, the first step is to identify which subset of the service interfaces defined in [E-VPN] is needed for the NVO solutions defined in [VXLAN] and [NVGRE]. Then we need to examine how the E-VPN BGP routes and procedures should be modified to support these service interfaces with the new encapsulation. [E-VPN] defines the following four service interface types: - VLAN Based Service Interface - VLAN Bundle Service Interface - Port-based Service Interface - VLAN Aware Bundle Service Interface For a detailed description of these service interface types, refer to [EVPN-REQ] and [E-VPN]. As described in [E-VPN], the first three service interface types don't require encoding the VLAN Tag in the BGP routes, because there is a one-to-one mapping between an EVI and a broadcast domain represented by a virtual network or a virtual segment. [NVGRE] requires only VLAN-based service interface and it clearly describes that the tenant VLAN Tag (inner VLAN Tag) is not part of the encapsulated frames because there is a one-to-one mapping between Virtual Subnet Identifier (VSID) and the inner VLAN ID. The [VXLAN] default mode of operation only requires VLAN-based service interface, as it specifies that the VTEP does not include an inner VLAN tag upon encapsulation; moreover, the decapsulated frames with an inner VLAN tag should get discarded. However, [VXLAN] provides an option of including an inner VLAN tag in the encapsulated packet if it is configured explicitly at the VTEP. If an inner VLAN tag is included, then VXLAN requires a VLAN-bundle service interface. However, as discussed above, this service interface type does not require that the tenant VLAN tag be sent in the BGP routes. 3.2.1 Impact on E-VPN Routes for VXLAN/NVGRE Encapsulation As discussed above, both [NVGRE] and [VXLAN] do not require the Sajassi et al. Expires April 22, 2013 [Page 8]
INTERNET DRAFT E-VPN Overlay October 22, 2012 tenant VLAN tag to be sent in BGP routes. Therefore, the 32-bit Ethernet tag field in the E-VPN BGP routes can be used to represent NVGRE VSID or VXLAN VNI. This is not accidental, but rather by design: The Ethernet Tag field in E-VPN was designed not just for C- tagged or S-tagged interfaces [802.1Q] but also for I-tagged interfaces [802.1ah] where an I-SID is a 24-bit entity representing a virtual segment just like VSID or VNI. Therefore, there is no need to re-purpose the MPLS label field in the E-VPN BGP routes and this field can be omitted in the E-VPN BGP routes. The length field of the NLRI in E-VPN routes will be three octets shorter for VXLAN and NVGRE encapsulations. Since VXLAN VNI or NVGRE VSID is assumed to be a global value, one might question the need for the Route Distinguisher (RD) in the E-VPN routes. In the scenario where all data centers are under a single administrative domain, and there is a single global VNI/VSID space, the RD can be set to zero in the E-VPN routes. However, in the scenarios where different group of data centers are under different administrative domains, and these data centers are connected via one or more backbone core providers as described in [NOV3-Framework], the RD must be a unique value per EVI or per NVE as described in [E-VPN]. In other words, whenever, there is more than one administrative domain for VNI or VSID, then a non-zero RD MUST be used. 3.2.2 Impact on E-VPN Procedures for VXLAN/NVGRE Encapsulation In order to analyze the impact of the VXLAN/NVGRE encapsulation on E- VPN procedures, we must distinguish three NVE redundancy models: - No redundancy - Active/Standby redundancy - All-active redundancy The impact of the encapsulation varies depending on the employed model. 220.127.116.11 NVE with No Redundancy This is the scenario where, for e.g., the NVE is implemented on the hypervisor. In this case, neither the Split-Horizon nor the Aliasing functions are required or applicable. Therefore, the choice of VXLAN/NVGRE encapsulation has no impact on E-VPN procedures. For all practical purposes, in this scenario, the only difference Sajassi et al. Expires April 22, 2013 [Page 9]
INTERNET DRAFT E-VPN Overlay October 22, 2012 between the choice of GRE or VXLAN/NVGRE encapsulation is in the size of the entropy field (32-bits vs. 16 bits). 184.108.40.206 NVE with Active/Standby Redundancy This is the scenario where the hosts are multi-homed to a set of NVEs, however, only a single NVE is active at a given point of time for a given VNI or VSID. In this case as well, the Split-Horizon function is not required. However, in order to support fast convergence in case where the primary NVE fails, the Aliasing function of E-VPN is needed. Note that Aliasing in this scenario is used to quickly identify the backup NVE rather than being used for traffic load-balancing. In this case, the impact of the use of the VXLAN/NVGRE encapsulation on the E-VPN procedures is as discussed in Section 184.108.40.206.2, with the difference being that a remote NVE uses the received Ethernet A-D routes to build primary and backup paths to the advertising NVEs, instead of a load-balancing path-list. If fast convergence is not required or not used, then the VXLAN/NVGRE encapsulation would have no impact on the E-VPN procedures. 184.108.40.206 NVE with All-Active Redundancy Out of the E-VPN features listed in section 2, the use of the VXLAN or NVGRE encapsulation impacts the Split-Horizon and Aliasing features, since those two rely on the MPLS client layer. Given that this MPLS client layer is absent with these types of encapsulations, alternative procedures and mechanisms are needed to provide the required functions. Those are discussed in detail next. 184.108.40.206.1 Split Horizon In E-VPN, an MPLS label is used for split-horizon filtering to support active/active multi-homing where an ingress NV Edge device (NVE) adds a label corresponding to the site of origin (aka ESI MPLS Label) when encapsulating the packet. The egress NVE checks the ESI MPLS label when attempting to forward a multi-destination frame out an interface, and if the label corresponds to the same site identifier (ESI) associated with that interface, the packet gets dropped. This prevents the occurrence of forwarding loops. Since the VXLAN or NVGRE encapsulation does not include this ESI MPLS label, other means of performing the split-horizon filtering function MUST be devised. One way of supporting this function is to assign an IP address for each site of origin (e.g., for each ESI in the E-VPN terminology) and advertise this IP address in the BGP Remote-Next-Hop attribute associated with the E-VPN Ethernet A-D route (refer to section 3.2.3 for details). The "Active-Standby" bit in the flags of Sajassi et al. Expires April 22, 2013 [Page 10]
INTERNET DRAFT E-VPN Overlay October 22, 2012 the ESI MPLS Label Extended Community MUST be set to 0 to indicate active/active multi-homing and the MPLS label field MUST be set to zero to indicate that IP address in the BGP Remote-Next-Hop attribute will be used for split-horizon filtering. The ingress NVE uses the IP address associated with a given site as the source IP address for all traffic originating from said site. The egress NVE will program its egress ACL with this IP address for the interfaces corresponding to that same site. Although the impact in control plane is minimal and the existing E- VPN BGP routes can be used with minimum modifications to its corresponding procedures, the same cannot be said in terms of network operations, management, and data plane. The use of IP addresses to represent the site of origin requires many IP addresses to be allocated and configured on a single NVE. For example a TOR with N interfaces may require one IP address per interface in worst case which may impact management and operational aspects of the Data Center Network. Also, the data-plane operation for Split-Horizon filtering will be different from that of MPLS client layer and it cannot be assumed that platforms/ASICs that support Split-Horizon filtering based on MPLS label can also support such function based on IP addresses. However, there are alternative options for performing such Split-Horizon filtering function when doing VXLAN/NVGRE encapsulation, while retaining a single IP address per NVE, and those will be described in a future revision of this document. It should be noted that such filtering function is not required when doing active/standby multi-homing where load-balancing from a tenant can still be performed on a per VLAN basis - e.g., different VLANs are active on different NVEs connected to a multi-homed site. Furthermore, active/active multi-homing is primarily applicable when NVEs are on physical devices as opposed to on the hypervisor. For example, [VXLAN] describes the use of physical devices as VXLAN gateways to connect a legacy network with a VXLAN overlay network. In such scenarios, one would expect: a) that the number of such gateways is not very large and/or b) that not all of them require active/active multi-homing. 22.214.171.124.2 Aliasing In E-VPN, the NVEs connected to a multi-homed site optionally advertise a VPN label used to load-balance traffic between NVEs, even when a given MAC address is learnt by only a single NVE connected to the site. In the case where VXLAN or NVGRE encapsulation is used, some alternative means that does not rely on MPLS labels is required to support aliasing. One solution would be to rely on the IP address per site assignment depicted in the previous section for aliasing as well: Effectively every NVE advertises an Ethernet A-D route for a Sajassi et al. Expires April 22, 2013 [Page 11]
INTERNET DRAFT E-VPN Overlay October 22, 2012 given site with the BGP Remote-Next-Hop attribute set to an IP address that has a 1:1 mapping to the site. The remote NVEs resolve an ESI (site ID) to a list of IP addresses corresponding to that site. Furthermore, a given MAC address that is associated with an ESI, in turn, gets resolved to this list of IP addresses. When a remote NVE wants to forward a packet for a given MAC address, it selects one of IP addresses from the list (using a hash value for load balancing) and encapsulates the packet using that IP address as the destination IP address in the VXLAN or NVGRE encapsulation. The source IP address will be that of the source multi-homed site. In case where the source site is single homed, the source IP address will be the loopback address of the NVE. 18.104.22.168.3 Tunnel Endpoint Identification To accommodate the Split Horizon as well as Aliasing functions of E- VPN, multiple IP tunnel endpoints (one per site) must be associated with the same NVE. As such, the mechanisms of [RFC5512] cannot be used to specify the tunnel endpoint and encapsulation, since those mechanisms only allow a single tunnel endpoint IP address to be associated with the BGP speaker. To alleviate this, the BGP Remote- Next-Hop attribute defined in [REMOTE-NH] can be used. Two new Tunnel Types would be required for VXLAN and NVGRE. This attribute will be carried with the E-VPN Ethernet A-D route. The IP address field of this attribute serves two functions: - It indicates the tunnel endpoint destination IP address that must be used when load-balancing traffic associated with a given site (i.e. ESI). - It is used to build the egress ACL for filtering multi-destination traffic on multi-homed Ethernet Segments. In this context, the IP address is the tunnel endpoint source address. It is worth noting that for multi-homed Ethernet segments, the NVE will always advertise an Ethernet A-D route with the Remote-Next-Hop attribute, in addition to the MAC Advertisement routes. In this case, the NVEs which receive the routes derive the tunnel endpoint IP address for a given MAC address as follows: 1- The NVE identifies the Ethernet Segment Identifier (ESI) associated with the MAC address, as encoded in the MAC Advertisement route. 2- The NVE then sets the tunnel endpoint IP address for that MAC to the value encoded in the Remote-Next-Hop attribute of the Ethernet AD Sajassi et al. Expires April 22, 2013 [Page 12]
INTERNET DRAFT E-VPN Overlay October 22, 2012 route advertised for the ESI identified in step 1. On the other hand, for single-homed Ethernet segments, the NVE will only advertise the MAC Advertisement routes. In this latter case, the tunnel endpoint IP address is derived from the BGP Next-Hop attribute associated with the MAC Advertisement route. 3.2.3 Support for Multicast The E-VPN Inclusive Multicast BGP route can be used to discover the multicast endpoints associated with a given VXLAN VNI or NVGRE VSID. The Ethernet Tag field of this route is used to encode the VNI or VSID. This route is tagged with the PMSI Tunnel attribute, which is used to encode the type of multicast tunnel to be used as well as the multicast tunnel identifier. The following tunnel types can be used for VXLAN/NVGRE: - PIM-SSM Tree - PIM-SM Tree - BIDIR-PIM Tree - Ingress Replication In the scenario where the multicast tunnel is a tree, both the Inclusive as well as the Aggregate Inclusive variants may be used. In the former case, a multicast tree is dedicated to a VNI or VSID. Whereas, in the latter, a multicast tree is shared among multiple VNIs or VSIDs. This is done by having the NVEs advertise multiple Inclusive Multicast routes with different VNI or VSID encoded in the Ethernet Tag field, but with the same tunnel identifier encoded in the PMSI Tunnel attribute. 3.2.4 Inter-AS Challenges For inter-AS operation, two scenarios must be considered: - Scenario 1: The tunnel endpoint IP addresses are public - Scenario 2: The tunnel endpoint IP addresses are private In the first scenario, inter-AS operation is straight-forward and follows existing BGP inter-AS procedures. The second scenario is more challenging, because the absence of the MPLS client layer from the VXLAN encapsulation creates a situation where the ASBR has no fully qualified indication within the tunnel header as to where the tunnel endpoint resides. To elaborate on this, recall that with MPLS, the client layer labels (i.e. the VPN labels) are downstream assigned. As such, this label implicitly has a connotation of the tunnel endpoint, and it is sufficient for the ASBR Sajassi et al. Expires April 22, 2013 [Page 13]
INTERNET DRAFT E-VPN Overlay October 22, 2012 to look up the client layer label in order to identify the label translation required as well as the tunnel endpoint to which a given packet is being destined. With the VXLAN encapsulation, the VNI is globally assigned and hence is shared among all endpoints. The destination IP address is the only field which identifies the tunnel endpoint in the tunnel header, and this address is privately managed by every data center network. Since the tunnel address is allocated out of a private address pool, then we either need to do a lookup based on VTEP IP address in context of a VRF (e.g., use IP-VPN) or terminate the VXLAN tunnel and do a lookup based on the tenant's MAC address to identify the egress tunnel on the ASBR. This effectively mandates that the ASBR to either run another overlay solution such as IP-VPN over MPLS/IP core network or to be aware of the MAC addresses of all VMs in its local AS, at the very least. Even in the first scenario where the tunnel endpoint IP addresses are public, there may be security concern regarding the distribution of these addresses among different ASes. This security concern is one of the main reasons for having the so called inter-AS "option-B" in MPLS VPN solutions such as E-VPN. Using MPLS over GRE encapsulation addresses both of these concerns. 4 Comparison between MPLSoGRE and VXLAN/NVGRE Encapsulation The comparison between MPLSoGRE and VXLAN/NVGRE encapsulation depends on the required functionality on NVEs. If the hosts are single-homed to NVEs without any need to support redundancy group on NVEs, or if the hosts are multi-homed to two or more NVEs with active/standby redundancy but without the need for fast convergence upon a failure, then both MPLSoGRE and VXLAN/NVGRE do equally well with E-VPN control plane. If we need to support active/standby multi-homing with fast convergence upon a failure or if we need to support active/active multi-homing, then MPLSoGRE encap can provide these additional functionality without any impact to E-VPN routes and procedures. Furthermore, it can provide complete support for inter-AS operation and complete set of E-VPN functions without impacting IP address assignment and management of the underlying network. However, VXLAN/NVGRE impacts E-VPN routes and procedures as well as the underlying data plane behavior as noted above. Furthermore, there are implications to IP address assignments, security, and inter-AS operations. It should be noted that the additional requirements on the data plane behavior as well as the above implications are the consequence of the functionality that need to be supported and Sajassi et al. Expires April 22, 2013 [Page 14]
INTERNET DRAFT E-VPN Overlay October 22, 2012 independent of the control-plane choice. As noted previously, there are existing core switches that do not support ECMP by hashing the GRE key; however, vast majority of existing core switches support ECMP by hashing UDP header; therefore, VXLAN encapsulation can provide better ECMP functions for these existing switches. Thus, the choice for overlay encapsulation depends on needed functionality, inter-AS scenarios, security requirements, and the ECMP capabilities of the core switches. 5 Acknowledgement The authors would like to thank John Mullooly and Dave Smith for providing value comments and feedbacks. 6 Security Considerations 7 IANA Considerations 8 References 8.1 Normative References [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [REMOTE-NH] Van de Velde et al., "BGP Remote-Next-Hop", draft- vandevelde-idr-remote-next-hop-01.txt, work in progress, July 2012. 8.2 Informative References [NVGRE] Sridhavan, M., et al., "NVGRE: Network Virtualization using Generic Routing Encapsulation", draft-sridharan-virtualization-nvgre- 01.txt, July 8, 2012. [VXLAN] Dutt, D., et al, "VXLAN: A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks", draft- mahalingam-dutt-dcops-vxlan-02.txt, August 22, 2012. [E-VPN] Sajassi et al., "BGP MPLS Based Ethernet VPN", draft-ietf- l2vpn-evpn-01.txt, work in progress, February, 2012. Sajassi et al. Expires April 22, 2013 [Page 15]
INTERNET DRAFT E-VPN Overlay October 22, 2012 [Problem-Statement] Narten et al., "Problem Statement: Overlays for Network Virtualization", draft-ietf-nvo3-overlay-problem-statement- 00, September 2012. [L3VPN-ENDSYSTEMS] Marques et al., "BGP-signaled end-system IP/VPNs", draft-ietf-l3vpn-end-system, work in progress, October 2012. Authors' Addresses Ali Sajassi Cisco Email: email@example.com Samer Salam Cisco 595 Burrard Street Vancouver, BC V7X 1J1, Canada Email: firstname.lastname@example.com Keyur Patel Cisco 170 West Tasman Drive San Jose, CA 95134, US Email: firstname.lastname@example.com Nabil Bitar Verizon Communications Email : firstname.lastname@example.com Wim Henderickx Alcatel-Lucent Email: email@example.com Sajassi et al. Expires April 22, 2013 [Page 16]


text:
Next Search Archive Previous
Sep 7, 2005
Penguinus Maximus: Thawing
This creature isn't entirely fictional, other than maybe the thawing back to life part, his size is exaggerated a bit, and I don't believe Penguinis Maximus was an official scientific name. But there were in fact prehistoric penguins. From fossil findings they stood nearly six feet tall and weighed in at up to 300 pounds.