Restart Signaling for IS-IS
obsoletes
- rfc-5306 — Restart Signaling for IS-IS
Extracted elements (29)
On a LAN interface, the restarting router SHOULD use the same LAN-ID as before the restart. If it was previously DIS and uses a different LAN-ID, new pseudonode LSPs must be generated and all neighboring routers must update their LSPs, causing unnecessary churn. Preserving LAN-ID prevents this. The LAN-ID in an IIH with RR set MUST be ignored by the receiver to allow this.
The SA bit allows a starting router to suppress adjacency advertisements by neighbors until it has propagated newer LSPs from its previous incarnation. Without this, stale LSPs with apparently higher sequence numbers can persist, causing temporary blackholes.
Timer T3 is initialized to 65535 seconds and then set to the minimum remaining Holding Time of neighbors that have acknowledged the restart (RA set with UP adjacency). This allows the restarting router to avoid flooding its LSPs prematurely while bounding the restart window to the neighbors' actual adjacency lifetimes.
A router that does not support restart capability will ignore the Restart TLV and reinitialize the adjacency normally, returning an IIH without the Restart TLV. On a P2P circuit, receipt of such an IIH is treated as an implicit acknowledgement. On a LAN, synchronization can still succeed if at least one neighbor is restart-capable.
RFC 5306 permitted omitting the Restarting Neighbor System ID from the Restart TLV when RA is set, allowing legacy implementations on LANs to have their RA accepted. RFC 8706 makes this an implementation choice; omission is only ambiguous when multiple systems on a LAN restart simultaneously.
A router operating at both Level 1 and Level 2 on an interface MUST perform restart operations for each level independently, including sending/receiving both Level 1 and Level 2 IIHs and performing CSNP synchronizations independently per level.
A router that supports any of the functionality defined in this document MUST include the Restart TLV in all transmitted IIHs. Absence of the TLV indicates the sender supports none of the defined functionality.
A router that suppresses an adjacency due to SA bit MUST NOT use that adjacency when performing its SPF calculation. In particular, the suppressed adjacency MUST NOT be pre-loaded into TENT.
A starting router MUST transmit its own zeroth LSP with the overload bit set as soon as each adjacency is established, before any CSNP exchanges, preventing other routers from computing routes through it until LSPDB synchronization is complete. When all T2 timers are canceled, the starting router MUST transmit IIHs with the SA bit clear.
All flag combinations in the Restart TLV where multiple flags are set are invalid except the combination of RR and SA as described in Section 3.3.2. Such invalid combinations MUST NOT be transmitted; received TLVs with invalid flag combinations MUST be ignored.
During restart, inter-level redistribution MUST be regenerated before the router's LSP is flooded. Level-n non-pseudonode LSPs MUST NOT be flooded until the other level's T2 timer has expired and its SPF has been run, ensuring inter-level information can be included.
If timer T3 expires before all T2 timers complete, the router MUST flood its own LSPs with the overload bit set, resume normal update operation, update local forwarding tables, and transmit normal-Holding-Time IIHs without RR or RA set to prevent neighbor adjacencies from expiring.
Neighbors of a router that has signaled planned restart SHOULD maintain the adjacency in Planned Restart State until they receive an IIH with RR set, an IIH with both PR and RR clear, or the adjacency Holding Time expires. The Holding Time SHOULD be set to the Remaining Time specified in the received PR IIH.
On a LAN circuit, if the router in Planned Restart State is the DIS at any supported level, the adjacency or adjacencies SHOULD be brought down whenever any LSP update is either generated or received, so as to trigger a new DIS election and preserve update process reliability.
On a Point-to-Point circuit, if a non-restart-capable neighbor is detected (IIH without Restart TLV received) and the three-way adjacency state is UP with matching Extended Local Circuit ID, the restarting router MUST force adjacency reinitialization by setting local Adjacency Three-Way State to DOWN and sending a normal IIH to guarantee SRMflag setting.
Signaling a planned restart (PR bit) in the absence of maintained forwarding-plane state is likely to lead to significant traffic loss and MUST NOT be done.
When a router receives an IIH with the SA bit set and has an existing UP adjacency to that system, it MUST suppress advertisement of the adjacency to the neighbor in its own LSPs. Suppression MUST continue until an IIH with SA clear is received. A new adjacency transitioning to UP MUST NOT be advertised until SA is cleared.
Database synchronization completion is determined by tracking LSPIDs from the first complete CSNP set received over each interface. Entries are removed as LSPs arrive or their remaining lifetime expires. Timer T2 is canceled when the LSPID list is empty and T1 is canceled on all interfaces with adjacencies at that level.
Three timers support restart signaling: T1 (per-interface, ~3s) tracks unacknowledged (re)start retransmissions; T2 (per LSPDB, ~60s) bounds the maximum wait for LSP database synchronization; T3 (system-wide, initialized to 65535s) is used only by restarting routers and tracks time before declaring synchronization failure by setting the overload bit.
When a neighbor receives an IIH with RR set and has an existing UP adjacency to that system, it: (a) preserves adjacency state and marks it 'Restart mode' on first receipt; (b) immediately transmits an IIH with RA set and Remaining Time set to the actual remaining holding time; (c) if on P2P or highest-priority router on LAN, sends a complete CSNP set and sets SRMflags for all LSPs.
This document defines and claims ownership of IS-IS TLV Type 211 ('Restart TLV') in the 'IS-IS TLV Codepoints' registry, valid in IIH PDUs only (IIH=y, LSP=n, SNP=n, Purge=n).
A false IIH with the PR bit set can cause a neighbor to modify its adjacency Holding Time and suppress topology update flooding in the false belief that the router's forwarding plane is not processing changes, resulting in unnecessary forwarding disruption.
A false IIH with the RR bit set causes neighbors to maintain an existing UP adjacency and potentially retransmit a complete CSNP set. The CSNP retransmission is wasteful but does not disrupt correct protocol operation.
A false IIH with the SA bit set can suppress advertisement of an IS neighbor indefinitely or intermittently, potentially causing loss of reachability to destinations and/or increased frequency of LSP flooding and SPF computation.
IS-IS PDU spoofing threats to restart signaling can be mitigated by IS-IS authentication (RFC 1195, ISO 10589), especially cryptographic authentication (RFC 5304, RFC 5310). No new attack surface beyond the ability to inject a false but valid-appearing IIH has been introduced.
Restarting Router state table: states are Restarting, ADJ-Seen-RA, ADJ-Seen-CSNP, and SPF-Wait. Key transitions: restart event sends IIH/RR and starts T1/T2/T3; RX RA adjusts T3 and advances to ADJ-Seen-RA; RX CSNP-set advances to ADJ-Seen-CSNP; T3 expiry sets overload bit; LSP-DB-Sync cancels T2/T3 and triggers SPF; All-SPF-done clears overload bit, updates forwarding, and transitions to Running.
Running Router state table: states are Running and ADJ-suppressed. Events include RX PR (set Planned Restart State, send PA), RX RR (maintain adjacency state, send RA, set SRM/send CSNP, set Restart Mode), RX SA (suppress IS neighbor TLV, goto ADJ-suppressed), and RX SA-clear (unsuppress TLV, return to Running).
Starting Router state table: states are Starting, ADJ-Seen-RA, and ADJ-Seen-CSNP. Key transitions: router starts sends IIH/SA and starts T1/T2; ADJ-UP starts T1 and sends local LSPs with overload bit; T2 expiry clears overload bit, sends normal IIH, and transitions to Running; LSP-DB-Sync cancels T2 and clears overload bit.
The Restart TLV (Type 211, length 1 to 3+ID Length octets) carries a 1-octet Flags field (bits: RR, RA, SA, PR, PA, Reserved), a 2-octet Remaining Time field (in seconds), and an optional Restarting Neighbor System ID field (ID Length octets). It is carried in IIH PDUs only.