Routing Bridges (RBridges): Appointed Forwarders
obsoleted by
- rfc-8139 — Transparent Interconnection of Lots of Links (TRILL): Appointed Forwarders
updated by
- rfc-7180 — Transparent Interconnection of Lots of Links (TRILL): Clarifications, Corrections, and Updates
updates
- rfc-6325 — Routing Bridges (RBridges): Base Protocol Specification
Extracted elements (22)
Per-VLAN inhibition timers are necessary for loop safety when bridges on a link are misconfigured, as illustrated in the Appendix example: RB1 sees RB2's VLAN-3 Hello and inhibits itself, while RB2 (unable to see RB1's Hellos) handles VLAN-3. If RB2 later disappears, RB1's per-VLAN timer eventually expires and RB1 resumes service. Without separate per-VLAN timers, inhibition could spread unnecessarily across VLANs.
The inhibition mechanism exists because TRILL cannot fully prevent two RBridges from simultaneously believing they are Appointed Forwarder for the same VLAN (e.g., due to bridged-LAN asymmetric visibility). Rather than relying solely on appointment correctness, inhibition provides a loop-safety backstop by suppressing native frame handling until timers expire.
The practical limit on Appointed Forwarders per link (~83 RBridges given ~1000 bytes available in a TRILL Hello, or ~166 if the Designated VLAN is an extreme value) is an incidental consequence of Hello PDU size constraints rather than a deliberate design choice. Links with more than a handful of RBridges are expected to be rare.
An RBridge with unexpired inhibition timers is still REQUIRED to indicate in every TRILL Hello it sends on VLAN-x whether or not it is Appointed Forwarder for VLAN-x on that port. Inhibition has no effect on the receipt or forwarding of TRILL Data frames.
If the DRB detects VLAN mapping on a link (a TRILL Hello arrives on VLAN-x but was sent on VLAN-y), the DRB MUST make or revoke appointments to ensure that the same RBridge is the Appointed Forwarder for both VLAN-x and VLAN-y on that link.
It is RECOMMENDED that the DRB send its forwarder appointments on the Designated VLAN at least once per its Holding Time on the DRB-winning port, for robustness against VLAN misconfigurations in bridged LAN links.
The DRB inhibition timer and root change inhibition timer MUST be implemented. At least two VLAN inhibition timers MUST be implemented.
The DRB MUST NOT send any Appointed Forwarder appointments on a link unless its DRB inhibition timer for that link has expired.
There MUST NOT be two Appointed Forwarders on a link simultaneously ingressing and egressing native frames for the same VLAN. Dual AFs for the same VLAN can form a loop where frames are unprotected by the TRILL hop count.
To minimize native traffic loss due to inhibition, a VLAN inhibition timer per VLAN for which end station service will ever be offered SHOULD be implemented. An RBridge MUST NOT merge VLAN inhibition timers for two VLANs when it is Appointed Forwarder for one but not the other, as this can cause unnecessarily prolonged inhibition.
Unnecessary changes in Appointed Forwarders SHOULD NOT be made as they may cause transient loss of end station service. Large numbers of Appointed Forwarders on a link (in excess of 65) are NOT RECOMMENDED due to the complexity of establishment and maintenance.
A non-DRB RBridge processes Appointed Forwarder sub-TLVs only when the TRILL Hello arrives from the winning DRB port. Appointments specify contiguous intervals of VLAN IDs; the receiver becomes Appointed Forwarder only for those VLANs in the interval that are enabled on its ports. VLANs not included in any sub-TLV cause the receiver to lose prior Appointed Forwarder status for those VLANs.
An Appointed Forwarder for VLAN-x is inhibited on a link if any of three timers is unexpired: the DRB inhibition timer, the root change inhibition timer, or the VLAN-x inhibition timer. Inhibition is per-VLAN; a forwarder may be inhibited for some VLANs but not others.
An inhibited VLAN-x Appointed Forwarder that receives a TRILL Data frame for VLAN-x decapsulates it normally but does not output it to the inhibited link (though it may forward to other links for multi-destination frames). An inhibited forwarder that receives a VLAN-x native frame from the link ignores it except for address learning.
An RBridge maintains three types of inhibition timers per link where it can offer end station service: a DRB inhibition timer, a root change inhibition timer, and up to 4,094 per-VLAN inhibition timers (one per legal VLAN ID). All timers are denominated in seconds.
An RBridge with multiple non-suspended ports on a link that is the Appointed Forwarder for VLAN-x may load-share ingress/egress of VLAN-x native frames across those ports, provided no frame egressed on one port can be ingressed on another (which would create a loop). For multiple VLANs, partitioning VLANs among ports is a straightforward approach.
Disabling VLAN-x on an RBridge port cancels its Appointed Forwarder status for VLAN-x unless VLAN-x is enabled on another port of the same RBridge on the same link. Configuring a port as trunk or point-to-point revokes any AF status that depends on that port. Re-enabling VLANs or removing trunk configuration does not by itself make the RBridge an Appointed Forwarder.
The Appointed Forwarder on a link for VLAN-x is the RBridge that ingresses native frames from and egresses native frames to the link in that VLAN. By default the DRB handles native traffic for all VLANs on the link and may delegate to other RBridges. Appointed Forwarder status has no effect on forwarding of TRILL Data frames; it only affects native frame handling.
The DRB appoints other RBridges as Appointed Forwarders by including one or more Appointed Forwarders sub-TLVs in a TRILL Hello sent on the Designated VLAN from the DRB-election-winning port. When the DRB sends any appointments it must send all appointments for that link in that Hello; any prior appointment not included is implicitly revoked.
RFC 6439 improves documentation of the TRILL Appointed Forwarder mechanism but does not introduce new security considerations beyond those of the TRILL base protocol. Security considerations for TRILL remain as specified in Section 6 of RFC 6325.
An RBridge loses all Appointed Forwarder status when (1) it decides it has lost DRB status for a link, or (2) it observes a DRB change to another RBridge without itself becoming DRB. In the corner case where DRB role shifts between two ports of the same RBridge, neither condition applies and AF status is unchanged.
Eight rules govern inhibition timer transitions: (1) on boot all timers expire except DRB timer; (2) becoming DRB sets DRB timer to port Holding Time; (3) losing DRB expires DRB timer; (4) receiving a Hello from an RBridge claiming AF status for VLAN-x sets VLAN-x timer to max(current, received Holding Time); (5) enabling VLAN-x on a port sets VLAN-x timer to port Holding Time; (6) detecting spanning-tree root change sets root change timer to 30 seconds (configurable down to 0); (7) discovering two ports are on the same link merges timers by max; (8) splitting ports to separate links clones timer state.