Internet Engineering Task Force (IETF) M. Umair
Request for Comments: 8385 Cisco
Category: Informational S. Kingston Smiler
ISSN: 2070-1721 PALC Networks
D. Eastlake 3rd
Huawei
L. Yong
Independent
June 2018
Internet Engineering Task Force (IETF) M. Umair
Request for Comments: 8385 Cisco
Category: Informational S. Kingston Smiler
ISSN: 2070-1721 PALC Networks
D. Eastlake 3rd
Huawei
L. Yong
Independent
June 2018
Transparent Interconnection of Lots of Links (TRILL) Transparent Transport over MPLS
多链路透明互连（TRILL）MPLS上的透明传输
Abstract
摘要
This document specifies methods to interconnect multiple TRILL (Transparent Interconnection of Lots of Links) sites with an intervening MPLS network using existing TRILL and VPLS (Virtual Private LAN Service) standards. This document addresses two problems: 1) providing connection between more than two TRILL sites that are separated by an MPLS provider network and 2) providing a single logical virtualized TRILL network for different tenants that are separated by an MPLS provider network.
本文件规定了使用现有TRILL和VPLS（虚拟专用LAN服务）标准将多个TRILL（大量链路的透明互连）站点与中间MPLS网络互连的方法。本文档解决两个问题：1）提供由MPLS提供商网络分隔的两个以上TRILL站点之间的连接；2）为由MPLS提供商网络分隔的不同租户提供单个逻辑虚拟化TRILL网络。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 7841.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 7841第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8385.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问https://www.rfc-editor.org/info/rfc8385.
Copyright Notice
版权公告
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2018 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(https://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction ....................................................3
1.1. Terminology ................................................3
2. TRILL-over-MPLS Model ...........................................5
3. VPLS Model ......................................................5
3.1. Entities in the VPLS Model .................................6
3.2. TRILL Adjacency for VPLS Model .............................7
3.3. MPLS Encapsulation for VPLS Model ..........................7
3.4. Loop-Free Provider PSN/MPLS ................................7
3.5. Frame Processing ...........................................7
4. VPTS Model ......................................................7
4.1. Entities in the VPTS Model .................................9
4.1.1. TRILL Intermediate Router (TIR) ....................10
4.1.2. Virtual TRILL Switch/Service Domain (VTSD) .........10
4.2. TRILL Adjacency for VPTS Model ............................10
4.3. MPLS Encapsulation for VPTS Model .........................10
4.4. Loop-Free Provider PSN/MPLS ...............................11
4.5. Frame Processing ..........................................11
4.5.1. Multi-destination Frame Processing .................11
4.5.2. Unicast Frame Processing ...........................11
5. VPTS Model versus VPLS Model ...................................11
6. Packet Processing between Pseudowires ..........................12
7. Efficiency Considerations ......................................12
8. Security Considerations ........................................12
9. IANA Considerations ............................................13
10. References ....................................................13
10.1. Normative References ....................................13
10.2. Informative References ..................................14
Acknowledgements ..................................................15
Authors' Addresses ................................................16
1. Introduction ....................................................3
1.1. Terminology ................................................3
2. TRILL-over-MPLS Model ...........................................5
3. VPLS Model ......................................................5
3.1. Entities in the VPLS Model .................................6
3.2. TRILL Adjacency for VPLS Model .............................7
3.3. MPLS Encapsulation for VPLS Model ..........................7
3.4. Loop-Free Provider PSN/MPLS ................................7
3.5. Frame Processing ...........................................7
4. VPTS Model ......................................................7
4.1. Entities in the VPTS Model .................................9
4.1.1. TRILL Intermediate Router (TIR) ....................10
4.1.2. Virtual TRILL Switch/Service Domain (VTSD) .........10
4.2. TRILL Adjacency for VPTS Model ............................10
4.3. MPLS Encapsulation for VPTS Model .........................10
4.4. Loop-Free Provider PSN/MPLS ...............................11
4.5. Frame Processing ..........................................11
4.5.1. Multi-destination Frame Processing .................11
4.5.2. Unicast Frame Processing ...........................11
5. VPTS Model versus VPLS Model ...................................11
6. Packet Processing between Pseudowires ..........................12
7. Efficiency Considerations ......................................12
8. Security Considerations ........................................12
9. IANA Considerations ............................................13
10. References ....................................................13
10.1. Normative References ....................................13
10.2. Informative References ..................................14
Acknowledgements ..................................................15
Authors' Addresses ................................................16
The IETF Transparent Interconnection of Lots of Links (TRILL) protocol [RFC6325] [RFC7177] [RFC7780] provides transparent forwarding in multi-hop networks with arbitrary topology and link technologies using a header with a hop count and link-state routing. TRILL provides optimal pair-wise forwarding without configuration, safe forwarding even during periods of temporary loops, and support for multipathing of both unicast and multicast traffic. Intermediate Systems (ISs) implementing TRILL are called Routing Bridges (RBridges) or TRILL switches.
IETF多链路透明互连（TRILL）协议[RFC6325][RFC7177][RFC7780]使用具有跳数和链路状态路由的报头，在具有任意拓扑和链路技术的多跳网络中提供透明转发。TRILL提供无需配置的最佳成对转发，即使在临时循环期间也能安全转发，并支持单播和多播流量的多路径传输。实现TRILL的中间系统（ISs）称为路由桥（RBridges）或TRILL交换机。
This document, in conjunction with [RFC7173] on TRILL transport using pseudowires, addresses two problems:
本文档与[RFC7173]结合使用伪导线进行颤音传输，解决了两个问题：
1) providing connection between more than two TRILL sites that belong to a single TRILL network and are separated by an MPLS provider network using [RFC7173]. (Herein, this is also called "problem statement 1".)
1) 使用[RFC7173]在属于单个TRILL网络且由MPLS提供商网络分隔的两个以上TRILL站点之间提供连接。（此处也称为“问题陈述1”。）
2) providing a single logical virtualized TRILL network for different tenants that are separated by an MPLS provider network. In short, this is for providing connection between TRILL sites belonging to a tenant/tenants over a MPLS provider network. (Herein, this is also called "problem statement 2".)
2) 为由MPLS提供商网络分隔的不同租户提供单个逻辑虚拟化TRILL网络。简而言之，这是为了通过MPLS提供商网络在属于租户的TRILL站点之间提供连接。（此处也称为“问题陈述2”。）
A tenant is the administrative entity on whose behalf their associated services are managed. Here, "tenant" refers to a TRILL campus that is segregated from other tenants for security reasons.
租户是代表其管理关联服务的管理实体。这里，“租户”是指出于安全原因与其他租户隔离的TRILL校园。
A key multi-tenancy requirement is traffic isolation so that one tenant's traffic is not visible to any other tenant. This document also addresses the problem of multi-tenancy by isolating one tenant's traffic from the other.
一个关键的多租户要求是流量隔离，以便一个租户的流量对任何其他租户都不可见。本文档还通过将一个租户的流量与另一个租户的流量隔离来解决多租户问题。
[RFC7173] mentions how to interconnect a pair of TRILL switch ports using pseudowires. This document explains how to connect multiple TRILL sites (not limited to only two sites) using the mechanisms and encapsulations defined in [RFC7173].
[RFC7173]提到了如何使用伪线互连一对TRILL交换机端口。本文档说明了如何使用[RFC7173]中定义的机制和封装连接多个TRILL站点（不限于两个站点）。
Acronyms and terms used in this document include the following:
本文件中使用的首字母缩略词和术语包括：
AC - Attachment Circuit [RFC4664]
交流-连接电路[RFC4664]
Data Label - VLAN Label or Fine-Grained Label
数据标签-VLAN标签或细粒度标签
database - IS-IS link state database
数据库-IS-IS链接状态数据库
ECMP - Equal-Cost Multipath
ECMP-等成本多路径
FGL - Fine-Grained Labeling [RFC7172]
FGL-细粒度标记[RFC7172]
IS-IS - Intermediate System to Intermediate System [IS-IS]
IS-IS-中间系统至中间系统[IS-IS]
LAN - Local Area Network
局域网
MPLS - Multiprotocol Label Switching
多协议标签交换
PBB - Provider Backbone Bridging
PBB-提供商主干桥接
PE - Provider Edge device
PE-Provider边缘设备
PSN - Packet Switched Network
分组交换网
PW - Pseudowire [RFC4664]
PW-伪线[RFC4664]
TIR - TRILL Intermediate Router (Device that has both IP/MPLS and TRILL functionality)
TIR-TRILL中间路由器（同时具有IP/MPLS和TRILL功能的设备）
TRILL - Transparent Interconnection of Lots of Links OR Tunneled Routing in the Link Layer
TRILL-大量链路的透明互连或链路层中的隧道路由
TRILL site - A part of a TRILL campus that contains at least one RBridge.
TRILL站点-TRILL校园的一部分，至少包含一个RBridge。
VLAN - Virtual Local Area Network
虚拟局域网
VPLS - Virtual Private LAN Service
虚拟专用局域网服务
VPTS - Virtual Private TRILL Service
虚拟专用颤音服务
VSI - Virtual Service Instance [RFC4664]
VSI-虚拟服务实例[RFC4664]
VTSD - Virtual TRILL Switch Domain OR Virtual TRILL Service Domain. A Virtual RBridge that segregates one tenant's TRILL database as well as traffic from the other.
VTSD-虚拟颤音交换域或虚拟颤音服务域。将一个租户的TRILL数据库以及流量与另一个租户隔离的虚拟RBridge。
WAN - Wide Area Network
广域网
TRILL over MPLS can be achieved in two different ways: a) the VPLS Model for TRILL b) the VPTS Model / TIR Model for TRILL
MPLS上的TRILL可以通过两种不同的方式实现：a）TRILL的VPLS模型b）TRILL的VPTS模型/TIR模型
Both these models can be used to solve problem statements 1 and 2. Herein, the VPLS Model for TRILL is also called "Model 1" and the VPTS Model / TIR Model is also called "Model 2".
这两种模型都可用于解决问题陈述1和2。在此，TRILL的VPLS模型也称为“模型1”，VPTS模型/TIR模型也称为“模型2”。
Figure 1 shows the topological model of TRILL over MPLS using the VPLS model. The PE routers in the below topology model should support all the functional components mentioned in [RFC4664].
图1显示了使用VPLS模型的TRILL over MPLS拓扑模型。以下拓扑模型中的PE路由器应支持[RFC4664]中提到的所有功能组件。
+-----+ +-----+
| RBa +---+ ........................... +---| RBb |
+-----+ | . . | +-----+
Site 1 | +----+ +----+ | Site 2
+----|PE1 | |PE2 |----+
+----+ MPLS Cloud +----+
. .
. +----+ .
..........|PE3 |...........
+----+ ^
| |
| +-- Emulated LAN
+-----+
| RBc |
+-----+
Site 3
+-----+ +-----+
| RBa +---+ ........................... +---| RBb |
+-----+ | . . | +-----+
Site 1 | +----+ +----+ | Site 2
+----|PE1 | |PE2 |----+
+----+ MPLS Cloud +----+
. .
. +----+ .
..........|PE3 |...........
+----+ ^
| |
| +-- Emulated LAN
+-----+
| RBc |
+-----+
Site 3
Figure 1: Topological Model of TRILL over MPLS Connecting 3 TRILL Sites
图1:TRILL-over-MPLS连接3个TRILL站点的拓扑模型
Figure 2 below shows the topological model of TRILL over MPLS to connect multiple TRILL sites belonging to a tenant. ("Tenant" here is a TRILL campus, not a specific Data Label.) VSI1 and VSI2 are two Virtual Service Instances that segregate Tenant1's traffic from other tenant traffic. VSI1 will maintain its own database for Tenant1; similarly, VSI2 will maintain its own database for Tenant2.
下图2显示了TRILL over MPLS的拓扑模型，用于连接属于租户的多个TRILL站点。（“租户”这里是TRILL校园，而不是特定的数据标签。）VSI1和VSI2是两个虚拟服务实例，它们将租户1的流量与其他租户流量隔离开来。VSI1将为租户1维护自己的数据库；同样，VSI2将为租户2维护自己的数据库。
+-----+ ............................ +-----+
|RBat1+---+ . ++++++++++++++++++++++++ . +---|RBbt1|
+-----+ | . + + . | +-----+
Tenant1 | +----+ +----+ | Tenant1
Site 1 +----|VSI1| |VSI1|----+ Site 2
+----|VSI2| MPLS Cloud |VSI2|----+
| +----+ +----+ |
+-----+ | . + + . | +-----+
|RBat2+---+ . +++++++++ +----+ ++++++++ . +---|RBbt2|
+-----+ ............|VSI1|........... +-----+
Tenant2 |VSI2| Tenant2
Site 1 +----+ Site 2
|
+-----+
|RBct2|
+-----+
Tenant2 Site 3
+-----+ ............................ +-----+
|RBat1+---+ . ++++++++++++++++++++++++ . +---|RBbt1|
+-----+ | . + + . | +-----+
Tenant1 | +----+ +----+ | Tenant1
Site 1 +----|VSI1| |VSI1|----+ Site 2
+----|VSI2| MPLS Cloud |VSI2|----+
| +----+ +----+ |
+-----+ | . + + . | +-----+
|RBat2+---+ . +++++++++ +----+ ++++++++ . +---|RBbt2|
+-----+ ............|VSI1|........... +-----+
Tenant2 |VSI2| Tenant2
Site 1 +----+ Site 2
|
+-----+
|RBct2|
+-----+
Tenant2 Site 3
.... VSI1 Path
++++ VSI2 Path
.... VSI1 Path
++++ VSI2 Path
Figure 2: Topological Model for VPLS Model Connecting 2 Tenants with 3 Sites Each
图2:VPLS模型的拓扑模型连接2个租户，每个租户有3个站点
In this model, TRILL sites are connected to VPLS-capable PE devices that provide a logical interconnect, such that TRILL RBridges belonging to a specific tenant are connected via a single bridged Ethernet. These PE devices are the same as the PE devices specified in [RFC4026]. The Attachment Circuit ports of PE routers are Layer 2 switch ports that are connected to the RBridges at a TRILL site. Here, each VPLS instance looks like an emulated LAN. This model is similar to connecting different RBridges by a Layer 2 bridge domain (multi-access link) as specified in [RFC6325]. This model doesn't requires any changes in PE routers to carry TRILL packets, as TRILL packets will be transferred transparently.
在该模型中，TRILL站点连接到支持VPLS的PE设备，这些设备提供逻辑互连，因此属于特定租户的TRILL RBridge通过单个桥接以太网连接。这些PE设备与[RFC4026]中规定的PE设备相同。PE路由器的连接电路端口是连接到TRILL站点的RBridge的第2层交换机端口。在这里，每个VPLS实例看起来都像一个模拟LAN。该模型类似于通过[RFC6325]中规定的第2层网桥域（多址链路）连接不同的RBridge。该模型不需要对PE路由器进行任何更改来携带TRILL数据包，因为TRILL数据包将被透明地传输。
The PE (VPLS-PE) and Customer Edge (CE) devices are defined in [RFC4026].
PE（VPLS-PE）和客户边缘（CE）设备在[RFC4026]中定义。
The generic L2VPN transport functional components like Attachment Circuits, pseudowires, VSI, etc., are defined in [RFC4664].
[RFC4664]中定义了通用L2VPN传输功能组件，如连接电路、伪线、VSI等。
The RB (RBridge) and TRILL campus are defined in [RFC6325] as updated by [RFC7780].
RB（RBridge）和TRILL校园在[RFC6325]中定义，并由[RFC7780]更新。
As specified in Section 3, the MPLS cloud looks like an emulated LAN (also called multi-access link or broadcast link). This results in RBridges at different sites looking like they are connected by a multi-access link. With such interconnection, the TRILL adjacencies over the link are automatically discovered and established through TRILL IS-IS control messages [RFC7177]. These IS-IS control messages are transparently forwarded by the VPLS domain, after doing MPLS encapsulation as specified in Section 3.3.
如第3节所述，MPLS云看起来像一个模拟LAN（也称为多址链路或广播链路）。这导致不同站点上的RBridge看起来像是通过多址链路连接的。通过这种互连，通过TRILL IS-IS控制消息自动发现并建立链路上的TRILL邻接[RFC7177]。按照第3.3节的规定进行MPLS封装后，这些IS-IS控制消息由VPLS域透明转发。
Use of VPLS [RFC4762] [RFC4761] to interconnect TRILL sites requires no changes to a VPLS implementation -- in particular, the use of Ethernet pseudowires between VPLS PEs. A VPLS PE receives normal Ethernet frames from an RBridge (i.e., CE) and is not aware that the CE is an RBridge device. As an example, an MPLS-encapsulated TRILL packet within the MPLS network can use the format illustrated in Appendix A of [RFC7173] for the non-PBB case. For the PBB case, additional header fields illustrated in [RFC7041] can be added by the entry PE and removed by the exit PE.
使用VPLS[RFC4762][RFC4761]互连TRILL站点不需要更改VPLS实现——特别是在VPLS PE之间使用以太网伪线。VPLS PE从RBridge（即CE）接收正常以太网帧，并且不知道CE是RBridge设备。例如，对于非PBB情况，MPLS网络内的MPLS封装TRILL分组可以使用[RFC7173]附录A中所示的格式。对于PBB情况，[RFC7041]中所示的附加头字段可以由入口PE添加，由出口PE删除。
No explicit handling is required to avoid a loop-free topology. The "split horizon" technique specified in [RFC4664] will take care of avoiding loops in the provider PSN network.
无需显式处理即可避免无循环拓扑。[RFC4664]中规定的“拆分地平线”技术将避免提供商PSN网络中的环路。
The PE devices transparently process the TRILL control and data frames. Procedures to forward the frames are defined in [RFC4664].
PE设备透明地处理颤音控制和数据帧。[RFC4664]中定义了转发帧的步骤。
The Virtual Private TRILL Service (VPTS) is a Layer 2 TRILL service that emulates TRILL service across a Wide Area Network (WAN). VPTS is similar to what VPLS does for a bridged core but provides a TRILL core. VPLS provides "Virtual Private LAN Service" for different customers. VPTS provides "Virtual Private TRILL Service" for different TRILL tenants.
虚拟专用TRILL服务（VPTS）是一种第2层TRILL服务，它通过广域网（WAN）模拟TRILL服务。VPTS类似于VPLS对桥接核心的作用，但提供了TRILL核心。VPLS为不同的客户提供“虚拟专用LAN服务”。VPTS为不同的TRILL租户提供“虚拟专用TRILL服务”。
Figure 3 shows the topological model of TRILL over MPLS using VPTS. In this model, the PE routers are replaced with TRILL Intermediate Routers (TIRs), and the VSIs are replaced with Virtual TRILL Switch Domains (VTSDs). The TIR devices must be capable of supporting both
图3显示了使用VPTS的TRILL over MPLS的拓扑模型。在该模型中，PE路由器替换为TRILL中间路由器（TIR），VSI替换为虚拟TRILL交换域（VTSDs）。TIR设备必须能够同时支持这两种功能
MPLS and TRILL as specified in Section 4.1.1. The TIR devices are interconnected via PWs and appear as a unified emulated TRILL campus with each VTSD inside a TIR equivalent to an RBridge.
第4.1.1节规定的MPLS和颤音。TIR设备通过PWs互连，并显示为一个统一的仿真TRILL园区，每个VTSD位于TIR内，相当于一个RBridge。
Below are some of the reasons for interconnecting TRILL sites without isolating the TRILL control plane of one TRILL site from other sites.
以下是在不将一个TRILL站点的TRILL控制平面与其他站点隔离的情况下互连TRILL站点的一些原因。
1) Nickname uniqueness: One of the basic requirements of TRILL is that RBridge nicknames are unique within the campus [RFC6325]. If we segregate the control plane of one TRILL site from other TRILL sites and provide interconnection between these sites, it may result in nickname collision.
1) 昵称唯一性：TRILL的基本要求之一是RBridge昵称在校园内是唯一的[RFC6325]。如果我们将一个TRILL站点的控制平面与其他TRILL站点隔离，并在这些站点之间提供互连，则可能会导致昵称冲突。
2) Distribution trees and their pruning: When a TRILL Data packet traverses a Distribution Tree, it will stay on it even in other TRILL sites. If no end-station service is enabled for a particular Data Label in a TRILL site, the distribution tree may be pruned and TRILL data packets of that particular Data Label might never get to another TRILL site where the packets had no receivers. The TRILL Reverse Path Forwarding (RPF) check will always be performed on the packets that are received by TIRs through pseudowires.
2) 分布树及其修剪：当TRILL数据包遍历分布树时，即使在其他TRILL站点中，它也会留在分布树上。如果没有为TRILL站点中的特定数据标签启用终端站服务，则可以修剪分发树，并且该特定数据标签的TRILL数据分组可能永远不会到达分组没有接收器的另一个TRILL站点。TRILL反向路径转发（RPF）检查将始终对TIR通过伪线接收的数据包执行。
3) Hop count values: When a TRILL data packet is received over a pseudowire by a TIR, the TIR does the processing of Hop Count defined in [RFC6325] and will not perform any resetting of Hop Count.
3) 跃点计数值：当TIR通过伪线接收到TRILL数据包时，TIR将处理[RFC6325]中定义的跃点计数，并且不会执行任何跃点计数重置。
+-----+ +-----+
| RBa +---+ ........................... +---| RBb |
+-----+ | . . | +-----+
Site 1 | +----+ +----+ | Site 2
+----|TIR1| |TIR2|----+
+----+ MPLS Cloud +----+
. .
. +----+ .
..........|TIR3|...........
+----+ ^
| |
| +-- Emulated TRILL
+-----+
| RBc |
+-----+
Site 3
+-----+ +-----+
| RBa +---+ ........................... +---| RBb |
+-----+ | . . | +-----+
Site 1 | +----+ +----+ | Site 2
+----|TIR1| |TIR2|----+
+----+ MPLS Cloud +----+
. .
. +----+ .
..........|TIR3|...........
+----+ ^
| |
| +-- Emulated TRILL
+-----+
| RBc |
+-----+
Site 3
Figure 3: Topological Model of VPTS/TIR Connecting 3 TRILL Sites
图3：连接3个TRILL站点的VPTS/TIR拓扑模型
In Figure 3, Site 1, Site 2, and Site 3 (running the TRILL protocol) are connected to TIR devices. These TIR devices, along with the MPLS cloud, look like a unified emulated TRILL network. Only the PE devices in the MPLS network should be replaced with TIRs so the intermediate provider routers are agnostic to the TRILL protocol.
在图3中，站点1、站点2和站点3（运行TRILL协议）连接到TIR设备。这些TIR设备以及MPLS云看起来就像一个统一的模拟TRILL网络。只有MPLS网络中的PE设备应替换为TIR，因此中间提供商路由器与TRILL协议无关。
Figure 4 below extends the topological model of TRILL over MPLS to connect multiple TRILL sites belonging to a tenant ("tenant" here is a campus, not a Data Label) using the VPTS model. VTSD1 and VTSD2 are two Virtual TRILL Switch Domains (Virtual RBridges) that segregate Tenant1's traffic from Tenant2's traffic. VTSD1 will maintain its own TRILL database for Tenant1; similarly, VTSD2 will maintain its own TRILL database for Tenant2.
下面的图4扩展了TRILL over MPLS的拓扑模型，以使用VPTS模型连接属于租户的多个TRILL站点（“租户”这里是一个校园，而不是一个数据标签）。VTSD1和VTSD2是两个虚拟TRILL交换机域（虚拟RBridges），将租户1的流量与租户2的流量隔离。VTSD1将为租户1维护自己的TRILL数据库；同样，VTSD2将为租户2维护自己的TRILL数据库。
+-----+ ............................ +-----+
|RBat1+---+ . ######################## . +---|RBbt1|
+-----+ | . # # . | +-----+
Tenant1 | +-----+ +-----+ | Tenant1
Site 1 +----|VTSD1| |VTSD1|----+ Site 2
+----|VTSD2| MPLS Cloud |VTSD2|----+
| +-----+ +-----+ |
+-----+ | . # # . | +-----+
|RBat2+---+ . #########+-----+######### . +---|RBbt2|
+-----+ ...........|VTSD1|........... +-----+
Tenant2 |VTSD2| ^ Tenant2
Site 1 +-----+ | Site 2
| |
+-----+ +-----Emulated
|RBct2| TRILL
+-----+
Tenant2 Site 3
+-----+ ............................ +-----+
|RBat1+---+ . ######################## . +---|RBbt1|
+-----+ | . # # . | +-----+
Tenant1 | +-----+ +-----+ | Tenant1
Site 1 +----|VTSD1| |VTSD1|----+ Site 2
+----|VTSD2| MPLS Cloud |VTSD2|----+
| +-----+ +-----+ |
+-----+ | . # # . | +-----+
|RBat2+---+ . #########+-----+######### . +---|RBbt2|
+-----+ ...........|VTSD1|........... +-----+
Tenant2 |VTSD2| ^ Tenant2
Site 1 +-----+ | Site 2
| |
+-----+ +-----Emulated
|RBct2| TRILL
+-----+
Tenant2 Site 3
.... VTSD1 Connectivity
#### VTSD2 Connectivity
.... VTSD1 Connectivity
#### VTSD2 Connectivity
Figure 4: Topological Model of VPTS/TIR Connecting 2 Tenants with 3 TRILL Sites
图4：连接2个租户和3个TRILL站点的VPTS/TIR拓扑模型
The CE devices are defined in [RFC4026].
CE设备在[RFC4026]中定义。
The generic L2VPN transport functional components like Attachment Circuits, pseudowires, etc., are defined in [RFC4664].
[RFC4664]中定义了通用L2VPN传输功能组件，如连接电路、伪线等。
The RB (RBridge) and TRILL campus are defined in [RFC6325] as updated by [RFC7780].
RB（RBridge）和TRILL校园在[RFC6325]中定义，并由[RFC7780]更新。
This model introduces two new entities, TIR and VTSD, which are described below.
该模型引入了两个新实体，TIR和VTSD，如下所述。
The TIRs must be capable of running both VPLS and TRILL protocols. TIR devices are a superset of the VPLS-PE devices defined in [RFC4026] with the additional functionality of TRILL. The VSI that provides transparent bridging functionality in the PE device is replaced with VTSD in a TIR.
TIR必须能够运行VPLS和TRILL协议。TIR设备是[RFC4026]中定义的VPLS-PE设备的超集，具有TRILL的附加功能。在PE设备中提供透明桥接功能的VSI在TIR中被VTSD取代。
The VTSD is similar to the VSI (Layer 2 bridge) in the VPLS model, but the VTSD acts as a TRILL RBridge. The VTSD is a superset of the VSI and must support all the functionality provided by the VSI as defined in [RFC4026]. Along with VSI functionality, the VTSD must be capable of supporting TRILL protocols and forming TRILL adjacencies. The VTSD must be capable of performing all the operations that a standard TRILL switch can do.
VTSD类似于VPLS模型中的VSI（第2层网桥），但VTSD充当颤音RBridge。VTSD是VSI的超集，必须支持[RFC4026]中定义的VSI提供的所有功能。除了VSI功能外，VTSD还必须能够支持颤音协议并形成颤音邻接。VTSD必须能够执行标准颤音开关可以执行的所有操作。
One VTSD instance per tenant must be maintained when multiple tenants are connected to a TIR. The VTSD must maintain all the information kept by the RBridge on a per-tenant basis. The VTSD must also take care of segregating one tenant's traffic from another's. Each VTSD will have its own nickname for each tenant. If a TIR supports 10 TRILL tenants, it needs to be assigned with 10 TRILL nicknames, one for the nickname space of each of its tenants, and run 10 copies of TRILL protocols, one for each tenant. It is possible that it would have the same nickname for two or more tenants, but, since the TRILL data and control traffic are separated for the tenants, there is no confusion.
当多个租户连接到TIR时，每个租户必须维护一个VTSD实例。悉尼威立雅运输公司必须按照每个承租人的情况维护RBridge保存的所有信息。VTSD还必须注意将一个租户的流量与另一个租户的流量隔离。每个VTSD对每个租户都有自己的昵称。如果TIR支持10个TRILL租户，则需要为其分配10个TRILL昵称，一个用于其每个租户的昵称空间，并运行10个TRILL协议副本，每个租户一个。对于两个或多个租户，它可能有相同的昵称，但是，由于TRILL数据和控制流量对于租户是分开的，因此没有混淆。
The VTSD must be capable of forming a TRILL adjacency with the corresponding VTSDs present in its peer VPTS neighbor and also with the neighboring RBridges of the TRILL sites. The procedure to form TRILL adjacency is specified in [RFC7173] and [RFC7177].
VTSD必须能够与其对等VPTS邻居中的相应VTSD以及颤音站点的相邻RBridge形成颤音邻接。[RFC7173]和[RFC7177]中规定了形成颤音邻接的步骤。
The VPTS model uses PPP or Ethernet pseudowires for MPLS encapsulation as specified in [RFC7173] and requires no changes in the packet format in that RFC. In accordance with [RFC7173], the PPP encapsulation is the default.
VPTS模型使用PPP或以太网伪线进行MPLS封装，如[RFC7173]中所述，并且不需要更改该RFC中的数据包格式。根据[RFC7173]，PPP封装是默认的。
This model isn't required to employ the "split horizon" mechanism in the provider PSN network, as TRILL takes care of loop-free topology using distribution trees. Any multi-destination packet will traverse a distribution tree path. All distribution trees are calculated based on the TRILL base protocol standard [RFC6325] as updated by [RFC7780].
该模型不需要在提供商PSN网络中采用“拆分地平线”机制，因为TRILL使用分布树处理无环拓扑。任何多目标数据包都将遍历分发树路径。所有分发树都是根据[RFC7780]更新的TRILL基本协议标准[RFC6325]计算的。
This section specifies multi-destination and unicast frame processing in the VPTS/TIR model.
本节规定了VPTS/TIR模型中的多目标和单播帧处理。
Any multi-destination (unknown unicast, multicast, or broadcast, as indicated by the multi-destination bit in the TRILL header) packets inside a VTSD will be processed or forwarded through the distribution tree for which they were encapsulated on TRILL ingress. If any multi-destination packet is received from the wrong pseudowire at a VTSD, the TRILL protocol running in the VTSD will perform an RPF check as specified in [RFC7780] and drop the packet.
VTSD内的任何多目的地（未知单播、多播或广播，如TRILL报头中的多目的地位所示）数据包将通过分发树进行处理或转发，这些数据包被封装在TRILL入口中。如果在VTSD处从错误的伪线接收到任何多目的地数据包，则在VTSD中运行的TRILL协议将按照[RFC7780]中的规定执行RPF检查并丢弃该数据包。
The pruning mechanism in distribution trees, as specified in [RFC6325] and [RFC7780], can also be used to avoid forwarding of multi-destination data packets on the branches where there are no potential destinations.
[RFC6325]和[RFC7780]中规定的分发树中的修剪机制也可用于避免在没有潜在目的地的分支上转发多目的地数据包。
Unicast packets are forwarded in the same way they get forwarded in a standard TRILL campus as specified in [RFC6325]. If multiple equal-cost paths are available over pseudowires to reach the destination, then VTSD should be capable of doing ECMP for those equal-cost paths.
单播数据包的转发方式与[RFC6325]中规定的在标准TRILL校园中的转发方式相同。如果多条等成本路径可通过伪线到达目的地，则VTSD应能够对这些等成本路径执行ECMP。
The VPLS model uses a simpler loop-breaking rule: the "split horizon" rule, where a PE must not forward traffic from one PW to another in the same VPLS mesh. In contrast, the VPTS model uses distribution trees for loop-free topology. As this is an emulated TRILL service, for interoperability purposes, the VPTS model is the default.
VPLS模型使用了一个更简单的环路中断规则：“分割地平线”规则，其中PE不得在同一VPLS网格中将流量从一个PW转发到另一个PW。相反，VPTS模型使用分布树实现无环拓扑。由于这是一个模拟的TRILL服务，出于互操作性的目的，VPTS模型是默认的。
Whenever a packet gets received over a pseudowire, a VTSD will decapsulate the MPLS headers then check the TRILL header. If the egress nickname in the TRILL header is for a TRILL site located beyond another pseudowire, then the VTSD will encapsulate the packet with new MPLS headers and send it across the proper pseudowire.
每当通过伪线接收到数据包时，VTSD都会解除MPLS报头的封装，然后检查TRILL报头。如果TRILL报头中的出口昵称用于位于另一个伪线之外的TRILL站点，则VTSD将使用新的MPLS报头封装数据包，并通过适当的伪线发送数据包。
For example, in Figure 3, consider that the pseudowire between TIR1 and TIR2 fails. Then, TIR1 will communicate with TIR2 via TIR3. Whenever packets that are destined to TIR3 are received from the pseudowire between TIR1 and TIR3, the VTSD inside TIR3 will decapsulate the MPLS headers, then check the TRILL header's egress nickname field. If the egress nickname indicates it is destined for the RBridge in Site 3, then the packet will be sent to RBc; if the egress nickname is located at Site 2, VTSD will add MPLS headers for the pseudowire between TIR3 and TIR2 and forward the packet on that pseudowire.
例如，在图3中，考虑TIR1和TIR2之间的伪线失败。然后，TIR1将通过TIR3与TIR2通信。每当从TIR1和TIR3之间的伪线接收到目的地为TIR3的数据包时，TIR3内的VTSD将解除MPLS报头的封装，然后检查TRILL报头的出口昵称字段。如果出口昵称指示其目的地为站点3中的RBridge，则该分组将被发送到RBc；如果出口昵称位于站点2，VTSD将为TIR3和TIR2之间的伪线添加MPLS报头，并在该伪线上转发数据包。
Since the VPTS model uses distribution trees for processing of multi-destination data packets, it is always advisable to have at least one distribution tree root located in every TRILL site. This will prevent data packets from being received at TRILL sites where end-station service is not enabled for that data packet.
由于VPTS模型使用分布树来处理多目的地数据包，因此建议在每个TRILL站点中至少有一个分布树根。这将防止在TRILL站点接收数据包，而该站点未为该数据包启用终端站服务。
This document specifies methods using existing standards and facilities in ways that do not create new security problems.
本文件规定了以不会产生新的安全问题的方式使用现有标准和设施的方法。
For general VPLS security considerations, including discussion of isolating customers from each other, see [RFC4761] and [RFC4762].
有关VPLS的一般安全注意事项，包括将客户彼此隔离的讨论，请参阅[RFC4761]和[RFC4762]。
For security considerations for transport of TRILL by pseudowires, see [RFC7173]. In particular, since pseudowires are supported by MPLS or IP, which are in turn supported by a link layer, that document recommends using IP security, such as IPsec [RFC4301] or DTLS [RFC6347], or the lower link-layer security, such as MACSEC [802.1AE] for Ethernet links.
有关伪线传输颤音的安全注意事项，请参阅[RFC7173]。特别是，由于MPLS或IP支持伪线，而MPLS或IP又由链路层支持，因此该文档建议使用IP安全性，如IPsec[RFC4301]或DTLS[RFC6347]，或较低的链路层安全性，如用于以太网链路的MACSEC[802.1AE]。
Transmission outside the customer environment through the provider environment, as described in this document, increases risk of compromise or injection of false data through failure of tenant isolation or by the provider. In the VPLS model (Section 3), the use of link encryption and authentication between the CEs of a tenant that is being connected through provider facilities should be a good
如本文档所述，通过提供商环境在客户环境之外进行传输，会增加因租户隔离失败或提供商失败而泄露或注入虚假数据的风险。在VPLS模型（第3节）中，在通过提供商设施连接的租户的CE之间使用链路加密和身份验证应该是一个好方法
defense. In the VPTS model (Section 4), it is assumed that the CEs will peer with virtual TRILL switches of the provider network, and thus link security between TRILL switch ports is inadequate as it will terminate at the edge PE. Thus, encryption and authentication from end station to end station and authentication are more appropriate for the VPTS model.
防守在VPTS模型（第4节）中，假设CEs将与提供商网络的虚拟TRILL交换机对等，因此TRILL交换机端口之间的链路安全性不足，因为它将终止于边缘PE。因此，从端站到端站的加密和身份验证以及身份验证更适合VPTS模型。
For added security against the compromise of data, end-to-end encryption and authentication should be considered; that is, encryption and authentication from source end station to destination end station. This would typically be provided by IPsec [RFC4301] or DTLS [RFC6347] or other protocols convenient to protect the information of concern.
为了增加数据泄露的安全性，应考虑端到端加密和身份验证；即，从源端站到目标端站的加密和身份验证。这通常由IPsec[RFC4301]或DTLS[RFC6347]或其他便于保护相关信息的协议提供。
For general TRILL security considerations, see [RFC6325].
有关一般TRILL安全注意事项，请参阅[RFC6325]。
This document has no IANA actions.
本文档没有IANA操作。
[IS-IS] ISO, "Intermediate system to Intermediate system routeing information exchange protocol for use in conjunction with the Protocol for providing the Connectionless-mode Network Service (ISO 8473)", ISO/IEC 10589:2002, 2002.
[IS-IS]ISO，“与提供无连接模式网络服务的协议一起使用的中间系统到中间系统路由信息交换协议（ISO 8473）”，ISO/IEC 10589:2002，2002。
[RFC4761] Kompella, K., Ed., and Y. Rekhter, Ed., "Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling", RFC 4761, DOI 10.17487/RFC4761, January 2007, <https://www.rfc-editor.org/info/rfc4761>.
[RFC4761]Kompella，K.，Ed.，和Y.Rekhter，Ed.，“使用BGP进行自动发现和信令的虚拟专用LAN服务（VPLS）”，RFC 4761，DOI 10.17487/RFC4761，2007年1月<https://www.rfc-editor.org/info/rfc4761>.
[RFC4762] Lasserre, M., Ed., and V. Kompella, Ed., "Virtual Private LAN Service (VPLS) Using Label Distribution Protocol (LDP) Signaling", RFC 4762, DOI 10.17487/RFC4762, January 2007, <https://www.rfc-editor.org/info/rfc4762>.
[RFC4762]Lasserre，M.，Ed.，和V.Kompella，Ed.，“使用标签分发协议（LDP）信令的虚拟专用LAN服务（VPLS）”，RFC 4762，DOI 10.17487/RFC4762，2007年1月<https://www.rfc-editor.org/info/rfc4762>.
[RFC6325] Perlman, R., Eastlake 3rd, D., Dutt, D., Gai, S., and A. Ghanwani, "Routing Bridges (RBridges): Base Protocol Specification", RFC 6325, DOI 10.17487/RFC6325, July 2011, <https://www.rfc-editor.org/info/rfc6325>.
[RFC6325]Perlman，R.，Eastlake 3rd，D.，Dutt，D.，Gai，S.，和A.Ghanwani，“路由桥（RBridges）：基本协议规范”，RFC 6325DOI 10.17487/RFC6325，2011年7月<https://www.rfc-editor.org/info/rfc6325>.
[RFC7173] Yong, L., Eastlake 3rd, D., Aldrin, S., and J. Hudson, "Transparent Interconnection of Lots of Links (TRILL) Transport Using Pseudowires", RFC 7173, DOI 10.17487/RFC7173, May 2014, <https://www.rfc-editor.org/info/rfc7173>.
[RFC7173]Yong，L.，Eastlake 3rd，D.，Aldrin，S.，和J.Hudson，“使用伪线的大量链路（TRILL）传输的透明互连”，RFC 7173，DOI 10.17487/RFC7173，2014年5月<https://www.rfc-editor.org/info/rfc7173>.
[RFC7177] Eastlake 3rd, D., Perlman, R., Ghanwani, A., Yang, H., and V. Manral, "Transparent Interconnection of Lots of Links (TRILL): Adjacency", RFC 7177, DOI 10.17487/RFC7177, May 2014, <https://www.rfc-editor.org/info/rfc7177>.
[RFC7177]Eastlake 3rd，D.，Perlman，R.，Ghanwani，A.，Yang，H.，和V.Manral，“大量链路的透明互连（颤音）：邻接”，RFC 7177，DOI 10.17487/RFC7177，2014年5月<https://www.rfc-editor.org/info/rfc7177>.
[RFC7780] Eastlake 3rd, D., Zhang, M., Perlman, R., Banerjee, A., Ghanwani, A., and S. Gupta, "Transparent Interconnection of Lots of Links (TRILL): Clarifications, Corrections, and Updates", RFC 7780, DOI 10.17487/RFC7780, February 2016, <https://www.rfc-editor.org/info/rfc7780>.
[RFC7780]Eastlake 3rd，D.，Zhang，M.，Perlman，R.，Banerjee，A.，Ghanwani，A.，和S.Gupta，“大量链接的透明互连（TRILL）：澄清，更正和更新”，RFC 7780，DOI 10.17487/RFC77802016年2月<https://www.rfc-editor.org/info/rfc7780>.
[802.1AE] IEEE, "IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Security", IEEE Std 802.1AE, DOI 10.1109/IEEESTD.2006.245590.
[802.1AE]IEEE，“局域网和城域网IEEE标准：媒体访问控制（MAC）安全”，IEEE标准802.1AE，DOI 10.1109/IEEESTD.2006.245590。
[RFC4026] Andersson, L. and T. Madsen, "Provider Provisioned Virtual Private Network (VPN) Terminology", RFC 4026, DOI 10.17487/RFC4026, March 2005, <https://www.rfc-editor.org/info/rfc4026>.
[RFC4026]Andersson，L.和T.Madsen，“提供商提供的虚拟专用网络（VPN）术语”，RFC 4026，DOI 10.17487/RFC4026，2005年3月<https://www.rfc-editor.org/info/rfc4026>.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, DOI 10.17487/RFC4301, December 2005, <https://www.rfc-editor.org/info/rfc4301>.
[RFC4301]Kent，S.和K.Seo，“互联网协议的安全架构”，RFC 4301，DOI 10.17487/RFC4301，2005年12月<https://www.rfc-editor.org/info/rfc4301>.
[RFC4664] Andersson, L., Ed., and E. Rosen, Ed., "Framework for Layer 2 Virtual Private Networks (L2VPNs)", RFC 4664, DOI 10.17487/RFC4664, September 2006, <https://www.rfc-editor.org/info/rfc4664>.
[RFC4664]Andersson，L.，Ed.，和E.Rosen，Ed.，“第二层虚拟专用网络（L2VPN）框架”，RFC 4664，DOI 10.17487/RFC4664，2006年9月<https://www.rfc-editor.org/info/rfc4664>.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer Security Version 1.2", RFC 6347, DOI 10.17487/RFC6347, January 2012, <https://www.rfc-editor.org/info/rfc6347>.
[RFC6347]Rescorla，E.和N.Modadugu，“数据报传输层安全版本1.2”，RFC 6347，DOI 10.17487/RFC6347，2012年1月<https://www.rfc-editor.org/info/rfc6347>.
[RFC7041] Balus, F., Ed., Sajassi, A., Ed., and N. Bitar, Ed., "Extensions to the Virtual Private LAN Service (VPLS) Provider Edge (PE) Model for Provider Backbone Bridging", RFC 7041, DOI 10.17487/RFC7041, November 2013, <https://www.rfc-editor.org/info/rfc7041>.
[RFC7041]Balus，F.，Ed.，Sajassi，A.，Ed.，和N.Bitar，Ed.，“虚拟专用LAN服务（VPLS）提供商边缘（PE）模型的扩展，用于提供商主干网桥”，RFC 7041，DOI 10.17487/RFC7041，2013年11月<https://www.rfc-editor.org/info/rfc7041>.
[RFC7172] Eastlake 3rd, D., Zhang, M., Agarwal, P., Perlman, R., and D. Dutt, "Transparent Interconnection of Lots of Links (TRILL): Fine-Grained Labeling", RFC 7172, DOI 10.17487/RFC7172, May 2014, <https://www.rfc-editor.org/info/rfc7172>.
[RFC7172]Eastlake 3rd，D.，Zhang，M.，Agarwal，P.，Perlman，R.，和D.Dutt，“大量链接的透明互连（TRILL）：细粒度标记”，RFC 7172，DOI 10.17487/RFC7172，2014年5月<https://www.rfc-editor.org/info/rfc7172>.
Acknowledgements
致谢
The contributions of Andrew G. Malis are gratefully acknowledged in improving the quality of this document.
感谢Andrew G.Malis在提高本文件质量方面的贡献。
Authors' Addresses
作者地址
Mohammed Umair Cisco Systems SEZ, Cessna Business Park Sarjapur - Marathahalli Outer Ring road Bengaluru - 560103 India
Mohammed Umair Cisco Systems经济特区，塞斯纳商业园Sarjapur-马拉塔哈里外环路班加罗尔-印度560103
Email: mohammed.umair2@gmail.com
Email: mohammed.umair2@gmail.com
S. Kingston Smiler PALC NETWORKS PVT LTD Envision Technology Center #119, 1st Floor, Road No.3 EPIP Area Phase 1, Whitefield Near Vydehi Hospital Bengaluru - 560066, Karnataka India
S.Kingston Smiler PALC NETWORKS私人有限公司远景技术中心，地址：印度卡纳塔克邦班加鲁维迪医院附近Whitefield EPIP区1期3号路1楼119号，邮编：560066
Email: kingstonsmiler@gmail.com
Email: kingstonsmiler@gmail.com
Donald Eastlake 3rd Huawei Technologies 155 Beaver Street Milford, MA 01757 United States of America
美国马萨诸塞州米尔福德市海狸街155号唐纳德·伊斯特莱克第三华为技术有限公司01757
Phone: +1-508-333-2270
Email: d3e3e3@gmail.com
Phone: +1-508-333-2270
Email: d3e3e3@gmail.com
Lucy Yong Independent
露西·杨独立报
Phone: +1-469-227-5837
Email: lucyyong@gmail.com
Phone: +1-469-227-5837
Email: lucyyong@gmail.com