idnits 2.17.1 draft-ietf-idr-bgp-gr-notification-15.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year (Using the creation date from RFC4724, updated by this document, for RFC5378 checks: 2000-12-19) -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (April 10, 2018) is 2201 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 8203 (Obsoleted by RFC 9003) Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Internet Engineering Task Force K. Patel 3 Internet-Draft Arrcus 4 Updates: 4724 (if approved) R. Fernando 5 Intended status: Standards Track Cisco Systems 6 Expires: October 12, 2018 J. Scudder 7 J. Haas 8 Juniper Networks 9 April 10, 2018 11 Notification Message support for BGP Graceful Restart 12 draft-ietf-idr-bgp-gr-notification-15.txt 14 Abstract 16 The BGP Graceful Restart mechanism defined in RFC 4724 limits the 17 usage of BGP Graceful Restart to BGP protocol messages other than a 18 BGP NOTIFICATION message. This document updates RFC 4724 by defining 19 an extension that permits the Graceful Restart procedures to be 20 performed when the BGP speaker receives a BGP NOTIFICATION Message or 21 the Hold Time expires. This document also defines a new BGP 22 NOTIFICATION Cease Error subcode whose effect is to request a full 23 session restart instead of a Graceful Restart. 25 Status of This Memo 27 This Internet-Draft is submitted in full conformance with the 28 provisions of BCP 78 and BCP 79. 30 Internet-Drafts are working documents of the Internet Engineering 31 Task Force (IETF). Note that other groups may also distribute 32 working documents as Internet-Drafts. The list of current Internet- 33 Drafts is at https://datatracker.ietf.org/drafts/current/. 35 Internet-Drafts are draft documents valid for a maximum of six months 36 and may be updated, replaced, or obsoleted by other documents at any 37 time. It is inappropriate to use Internet-Drafts as reference 38 material or to cite them other than as "work in progress." 40 This Internet-Draft will expire on October 12, 2018. 42 Copyright Notice 44 Copyright (c) 2018 IETF Trust and the persons identified as the 45 document authors. All rights reserved. 47 This document is subject to BCP 78 and the IETF Trust's Legal 48 Provisions Relating to IETF Documents 49 (https://trustee.ietf.org/license-info) in effect on the date of 50 publication of this document. Please review these documents 51 carefully, as they describe your rights and restrictions with respect 52 to this document. Code Components extracted from this document must 53 include Simplified BSD License text as described in Section 4.e of 54 the Trust Legal Provisions and are provided without warranty as 55 described in the Simplified BSD License. 57 Table of Contents 59 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 60 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 61 2. Modifications to BGP Graceful Restart Capability . . . . . . 3 62 3. BGP Hard Reset Subcode . . . . . . . . . . . . . . . . . . . 3 63 3.1. Sending a Hard Reset . . . . . . . . . . . . . . . . . . 4 64 3.2. Receiving a Hard Reset . . . . . . . . . . . . . . . . . 4 65 4. Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 4 66 4.1. Rules for the Receiving Speaker . . . . . . . . . . . . . 5 67 5. Use of Hard Reset . . . . . . . . . . . . . . . . . . . . . . 6 68 5.1. When to Send Hard Reset . . . . . . . . . . . . . . . . . 6 69 5.2. Interaction With Other Specifications . . . . . . . . . . 7 70 6. Management Considerations . . . . . . . . . . . . . . . . . . 7 71 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7 72 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 73 9. Security Considerations . . . . . . . . . . . . . . . . . . . 8 74 10. Normative References . . . . . . . . . . . . . . . . . . . . 8 75 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 77 1. Introduction 79 For many classes of errors, the BGP protocol must send a NOTIFICATION 80 message and reset the peering session to handle the error condition. 81 The BGP Graceful Restart extension defined in [RFC4724] requires that 82 normal BGP procedures defined in [RFC4271] be followed when a 83 NOTIFICATION message is sent or received. This document defines an 84 extension to BGP Graceful Restart that permits the Graceful Restart 85 procedures to be performed when the BGP speaker receives a 86 NOTIFICATION message or the Hold Time expires. This permits the BGP 87 speaker to avoid flapping reachability and continue forwarding while 88 the BGP speaker restarts the session to handle errors detected in the 89 BGP protocol. 91 At a high level, this document can be summed up as follows. When a 92 BGP session is reset, both speakers operate as "Receiving Speakers" 93 according to [RFC4724], meaning they retain each other's routes. 94 This is also true for HOLDTIME expiration. The functionality can be 95 defeated using a "Hard Reset" subcode for the BGP NOTIFICATION Cease 96 Error code. If a Hard Reset is used, a full session reset is 97 performed. 99 1.1. Requirements Language 101 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 102 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 103 document are to be interpreted as described in RFC 2119 [RFC2119]. 105 2. Modifications to BGP Graceful Restart Capability 107 The BGP Graceful Restart Capability is augmented to signal the 108 Graceful Restart support for BGP NOTIFICATION messages. The Restart 109 Flags field is augmented as follows (following the diagram from 110 section 3 of [RFC4724]): 112 Restart Flags: 114 This field contains bit flags relating to restart. 116 0 1 2 3 117 +-+-+-+-+ 118 |R|N| | 119 +-+-+-+-+ 121 The most significant ("Restart State", or "R") bit is defined in 122 [RFC4724]. 124 The second most significant bit ("N") is defined as the BGP Graceful 125 Notification bit, which is used to indicate Graceful Restart support 126 for BGP NOTIFICATION messages. A BGP speaker indicates support for 127 the procedures of this document, by advertising a Graceful Restart 128 Capability with its Graceful NOTIFICATION bit set (value 1). This 129 also implies support for the format for a BGP NOTIFICATION Cease 130 message defined in [RFC4486]. 132 If a BGP speaker that previously advertised a given set of Graceful 133 Restart parameters opens a new session with a different set of 134 parameters, these new parameters apply once the session has 135 transitioned into ESTABLISHED state. 137 3. BGP Hard Reset Subcode 139 We define a new BGP NOTIFICATION Cease message subcode, called the 140 BGP Hard Reset Subcode. The value of this subcode is discussed in 141 Section 8. We refer to a BGP NOTIFICATION Cease message with the 142 Hard Reset subcode as a Hard Reset message, or just a Hard Reset. 144 When the "N" bit has been exchanged by two peers, to distinguish them 145 from Hard Reset we refer to any NOTIFICATION messages other than Hard 146 Reset as "Graceful", since such messages invoke Graceful Restart 147 semantics. 149 3.1. Sending a Hard Reset 151 A Hard Reset message is used to indicate to a peer with which the 152 Graceful Notification bit has been exchanged, that the session is to 153 be fully terminated. 155 When sending a Hard Reset, the data portion of the NOTIFICATION is 156 encoded as follows: 158 +--------+--------+-------- 159 | ErrCode| Subcode| Data 160 +--------+--------+-------- 162 ErrCode is a BGP Error Code (as documented in the IANA BGP Error 163 Codes registry) that indicates the reason for the Hard Reset. 164 Subcode is a BGP Error Subcode (as documented in the IANA BGP Error 165 Subcodes registry) as appropriate for the ErrCode. Similarly, Data 166 is as appropriate for the ErrCode and Subcode. In short, the Hard 167 Reset encapsulates another NOTIFICATION message in its data portion. 169 3.2. Receiving a Hard Reset 171 Whenever a BGP speaker receives a Hard Reset, the speaker MUST 172 terminate the BGP session following the standard procedures in 173 [RFC4271]. 175 4. Operation 177 A BGP speaker that is willing to receive and send BGP NOTIFICATION 178 messages according to the procedures of this document MUST advertise 179 the BGP Graceful Notification "N" bit using the Graceful Restart 180 Capability as defined in [RFC4724]. 182 When such a BGP speaker has received the "N" bit from its peer, and 183 receives from that peer a BGP NOTIFICATION message other than a Hard 184 Reset, it MUST follow the rules for the Receiving Speaker mentioned 185 in Section 4.1. The BGP speaker generating the BGP NOTIFICATION 186 message MUST also follow the rules for the Receiving Speaker. 188 When a BGP speaker resets its session due to a HOLDTIME expiry, it 189 should generate the relevant BGP NOTIFICATION message as mentioned in 190 [RFC4271], but subsequently it MUST follow the rules for the 191 Receiving Speaker mentioned in Section 4.1. 193 A BGP speaker SHOULD NOT send a Hard Reset to a peer from which it 194 has not received the "N" bit. We note, however, that if it did so 195 the effect would be as desired in any case, since according to 196 [RFC4271] and [RFC4724] any NOTIFICATION message, whether recognized 197 or not, results in a session reset. Thus the only negative effect to 198 be expected from sending the Hard Reset to a peer that hasn't 199 advertised compliance to this specification would be that the peer 200 would be unable to properly log the associated information. 202 Once the session is re-established, both BGP speakers SHOULD set 203 their "Forwarding State" bit to 1. If the "Forwarding State" bit is 204 not set, then according to the procedures of [RFC4724] section 4.2, 205 the relevant routes will be flushed, defeating the goals of this 206 specification. 208 4.1. Rules for the Receiving Speaker 210 [RFC4724] section 4.2 defines rules for the Receiving Speaker. These 211 are modified as follows. 213 The sentence "To deal with possible consecutive restarts, a route 214 (from the peer) previously marked as stale MUST be deleted" only 215 applies when the "N" bit has not been exchanged with the peer: 217 OLD: When the Receiving Speaker detects termination of the TCP 218 session for a BGP session with a peer that has advertised the 219 Graceful Restart Capability, it MUST retain the routes received 220 from the peer for all the address families that were previously 221 received in the Graceful Restart Capability and MUST mark them 222 as stale routing information. To deal with possible consecutive 223 restarts, a route (from the peer) previously marked as stale 224 MUST be deleted. The router MUST NOT differentiate between 225 stale and other routing information during forwarding. 227 NEW: When the Receiving Speaker detects termination of the TCP 228 session for a BGP session with a peer that has advertised the 229 Graceful Restart Capability, it MUST retain the routes received 230 from the peer for all the address families that were previously 231 received in the Graceful Restart Capability and MUST mark them 232 as stale routing information. The router MUST NOT differentiate 233 between stale and other routing information during forwarding. 234 If the "N" bit has not been exchanged with the peer, then to 235 deal with possible consecutive restarts, a route (from the peer) 236 previously marked as stale MUST be deleted. 238 The stale timer is given a formal name and made mandatory: 240 OLD: To put an upper bound on the amount of time a router retains the 241 stale routes, an implementation MAY support a (configurable) 242 timer that imposes this upper bound. 244 NEW: To put an upper bound on the amount of time a router retains the 245 stale routes, an implementation MUST support a (configurable) 246 timer, called the "stale timer", that imposes this upper bound. 247 A suggested default value for the stale timer is 180 seconds. 248 An implementation MAY provide the option to disable the timer 249 (i.e., to provide an infinite retention time) but MUST NOT do so 250 by default. 252 5. Use of Hard Reset 254 5.1. When to Send Hard Reset 256 Although when to send a Hard Reset is an implementation-specific 257 decision, we offer some advice. Many Cease notification subcodes 258 represent permanent or long-term rather than transient session 259 termination, and as such it's appropriate to use Hard Reset with 260 them. At time of publication, Cease subcodes 1-9 were defined. 262 +-------+------------------------------------+----------------------+ 263 | Value | Name | Suggested Behavior | 264 +-------+------------------------------------+----------------------+ 265 | 1 | Maximum Number of Prefixes Reached | Hard Reset | 266 | 2 | Administrative Shutdown | Hard Reset | 267 | 3 | Peer De-configured | Hard Reset | 268 | 4 | Administrative Reset | Provide user control | 269 | 5 | Connection Rejected | Graceful Cease | 270 | 6 | Other Configuration Change | Graceful Cease | 271 | 7 | Connection Collision Resolution | Graceful Cease | 272 | 8 | Out of Resources | Graceful Cease | 273 | 9 | Hard Reset | Hard Reset | 274 +-------+------------------------------------+----------------------+ 276 Suggestions for Cease Subcode Behavior 278 These suggestions are only that, suggestions, not requirements. It's 279 the nature of BGP implementations that the mapping of internal states 280 to BGP NOTIFICATION codes and subcodes is not always perfect. The 281 guiding principle for the implementor should be that if there is no 282 realistic hope that forwarding can continue or that the session will 283 be re-established within the deadline, Hard Reset should be used. 285 For all other NOTIFICATION codes other than Cease, use of Hard Reset 286 does not appear to be indicated. 288 5.2. Interaction With Other Specifications 290 "BGP Administrative Shutdown Communication" [RFC8203] specifies use 291 of the data portion of the Administrative Shutdown or Administrative 292 Reset Cease to convey a short message. When [RFC8203] is used in 293 conjunction with Hard Reset, the subcode of the outermost Cease MUST 294 be Hard Reset, with the Administrative Shutdown or Reset Cease 295 encapsulated within. The encapsulated administrative shutdown 296 message MUST subsequently be processed according to [RFC8203]. 298 6. Management Considerations 300 When reporting a Hard Reset to network management, the error code and 301 subcode reported MUST be Cease, Hard Reset. If the network 302 management layer in use permits it, the information carried in the 303 Data portion SHOULD be reported as well. 305 7. Acknowledgements 307 The authors would like to thank Jim Uttaro for the suggestion, and 308 Emmanuel Baccelli, Bruno Decraene, Chris Hall, Paul Mattes, Robert 309 Raszuk, and Alvaro Retana for their review and comments. 311 8. IANA Considerations 313 IANA has temporarily assigned subcode 9, named "Hard Reset", in the 314 "BGP Cease NOTIFICATION message subcodes" registry. Upon publication 315 of this document as an RFC, IANA is requested to make this allocation 316 permanent. 318 IANA is requested to establish a registry within the "Border Gateway 319 Protocol (BGP) Parameters" grouping, to be called "BGP Graceful 320 Restart Flags". The Registration Procedure should be Standards 321 Action, the reference this document and [RFC4724], and the initial 322 values as follows: 324 +--------------+---------------+------------+---------------+ 325 | Bit Position | Name | Short Name | Reference | 326 +--------------+---------------+------------+---------------+ 327 | 0 | Restart State | R | [RFC4724] | 328 | 1 | Notification | N | this document | 329 | 2, 3 | unassigned | | | 330 +--------------+---------------+------------+---------------+ 332 IANA is requested to establish a registry within the "Border Gateway 333 Protocol (BGP) Parameters" grouping, to be called "BGP Graceful 334 Restart Flags for Address Family". The Registration Procedure should 335 be Standards Action, the reference this document and [RFC4724], and 336 the initial values as follows: 338 +--------------+------------------+------------+-----------+ 339 | Bit Position | Name | Short Name | Reference | 340 +--------------+------------------+------------+-----------+ 341 | 0 | Forwarding State | F | [RFC4724] | 342 | 1-7 | unassigned | | | 343 +--------------+------------------+------------+-----------+ 345 9. Security Considerations 347 This specification doesn't change the basic security model inherent 348 in [RFC4724], with the exception that the protection against repeated 349 resets is relaxed. To mitigate the consequent risk that an attacker 350 could use repeated session resets to prevent stale routes from ever 351 being deleted, we make the stale routes timer mandatory (in practice 352 it is already ubiquitous). To the extent [RFC4724] might be said to 353 help defend against denials of service by making the control plane 354 more resilient, this extension may modestly increase that resilience; 355 however, there are enough confounding and deployment-specific factors 356 that no general claims can be made. 358 10. Normative References 360 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 361 Requirement Levels", BCP 14, RFC 2119, 362 DOI 10.17487/RFC2119, March 1997, 363 . 365 [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A 366 Border Gateway Protocol 4 (BGP-4)", RFC 4271, 367 DOI 10.17487/RFC4271, January 2006, 368 . 370 [RFC4486] Chen, E. and V. Gillet, "Subcodes for BGP Cease 371 Notification Message", RFC 4486, DOI 10.17487/RFC4486, 372 April 2006, . 374 [RFC4724] Sangli, S., Chen, E., Fernando, R., Scudder, J., and Y. 375 Rekhter, "Graceful Restart Mechanism for BGP", RFC 4724, 376 DOI 10.17487/RFC4724, January 2007, 377 . 379 [RFC8203] Snijders, J., Heitz, J., and J. Scudder, "BGP 380 Administrative Shutdown Communication", RFC 8203, 381 DOI 10.17487/RFC8203, July 2017, 382 . 384 Authors' Addresses 386 Keyur Patel 387 Arrcus 389 Email: keyur@arrcus.com 391 Rex Fernando 392 Cisco Systems 393 170 W. Tasman Drive 394 San Jose, CA 95134 395 USA 397 Email: rex@cisco.com 399 John Scudder 400 Juniper Networks 401 1194 N. Mathilda Ave 402 Sunnyvale, CA 94089 403 USA 405 Email: jgs@juniper.net 407 Jeff Haas 408 Juniper Networks 409 1194 N. Mathilda Ave 410 Sunnyvale, CA 94089 411 USA 413 Email: jhaas@juniper.net