]> China Telecom

Beiqijia Town, Changping District Beijing Beijing 102209 China weiwang94@foxmail.com

China Telecom

Beiqijia Town, Changping District Beijing Beijing 102209 China wangaj3@chinatelecom.cn

Huawei Technologies

Huawei Building, No.156 Beiqing Rd. Beijing Beijing 100095 China rainsword.wang@huawei.com

Verizon Inc.

13101 Columbia Pike Silver Spring MD 20904 United States of America gyan.s.mishra@verizon.com

Huawei Technologies

Huawei Building, No.156 Beiqing Rd. Beijing Beijing 100095 China jie.dong@huawei.com

RTG Area IDR Working Group RFC This draft defines a new type of Outbound Route Filter (ORF), known as the Virtual Private Network (VPN) Prefix ORF. The VPN Prefix ORF mechanism is applicable when VPN routes from different Virtual Routing and Forwarding (VRF) instances are exchanged through a single shared Border Gateway Protocol (BGP) session.The purpose of VPN Prefix ORF mechanism is to control the overload of VPN routes based on RT. With this mechanism, the overload can be limited within the minimum range.

BGP Maximum Prefix feature is often used at the network boundary to control the number of prefixes to be injected into the network. But for some scenarios when the VPN routes from several VRFs are advertised via one shared BGP session, there is lack of appropriate methods to control the flooding of VPN routes within one VRF to avoid overwhelming the processing of VPN routes in other VRFs, which consequently affects the route processing performance of other VRFs (such as route dropping, processing delays, and abnormal customer services). Therefore, it is desirable that the excessive VPN routes advertisement be controlled individually for each VRF in such a shared BGP session. There are several solutions that can be used to alleviate this problem: Route Target Constraint (RTC) as defined in Address Prefix ORF as defined in Covering Prefixes Outbound Route Filter (CP-ORF) mechanism as defined in Provider Edge (PE) - Customer Edge (CE) edge peer Maximum Prefix Configuring the Maximum Prefix for each VRF on edge nodes However, each existing solution has its own limitation as described in Section 4. This draft defines a new type of Outbound Route Filter (ORF), called the VPN Prefix ORF. This ORF mechanism is event-driven and does not require pre-configuration. When the number of VPN routes in a VRF exceeds the prefix limit, the router will identify the VPN prefix (Route Distinguisher (RD), Route Target (RT), source PE, etc.) of the overload VPN routes in this VRF and send a VPN Prefix ORF message to its BGP peer, who announced these overload routes. Upon receiving a VPN Prefix ORF entry from its BGP peer, the BGP speaker will filter and withdraw any overload VPN routes that was announced to its peer. The purpose of this mechanism is to control the overload within the minimum range and avoid route churn effects when a VRF on a device in the network overflows. VPN Prefix ORF is applicable when the VPN routes from different VRFs are exchanged via one shared BGP session.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The following terms are used in this draft: AFI: Address Family Identifier, defined in ASBR: Autonomous System Border Router. BGP: Border Gateway Protocol, defined in EVPN: BGP/MPLS Ethernet VPN, defined in MPLS: Multi-Protocol Label Switching. ORF: Outbound Route Filter, defined in Quota: A threshold to limit the number of VPN routes under specific granularities (such as <PE>, <RD, Source AS>). RD: Route Distinguisher, defined in RIB: Routing Information Base. RR: Route Reflector, provides a simple solution to the problem of IBGP full mesh connection in large-scale IBGP implementation RT: Route Target, defined in SAFI: Subsequent Address Family Identifier, defined in VPN: Virtual Private Networks, defined in VRF: Virtual Routing Forwarding, a virtual routing table based on VPN instance.

RTC can only filter the VPN routes from any uninterested VRFs, if the route overload comes from an interested VRF, the RTC mechanism can't filter them.

Using Address Prefix ORF to filter VPN routes requires a pre-configuration, but it is impossible to know in advance which prefix may exceed the predefined threshold.

defines the Covering Prefixes ORF (CP-ORF). A BGP speaker sends a CP-ORF to a peer in order to pull routes that cover a specified host address. A prefix covers a host address if it can be used to forward traffic towards that host address. CP-ORF is applicable in Virtual Hub-and-Spoke VPN and also BGP/MPLS Ethernet VPN (EVPN) networks, but its primary function is to retrieve interested VPN prefixes and it cannot be used to filter overload of VPN prefixes dynamically.

The BGP Maximum-Prefix feature is used to control how many prefixes can be received from a neighbor. By default, this feature allows a router to drop overloading routes or bring down a peer when the number of received prefixes from that peer exceeds the configured Maximum-Prefix limit. This feature is commonly used for external BGP peers. If it is applied to internal BGP peers, for example the VPN scenarios, all the VPN routes from different VRFs will share the common fate. If the number of VPN routes of a certain VPN exceeds the configured Maximum-Prefix limit, the overloading VPN routes will be dropped, or BGP session will be shut down, which will affect the operation of other VPN routes transmitted via this BGP session. If Maximum Prefix is configured on every PE-CE link, it can prevent VPN route overflow. However, reliance solely on the sender side for protection is insufficient; if the sender has not configured Maximum Prefix, the VPN Prefix ORF mechanism can still prevent VPN route overflow from occurring.

When a VRF overflows, some implementations may stops the import of routes. Any additional VPN routes are held into its Routing Information Base (RIB). However, PEs still need to parse the incoming BGP messages. This will cost CPU cycles and further burden the overflowed PE. The VPN Prefix ORF mechanism improves upon this by enabling the overloaded PE to signal the specific offending routes back to the sender, which can then suppress them at the source—eliminating wasted processing and preserving resources for healthy VRFs.

In this section, we describe the encoding of VPN Prefix ORF entries. The VPN Prefix ORF entries are carried in the BGP ROUTE-REFRESH message as defined in . A BGP ROUTE-REFRESH message can carry one or more ORF entries. The format of a ROUTE-REFRESH message which carries VPN Prefix ORF entries are as follows: AFI (2 octets). The AFI MUST be set to IPv4, IPv6, or Layer 2 VPN (L2VPN). SAFI (1 octet). If the AFI is set to IPv4 or IPv6, the SAFI MUST be set to MPLS-labeled VPN address. If the AFI is set to L2VPN, the SAFI MUST be set to BGP EVPN. It is applicable for all types of EVPN routes as mentioned in . When-to-refresh (1 octet): the value is IMMEDIATE or DEFER. ORF Type (1 octet): The type of VPN Prefix ORF is 66. Length of ORF entries (2 octets) A VPN Prefix ORF entry contains a common part and type-specific part. The encoding of the common part is shown in Figure 4.

Action (2 bits): the value is ADD, REMOVE or REMOVE-ALL. Match (1 bit): the value is PERMIT or DENY Overload VPN routes process method (1 bit): if the value is set to 0, it means all overload VPN routes on the sender of VPN Prefix ORF message SHOULD be withdrawn; if the value is set to 1, it means the sender of VPN Prefix ORF message refuse to receive new overload VPN routes. The default value is 0. Reserved (4 bits) VPN Prefix ORF also contains type-specific part. The encoding of the type-specific part is shown in Figure 5.

Sequence: identifying the order in which VPN Prefix ORF is generated and evaluated. It can uniquely identify a VPN Prefix ORF entry together with AFI/SAFI, ORF-Type, and Route Distinguisher. The sequence numbers SHOULD be discontinuous to facilitate the insertion of new rules at a later stage. Length: identifying the length of this VPN Prefix ORF entry. Route Distinguisher: distinguish the different user routes. The VPN Prefix ORF filters the VPN routes it tends to send based on Route Distinguisher. If RD is equal to 0, it means all VPN prefixes. Optional TLVs: carry the potential additional information to give the extensibility of the VPN Prefix ORF mechanism. Its format is shown in Figure 6. If one or more TLV(s) are unrecognized, the whole VPN Prefix ORF entry SHOULD be removed.

Note that if the Action component of an ORF entry specifies REMOVE-ALL, the ORF entry does not include the type-specific part. When the BGP ROUTE-REFRESH message carries VPN Prefix ORF entries, it MUST be set as follows: The ORF-Type MUST be set to 66 (VPN Prefix ORF). The purpose of VPN Prefix ORF is to block unwanted VPN prefixes, then the "action" of one valid entry SHOULD be set to "DENY". In order to allow other allowed VPN prefixes pass the filter, one default, last resort entry SHOULD be installed in advance in the VPN Prefixes ORF table, with the RD is set to 0 and the corresponding Sequence are set to 0xFFFFFFFF. According to , if any of the fields of a VPN Prefix ORF entry in the message contains an unrecognized value, the whole specified ORF previously received is removed. A BGP speaker that is willing to receive ORF entries from its peer, or a BGP speaker that would like to send ORF entries to its peer, advertises this capability to the peer by using the Outbound Route Filtering Capability defined in .

Source PE TLV is defined to identify the source of the VPN routes. For the sender of VPN Prefix ORF, it will check the existence of SPE EC on the VPN route being matched. If it exists, the sender will put it into Source PE TLV. Otherwise, the value of Source PE TLV SHOULD be set to next hop address. The Source PE TLV SHOULD only appear once within an individual ORF entry. If one ORF entry contains multiple Source PE TLVs, all MUST be ignored. The source PE TLV contains the following types: IPv4 Source PE TLV: Type = 1, Length = 4 octets, value = next hop address in IPv4 format. IPv6 Source PE TLV: Type = 2, Length = 16 octets, value = next hop address in IPv6 format (only global IPv6 address). Source PE identifier TLV: Type = 3, Length = 4 octets, value = the value of ORIGINATOR_ID in Source PE Extended Community.

Source AS TLV is defined to identify the source AS number of source PE. It is only required in inter-domain scenario. The Source AS TLV SHOULD only appear once within an individual ORF entry. If one ORF entry contains multiple Source AS TLVs, it SHOULD be ignored. The encoding of Source AS TLV is as follows: Type = 4, Length = 4 octets, value = the value of Source AS in Source AS Extended Community as defined in .

Route Target TLV is defined to identify the RT of the overload VPN routes. RT and RD can be used together to filter VPN routes when the source VRF contains multiple RTs, and the VPN routes with different RTs MAY be assigned to different VRFs on the receiver. If this TLV contains only one RT but multiple RTs are configured on the VPN route, the device should check whether the RT included in this TLV exists among the multiple RTs configured on the VPN route. If it exists, the device should filter out the VPN route. The Route Target TLV contains the following types: Type = 5, Length = 8*n (n is the number of RTs that the overload VPN routes attached) octets, value = the RT of the overload VPN routes. If multiple RTs are included, there MUST be an exact match.

The operation of VPN Prefix ORF mechanism on each device is independent, each of them makes a local judgment to determine whether it needs to send a VPN Prefix ORF message to its upstream peer. Operators can configure the algorithms in the devices according to their own circumstances. This section describes the procedures for the receiving BGP peer to receive VPN route information from the sending BGP peer. The VPN information includes updated VPN routes and their corresponding VPN instance identification information. Based on the VPN instance identification information, the receiving BGP peer determines the newly added VPN routes. It then checks whether the number of newly added VPN routes has caused the total number of VPN routes to exceed the maximum route limit for the associated VPN instance. If the route limit of the VPN instance, which is identified by the VPN instance identification information, is reached or exceeded, the receiving BGP peer will send a VPN Prefix ORF message to the sending BGP peer, indicating that it should stop sending the corresponding VPN routes which are identified by the VPN instance identification information. Before originating a VPN Prefix ORF message, the device SHOULD compare the list of RTs carried by VPN routes with those imported by other VRFs on the device. If the route's RT is included in the import rules of other VRFs, the VPN Prefix ORF message MUST NOT be originated. Before sending a VPN Prefix ORF entry, a sender SHOULD send a "default" entry to the VPN Prefix ORF receiver, to allow other allowed VPN prefixes to pass the filter. The "default" entry should be installed in advance in the VPN Prefixes ORF table, with the overload VPN routes process method set to 0, sequence set to 0xFFFFFFFF, length set to 8, and Route Distinguisher set to 0. The receiving BGP peer and the sending BGP peer are iBGP peers within the same Autonomous System (AS). The VPN instance identification information is RD and the instruction information is sent using ORF in the ROUTE-REFRESH message. The instruction information sent from the receiving BGP peer includes the following information: The ORF entries that are included in the ROUTE-REFRESH message. The Action field in the ORF entries is set to a value that instructs the sending BGP peer to add the corresponding filter condition to its outbound route filter. The Match field in the ORF entries is set to a value that instructs the sending BGP peer to deny VPN routes updates that match the corresponding ORF entries. The RD value that identifies the above mentioned VPN instance is added to the type-specific part of the ORF entries. When multiple VRFs on a PE are receiving VPN routes with a specific RD, if one VRF exceeds its limit upon receiving routes with that RD, then the PE sends a VPN Prefix ORF message, which will prevent other VRFs that have not exceeded their limits from receiving VPN routes containing that RD, thereby avoiding any communication disruptions between these VRFs and the rejected VPN routes. In order to more finely control VPN routing, when not all VRFs on a PE that are interested in VPN routes with a specific RD exceed the limit, the PE MUST NOT send a VPN Prefix ORF entry. When the VPN Prefix ORF mechanism is triggered, the device SHOULD send an alarm information to network operators. The procedures for senders of VPN Prefix ORF entries are described below:

tuples from the newly received routes that belong to VRF v. // Check if any RT in RT_set is also imported by another VRF that has NOT exceeded its limit S05. conflict_exists = FALSE; S06. For each RT r in RT_set { S07. For each other VRF u on this device { S08. If (r is in the import RT list of VRF u) AND (prefix count of VRF u <= its prefix limit) { S09. conflict_exists = TRUE; S10. } S11. } S12. } S13. If (conflict_exists == TRUE) { S14. // Cannot send ORF: would block routes needed by healthy VRFs S15. Send warning message to the operator. S16. } S17. // Safe to send ORF entries S18. For each in overload_RD_source_pairs { S19. Collect all RTs carried by routes with RD=RD_x from source PE_y that are imported into VRF v ? RT_list. S20. Construct a VPN Prefix ORF entry with: S21. Action = ADD, S22. Match = DENY, S23. Overload VPN routes process method = 0, S24. Sequence = generate unique sequence number, S25. Route Distinguisher = RD_x, S26. Optional TLVs include: S27. Source PE TLV = PE_y, S28. Route Target TLV = RT_list. S29. Send a BGP ROUTE-REFRESH message containing this ORF entry to the upstream BGP peer (e.g., RR). S30. Send an alarm message to the operator indicating VRF v overflow and ORF transmission. S31. } S32. } Else { S33. // No overflow in this VRF; no ORF triggered S34. Continue normal route processing. S35. } S36. }]]>

For intra-AS VPN deployment, there are two scenarios: unique RD (per VPN, per PE). the same RD (per VPN, same on all PEs) The detailed descriptions about the above solutions are in Appendix B.

The VPN Prefix ORF is used mainly to block the unwanted BGP updates. When the receiver receives VPN Prefix ORF entry, it MUST check first whether the "Match" bit is "DENY" or not. If the "Match" bit is "PERMIT", and is the "default" entry (the overload VPN routes process method equal to 0, sequence equal to 0xFFFFFFFF, length is equal to 8, and Route Distinguisher is equal to 0), the entry SHOULD be installed. Otherwise, if the "Match" bit is "PERMIT", the entry MUST be discarded and a warning MUST be sent to the operator. The following procedures will only be evaluated when the "Match" bit is "DENY". The receiver of VPN Prefix ORF entries, which may be a RR, ASBR or PE, when receives VPN Prefix ORF entry from its BGP peer, it does the following:

of the received VPN Prefix ORF entry. S02. If (the combination does not already exist in the ORF-Policy table) { S03. The receiver adds the VPN Prefix ORF entry to the ORF-Policy table. S04. } else if (Action is ADD) { S05. Overwrite the old VPN Prefix ORF entry with the new one. S06. } else if (Action is REMOVE) { S07. The corresponding VPN Prefix ORF entries should be removed from the ORF-Policy table. S07. } else { Remove all VPN Prefix ORF entries SHOULD be removed from the ORF-Policy table. S08. } ]]>

The filtering conditions for the stored VPN Prefix ORF entries contain the RD and RT of the source PE. If the SPE EC is not attached to the BGP Update message of the VPN prefixes, the receiver MUST use NEXT_HOP or ORIGINATOR_ID as the originator of VPN Prefix to match against the VPN Prefix ORF entry. After installing the filter entries for the outbound VPN prefixes, the RR or ASBR does the following before sending VPN routes:

The procedure above can be used for route refresh processing after getting the ORF update and the usual VPN route propagation. A change to the ORF prefixes will trigger a re-scan of the relevant routing information, followed by a route refresh; in contrast, regular individual VPN route updates are subject only to matching against the existing ORF rules.

Next hop does not always identify the source as in the following scenarios: a PE MAY have multiple addresses so that its BGP peer MAY receive several different next hop addresses from the same source. In Option B inter-domain scenario, the ASBR will change the next hop. ORIGINATOR_ID is a non-transitive attribute generated by RR to identify the source, but ORIGINATOR_ID cannot be advertised outside the local AS. To address the above scenarios, we have defined a new Extended Community: Source PE Extended Community (SPE EC), which is designed to transmit the identifier of source. The value of SPE EC can be set by source PE, RR or Autonomous System Boundary Router (ASBR). Once set and attached to the BGP UPDATE message, its value SHOULD NOT be altered along the advertisement path. The AS number of source PE can be conveyed by Source AS Extended Community, as defined in The format of SPE EC is shown as Figure 4.

Where: Type: specifies the type value assigned by IANA, now it is TBD. ORIGINATOR_ID: specifies the identifier of source. Reserved: MUST be zero on transmit. For the RR/ASBR, it SHOULD perform the following: Check the existence of the SPE EC. If it exists, does not change it. If SPE EC does not exist, check the existence of ORIGINATOR_ID. If it exists, put it into SPE EC. If ORIGINATOR_ID does not exist, put the router-id of source PE into SPE EC. This section extends route reflection behaviours, which means if someone wants this new feature extension, then the RR needs to do something additional as above.

The VPN Prefix ORF mechanism is designed for intra-domain BGP/MPLS IP VPN and BGP/MPLS Ethernet VPN (EVPN) deployments where multiple VRFs on a Provider Edge (PE) router exchange VPN routes via a single shared iBGP session (typically with a Route Reflector). This mechanism operates in two modes: Basic mode: Triggered solely by VRF-level prefix limits. No per-source quota configuration is required. In this mode, the PE sends a VPN Prefix ORF only when all VRFs that import the same Route Target(s) have exceeded their respective prefix limits. Granular mode (optional): Enabled when operators configure per-<Route Distinguisher, Source PE> quotas via their Network Management System (NMS) or CLI. This allows finer-grained control, enabling ORF triggering even if only one VRF exceeds its limit while others sharing the same RT remain healthy—provided the offending routes originate from a specific source. Quota is a threshold to limit the number of VPN routes under specific granularities (such as <PE>, <RD, Source AS>). In deployment, quota values SHOULD be set and delivered by the Network Management System (NMS). When the granular mode is enabled, an operator may configure a quota for each <RD, Source PE> tuple imported into a VRF. This quota represents the maximum number of prefixes allowed from that specific source for the given RD. The quota value can be derived based on historical traffic patterns, service level agreements (SLAs), or static provisioning via NMS/CLI. It is not a prerequisite for the VPN Prefix ORF mechanism to operate; the mechanism defaults to VRF-level prefix limit enforcement if no per-source quotas are configured. If the quota value is set to (VRF prefix limit/the number of PEs), whenever a new PE access to the network, the quota value SHOULD be re-evaluated or adjusted accordingly. To avoid frequent changes to the quota value, the value SHOULD be set based on the following formula: Quota=MIN[(Margins coefficient)*<PE,CE limit>*<Number of PEs within the VPN, includes the possibility expansion in futures>, VRF Prefixes Limit] It SHOULD be noted that the above formula is only an example, the operators can use different formulas based on actual needs in management plane.

When the VPN Prefix ORF mechanism is triggered, a warning message will be generated and sent to the network operators. Operators SHOULD manually configure the network to resume normal operation. Since devices can record the VPN Prefix ORF entries sent by each VRF, operators can identify the entries that need to be withdrawn and manually trigger the withdraw process. The withdrawal of the VPN Prefix ORF mechanism is manually triggered, and its activation requires two conditions: Network operation and maintenance personnel have confirmed through device alarms that the issue of "overload routes", which originally caused the VRF route count to exceed the limit --- has been resolved; Operation and maintenance personnel have located the target ORF entry to be withdrawn. Devices record the VPN Prefix ORF entries sent by each VRF, providing a basis for personnel to locate the target of the withdrawal. Operation and maintenance personnel manually configure withdrawal commands on the device that triggered the ORF (typically the original ORF sender, such as a PE with an exceeded route limit). The commands MUST include the unique identification information of the target ORF entry, and set the "Action" field of the ORF entry to "REMOVE" (for removing a single entry) or "REMOVE-ALL" (for removing all entries of the same type). The withdrawal of ORF entries relies on manual intervention from a management entity (e.g., NMS), and there is no automatic withdrawal mechanism. This is to prevent route disruptions caused by misoperations.

This draft adds no new security considerations beyond those of .

This document defines a new Outbound Route Filter type - VPN Prefix Outbound Route Filter (VPN Prefix ORF). This new ORF type SHOULD be registered under "BGP Outbound Route Filtering (ORF) Types", value 66 has been allocated to this new ORF type by IANA.

This document define a VPN Prefix ORF TLV type under "Border Gateway Protocol (BGP) Parameters", four TLV types are defined:

This document also requests a new Transitive Extended Community Type. The new Transitive Extended Community Type name SHALL be "Source PE Extended Community".

This document defines the encoding of the common part of ORF entries as follows:

A (2 bits): specifies the Action of this entry. M (1 bit): specifies the Match method of this entry. O (1 bit): specifies the overload VPN routes process method. R (4 bits): reserved.

Shunwan Zhuang Huawei Technologies Huawei Building, No.156 Beiqing Rd. Beijing Beijing, 100095 China

Thanks Jeffrey Haas, Robert Raszuk, Jim Uttaro, Jakob Heitz, Jeff Tantsura, Rajiv Asati, John E Drake, Gert Doering, Shuanglong Chen, Enke Chen, Srihari Sangli and Igor Malyushkin for their valuable comments on this draft.

The experimental topology is shown in Figure 6.

This topology can be used to verify as follows: whether the VPN Prefix ORF mechanism could block the overload routes in intra-domain scenario. whether the VPN Prefix ORF mechanism conflicts with the existing mechanism and cause failure. whether the quota value leads to flapping. Since all existing standards defining new ORF types are under the standard track, the authors of this draft would like to inquire whether this document can be reclassified into the standard track.

In this scenario, PE1-PE4 and RR are iBGP peers. RD is allocated per VPN per PE. The overload VPN routes only carry one RT. We assume that the network topology is shown in Figure 1.

When PE3 sends an excessive number of VPN routes with RT1, and both PE1 and PE2 import VPN routes with RT1, the process of overload VPN routes will influence performance of VRFs on PEs. PEs and RR need to have appropriate mechanisms to identify and control the advertising of offending VPN routes. a) PE1 If quota value is not set on PE1, and each VRF has a prefix limit on PE1. When the PE1 receives VPN routes from its BGP peer, it does the following:

NOTE: When the prefix limit for VPN1 VRF is exceeded, there are no other VRFs on PE1 that need the VPN routes with RT1. PE1 sends a VPN Prefix ORF message to the RR and a warning message to the operator. If each <RD31, source PE3> tuple imported into a VRF has a quota, and each VRF has a prefix limit. When the PE1 receives VPN routes from its BGP peer, it does the following:

tuple exceed the quota) { S02. If (the prefix limit of VPN1 VRF is not exceeded) { S03. PE1 sends a warning message to the operator, and the VPN Prefix ORF mechanism cannot be triggered. S04. } else { S05. PE1 generates a BGP ROUTE-REFRESH message containing a VPN Prefix ORF entry with (RD31, source PE is PE3, RT is RT1), and send the entry to RR. RR handles the overload VPN routes according to the value of "Overload VPN routes process method". S06. } S07. } ]]>

b) PE2 If quota value is not set on PE2, and each VRF has a prefix limit on PE2. When the PE2 receives VPN routes from its BGP peer, it does the following:

NOTE: PE2 cannot directly trigger the VPN Prefix ORF mechanism when the prefix limit of VPN1 VRF is exceeded, because VPN2 VRF requires the VPN routes with RT1. PE2 triggers the mechanism only when the prefix limits for both the VPN1 and VPN2 VRFs have been exceeded. If each <RD31, source PE3> tuple imported into a VRF has a quota, and each VRF has a prefix limit. When the PE2 receives VPN routes from its BGP peer, it does the following:

tuple exceed the quota) { S02. If (the prefix limit of VPN1 VRF is not exceeded) { S03. PE2 sends a warning message to the operator, and the VPN Prefix ORF mechanism cannot be triggered. S04. } else { S05. If (the prefix limit of VPN2 VRF is not exceeded) { S06. PE2 cannot trigger the VPN Prefix ORF mechanism, and only performs VPN route filtering for the target VPN1 VRF, stopping the import of VPN routes with . S07. } else { S08. PE2 generates a BGP ROUTE-REFRESH message containing a VPN Prefix ORF entry with (RD31, source PE is PE3, RTs are RT1 and RT2), and send the entry to RR. RR handles the overload VPN routes according to the value of "Overload VPN routes process method". S09. } S10. } S11. } ]]>

In this scenario, PE1-PE4 and RR are iBGP peers. RD is allocated per VPN. One/Multiple RTs are associated with the offending VPN routes and are imported into different VRFs on other devices. We assume the network topology is shown in Figure 2.

When PE3 sends an excessive number of VPN routes associated with RD1, RT1 and RT2, and both PE1 and PE2 import VPN routes with RT1, the process of overload VPN routes can affect the performance of the VRFs on PEs. a) PE1 If quota value is not set on PE1, and each VRF has a prefix limit on PE1. Since VPN2 VRF requires the VPN routes with RT2, PE1 cannot trigger VPN Prefix ORF mechanism directly when the prefix limit of VPN1 VRF is exceeded. This case is similar to PE2 without quota in Scenario 1, which is modified as follows:

If each <RD1, source PE3> tuple imported into a VRF has a quota, and each VRF has a prefix limit. This case is similar to PE2 with quota in Scenario 1, which is modified as follows:

b) PE2 If quota value is not set on PE2, and each VRF has a prefix limit on PE2. Since only VPN1 VRF needs to import VPN routes with RT1, this case is similar to PE1 without quota in Scenario 1, which is modified as follows:

If each <RD31, source PE3> tuple imported into a VRF has a quota, and each VRF has a prefix limit. This case is similar to PE1 with quota in Scenario 1, which is modified as follows:

Using the scenario 1 in Appendix B, we demonstrate how to determine each field when the sender generates a VPN Prefix ORF entry. Assuming it is an IPv4 network, after PE1-PE4 and RR have advertised the Outbound Route Filtering Capability, each of PE1-PE4 needs to send a VPN Prefix ORF entry that means "PERMIT-ALL" as follows: AFI is equal to IPv4 SAFI is equal to MPLS-labeled VPN address When-to-refresh is equal to IMMEDIATE ORF Type is equal to VPN Prefix ORF Length of ORF entries is equal to 22 Action is equal to ADD Match is equal to PERMIT Overload VPN routes process method is equal to 0 Sequence is equal to 0xFFFFFFFF Length is equal to 8 Route Distinguisher is equal to 0 When the VPN Prefix ORF mechanism is triggered on PE1, PE1 generates a VPN Prefix ORF entry contains the following information: AFI is equal to IPv4 SAFI is equal to MPLS-labeled VPN address When-to-refresh is equal to IMMEDIATE ORF Type is equal to VPN Prefix ORF Length of ORF entries is equal to 45 Action is equal to ADD Match is equal to DENY Overload VPN routes process method is equal to 0 Sequence is equal to 1 Length is equal to 31 Route Distinguisher is equal to RD31 Optional TLV: Type is equal to 1 (Source PE TLV) Length is equal to 4 value is equal to PE3's IPv4 address Type is equal to 4 (Source AS TLV) Length is equal to 4 value is equal to PE3's source AS number Type is equal to 5 (Route Target TLV) Length is equal to 8 value is equal to RT1