Transparent Interconnection of Lots of Links (TRILL): Appointed Forwarders
Extracted elements (27)
The requirement to support E-L1CS FS-LSPs for forwarder appointment frees the mechanism from Hello PDU size constraints. Using only Hello-based appointments, roughly 83 RBridges can be appointed per link (assuming 1,000 bytes available and 12 bytes per RBridge appointment); E-L1CS FS-LSPs increase capacity by several orders of magnitude.
The root bridge change inhibition timer defaults to 30 seconds rather than being derived from spanning tree timers because TRILL switches may not know which spanning tree protocol is running. Operators who know RSTP is deployed throughout the attached bridged LAN may safely reduce this to 7 seconds (or 4 seconds with minimum Bridge Hello Timer configured).
Future TRILL specifications making use of E-L1CS MUST specify how links will behave when some attached TRILL switches support E-L1CS and others do not. Legacy RBridges that do not support E-L1CS will not see E-L1CS-based forwarder appointments; the DRB must fall back to Hello-based appointments to appoint such legacy switches.
A TRILL switch that is shutting down a port soon SHOULD reduce its Holding Time on that port so that adjacent RBridges not supporting the Port-Shutdown message will notice the shutdown more rapidly.
All TRILL switches MUST support the E-L1CS flooding scope (RFC 7356), E-L1FS (RFC 7780), and base LSPs. E-L1CS PDUs MUST NOT exceed 1,470 bytes in length when transmitted, though longer received PDUs are processed normally.
All TRILL switches on a link configured with an FGL-VLAN mapping SHOULD be configured with the same mapping, and SHOULD advertise their mapping using the FGL-VLAN-Bitmap and FGL-VLAN-Pairs APPsub-TLVs. A TRILL switch SHOULD alert the network operator if an inconsistency persists beyond its Holding Time (configurable from 0 to 65,534 seconds).
An inhibited Appointed Forwarder for VLAN-x MUST NOT ingress or egress native frames for VLAN-x on the inhibited link but still decapsulates received TRILL Data for possible forwarding to other links. The switch MUST still indicate its Appointed Forwarder status in TRILL Hellos even while inhibited.
An RBridge MUST always attempt to send TRILL Hellos in the Designated VLAN. Optional Hello reduction to fewer VLANs is only safe if all adjacencies on the link (excluding Down-state) indicate support for the self-appointment and VLANs-Appointed mechanisms.
If the DRB loses adjacency to an appointed Appointed Forwarder and native traffic from that forwarder still needs handling, the DRB SHOULD immediately appoint another forwarder or itself become the forwarder for that traffic.
If the DRB on a link detects VLAN mapping (a Hello arrives on VLAN-x but was sent on VLAN-y), it MUST make or revoke appointments to ensure the same TRILL switch is Appointed Forwarder for both VLAN-x and VLAN-y, preventing potential forwarding loops.
It is RECOMMENDED that the E-L1CS FS-LSP method be used to distribute forwarder appointments and that all RBridges on a link advertise the appointments they would make if they were DRB. Hello-based appointments must be used only when legacy RBridges on the link do not support E-L1CS FS-LSPs.
Port-Shutdown messages SHOULD be sent with the highest priority (priority 7) and SHOULD NOT be marked drop-eligible. The default is two copies separated by 20 milliseconds, configurable to 1–3 copies and 0–1,000 ms delay.
The DRB inhibition timer and root bridge change inhibition timer MUST be implemented. At least two VLAN inhibition timers MUST be implemented. Per-VLAN inhibition timers SHOULD be logically implemented for each VLAN offering end-station service. An RBridge MUST NOT merge VLAN inhibition timers for two VLANs if it is Appointed Forwarder for one but not the other.
The DRB SHOULD NOT appoint an RBridge that is in link-state overload as an Appointed Forwarder. If an Appointed Forwarder becomes overloaded and a non-overloaded RBridge is available on the link, the DRB SHOULD reassign VLANs to that non-overloaded RBridge.
When a TRILL switch detects a change in the common spanning tree root bridge on a port, it MUST set its root bridge change inhibition timer to a value defaulting to 30 seconds, configurable down to 0 seconds. This inhibition is safe to reduce to the bridged LAN settling time (e.g., 7 seconds for RSTP).
When the DRB sends any appointments in a TRILL Hello, it MUST send all appointments for that link in that Hello; any previous Hello appointment not included is implicitly revoked. Unnecessary changes in Appointed Forwarders SHOULD NOT be made.
Each RBridge maintains two appointment databases: (1) the E-L1CS LSDB, which is semi-permanent and changed only by E-L1CS FS-LSPs or IS-IS purges, and (2) the Hello appointment database, which is transient and completely reset by each Hello from the DRB containing appointments. An RBridge considers itself Appointed Forwarder for VLAN-x if indicated by either database.
The Appointed Forwarder on a link for VLAN-x is the TRILL switch (RBridge) that ingresses native frames from and egresses native frames to the link in VLAN-x. By default, the DRB is in charge of native traffic for all VLANs on the link and may appoint other TRILL switches as Appointed Forwarders. Appointed Forwarder status and inhibition only affect native frames, not TRILL Data or IS-IS frames.
IANA assigned four new APPsub-TLV type codes in the 'TRILL APPsub-TLV Types under IS-IS TLV 251 Application Identifier 1' registry: type 17 (AppointmentBitmap), type 18 (AppointmentList), type 19 (FGL-VLAN-Bitmap), and type 20 (FGL-VLAN-Pairs). A new RBridge Channel Protocol number 0x006 (Port-Shutdown) was also registered.
E-L1CS FS-LSPs are IS-IS PDUs and are securable by adding Authentication TLVs (RFC 5310) in the same manner as TRILL Hellos or other IS-IS PDUs. This document does not change the base TRILL security model described in RFC 6325 Section 6.
Port-Shutdown messages SHOULD be secured using the RBridge Channel Header Extension security feature (RFC 7978). If inadequately secured, they present a potential denial-of-service vector, as a rogue actor could falsely signal port failures and disrupt Appointed Forwarder assignments.
On becoming DRB, a TRILL switch sets its DRB inhibition timer to its port Holding Time; on losing DRB status, it sets the timer to expired. When receiving a Hello asserting Appointed Forwarder status on VLAN-x, the VLAN-x inhibition timer is set to the maximum of its current value and the received Holding Time. On enabling VLAN-x for the first time on a link, the VLAN-x inhibition timer is set to the port's Holding Time.
The AppointmentBitmap APPsub-TLV (type 17) encodes scattered VLAN appointments over a compact range: 2-byte Appointee Nickname, 4-bit RESV, 12-bit Starting VLAN ID, and a variable-length Bit Map where each bit represents the VLAN at Starting VLAN ID + N. Length field = 4 + bitmap size in bytes.
The AppointmentList APPsub-TLV (type 18) encodes a list of individual VLAN appointments: 2-byte Appointee Nickname followed by k entries of 2 bytes each (4-bit RESV + 12-bit VLAN ID). Length = 2 + 2*k; corrupt (odd Length) APPsub-TLVs MUST be ignored.
The FGL-VLAN-Bitmap APPsub-TLV (type 19) maps FGLs to VLANs using 4-bit RESV, 12-bit Starting VLAN ID, 3-byte Starting FGL, and a variable Bit Map where bit N represents (Starting VLAN ID + N) ↔ (Starting FGL + N). Length = 5 + bitmap size; corrupt (Length < 5) APPsub-TLVs MUST be ignored.
The FGL-VLAN-Pairs APPsub-TLV (type 20) encodes an explicit list of FGL-to-VLAN mappings as k Mapping RECORDs of 5 bytes each: 4-bit RESV, 12-bit VLAN ID, 3-byte FGL. Length = 5*k; APPsub-TLVs with Length not a multiple of 5 are corrupt and MUST be ignored.
The Port-Shutdown message is an RBridge Channel message (protocol number 0x006) whose payload consists of a list of 2-byte Port IDs for ports that have failed or are shutting down. It uses priority 7, VLAN tag with Ethertype 0x8100 on the Designated VLAN, and the All-Egress-RBridges Inner.MacDA.