Restart Signaling for IS-IS
obsoleted by
- rfc-8706 — Restart Signaling for IS-IS
obsoletes
- rfc-3847 — Restart Signaling for Intermediate System to Intermediate System (IS-IS)
Extracted elements (27)
Database synchronization completeness is determined by tracking LSPIDs from the first complete CSNP set received over each interface and removing entries as LSPs arrive. This avoids indefinite waiting by not tracking LSPs with zero remaining lifetime and expiring entries that never arrive.
During restart, a router's own received LSPs are not purged even though normal operation would purge unknown own-LSPs, because premature purging could cause churn in remote routers. The restriction is lifted once own LSPs are generated and flooded post-synchronization.
Preserving the LAN-ID across a restart prevents generation of new pseudonode LSPs and corresponding changes in all LSPs referencing them. Using a different LAN-ID would create unnecessary churn, so the restarting router SHOULD use the same LAN-ID as before the restart.
The SA (Suppress Adjacency) bit is used by a starting router—not a restarting router—because a starting router has no maintained forwarding state, and stale copies of previous-incarnation LSPs with higher sequence numbers may exist in the network, causing temporary blackholes until newer LSP versions propagate.
Timer T3 is initialized to 65535 seconds and then set to the minimum of received RA IIH holding times, rather than a fixed short value, to allow the restarting router to complete synchronization within the neighbors' adjacency holding windows without prematurely setting the overload bit.
A router that does not support the restart capability will ignore the Restart TLV and reinitialize the adjacency normally, returning an IIH without the Restart TLV. On Point-to-Point links this IIH is treated as an implicit acknowledgement; on LANs, synchronization can still proceed if at least one other neighbor supports restart.
Implementations based on earlier versions of this document (RFC 3847) may not include the Restarting Neighbor System ID field when the RA bit is set. A router expecting an RA on a LAN circuit SHOULD assume the acknowledgement is directed at the local system in this case.
A router operating as both Level 1 and Level 2 on an interface MUST perform restart operations independently for each level, including separate CSNP synchronization per level.
A router that suppresses advertisement of an adjacency MUST NOT use that adjacency when performing its SPF calculation; the suppressed adjacency must not be loaded into TENT.
All IIHs transmitted by a router that supports this capability MUST include the Restart TLV.
On a LAN circuit, the LAN-ID specified in an IIH with RR set MUST be ignored by receiving neighbors, so that the restarting router can learn the previously used LAN-ID from normal IIHs and avoid unnecessary pseudonode LSP churn.
On a Point-to-Point circuit, when a restarting router's three-way state would result in an UP adjacency to a non-restart-capable neighbor without the neighbor reinitializing, the restarting router MUST force adjacency reinitialization by setting local Adjacency Three-Way State to DOWN and sending a normal IIH, to guarantee SRMflags are set on the neighbor's database.
Redistribution of inter-level information MUST be regenerated before flooding a restarting router's LSP; the Level-n non-pseudonode LSP(s) MUST NOT be flooded until the other level's T2 timer has expired and its SPF has been run.
The Remaining Time field in an RA IIH MUST be set to the current time in seconds before the holding timer on the acknowledged adjacency is due to expire, ensuring the restarting router can accurately track its window for completing synchronization.
When a router receives an IIH with the SA bit set and an UP adjacency to the sender exists, it MUST suppress advertisement of that adjacency in its own LSPs and MUST continue suppression until an IIH with SA bit clear is received. If the adjacency transitions to UP, the new adjacency MUST NOT be advertised until an IIH with SA bit clear has been received.
When all T2 timers have been cancelled (LSPDB synchronized), a starting router MUST transmit IIHs with the SA bit clear, signaling neighbors to resume advertising the adjacency.
A new Restart TLV (Type 211) is defined for inclusion in IS-IS Hello (IIH) PDUs. It carries three flag bits (RR, RA, SA), a 2-octet Remaining Time field, and an optional Restarting Neighbor System ID field. Routers supporting this capability MUST include this TLV in all IIHs.
Three timers support restart signaling: T1 (per-interface retransmission timer, typical 3 s) controls retransmission of unacknowledged (re)start IIHs; T2 (per-LSPDB, typical 60 s) bounds the wait for LSPDB synchronization; T3 (system-wide, initialized to 65535 s) bounds the overall restart process and is updated from received RA IIHs.
This document registers TLV Type 211 (Restart TLV) in the IS-IS TLV codepoint registry. The TLV is valid in IIH PDUs only (IIH=y, LSP=n, SNP=n).
A false IIH with the RA bit set could cause a (re)starting router to falsely believe a neighbor supports restart procedures; in the absence of a complete CSNP set, this could delay restart completion by requiring T1 to exhaust its maximum retry count. A false RR bit causes neighbors to maintain adjacency state and resend CSNPs, which is wasteful but not disruptive to correct operation.
A false IIH with the SA bit set could cause a neighbor to suppress advertisement of an IS adjacency indefinitely or intermittently, potentially causing loss of reachability to some destinations and increased frequency of LSP flooding and SPF computation.
The possibility of IS-IS PDU spoofing that enables the above attacks can be reduced by the use of IS-IS authentication as described in RFC 1195 and ISO 10589, and especially cryptographic authentication per RFC 5304.
The Restarting Router state machine has states: Restarting → ADJ Seen RA (on RX RA) → cancels T1 when both RA and CSNP set received; → SPF Wait (on T2 expiry or LSP DB Sync, triggering SPF); → Running (on all SPFs done, clearing overload bit and updating forwarding plane). T3 expiry causes immediate overload bit set, forwarding table update, and LSP flood with overload bit.
The Running Router state machine handles RX RR (maintain adjacency state, send RA, set SRM flags, send CSNP, update hold time, set Restart Mode), RX RR clear (clear Restart Mode), RX SA (suppress IS neighbor TLV, enter ADJ Suppressed state), and RX SA clear (unsuppress adjacency, return to Running).
The Starting Router state machine has states: Starting → ADJ Seen RA (on RX RA) or ADJ Seen CSNP (on RX CSNP set); T1 cancelled when both RA and CSNP received; T2 expiry or LSP DB Sync clears overload bit, clears SA bit, and transitions to Running. On ADJ UP, local LSPs are immediately transmitted with overload bit set.
The Flags octet uses bits 5–7 (low-order): bit 0 = RR (Restart Request), bit 1 = RA (Restart Acknowledgement), bit 2 = SA (Suppress Adjacency advertisement); bits 3–7 are reserved.
The Restart TLV value field encodes: Flags (1 octet), Remaining Time in seconds (2 octets), and Restarting Neighbor System ID (ID Length octets, present when RA bit is set). Total length is 1 to (3 + ID Length) octets.