Power Transition Framework for TE Resources

Introduction Operational networks are frequently engineered for peak utilization. During lower-demand periods, portions of the topology may remain active even though their forwarding capacity is not immediately required. A power-management system can place an eligible traffic-engineered resource in a low-power or power-down state and later restore it when demand or policy requires. A power transition is a distributed operation. Both ends of a resource must agree before the resource is powered down, and the control plane must continue to identify the resource and retain sufficient traffic-engineering information to restore it. The mechanism that controls the physical power state is implementation-specific and is outside the scope of this document. This document specifies the coordination protocol and its signaling requirements. The framework is intentionally independent of RSVP-TE. Section 3 defines the generic procedures. Section 4 defines how RSVP-TE carries those procedures for a directly connected RSVP-TE link. RSVP-TE is one signaling realization of the framework; the framework does not require RSVP-TE for other resource types or signaling protocols.

Requirements Language and Terminology The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in BCP 14 .

Power-sleep: A coordinated transition in which the underlying hardware for a resource is powered down or placed in a low-power state.
Wakeup: A transition that restores the underlying hardware to its forwarding-capable state.
Sender: The node that initiates a power-sleep transaction.
Receiver: The adjacent node that receives and accepts or rejects a power-sleep request.
Power manager: The local system component that applies the physical power transition. Signaling protocol processing MUST NOT be assumed to perform the physical operation itself.
Power resource: The link or other traffic-engineered resource identified by the transaction.

Power Transition Procedures

Roles and Resource Scope A power-sleep transaction operates on one explicitly identified resource. The resource identifier MUST be sufficient to distinguish parallel links between the same pair of nodes. A node MUST NOT apply a transition to a different resource merely because the message arrived over a related adjacency or interface. The node requesting power-sleep is the Sender and the adjacent node is the Receiver. These roles apply to one power-sleep transaction only; a later transaction MAY assign the roles differently. Wakeup is not restricted to one Sender. Either endpoint, or a local policy or service event, MAY initiate wakeup. Each endpoint SHOULD maintain local transaction state for the resource. At a minimum, the model MUST have the following modes:

Operating mode: no active power-sleep coordination exists and the resource is available for normal operation.
Requisition mode: the Sender has requested preparation for an upcoming power-sleep and is waiting for acceptance or rejection.
Ready mode: the Sender has received acceptance and is waiting for local power manager authorization; or the Receiver has accepted the request and is waiting for the Sender's final instruction.
Pending mode: the Sender has issued the sleep instruction and is waiting for confirmation.
Sleeping mode: the resource has completed the coordinated transition to its low-power or power-down state.

An implementation MAY represent Operating mode by the absence of a transaction object. Changes in mode SHOULD be recorded for operational diagnosis.

Wakeup Procedure Wakeup MAY be initiated by either endpoint, by an ingress or service requirement, or by local policy. The initiator sends request for wakeup with the resource identifier. The peer receiving wakeup request MUST resolve the resource and request or perform local wakeup. At each endpoint, the wakeup operation triggers an independent restoration of the local resource state to Operating mode and cleanup of the sleep state. The endpoint initiating wakeup MUST use a path to send the wakeup request such that it does not depend on the sleeping resource being operational.

Power-Sleep Procedure The following procedure applies to a resource eligible for power-sleep:

The Sender in Operating mode verifies local policy, resource eligibility, and the availability of a live adjacency or equivalent peer relationship.
The Sender in Requisition mode creates transaction state for the resource and requests to prepare for sleep, identifying the resource.
The Receiver resolves the resource identifier and verifies that the resource is locally eligible. If it cannot participate, it continues to be in Operating mode and sends negative acknowledgement. If it can participate, it sends acknowledgement and transitions to Ready mode.
Upon receiving acknowledgment, the Sender transitions to Ready mode, and notifies its local Power manager that preparation has completed. This is the end of the sleep preparation phase.
If the intent is to put the interface to power-sleep, driven by the local policy, the Sender in Ready mode instructs the Receiver to sleep and transitions to Pending mode while waiting for confirmation.
Upon receiving the request to sleep, the Receiver in Ready mode acknowledges the request and completes its local transition to Sleeping mode. The Sender, upon receiving acknowledgment from the Receiver, completes its local transition to Sleeping mode.
The Sender may adopt a configurable timeout value to avoid waiting indefinitely for a response from the Receiver.

The signaling protocol coordinates the endpoints. A local power management framework that is outside the scope of this document is responsible for the physical operation triggered by the Sleeping state. An implementation MUST NOT report successful completion merely because a sleep request was sent.

Concurrent Requests and Collision Resolution Both endpoints can independently initiate preparation for sleep. If a node has an active Sender transaction for the same resource when it receives a competing request for sleep preparation, the nodes MUST deterministically select one Sender. The node identifiers used for the tie-break MUST be stable and globally comparable within the protocol domain. The node with the numerically higher identifier wins and remains Sender. It sends a negative acknowledgment for the competing request. The losing node cancels its Sender transaction, assumes the Receiver role, and continues processing the peer's request. Equal identifiers are an invalid or ambiguous condition. In such a case, the node MUST avoid creating two active transactions and SHOULD log the condition for operator intervention before discarding the competing request. Collision resolution MUST be applied only when the requests identify the same resource. A request for another parallel link is not a collision. Repeated wakeup requests MUST be handled idempotently.

Failure, Timeout, and Recovery A node MUST reject or abort a transaction when it cannot resolve the resource, lacks the required capability, lacks a usable peer relationship, or cannot obtain local power manager authorization. Where a response can still be sent, the Receiver SHOULD send a negative acknowledgment. The Sender MUST treat a rejection as an unsuccessful transaction and release its active state. The Sender MUST bound the time spent waiting for a response from the Receiver. The recommended default for each wait is 180 seconds. On expiry, the Sender SHOULD release the transaction state and log the failure for operator intervention. The timer does not imply retransmission; an implementation MAY add retransmission only if it preserves transaction correlation and bounded duplicate handling. A failed send, malformed message, unknown resource, or unexpected state MUST NOT cause an implementation to power down a resource. Such a condition MUST leave the resource in, or return it to Operating mode. Cleanup MUST cancel any associated timers and discard the transaction. Administrative disabling of power management MAY immediately discard active transaction state. It MUST NOT be interpreted as a successful negotiated sleep. The implementation SHOULD log the reason for the abort.

Traffic and TE-State Preservation Requirements Power transition signaling MUST NOT silently destroy the traffic-engineering state associated with the resource. In particular:

Link identity, addressing, TE attributes, and parallel-link disambiguation MUST remain available across the sleep interval.
Existing LSP, path, reservation, label, and protection state MUST be retained or reconciled according to the applicable TE protocol and policy. A power transition MUST NOT be treated as an implicit successful teardown unless another protocol explicitly performs that teardown.
A node MUST prevent new use of an unavailable resource according to its TE admission and flooding policy. The resource MUST become eligible for normal use only after wakeup and local readiness have completed.
Wakeup processing MUST restore the resource's TE participation and MUST use the preserved resource identity when reestablishing adjacency, reachability, or reservations.
There MUST be at least one control-plane path available for wakeup while the resource is asleep.

Implementations SHOULD expose state transitions, failures, collisions, and timeouts to operations.

RSVP-TE Signaling This section specifies the RSVP-TE realization of the framework for a directly connected RSVP-TE link. RSVP-TE carries the power-transition messages in an RSVP ResourceNotify message as specified in . The physical power action remains outside RSVP-TE and is performed by the local power manager.

Mapping of Power-Transition Messages to RSVP Power Code Values

Framework message	Value	Meaning
SleepPrepare	0	Sender proposes preparation to power-sleep
SleepPrepareAck	1	Receiver accepts preparation
SleepPrepareNak	2	Receiver rejects preparation
GoSleep	3	Sender authorizes power-sleep
GoSleepAck	4	Receiver confirms power-sleep
GoWakeup	5	Initiator requests wakeup

Each message is an RSVP ResourceNotify message containing one RESOURCE_SPEC object as specified in and one POWER object. A POWER object without a RESOURCE_SPEC object is invalid and MUST be rejected.

POWER Object Class = TBD, C-Type = TBD. Its format is:

POWER Object Format The Power Code is an unsigned one-octet value. Values 0 through 5 have the meanings in . Values 6 through 255 are reserved and MUST NOT be transmitted. A receiver that does not recognize a Power Code MUST reject or discard the object according to RSVP object processing rules and MUST NOT perform a power transition. The POWER Object applies only to the resource identified by the accompanying RESOURCE_SPEC object. A ResourceNotify message MUST NOT carry more than one POWER object.

Resource Identification The RESOURCE_SPEC object identifies the resource being transitioned. For the RESOURCE_SPEC_Ipv4 Class or RESOURCE_SPEC_IPv6 Class, the resource identifier is defined as:

For a numbered link, the Sender's local link address is encoded in the Link Address field and Link Index field is set to zero.
For an unnumbered link, the Sender's Router Identifier is encoded in the Link Address field and Sender's local unnumbered TE link identifier is encoded in the Link Index field.

The tuple (Link Address, Link Index) MUST be interpreted as one composite identifier. The receiver MUST resolve the tuple to its local interface and MUST reject the request if it cannot unambiguously do so.

Reliability, Acknowledgment, and Transaction Correlation RSVP ResourceNotify provides the message container; the power procedure provides the transaction semantics. The MESSAGE_ID with ACK_Desired semantics for ResourceNotify message provides the needed reliable transport for power coordination. However, both the Sender and Receiver RSVP nodes MUST maintain state and a timer to recover from error condition and put the resource back into Operating mode. SleepPrepareAck and SleepPrepareNak correlate to a pending SleepPrepare using the resource identifier and the peer relationship. GoSleepAck correlates to a pending GoSleep using the same resource identifier. An implementation MUST at minimum validate the resource identifier, expected role, expected state, and peer before applying a message. A valid message received in an unexpected state MUST be ignored or rejected without changing the power state. Duplicate acknowledgments MUST be treated as harmless. GoWakeup MUST be processed idempotently. The RSVP implementation uses a timeout interval of 180 seconds for the SleepPrepare and GoSleep confirmation phases. On expiry, the state should be removed, the operation should be reported as failed, and physical power-down MUST NOT be performed solely as a consequence of the timeout. ResourceNotify messages for a sleeping resource SHOULD be routed through a reachable control-plane path independent of the sleeping link.

Backward Compatibility and Error Handling The POWER object is an optional RSVP extension. A node that does not support power coordination may ignore or reject ResourceNotify according to the RSVP processing rules applicable to an unknown object. A Sender MUST treat the absence of a valid response as a failed transaction and MUST NOT power down the resource unilaterally. A receiver supporting this document MUST validate the ResourceNotify object structure before interpreting its contents. ResourceNotify messages carrying a POWER Object MUST contain a valid RESOURCE_SPEC. Missing, malformed, duplicated, or unknown mandatory content MUST result in rejection or discard and MUST NOT trigger a power action. If the resource cannot be found, the peer relationship is not valid, or local capability is unavailable, the receiver SHOULD send SleepPrepareNak. Otherwise it MUST discard the message, record an operational diagnostic, and leave the resource in Operating mode. Power coordination is controlled by local policy. A local administrative disable of RSVP power management MUST prevent new coordination and MAY clear active coordination state. It MUST NOT cause a GoWakeup exchange to be assumed.

Security Considerations A forged or replayed power message could cause a link to become unavailable or could cause unnecessary wakeup activity. Implementations MUST apply the RSVP security and peer-authentication mechanisms used for the associated RSVP adjacency and MUST validate that the message is from the authorized peer for the identified resource. Resource identifiers, roles, expected states, and transaction correlation MUST be checked before a message can cause a power action. Implementations SHOULD rate-limit invalid messages and record sufficient diagnostics to identify an attack or misconfiguration. A malformed or unauthenticated message MUST NOT cause a power transition.

IANA Considerations IANA is requested to allocate a new RSVP object class number for the POWER object, with C-Type 1. IANA is requested to create a registry titled "RSVP Power Management Codes". The registration policy is IETF Review. The initial values are: Initial RSVP Power Management Codes

Value	Name	Reference
0	SleepPrepare	This document,
1	SleepPrepareAck	This document,
2	SleepPrepareNak	This document,
3	GoSleep	This document,
4	GoSleepAck	This document,
5	GoWakeup	This document,

Values 6 through 255 are reserved.

Acknowledgements The authors would like to thank Joel Halpern for the invaluable feedback and comments.