Path Computation Element Communication Protocol (PCEP) Extensions for Stateful PCE
updated by
- rfc-8786 — Updated Rules for Processing Stateful PCE Request Parameters Flags
- rfc-9353 — IGP Extension for Path Computation Element Communication Protocol (PCEP) Security Capability Support in PCE Discovery (PCED)
- rfc-9753 — Extension for Stateful PCE to Allow Optional Processing of Path Computation Element Communication Protocol (PCEP) Objects
- rfc-9756 — Update to the IANA Path Communication Element Protocol (PCEP) Numbers Registration Procedures and the Allowance of Experimental Error Codes
- rfc-9862 — Path Computation Element Communication Protocol (PCEP) Extensions for Segment Routing (SR) Policy Candidate Paths
Extracted elements (31)
A stateful PCE requires global visibility of LSP state and ordered control of path reservations across devices — capabilities unavailable in stateless PCEP. TE algorithms effective at scale uniformly require both properties, justifying the complexity and control-plane overhead of stateful synchronization.
LSP state ownership is retained by the PCC even when an LSP is delegated to an active stateful PCE. This allows simultaneous interaction with stateless and stateful PCEs, operator override via CLI, and graceful reversion to operator-defined defaults upon PCE disconnection or delegation revocation.
Using PCEP for LSP updates rather than configuration tools (CLI, NETCONF) provides better scale and performance (lightweight operations), security (limited LSP-attribute scope vs. full device control), interoperability (common information model across vendors), and efficient bidirectional state synchronization.
Active and passive stateful PCE capabilities MAY be advertised via IGP (bits 11 and 12 of PCE-CAP-FLAGS), but PCEP speakers MUST negotiate stateful PCEP capabilities during PCEP session setup regardless of IGP advertisements. A PCC MAY initiate stateful negotiation even without IGP discovery.
A PCC MUST NOT send a path computation request for a delegated LSP; it MUST first perform the Delegation Revocation procedure before sending a PCReq for that LSP. The PCRpt message MUST NOT be used to request a path from the PCE.
A PCC MUST send each LSP State Report to each stateful PCE connected to it. Once an LSP is up, the PCC MUST send a PCRpt indicating status 'Up'; if the LSP cannot be set up, the PCC MUST send a PCRpt indicating 'Down' with the failure cause.
A permanent PCEP session MUST be established between a stateful PCE and a PCC. In case of session failure, re-establishment MUST be re-attempted per RFC 5440 procedures including backoff timers.
Each LSP Update Request in PCUpd MUST contain all LSP parameters the PCE wishes to set. PCErr and PCRpt messages triggered by a PCUpd MUST include the SRP-ID-number from the triggering PCUpd for correlation. PCRpt messages MUST NOT be pruned from the PCC's egress queue.
If a PCE implements a resource limit per PCC, it MUST send a PCNtf with Notification Type 4, Value 1 (Stateful PCE resource limit exceeded) upon exceeding the limit and MUST terminate the session.
If a PCEP session is UP when a PCC revokes delegation, the PCC MUST notify the PCE by sending an LSP State Report with the Delegate flag set to 0. After revocation, an attempt by the PCE to update a non-delegated LSP results in PCErr Error-type=19, error-value=1.
LSP delegation and LSP Update operations may only be used if both PCEP speakers set the LSP-UPDATE-CAPABILITY flag (U flag=1) in the STATEFUL-PCE-CAPABILITY TLV. Violations MUST generate PCErr Error-type=19, error-value=1.
PCEP extensions for stateful PCEs MUST NOT be used if one or both PCEP speakers have not included the STATEFUL-PCE-CAPABILITY TLV in their OPEN message. A PCC that receives a PCUpd without having advertised the capability MUST generate PCErr Error-type=19, error-value=2, and SHOULD terminate the session.
The end of State Synchronization is marked by a PCRpt with the SYNC flag set to 0 for an LSP object with PLSP-ID equal to the reserved value 0. The PCRpt MUST include an empty ERO as its intended path.
The LSP-IDENTIFIERS TLV MUST be included in the LSP object in PCRpt messages for RSVP-signaled LSPs. If missing, the PCE generates Error-type=6, error-value=11 and closes the session.
The State Timeout Interval MUST be greater than or equal to the Redelegation Timeout Interval. Upon expiration without successful redelegation, the PCC MUST flush any LSP state set by the PCE and revert to operator-defined defaults, done in a make-before-break fashion.
When a PCC's PCEP session with a PCE terminates unexpectedly, the PCC MUST wait the Redelegation Timeout Interval before revoking LSP delegations and attempting redelegation to an alternate PCE. If the session is re-established before the timer expires, delegations remain intact.
PCRpt (Path Computation LSP State Report) message: Message-Type=10, sent by PCC to PCE. Carries one or more state-report elements each containing an optional SRP object, a required LSP object, and a required ERO (intended path), plus optional RRO (actual path) and attribute lists.
PCUpd (Path Computation LSP Update Request) message: Message-Type=11, sent by PCE to PCC. Each update-request MUST include SRP, LSP, and ERO objects. A single PCUpd may contain multiple update requests; the ERO may be empty when the PCE cannot find a valid path.
IGP PCE Capability Flags: This document defines Bit 11 (Active stateful PCE capability) and Bit 12 (Passive stateful PCE capability) in the PCE-CAP-FLAGS sub-TLV used in OSPF and IS-IS PCE Discovery advertisements per RFC 5088/5089.
This document creates or updates multiple IANA registries: PCEP Messages (PCRpt=10, PCUpd=11), PCEP Objects (LSP Object-Class=32, SRP Object-Class=33), STATEFUL-PCE-CAPABILITY TLV Flags (U bit), LSP Object flags (D, S, R, A, O), PCEP-Error Object values (Error-type 19 and 20), and PCEP TLV Type Indicators (types 16-19).
A malicious PCC can send false LSP State Reports to a PCE, corrupting the PCE's view of network state and causing incorrect path computations for other LSPs that share the same PCE. PCEP session authentication is the primary mitigation.
A malicious PCE with delegated LSP control can reroute traffic, cause denial of service, or enable traffic interception by modifying LSP paths. The security of the stateful PCEP session is therefore critical; TCP-MD5, TCP-AO, or TLS SHOULD be used to authenticate PCEP peers.
LSP State Snooping: a passive eavesdropper on a PCEP session can learn the full LSP topology of the network, enabling traffic analysis or targeted attacks. Encryption of the PCEP session mitigates this threat.
LSP delegation lifecycle: PCC delegates by setting D=1 in PCRpt; PCE accepts by setting D=1 in subsequent PCUpd, or rejects by responding with D=0. PCC revokes by sending PCRpt with D=0; PCE returns by sending PCUpd with D=0. An LSP remains delegated only while each successive PCRpt and PCUpd carries D=1.
LSP Operational status is encoded in the 3-bit O field of the LSP object: 0=DOWN (not active), 1=UP (signaled), 2=ACTIVE (up and carrying traffic), 3=GOING-DOWN (being torn down), 4=GOING-UP (being signaled). Values 5-7 are reserved.
State Synchronization phase begins immediately after PCEP session initialization. PCC sends PCRpt messages with SYNC=1 for each LSP snapshot. Synchronization ends with a PCRpt having SYNC=0 and PLSP-ID=0. PCE MUST NOT send PCUpd, and PCC MUST NOT send PCReq, until synchronization completes.
IPV4-LSP-IDENTIFIERS TLV: Type=18, Length=16 (fixed). Contains IPv4 Tunnel Sender Address (32-bit), LSP ID (16-bit), Tunnel ID (16-bit), Extended Tunnel ID (32-bit), and IPv4 Tunnel Endpoint Address (32-bit) mirroring RSVP-TE LSP_TUNNEL_IPv4 objects.
IPV6-LSP-IDENTIFIERS TLV: Type=19, Length=52 (fixed). Contains IPv6 Tunnel Sender Address (16 octets), LSP ID (16-bit), Tunnel ID (16-bit), Extended Tunnel ID (16 octets), and IPv6 Tunnel Endpoint Address (16 octets).
LSP Object: Object-Class=32, Object-Type=1. Body contains a 20-bit PLSP-ID, a 12-bit Flags field (D=Delegate, S=SYNC, R=Remove, A=Administrative, O=Operational 3-bit), followed by optional TLVs. The PLSP-ID is constant for the lifetime of the PCEP session.
SRP Object: Object-Class=33, Object-Type=1. Body contains a 32-bit Flags field (none defined) followed by a 32-bit SRP-ID-number uniquely identifying the PCE operation per PCEP session. Reserved values: 0x00000000 and 0xFFFFFFFF.
STATEFUL-PCE-CAPABILITY TLV: Type=16 (16-bit), Length=4 (16-bit fixed), Value=32-bit Flags field with U bit (LSP-UPDATE-CAPABILITY) at the least-significant position. U=1 indicates support for LSP parameter updates; U=0 indicates passive stateful PCE mode.