Micro-loop Prevention by Introducing a Local Convergence Delay
Extracted elements (24)
By limiting the ordered convergence to one hop (unlike oFIB which covers the full network), the mechanism requires no interoperability and preserves normal network-wide convergence behavior, at the cost of only eliminating local transient forwarding loops.
Simulations across eight different service-provider topologies showed the local delay mechanism eliminated 50–81% of all transient forwarding loops (both local and remote); all local loops are prevented and only remote loops remain.
The mechanism does not protect link-up events; when a link goes back up, the operator must use other procedures (e.g., perform the action outside business hours or use incremental metric changes as in RFC 5715) to avoid transient forwarding loops during reconvergence.
The mechanism is deliberately limited to local link-down events in order to keep it simple. Limiting scope to a single-hop convergence delay makes the feature router-local and removes any need for network-wide interoperability.
Transient forwarding loops can congest links serving unrelated traffic because routers cannot distinguish looping packets from normally forwarded packets; class-of-service may mitigate but cannot fully prevent collateral congestion.
Transient forwarding loops negate FRR benefits: when the PLR converges and replaces its FRR path before neighbors converge, a micro-loop forms that drops traffic FRR was protecting. Delaying FIB updates on the failure-adjacent node allows the FRR path to remain active until neighbors have converged.
ULOOP_DELAY_DOWN_TIMER should be set to the maximum IGP convergence time observed in the network (typically the slowest node), so that the delay is sufficient to allow all neighbors to converge before the local node updates its FIB.
Compared to oFIB (RFC 6976), the local delay mechanism limits ordered convergence to the first hop adjacent to the failure instead of computing per-node timers across the entire network. This sacrifices solving remote loops but eliminates complexity and network-wide coordination overhead.
Compared to PLSN, the local delay mechanism is simpler: PLSN has three possible behaviors (keep old next-hop, use new safe next-hop, use another safe next-hop) and applies to all nodes, while the local delay has exactly one behavior (keep current next-hop or active FRR path) and applies only to nodes adjacent to the failure.
The mechanism is entirely router-local and requires no interoperability with neighboring routers. It can be incrementally deployed with incremental benefit, unlike oFIB which requires network-wide coordination.
This mechanism only eliminates forwarding loops on links between the failure-adjacent node and its direct neighbors; remote loops further in the network may still occur and require other solutions.
An implementation SHOULD implement logic to correlate the protocol messages (LSP/LSA) received during the SPF scheduling period in order to determine the topology changes that occurred, since multiple messages may describe the same change and a single message may describe multiple changes.
Determining a particular topology change MUST be independent of the order of reception of protocol messages, because multiple LSP/LSA messages may describe the same topology change.
If a new convergence event occurs while ULOOP_DELAY_DOWN_TIMER is running, the timer MUST be stopped and the RIB/FIB SHOULD be updated as part of the new convergence event without further delay.
If an implementation determines that the topology change is a single local link failure, the router MAY use the local delay mechanism; otherwise, regular IP convergence MUST be used.
If the single local link-down condition has not been met, the RIB and FIB SHOULD be updated immediately following SPF computation.
The local delay SHOULD only be applied for non-urgent convergence, such as administrative deactivation (maintenance) or when traffic is protected by FRR, because delaying local convergence increases the window of reduced routing efficiency.
Upon SPF completion, if the condition of a single local link-down event has been met, an update of the RIB and FIB MUST be delayed for ULOOP_DELAY_DOWN_TIMER milliseconds.
LSP_GEN_TIMER is an existing IGP timer defining the delay between consecutive generation of local LSPs/LSAs; it batches multiple local events into a single update. In IS-IS this is minimumLSPGenerationInterval; in OSPFv2 it is MinLSInterval.
SPF_DELAY is an existing timer defining the delay between the first IGP event triggering a routing table computation and the start of that computation; it is often associated with a damping mechanism that increases the timer during instability.
ULOOP_DELAY_DOWN_TIMER is a new timer introduced by this document used to slow down local node convergence in case of link-down events. Its value should be set according to the maximum IGP convergence time observed in the network.
This document introduces no change in IGP security. The local delay does not increase attack vectors because an attacker can only trigger this mechanism if they already have the ability to disable or enable an IGP link, in which case they could already cause instability and traffic loss without this mechanism.
Regular IGP convergence involves five steps: (1) IGP notified of up/down event, (2) reaction postponed for LSP_GEN_TIMER ms, (3) upon expiry LSP/LSA is updated and flooded, (4) SPF scheduled with SPF_DELAY, (5) upon SPF_DELAY expiry SPF is computed and RIB/FIB updated.
The modified step 5 for link-down events: upon SPF_DELAY expiry, SPF is computed; if a single local link-down event is confirmed, RIB/FIB update is deferred by ULOOP_DELAY_DOWN_TIMER; if a new event arrives during the deferral, the timer is cancelled and normal convergence resumes.