Pseudowire (PW) Endpoint Fast Failure Protection
Extracted elements (32)
During local repair, the PLR keeps the PW label intact rather than swapping it. This design choice obviates the need for the PLR to maintain bypass routes on a per-PW basis and enables bypass tunnel sharing between multiple PWs, at the cost of requiring the protector to understand upstream-assigned PW labels.
The context identifier is used as the transport tunnel destination rather than the private IP address of the primary PE. This simultaneously routes traffic to the primary PE during normal operation and conveys the identity of the protector to PLRs so they can establish correctly targeted bypass tunnels without per-PW state.
Two categories of IGP advertisement approaches are supported for the context identifier: the first requires no IGP extension and advertises the context identifier as reachable via both primary PE and protector (e.g., via a virtual proxy node), allowing normal path computation; the second requires an explicit 'context identifier object' IGP extension but ensures the transport tunnel terminates only at the primary PE. The mechanism is flexible as long as tunnel path requirements are satisfied.
Although local repair can temporarily restore traffic in tens of milliseconds, if the failure persists, LDP sessions between the ingress PE or protector and the failed egress PE/S-PE may eventually expire, causing the primary PW to be torn down or the protector's forwarding entry to be removed. Global repair SHOULD take place in a timely manner to move traffic to a fully functional alternative path.
The fast protection mechanism is applicable only to LDP-signaled PWs and requires multihomed CE with redundant PWs. It depends on MPLS upstream label assignment and context-specific label switching (RFC 5331) and is intended to complement, not replace, global repair and control-plane convergence.
A context identifier MUST be globally unique (or unique in the address space of the network where the primary PE and protector reside). A distinct context identifier MUST be assigned to each {primary PE, protector} pair, and a given PW MUST be associated with one and only one such pair.
A PLR MUST be able to detect a failure by using a rapid mechanism such as physical-layer failure detection, BFD, S-BFD, or others. In anticipation of failure, the PLR MUST also pre-establish a bypass tunnel to a protector and pre-install a bypass route in the data plane.
A primary PE MUST advertise a primary PW's label to a protector via a Label Mapping message carrying a Protection FEC Element TLV, an Upstream-Assigned Label TLV, and an Interface_ID TLV encoded with the context identifier of the {primary PE, protector}.
A protector MUST advertise the Egress Protection Capability TLV in its LDP Initialization and Capability messages. The TLV MUST carry the context identifier(s) of the {primary PE, protector} pairs for which the sender is the protector. This TLV MUST NOT be advertised by the primary PE or backup PE to the protector.
A targeted LDP session MUST be established between each pair of primary PE and protector. In the centralized protector model, a targeted LDP session MUST also be established between a backup S-PE and the protector.
FEC aggregation MUST NOT be applied to a context identifier's FEC, and every router MUST assign a unique label to the FEC. This prevents bypass tunnels from being misrouted due to label sharing.
In the centralized protector model, a backup PE MUST advertise a backup PW's label to the protector using a Label Mapping message whose Protection FEC Element MUST be identical to the one advertised by the primary PE. The context identifier MUST NOT be encoded in an Interface_ID TLV in this backup PE message.
It is RECOMMENDED that the fast protection mechanism SHOULD be used in conjunction with global repair, so that the mechanism temporarily repairs a failed path via a bypass tunnel while global repair eventually moves traffic to a fully functional alternative path.
The bypass tunnel MUST NOT traverse the primary PE or the penultimate link of the protected transport tunnel, and MUST NOT share any SRLGs with the penultimate link, ensuring it remains unaffected by the topology changes due to the failure.
The ingress PE MUST map only the PWs terminated by the exact primary PE and protected by the exact protector to a given transport tunnel, using the context identifier rather than a private IP address of the primary PE as the destination.
The PLR MUST establish a bypass tunnel to each protector for each context identifier associated with that protector. The destination of the bypass tunnel MUST be the context identifier.
The protector MUST learn the PW label from the primary PE prior to the failure and install a proper forwarding state for the PW label in a dedicated label space associated with the primary PE. During local repair, the protector MUST perform PW label lookup in this label space.
The transport tunnel MUST have the primary PE as the path endpoint. The bypass tunnel MUST have the protector as the path endpoint, and in egress PE and S-PE node protection, the bypass tunnel path MUST avoid the primary PE.
A context identifier is an IPv4/v6 address assigned to each ordered pair of {primary PE, protector}. It serves a dual role: identifying the primary PE and its associated protector for tunnel destination purposes, and indicating the primary PE's label space on the protector for context-specific label switching.
During local repair, the PLR keeps the PW label intact in packets and pushes a bypass tunnel label (MPLS) or IP header (IP tunnel) onto the stack when rerouting to the protector. The protector uses the bypass tunnel (context label or IP destination) as a pointer to determine which primary PE's label space to use for the PW label lookup.
In the centralized protector model, the protector is a dedicated P or PE router serving multiple primary PEs. Each primary PE may need only one protector, bounding the number of context identifiers to the number of primary PEs. For centralized protectors not directly connected to the CE, the protector performs a label swap from the primary PW label to the backup PW label before forwarding to the backup PE.
In the co-located protector model, the protector is the backup PE directly connected to the CE via a backup AC or a backup S-PE on a backup PW. The number of context identifiers scales with the number of distinct {primary PE, backup PE} pairs, making this model suitable for networks with relatively few primary and backup PEs.
The Point of Local Repair (PLR) is the router upstream adjacent to a failure. In egress AC protection, the PLR is the primary PE itself; in egress PE node protection, the PLR is the penultimate hop router of the transport tunnel; in S-PE node protection, the PLR is the penultimate hop of the primary PW segment's transport tunnel.
The protector is a router that receives rerouted PW traffic from the PLR during local repair and forwards it to the target CE via a backup path. It may be a backup PE (co-located model) or a dedicated router that forwards to a backup PE (centralized model). The protector MUST maintain a separate label space per primary PE it protects.
IANA assigned value 0x0974 for the Egress Protection Capability TLV in the 'TLV Type Name Space' registry, as defined in Section 6.1 of this document.
IANA assigned value 0x83 for the Protection FEC Element TLV in the 'Forwarding Equivalence Class (FEC) Type Name Space' registry per RFC 7358, and updated the registry to also reference this document.
PW traffic rerouted by a PLR to a protector, and further to a backup PE in the centralized model, should not be viewed as a new security threat, since all rerouting via PLRs, protectors, and backup PEs is planned and anticipated, and backup PEs can be used anyway to host PWs and LDP sessions.
The general MPLS security framework (RFC 5920), RSVP LSP security considerations (RFC 3209), LDP security considerations (RFC 5036), and LDP capability mechanism security considerations (RFC 5561) all apply to this document.
Protection FEC Element Encoding Type 1 (PWid with IPv4 PE addresses) has a fixed Length of 20 octets, encoding: Ingress PE IPv4 Address (4 bytes), Egress PE IPv4 Address (4 bytes), Group ID (4 bytes), PW ID (4 bytes, non-zero 32-bit), C-bit plus 15-bit PW Type (2 bytes), Reserved (2 bytes).
Protection FEC Element Encoding Type 3 (PWid with IPv6 PE addresses) has a fixed Length of 44 octets, encoding: Ingress PE IPv6 Address (16 bytes), Egress PE IPv6 Address (16 bytes), Group ID (4 bytes), PW ID (4 bytes), C-bit plus 15-bit PW Type (2 bytes), Reserved (2 bytes).
The Egress Protection Capability TLV has code point 0x0974, U-bit=1 (silently ignore if unknown), F-bit=0. It carries an S-bit (advertise/withdraw), Reserved byte, and a variable-length Capability Data field containing one or more IPv4/v6 context identifiers identifying the {primary PE, protector} pairs for which the sender is the protector.
The Protection FEC Element TLV has type 0x83, with an Encoding Type field (1=PWid/IPv4, 2=Generalized PWid/IPv4, 3=PWid/IPv6, 4=Generalized PWid/IPv6), a Length field (octets of PW Information), and a variable-length PW Information field. This TLV is carried in LDP Label Mapping messages to identify the primary PW being protected.