Because of the transport-independent nature of NSH-based service function chains, it is expected that the NSH has broad applicability across different network domains (e.g., access, core). By way of illustration, the various SFs involved in a service function chain may be available in a single data center or spread throughout multiple locations (e.g., data centers, different Points of Presence (POPs)), depending upon the network operator preference and/or availability of service resources. Regardless of where the SFs are deployed, it is necessary to provide traffic steering through a set of SFFs, and when NSH and SR are integrated, this is provided by SR-MPLS or SRv6.
The following three figures provide an example of an SFC-established flow F that has SF instances located in different data centers, DC1 and DC2. For the purpose of illustration, let the SFC's NSH SPI be 100 and the initial Service Index (SI) be 255.
Referring to
Figure 1, packets of flow F in DC1 are classified into an NSH-based service function chain, encapsulated after classification as <Inner Pkt><NSH: SPI 100, SI 255><Outer-transport>, and forwarded to SFF1 (which is the first SFF hop for this service function chain).
After removing the outer transport encapsulation, SFF1 uses the SPI and SI carried within the NSH encapsulation to determine that it should forward the packet to SF1. SF1 applies its service, decrements the SI by 1, and returns the packet to SFF1. Therefore, SFF1 has <SPI 100, SI 254> when the packet comes back from SF1. SFF1 does a lookup on <SPI 100, SI 254>, which results in <next-hop: DC1-GW1> and forwards the packet to DC1-GW1.
+--------------------------- DC1 ----------------------------+
| +-----+ |
| | SF1 | |
| +--+--+ |
| | |
| | |
| +------------+ | +------------+ |
| | N(100,255) | | | N(100,254) | |
| +------------+ | +------------+ |
| | F:Inner Pkt| | | F:Inner Pkt| |
| +------------+ ^ | | +------------+ |
| (2) | | | (3) |
| | | v |
| (1) | (4) |
|+------------+ ----> +--+---+ ----> +---------+ |
|| | NSH | | NSH | | |
|| Classifier +------------+ SFF1 +--------------+ DC1-GW1 + |
|| | | | | | |
|+------------+ +------+ +---------+ |
| |
| +------------+ +------------+ |
| | N(100,255) | | N(100,254) | |
| +------------+ +------------+ |
| | F:Inner Pkt| | F:Inner Pkt| |
| +------------+ +------------+ |
| |
+------------------------------------------------------------+
Referring now to
Figure 2, DC1-GW1 performs a lookup using the information conveyed in the NSH, which results in <next-hop: DC2-GW1, encapsulation: SR>. The SR encapsulation, which may be SR-MPLS or SRv6, has the SR segment list to forward the packet across the inter-DC network to DC2.
+----------- Inter DC ----------------+
(4) | (5) |
+------+ ----> | +---------+ ----> +---------+ |
| | NSH | | | SR | | |
+ SFF1 +----------|-+ DC1-GW1 +-------------+ DC2-GW1 + |
| | | | | | | |
+------+ | +---------+ +---------+ |
| |
| +------------+ |
| | S(DC2-GW1) | |
| +------------+ |
| | N(100,254) | |
| +------------+ |
| | F:Inner Pkt| |
| +------------+ |
+-------------------------------------+
When the packet arrives at DC2, as shown in
Figure 3, the SR encapsulation is removed, and DC2-GW1 performs a lookup on the NSH, which results in next hop: SFF2. When SFF2 receives the packet, it performs a lookup on <NSH: SPI 100, SI 254> and determines to forward the packet to SF2. SF2 applies its service, decrements the SI by 1, and returns the packet to SFF2. Therefore, SFF2 has <NSH: SPI 100, SI 253> when the packet comes back from SF2. SFF2 does a lookup on <NSH: SPI 100, SI 253>, which results in the end of the service function chain.
+------------------------ DC2 ----------------------+
| +-----+ |
| | SF2 | |
| +--+--+ |
| | |
| | |
| +------------+ | +------------+ |
| | N(100,254) | | | N(100,253) | |
| +------------+ | +------------+ |
| | F:Inner Pkt| | | F:Inner Pkt| |
| +------------+ ^ | | +------------+ |
| (7) | | | (8) |
| | | v |
(5) | (6) | (9) |
+---------+ ---> | +----------+ ----> +--+---+ ----> |
| | SR | | | NSH | | IP |
+ DC1-GW1 +--------|-+ DC2-GW1 +------------+ SFF2 | |
| | | | | | | |
+---------+ | +----------+ +------+ |
| |
| +------------+ +------------+ |
| | N(100,254) | | F:Inner Pkt| |
| +------------+ +------------+ |
| | F:Inner Pkt| |
| +------------+ |
+---------------------------------------------------+
The benefits of this scheme are listed hereafter:
-
The network operator is able to take advantage of the transport-independent nature of the NSH encapsulation while the service is provisioned end-to-end.
-
The network operator is able to take advantage of the traffic-steering (traffic-engineering) capability of SR where appropriate.
-
Clear responsibility division and scope between the NSH and SR.
Note that this scenario is applicable to any case where multiple segments of a service function chain are distributed across multiple domains or where traffic-engineered paths are necessary between SFFs (strict forwarding paths, for example). Further, note that the above example can also be implemented using end-to-end segment routing between SFF1 and SFF2. (As such, DC-GW1 and DC-GW2 are forwarding the packets based on segment routing instructions and are not looking at the NSH header for forwarding.)