SRH Reduction for SRv6 End.M.GTP6.E Behavior

Introduction Segment Routing over IPv6 for the Mobile User Plane defines interworking between SRv6 networks and GTP-U networks including required behaviors such as End.M.GTP6.E. This End.M.GTP6.E behavior converts SRv6 packets to GTP-U packets for downlink (DL) traffic at an egress MUP-PE when a gNB uses IPv6/GTP-U. In the End.M.GTP6.E behavior, an ingress MUP-PE requires two SIDs in an SRH with the remote endpoint information (IP address and TEID) in separate locations within the SRH and an egress MUP-PE also needs to fetch the last SID next to the active SID before outer IPv6 and SRH decapsulation to restore the IPv6/GTP-U header from those SIDs, in which current hardware pipelines may be unfamiliar or insufficient to implement. This document specifies a new behavior named End.M.GTP6.E.Red which makes End.M.GTP6.E behavior more hardware-friendly by encoding the required information in a single SID. This behavior uses an Interwork Segment Discovery (ISD) Route and Type 1 Session Transformed (ST) Route of MUP SAFI , specified in to reconstruct the gNB IPv6 address from the End.M.GTP6.E.Red SID and a locally maintained mapping.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology Terminology used in this document is given by and .

End.M.GTP6.E.Red Behavior End.M.GTP6.E.Red (Endpoint Behavior with encapsulation for IPv6/GTP-U tunnel with reduced SRH) is used in the interworking scenarios described in for the downlink toward a legacy gNB using IPv6/GTP-U. depicts a topology used for the example. This topology is the same as Figure 4 described in Section 5.3 of but terminology has been adapted from .

Example Topology for Interworking In this topology, the following addressing parameters are assumed:

The prefix length of the Interwork Segment, that is, actual RAN IP Prefix is 'a'.
The length of the LOC+FUNC field of the SID for End.M.GTP6.E.Red behavior on the Egress PE is 'b'.

shows the relationship between RAN IP Prefix, gNB address and End.M.GTP6.E.Red SID.

Relationship between RAN IP Prefix and gNB address and SID in the case of a < b+40 In one deployment scenario, the length of actual RAN IP Prefix can be 64 bits (a=64) or shorter (a<64) and the length of SRGW-IPv6-LOC-FUNC can be 48 bits (b=48) in both cases of full SID and uSID. These are given by the addressing design of the RAN and the SRv6 domain. In this case, the stuff field is 24 bits (or more) and then, the prefix length of advertised RAN IP Prefix (the NLRI in the ISD Route) is 88 bits.

Control Plane Specification

Egress PE If a is less than b+40, the Egress PE constructs an advertised RAN IP Prefix of length b+40 bits by appending the next b+40-a bits (stuff field) of the gNB's IPv6 address to the actual RAN IP Prefix. Otherwise, the actual RAN IP Prefix is used as the advertised RAN IP Prefix without modification. The Egress PE allocates an End.M.GTP6.E.Red SID prefix, consisting of a b-bit SRGW-IPv6-LOC-FUNC field, for each advertised RAN IP Prefix. The Egress PE maintains a mapping between each allocated SID prefix and its corresponding advertised RAN IP Prefix. This mapping is used to reconstruct the destination IPv6 address of the gNB during End.M.GTP6.E.Red processing. The Egress PE MUST advertise an Interwork Segment Discovery (ISD) Route whose NLRI contains the advertised RAN IP Prefix with the corresponding SID information.

Ingress PE The Ingress PE receives a Type 1 Session Transformed (ST) Route for the UE from the MUP Controller and an ISD Route for the gNB from the Egress PE. When the Type 1 ST Route can be resolved using the advertised RAN IP Prefix in the NLRI field of the ISD Route, the Ingress PE MUST construct a 128-bit End.M.GTP6.E.Red SID by concatenating the following fields:

The b-bit SRGW-IPv6-LOC-FUNC field obtained from the SID information associated with the ISD Route.
The 40-bit Args.Mob.Session field, constructed from the TEID and QFI fields of the Type 1 ST Route, as specified in .
The least significant 128-b-40 bits of the gNB IPv6 address carried in the Endpoint Address field of the Type 1 ST Route.

The Ingress PE then uses the constructed SID as the H.Encaps(.Red) behavior SID for the host route of the corresponding UE.

Data Plane Specification

Ingress PE When the Ingress PE receives a packet destined for the UE and finds the corresponding route in the FIB, it performs the encapsulation behavior associated with that route.

Egress PE When Egress PE node N receives a packet destined to D, and D is a local End.M.GTP6.E.Red SID, N does the following: When processing the Upper-Layer header of a packet matching a FIB entry locally instantiated as an End.M.GTP6.E.Red SID, N does the following: Notes:

The source address S SHOULD be an End.M.GTP6.D SID instantiated at N or an IPv6 address of the UPF.
The higher b+40 bits of the IPv6 DA can be restored from the advertised RAN IP Prefix corresponding to the SID in the mapping, and the lower 128-40-b bits can be restored from the remainder bits of the End.M.GTP6.E.Red SID.
The GTP-U TEID is restored from the Args.Mob.Session field in the SID as defined in .

Security Considerations The security considerations for Segment Routing and SRv6 described in and apply to the behavior specified in this document. The End.M.GTP6.E.Red behavior reconstructs the destination IPv6 address of a GTP-U tunnel using information encoded in the received SRv6 SID and a locally maintained mapping between SID prefixes and advertised RAN IP Prefixes. The GTP-U TEID is extracted from the Args.Mob.Session field of the received SID. An attacker capable of injecting packets containing unauthorized End.M.GTP6.E.Red SIDs into the SR domain could potentially cause packets to be forwarded to unintended GTP-U endpoints or tunnels. Therefore, access to End.M.GTP6.E.Red SIDs needs to be restricted to authorized traffic within the SR domain, consistent with the security mechanisms described in . The correctness of the destination address reconstruction depends on the integrity of the control-plane information used to establish the SID-to-RAN-prefix mappings. Unauthorized modification of this information could cause packets to be forwarded to incorrect destinations. Deployments need to protect the distribution and installation of these mappings using the security mechanisms applicable to the underlying control-plane protocols.

IANA Considerations The following values have been allocated in the "SRv6 Endpoint Behaviors" subregistry within the top-level "Segment Routing Parameters" registry: New SRv6 Mobile User-plane Endpoint Behavior Types

Value	Hex	Endpoint behavior	Reference
168	0x00a8	End.M.GTP6.E.Red	This.ID

IANA is requested to update the Reference field for this allocation to refer to this document upon its publication as an RFC.