--- 1/draft-ietf-bfd-seamless-base-02.txt 2014-08-23 08:14:31.224445834 -0700 +++ 2/draft-ietf-bfd-seamless-base-03.txt 2014-08-23 08:14:31.264446813 -0700 @@ -1,23 +1,23 @@ Internet Engineering Task Force N. Akiya Internet-Draft C. Pignataro Updates: 5880 (if approved) D. Ward Intended status: Standards Track Cisco Systems -Expires: February 2, 2015 M. Bhatia +Expires: February 24, 2015 M. Bhatia Ionos Networks - P. K. Santosh + S. Pallagatti Juniper Networks - August 1, 2014 + August 23, 2014 Seamless Bidirectional Forwarding Detection (S-BFD) - draft-ietf-bfd-seamless-base-02 + draft-ietf-bfd-seamless-base-03 Abstract This document defines a simplified mechanism to use Bidirectional Forwarding Detection (BFD) with large portions of negotiation aspects eliminated, thus providing benefits such as quick provisioning as well as improved control and flexibility to network nodes initiating the path monitoring. This document updates RFC5880. @@ -36,21 +36,21 @@ Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on February 2, 2015. + This Internet-Draft will expire on February 24, 2015. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -59,50 +59,50 @@ include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Seamless BFD Overview . . . . . . . . . . . . . . . . . . . . 4 4. S-BFD Discriminators . . . . . . . . . . . . . . . . . . . . 5 - 4.1. Discriminator Pools . . . . . . . . . . . . . . . . . . . 5 - 4.2. S-BFD Discriminator Uniqueness . . . . . . . . . . . . . 6 + 4.1. S-BFD Discriminator Uniqueness . . . . . . . . . . . . . 5 + 4.2. Discriminator Pools . . . . . . . . . . . . . . . . . . . 6 5. Reflector BFD Session . . . . . . . . . . . . . . . . . . . . 7 6. State Variables . . . . . . . . . . . . . . . . . . . . . . . 7 6.1. New State Variables . . . . . . . . . . . . . . . . . . . 7 6.2. State Variable Initialization and Maintenance . . . . . . 8 7. S-BFD Procedures . . . . . . . . . . . . . . . . . . . . . . 8 - 7.1. S-BFD Packet Demultiplexing . . . . . . . . . . . . . . . 8 + 7.1. S-BFD Control Packet Demultiplexing . . . . . . . . . . . 8 7.2. Initiator Procedures . . . . . . . . . . . . . . . . . . 8 7.2.1. SBFDInitiator State Machine . . . . . . . . . . . . . 9 - 7.2.2. Details of S-BFD Packet Sent by SBFDInitiator . . . . 10 + 7.2.2. Details of S-BFD Control Packet Sent by SBFDInitiator 10 7.3. Responder Procedures . . . . . . . . . . . . . . . . . . 10 - 7.3.1. Responder Demultiplexing . . . . . . . . . . . . . . 10 - 7.3.2. Details of S-BFD Packet Sent by SBFDReflector . . . . 11 + 7.3.1. Responder Demultiplexing . . . . . . . . . . . . . . 11 + 7.3.2. Details of S-BFD Control Packet Sent by SBFDReflector 11 7.4. Diagnostic Values . . . . . . . . . . . . . . . . . . . . 11 7.5. The Poll Sequence . . . . . . . . . . . . . . . . . . . . 11 - 7.6. Control Plane Independent (C) . . . . . . . . . . . . . . 11 + 7.6. Control Plane Independent (C) . . . . . . . . . . . . . . 12 7.7. Additional SBFDInitiator Behaviors . . . . . . . . . . . 12 7.8. Additional SBFDReflector Behaviors . . . . . . . . . . . 12 8. Scaling Aspect . . . . . . . . . . . . . . . . . . . . . . . 13 9. Co-existence with Classical BFD Sessions . . . . . . . . . . 13 10. S-BFD Echo Function . . . . . . . . . . . . . . . . . . . . . 13 11. Security Considerations . . . . . . . . . . . . . . . . . . . 14 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15 14. Contributing Authors . . . . . . . . . . . . . . . . . . . . 15 15. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 15.1. Normative References . . . . . . . . . . . . . . . . . . 16 15.2. Informative References . . . . . . . . . . . . . . . . . 16 - Appendix A. Loop Problem . . . . . . . . . . . . . . . . . . . . 16 + Appendix A. Loop Problem . . . . . . . . . . . . . . . . . . . . 17 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18 1. Introduction Bidirectional Forwarding Detection (BFD), [RFC5880] and related documents, has efficiently generalized the failure detection mechanism for multiple protocols and applications. There are some improvements which can be made to better fit existing technologies. There is a possibility of evolving BFD to better fit new technologies. This document focuses on several aspects of BFD in @@ -122,82 +122,87 @@ 2. Terminology The reader is expected to be familiar with the BFD, IP and MPLS terminologies and protocol constructs. This section describes several new terminologies introduced by S-BFD. o Classical BFD - BFD session types based on [RFC5880]. o S-BFD - Seamless BFD. - o S-BFD packet - a BFD control packet destined to or sourced from - the well-known S-BFD port. + o S-BFD control packet - a BFD control packet for the S-BFD + mechanism. + + o S-BFD echo packet - a BFD echo packet for the S-BFD mechanism. + + o S-BFD packet - a BFD control packet or a BFD echo packet. o Entity - a function on a network node that S-BFD mechanism allows remote network nodes to perform continuity test to. An entity can be abstract (ex: reachability) or specific (ex: IP addresses, router-IDs, functions). o SBFDInitiator - an S-BFD session on a network node that performs a continuity test to a remote entity by sending S-BFD packets. o SBFDReflector - an S-BFD session on a network node that listens - for incoming S-BFD packets to local entities and generates - response S-BFD packets. + for incoming S-BFD control packets to local entities and generates + response S-BFD control packets. o Reflector BFD session - synonymous with SBFDReflector. o S-BFD discriminator - a BFD discriminator allocated for a local entity and is being listened by an SBFDReflector. o BFD discriminator - a BFD discriminator allocated for an SBFDInitiator. o Initiator - a network node hosting an SBFDInitiator. o Responder - a network node hosting an SBFDReflector. Below figure describes the relationship between S-BFD terminologies. - +---------------------+ +---------------------+ + +---------------------+ +------------------------+ | Initiator | | Responder | | +-----------------+ | | +-----------------+ | - | | SBFDInitiator |--- S-BFD packet -->| SBFDReflector | | - | | +-------------+ | | | | +-------------+ | | + | | SBFDInitiator |---S-BFD ctrl pkt----->| SBFDReflector | | + | | +-------------+ |<--S-BFD ctrl pkt------| +-------------+ | | | | | BFD discrim | | | | | |S-BFD discrim| | | - | | +-------------+ |<-- S-BFD packet ---| +----------^--+ | | - | +-----------------+ | | +------------|----+ | + | | | | |---S-BFD echo pkt---+ | | | | | + | | +-------------+ | | | | | +----------^--+ | | + | +-----------------+<-------------------+ +------------|----+ | | | | | | | | | +---v----+ | | | | | Entity | | | | | +--------+ | - +---------------------+ +---------------------+ + +---------------------+ +------------------------+ Figure 1: S-BFD Terminology Relationship 3. Seamless BFD Overview An S-BFD module on each network node allocates one or more S-BFD discriminators for local entities, and creates a reflector BFD session. Allocated S-BFD discriminators may be advertised by applications (ex: OSPF/IS-IS). Required result is that applications, on other network nodes, possess the knowledge of the mapping from remote entities to S-BFD discriminators. The reflector BFD session - is to, upon receiving an S-BFD packet targeted to one of local S-BFD - discriminator values, transmit a response S-BFD packet back to the - initiator. + is to, upon receiving an S-BFD control packet targeted to one of + local S-BFD discriminator values, transmit a response S-BFD control + packet back to the initiator. Once above setup is complete, any network nodes, having the knowledge of the mapping from a remote entity to an S-BFD discriminator, can quickly perform a continuity test to the remote entity by simply - sending S-BFD packets with corresponding S-BFD discriminator value in - the "your discriminator" field. + sending S-BFD control packets with corresponding S-BFD discriminator + value in the "your discriminator" field. For example: <------- IS-IS Network -------> +---------+ | | A---------B---------C---------D ^ ^ | | @@ -207,34 +212,55 @@ 123 456 Figure 2: S-BFD for IS-IS Network The IS-IS with SystemID xxx (node A) allocates an S-BFD discriminator 123, and advertises the S-BFD discriminator 123 in an IS-IS TLV. The IS-IS with SystemID yyy (node D) allocates an S-BFD discriminator 456, and advertises the S-BFD discriminator 456 in an IS-IS TLV. A reflector BFD session is created on both network nodes (node A and node D). When network node A wants to check the reachability to - network node D, node A can send an S-BFD packet, destined to node D, - with "your discriminator" field set to 456. When the reflector BFD - session on node D receives this S-BFD packet, then response S-BFD - packet is sent back to node A, which allows node A to complete the - continuity test. + network node D, node A can send an S-BFD control packet, destined to + node D, with "your discriminator" field set to 456. When the + reflector BFD session on node D receives this S-BFD control packet, + then response S-BFD control packet is sent back to node A, which + allows node A to complete the continuity test. 4. S-BFD Discriminators -4.1. Discriminator Pools +4.1. S-BFD Discriminator Uniqueness - This document defines following suggestions for discriminator - management on SBFDInitiator and SBFDReflector sessions, to minimize - the collision between required S-BFD discriminators on a local - device. + One important characteristics of an S-BFD discriminator is that it + MUST be unique within an administrative domain. If multiple network + nodes allocated a same S-BFD discriminator value, then S-BFD control + packets falsely terminating on a wrong network node can result in a + reflector BFD session to generate a response back, due to "your + discriminator" matching. This is clearly not desirable. If only IP + based S-BFD is considered, then it is possible for the reflector BFD + session to require demultiplexing of incoming S-BFD control packets + with combination of destination IP address and "your discriminator". + Then S-BFD discriminator only has to be unique within a local node. + However, S-BFD is a generic mechanism defined to run on wide range of + environments: IP, MPLS, etc. For other transports like MPLS, because + of the need to use non-routable IP destination address, it is not + possible for reflector BFD session to demultiplex using IP + destination address. With PHP, there may not be any incoming label + stack to aid in demultiplexing either. Thus, S-BFD imposes a + requirement that S-BFD discriminators MUST be unique within an + administrative domain. + +4.2. Discriminator Pools + + This subsection describes a discriminator pool implementation + technique to minimize S-BFD discriminator collisions. The result + will allow an implementation to better satisfy the S-BFD + discriminator uniqueness requirement defined in Section 4.1. o SBFDInitiator is to allocate a discriminator from the BFD discriminator pool. If the system also supports classical BFD that runs on [RFC5880], then the BFD discriminator pool SHOULD be shared by SBFDInitiator sessions and classical BFD sessions. o SBFDReflector is to allocate a discriminator from the S-BFD discriminator pool. The S-BFD discriminator pool SHOULD be a separate pool than the BFD discriminator pool. @@ -253,125 +279,108 @@ Even when following the separate discriminator pool approach, collision is still possible between one S-BFD application to another S-BFD application, that may be using different values and algorithms to derive S-BFD discriminator values. If the two applications are using S-BFD for a same purpose (ex: network reachability), then the colliding S-BFD discriminator value can be shared. If the two applications are using S-BFD for a different purpose, then the collision must be addressed. How such collisions are addressed is outside the scope of this document. -4.2. S-BFD Discriminator Uniqueness - - One important characteristics of an S-BFD discriminator is that it - MUST be unique within an administrative domain. If multiple network - nodes allocated a same S-BFD discriminator value, then S-BFD packets - falsely terminating on a wrong network node can result in a reflector - BFD session to generate a response back, due to "your discriminator" - matching. This is clearly not desirable. If only IP based S-BFD is - considered, then it is possible for the reflector BFD session to - require demultiplexing of incoming S-BFD packets with combination of - destination IP address and "your discriminator". Then S-BFD - discriminator only has to be unique within a local node. However, - S-BFD is a generic mechanism defined to run on wide range of - environments: IP, MPLS, etc. For other transports like MPLS, because - of the need to use non-routable IP destination address, it is not - possible for reflector BFD session to demultiplex using IP - destination address. With PHP, there may not be any incoming label - stack to aid in demultiplexing either. Thus, S-BFD imposes a - requirement that S-BFD discriminators MUST be unique within an - administrative domain. - 5. Reflector BFD Session Each network node creates one or more reflector BFD sessions. This - reflector BFD session is a session which transmits S-BFD packets in - response to received S-BFD packets with "your discriminator" having - S-BFD discriminators allocated for local entities. Specifically, - this reflector BFD session is to have following characteristics: + reflector BFD session is a session which transmits S-BFD control + packets in response to received S-BFD control packets with "your + discriminator" having S-BFD discriminators allocated for local + entities. Specifically, this reflector BFD session is to have + following characteristics: o MUST NOT transmit any S-BFD packets based on local timer expiry. - o MUST transmit an S-BFD packet in response to a received S-BFD - packet having a valid S-BFD discriminator in the "your - discriminator" field, unless prohibited by local policies (ex: - administrative, security, rate-limiter, etc). + o MUST transmit an S-BFD control packet in response to a received + S-BFD control packet having a valid S-BFD discriminator in the + "your discriminator" field, unless prohibited by local policies + (ex: administrative, security, rate-limiter, etc). o MUST be capable of sending only two states: UP and ADMINDOWN. One reflector BFD session may be responsible for handling received - S-BFD packets targeted to all locally allocated S-BFD discriminators, - or few reflector BFD sessions may each be responsible for subset of - locally allocated S-BFD discriminators. This policy is a local - matter, and is outside the scope of this document. + S-BFD control packets targeted to all locally allocated S-BFD + discriminators, or few reflector BFD sessions may each be responsible + for subset of locally allocated S-BFD discriminators. This policy is + a local matter, and is outside the scope of this document. - Note that incoming S-BFD packets may be IPv4, IPv6 or MPLS based. - How such S-BFD packets reach an appropriate reflector BFD session is - also a local matter, and is outside the scope of this document. + Note that incoming S-BFD control packets may be IPv4, IPv6 or MPLS + based. How such S-BFD control packets reach an appropriate reflector + BFD session is also a local matter, and is outside the scope of this + document. 6. State Variables S-BFD introduces new state variables, and modifies the usage of existing ones. 6.1. New State Variables A new state variable is added to the base specification in support of S-BFD. - o bfd.SessionType: The type of this session. Allowable values are: + o bfd.SessionType: This is a variable introduced by + [I-D.ietf-bfd-multipoint] and describes the type of this session. + Allowable values for S-BFD sessions are: * SBFDInitiator - an S-BFD session on a network node that performs a continuity test to a target entity by sending S-BFD packets. * SBFDReflector - an S-BFD session on a network node that listens - for incoming S-BFD packets to local entities and generates - response S-BFD packets. + for incoming S-BFD control packets to local entities and + generates response S-BFD control packets. bfd.SessionType variable MUST be initialized to the appropriate type when an S-BFD session is created. 6.2. State Variable Initialization and Maintenance Some state variables defined in section 6.8.1 of the BFD base specification need to be initialized or manipulated differently depending on the session type. o bfd.DemandMode: This variable MUST be initialized to 1 for session type SBFDInitiator, and MUST be initialized to 0 for session type SBFDReflector. 7. S-BFD Procedures -7.1. S-BFD Packet Demultiplexing +7.1. S-BFD Control Packet Demultiplexing Received BFD control packet MUST first be demultiplexed with information from the lower layer (ex: destination UDP port, associated channel type). If the packet is determined to be for an SBFDReflector, then the packet MUST be looked up to locate a corresponding SBFDReflector session based on the value from the "your discriminator" field in the table describing S-BFD discriminators. If the packet is determined not to be for SBFDReflector, then the packet MUST be looked up to locate a corresponding SBFDInitiator session or classical BFD session based on the value from the "your discriminator" field in the table describing BFD discriminators. If the located session is a SBFDInitiator, then destination of the packet (i.e. destination IP address) SHOULD be validated to be for self. Details of the initial BFD control packet demultiplexing are described in relevant S-BFD data plane documents. 7.2. Initiator Procedures - S-BFD packets transmitted by an SBFDInitiator MUST set "your + S-BFD control packets transmitted by an SBFDInitiator MUST set "your discriminator" field to an S-BFD discriminator corresponding to the remote entity. Every SBFDInitiator MUST have a locally unique "my discriminator" allocated from the BFD discriminator pool. Below ASCII art describes high level concept of continuity test using S-BFD. R2 allocates XX as the S-BFD discriminator for its network reachability purpose, and advertises XX to neighbors. ASCII art shows R1 and R4 performing a continuity test to R2. @@ -383,40 +392,40 @@ |v | v R1 ==================== R2[*] ========= R3 ========= R4 | ^ |^ | | || | +-- md=60/yd=XX (ping) --+| | | +---- md=XX/yd=60 (pong) ---+ [*] Reflector BFD session on R2. === Links connecting network nodes. - --- S-BFD packet traversal. + --- S-BFD control packet traversal. Figure 3: S-BFD Continuity Test 7.2.1. SBFDInitiator State Machine An SBFDInitiator may be a persistent session on the initiator with a - timer for S-BFD packet transmissions (stateful SBFDInitiator). An - SBFDInitiator may also be a module, a script or a tool on the - initiator that transmits one or more S-BFD packets "when needed" - (stateless SBFDInitiator). For stateless SBFDInitiators, a complete - BFD state machine may not be applicable. For stateful - SBFDInitiators, the states and the state machine described in - [RFC5880] will not function due to SBFDReflector session only sending - UP and ADMINDOWN states (i.e. SBFDReflector session does not send - INIT state). The following diagram provides the RECOMMENDED state - machine for stateful SBFDInitiators. The notation on each arc - represents the state of the SBFDInitiator (as received in the State - field in the S-BFD packet) or indicates the expiration of the - Detection Timer. + timer for S-BFD control packet transmissions (stateful + SBFDInitiator). An SBFDInitiator may also be a module, a script or a + tool on the initiator that transmits one or more S-BFD control + packets "when needed" (stateless SBFDInitiator). For stateless + SBFDInitiators, a complete BFD state machine may not be applicable. + For stateful SBFDInitiators, the states and the state machine + described in [RFC5880] will not function due to SBFDReflector session + only sending UP and ADMINDOWN states (i.e. SBFDReflector session + does not send INIT state). The following diagram provides the + RECOMMENDED state machine for stateful SBFDInitiators. The notation + on each arc represents the state of the SBFDInitiator (as received in + the State field in the S-BFD control packet) or indicates the + expiration of the Detection Timer. +--+ ADMIN DOWN, | | TIMER | V +------+ UP +------+ | |-------------------->| |----+ | DOWN | | UP | | UP | |<--------------------| |<---+ +------+ ADMIN DOWN, +------+ TIMER @@ -424,59 +433,62 @@ Figure 4: SBFDInitiator FSM Note that the above state machine is different from the base BFD specification[RFC5880]. This is because the INIT state is no longer applicable for the SBFDInitiator. Another important difference is the transition of the state machine from the DOWN state to the UP state when a packet with State UP is received by the SBFDInitiator. The definitions of the states and the events have the same meaning as in the base BFD specification [RFC5880]. -7.2.2. Details of S-BFD Packet Sent by SBFDInitiator +7.2.2. Details of S-BFD Control Packet Sent by SBFDInitiator - S-BFD packets sent by an SBFDInitiator is to have following contents: + S-BFD control packets sent by an SBFDInitiator is to have following + contents: o "my discriminator" assigned by local node. o "your discriminator" corresponding to a remote entity. o "State" MUST be set to a value describing local state. o "Desired Min TX Interval" MUST be set to a value describing local desired minimum transmit interval. o "Required Min RX Interval" MUST be zero. o "Required Min Echo RX Interval" SHOULD be zero. o "Detection Multiplier" MUST be set to a value describing locally used multiplier value. o Demand (D) bit MUST be set. 7.3. Responder Procedures - A network node which receives S-BFD packets transmitted by an + A network node which receives S-BFD control packets transmitted by an initiator is referred as responder. The responder, upon reception of - S-BFD packets, is to perform necessary relevant validations described - in [RFC5880], [RFC5881], [RFC5883], [RFC5884] and [RFC5885]. + S-BFD control packets, is to perform necessary relevant validations + described in [RFC5880], [RFC5881], [RFC5883], [RFC5884] and + [RFC5885]. 7.3.1. Responder Demultiplexing - When a responder receives an S-BFD packet, if the value in the "your - discriminator" field is not one of S-BFD discriminators allocated for - local entities, then this packet MUST NOT be considered for this - mechanism. If the value in the "your discriminator" field is one of - S-BFD discriminators allocated for local entities, then the packet is - determined to be handled by a reflector BFD session responsible for - the S-BFD discriminator. If the packet was determined to be - processed further for this mechanism, then chosen reflector BFD - session is to transmit a response BFD control packet using procedures - described in Section 7.3.2, unless prohibited by local policies (ex: - administrative, security, rate-limiter, etc). + When a responder receives an S-BFD control packet, if the value in + the "your discriminator" field is not one of S-BFD discriminators + allocated for local entities, then this packet MUST NOT be considered + for this mechanism. If the value in the "your discriminator" field + is one of S-BFD discriminators allocated for local entities, then the + packet is determined to be handled by a reflector BFD session + responsible for the S-BFD discriminator. If the packet was + determined to be processed further for this mechanism, then chosen + reflector BFD session is to transmit a response BFD control packet + using procedures described in Section 7.3.2, unless prohibited by + local policies (ex: administrative, security, rate-limiter, etc). -7.3.2. Details of S-BFD Packet Sent by SBFDReflector +7.3.2. Details of S-BFD Control Packet Sent by SBFDReflector - S-BFD packets sent by an SBFDReflector is to have following contents: + S-BFD control packets sent by an SBFDReflector is to have following + contents: o "my discriminator" MUST be copied from received "your discriminator". o "your discriminator" MUST be copied from received "my discriminator". o "State" MUST be UP or ADMINDOWN. Clarification of reflector BFD session state is described in Section 7.8. o "Desired Min TX Interval" MUST be copied from received "Desired Min TX Interval". o "Required Min RX Interval" MUST be set to a value describing how @@ -490,87 +502,89 @@ 7.4. Diagnostic Values Diagnostic value in both directions MAY be set to a certain value, to attempt to communicate further information to both ends. However, details of such are outside the scope of this specification. 7.5. The Poll Sequence Poll sequence MAY be used in both directions. The Poll sequence MUST operate in accordance with [RFC5880]. An SBFDReflector MAY use the - Poll sequence to slow down that rate at which S-BFD packets are - generated from an SBFDInitiator. This is done by the SBFDReflector - using procedures described in Section 7.8 and setting the Poll (P) - bit in the reflected S-BFD packet. The SBFDInitiator is to then send - the next S-BFD packet with the Final (F) bit set. If an - SBFDReflector receives an S-BFD packet with Poll (P) bit set, then - the SBFDReflector MUST respond with an S-BFD packet with Poll (P) bit - cleared and Final (F) bit set. + Poll sequence to slow down that rate at which S-BFD control packets + are generated from an SBFDInitiator. This is done by the + SBFDReflector using procedures described in Section 7.8 and setting + the Poll (P) bit in the reflected S-BFD control packet. The + SBFDInitiator is to then send the next S-BFD control packet with the + Final (F) bit set. If an SBFDReflector receives an S-BFD control + packet with Poll (P) bit set, then the SBFDReflector MUST respond + with an S-BFD control packet with Poll (P) bit cleared and Final (F) + bit set. 7.6. Control Plane Independent (C) Control plane independent (C) bit for an SBFDInitiator sending S-BFD - packets to a reflector BFD session MUST work according to [RFC5880]. - Reflector BFD session also MUST work according to [RFC5880]. - Specifically, if reflector BFD session implementation does not share - fate with control plane, then response S-BFD packets transmitted MUST - have control plane independent (C) bit set. If reflector BFD session - implementation shares fate with control plane, then response S-BFD - packets transmitted MUST NOT have control plane independent (C) bit - set. + control packets to a reflector BFD session MUST work according to + [RFC5880]. Reflector BFD session also MUST work according to + [RFC5880]. Specifically, if reflector BFD session implementation + does not share fate with control plane, then response S-BFD control + packets transmitted MUST have control plane independent (C) bit set. + If reflector BFD session implementation shares fate with control + plane, then response S-BFD control packets transmitted MUST NOT have + control plane independent (C) bit set. 7.7. Additional SBFDInitiator Behaviors - o If the SBFDInitiator receives a valid S-BFD packet in response to - transmitted S-BFD packet to a remote entity, then the - SBFDInitiator SHOULD conclude that S-BFD packet reached the - intended remote entity. + o If the SBFDInitiator receives a valid S-BFD control packet in + response to transmitted S-BFD control packet to a remote entity, + then the SBFDInitiator SHOULD conclude that S-BFD control packet + reached the intended remote entity. o When a sufficient number of S-BFD packets have not arrived as they should, the SBFDInitiator SHOULD declare loss of reachability to the remote entity. The criteria for declaring loss of reachability and the action that would be triggered as a result are outside the scope of this document. o Relating to above bullet item, it is critical for an implementation to understand the latency to/from the reflector BFD session on the responder. In other words, for very first S-BFD packet transmitted by the SBFDInitiator, an implementation MUST NOT expect response S-BFD packet to be received for time equivalent to sum of latencies: initiator to responder and responder back to initiator. - o If the SBFDInitiator receives an S-BFD packet with Demand (D) bit - set, the packet MUST be discarded. + o If the SBFDInitiator receives an S-BFD control packet with Demand + (D) bit set, the packet MUST be discarded. 7.8. Additional SBFDReflector Behaviors - o S-BFD packets transmitted by the SBFDReflector MUST have "Required - Min RX Interval" set to a value which expresses how many incoming - S-BFD packets this SBFDReflector can handle. The SBFDReflector - can control how fast SBFInitiators will be sending S-BFD packets - to self by ensuring "Required Min RX Interval" indicates a value - based on the current load. + o S-BFD control packets transmitted by the SBFDReflector MUST have + "Required Min RX Interval" set to a value which expresses how many + incoming S-BFD control packets this SBFDReflector can handle. The + SBFDReflector can control how fast SBFInitiators will be sending + S-BFD control packets to self by ensuring "Required Min RX + Interval" indicates a value based on the current load. o If the SBFDReflector wishes to communicate to some or all SBFDInitiators that monitored local entity is "temporarily out of - service", then S-BFD packets with "state" set to ADMINDOWN are - sent to those SBFDInitiators. The SBFDInitiators, upon reception - of such packets, MUST NOT conclude loss of reachability to - corresponding remote entity, and MUST back off packet transmission - interval for the remote entity to an interval no faster than 1 - second. If the SBFDReflector is generating a response S-BFD - packet for a local entity that is in service, then "state" in - response BFD control packets MUST be set to UP. + service", then S-BFD control packets with "state" set to ADMINDOWN + are sent to those SBFDInitiators. The SBFDInitiators, upon + reception of such packets, MUST NOT conclude loss of reachability + to corresponding remote entity, and MUST back off packet + transmission interval for the remote entity to an interval no + faster than 1 second. If the SBFDReflector is generating a + response S-BFD control packet for a local entity that is in + service, then "state" in response BFD control packets MUST be set + to UP. - o If an SBFDReflector receives an S-BFD packet with Demand (D) bit - cleared, the packet MUST be discarded. + o If an SBFDReflector receives an S-BFD control packet with Demand + (D) bit cleared, the packet MUST be discarded. 8. Scaling Aspect This mechanism brings forth one noticeable difference in terms of scaling aspect: number of SBFDReflector. This specification eliminates the need for egress nodes to have fully active BFD sessions when only one side desires to perform continuity tests. With introduction of reflector BFD concept, egress no longer is required to create any active BFD session per path/LSP/function basis. Due to this, total number of BFD sessions in a network is @@ -578,55 +592,55 @@ 9. Co-existence with Classical BFD Sessions Initial packet demultiplexing requirement is described in Section 7.1. Because of this, S-BFD mechanism can co-exist with classical BFD sessions. 10. S-BFD Echo Function The concept of the S-BFD Echo function is similar to the BFD Echo - function described in [RFC5880], packets are self-generated and self- - terminated after traversing a link/path. S-BFD echo packets are + function described in [RFC5880]. S-BFD echo packets have the + destination of self, thus S-BFD echo packets are self-generated and + self-terminated after traversing a link/path. S-BFD echo packets are expected to u-turn on the target node in the data plane and MUST NOT be processed by any reflector BFD sessions on the target node. When using the S-BFD Echo function, it is RECOMMENDED that: - o Both S-BFD packets (with BFD control header) and S-BFD echo - packets (implementation specific) be sent. + o Both S-BFD control packets and S-BFD echo packets be sent. - o Both S-BFD packets and S-BFD echo packets have the same semantics - in the forward direction to reach the target node. + o Both S-BFD control packets and S-BFD echo packets have the same + semantics in the forward direction to reach the target node. - In other words, it is not preferable to send just S-BFD echo packets. - There are two reason behind this suggestion: + In other words, it is not preferable to send just S-BFD echo packets + without also sending S-BFD control packets. There are two reasons + behind this suggestion: - o S-BFD packets can verify reachability to intended target node, - which allows one to conclude that S-BFD echo packets are u-turning - on the expected target node. + o S-BFD control packets can verify the reachability to intended + target node, which allows one to have confidence that S-BFD echo + packets are u-turning on the expected target node. - o S-BFD packets can detect when the target node is going out of - service (i.e. via receiving back ADMINDOWN state). + o S-BFD control packets can detect when the target node is going out + of service (i.e. via receiving back ADMINDOWN state). - Implementations MAY set "Required Min Echo RX Interval" field to - indicate the rate which SBFDInitiator is sending S-BFD Echo packets - (in ping) or the rate which SBFDReflector wants SBFDInitiators to - send S-BFD Echo packets (in pong). However, this is likely more than - necessary for the S-BFD Echo function to operate. Therefore, it is - RECOMMENDED that "Required Min Echo RX Interval" field simply be set - to zero in both directions. + The usage of the "Required Min Echo RX Interval" field is described + in Section 7.2.2 and Section 7.3.2. Because of the stateless nature + of SBFDReflector sessions, a value specified the "Required Min Echo + RX Interval" field in both directions is not very meaningful. Thus + it is RECOMMENDED that the "Required Min Echo RX Interval" field + simply be set to zero in both directions. - Additionally, following aspects are left as implementation details, - and are outside the scope of this document: + Following aspects of S-BFD Echo functions are left as implementation + details, and are outside the scope of this document: - o Format of the S-BFD Echo packet (ex: data beyond UDP header). + o Format of the S-BFD echo packet (ex: data beyond UDP header). o Procedures on when and how to use the S-BFD Echo function. 11. Security Considerations Same security considerations as [RFC5880], [RFC5881], [RFC5883], [RFC5884] and [RFC5885] apply to this document. Additionally, implementing the following measures will strengthen security aspects of the mechanism described by this document: @@ -637,40 +651,40 @@ accepting the packet. o SBFDReflector MAY look at the Key ID [I-D.ietf-bfd-generic-crypto-auth] in the incoming packet and verify the authentication data. o SBFDReflector MUST accept the packet if authentication is successful. o SBFDReflector MUST compute the Authentication data and MUST use - the same sequence number that it received in the S-BFD packet that - it is responding to. + the same sequence number that it received in the S-BFD control + packet that it is responding to. - o SBFDInitiator MUST accept the S-BFD packet if it either comes with - the same sequence number as it had sent or it's within the window - that it finds acceptable (described in detail in + o SBFDInitiator MUST accept the S-BFD control packet if it either + comes with the same sequence number as it had sent or it's within + the window that it finds acceptable (described in detail in [I-D.ietf-bfd-generic-crypto-auth]) Using the above method, o SBFDReflector continue to remain stateless despite using security. o SBFDReflector are not susceptible to replay attacks as they always - respond to S-BFD packets irrespective of the sequence number - carried. + respond to S-BFD control packets irrespective of the sequence + number carried. o An attacker cannot impersonate the responder since the - SBFDInitiator will only accept S-BFD packets that come with the - sequence number that it had originally used when sending the S-BFD - packet. + SBFDInitiator will only accept S-BFD control packets that come + with the sequence number that it had originally used when sending + the S-BFD control packet. 12. IANA Considerations No action is required by IANA for this document. 13. Acknowledgements Authors would like to thank Jeffrey Haas, Greg Mirsky and Marc Binderberger for performing thorough reviews and providing number of suggestions. Authors would like to thank Girija Raghavendra Rao, Les @@ -722,20 +736,25 @@ "Bidirectional Forwarding Detection (BFD) for MPLS Label Switched Paths (LSPs)", RFC 5884, June 2010. 15.2. Informative References [I-D.ietf-bfd-generic-crypto-auth] Bhatia, M., Manral, V., Zhang, D., and M. Jethanandani, "BFD Generic Cryptographic Authentication", draft-ietf- bfd-generic-crypto-auth-06 (work in progress), April 2014. + [I-D.ietf-bfd-multipoint] + Katz, D., Ward, D., and J. Networks, "BFD for Multipoint + Networks", draft-ietf-bfd-multipoint-04 (work in + progress), August 2014. + [I-D.ietf-bfd-seamless-use-case] Aldrin, S., Bhatia, M., Mirsky, G., Kumar, N., and S. Matsushima, "Seamless Bidirectional Forwarding Detection (BFD) Use Case", draft-ietf-bfd-seamless-use-case-00 (work in progress), June 2014. [RFC5885] Nadeau, T. and C. Pignataro, "Bidirectional Forwarding Detection (BFD) for the Pseudowire Virtual Circuit Connectivity Verification (VCCV)", RFC 5885, June 2010. @@ -808,14 +827,14 @@ Dave Ward Cisco Systems Email: wardd@cisco.com Manav Bhatia Ionos Networks Email: manav@ionosnetworks.com - Santosh + Santosh Pallagatti Juniper Networks Email: santoshpk@juniper.net