Redundancy Mechanism for Inter-domain VPLS Service
Extracted elements (25)
Independent PW redundancy mode is preferred by operators for inter-domain deployments because it maintains control-plane separation between domains. Master/slave mode provides enhanced capabilities but requires cross-domain coordination.
MC-LAG-based inter-domain redundancy requires Ethernet links of homogeneous speed, making it inapplicable when domains interconnect over packet-over-SONET/SDH. PW-based redundancy with ICCP avoids these constraints and works over heterogeneous links.
MP-BGP-based VPLS inter-domain protection (RFC 6074) relies on BGP control-plane convergence, which may not meet tight SLA failover requirements. ICCP with PW redundancy provides faster convergence and applies even when MP-BGP is not deployed for VPLS.
With inter-AS option B, each PE must replicate multicast traffic to all PEs in both local and remote domains. The ICCP solution limits replication: a PE replicates only to local PEs and the ASBR, and the remote ASBR replicates to its local PEs, distributing load more efficiently.
Both domains must use the same inter-domain redundancy use case (two-PW per Section 5.2 or four-PW per Section 5.3), and all modes and options must be provisioned identically within each RG and between RGs. Inconsistent provisioning may cause the redundancy mechanism to malfunction.
For two-PW inter-domain redundancy, operators of both domains must negotiate and configure the same PW high/low priority at the two PW endpoints prior to deployment. If PE3 and PE5 do not both have higher (or lower) priority than PE4 and PE6, both PW1 and PW2 may enter standby state simultaneously.
Option B of the 3:1 protection model accommodates legacy PEs in one domain that do not implement this document's procedures, provided those legacy PEs support PW redundancy per RFC 6870 and are configured as slave nodes.
During simultaneous switchover requests in the 3:1 Option A model, the PE MUST compare IP addresses with the remote PW peer. The PE with the higher IP address SHOULD ignore the request and wait for acknowledgement; the PE with the lower IP address SHOULD clear the 'request switchover' bit, set the 'Preferential Forwarding' local status bit, and update the PW status to its ICCP peer.
For the four-PW inter-domain scenario, PEs MUST ensure that the same PW redundancy mode (independent or master/slave) is supported on both ICCP peers within the same RG; this consistency is achieved via manual configuration.
In the 1:1 four-PW protection model, the PE detecting one PW DOWN SHOULD set the other PW to STANDBY if available, then synchronize the updated state to its ICCP peer.
In the 3:1 Option B (master/slave) model, when the master PE detects an active PW DOWN it SHOULD enable another local standby PW. Only when both inter-domain PWs on the master PE are DOWN SHOULD the ICCP peer PE in the same RG switchover.
In the 3:1 protection model, implementations MUST support Option A (independent mode with Request Switchover bit) and MAY support Option B (master/slave mode with ICCP in one domain only).
The remote PE receiving the 'request switchover' bit SHOULD acknowledge the request and activate the PW only when it is ready to take over as described in Section 5.1; otherwise, it SHOULD ignore the request.
When a PE detects failure of all PWs to the local domain (node isolation), it SHOULD advertise standby state for all its inter-domain PWs to trigger the remote PE to switchover.
When a PE detects failure of the active inter-domain PW in the 3:1 Option A scenario, it SHOULD switch to another local standby inter-domain PW if available and send an LDP PW status message with the 'request switchover' bit set on that standby PW to the remote PE.
When a PE detects that the active PE in the same RG has gone down, if the local PE has redundant PWs for the affected services and has the highest priority after the failed PE, it SHOULD advertise active state for all associated inter-domain PWs.
When a PE receives advertisements from the active PE in the same RG indicating all inter-domain PW status has changed to DOWN/STANDBY, and it has the highest priority after the advertising PE, it SHOULD advertise active state for all its associated inter-domain PWs.
A Redundancy Group (RG) pairs two PE nodes within the same domain. In the two-PW use case, PE3 and PE4 form RG1 in operator A's network, and PE5 and PE6 form RG2 in operator B's network, with ICCP running between the two peers of each RG.
Four-PW inter-domain redundancy supports two protection models: 1:1 (one active, one standby) and 3:1 (one active, three standby). In the 3:1 model, Option A requires Request Switchover bit support (RFC 6870 Section 6.3); Option B requires master/slave mode and ICCP in only one domain.
The PW-RED Synchronization Request TLV in ICCP Application Data Messages is used to synchronize the latest PW active/standby status between ICCP peers during a 3:1 switchover event, ensuring both sides have consistent state.
The solution reuses the Inter-Chassis Communication Protocol (ICCP, RFC 7275) to coordinate between redundant PE nodes, and the PW Preferential Forwarding Status Bit (RFC 6870) to negotiate PW active/standby state. No new protocol message formats or options are introduced.
Two-PW inter-domain redundancy uses one active PW (PW1) and one standby PW (PW2) connecting the two RGs, providing 1:1 protection with ICCP deployed on VPLS edge nodes in both domains and independent PW redundancy mode.
Excessive PW state flapping—potentially induced by a malicious peer PE implementation—can cause excessive ICCP message exchanges, creating a denial-of-service risk. Implementations SHOULD provide mechanisms for control-plane policing to mitigate such attacks.
ICCP is deployed between PEs or ASBRs across domains. The interconnecting network must be well-managed with highly monitored service levels and availability, as ICCP carries control-plane state that governs failover behavior. This must be ensured by the operator.
Each inter-domain PW operates in one of three states: ACTIVE, STANDBY, or DOWN. Triggers for transitions include: inter-domain PW failure (DOWN → peer assumes ACTIVE), PE node isolation (all local PWs fail → advertise STANDBY), and PE node failure (active PE gone → highest-priority peer assumes ACTIVE).