draft-ietf-idr-bgp-gr-notification-13.txt   draft-ietf-idr-bgp-gr-notification-14.txt 
Internet Engineering Task Force K. Patel Internet Engineering Task Force K. Patel
Internet-Draft Arrcus Internet-Draft Arrcus
Updates: 4724 (if approved) R. Fernando Updates: 4724 (if approved) R. Fernando
Intended status: Standards Track Cisco Systems Intended status: Standards Track Cisco Systems
Expires: December 17, 2017 J. Scudder Expires: October 8, 2018 J. Scudder
J. Haas J. Haas
Juniper Networks Juniper Networks
June 15, 2017 April 6, 2018
Notification Message support for BGP Graceful Restart Notification Message support for BGP Graceful Restart
draft-ietf-idr-bgp-gr-notification-13.txt draft-ietf-idr-bgp-gr-notification-14.txt
Abstract Abstract
The BGP Graceful Restart mechanism defined in RFC 4724 limits the The BGP Graceful Restart mechanism defined in RFC 4724 limits the
usage of BGP Graceful Restart to BGP protocol messages other than a usage of BGP Graceful Restart to BGP protocol messages other than a
BGP NOTIFICATION message. This document updates RFC 4724 by defining BGP NOTIFICATION message. This document updates RFC 4724 by defining
an extension that permits the Graceful Restart procedures to be an extension that permits the Graceful Restart procedures to be
performed when the BGP speaker receives a BGP NOTIFICATION Message or performed when the BGP speaker receives a BGP NOTIFICATION Message or
the Hold Time expires. This document also defines a new BGP the Hold Time expires. This document also defines a new BGP
NOTIFICATION Cease Error subcode whose effect is to request a full NOTIFICATION Cease Error subcode whose effect is to request a full
session restart instead of a Graceful Restart. session restart instead of a Graceful Restart.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 17, 2017. This Internet-Draft will expire on October 8, 2018.
Copyright Notice Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. Modifications to BGP Graceful Restart Capability . . . . . . 3 2. Modifications to BGP Graceful Restart Capability . . . . . . 3
3. BGP Hard Reset Subcode . . . . . . . . . . . . . . . . . . . 4 3. BGP Hard Reset Subcode . . . . . . . . . . . . . . . . . . . 3
3.1. Sending a Hard Reset . . . . . . . . . . . . . . . . . . 4 3.1. Sending a Hard Reset . . . . . . . . . . . . . . . . . . 4
3.2. Receiving a Hard Reset . . . . . . . . . . . . . . . . . 4 3.2. Receiving a Hard Reset . . . . . . . . . . . . . . . . . 4
4. Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4. Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 4
4.1. Rules for the Receiving Speaker . . . . . . . . . . . . . 5 4.1. Rules for the Receiving Speaker . . . . . . . . . . . . . 5
5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 6 5. Use of Hard Reset . . . . . . . . . . . . . . . . . . . . . . 6
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 5.1. When to Send Hard Reset . . . . . . . . . . . . . . . . . 6
7. Security Considerations . . . . . . . . . . . . . . . . . . . 6 5.2. Interaction With Other Specifications . . . . . . . . . . 7
8. Normative References . . . . . . . . . . . . . . . . . . . . 6 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 6 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
8. Security Considerations . . . . . . . . . . . . . . . . . . . 8
9. Normative References . . . . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9
1. Introduction 1. Introduction
For many classes of errors, the BGP protocol must send a NOTIFICATION For many classes of errors, the BGP protocol must send a NOTIFICATION
message and reset the peering session to handle the error condition. message and reset the peering session to handle the error condition.
The BGP Graceful Restart extension defined in [RFC4724] requires that The BGP Graceful Restart extension defined in [RFC4724] requires that
normal BGP procedures defined in [RFC4271] be followed when a normal BGP procedures defined in [RFC4271] be followed when a
NOTIFICATION message is sent or received. This document defines an NOTIFICATION message is sent or received. This document defines an
extension to BGP Graceful Restart that permits the Graceful Restart extension to BGP Graceful Restart that permits the Graceful Restart
procedures to be performed when the BGP speaker receives a procedures to be performed when the BGP speaker receives a
skipping to change at page 3, line 15 skipping to change at page 3, line 15
1.1. Requirements Language 1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119]. document are to be interpreted as described in RFC 2119 [RFC2119].
2. Modifications to BGP Graceful Restart Capability 2. Modifications to BGP Graceful Restart Capability
The BGP Graceful Restart Capability is augmented to signal the The BGP Graceful Restart Capability is augmented to signal the
Graceful Restart support for BGP NOTIFICATION messages. The Restart Graceful Restart support for BGP NOTIFICATION messages. The Restart
flags field is augmented as follows: Flags field is augmented as follows (following the diagram from
section 3 of [RFC4724]):
+--------------------------------------------------+
| Restart Flags (4 bits) |
+--------------------------------------------------+
| Restart Time in seconds (12 bits) |
+--------------------------------------------------+
| Address Family Identifier (16 bits) |
+--------------------------------------------------+
| Subsequent Address Family Identifier (8 bits) |
+--------------------------------------------------+
| Flags for Address Family (8 bits) |
+--------------------------------------------------+
| ... |
+--------------------------------------------------+
| Address Family Identifier (16 bits) |
+--------------------------------------------------+
| Subsequent Address Family Identifier (8 bits) |
+--------------------------------------------------+
| Flags for Address Family (8 bits) |
+--------------------------------------------------+
Restart Flags: Restart Flags:
This field contains bit flags relating to restart. This field contains bit flags relating to restart.
0 1 2 3 0 1 2 3
+-+-+-+-+ +-+-+-+-+
|R|N| | |R|N| |
+-+-+-+-+ +-+-+-+-+
skipping to change at page 4, line 9 skipping to change at page 3, line 38
[RFC4724]. [RFC4724].
The second most significant bit ("N") is defined as the BGP Graceful The second most significant bit ("N") is defined as the BGP Graceful
Notification bit, which is used to indicate Graceful Restart support Notification bit, which is used to indicate Graceful Restart support
for BGP NOTIFICATION messages. A BGP speaker indicates support for for BGP NOTIFICATION messages. A BGP speaker indicates support for
the procedures of this document, by advertising a Graceful Restart the procedures of this document, by advertising a Graceful Restart
Capability with its Graceful NOTIFICATION bit set (value 1). This Capability with its Graceful NOTIFICATION bit set (value 1). This
also implies support for the format for a BGP NOTIFICATION Cease also implies support for the format for a BGP NOTIFICATION Cease
message defined in [RFC4486]. message defined in [RFC4486].
If a BGP speaker which previously advertised the "N" bit opens a new
session without advertising that bit, normal BGP Graceful Restart
procedures documented in [RFC4724] apply.
3. BGP Hard Reset Subcode 3. BGP Hard Reset Subcode
A new BGP NOTIFICATION Cease message subcode is defined known as the We define a new BGP NOTIFICATION Cease message subcode, called the
BGP Hard Reset Subcode. The value of this subcode is discussed in BGP Hard Reset Subcode. The value of this subcode is discussed in
Section 6. We refer to a BGP NOTIFICATION Cease message with the Section 7. We refer to a BGP NOTIFICATION Cease message with the
Hard Reset subcode as a Hard Reset message, or just a Hard Reset. Hard Reset subcode as a Hard Reset message, or just a Hard Reset.
When the "N" bit has been exchanged by two peers, to distinguish them
from Hard Reset we refer to any NOTIFICATION messages other than Hard
Reset as "Graceful", since such messages invoke Graceful Restart
semantics.
3.1. Sending a Hard Reset 3.1. Sending a Hard Reset
A Hard Reset message is used to indicate to a peer with which the A Hard Reset message is used to indicate to a peer with which the
Graceful Notification flag has been exchanged, that the session is to Graceful Notification bit has been exchanged, that the session is to
be fully terminated. be fully terminated.
When sending a Hard Reset, the data portion of the NOTIFICATION is When sending a Hard Reset, the data portion of the NOTIFICATION is
encoded as follows: encoded as follows:
+--------+--------+-------- +--------+--------+--------
| ErrCode| Subcode| Data | ErrCode| Subcode| Data
+--------+--------+-------- +--------+--------+--------
ErrCode is a BGP Error Code (as documented in the IANA BGP Error ErrCode is a BGP Error Code (as documented in the IANA BGP Error
Codes registry) that indicates the reason for the hard reset. Codes registry) that indicates the reason for the Hard Reset.
Subcode is a BGP Error Subcode (as documented in the IANA BGP Error Subcode is a BGP Error Subcode (as documented in the IANA BGP Error
Subcodes registry) as appropriate for the ErrCode. Similarly, Data Subcodes registry) as appropriate for the ErrCode. Similarly, Data
is as appropriate for the ErrCode and Subcode. is as appropriate for the ErrCode and Subcode. In short, the Hard
Reset encapsulates another NOTIFICATION message in its data portion.
3.2. Receiving a Hard Reset 3.2. Receiving a Hard Reset
Whenever a BGP speaker receives a Hard Reset, the speaker MUST Whenever a BGP speaker receives a Hard Reset, the speaker MUST
terminate the BGP session following the standard procedures in terminate the BGP session following the standard procedures in
[RFC4271]. [RFC4271].
4. Operation 4. Operation
A BGP speaker that is willing to receive and send BGP NOTIFICATION A BGP speaker that is willing to receive and send BGP NOTIFICATION
messages in Graceful mode MUST advertise the BGP Graceful messages according to the procedures of this document MUST advertise
Notification "N" bit using the Graceful Restart Capability as defined the BGP Graceful Notification "N" bit using the Graceful Restart
in [RFC4724]. Capability as defined in [RFC4724].
When such a BGP speaker has received the "N" bit from its peer, and When such a BGP speaker has received the "N" bit from its peer, and
receives from that peer a BGP NOTIFICATION message other than a Hard receives from that peer a BGP NOTIFICATION message other than a Hard
Reset, it MUST follow the rules for the Receiving Speaker mentioned Reset, it MUST follow the rules for the Receiving Speaker mentioned
in Section 4.1. The BGP speaker generating the BGP NOTIFICATION in Section 4.1. The BGP speaker generating the BGP NOTIFICATION
message MUST also follow the rules for the Receiving Speaker. message MUST also follow the rules for the Receiving Speaker.
When a BGP speaker resets its session due to a HOLDTIME expiry, it When a BGP speaker resets its session due to a HOLDTIME expiry, it
should generate the relevant BGP NOTIFICATION message as mentioned in should generate the relevant BGP NOTIFICATION message as mentioned in
[RFC4271], but subsequently it MUST follow the rules for the [RFC4271], but subsequently it MUST follow the rules for the
skipping to change at page 5, line 32 skipping to change at page 5, line 20
their "Forwarding State" bit to 1. If the "Forwarding State" bit is their "Forwarding State" bit to 1. If the "Forwarding State" bit is
not set, then according to the procedures of [RFC4724] section 4.2, not set, then according to the procedures of [RFC4724] section 4.2,
the relevant routes will be flushed, defeating the goals of this the relevant routes will be flushed, defeating the goals of this
specification. specification.
4.1. Rules for the Receiving Speaker 4.1. Rules for the Receiving Speaker
[RFC4724] section 4.2 defines rules for the Receiving Speaker. These [RFC4724] section 4.2 defines rules for the Receiving Speaker. These
are modified as follows. are modified as follows.
As part of this extension, routes from the peer previously marked as The sentence "To deal with possible consecutive restarts, a route
stale MUST NOT be deleted, until and unless the optional timer (from the peer) previously marked as stale MUST be deleted" only
mentioned in the final paragraph of [RFC4724] section 4.2 expires, or applies when the "N" bit has not been exchanged with the peer:
unless a Hard Reset is performed. This supersedes the "consecutive
restarts" requirement in the third paragraph of [RFC4724] section
4.2.
In addition to the rules already specified in [RFC4724] section 4.2 OLD: When the Receiving Speaker detects termination of the TCP
for how variations in the received Graceful Restart Capability should session for a BGP session with a peer that has advertised the
be interpreted (the paragraph that begins "Once the session is re- Graceful Restart Capability, it MUST retain the routes received
established..."), if the Graceful Notification ("N") bit is not set from the peer for all the address families that were previously
in the newly received Graceful Restart Capability, no new actions are received in the Graceful Restart Capability and MUST mark them
triggered on the Receiving Speaker -- in particular, a clear "N" bit as stale routing information. To deal with possible consecutive
does not trigger deletion of stale routes. restarts, a route (from the peer) previously marked as stale
MUST be deleted. The router MUST NOT differentiate between
stale and other routing information during forwarding.
Other than these modifications, the rules for the Receiving Speaker NEW: When the Receiving Speaker detects termination of the TCP
are as specified in [RFC4724] section 4.2. session for a BGP session with a peer that has advertised the
Graceful Restart Capability, it MUST retain the routes received
from the peer for all the address families that were previously
received in the Graceful Restart Capability and MUST mark them
as stale routing information. The router MUST NOT differentiate
between stale and other routing information during forwarding.
If the "N" bit has not been exchanged with the peer, then to
deal with possible consecutive restarts, a route (from the peer)
previously marked as stale MUST be deleted.
5. Acknowledgements The stale timer is given a formal name and made mandatory:
OLD: To put an upper bound on the amount of time a router retains the
stale routes, an implementation MAY support a (configurable)
timer that imposes this upper bound.
NEW: To put an upper bound on the amount of time a router retains the
stale routes, an implementation MUST support a (configurable)
timer, called the "stale timer", that imposes this upper bound.
A suggested default value for the stale timer is 180 seconds.
An implementation MAY provide the option to disable the timer
(i.e., to provide an infinite retention time) but MUST NOT do so
by default.
5. Use of Hard Reset
5.1. When to Send Hard Reset
Although when to send a Hard Reset is an implementation-specific
decision, we offer some advice. Many Cease notification subcodes
represent permanent or long-term rather than transient session
termination, and as such it's appropriate to use Hard Reset with
them. At time of publication, Cease subcodes 1-9 were defined.
+-------+------------------------------------+----------------------+
| Value | Name | Suggested Behavior |
+-------+------------------------------------+----------------------+
| 1 | Maximum Number of Prefixes Reached | Hard Reset |
| 2 | Administrative Shutdown | Hard Reset |
| 3 | Peer De-configured | Hard Reset |
| 4 | Administrative Reset | Provide user control |
| 5 | Connection Rejected | Graceful Cease |
| 6 | Other Configuration Change | Graceful Cease |
| 7 | Connection Collision Resolution | Graceful Cease |
| 8 | Out of Resources | Graceful Cease |
| 9 | Hard Reset | Hard Reset |
+-------+------------------------------------+----------------------+
Suggestions for Cease Subcode Behavior
These suggestions are only that, suggestions, not requirements. It's
the nature of BGP implementations that the mapping of internal states
to BGP NOTIFICATION codes and subcodes is not always perfect. The
guiding principle for the implementor should be that if there is no
realistic hope that forwarding can continue or that the session will
be re-established within the deadline, Hard Reset should be used.
For all other NOTIFICATION codes other than Cease, use of Hard Reset
does not appear to be indicated.
5.2. Interaction With Other Specifications
"BGP Administrative Shutdown Communication" [RFC8203] specifies use
of the data portion of the Administrative Shutdown or Administrative
Reset Cease to convey a short message. When [RFC8203] is used in
conjunction with Hard Reset, the subcode of the outermost Cease MUST
be Hard Reset, with the Administrative Shutdown or Reset Cease
encapsulated within. The encapsulated administrative shutdown
message MUST subsequently be processed according to [RFC8203].
6. Acknowledgements
The authors would like to thank Jim Uttaro for the suggestion, and The authors would like to thank Jim Uttaro for the suggestion, and
Emmanuel Baccelli, Bruno Decraene, Chris Hall, Paul Mattes and Robert Emmanuel Baccelli, Bruno Decraene, Chris Hall, Paul Mattes, Robert
Raszuk for their review and comments. Raszuk, and Alvaro Retana for their review and comments.
6. IANA Considerations 7. IANA Considerations
IANA has temporarily assigned subcode 9, named "Hard Reset", in the IANA has temporarily assigned subcode 9, named "Hard Reset", in the
"BGP Cease NOTIFICATION message subcodes" registry. Upon publication "BGP Cease NOTIFICATION message subcodes" registry. Upon publication
of this document as an RFC, IANA is requested to make this allocation of this document as an RFC, IANA is requested to make this allocation
permanent. permanent.
7. Security Considerations IANA is requested to establish a registry within the "Border Gateway
Protocol (BGP) Parameters" grouping, to be called "BGP Graceful
Restart Flags". The Registration Procedure should be Standards
Action, the reference this document and [RFC4724], and the initial
values as follows:
This extension to BGP does not change the underlying security issues +--------------+---------------+------------+---------------+
inherent in the existing [RFC4724] and [RFC4271]. | Bit Position | Name | Short Name | Reference |
+--------------+---------------+------------+---------------+
| 0 | Restart State | R | [RFC4724] |
| 1 | Notification | N | this document |
| 2, 3 | unassigned | | |
+--------------+---------------+------------+---------------+
8. Normative References IANA is requested to establish a registry within the "Border Gateway
Protocol (BGP) Parameters" grouping, to be called "BGP Graceful
Restart Flags for Address Family". The Registration Procedure should
be Standards Action, the reference this document and [RFC4724], and
the initial values as follows:
+--------------+------------------+------------+-----------+
| Bit Position | Name | Short Name | Reference |
+--------------+------------------+------------+-----------+
| 0 | Forwarding State | F | [RFC4724] |
| 1-7 | unassigned | | |
+--------------+------------------+------------+-----------+
8. Security Considerations
This specification doesn't change the basic security model inherent
in [RFC4724], with the exception that the protection against repeated
resets is relaxed. To mitigate the consequent risk that an attacker
could use repeated session resets to prevent stale routes from ever
being deleted, we make the stale routes timer mandatory (in practice
it is already ubiquitous). To the extent [RFC4724] might be said to
help defend against denials of service by making the control plane
more resilient, this extension may modestly increase that resilience;
however, there are enough confounding and deployment-specific factors
that no general claims can be made.
9. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A
Border Gateway Protocol 4 (BGP-4)", RFC 4271, Border Gateway Protocol 4 (BGP-4)", RFC 4271,
DOI 10.17487/RFC4271, January 2006, DOI 10.17487/RFC4271, January 2006,
<http://www.rfc-editor.org/info/rfc4271>. <https://www.rfc-editor.org/info/rfc4271>.
[RFC4486] Chen, E. and V. Gillet, "Subcodes for BGP Cease [RFC4486] Chen, E. and V. Gillet, "Subcodes for BGP Cease
Notification Message", RFC 4486, DOI 10.17487/RFC4486, Notification Message", RFC 4486, DOI 10.17487/RFC4486,
April 2006, <http://www.rfc-editor.org/info/rfc4486>. April 2006, <https://www.rfc-editor.org/info/rfc4486>.
[RFC4724] Sangli, S., Chen, E., Fernando, R., Scudder, J., and Y. [RFC4724] Sangli, S., Chen, E., Fernando, R., Scudder, J., and Y.
Rekhter, "Graceful Restart Mechanism for BGP", RFC 4724, Rekhter, "Graceful Restart Mechanism for BGP", RFC 4724,
DOI 10.17487/RFC4724, January 2007, DOI 10.17487/RFC4724, January 2007,
<http://www.rfc-editor.org/info/rfc4724>. <https://www.rfc-editor.org/info/rfc4724>.
[RFC8203] Snijders, J., Heitz, J., and J. Scudder, "BGP
Administrative Shutdown Communication", RFC 8203,
DOI 10.17487/RFC8203, July 2017,
<https://www.rfc-editor.org/info/rfc8203>.
Authors' Addresses Authors' Addresses
Keyur Patel Keyur Patel
Arrcus Arrcus
Email: keyur@arrcus.com Email: keyur@arrcus.com
Rex Fernando Rex Fernando
Cisco Systems Cisco Systems
170 W. Tasman Drive 170 W. Tasman Drive
San Jose, CA 95134 San Jose, CA 95134
USA USA
Email: rex@cisco.com Email: rex@cisco.com
John Scudder John Scudder
Juniper Networks Juniper Networks
 End of changes. 32 change blocks. 
69 lines changed or deleted 171 lines changed or added

This html diff was produced by rfcdiff 1.46. The latest version is available from http://tools.ietf.org/tools/rfcdiff/