One document matched: draft-bhandari-dnssd-mdns-gateway-00.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!-- One method to get references from the online citation libraries.
There has to be one entity for each item to be referenced.
An alternate method (rfc include) is described in the references. -->
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC1035 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.1035.xml">
<!ENTITY RFC6762 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6762.xml">
<!ENTITY RFC6763 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6763.xml">
<!ENTITY I-D.cheshire-mdnsext-hybrid SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.cheshire-mdnsext-hybrid.xml">
<!ENTITY I-D.stenberg-homenet-dnssdext-hybrid-proxy-ospf SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.stenberg-homenet-dnssdext-hybrid-proxy-ospf.xml">
<!ENTITY I-D.lynn-homenet-site-mdns SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.lynn-homenet-site-mdns.xml">
<!ENTITY I-D.sekar-dns-llq SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-sekar-dns-llq-01.xml">
]>
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="info" docName="draft-bhandari-dnssd-mdns-gateway-00"
ipr="trust200902">
<front>
<title abbrev="mDNS across local links in campus network">Extending
multicast DNS across local links in Campus and Enterprise networks</title>
<author fullname="Shwetha Bhandari" initials="S." surname="Bhandari">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>Cessna Business Park, Sarjapura Marathalli Outer Ring
Road</street>
<city>Bangalore</city>
<region>KARNATAKA</region>
<code>560 087</code>
<country>India</country>
</postal>
<email>shwethab@cisco.com</email>
</address>
</author>
<author fullname="Bhavik Fajalia" initials="B." surname="Fajalia">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>Cessna Business Park, Sarjapura Marathalli Outer Ring
Road</street>
<city>Bangalore</city>
<region>KARNATAKA</region>
<code>560 087</code>
<country>India</country>
</postal>
<email>bfajalia@cisco.com</email>
</address>
</author>
<author fullname="Ralph Schmieder" initials="R." surname="Schmieder">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>City Plaza - 4th Floor</street>
<city>Stuttgart</city>
<region>BADEN-WURTTEMBERG</region>
<code>70178</code>
<country>Germany</country>
</postal>
<email>rschmied@cisco.com</email>
</address>
</author>
<author fullname="Stephen Orr" initials="S." surname="Orr">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>1 Paragon Drive</street>
<street></street>
<city>Montvale</city>
<region>NJ</region>
<code>07645</code>
<country>USA</country>
</postal>
<email>sorr@cisco.com</email>
</address>
</author>
<author fullname="Amit Dutta" initials="A." surname="Dutta">
<organization abbrev="Cisco">Cisco Systems, Inc.</organization>
<address>
<postal>
<street>Cessna Business Park, Sarjapura Marathalli Outer Ring
Road</street>
<city>Bangalore</city>
<region>KARNATAKA</region>
<code>560 087</code>
<country>India</country>
</postal>
<email>amdutta@cisco.com</email>
</address>
</author>
<date day="20" month="October" year="2013" />
<area>Internet</area>
<workgroup>dnssd</workgroup>
<abstract>
<t>This document describes the requirements for extending multicast DNS
in enterprise networks. It provides an overview of a solution to extend
multicast DNS services across links that have been implemented in
routers, switches and wireless LAN controllers.</t>
</abstract>
<note title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119">RFC 2119</xref>.</t>
</note>
</front>
<middle>
<section title="Introduction">
<t>Service discovery using multicast DNS (mDNS) as defined in <xref
target="RFC6762"></xref> is limited in scope to L3 boundaries due to the
use of link-local scoped multicast addresses. Networks are partitioned
into multiple segments by means of virtual local area networks (VLANs)
or subnet creation for various reasons. The need for network wide,
seamless service discovery demands the extension of the discovery
protocol beyond the L3 boundary. There are also challenges in wireless
networks (802.11, 802.15.4 etc) where a large number multicast messages
can impact wireless performance.</t>
<t>Enabling Service Discovery across L3 boundaries can be accomplished
in one of the following ways using existing, unmodified protocols:</t>
<t><list style="numbers">
<t>Unicast DNS-SD only: Use of DNS servers and allowing clients to
use dynamic DNS updates and Long Lived Queries (LLQs) to announce
and learn services dynamically <xref
target="I-D.sekar-dns-llq"></xref></t>
<t>mDNS only: Defining a mDNS gateway entity at the L3 boundaries
extending service advertisements/discovery across the links it is
attached to</t>
<t>Combination of unicast DNS and mDNS - Hybrid proxy approach as
described in <xref target="I-D.cheshire-mdnsext-hybrid"></xref></t>
<t>mDNS utilizing extended scope multicast - Modifying mDNS to use a
wider scope multicast address for message exchange</t>
</list></t>
<t>As a first step, this draft lists out the approach to use a mDNS
gateway on a network element (2) to extend the service
advertisement/discovery across network segments attached to the element.
While this approach does not preclude (1) or (3), it allows the
extension of service discovery in a limited number of segments with
minimal provisioning. Approach (4) is not explored further as it would
add to the flood of service discovery messages in the scope defined by
the multicast address and it would also require changes on mDNS clients,
which is undesirable.</t>
<section title="Requirements">
<t>This section describes requirements for extending multicast DNS in
an enterprise environment:<list style="numbers">
<t>Extend service discovery across L3 boundaries</t>
<t>Defining and enforcing a policy to selectively filter services
that are to be extended based on service type, service instance,
location of the provider/user, role of the device or user
accessing/offering the service.</t>
<t>Defining and enforcing a policy to selectively filter queries
and announcements from specific clients or over specific network
links</t>
<t>Filtering of link-local-only information - Services that
resolve to IPv4 and IPv6 link-local addresses only must not be
extended beyond the local link. Suppression of resource records
that contain link-local-only addresses from propagation beyond the
local link</t>
<t>Optimization of mDNS queries/advertisements in wireless
networks</t>
<t>Effectively handle roaming of mobile devices (changes in the
Point of Attachment). Especially if those devices advertise
services</t>
<t>Limit the services in response to queries with a subset of the
services by geographic proximity</t>
<t>Handle conflict resolution of service instances and host names
across the links where the service is extended</t>
<t>Protection of resources (memory and CPU) of the network element
that participates in extending multicast DNS</t>
<t>Audit, logging of services that are denied based on policy</t>
</list></t>
</section>
</section>
<section title=" Conventions and Terminology Used in this Document ">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in "Key words for use in
RFCs to Indicate Requirement Levels" [RFC2119].</t>
<t>This document uses the multicast DNS and DNS terminology conventions
from <xref target="RFC6762"></xref> and <xref target="RFC6763"></xref>.
It uses the same convention for services on the same link as defined in
<xref target="I-D.cheshire-mdnsext-hybrid"></xref>, repeated here for
quick reference:</t>
<t>Multicast DNS works between a hosts on the same link. A set of hosts
is considered to be "on the same link", if:</t>
<t>when any host A from that set sends a packet to any other host B in
that set, using unicast, multicast, or broadcast, the entire link-layer
packet payload arrives unmodified, and</t>
<t>a broadcast sent over that link by any host from that set of hosts
can be received by every other host in that set</t>
<t>The link-layer *header* may be modified, such as in Token Ring Source
Routing [802.5], but not the link-layer *payload*. In particular, if any
device forwarding a packet modifies any part of the IP header or IP
payload then the packet is no longer considered to be on the same link.
This means that the packet may pass through devices such as repeaters,
bridges, hubs or switches and still be considered to be on the same link
for the purpose of this document, but not through a device such as an IP
router that decrements the TTL or otherwise modifies the IP header.
<list style="symbols">
<t>mDNS gateway - An application that listens to services and
extends the services across links</t>
</list></t>
</section>
<section title="Solution overview">
<t>The solution introduces the mDNS gateway function which is co-located
on the network element that connects to multiple links, typically an IP
router. The mDNS gateway function will be responsible for:</t>
<t><list style="symbols">
<t>Caching - Learn and cache services. Maintain services in the
cache according to service announcements, service removals and the
TTL of the records.</t>
<t>Respond to queries - Advertise in response to queries with
services in the cache that are not in the same link-local domain
where the query is received.</t>
<t>Service filtering - Filter services to be added to the cache and
to be included in the advertisements as per configured policies.</t>
<t>Service redistribution - forwarding of unsolicited service
announcements across links based on configuration</t>
<t>Active query - Service queries sent by the mDNS gateway itself to
learn about services or keep services 'fresh' in the cache. Can be
sent on one or more of the links the gateway is attached to.</t>
</list></t>
<section title="Service Cache">
<t>The mDNS gateway maintains a database of DNS Resource Records (RR)
required to advertise and resolve services. At a minimum, the cache
will contain PTR, SRV,TXT and A/AAAA RRs for each service with NSEC RR
support for optimization. In addition, the link on which the service
and host originate is also maintained in the cache. Records in the
cache are refreshed based on TTL expiry.</t>
</section>
<section title="Service Filters">
<t>A service filtering policy is configured with an action to permit
or deny services into the cache or to filter services included in the
response/advertisement messages based on matching criteria. The
matching criteria can be defined based on:</t>
<t><list style="symbols">
<t>Service type</t>
<t>Service instance names</t>
<t>Link on which the message is received</t>
<t>Type of message - query or advertisement</t>
<t>Location of the host querying or advertising a service</t>
</list>A Service filtering policy is applied for incoming and
outgoing messages. A unique filtering policy can be applied Globally
or per link.</t>
<t>When a mDNS message is received by the mDNS gateway matching an
action set for the link, the policy match is then executed. The
incoming advertisement is processed against the mDNS gateway inbound
filtering policy applied on the link where the advertisement is
received. If the action is 'permit' the service is added to the cache.
If a response or advertisement is to be sent out, the outbound
filtering policy applied applied on the interface is processed and if
the resulting action is 'deny' then the service and its corresponding
RRs are not included in the message sent out.</t>
</section>
<section title="Service Announcement">
<t>The mDNS gateway listens for all service announcements. When a
service announcement is received, the announcement and all the
additional RRs learnt are added to the cache or ignored based on the
result of the configured inbound filter policy.</t>
<t>The RRs containing link-local information e.g. A or AAAA RRs that
contain link-local scoped IPv4 or IPv6 addresses are not stored in the
cache.</t>
<t>When the mDNS gateway learns a service it can also forward the
advertisement on other attached links.</t>
</section>
<section title="Service Query">
<t>The mDNS gateway processes all queries against the configured
filtering policy. If the response to the query is permitted then it
constructs the answers and additional records required to resolve the
service from its cache for the services that are permitted. Services
that reside on the same link where the query is received are not
included as the owner of the service will also see the query and would
send the response directly. Only services learnt from different links
are considered in the response.</t>
<t>Any query received for additional RRs to resolve the service e.g.
query for SRV, A, AAAA etc are responded to in the same way. If the
records do not exist in the cache due to expiry or purging of cache
for any other reason, mDNS gateway sends out an explicit query to
fetch the records on the link where the service resides.</t>
</section>
<section title="Service Probing">
<t>According to <xref target="RFC6762"></xref> before registering a
service, RR probing is performed to ensure unique names. As the mDNS
gateway maintains a cache of all the RRs that are extended across the
links it responds to probe records like any other query. This will
help in detecting and resolving name space conflicts across links
where service discovery has been extended.</t>
</section>
<section title="Service update, Service withdrawal">
<t>When the mDNS gateway receives a service update or withdrawal it
updates or removes the service and all corresponding records from its
cache. It forwards the withdraw messages to other attached links.</t>
</section>
<section title="Service Refresh">
<t>The RRs describing the service and resolving it have a TTL that
defines the validity of the RR. The mDNS gateway can continuously
refresh each of the RRs in the cache as per the TTL rules. For the
purpose of optimization, the mDNS gateway can rely on the host
interested in the RRs to trigger a refresh by setting the TTLs in the
response to the time remaining since the record was learnt by the mDNS
gateway. If a client is interested in the RR then it would trigger a
refresh when a fraction of the TTL is reached. While responding to
queries from hosts, the mDNS gateway inturn sends out queries to
refresh the records that are about to expire on the source link where
the records were learnt.</t>
</section>
<section title="mDNS Gateway for Wireless Network">
<t>Deploying the mDNS gateway in wireless networks has a few
additional requirements w.r.t to multicast radio optimization and
mobility aspects. This section describes some additional capabilities
added to the mDNS gateway to satisfy these requirements.</t>
<section anchor="advertising_wireless"
title="Advertising services on wireless networks">
<t>In order to conserve wireless bandwidth, the mDNS gateway sends
service advertisements as L2 unicast messages to wireless devices
.</t>
<t>In a wireless network, the mDNS gateway co-located on the network
element that is providing the wireless service can act as a passive
device and respond only if wireless clients send a mDNS query. When
bridging is turned off the mDNS gateway and the Layer 2 optimazation
is enabled, the mDNS gateway will need to send the query responseas
layer 2 unicast messages even when the provider is on the same link
as the requestor. Bridging of mDNS messages can be turned off based
on configuration. This is useful in the following scenario:</t>
<t><list style="numbers">
<t>Save computation resources on the device which are used to
replicate the multicast packet as a L2 unicast for all wireless
clients.</t>
<t>If the wireless client is in power saving mode, sending a
mDNS advertisement as a L2 unicast would forcefully awake the
client and it would result into more power consumption by the
wireless client.</t>
</list></t>
<t>mDNS functionality is not impacted by acting as a passive gateway
because the client would always send the mDNS query when inquiring
for a service.</t>
</section>
<section title="Device Tracking">
<t>Wireless clients are mobile in nature. The mDNS gateway should
learn the service instance only from the authenticated wireless
client. The mDNS gateway should tag each service instance from a
wireless client with the client's MAC address. This MAC address
should be used for device tracking. If the wireless client leaves
the network, the mDNS gateway should not wait until the TTL expires
but it should actively clean up the service instance provided by
that wireless client. This is done to protect the mDNS gateway cache
resources as well as to keep other clients from hearing about
services that are no longer connected to the network..</t>
</section>
<section title="Mobility Considerations">
<t>Wireless deployments supports seamless mobility. In such a
scenario, the mDNS gateway needs to be aware of the client location.
If the location changes, the mDNS gateway needs to update its mDNS
cache. The mDNS gateway should tag each service instance with the
device location. The device location can be derived based on the
Access Point (AP) to which the wireless client is attached. If the
client, which is providing any service, changes its location, this
change needs to be reflected in the mDNS gateway. If the client
roams from one mDNS gateway to another mDNS gateway, then the old
gateway should provide the service instance information pertaining
to the roamed client to the new gateway and then it must clear the
mDNS cache for that particular client. If the mDNS gateway is not
acting as a passive gateway, it may choose to update the network
about the new service instance it has learnt.</t>
</section>
<section title="mDNS traffic optimization">
<t>All mDNS packets are sent to the multicast link-local IP address.
When the mDNS gateway starts forwarding the mDNS advertisements
across L3 boundaries then the number of such advertisement on any
network would increase. Wireless networks should be optimized for
the increase in mulitcast traffic that will be generated by
extending the service advertisement domain. If there are many mDNS
packets going on air then it would impact other data traffic. Hence
mDNS traffic optimization is required. One method of optimization
the mDNS gateway could implement is sending the query reponse back
as a L2 unicast to the requesting client.</t>
<t>When services are advertised, each record has an associated TTL
value. When the TTL expires, the gateway needs to send a query (at
85%, 90% and 95% of the TTL) for that record to confirm its
validity. If the TTL value of each record is different, then mDNS
gateway needs to send a query for individual records. To minimize
the mDNS traffic, queries for multiple RRs for that service record
set can be initiated towards the source of the service. Such a query
can be sent with the QU bit set as described in <xref
target="RFC6762"></xref> to solicit a unicast response.</t>
<t>The mDNS gateway for wireless networks should act as a passive
gateway as explained in <xref target="advertising_wireless"></xref>.
When it is acting as a passive gateway and bridging of mDNS packets
is turned off it has to respond to queries on the link even when the
provider of the service resides on the same link.</t>
</section>
</section>
</section>
<section title="Challenges">
<t>This section lists out limitations and challenges faced as part of
the the solution described in this draft.</t>
<t><list style="numbers">
<t>Name conflict resolution across links: Name conflict resolution
depends on probing followed by service registration. This is done by
the host which is providing the service. Name conflict resolution
across links depends on the mDNS gateway cache to have a conclusive
list of names already present to be able to authoritatively respond
to probe requests. However, this may not always be posible due to
timing issues when the cache gets updated, records having expired
from the cache etc.</t>
<t>Multi-homed hosts: There is also the case of a multihomed host
connected via multiple links to the same mDNS gateway that may end
up wrongly assuming conflict and getting into a continuous renaming
loop.</t>
<t>Multiple mDNS gateways on the link: If there are multiple mDNS
gateways enabled on the same link queries may get duplicate
responses.</t>
<t>Loops in the network: If there is a loop in the network with
multiple mDNS gateways enabled in such a topology it may end up
continuously cycling the service around the loop and keeping the RRs
alive forever.</t>
<t>Refreshing resource records: Balancing an excessive number of
queries to maintain the records in the cache vs. having the cache
up-to-date with all the known record names requires optimizations
that may lead to corner cases where wrong results or conflicts
arise.</t>
</list></t>
</section>
<section title="Future work">
<t>The solution documented here is limited to extending services across
links attached to a single network element or mDNS gateway. For a
broader application, the service discovery solution described in <xref
target="I-D.cheshire-mdnsext-hybrid"></xref> should be realized with any
provisioning as needed.</t>
<t>Similar to auto provisioning and realization of the hybrid proxy
approach for homenet as described in <xref
target="I-D.stenberg-homenet-dnssdext-hybrid-proxy-ospf"></xref> a
solution needs to be built for enterprise and campus networks extending
what has been described in this draft.</t>
<t>There are other considerations such as including the location
information so that services can be ordered based on proximity of the
service.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document makes no request of IANA.</t>
<t>Note to RFC Editor: this section may be removed on publication as an
RFC.</t>
</section>
<section anchor="Security" title="Security Considerations">
<t>N/A</t>
</section>
<section anchor="Acknowledgements" title="Acknowledgements">
<t></t>
</section>
</middle>
<back>
<references title="Normative References">
&RFC2119;
&RFC1035;
&RFC6762;
&RFC6763;
&I-D.cheshire-mdnsext-hybrid;
&I-D.stenberg-homenet-dnssdext-hybrid-proxy-ospf;
&I-D.sekar-dns-llq;
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 05:28:16 |