D.ietf-cose-rfc8152bis-struct. An example of a countersignature on a signature can be found in <del> Appendix_B_1_3.  An example of a countersignature in an encryption object can be found in Appendix_B_3_3. </del>  It should be noted that only a signature algorithm with appendix (see I-D.ietf-cose-rfc8152bis-struct) can be used for countersignatures. processing RFC8152. IANA is requested to register the following new items in the <del> registry. </del>  IANA is requested to modify the Description field for "counter signature" and "CounterSignature0" to include the words "(Deprecated 6. <del> TODO - review and trim as needed. </del> There are a number of security considerations that need to be taken into account by implementers of this specification.  While some considerations have been highlighted here, additional considerations multiple algorithms has been demonstrated in some cases to leak information about that key, provide the opportunity for attackers to forge integrity tags, or gain information about encrypted content. <del> Binding a key to a single algorithm prevents these problems.  Key creators and key consumers are strongly encouraged not only to create new keys for each different algorithm, but to include that selection of algorithm in any distribution of key material and strictly enforce the matching of algorithms in the key structure to algorithms in the message structure.  In addition to checking that algorithms are correct, the key form needs to be checked as well.  Do not use an 'EC2' key where an 'OKP' key is expected. </del>  Before using a key for transmission, or before acting on information received, a trust decision on a key needs to be made.  Is the data or with this trust decision.  Some of the ones that are highlighted here are: <del> One area that has been getting exposure is traffic analysis of encrypted messages based on the length of the message.  This specification does not provide for a uniform method of providing padding as part of the message structure.  An observer can distinguish between two different messages (for example, 'YES' and 'NO') based on the length for all of the content encryption algorithms that are defined in I-D.ietf-cose-rfc8152bis-algs document.  This means that it is up to the applications to document how content padding is to be done in order to prevent or discourage such analysis.  (For example, the text strings could be defined as 'YES' and 'NO '.) </del>  7.

Remove the sections from the Examples Applenix that were blank, clean up the Security Considerations, and narrow the table in the IANA considerations.
Looks good to me! Thanks! Let us know if you want us to merge it or you plan to do that yourself.

D.ietf-cose-rfc8152bis-struct. An example of a countersignature on a signature can be found in  <ins> Appendix_A_1_1.  An example of a countersignature in an encryption object can be found in Appendix_A_2_1. </ins> It should be noted that only a signature algorithm with appendix (see I-D.ietf-cose-rfc8152bis-struct) can be used for countersignatures. processing RFC8152. IANA is requested to register the following new items in the  <ins> registry.  For these entries, the Value Registry column will be blank and the Reference column will be [[This Document]]. </ins> IANA is requested to modify the Description field for "counter signature" and "CounterSignature0" to include the words "(Deprecated 6.  There are a number of security considerations that need to be taken into account by implementers of this specification.  While some considerations have been highlighted here, additional considerations multiple algorithms has been demonstrated in some cases to leak information about that key, provide the opportunity for attackers to forge integrity tags, or gain information about encrypted content.  <ins> Binding a key to a single algorithm prevents these problems. Key creators and key consumers are strongly encouraged not only to create new keys for each different algorithm, but to include that selection of algorithm in any distribution of key material and strictly enforce the matching of algorithms in the key structure to algorithms in the message structure.  In addition to checking that algorithms are correct, the key form needs to be checked as well.  Do not use an 'EC2' key where an 'OKP' key is expected. </ins> Before using a key for transmission, or before acting on information received, a trust decision on a key needs to be made.  Is the data or with this trust decision.  Some of the ones that are highlighted here are:  <ins> Analysis of the size of encrypted messages can provide information about the plaintext messages.  This specification does not provide a uniform method for padding messages prior to encryption.  An observer can distinguish between two different messages (for example, 'YES' and 'NO') based on the length for all of the content encryption algorithms that are defined in I-D.ietf-cose-rfc8152bis-algs.  This means that it is up to the applications to specify how content padding is to be done to prevent or discourage such analysis.  (For example, the text strings could be defined as 'YES' and 'NO '.) </ins> 7.


padding is to be done to prevent or discourage such analysis.  (For example, the text strings could be defined as 'YES' and 'NO '.)  7. This section records the status of known implementations of the

When either COSEEncrypt and COSEMac is used and more than two parties share the key, data origin authentication is not provided. Any party that knows the message-authentication key can compute a valid authentication tag; therefore, the contents could originate from any one of the parties that share the key. Countersignatures of COSEEncrypt and COSEMac with short authentication tags do not provide the security properties associated with the same algorithm used in COSESign. To provide 128-bit security against collision attacks, the tag length MUST be at least 256-bits. A countersignature of a COSEMac with AES-MAC 256/128 provides at most 64 bits of integrity protection. Similarly, a countersignature of a COSE_Encrypt with AES-CCM-16-64-128 provides at most 32 bits bits of integrity protection.

padding is to be done to prevent or discourage such analysis.  (For example, the text strings could be defined as 'YES' and 'NO '.) <ins> When either COSE_Encrypt and COSE_Mac is used and more than two parties share the key, data origin authentication is not provided. Any party that knows the message-authentication key can compute a valid authentication tag; therefore, the contents could originate from any one of the parties that share the key. Countersignatures of COSE_Encrypt and COSE_Mac with short authentication tags do not provide the security properties associated with the same algorithm used in COSE_Sign.  To provide 128-bit security against collision attacks, the tag length MUST be at least 256-bits.  A countersignature of a COSE_Mac with AES-MAC 256/128 provides at most 64 bits of integrity protection.  Similarly, a countersignature of a COSE_Encrypt with AES-CCM-16-64-128 provides at most 32 bits bits of integrity protection. </ins> 7. This section records the status of known implementations of the


A P-Route may be installed in either Storing and Non-Storing Mode, potentially resulting in hybrid situations where the Mode of the <del> P-Route is different from that of the RPL Main DODAG.  P-Routes can be used as stand-alone segments to reduce the size of the source routing headers with loose source routing operations down the main RPL DODAG.  P-Routes can also be combined with other P-Routes to form a more complex forwarding graph called a Track. </del>  3.3.

Comments on the content In the XML file you can search for "COMMENT:". In the TXT file, the comments start with "_COMMENT:"
I'll address inline and commit too. Many thanks Aris!!!

A P-Route may be installed in either Storing and Non-Storing Mode, potentially resulting in hybrid situations where the Mode of the  <ins> P-Route is different from that of the RPL Main DODAG. P-Routes can be used as stand-alone segments to reduce the size of the source routing headers with loose source routing operations down the main RPL DODAG.  P-Routes can also be combined with other P-Routes to form a more complex forwarding graph called a Track. </ins> 3.3.


DetNet Data Plane: MPLS <del> draft-ietf-detnet-mpls-09 </del>  Abstract within a domain, they must be advertised to their upstream DetNet service-aware peer nodes (e.g., a DetNet MPLS End System or a DetNet Relay or Edge Node) and interpreted in the context of their received <del> F-Label(s). </del>  An S-Label will normally be at the bottom of the label stack once the last F-Label is removed, immediately preceding the d-CW.  To support e.g., via the controller plane described in I-D.ietf-detnet-data- plane-framework.  When replication is configure, the same app-flow data will be sent over multiple outgoing DetNet member flows using <del> forwarding sub-layer LSPs.  The same d-CW field value MUST be used on all outgoing member flows for each replicated MPLS packet. </del>  4.2.2.2. When sending a DetNet flow, zero or more F-Labels MAY be pushed on top of an S-Label by the node pushing an S-Label.  The F-Label(s) to be pushed when sending a particular DetNet service MUST be <del> provisioned per DetNet service via configuration, e.g., via the </del>  controller plane discussed in I-D.ietf-detnet-data-plane-framework. F-Label(s) can also provide context for an S-Label.  To allow for the omission of F-Label(s), an implementation SHOULD also allow an <del> outgoing interface to be configured. </del>  <del> When PRF is supported, the same app-flow data will be sent over </del>  multiple outgoing DetNet member flows using forwarding sub-layer <del> LSPs.  To support PRF an implementation MUST support the setting of different sets of F-Labels per DetNet member flow.  To allow for the omission of F-Labels, an implementation SHOULD also allow multiple outgoing interfaces to be provisioned. </del>  When a single set of F-Labels is provisioned for a particular outgoing S-Label, that set of F-labels MUST be pushed after the When multiple sets of outgoing F-Labels or interfaces are provisioned for a particular DetNet service, a copy of the outgoing packet, <del> including the pushed S-Label, MUST be made per F-label set and outgoing interface.  Each set of provisioned F-Labels are then pushed onto a copy of the packet.  Each copy is then forwarded as described below in f-labels-all. </del>  As described in the previous section, when receiving a DetNet MPLS flow, an implementation identifies the DetNet service associated with values included 0, 16 and 28 bits. 0 bits cannot be used when PEF or POF is configured for the service. <del> The outgoing S-Label for the service. </del> If PRF is to be provided for the service.  The forwarding sub-layer information associated with the output of the service sub-layer.  Note that when the PRF function is provisioned, this information is per DetNet member flow.

Clarifying S-Label procedures (i.e., allowing S-Label value per outgoing member flow after PRF).

DetNet Data Plane: MPLS  <ins> draft-ietf-detnet-mpls-10 </ins> Abstract within a domain, they must be advertised to their upstream DetNet service-aware peer nodes (e.g., a DetNet MPLS End System or a DetNet Relay or Edge Node) and interpreted in the context of their received  <ins> F-Label(s).  In some PREOF topologies, the node performing replication will be sending to multiple nodes performing PEF or POF, and may need to send different S-Label values for the different member flows for the same DetNet service. </ins> An S-Label will normally be at the bottom of the label stack once the last F-Label is removed, immediately preceding the d-CW.  To support e.g., via the controller plane described in I-D.ietf-detnet-data- plane-framework.  When replication is configure, the same app-flow data will be sent over multiple outgoing DetNet member flows using  <ins> forwarding sub-layer LSPs.  An S-Label value MUST be configured per outgoing member flow.  The same d-CW field value MUST be used on all outgoing member flows for each replicated MPLS packet. </ins> 4.2.2.2. When sending a DetNet flow, zero or more F-Labels MAY be pushed on top of an S-Label by the node pushing an S-Label.  The F-Label(s) to be pushed when sending a particular DetNet service MUST be  <ins> provisioned per outgoing S-Label via configuration, e.g., via the </ins> controller plane discussed in I-D.ietf-detnet-data-plane-framework. F-Label(s) can also provide context for an S-Label.  To allow for the omission of F-Label(s), an implementation SHOULD also allow an  <ins> outgoing interface to be configured per S-Label. </ins>  <ins> Note, when PRF is supported, the same app-flow data will be sent over </ins> multiple outgoing DetNet member flows using forwarding sub-layer  <ins> LSPs.  This means that implementation may be sending different sets of F-Labels per DetNet member flow, each with a different S-Label. </ins> When a single set of F-Labels is provisioned for a particular outgoing S-Label, that set of F-labels MUST be pushed after the When multiple sets of outgoing F-Labels or interfaces are provisioned for a particular DetNet service, a copy of the outgoing packet,  <ins> including the pushed member flow-specific S-Label, MUST be made per F-label set and outgoing interface.  Each set of provisioned F-Labels are then pushed onto a copy of the packet.  Each copy is then forwarded as described below in f-labels-all. </ins> As described in the previous section, when receiving a DetNet MPLS flow, an implementation identifies the DetNet service associated with values included 0, 16 and 28 bits. 0 bits cannot be used when PEF or POF is configured for the service.  If PRF is to be provided for the service. <ins> The outgoing S-Label for each of the service's outgoing DetNet (member) flow. </ins> The forwarding sub-layer information associated with the output of the service sub-layer.  Note that when the PRF function is provisioned, this information is per DetNet member flow.


Layer-2. <del> Layer-3. </del> Label-switched path. Multiprotocol Label Switching. <del> Provider Edge. </del> Packet Elimination Function. Packet Replication Function. Packet Ordering Function. <del> Packet Switched Network. </del> Pseudowire. DetNet "service" label.  Terminating Provider Edge. Traffic Engineering. Note that such configuration MAY include support from PREOF on the incoming DetNet MPLS flow.  5.2. The traffic treatment required for a particular DetNet IP flow is processing according to I-D.ietf-detnet-mpls. It is the responsibility of the DetNet controller plane to properly <del> provision both flow identification information and the flow specific resources needed to provided the traffic treatment needed to meet each flow's service requirements.  This applies for aggregated and individual flows. </del>  7.

Note added to 5.1, that L4 multipath is out-of-scope. Please, check note and its placement that it is appropriate. URL URL Internet-Draft draft-ietf-detnet-ip-oam-URL is now available. It is a work item of the Deterministic Networking (DETNET) WG of the IETF. Title: Operations, Administration and Maintenance (OAM) for Deterministic Networks (DetNet) with IP Data Plane Authors: Greg Mirsky Mach(Guoyi) Chen David Black Name: draft-ietf-detnet-ip-oam-URL Pages: 9 Dates: 2024-02-05 Abstract: This document discusses the use of existing IP Operations, Administration, and Maintenance protocols and mechanisms in Deterministic Networking networks that use the IP data plane. The IETF datatracker status page for this Internet-Draft is: URL There is also an HTML version available at: URL A diff from the previous version is available at: https://author-URL Internet-Drafts are also available by rsync at: URL
Hi Bernard, thank you for your thoughtful comments and helpful suggestions. The authors discussed them and updated the draft to address your concerns. I uploaded the new version: A new version of Internet-Draft draft-ietf-detnet-ip-oam-URL has been successfully submitted by Greg Mirsky and posted to the IETF repository. Name: draft-ietf-detnet-ip-oam Revision: 11 Title: Operations, Administration and Maintenance (OAM) for Deterministic Networks (DetNet) with IP Data Plane Date: 2024-02-05 Group: detnet Pages: 9 URL: URL Status: URL HTML: URL HTMLized: URL Diff: https://author-URL Abstract: This document discusses the use of existing IP Operations, Administration, and Maintenance protocols and mechanisms in Deterministic Networking networks that use the IP data plane. Please let us know whether these updates adequately address your comments. Our sincere thanks for your help in improving this document. Regards, Greg (on behalf of the authors)

Layer-2.  Label-switched path. Multiprotocol Label Switching.  Packet Elimination Function. Packet Replication Function. Packet Ordering Function.  Pseudowire. DetNet "service" label. <ins> Switching Provider Edge. </ins> Terminating Provider Edge. Traffic Engineering. Note that such configuration MAY include support from PREOF on the incoming DetNet MPLS flow. <ins> Note: using Layer-4 (L4) transport protocols e.g., for multipath are out of scope of this document both for a single flow and aggregate flows. </ins> 5.2. The traffic treatment required for a particular DetNet IP flow is processing according to I-D.ietf-detnet-mpls. It is the responsibility of the DetNet controller plane to properly  <ins> provision both flow identification information and the flow-specific resources needed to provide the traffic treatment to meet each flow's service requirements.  This applies for aggregated and individual flows. </ins> 7.


5.  5.1. A DetNet relay node (ingress T-PE) that sends a DetNet IP flow over a Section 5.1. An implementation MUST support the provisioning for handling any <del> received DetNet MPLS data plane as DetNet IP flows via configuration. Note that such configuration MAY include support from PREOF on the incoming DetNet MPLS flow. </del>  Note: using Layer-4 (L4) transport protocols e.g., for multipath are out of scope of this document both for a single flow and aggregate

Changes: 1, Section “5. IP over DetNet MPLS Procedures” Add new text before section 5.1. 2, Fix a nit in penultimate paragraph of “5.1. DetNet IP over DetNet MPLS Flow Identification and Aggregation Procedures”

5. <ins> Main differences of mapping to DetNet MPLS (compared to plain MPLS) are that (1) there is a mandatory flow identification to make the forwarding decision (i.e., forwarding is not based on FEC), (2) the d-CW (DetNet Control Word) is mandatory for the MPLS encapsulation and (3) during forwarding over the DetNet MPLS network DetNet flow specific treatment is needed. </ins> 5.1. A DetNet relay node (ingress T-PE) that sends a DetNet IP flow over a Section 5.1. An implementation MUST support the provisioning for handling any  <ins> packet flows received via DetNet MPLS data plane as DetNet IP flows via configuration.  Note that such configuration MAY include support from PREOF on the incoming DetNet MPLS flow. </ins> Note: using Layer-4 (L4) transport protocols e.g., for multipath are out of scope of this document both for a single flow and aggregate


5. <del> The following summarizes the set of information that is needed to configure DetNet MPLS over UDP/IP: </del>  Label information (A-labels, S-labels and F-labels) to be mapped to UDP/IP flow.  Note that for example, a single S-Label can map UDP Destination Port.  This information MUST be provisioned per DetNet flow via configuration, e.g., via the controller RFC8655 or management plane.  It is the responsibility of the DetNet controller plane to properly provision both flow identification information and the flow specific

In chapter 5. Management and Control Information Summary one more bullet added + clarification text to the paragraph after the list.

5.  <ins> The following summarizes the minimum set of information that is needed to configure DetNet MPLS over UDP/IP: </ins> Label information (A-labels, S-labels and F-labels) to be mapped to UDP/IP flow.  Note that for example, a single S-Label can map UDP Destination Port. <ins> Use/non-use of UDP checksum. </ins> This information MUST be provisioned per DetNet flow via configuration, e.g., via the controller RFC8655 or management plane. <ins> Not using the UDP checksum has to be evaluated on a case-by-case basis for a given network scenario based on the exception criteria's defined in RFC7510, particularly when IPv6 is used. </ins> It is the responsibility of the DetNet controller plane to properly provision both flow identification information and the flow specific


IEEE8021CB and IEEEP8021CBdb) whether the packet belongs to a configured TSN Stream (i.e., App-flow from DetNet perspective).  If no Stream ID is matched and no other (VPN) service is configured for <del> the AC then packet MUST be dropped.  If there is a matching TSN Stream then the Stream ID specific TSN functions are executed (e.g., </del>  ingress policing, header field manipulation in case of active Stream Identification, FRER, etc.).  Source MAC lookup may also be used for local MAC address learning. according to the TSN Stream specific configuration to connected CE(s) (in case of local bridging) and/or to the DetNet Service Proxy (in case of forwarding to remote CE(s)).  If there are no TSN Stream <del> specific forwarding configurations the PE MUST flood the packet to </del>  other locally attached CE(s) and to the DetNet Service Proxy.  If the <del> administrative policy on the PE does not allow flooding the PE MUST </del>  drop the packet. When a TSN entity of the PE receives a packet from the DetNet Service Proxy, it first checks via Stream Identification (see Clause 6. of IEEE8021CB and IEEEP8021CBdb) whether the packet belongs to a <del> configured TSN Stream.  If no Stream ID is matched then packet is dropped.  If there is a matching TSN Stream then the Stream ID </del>  specific TSN functions are executed (e.g., header field manipulation in case of active Stream Identification, FRER, etc.).  Source MAC lookup may also be used for local MAC address learning. If the PE decides to forward the packet, the packet is forwarded according to the TSN Stream specific configuration to connected <del> CE(s).  If there are no TSN Stream specific forwarding configurations the PE floods the packet to locally attached CE(s).  If the administrative policy on the PE does not allow flooding the PE drops the packet. </del>  Implementations of this document SHALL use management and control information to ensure TSN specific functions of the Edge Node

Adding commas, the editor will probably catch these.
Hi Don, many thanks for the review. Cheers Bala'zs

IEEE8021CB and IEEEP8021CBdb) whether the packet belongs to a configured TSN Stream (i.e., App-flow from DetNet perspective).  If no Stream ID is matched and no other (VPN) service is configured for  <ins> the AC, then packet MUST be dropped.  If there is a matching TSN Stream, then the Stream ID specific TSN functions are executed (e.g., </ins> ingress policing, header field manipulation in case of active Stream Identification, FRER, etc.).  Source MAC lookup may also be used for local MAC address learning. according to the TSN Stream specific configuration to connected CE(s) (in case of local bridging) and/or to the DetNet Service Proxy (in case of forwarding to remote CE(s)).  If there are no TSN Stream  <ins> specific forwarding configurations, the PE MUST flood the packet to </ins> other locally attached CE(s) and to the DetNet Service Proxy.  If the  <ins> administrative policy on the PE does not allow flooding, the PE MUST </ins> drop the packet. When a TSN entity of the PE receives a packet from the DetNet Service Proxy, it first checks via Stream Identification (see Clause 6. of IEEE8021CB and IEEEP8021CBdb) whether the packet belongs to a  <ins> configured TSN Stream.  If no Stream ID is matched, then packet is dropped.  If there is a matching TSN Stream, then the Stream ID </ins> specific TSN functions are executed (e.g., header field manipulation in case of active Stream Identification, FRER, etc.).  Source MAC lookup may also be used for local MAC address learning. If the PE decides to forward the packet, the packet is forwarded according to the TSN Stream specific configuration to connected  <ins> CE(s).  If there are no TSN Stream specific forwarding configurations, the PE floods the packet to locally attached CE(s). If the administrative policy on the PE does not allow flooding, the PE drops the packet. </ins> Implementations of this document SHALL use management and control information to ensure TSN specific functions of the Edge Node


6. <del> [Editor's Note] The following will summarize the set of information that is needed to support the MPLS DetNet data plane. </del>  7. <del> The security considerations of DetNet in general are discussed in I- D.ietf-detnet-architecture and I-D.sdt-detnet-security.  Other security considerations will be added in a future version of this draft. </del>  8.

Fixing up MPLS draft as agreed. Also fixing some Warnings in other drafts from doing a full make.
LGTM

6.  <ins> The following summarizes the set of information that is needed to identify an individual DetNet flow in an MPLS context: MPLS Service Label and d-CW labels at a DetNet end system. MPLS Service Label and d-CW in the context of one or more MPLS Forwarding Labels at any DetNet aware device along the path. Any aggregate flow by one or more MPLS Forwarding Labels at any DetNet aware device along the path. Any other DetNet flow information for example IP Flow Identification beyond the MPLS service label as specified in I- D.ietf-detnet-ip at a DetNet aware device. </ins> 7.  <ins> Security considerations for DetNet are described in detail in I- D.ietf-detnet-security.  General security considerations are described in I-D.ietf-detnet-architecture.  This section considers exclusively security considerations which are specific to the DetNet MPLS data plane. Security aspects which are unique to DetNet are those whose aim is to provide the specific quality of service aspects of DetNet, which are primarily to deliver data flows with extremely low packet loss rates and bounded end-to-end delivery latency. The primary considerations for the data plane is to maintain integrity of data and delivery of the associated DetNet service traversing the DetNet network.  Application flows can be protected through whatever means is provided by the underlying technology.  For example, encryption may be used, such as that provided by IPSec RFC4301 for IP flows and/or by an underlying sub-net using MACSec IEEE802.1AE-2018 for IP over Ethernet (Layer-2) flows. From a data plane perspective this document does not add or modify any header information. At the management and control level DetNet flows are identified on a per-flow basis, which may provide controller plane attackers with additional information about the data flows (when compared to controller planes that do not include per-flow identification).  This is an inherent property of DetNet which has security implications that should be considered when determining if DetNet is a suitable technology for any given use case. To provide uninterrupted availability of the DetNet service, provisions can be made against DOS attacks and delay attacks.  To protect against DOS attacks, excess traffic due to malicious or malfunctioning devices can be prevented or mitigated, for example through the use of existing mechanism such as policing and shaping applied at the input of a DetNet domain.  To prevent DetNet packets from being delayed by an entity external to a DetNet domain, DetNet technology definition can allow for the mitigation of Man-In-The- Middle attacks, for example through use of authentication and authorization of devices within the DetNet domain. </ins> 8.


Abstract This document specifies the Deterministic Networking MPLS data plane <del> when operating over a TSN network. </del>  1. <del> [Editor's note: Introduction to be made specific to DetNet MPLS over TSN scenario.  May be similar to intro of DetNet IP over TSN.]. </del> Deterministic Networking (DetNet) is a service that can be offered by a network to DetNet flows.  DetNet provides these flows with a low packet loss rates and assured maximum end-to-end delivery latency. provides congestion protection (low loss, assured latency, and limited reordering) leveraging MPLS Traffic Engineering mechanisms. <del> This document specifies the DetNet data plane operation and the on- wire encapsulation of DetNet flows over an MPLS-based Packet Switched Network (PSN).  The specified encapsulation provides the building blocks to enable the DetNet service and forwarding sub-layer functions and supports flow identification as described in the DetNet Architecture.  As part of the service sub-layer functions, this document describes DetNet node data plane operation.  It also describes the function and operation of the Packet Replication (PRF) Packet Elimination (PEF) and Packet Ordering (POF) functions with an MPLS data plane.  It also describes an MPLS-based DetNet forwarding sub-layer that eliminates (or reduces) contention loss and provides bounded latency for DetNet flows. MPLS encapsulated DetNet flows can be carried over network technologies that can provide the DetNet required level of service. This document defines examples of such, specifically carrying DetNet MPLS flows over IEEE 802.1 TSN sub-networks, and over DetNet IP PSN. The intent is for this document to support different traffic types being mapped over DetNet MPLS, but this is out side the scope of this document.  An example of such can be found in I-D.ietf-detnet-dp-sol- ip.  This document also allows for, but does not define, associated controller plane and Operations, Administration, and Maintenance (OAM) functions. </del>  2. 2.1. This document uses the terminology established in the DetNet <del> architecture I-D.ietf-detnet-architecture, and the reader is assumed to be familiar with that document and its terminology. The following terminology is introduced in this document: A Detnet "forwarding" label that identifies the LSP used to forward a DetNet flow across an MPLS PSN, e.g., a hop-by-hop label used between label switching routers (LSR). A DetNet "service" label that is used between DetNet nodes that implement also the DetNet service sub-layer functions.  An S-Label is also used to identify a DetNet flow at DetNet service sub- layer. A DetNet Control Word (d-CW) is used for sequencing and identifying duplicate packets of a DetNet flow at the DetNet service sub-layer. </del>  2.2. The following abbreviations are used in this document: <del> Attachment Circuit. Customer Edge equipment. Class of Service. </del> Control Word. Deterministic Networking. DetNet Flow. <del> DetNet Inter-Working Function. </del>  Layer 2. <del> Layer 2 Virtual Private Network. </del> Layer 3. Label Switching Router. Multiprotocol Label Switching. <del> Multiprotocol Label Switching - Traffic Engineering. Multiprotocol Label Switching - Transport Profile. Multi-Segment PseudoWire (MS-PW). Native Service Processing. Operations, Administration, and Maintenance. </del> Provider Edge. <del> Packet Elimination Function. Packet Replication Function. </del> Packet Replication, Elimination and Ordering Functions. <del> Packet Ordering Function. </del> Packet Switched Network. PseudoWire. <del> Quality of Service. </del> Switching Provider Edge. Terminating Provider Edge. Time-Sensitive Network. <del> 3. </del>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. <del> 4. [Editor's note: simplify this section and highlight DetNet MPLS over subnets scenario being the focus in the remaining part of the document.]. 4.1. </del>  <del> This document describes how DetNet flows are carried over MPLS networks.  The DetNet Architecture, I-D.ietf-detnet-architecture, decomposes the DetNet data plane into two sub-layers: a service sub- layer and a forwarding sub-layer.  The basic approach defined in this document supports the DetNet service sub-layer based on existing pseudowire (PW) encapsulations and mechanisms, and supports the DetNet forwarding sub-layer based on existing MPLS Traffic Engineering encapsulations and mechanisms.  Background on PWs can be found in RFC3985 and RFC3031.  Background on MPLS Traffic Engineering can be found in RFC3272 and RFC3209. The DetNet MPLS data plane approach defined in this document is shown in dn_mpls_dp_approach.  The service sub-layer is supported by a DetNet control word (d-CW) which conforms to the Generic PW MPLS Control Word (PWMCW) defined in RFC4385.  A d-CW identifying service label (S-Label) is also used. </del>  A node operating on a DetNet flow in the Detnet service sub-layer, <del> i.e. a node processing a DetNet packet which has the S-Label as top </del>  of stack uses the local context associated with that S-Label, for example a received F-Label, to determine what local DetNet operation(s) are applied to that packet.  An S-Label may be unique when taken from the platform label space RFC3031, which would enable correct DetNet flow identification regardless of which input <del> interface or LSP the packet arrives on. </del>  The DetNet MPLS data plane builds on MPLS Traffic Engineering encapsulations and mechanisms to provide a forwarding sub-layer that The forwarding sub-layer is supported by one or more forwarding labels (F-Labels). <del> 4.2. [Editor's note: simplify this section and highlight DetNet MPLS over subnets scenario being the focus in the remaining part of the document.]. </del>  <del> fig_dn_mpls_detnet illustrates a hypothetical DetNet MPLS-only network composed of DetNet aware MPLS enabled end systems, operating over a DetNet aware MPLS network.  In this figure, relay nodes sit at MPLS LSP boundaries and transit nodes are LSRs. DetNet end system and relay nodes are DetNet service sub-layer aware, </del>  understand the particular needs of DetNet flows and provide both DetNet service and forwarding sub-layer functions.  They add, remove <del> and process d-CWs, S-Labels and F-labels as needed.  MPLS enabled end system and relay nodes can enhance the reliability of delivery by enabling the replication of packets where multiple copies, possibly over multiple paths, are forwarded through the DetNet domain.  They can also eliminate surplus previously replicated copies of DetNet packets.  DetNet MPLS nodes provide functionality similar to T-PEs when they sit at the edge of an MPLS domain, and functionality similar to S-PEs when they are in the middle of an MPLS domain, see RFC6073.  End system and relay nodes also include DetNet forwarding sub-layer functions, support for notably explicit routes, and resources allocation to eliminate (or reduce) congestion loss and jitter. </del>  DetNet transit nodes reside wholly within a DetNet domain, and also provide DetNet forwarding sub-layer functions in accordance with the performance required by a DetNet flow carried over an LSP.  Unlike other DetNet node types, transit nodes provide no service sub-layer <del> processing.  In a DetNet MPLS network, transit nodes may be DetNet service aware or may be DetNet unaware MPLS Label Switching Routers (LSRs).  In this latter case, such LSRs would be unaware of the special requirements of the DetNet service sub-layer, but would still provide traffic engineering services and the QoS need to ensure that the (TE) LSPs meet the service requirements of the carried DetNet flows. The LSPs may be provided by any MPLS controller method.  For example they may be provisioned via a management plane, RSVP-TE, MPLS-TP, or MPLS Segment Routing (when extended to support resource allocation). [Editor's note: Figure 3. and surrunding text are candidates to delete from this document.]. fig_pw_detnet illustrates how an end to end MPLS-based DetNet service is provided in a more detail.  In this figure, the end systems, CE1 and CE2, are able to send and receive MPLS encapsulated DetNet flows, and R1, R2 and R3 are relay nodes as they sit in the middle of a DetNet network.  The 'X' in the end systems, and relay nodes represents potential DetNet compound flow packet replication and elimination points.  In this example, service protection is supported over four DetNet member flows and TE LSPs.  For a unidirectional flow, R1 supports PRF, R2 supports PREOF and R3 supports PEF and POF. Note that the relay nodes may change the underlying forwarding sub- layer, for example tunneling MPLS over IEEE 802.1 TSN mpls-over-tsn, or simply over interconnect network links. As previously mentioned, this document specifies how MPLS is used to support DetNet flows using an MPLS data plane as well as how such can be mapped to IEEE 802.1 TSN and IP DetNet PSNs.  An equally import scenario is when IP is supported over DetNet MPLS and this is covered in I-D.ietf-detnet-dp-sol-ip.  Another important scenario is where an Ethernet Layer 2 service is supported over DetNet MPLS and this is covered in [TBD-TSN-OVER-DETNET]. 4.3. [Editor's note: this text might be relevant for the discussion of FRER within the TSN sub-network.  Needs revision.]. An example DetNet MPLS network fragment and packet flow is illustrated in fig_mpls_example. In fig_mpls_example the numbers are used to identify the instance of a packet.  Packet 1 is the original packet, and packets 1.1, and 1.2 are two first generation copies of packet 1.  Packet 1.2.1 is a second generation copy of packet 1.2 etc.  Note that these numbers never appear in the packet, and are not to be confused with sequence numbers, labels or any other identifier that appears in the packet. They simply indicate the generation number of the original packet so that its passage through the network fragment can be identified to the reader. Customer Equipment CE1 sends a packet into the DetNet enabled MPLS network.  This is packet (1).  Edge Node EN1 encapsulates the packet as a DetNet Packet and sends it to Relay node R1 (packet 1.1).  EN1 makes a copy of the packet (1.2), encapsulates it and sends this copy to Relay node R4. Note that along the MPLS path from EN1 to R1 there may be zero or more LSRs which, for clarity, are not shown.  The same is true for any other path between two DetNet entities shown in fig_mpls_example. Relay node R4 has been configured to send one copy of the packet to Relay Node R2 (packet 1.2.1) and one copy to Edge Node EN2 (packet 1.2.2). R2 receives packet copy 1.2.1 before packet copy 1.1 arrives, and, having been configured to perform packet elimination on this DetNet flow, forwards packet 1.2.1 to Relay Node R3.  Packet copy 1.1 is of no further use and so is discarded by R2. Edge Node EN2 receives packet copy 1.2.2 from R4 before it receives packet copy 1.2.1 from R2 via relay Node R3.  EN2 therefore strips any DetNet encapsulation from packet copy 1.2.2 and forwards the packet to CE2.  When EN2 receives the later packet copy 1.2.1 this is discarded. The above is of course illustrative of many network scenarios that can be configured.  Between a pair of relay nodes there may be one or more transit nodes that simply forward the DetNet traffic, but these are omitted for clarity. 5. [Editor's note: Sort out what data plane considerations are relevant for sub-net scenarios.]. This section provides informative considerations related to providing DetNet service to flows which are identified based on their header information.  At a high level, the following are provided on a per flow basis: Use of allocated resources (queuing, policing, shaping) to ensure that the congestion-related loss and latency/jitter requirements of a DetNet flow are met. </del>  <del> Use of a specific path for a flow.  This limits misordering and bounds latency. Which in the case of this document primarily relates to replication and elimination.  Changing the explicit path after a failure is detected in order to restore delivery of the required DetNet service characteristics is also possible.  Path changes, even in the case of failure recovery, can lead to the out of order delivery of data. Generally, distributing packets of the same DetNet flow over multiple paths is not recommended.  Such load sharing, e.g., via ECMP or UCMP, impacts ordering and possibly jitter. For example, to support identification of misbehaving flows. For example, increase counters. For example, unexpected loss. The DetNet data plane also allows for the aggregation of DetNet flows, e.g., via MPLS hierarchical LSPs, to improved scaling.  When DetNet flows are aggregated, transit nodes provide service to the aggregate and not on a per-DetNet flow basis.  In this case, nodes performing aggregation will ensure that per-flow service requirements are achieved. 5.1. </del>  <del> As shown in fig_dn_mpls_detnet, MPLS nodes are interconnected by different sub-network technologies, which may include point-to-point links.  Each of these need to provide appropriate service to DetNet flows.  In some cases, e.g., on dedicated point-to-point links or TDM technologies, all that is required is for a DetNet node to appropriately queue its output traffic.  In other cases, DetNet nodes will need to map DetNet flows to the flow semantics (i.e., identifiers) and mechanisms used by an underlying sub-network technology.  fig_dn_mpls_sn_ex shows several examples of header formats that can be used to carry DetNet MPLS flows over different sub-network technologies.  L2 represent a generic layer-2 encapsulation that might be used on a point-to-point link.  TSN represents the encapsulation used on an IEEE 802.1 TSN network, as described in mpls-over-tsn.  UDP/IP represents the encapsulation used on a DetNet IP PSN. </del>  <del> 6. </del>  <del> [Editor's note: this is a place holder section.  A standalone section on MPLS over IEEE 802.1 TSN.  Includes RFC2119 Language.] </del>  <del> This section covers how DetNet MPLS flows operate over an IEEE 802.1 TSN sub-network.  fig_mpls_detnet_to_tsn illustrates such a scenario, where two MPLS (DetNet) nodes are interconnected by a TSN sub- network.  Node-1 is single homed and Node-2 is dual-homed.  MPLS nodes can be (1) DetNet MPLS End System, (2) DetNet MPLS Edge or Relay node or (3) MPLS Transit node. </del>  <del> Note: in case of MPLS Transit node there is no DetNet Service sub- layer processing. </del>  The Time-Sensitive Networking (TSN) Task Group of the IEEE 802.1 Working Group have defined (and are defining) a number of amendments compatible with and useful to, DetNet networks.  All these functions have to identify flows those require TSN treatment. <del> As is the case for DetNet, a Layer 2 network node such as a bridge may need to identify the specific DetNet flow to which a packet belongs in order to provide the TSN/DetNet QoS for that packet.  It also may need a CoS marking, such as the priority field of an IEEE Std 802.1Q VLAN tag, to give the packet proper service. </del>  <del> The challange for MPLS DeNet flows is that the protocol interworking function defined in IEEE8021CB works only for IP flows.  The aim of the protocol interworking function is to convert an ingress flow to use a specific multicast destination MAC address and VLAN, for example to direct the packets through a specific path inside the bridged network.  A similar interworking pair at the other end of the TSN sub-network would restore the packet to its original destination MAC address and VLAN. As protocol interworking function defined in IEEE8021CB does not work for MPLS labeled flows, the DetNet MPLS nodes MUST ensure proper TSN sub-network specific Ethernet encapsulation of the DetNet MPLS packets.  For a given TSN Stream (i.e., DetNet flow) an MPLS (DetNet) node MUST behave as a TSN-aware Talker or a Listener inside the TSN sub-network. 6.1. TSN capable MPLS (DetNet) nodes are TSN-aware Talker/Listener as shown in fig_mpls_with_tsn.  MPLS (DetNet) node MUST provide the TSN sub-network specific Ethernet encapsulation over the link(s) towards the sub-network.  An TSN-aware MPLS (DetNet) node MUST support the following TSN components: </del>  <del> For recognizing flows: </del>  <del> Stream Identification (MPLS-flow-aware) </del>  <del> For FRER used inside the TSN domain, additonaly: </del>  <del> Sequencing function (MPLS-flow-aware) </del>  <del> Sequence encode/decode function </del>  <del> For FRER when the node is a TSN replication or elimination point, additionally: </del>  <del> Stream splitting function </del>  <del> Individual recovery function </del>  <del> [Editor's note: Should we added here requirements regarding IEEE 802.1Q C-VLAN component?] </del>  <del> The Stream Identification and The Sequencing functions are slightly modified for frames passed down the protocol stack from the upper layers. </del>  <del> Stream Identification MUST pair MPLS flows and TSN Streams and encode that in data plane formats as well.  The packet's stream_handle subparameter (see IEEE8021CB) inside the Talker/Listener is defined based on the Flow-ID used in the upper DetNet MPLS layer.  Stream Identification function MUST encode Ethernet header fields namely (1) the destination MAC-address, (2) the VLAN-ID and (3) priority parameters with TSN sub-network specific values.  Encoding is provided for the frame passed down the stack from the upper layers. </del>  <del> The sequence generation function resides in the Sequencing function. It generates a sequence_number subparameter for each packet of a Stream passed down to the lower layers.  Sequencing function MUST copy sequence information from the MPLS d-CW of the packet to the sequence_number subparameter for the frame passed down the stack from the upper layers. </del>  The Sequence encode/decode function MUST support the Redundancy tag (R-TAG) format as per Clause 7.8 of IEEE8021CB. <del> 6.2. </del>  TSN Streams supporting DetNet flows may use Frame Replication and <del> Elimination for Redundancy (FRER) [802.1CB] based on the loss service requirements of the TSN Stream, which is derived from the DetNet service requirements of the DetNet mapped flow.  The specific operation of FRER is not modified by the use of DetNet and follows IEEE8021CB. </del>  FRER function and the provided service recovery is available only <del> within the TSN sub-network however as the Stream-ID and the TSN sequence number are paired with the MPLS flow parameters they can be combined with PREOF functions. 6.3. [Editor's note: This section is TBD - covers required behavior of a TSN-aware DetNet node using a TSN underlay.] </del>  <del> 6.4. [Editor's NOTE: review and simplify this section.  May overlap with previous sections.] The Time-Sensitive Networking (TSN) Task Group of the IEEE 802.1 Working Group have defined (and are defining) a number of amendments to IEEE8021Q that provide zero congestion loss and bounded latency in bridged networks.  IEEE8021CB defines packet replication and elimination functions that should prove both compatible with and useful to, DetNet networks. As is the case for DetNet, a Layer 2 network node such as a bridge may need to identify the specific DetNet flow to which a packet belongs in order to provide the TSN/DetNet QoS for that packet.  It also will likely need a CoS marking, such as the priority field of an IEEE Std 802.1Q VLAN tag, to give the packet proper service. Although the flow identification methods described in IEEE8021CB are flexible, and in fact, include IP 5-tuple identification methods, the baseline TSN standards assume that every Ethernet frame belonging to a TSN stream (i.e.  DetNet flow) carries a multicast destination MAC address that is unique to that flow within the bridged network over which it is carried.  Furthermore, IEEE8021CB describes three methods by which a packet sequence number can be encoded in an Ethernet frame. Ensuring that the proper Ethernet VLAN tag priority and destination MAC address are used on a DetNet/TSN packet may require further clarification of the customary L2/L3 transformations carried out by routers and edge label switches.  Edge nodes may also have to move sequence number fields among Layer 2, PW, and IP encapsulations. </del>  <del> 7. </del>  <del> [Editor's note: This section is TBD Covers Creation, mapping, removal of TSN Stream IDs, related parameters and,when needed, configuration of FRER.  Supported by management/control plane.  SEE sections in removed text file.] While management plane and control planes are traditionally considered separately, from the Data Plane perspective there is no practical difference based on the origin of flow provisioning information, and the DetNet architecture I-D.ietf-detnet-architecture refers to these collectively as the 'Controller Plane'.  This document therefore does not distinguish between information provided by distributed control plane protocols, e.g., RSVP-TE RFC3209 and RFC3473, or by centralized network management mechanisms, e.g., RestConf RFC8040, YANG RFC7950, and the Path Computation Element Communication Protocol (PCEP) I-D.ietf-pce-pcep-extension-for-pce- controller or any combination thereof.  Specific considerations and requirements for the DetNet Controller Plane are discussed below. 8. </del>  The security considerations of DetNet in general are discussed in I- <del> D.ietf-detnet-architecture and I-D.sdt-detnet-security.  Other security considerations will be added in a future version of this draft. </del>  <del> 9. </del>  This document makes no IANA requests.

Similar structure and changes as in IP over TSN. Service protection interworking is out-of-scope.

Abstract This document specifies the Deterministic Networking MPLS data plane  <ins> when operating over a TSN sub-network. </ins> 1.  Deterministic Networking (DetNet) is a service that can be offered by a network to DetNet flows.  DetNet provides these flows with a low packet loss rates and assured maximum end-to-end delivery latency. provides congestion protection (low loss, assured latency, and limited reordering) leveraging MPLS Traffic Engineering mechanisms.  <ins> I-D.ietf-detnet-mpls specifies the DetNet data plane operation for MPLS-based Packet Switched Network (PSN).  MPLS encapsulated DetNet flows can be carried over network technologies that can provide the DetNet required level of service.  This document focuses on the scenario where MPLS (DetNet) nodes are interconnected by a IEEE 802.1 TSN sub-network. </ins> 2. 2.1. This document uses the terminology established in the DetNet  <ins> architecture I-D.ietf-detnet-architecture and I-D.ietf-detnet-mpls, and the reader is assumed to be familiar with that document and its terminology. </ins> 2.2. The following abbreviations are used in this document:  Control Word. Deterministic Networking. DetNet Flow.  <ins> Frame Replication and Elimination for Redundancy (TSN function). </ins> Layer 2.  Layer 3. Label Switching Router. Multiprotocol Label Switching.  Provider Edge.  Packet Replication, Elimination and Ordering Functions.  Packet Switched Network. PseudoWire.  Switching Provider Edge. Terminating Provider Edge. Time-Sensitive Network.  <ins> 2.3. </ins> The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here.  <ins> 3. </ins>  <ins> The basic approach defined in I-D.ietf-detnet-mpls supports the DetNet service sub-layer based on existing pseudowire (PW) encapsulations and mechanisms, and supports the DetNet forwarding sub-layer based on existing MPLS Traffic Engineering encapsulations and mechanisms. </ins> A node operating on a DetNet flow in the Detnet service sub-layer,  <ins> i.e.  a node processing a DetNet packet which has the S-Label as top </ins> of stack uses the local context associated with that S-Label, for example a received F-Label, to determine what local DetNet operation(s) are applied to that packet.  An S-Label may be unique when taken from the platform label space RFC3031, which would enable correct DetNet flow identification regardless of which input  <ins> interface or LSP the packet arrives on.  The service sub-layer functions (i.e., PREOF) use a DetNet control word (d-CW). </ins> The DetNet MPLS data plane builds on MPLS Traffic Engineering encapsulations and mechanisms to provide a forwarding sub-layer that The forwarding sub-layer is supported by one or more forwarding labels (F-Labels).  <ins> fig_mpls_detnet_part illustrates an extract of a DetNet enabled MPLS network.  Edge/relay nodes sit at MPLS LSP boundaries and transit nodes are LSRs.  In this figure, two MPLS nodes (the edge node and the transit node) are interconnected by a TSN sub-network. </ins>  <ins> DetNet edge/relay nodes are DetNet service sub-layer aware, </ins> understand the particular needs of DetNet flows and provide both DetNet service and forwarding sub-layer functions.  They add, remove  <ins> and process d-CWs, S-Labels and F-labels as needed.  MPLS enabled DetNet nodes can enhance the reliability of delivery by enabling the replication of packets where multiple copies, possibly over multiple paths, are forwarded through the DetNet domain.  They can also eliminate surplus previously replicated copies of DetNet packets. MPLS (DetNet) nodes also include DetNet forwarding sub-layer functions, support for notably explicit routes, and resources allocation to eliminate (or reduce) congestion loss and jitter. </ins> DetNet transit nodes reside wholly within a DetNet domain, and also provide DetNet forwarding sub-layer functions in accordance with the performance required by a DetNet flow carried over an LSP.  Unlike other DetNet node types, transit nodes provide no service sub-layer  <ins> processing. 4. The DetNet WG collaborates with IEEE 802.1 TSN in order to define a common architecture for both Layer 2 and Layer 3, what maintains consistency across diverse networks.  Both DetNet MPLS and TSN use the same techniques to provide their deterministic service: </ins>  <ins> Service protection. </ins>  <ins> Resource allocation. </ins>  <ins> Explicit routes. </ins>  <ins> As described in the DetNet architecture I-D.ietf-detnet-architecture and also illustrated here in fig_mpls_detnet_part a sub-network provides from MPLS perspective a single hop connection between MPLS (DetNet) nodes.  Functions used for resource allocation and explicit routes are treated as domain internal functions and does not require function interworking across the DetNet MPLS network and the TSN sub- network. </ins>  <ins> In case of the service protection function due to the similarities of the DetNet PREOF and TSN FRER functions some level of interworking is possible.  However, such interworking is out-of-scope in this document and left for further study. </ins>  <ins> fig_mpls_detnet_to_tsn illustrates a scenario, where two MPLS (DetNet) nodes are interconnected by a TSN sub-network.  Node-1 is single homed and Node-2 is dual-homed to the TSN sub-network. </ins> The Time-Sensitive Networking (TSN) Task Group of the IEEE 802.1 Working Group have defined (and are defining) a number of amendments compatible with and useful to, DetNet networks.  All these functions have to identify flows those require TSN treatment.  <ins> TSN capabilities of the TSN sub-network are made available for MPLS (DetNet) flows via the protocol interworking function defined in IEEE8021CB.  For example, applied on the TSN edge port it can convert an ingress unicast MPLS (DetNet) flow to use a specific Layer-2 multicast destination MAC address and a VLAN, in order to direct the packet through a specific path inside the bridged network.  A similar interworking function pair at the other end of the TSN sub-network would restore the packet to its original Layer-2 destination MAC address and VLAN. Placement of TSN functions depends on the TSN capabilities of nodes. MPLS (DetNet) Nodes may or may not support TSN functions.  For a given TSN Stream (i.e., DetNet flow) an MPLS (DetNet) node is treated as a Talker or a Listener inside the TSN sub-network. </ins>  <ins> 4.1. </ins>  <ins> Mapping of a DetNet MPLS flow to a TSN Stream is provided via the combination of a passive and an active stream identification function that operate at the frame level.  The passive stream identification function is used to catch the MPLS label(s) of a DetNet MPLS flow and the active stream identification function is used to modify the Ethernet header according to the ID of the mapped TSN Stream. </ins>  <ins> IEEEP8021CBdb defines a Mask-and-Match Stream identification function that can be used as a passive function for MPLS DetNet flows. </ins>  <ins> IEEE8021CB defines an Active Destination MAC and VLAN Stream identification function, what can replace some Ethernet header fields namely (1) the destination MAC-address, (2) the VLAN-ID and (3) priority parameters with alternate values.  Replacement is provided for the frame passed down the stack from the upper layers or up the stack from the lower layers. </ins>  <ins> Active Destination MAC and VLAN Stream identification can be used within a Talker to set flow identity or a Listener to recover the original addressing information.  It can be used also in a TSN bridge that is providing translation as a proxy service for an End System. </ins>  <ins> 4.2. </ins>  <ins> This section covers required behavior of a TSN-aware MPLS (DetNet) node using a TSN sub-network. </ins>  <ins> From the TSN sub-network perspective MPLS (DetNet) nodes are treated as Talker or Listener, that may be (1) TSN-unaware or (2) TSN-aware. </ins>  <ins> In cases of TSN-unaware MPLS DetNet nodes the TSN relay nodes within the TSN sub-network must modify the Ethernet encapsulation of the DetNet MPLS flow (e.g., MAC translation, VLAN-ID setting, Sequence number addition, etc.) to allow proper TSN specific handling inside the sub-network.  There are no requirements defined for TSN-unaware MPLS DetNet nodes in this document. </ins>  <ins> MPLS (DetNet) nodes being TSN-aware can be treated as a combination of a TSN-unaware Talker/Listener and a TSN-Relay, as shown in fig_mpls_with_tsn.  In such cases the MPLS (DetNet) node must provide the TSN sub-network specific Ethernet encapsulation over the link(s) towards the sub-network. </ins>  <ins> A TSN-aware MPLS (DetNet) node impementations MUST support the Stream Identification TSN component for recognizing flows. </ins>  <ins> A Stream identification component MUST be able to instantiate the following functions (1) Active Destination MAC and VLAN Stream identification function, (2) Mask-and-Match Stream identification function and (3) the related managed objects in Clause 9 of IEEE8021CB and IEEEP8021CBdb. </ins>  <ins> A TSN-aware MPLS (DetNet) node implementations MUST support the Sequencing function and the Sequence encode/decode function as defined in IEEE8021CB if FRER is used inside the TSN sub-network. </ins> The Sequence encode/decode function MUST support the Redundancy tag (R-TAG) format as per Clause 7.8 of IEEE8021CB.  <ins> A TSN-aware MPLS (DetNet) node implementations MUST support the Stream splitting function and the Individual recovery function as defined in IEEE8021CB when the node is a replication or elimination point for FRER. 4.3. </ins> TSN Streams supporting DetNet flows may use Frame Replication and  <ins> Elimination for Redundancy (FRER) as defined in IEEE8021CB based on the loss service requirements of the TSN Stream, which is derived from the DetNet service requirements of the DetNet mapped flow.  The specific operation of FRER is not modified by the use of DetNet and follows IEEE8021CB. </ins> FRER function and the provided service recovery is available only  <ins> within the TSN sub-network as the TSN Stream-ID and the TSN sequence number are not valid outside the sub-network.  An MPLS (DetNet) node represents a L3 border and as such it terminates all related information elements encoded in the L2 frames. As the Stream-ID and the TSN sequence number are paired with the similar MPLS flow parameters, FRER can be combined with PREOF functions.  Such service protection interworking scenarios may require to move sequence number fields among TSN (L2) and PW (MPLS) encapsulations and they are left for further study. 4.4. Implementations of this document SHALL use management and control information to map a DetNet flow to a TSN Stream.  N:1 mapping (aggregating DetNet flows in a single TSN Stream) SHALL be supported. The management or control function that provisions flow mapping SHALL ensure that adequate resources are allocated and configured to provide proper service requirements of the mapped flows. </ins>  <ins> 5. </ins>  <ins> [Editor's note: This section covers management/control plane related implications of creation, mapping, removal of TSN Stream IDs, their related parameters and, when needed, the configuration of FRER.] DetNet flow and TSN Stream mapping related information are required only for TSN-aware MPLS (DetNet) nodes.  From the Data Plane perspective there is no practical difference based on the origin of flow mapping related information (management plane or control plane). TSN-aware MPLS DetNet nodes are member of both the DetNet domain and the TSN sub-network.  Within the TSN sub-network the TSN-aware MPLS (DetNet) node has a TSN-aware Talker/Listener role, so TSN specific management and control plane functionalities must be implemented. There are many similarities in the management plane techniques used in DetNet and TSN, but that is not the case for the control plane protocols.  For example, RSVP-TE and MSRP behaves differently. Therefore management and control plane design is an important aspect of scenarios, where mapping between DetNet and TSN is required. In order to use a TSN sub-network between DetNet nodes, DetNet specific information must be converted to TSN sub-network specific ones.  DetNet flow ID and flow related parameters/requirements must be converted to a TSN Stream ID and stream related parameters/ requirements.  Note that, as the TSN sub-network is just a portion of the end2end DetNet path (i.e., single hop from MPLS perspective), some parameters (e.g., delay) may differ significantly.  Other parameters (like bandwidth) also may have to be tuned due to the L2 encapsulation used within the TSN sub-network. In some case it may be challenging to determine some TSN Stream related information.  For example, on a TSN-aware MPLS (DetNet) node that acts as a Talker, it is quite obvious which DetNet node is the Listener of the mapped TSN stream (i.e., the MPLS Next-Hop).  However it may be not trivial to locate the point/interface where that Listener is connected to the TSN sub-network.  Such attributes may require interaction between control and management plane functions and between DetNet and TSN domains. Mapping between DetNet flow identifiers and TSN Stream identifiers, if not provided explicitly, can be done by a TSN-aware MPLS (DetNet) node locally based on information provided for configuration of the TSN Stream identification functions (Mask-and-match Stream identification and active Stream identification function). Triggering the setup/modification of a TSN Stream in the TSN sub- network is an example where management and/or control plane interactions are required between the DetNet and TSN sub-network. TSN-unaware MPLS (DetNet) nodes make such a triggering even more complicated as they are fully unaware of the sub-network and run independently. Configuration of TSN specific functions (e.g., FRER) inside the TSN sub-network is a TSN domain specific decision and may not be visible in the DetNet domain.  Service protection interworking scenarios are left for further study. </ins>  <ins> 6. </ins> The security considerations of DetNet in general are discussed in I-  <ins> D.ietf-detnet-architecture and I-D.ietf-detnet-security.  DetNet IP data plane specific considerations are summarized in I-D.ietf-detnet- ip.  Encryption may provided by an underlying sub-net using MACSec IEEE802.1AE-2018 for DetNet IP over TSN flows. </ins>  <ins> 7. </ins> This document makes no IANA requests.


DetNet Data Plane: IEEE 802.1 Time Sensitive Networking over MPLS <del> draft-ietf-detnet-tsn-vpn-over-mpls-00 </del>  Abstract This document specifies the Deterministic Networking data plane when <del> TSN networks interconnected over an MPLS Packet Switched Networks. </del>  1. <del> [Editor's note: Introduction to be made specific to TSN over DetNet scenario.  Do we intend to cover both TSN over DetNet IP and TSN over DetNet MPLS?  Or this document is limited to MPLS scenarios?]. </del>  <del> 2. </del>  <del> [Editor's note: text to be review what is really needed here.]. </del>  2.1. <del> This document uses the terminology established in the DetNet architecture I-D.ietf-detnet-architecture, and the reader is assumed to be familiar with that document and its terminology. The following terminology is introduced in this document: A Detnet "forwarding" label that identifies the LSP used to forward a DetNet flow across an MPLS PSN, e.g., a hop-by-hop label used between label switching routers (LSR). A DetNet "service" label that is used between DetNet nodes that implement also the DetNet service sub-layer functions.  An S-Label is also used to identify a DetNet flow at DetNet service sub- layer. A DetNet Control Word (d-CW) is used for sequencing and identifying duplicate packets of a DetNet flow at the DetNet service sub-layer. </del>  2.2. DetNet Flow. <del> DetNet Inter-Working Function. </del>  Layer 2. Time-Sensitive Network. <del> 3. </del>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. <del> 4. [Author's note: review required on his part.] </del>  fig_tsn_mpls_detnet shows IEEE 802.1 TSN end stations operating over a TSN aware DetNet service running over an MPLS network.  DetNet Edge encapsulation.  These are functionally similar to pseudowire (PW) Terminating Provider Edge (T-PE) nodes which use MPLS-TE LSPs.  In this example they understand and support IEEE 802.1 TSN and are able <del> to map TSN flows into DetNet flows.  The specific of this operation </del>  are discussed later in this document. <del> Native TSN flow and DetNet MPLS flow differ not only by the additional MPLS specific encapsulation, but DetNet MPLS flows have on each DetNet node an associated DetNet specific data structure, what defines flow related characteristics and required forwarding functions.  In this example, edge Nodes provide a service proxy function that "associates" the DetNet flows and native flows at the edge of the DetNet domain.  This ensures that the DN Flow is properly served at the Edge node (and inside the domain). </del>  fig_8021_detnet illustrates how DetNet can provide services for IEEE <del> 802.1TSN end systems, CE1 and CE2, over a DetNet enabled MPLS </del>  network.  Edge nodes, E1 and E2, insert and remove required DetNet data plane encapsulation.  The 'X' in the edge nodes and relay node, R1, represent a potential DetNet compound flow packet replication and elimination point.  This conceptually parallels L2VPN services, and could leverage existing related solutions as discussed below. <del> 5. [Editor's note: Needs clean up, what is relevant for TSN over DetNet scenarios.]. This section provides informative considerations related to providing DetNet service to flows which are identified based on their header information.  At a high level, the following are provided on a per flow basis: Use of allocated resources (queuing, policing, shaping) to ensure that the congestion-related loss and latency/jitter requirements of a DetNet flow are met. Use of a specific path for a flow.  This limits misordering and bounds latency. Which in the case of this document primarily relates to replication and elimination.  Changing the explicit path after a failure is detected in order to restore delivery of the required DetNet service characteristics is also possible.  Path changes, even in the case of failure recovery, can lead to the out of order delivery of data. Generally, distributing packets of the same DetNet flow over multiple paths is not recommended.  Such load sharing, e.g., via ECMP or UCMP, impacts ordering and possibly jitter. For example, to support identification of misbehaving flows. </del>  <del> For example, increase counters. </del>  <del> For example, unexpected loss. </del>  <del> The DetNet data plane also allows for the aggregation of DetNet flows, e.g., via MPLS hierarchical LSPs, to improved scaling.  When DetNet flows are aggregated, transit nodes provide service to the aggregate and not on a per-DetNet flow basis.  In this case, nodes performing aggregation will ensure that per-flow service requirements are achieved. </del>  5.1. <del> Data-flows requiring DetNet service are generated and terminated on end-systems.  Encapsulation depends on application and its preferences.  In a DetNet MPLS domain the DN functions use the d-CWs, S-Labels and F-Labels to provide DetNet services.  However, an application may exchange further flow related parameters (e.g., time- stamp), which are not provided by DN functions. Specifics related to non-MPLS DetNet end station behavior are out side the scope of this document.  For example, details on support for DetNet IP data flows can be found in I-D.ietf-detnet-dp-sol-ip.  This document is also useful for end stations that map IP flows to DetNet flows. As a general rule, DetNet MPLS domains are capable of forwarding any DetNet MPLS flows and the DetNet domain does not mandate the end- system or edge system encapsulation format.  Unless there is a proxy of some form present, end-systems peer with similar end-systems using the same application encapsulation format.  For example, as shown in fig_es_connect, IP applications peer with IP applications and Ethernet L2VPN applications peer with Ethernet L2VPN applications. 6. [Editor's note: Needs clean up.  Text should focus on Edge node related topics.]. 6.1. To carry DetNet over MPLS the following is required: A method of identifying the MPLS payload type. A method of identifying the DetNet flow group to the processing element. A method of distinguishing DetNet OAM packets from DetNet data packets. A method of carrying the DetNet sequence number. A suitable LSP to deliver the packet to the egress PE. A method of carrying queuing and forwarding indication. In this design an MPLS service label (the S-Label), similar to a pseudowire (PW) label RFC3985, is used to identify both the DetNet flow identity and the payload MPLS payload type satisfying (1) and (2) in the list above.  OAM traffic discrimination happens through the use of the Associated Channel method described in RFC4385.  The DetNet sequence number is carried in the DetNet Control word which carries the Data/OAM discriminator.  To simplify implementation and to maximize interoperability two sequence number sizes are supported: a 16 bit sequence number and a 28 bit sequence number.  The 16 bit sequence number is needed to support some types of legacy clients. The 28 bit sequence number is used in situations where it is necessary ensure that in high speed networks the sequence number space does not wrap whilst packets are in flight. </del>  The LSP used to forward the DetNet packet may be of any type (MPLS- LDP, MPLS-TE, MPLS-TP RFC5921, or MPLS-SR I-D.ietf-spring-segment- routing-mpls).  The LSP (F-Label) label and/or the S-Label may be used to indicate the queue processing as well as the forwarding <del> parameters.  Note that the possible use of Penultimate Hop Popping (PHP) means that the only label in a received label stack may be the S-Label. 6.2. 6.2.1. An edge node is resposable for matching ingress packets to the service they require and encapsulating them accordingly.An edge node may participate in the packet replication and duplication elimination. The DetNet-aware forwarder selects the egress DetNet member flow segment based on the flow identification.  The mapping of ingress DetNet member flow segment to egress DetNet member flow segment may be statically or dynamically configured.  Additionally the DetNet- aware forwarder does duplicate frame elimination based on the flow identification and the sequence number combination.  The packet replication is also done within the DetNet-aware forwarder.  During elimination and the replication process the sequence number of the DetNet member flow MUST be preserved and copied to the egress DetNet member flow. The internal design of a relay node is out of scope of this document. However the reader's attention is drawn to the need to make any PREOF state available to the packet processor(s) dealing with packets to which the PREOF functions must be applied, and to maintain that state is such as way that it is available to the packet processor operation on the next packet in the DetNet flow (which may be a duplicate, a late packet, or the next packet in sequence. [Editor's note: I think the rest of this section belongs in a new "802.1 TSN (island Interconnect) over DetNet MPLS" section.] This may be done in the DetNet layer, or where the native service processing (NSP) RFC3985 is IEEE 802.1CB IEEE8021CB capable, the packet replication and duplicate elimination MAY entirely be done in the NSP, bypassing the DetNet flow encapsulation and logic entirely. This enables operating over unmodified implementations and deployments.  The NSP approach works only between edge nodes and cannot make use of relay nodes. The NSP approach is useful end to end tunnel and for for "island interconnect" scenarios.  However, when there is a need to do PREOF in a middle of the network, such plain edge to edge operation is not sufficient. The extended forwarder MAY copy the sequencing information from the native DetNet packet into the DetNet sequence number field and vice versa.  If there is no existing sequencing information available in the native packet or the forwarder chose not to copy it from the native packet, then the extended forwarder MUST maintain a sequence number counter for each DetNet flow (indexed by the DetNet flow identification). 6.2.2. [Editor's NOTE: review and simplify this section if possible.] </del>  <del> The Time-Sensitive Networking (TSN) Task Group of the IEEE 802.1 Working Group have defined (and are defining) a number of amendments to IEEE8021Q that provide zero congestion loss and bounded latency in bridged networks.  IEEE8021CB defines packet replication and elimination functions that should prove both compatible with and useful to, DetNet networks. As is the case for DetNet, a Layer 2 network node such as a bridge may need to identify the specific DetNet flow to which a packet belongs in order to provide the TSN/DetNet QoS for that packet.  It also will likely need a CoS marking, such as the priority field of an IEEE Std 802.1Q VLAN tag, to give the packet proper service. Although the flow identification methods described in IEEE8021CB are flexible, and in fact, include IP 5-tuple identification methods, the baseline TSN standards assume that every Ethernet frame belonging to a TSN stream (i.e.  DetNet flow) carries a multicast destination MAC address that is unique to that flow within the bridged network over which it is carried.  Furthermore, IEEE8021CB describes three methods by which a packet sequence number can be encoded in an Ethernet frame. Ensuring that the proper Ethernet VLAN tag priority and destination MAC address are used on a DetNet/TSN packet may require further clarification of the customary L2/L3 transformations carried out by routers and edge label switches.  Edge nodes may also have to move sequence number fields among Layer 2, PW, and IP encapsulations. </del>  <del> 7. </del>  <del> [Editor's note: requires considerations related to TSN over DetNet.]. </del>  <del> 8. </del>  The security considerations of DetNet in general are discussed in I- <del> D.ietf-detnet-architecture and I-D.sdt-detnet-security.  Other security considerations will be added in a future version of this draft. </del>  <del> 9. </del>  This document makes no IANA requests.

Major clean up and simplification as data plane drafts can be referred for MPLS related details. TSN over DetNet MPLS follows the concept of RFC3985. Description focus on Edge Nodes procedures and functions. Text covers the Edge Nodes components: (1) TSN functions (in NSP block); (2) DetNet Service Proxy; and (3) DetNet sub-layers.
Approving from teelcon review

DetNet Data Plane: IEEE 802.1 Time Sensitive Networking over MPLS  <ins> draft-ietf-detnet-tsn-vpn-over-mpls-01 </ins> Abstract This document specifies the Deterministic Networking data plane when  <ins> TSN networks are interconnected over a DetNet MPLS Network. </ins> 1.  <ins> The Time-Sensitive Networking Task Group (TSN TG) within IEEE 802.1 Working Group deals with deterministic services through IEEE 802 networks.  Deterministic Networking (DetNet) defined by IETF is a service that can be offered by a L3 network to DetNet flows.  General background and concepts of DetNet can be found in I-D.ietf-detnet- architecture. </ins>  <ins> This document specifies the use of a DetNet MPLS network to interconnect TSN nodes/network segments.  DetNet MPLS data plane is defined in I-D.ietf-detnet-mpls. </ins>  <ins> 2. </ins> 2.1.  <ins> This document uses the terminology and concepts established in the DetNet architecture I-D.ietf-detnet-architecture and I-D.ietf-detnet- data-plane-framework, and I-D.ietf-detnet-mpls.  The reader is assumed to be familiar with these documents and their terminology. </ins> 2.2. DetNet Flow.  <ins> Frame Replication and Elimination for Redundancy (TSN function). </ins> Layer 2. Time-Sensitive Network.  <ins> 2.3. </ins> The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here.  <ins> 3. </ins> fig_tsn_mpls_detnet shows IEEE 802.1 TSN end stations operating over a TSN aware DetNet service running over an MPLS network.  DetNet Edge encapsulation.  These are functionally similar to pseudowire (PW) Terminating Provider Edge (T-PE) nodes which use MPLS-TE LSPs.  In this example they understand and support IEEE 802.1 TSN and are able  <ins> to map TSN Streams into DetNet flows.  The specific of this operation </ins> are discussed later in this document.  <ins> In this example, edge nodes provide a service proxy function that "associates" the DetNet flows and native flows (i.e., TSN Streams) at the edge of the DetNet domain.  This ensures that the DN Flow is properly served at the Edge node (and inside the domain). </ins> fig_8021_detnet illustrates how DetNet can provide services for IEEE  <ins> 802.1 TSN end systems, CE1 and CE2, over a DetNet enabled MPLS </ins> network.  Edge nodes, E1 and E2, insert and remove required DetNet data plane encapsulation.  The 'X' in the edge nodes and relay node, R1, represent a potential DetNet compound flow packet replication and elimination point.  This conceptually parallels L2VPN services, and could leverage existing related solutions as discussed below.  <ins> 4. 4.1. The basic approach defined in I-D.ietf-detnet-mpls supports the DetNet service sub-layer based on existing pseudowire (PW) encapsulations and mechanisms, and supports the DetNet forwarding sub-layer based on existing MPLS Traffic Engineering encapsulations and mechanisms. A node operating on a DetNet flow in the Detnet service sub-layer, i.e.  a node processing a DetNet packet which has the S-Label as top of stack uses the local context associated with that S-Label, for example a received F-Label, to determine what local DetNet operation(s) are applied to that packet.  An S-Label may be unique when taken from the platform label space RFC3031, which would enable correct DetNet flow identification regardless of which input interface or LSP the packet arrives on.  The service sub-layer functions (i.e., PREOF) use a DetNet control word (d-CW). The DetNet MPLS data plane builds on MPLS Traffic Engineering encapsulations and mechanisms to provide a forwarding sub-layer that is responsible for providing resource allocation and explicit routes. The forwarding sub-layer is supported by one or more forwarding labels (F-Labels). DetNet edge/relay nodes are DetNet service sub-layer aware, understand the particular needs of DetNet flows and provide both DetNet service and forwarding sub-layer functions.  They add, remove and process d-CWs, S-Labels and F-labels as needed.  MPLS enabled DetNet nodes can enhance the reliability of delivery by enabling the replication of packets where multiple copies, possibly over multiple paths, are forwarded through the DetNet domain.  They can also eliminate surplus previously replicated copies of DetNet packets. MPLS (DetNet) nodes also include DetNet forwarding sub-layer functions, support for notably explicit routes, and resources allocation to eliminate (or reduce) congestion loss and jitter. DetNet transit nodes reside wholly within a DetNet domain, and also provide DetNet forwarding sub-layer functions in accordance with the performance required by a DetNet flow carried over an LSP.  Unlike other DetNet node types, transit nodes provide no service sub-layer processing. 4.2. The basic encapsulation approach is to treat a TSN Stream as an app- flow from the DetNet MPLS perspective.  The corresponding example shown in fig_tsn_mpls_ex. In the figure, "Application" indicates the application payload carried by the TSN network.  "MPLS App-Flow" indicates that the TSN Stream is the payload from the perspective of the DetNet MPLS data plane defined in I-D.ietf-detnet-mpls.  A single DetNet MPLS flow can aggregate multiple TSN Streams. </ins>  <ins> 5. Description of Edge Nodes procedures and functions for TSN over DetNet MPLS scenario follows the concept of RFC3985 and covers the Edge Nodes components shown on fig_tsn_mpls_detnet.  In this section the following procedures of DetNet Edge Nodes are described: TSN related (tom_tsn_proc) </ins>  <ins> DetNet Service Proxy (tom_svc_prx_proc) </ins>  <ins> DetNet service and forwarding sub-layer (tom_dn_sub_proc) </ins> 5.1.  <ins> The Time-Sensitive Networking (TSN) Task Group of the IEEE 802.1 Working Group have defined (and are defining) a number of amendments to IEEE8021Q that provide zero congestion loss and bounded latency in bridged networks.  IEEE8021CB defines packet replication and elimination functions for a TSN network. TSN specific functions are executed on the data received by the PE from the CE before presentation to the DetNet PW for transmission across the DetNet domain, or on the data received from a DetNet PW by a PE before it is output on the Attachment Circuit (AC). TSN specific function(s) of Edge Nodes (T-PE) are belonging to the native service processing (NSP) RFC3985 block.  This is similar to other functionalities being defined by standard bodies other than the IETF (for example in case of Ethernet: stripping, overwriting or adding VLAN tags, etc.).  Depending on the TSN role of the Edge Node in the end-to-end TSN service selected TSN functions must be supported. Implementations of this document SHALL use management and control information to ensure TSN specific functions of the Edge Node according to the expectations of the connected TSN network. 5.2. The Service Proxy function maps between App-flows and DetNet flows. It MUST support the TSN Stream identification functions and the related managed objects as defined in IEEE8021CB and IEEEP8021CBdb to recognize the App-flow related packets. Implementations of this document SHALL use management and control information to map a TSN Stream to a DetNet flow.  N:1 mapping (aggregating TSN Streams in a single DetNet flow) SHALL be supported. The management or control function that provisions flow mapping SHALL ensure that adequate resources are allocated and configured to provide proper service requirements of the mapped flows. Due to the (intentional) similarities of the DetNet PREOF and TSN FRER functions service protection function interworking is possible between the TSN and the DetNet domains.  Such service protection interworking scenarios MAY require to copy sequence number fields from TSN (L2) to PW (MPLS) encapsulation.  However, such interworking is out-of-scope in this document and left for further study. 5.3. In the design of I-D.ietf-detnet-mpls an MPLS service label (the S-Label), similar to a pseudowire (PW) label RFC3985, is used to identify both the DetNet flow identity and the payload MPLS payload type.  The DetNet sequence number is carried in the DetNet Control word (d-CW) which carries the Data/OAM discriminator as well.  In I- D.ietf-detnet-mpls two sequence number sizes are supported: a 16 bit sequence number and a 28 bit sequence number. PREOF functions and the provided service recovery is available only within the DetNet domain as the DetNet flow-ID and the DetNet sequence number are not valid outside the DetNet network.  MPLS (DetNet) Edge node terminates all related information elements encoded in the MPLS labels. </ins> The LSP used to forward the DetNet packet may be of any type (MPLS- LDP, MPLS-TE, MPLS-TP RFC5921, or MPLS-SR I-D.ietf-spring-segment- routing-mpls).  The LSP (F-Label) label and/or the S-Label may be used to indicate the queue processing as well as the forwarding  <ins> parameters. </ins>  <ins> For further details see I-D.ietf-detnet-mpls. </ins>  <ins> 6. </ins>  <ins> [Editor's note: This section covers management/control plane related implications of creation, mapping, removal of DetNet flow IDs, their related parameters and, when needed, the configuration of PREOF.] TSN Stream(s) to DetNet flow mapping related information are required only for the service proxy function of MPLS (DetNet) Edge nodes. From the Data Plane perspective there is no practical difference based on the origin of flow mapping related information (management plane or control plane). MPLS DetNet Edge nodes are member of both the DetNet domain and the connected TSN network.  From the TSN network perspective the MPLS (DetNet) Edge node has a "TSN relay node" role, so TSN specific management and control plane functionalities must be implemented. There are many similarities in the management plane techniques used in DetNet and TSN, but that is not the case for the control plane protocols.  For example, RSVP-TE and MSRP behaves differently. Therefore management and control plane design is an important aspect of scenarios, where mapping between DetNet and TSN is required. In order to use a DetNet network to interconnect TSN segments, TSN specific information must be converted to DetNet domain specific ones.  TSN Stream ID(s) and stream(s) related parameters/requirements must be converted to a DetNet flow-ID and flow related parameters/ requirements.  Note that, as the DetNet network is just a portion of the end2end TSN path (i.e., single hop from Ethernet perspective), some parameters (e.g., delay) may differ significantly.  Other parameters (like bandwidth) also may have to be tuned due to the MPLS encapsulation used within the DetNet network. In some case it may be challenging to determine some egress node related information.  For example, it may be not trivial to locate the egress point/interface of a TSN Streams with a multicast destination MAC address.  Such scenarios may require interaction between control and management plane functions and between DetNet and TSN domains. Mapping between DetNet flow identifiers and TSN Stream identifiers, if not provided explicitly, can be done by the service proxy function of an MPLS (DetNet) Edge node locally based on information provided for configuration of the TSN Stream identification functions (e.g., Mask-and-Match Stream identification). Triggering the setup/modification of a DetNet flow in the DetNet network is an example where management and/or control plane interactions are required between the DetNet and the TSN network. Configuration of TSN specific functions (e.g., FRER) inside the TSN network is a TSN domain specific decision and may not be visible in the DetNet domain.  Service protection interworking scenarios are left for further study. </ins>  <ins> 7. </ins> The security considerations of DetNet in general are discussed in I-  <ins> D.ietf-detnet-architecture and I-D.ietf-detnet-security.  DetNet MPLS data plane specific considerations are summarized in I-D.ietf-detnet- mpls.  Encryption may provided within the TSN network using MACSec IEEE802.1AE-2018. </ins>  <ins> 8. </ins> This document makes no IANA requests.


interconnect TSN nodes/network segments.  DetNet MPLS data plane is defined in I-D.ietf-detnet-mpls. 2. 2.1. 2.2. <del> [Editor's note: text to be cleaned up]. </del> The following abbreviations are used in this document: Attachment Circuit. also support the imposition and disposition of the required DetNet encapsulation.  These are functionally similar to pseudowire (PW) Terminating Provider Edge (T-PE) nodes which use MPLS-TE LSPs.  In <del> this example they understand and support IEEE 802.1 TSN and are able to map TSN Streams into DetNet flows.  The specific of this operation are discussed later in this document. </del>  In this example, edge nodes provide a service proxy function that "associates" the DetNet flows and native flows (i.e., TSN Streams) at <del> the edge of the DetNet domain.  This ensures that the DN Flow is properly served at the Edge node (and inside the domain). </del>  fig_8021_detnet illustrates how DetNet can provide services for IEEE 802.1 TSN end systems, CE1 and CE2, over a DetNet enabled MPLS 5.2. The Service Proxy function maps between App-flows and DetNet flows. <del> It MUST support the TSN Stream identification functions and the related managed objects as defined in IEEE8021CB and IEEEP8021CBdb to recognize the App-flow related packets. </del>  Implementations of this document SHALL use management and control information to map a TSN Stream to a DetNet flow.  N:1 mapping <del> (aggregating TSN Streams in a single DetNet flow) SHALL be supported. The management or control function that provisions flow mapping SHALL ensure that adequate resources are allocated and configured to provide proper service requirements of the mapped flows. </del>  Due to the (intentional) similarities of the DetNet PREOF and TSN FRER functions service protection function interworking is possible from TSN (L2) to PW (MPLS) encapsulation.  However, such interworking is out-of-scope in this document and left for further study.  5.3. In the design of I-D.ietf-detnet-mpls an MPLS service label (the 6. <del> [Editor's note: This section covers management/control plane related implications of creation, mapping, removal of DetNet flow IDs, their related parameters and, when needed, the configuration of PREOF.] </del> TSN Stream(s) to DetNet flow mapping related information are required only for the service proxy function of MPLS (DetNet) Edge nodes. From the Data Plane perspective there is no practical difference Therefore management and control plane design is an important aspect of scenarios, where mapping between DetNet and TSN is required.  In order to use a DetNet network to interconnect TSN segments, TSN specific information must be converted to DetNet domain specific ones.  TSN Stream ID(s) and stream(s) related parameters/requirements must be converted to a DetNet flow-ID and flow related parameters/ <del> requirements.  Note that, as the DetNet network is just a portion of the end2end TSN path (i.e., single hop from Ethernet perspective), some parameters (e.g., delay) may differ significantly.  Other parameters (like bandwidth) also may have to be tuned due to the MPLS encapsulation used within the DetNet network. </del>  In some case it may be challenging to determine some egress node related information.  For example, it may be not trivial to locate 7. <del> The security considerations of DetNet in general are discussed in I- D.ietf-detnet-architecture and I-D.ietf-detnet-security.  DetNet MPLS data plane specific considerations are summarized in I-D.ietf-detnet- mpls.  Encryption may provided within the TSN network using MACSec IEEE802.1AE-2018. </del>  8.

Work In progress - Wanted to get the figure changes out for review. Need to check if the overly wording is complete. There was a lot of inter working text - I have commented out.

interconnect TSN nodes/network segments.  DetNet MPLS data plane is defined in I-D.ietf-detnet-mpls. 2. 2.1. 2.2.  The following abbreviations are used in this document: Attachment Circuit. also support the imposition and disposition of the required DetNet encapsulation.  These are functionally similar to pseudowire (PW) Terminating Provider Edge (T-PE) nodes which use MPLS-TE LSPs.  In  <ins> this example TSN Streams are simple applicaions over DetNet flows. The specific of this operation are discussed later in this document. </ins> In this example, edge nodes provide a service proxy function that "associates" the DetNet flows and native flows (i.e., TSN Streams) at  <ins> the edge of the DetNet domain.  TSN streams are treated as App-flows for DetNet.  The whole DetNet domain behaves as a TSN relay node for the TSN streams.  The service proxy behaves as a port of that TSN relay node. </ins> fig_8021_detnet illustrates how DetNet can provide services for IEEE 802.1 TSN end systems, CE1 and CE2, over a DetNet enabled MPLS 5.2. The Service Proxy function maps between App-flows and DetNet flows.  <ins> The DetNet Edge Node TSN function MUST support the TSN Stream identification functions and the related managed objects as defined in IEEE8021CB and IEEEP8021CBdb to recognize the App-flow related packets.  The Service Proxy presents TSN Streams as an App-flow to a DetNet Flow. </ins> Implementations of this document SHALL use management and control information to map a TSN Stream to a DetNet flow.  N:1 mapping  <ins> (aggregating multiple TSN Streams in a single DetNet flow) SHALL be supported.  The management or control function that provisions flow mapping SHALL ensure that adequate resources are allocated and configured to provide proper service requirements of the mapped flows. </ins> Due to the (intentional) similarities of the DetNet PREOF and TSN FRER functions service protection function interworking is possible from TSN (L2) to PW (MPLS) encapsulation.  However, such interworking is out-of-scope in this document and left for further study. <ins> A MPLS DetNet flow is configured to carry any number of TSN flows. The DetNet flow specific bandwidth profile SHOULD match the required bandwidth of the App-flow aggregate. </ins> 5.3. In the design of I-D.ietf-detnet-mpls an MPLS service label (the 6.  TSN Stream(s) to DetNet flow mapping related information are required only for the service proxy function of MPLS (DetNet) Edge nodes. From the Data Plane perspective there is no practical difference Therefore management and control plane design is an important aspect of scenarios, where mapping between DetNet and TSN is required. <ins> Note that, as the DetNet network is just a portion of the end to end TSN path (i.e., single hop from Ethernet perspective), some parameters (e.g., delay) may differ significantly.  Since there is no interworking function the bandwidth of DetNet network is assumed to be set large enough to handle all TSN Flows it will support.  At the egress of the Detnet Domain the MPLS headers are stripped and the TSN flow continues on as a normal TSN flow. </ins> In order to use a DetNet network to interconnect TSN segments, TSN specific information must be converted to DetNet domain specific ones.  TSN Stream ID(s) and stream(s) related parameters/requirements must be converted to a DetNet flow-ID and flow related parameters/  <ins> requirements. </ins> In some case it may be challenging to determine some egress node related information.  For example, it may be not trivial to locate 7.  <ins> Security considerations for DetNet are described in detail in I- D.ietf-detnet-security.  General security considerations are described in I-D.ietf-detnet-architecture.  DetNet MPLS data plane specific considerations are summarized in I-D.ietf-detnet-mpls.  The primary considerations for the data plane is to maintain integrity of data and delivery of the associated DetNet service traversing the DetNet network.  Application flows can be protected through whatever means is provided by the underlying technology.  For example, encryption may be used, such as that provided by IPSec RFC4301 for IP flows and/or by an underlying sub-net using MACSec IEEE802.1AE-2018 for IP over Ethernet (Layer-2) flows. </ins> 8.