Graceful BGP Session Shutdown
Extracted elements (20)
IGP distance poisoning of the BGP NEXT_HOP was rejected because it also requires equal LOCAL_PREF, AS Path, and MED on alternate paths, and cannot be applied at all when BGP NEXT_HOP self is used.
MED tweaking was rejected as an alternative because it only influences the neighboring AS when alternate paths are equal in LOCAL_PREF and AS Path Length; it has no effect when those attributes differ.
The document addresses only the first cause of packet loss upon EBGP session shutdown (hidden alternate paths), not the second (FIB inconsistency causing loops), because the latter requires encapsulation within the AS and is out of scope.
The procedure retains paths to be shut down but with a lowered LOCAL_PREF, rather than withdrawing them, so that alternate paths can be selected and propagated before the session goes down. This ensures routers always have a valid route available during the convergence process.
Packet loss during convergence can occur when RFC 7911 (Advertisement of Multiple Paths in BGP) is not used and alternate paths are hidden by ASBRs or Route Reflectors that do not select them as best.
Shutdown of an IBGP session does not lead to transient unreachability provided the IBGP topology remains viable post-maintenance, so no specific graceful shutdown action is required for IBGP sessions.
The graceful shutdown procedure optionally uses RFC 8203 to communicate the reason for the session shutdown when the EBGP session is finally torn down.
The graceful shutdown procedures apply only where the forwarding plane is impacted by the maintenance, explicitly excluding cases where BGP Graceful Restart applies.
Use of RFC 7911 (Add-Paths) or BEST-EXTERNAL advertisement among Route Reflectors in an IBGP full mesh can prevent transient unreachability during EBGP session establishment by ensuring new path advertisements do not trigger withdrawal of previously advertised paths.
BGP implementers SHOULD provide configuration knobs that utilize the GRACEFUL_SHUTDOWN community to inform BGP neighbors in preparation for an impending neighbor shutdown.
If the ISP does not tolerate a neighbor abusing the graceful shutdown community for inbound traffic engineering, it SHOULD monitor the use of the graceful shutdown community.
On each ASBR supporting the graceful shutdown receiver procedure, an inbound BGP route policy MUST be applied on all EBGP sessions that matches the GRACEFUL_SHUTDOWN community and sets LOCAL_PREF to a low value.
The LOCAL_PREF value set on paths tagged with the GRACEFUL_SHUTDOWN community SHOULD be lower than any of the alternative paths. The RECOMMENDED value is 0.
A BGP speaker MAY avoid transient packet loss during EBGP session establishment by ensuring third-party NEXT_HOPs are resolved (MAC addresses obtained) before installing paths using those NEXT_HOPs in the RIB.
At maintenance time, the graceful shutdown initiator applies an outbound BGP route policy tagging all active advertised paths with GRACEFUL_SHUTDOWN, triggers re-advertisement, applies an inbound policy setting LOCAL_PREF low, waits for convergence on both ASBRs, then shuts the session.
For a full router shutdown, routes originated by the router (BGP aggregates, redistributed routes, static routes) must also be tagged with GRACEFUL_SHUTDOWN and set to a low LOCAL_PREF, in addition to gracefully shutting down all EBGP sessions.
GRACEFUL_SHUTDOWN is a well-known BGP community with value 0xFFFF0000 (65535:0), used to signal that paths advertised over a BGP session are about to be shut down for planned maintenance. It allows automated graceful shutdown without router reconfiguration at maintenance time.
IANA updated the 'BGP Well-known Communities' registry: the community value 0xFFFF0000, previously named 'planned-shut', was renamed to 'GRACEFUL_SHUTDOWN' with reference updated to RFC 8326.
By honoring the GRACEFUL_SHUTDOWN community, an ISP gives its neighbor (and potentially downstream ASes) the ability to lower the LOCAL_PREF of received paths. A malicious or misconfigured neighbor could abuse this for inbound traffic engineering by falsely declaring prefixes under maintenance.
The graceful shutdown procedure has two phases: (1) pre-configuration, where receivers install an inbound policy setting LOW LOCAL_PREF for paths tagged with GRACEFUL_SHUTDOWN; and (2) maintenance time, where the initiator tags outbound and inbound paths with GRACEFUL_SHUTDOWN and LOW LOCAL_PREF, waits for convergence, then shuts the session.