Multipoint LDP (mLDP) Node Protection
Extracted elements (28)
The procedures require the protected node to be directly connected to both PLR and MPT nodes because mLDP depends on unicast routing for upstream LSR determination, which by default only provides next-hop information. Support for non-directly-connected PLR and MPT nodes is explicitly out of scope.
The solution uses a Targeted LDP (tLDP) session between each MPT and PLR to notify PLRs of MPT LSRs. This design avoids defining additional procedures for Make-Before-Break, Graceful Restart, and Typed Wildcard FEC by reusing existing tLDP mechanisms, at the cost of additional tLDP sessions.
When both link protection (via FRR through node M) and node protection are simultaneously invoked by the PLR, downstream MPTs may receive duplicate packets. The design resolves this by having MPTs select the upstream (primary N vs. secondary PLR) based on reachability of the protected node, ensuring only one path is active at a time.
An upstream LSR switchover from a tLDP neighbor to a directly connected LDP neighbor during reconvergence is procedurally identical to switching between two directly connected LDP neighbors; no special handling is required.
The MP2MP root node protection mechanism does not replace Root Node Redundancy (RNR) procedures from RFC 6388 Section 7. Node protection restores traffic for existing MP2MP LSPs after node failure, but a new root node must eventually be elected to allow creation of new MP2MP LSPs.
After a link failure where node N is still reachable, LSR2 and LSR3 MUST send a Label Withdraw to LSR1 to withdraw the label binding after N updates them that the PLR address is no longer applicable.
After determining the upstream LSR, node N (which has the node protection feature enabled) MUST advertise the address of that upstream LSR as the PLR address to the downstream members of the MP LSP, but only if a given downstream member has announced support for node protection.
After reconvergence when switching to a new primary path, a Label Withdraw message MUST be sent to the old upstream LSR, and both LSR2 and LSR3 SHOULD use Make-Before-Break (MBB) procedures as described in RFC 6388 to switch to the new primary upstream node.
Both the PLR Status and an MP FEC TLV MUST be included in the LDP Notification message so that a receiver is able to associate the PLR Status with the MP LSP.
In order to allow a node to be protected against failure, the LSRs providing the PLR and MPT functionality as well as the protected node MUST support the functionality described in this document, and these nodes MUST support LDP capability negotiation.
The FEC Label Mapping sent by the MPT over the tLDP session to the PLR MUST include a Status TLV with an MP Status and a 'Protected Node Status Value Element' to specify the address of the node being protected.
The nodes downstream from the protected node (participating in node protection) MUST have the capability to determine that the protected node has become unreachable; otherwise the reconvergence procedures cannot be applied.
The U/F bits in the Node Protection Capability TLV MUST be set to 1 and 0 respectively (as per RFC 5561), and the Length field MUST be set to 2.
To remove all PLR addresses belonging to the encoded Address Family, an LSR N MUST encode a PLR Status Value Element with no PLR entry and the 'Num PLR entry' field MUST be set to zero.
Upon receipt of a PLR MP Status with PLR addresses for an MP LSP, the MPT LSR MUST establish a tLDP session with all of the learned PLR addresses using the procedures documented in RFC 7060.
When a PLR receives a Label Mapping for a FEC that includes a Protected Node Status, it MUST only use that label binding once the advertised node becomes unreachable; for MP2MP LSPs, the label binding on the MPT MUST only be used once node N becomes unreachable.
When there is no more interest in the tLDP session between the MPT and PLR after reconvergence, the session MAY be taken down; it is RECOMMENDED to apply a delay before tearing down the session to avoid flapping.
For MP2MP root node protection, all directly connected members of the MP2MP LSP act as both PLR and MPT. The root node advertises the full member list to each member (excluding the recipient) rather than a single PLR address.
The Merge Point (MPT) is the LSR that merges the backup LSP with the primary LSP. There can be multiple MPT LSRs for a single MP-LSP node protection, and the MPT establishes a tLDP session with the PLR upon receiving PLR address information.
The Point of Local Repair (PLR) is the LSR that redirects multicast traffic to one or more Merge Point LSRs upon detecting node failure, using pre-established P2P LSPs that bypass the protected node N.
IANA allocated two new code points in the 'LDP MP Status Value Element type' registry: value 2 for 'PLR Status Value Element' and value 3 for 'Protected Node Status Value Element', both referencing RFC 7715.
IANA assigned code point 0x0972 in the 'TLV Type Name Space' registry (within LDP Parameters) for the 'MP Node Protection Capability', allocated from the IETF Consensus range.
The new TLVs defined in this document are protected by the same mechanisms used for LDP messages as described in RFC 6388 and RFC 5920. An attacker exploiting these mechanisms could induce a PLR or MPT to support a large number of tLDP sessions and even larger numbers of LSPs; implementations should count protection sessions and LSPs and log a warning if a threshold is crossed.
On each MPT, a secondary upstream LSR entry is maintained per FEC with label Lpx assigned to the PLR. The secondary upstream is inactive while the protected node N is reachable; upon N becoming unreachable (node failure trigger), the MPT switches to the secondary upstream LSR binding and deactivates the primary binding to N.
Each PLR Entry contains a 1-bit A field (0=Withdraw, 1=Add), 15 reserved bits (MUST be zero on transmit, ignored on receipt), and a variable-length PLR address encoded per the Address Family in the enclosing PLR Status Value Element.
The MP Node Protection Capability TLV (Type=0x0972) has U=1, F=0, Length=2, and a 2-octet value field containing: S bit (announce/withdraw), P bit (PLR capable), M bit (MPT capable), with all Reserved bits MUST be zero on transmit and ignored on receipt.
The PLR Status Value Element (Type=2) encodes: 1-octet Type, variable-length Length, 2-octet Addr Family, 1-octet Num PLR entry, followed by one or more PLR entries. Each PLR entry is 6 octets for IPv4 (2-octet A-bit+Reserved plus 4-octet address) or 18 octets for IPv6.
The Protected Node Status Value Element (Type=3) encodes: 1-octet Type, variable-length Length (6 octets for IPv4, 18 octets for IPv6), 2-octet Addr Family, and the node address. It is carried in an MP Status TLV within a Label Mapping message sent over the tLDP session.