<pre>Network Working Group                                          A. Farrel
Request for Comments: 3612                            Old Dog Consulting
Category: Informational                                   September 2003


            <span class="h1">Applicability Statement for Restart Mechanisms</span>
               <span class="h1">for the Label Distribution Protocol (LDP)</span>

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This document provides guidance on when it is advisable to implement
   some form of Label Distribution Protocol (LDP) restart mechanism and
   which approach might be more suitable.  The issues and extensions
   described in this document are equally applicable to <a href="./rfc3212">RFC 3212</a>,
   "Constraint-Based LSP Setup Using LDP".

<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>.  Introduction</span>

   Multiprotocol Label Switching (MPLS) systems are used in core
   networks where system downtime must be kept to a minimum.  Similarly,
   where MPLS is at the network edges (e.g., in Provider Edge (PE)
   routers) [<a href="./rfc2547" title="&quot;BGP/MPLS VPNs&quot;">RFC2547</a>], system downtime must also be kept to a minimum.
   Many MPLS Label Switching Routers (LSRs) may, therefore, exploit
   Fault Tolerant (FT) hardware or software to provide high availability
   of the core networks.

   The details of how FT is achieved for the various components of an FT
   LSR, including the switching hardware and the TCP stack, are
   implementation specific.  How the software module itself chooses to
   implement FT for the state created by the LDP is also implementation
   specific.  However, there are several issues in the LDP specification
   [<a href="./rfc3036" title="&quot;LDP Specification&quot;">RFC3036</a>] that make it difficult to implement an FT LSR using the LDP
   protocols without some extensions to those protocols.

   Proposals have been made in [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] to address these
   issues.





<span class="grey">Farrel                       Informational                      [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>.  Requirements of an LDP FT System</span>

   Many MPLS LSRs may exploit FT hardware or software to provide high
   availability (HA) of core networks.  In order to provide HA, an MPLS
   system needs to be able to survive a variety of faults with minimal
   disruption to the Data Plane, including the following fault types:

   -  failure/hot-swap of the switching fabric in an LSR,

   -  failure/hot-swap of a physical connection between LSRs,

   -  failure of the TCP or LDP stack in an LSR,

   -  software upgrade to the TCP or LDP stacks in an LSR.

   The first two examples of faults listed above may be confined to the
   Data Plane.  Such faults can be handled by providing redundancy in
   the Data Plane which is transparent to LDP operating in the Control
   Plane.  However, the failure of the switching fabric or a physical
   link may have repercussions in the Control Plane since signaling may
   be disrupted.

   The third example may be caused by a variety of events including
   processor or other hardware failure, and software failure.

   Any of the last three examples may impact the Control Plane and will
   require action in the Control Plane to recover.  Such action should
   be designed to avoid disrupting traffic in the Data Plane.  Since
   many recent router architectures can separate the Control and Data
   Planes, it is possible that forwarding can continue unaffected by
   recovery action in the Control Plane.

   In other scenarios, the Data and Control Planes may be impacted by a
   fault, but the needs of HA require the coordinated recovery of the
   Data and Control Planes to a state that existed before the fault.

   The provision of protection paths for MPLS LSP and the protection of
   links, IP routes or tunnels through the use of protection LSPs is
   outside the scope of this document.  See [<a href="./rfc3469" title="&quot;Framework for Multi-Protocol Label Switching (MPLS)-based Recovery&quot;">RFC3469</a>] for further
   information.

<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>.  General Considerations</span>

   In order for the Data and Control Plane states to be successfully
   recovered after a fault, procedures are required to ensure that the
   state held on a pair of LDP peers (at least one of which was affected





<span class="grey">Farrel                       Informational                      [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   directly by the fault) are synchronized.  Such procedures must be
   implemented in the Control Plane software modules on the peers using
   Control Plane protocols.

   The required actions may operate fully after the failure (reactive
   recovery) or may contain elements that operate before the fault in
   order to minimize the actions taken after the fault (proactive
   recovery).  It is rare to implement actions that operate solely in
   advance of the failure and do not require any further processing
   after the failure (preventive recovery) - this is because of the
   dynamic nature of signaling protocols and the unpredictability of
   fault timing.

   Reactive recovery actions may include full re-signaling of state and
   re-synchronization of state between peers and synchronization based
   on checkpointing.

   Proactive recovery actions may include hand-shaking state transitions
   and checkpointing.

<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>.  Specific Issues with the LDP Protocol</span>

   LDP uses TCP to provide reliable connections between LSRs to exchange
   protocol messages to distribute labels and to set up LSPs.  A pair of
   LSRs that have such a connection are referred to as LDP peers.

   TCP enables LDP to assume reliable transfer of protocol messages.
   This means that some of the messages do not need to be acknowledged
   (e.g., Label Release).

   LDP is defined such that if the TCP connection fails, the LSR should
   immediately tear down the LSPs associated with the session between
   the LDP peers, and release any labels and resources assigned to those
   LSPs.

   It is notoriously difficult to provide a Fault Tolerant
   implementation of TCP.  To do so might involve making copies of all
   data sent and received.  This is an issue familiar to implementers of
   other TCP applications, such as BGP.

   During failover affecting the TCP or LDP stacks, therefore, the TCP
   connection may be lost.  Recovery from this position is made worse by
   the fact that LDP control messages may have been lost during the
   connection failure.  Since these messages are unconfirmed, it is
   possible that LSP or label state information will be lost.






<span class="grey">Farrel                       Informational                      [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   At the very least, the solution to this problem must include a change
   to the basic requirements of LDP so that the failure of an LDP
   session does not require that associated LDP or forwarding state be
   torn down.

   Any changes made to LDP in support of recovery processing must meet
   the following requirements:

   -  offer backward-compatibility with LSRs that do not implement the
      extensions to LDP,

   -  preserve existing protocol rules described in [<a href="./rfc3036" title="&quot;LDP Specification&quot;">RFC3036</a>] for
      handling unexpected duplicate messages and for processing
      unexpected messages referring to unknown LSPs/labels.

   Ideally, any solution applicable to LDP should be equally applicable
   to CR-LDP.

<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>.  Summary of the Features of LDP FT</span>

   LDP Fault Tolerance extensions are described in [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>].  This
   approach involves:

   -  negotiation between LDP peers of the intent to support extensions
      to LDP that facilitate recovery from failover without loss of
      LSPs,

   -  selection of FT survival on a per LSP/label basis or for all
      labels on a session,

   -  sequence numbering of LDP messages to facilitate acknowledgement
      and checkpointing,

   -  acknowledgement of LDP messages to ensure that a full handshake is
      performed on those messages either frequently (such as per
      message) or less frequently as in checkpointing,

   -  solicitation of up-to-date acknowledgement (checkpointing) of
      previous LDP messages to ensure the current state is secured, with
      an additional option that allows an LDP partner to request that
      state is flushed in both directions if graceful shutdown is
      required,

   -  a timer to control how long LDP and forwarding state should be
      retained after the LDP session failure, but before being discarded
      if LDP communications are not re-established,





<span class="grey">Farrel                       Informational                      [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   -  exchange of checkpointing information on LDP session recovery to
      establish what state has been retained by recovering LDP peers,

   -  re-issuing lost messages after failover to ensure that LSP/label
      state is correctly recovered after reconnection of the LDP
      session.

   The FT procedures in [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] concentrate on the preservation of
   label state for labels exchanged between a pair of adjacent LSRs when
   the TCP connection between those LSRs is lost.  There is no intention
   within these procedures to support end-to-end protection for LSPs.

<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>.  Summary of the Features of LDP Graceful Restart</span>

   LDP graceful restart extensions are defined in [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>].  This
   approach involves:

   -  negotiation between LDP peers of the intent to support extensions
      to LDP that facilitate recovery from failover without loss of
      LSPs,

   -  a mechanism whereby an LSR that restarts can relearn LDP state by
      resynchronization with its peers,

   -  use of the same mechanism to allow LSRs recovering from an LDP
      session failure to resynchronize LDP state with their peers
      provided that at least one of the LSRs has retained state across
      the failure or has itself resynchronized state with its peers,

   -  a timer to control how long LDP and forwarding state should be
      retained after the LDP session failure, but before being discarded
      if LDP communications are not re-established,

   -  a timer to control the length of the resynchronization period
      between adjacent peers should be completed.

   The procedures in [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] are applicable to all LSRs, both those
   with the ability to preserve forwarding state during LDP restart and
   those without.  LSRs that can not preserve their MPLS forwarding
   state across the LDP restart would impact MPLS traffic during
   restart.  However, by implementing a subset of the mechanisms in
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] they can minimize the impact if their neighbor(s) are
   capable of preserving their forwarding state across the restart of
   their LDP sessions or control planes by implementing the mechanism in
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>].






<span class="grey">Farrel                       Informational                      [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>.  Applicability Considerations</span>

   This section considers the applicability of fault tolerance schemes
   within LDP networks and considers issues that might lead to the
   choice of one method or another.  Many of the points raised below
   should be viewed as implementation issues rather than specific
   drawbacks of either solution.

<span class="h3"><a class="selflink" id="section-7.1" href="#section-7.1">7.1</a>.  General Applicability</span>

   The procedures described in [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are intended to
   cover two distinct scenarios.  In Session Failure, the LDP peers at
   the ends of a session remain active, but the session fails and is
   restarted.  Note that session failure does not imply failure of the
   data channel even when using an in-band control channel.  In Node
   Failure, the session fails because one of the peers has been
   restarted (or at least, the LDP component of the node has been
   restarted).  These two scenarios have different implications for the
   ease of retention of LDP state within an individual LSR, and are
   described in sections below.

   These techniques are only applicable in LDP networks where at least
   one LSR has the capability to retain LDP signaling state and the
   associated forwarding state across LDP session failure and recovery.
   In [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>], the LSRs retaining state do not need to be adjacent to
   the failed LSR or session.

   If traffic is not to be impacted, both LSRs at the ends of an LDP
   session must at least preserve forwarding state.  Preserving LDP
   state is not a requirement to preserve traffic.

   [<a id="ref-RFC3479">RFC3479</a>] requires that the LSRs at both ends of the session
   implement the procedures that it describes.  Thus, either traffic is
   preserved and recovery resynchronizes state, or no traffic is
   preserved and the LSP fails.

   Further, to use the procedures of [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] to recover state on a
   session, both LSRs must have a mechanism for maintaining some session
   state and a way of auditing the forwarding state and the
   resynhcronized control state.

   [<a id="ref-RFC3478">RFC3478</a>] is scoped to support preservation of traffic if both LSRs
   implement the procedures that it describes.  Additionally, it
   functions if only one LSR on the failed session supports retention of
   forwarding state, and implements the mechanisms in the document.  In
   this case, traffic will be impacted by the session failure, but the
   forwarding state will be recovered on session recovery.  Further, in
   the event of simultaneous failures, [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] is capable of



<span class="grey">Farrel                       Informational                      [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   relearning and redistributing state across multiple LSRs by combining
   its mechanisms with the usual LDP message exchanges of [<a href="./rfc3036" title="&quot;LDP Specification&quot;">RFC3036</a>].

<span class="h3"><a class="selflink" id="section-7.2" href="#section-7.2">7.2</a>.  Session Failure</span>

   In Session Failure, an LDP session between two peers fails and is
   restarted.  There is no restart of the LSRs at either end of the
   session and LDP continues to function on those nodes.

   In these cases, it is simple for LDP implementations to retain the
   LDP state associated with the failed session and to associate the
   state with the new session when it is established.  Housekeeping may
   be applied to determine that the failed session is not returning and
   to release the old LDP state.  Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] handle
   this case.

   Applicability of [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] to the Session Failure
   scenario should be considered with respect to the availability of the
   data plane.

   In some cases the failure of the LDP session may be independent of
   any failure of the physical (or virtual) link(s) between adjacent
   peers; for example, it might represent a failure of the TCP/IP stack.
   In these cases, the data plane is not impacted and both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and
   [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are applicable to preserve or restore LDP state.

   LDP signaling may also operate out of band; that is, it may use
   different links from the data plane.  In this case, a failure of the
   LDP session may be a result of a failure of the control channel, but
   there is no implied failure of the data plane.  For this scenario
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are both applicable to preserve or restore
   LDP state.

   In the case where the failure of the LDP session also implies the
   failure of the data plane, it may be an implementation decision
   whether LDP peers retain forwarding state, and for how long.  In such
   situations, if forwarding state is retained, and if the LDP session
   is re-established, both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are applicable to
   preserve or restore LDP state.

   When the data plane has been disrupted an objective of a recovery
   implementation might be to restore data traffic as quickly as
   possible.








<span class="grey">Farrel                       Informational                      [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


<span class="h3"><a class="selflink" id="section-7.3" href="#section-7.3">7.3</a>.  Controlled Session Failure</span>

   In some circumstances, the LSRs may know in advance that an LDP
   session is going fail (e.g., perhaps a link is going to be taken out
   of service).

   [<a id="ref-RFC3036">RFC3036</a>] includes provision for controlled shutdown of a session.
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] allow resynchronization of LDP state upon
   re-establishment of the session.

   [<a id="ref-RFC3479">RFC3479</a>] offers the facility to both checkpoint all LDP states
   before the shut-down, and to quiesce the session so that no new state
   changes are attempted between the checkpoint and the shut-down.  This
   means that on recovery, resynchronization is simple and fast.

   [<a id="ref-RFC3478">RFC3478</a>] resynchronizes all state on recovery regardless of the
   nature of the shut-down.

<span class="h3"><a class="selflink" id="section-7.4" href="#section-7.4">7.4</a>.  Node Failure</span>

   Node Failure describes events where a whole node is restarted or
   where the component responsible for LDP signaling is restarted.  Such
   an event will be perceived by the LSR's peers as session failure, but
   the restarting node sees the restart as full re-initialization.

   The basic requirement is that the forwarding state is retained,
   otherwise the data plane will necessarily be interrupted.  If
   forwarding state is not retained, it may be relearned from the saved
   control state in [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>].  [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] does not utilize or expect a
   saved control state.  If a node restarts without preserved forwarding
   state it informs its neighbors, which immediately delete all label-
   FEC bindings previously received from the restarted node.

   The ways to retain a forwarding and control state are numerous and
   implementation specific.  It is not the purpose of this document to
   espouse one mechanism or another, nor even to suggest how this might
   be done.  If state has been preserved across the restart,
   synchronization with peers can be carried out as though recovering
   from Session Failure as in the previous section.  Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and
   [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] support this case.

   How much control state is retained is largely an implementation
   choice, but [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] requires that at least small amount of per-
   session control state be retained.  [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] does not require or
   expect control state to be retained.

   It is also possible that the restarting LSR has not preserved any
   state.  In this case, [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] is of no help.  [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] however,



<span class="grey">Farrel                       Informational                      [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   allows the restarting LSR to relearn state from each adjacent peer
   through the processes for resynchronizing after Session Failure.
   Further, in the event of simultaneous failure of multiple adjacent
   nodes, the nodes at the edge of the failure zone can recover state
   from their active neighbors and distribute it to the other recovering
   LSRs without any failed LSR having to have saved state.

<span class="h3"><a class="selflink" id="section-7.5" href="#section-7.5">7.5</a>.  Controlled Node Failure</span>

   In some cases (hardware repair, software upgrade, etc.), node failure
   may be predictable.  In these cases all sessions with peers may be
   shutdown and existing state retention may be enhanced by special
   actions.

   [<a id="ref-RFC3479">RFC3479</a>] checkpointing and quiesce may be applied to all sessions so
   that state is up-to-date.

   As above, [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] does not require that state is retained by the
   restarting node, but can utilize it if it is.

<span class="h3"><a class="selflink" id="section-7.6" href="#section-7.6">7.6</a>.  Speed of Recovery</span>

   Speed of recovery is impacted by the amount of signaling required.

   If forwarding state is preserved on both LSRs on the failed session,
   then the recovery time is constrained by the time to resynchronize
   the state between the two LSRs.

   [<a id="ref-RFC3479">RFC3479</a>] may resynchronize very quickly.  In a stable network, this
   resolves to a handshake of a checkpoint.  At the most,
   resynchronization involves this handshake plus an exchange of
   messages to handle state changes since the checkpoint was taken.
   Implementations that support only the periodic checkpointing subset
   of [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are more likely to have additional state to
   resynchronize.

   [<a id="ref-RFC3478">RFC3478</a>] must resynchronize state for all label mappings that have
   been retained.  At the same time, resources that have been retained
   by a restarting upstream LSR but are not actually required, because
   they have been released by the downstream LSR (perhaps because it was
   in the process of releasing the state), they must be held for the
   full resynchronization time to ensure that they are not needed.

   The impact of recovery time will vary according to the use of the
   network.  Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] allow advertisement of new
   labels while resynchronization is in progress.  Issues to consider
   are re-availability of falsely retained resources and conflict
   between retained label mappings and newly advertised ones.  This may



<span class="grey">Farrel                       Informational                      [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   cause incorrect forwarding of data (since labels are advertised from
   downstream), an LSR upstream of a failure may continue to forward
   data for one FEC on an old label while the recovering downstream LSR
   might re-assign that label to another FEC and advertise it.  For this
   reason, restarting LSRs may choose to not advertise new labels until
   resynchronization with their peers has completed, or may decide to
   use special techniques to cover the short period of overlap between
   resynchronization and new LSP setup.

<span class="h3"><a class="selflink" id="section-7.7" href="#section-7.7">7.7</a>.  Scalability</span>

   Scalability is largely the same issue as speed of recovery and is
   governed by the number of LSPs managed through the failed session(s).

   Note that there are limits to how small the resynchronization time in
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] may be made given the capabilities of the LSRs, the
   throughput on the link between them, and the number of labels that
   must be resynchronized.

   Impact on normal operation should also be considered.

   [<a id="ref-RFC3479">RFC3479</a>] requires acknowledgement of all messages.  These
   acknowledgements may be deferred as for checkpointing described in
   <a href="#section-4">section 4</a>, or may be frequent.  Although acknowledgements can be
   piggy-backed on other state messages, an option for frequent
   acknowledgement is to send a message solely for the purpose of
   acknowledging a state change message.  Such an implementation would
   clearly be unwise in a busy network.

   [<a id="ref-RFC3478">RFC3478</a>] has no impact on normal operations.

<span class="h3"><a class="selflink" id="section-7.8" href="#section-7.8">7.8</a>.  Rate of Change of LDP State</span>

   Some networks do not show a high degree of change over time, such as
   those using targeted LDP sessions; others change the LDP forwarding
   state frequently, perhaps reacting to changes in routing information
   on LDP discovery sessions.

   Rate of change of LDP state exchanged over an LDP session depends on
   the application for which the LDP session is being used.  LDP
   sessions used for exchanging &lt;FEC, label&gt; bindings for establishing
   hop by hop LSPs will typically exchange state reacting to IGP
   changes.  Such exchanges could be frequent.  On the other hand, LDP
   sessions established for exchanging MPLS Layer 2 VPN FECs will
   typically exhibit a smaller rate of state exchange.






<span class="grey">Farrel                       Informational                     [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   In [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>], two options exist.  The first uses a frequent (up to
   per-message) acknowledgement system which is most likely to be
   applicable in a more dynamic system where it is desirable to preserve
   the maximum amount of state over a failure to reduce the level of
   resynchronization required and to speed the recovery time.

   The second option in [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] uses a less-frequent acknowledgement
   scheme known as checkpointing.  This is particularly suitable to
   networks where changes are infrequent or bursty.

   [<a id="ref-RFC3478">RFC3478</a>] resynchronizes all state on recovery regardless of the rate
   of change of the network before the failure.  This consideration is
   thus not relevant to the choice of [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>].

<span class="h3"><a class="selflink" id="section-7.9" href="#section-7.9">7.9</a>.  Label Distribution Modes</span>

   Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are suitable for use with Downstream
   Unsolicited label distribution.

   [<a id="ref-RFC3478">RFC3478</a>] describes Downstream-On-Demand as an area for future study
   and is therefore not applicable for a network in which this label
   distribution mode is used.  It is possible that future examination of
   this issue will reveal that once a label has been distributed in
   either distribution mode, it can be redistributed by [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] upon
   session recovery.

   [<a id="ref-RFC3479">RFC3479</a>] is suitable for use in a network that uses Downstream-On-
   Demand label distribution.

   In theory, and according to [<a href="./rfc3036" title="&quot;LDP Specification&quot;">RFC3036</a>], even in networks configured to
   utilize Downstream Unsolicited label distribution, there may be
   occasions when the use of Downstream-On-Deman distribution is
   desirable.  The use of the Label Request message is not prohibited in
   a Downstream Unsolicited label distribution LDP network.

   Opinion varies as to whether there is a practical requirement for the
   use of the Label Request message in a Downstream Unsolicited label
   distribution LDP network.  Current deployment experience suggests
   that there is no requirement.

<span class="h3"><a class="selflink" id="section-7.10" href="#section-7.10">7.10</a>.  Implementation Complexity</span>

   Implementation complexity has consequences for the implementer and
   also for the deployer since complex software is more error prone and
   harder to manage.






<span class="grey">Farrel                       Informational                     [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   [<a id="ref-RFC3479">RFC3479</a>] is a more complex solution than [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>].  In particular,
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] does not require any modification to the normal signaling
   and processing of LDP state changing messages.

   [<a id="ref-RFC3479">RFC3479</a>] implementations may be simplified by implementing only the
   checkpointing subset of the functionality.

<span class="h3"><a class="selflink" id="section-7.11" href="#section-7.11">7.11</a>.  Implementation Robustness</span>

   In addition to the implication for robustness associated with
   complexity of the solutions, consideration should be given to the
   effects of state preservation on robustness.

   If state has become incorrect for whatever reason, then state
   preservation may retain incorrect state.  In extreme cases, it may be
   that the incorrect state is the cause of the failure in which case
   preserving that state would be inappropriate.

   When state is preserved, the precise amount that is retained is an
   implementation issue.  The basic requirement is that forwarding state
   is retained (to preserve the data path) and that that state can be
   accessed by the LDP software component.

   In both solutions, if the forwarding state is incorrect and is
   retained, it will continue to be incorrect.  Both solutions have a
   mechanism to housekeep and free the unwanted state after
   resynchronization is complete.  [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] may be better at
   eradicating incorrect forwarding state, because it replays all
   message exchanges that caused the state to be populated.

   In [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>], no more data than the forwarding state needs to have
   been saved by the recovering node.  All LDP state may be relearned by
   message exchanges with peers.  Whether those exchanges may cause the
   same incorrect state to arise on the recovering node is an obvious
   concern.

   In [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>], the forwarding state must be supplemented by a small
   amount of state specific to the protocol extensions.  LDP state may
   be retained directly or reconstructed from the forwarding state.  The
   same issues apply when reconstructing state but are mitigated by the
   fact that this is likely a different code path.  Errors in the
   retained state specific to the protocol extensions will persist.

<span class="h3"><a class="selflink" id="section-7.12" href="#section-7.12">7.12</a>.  Interoperability and Backward Compatibility</span>

   It is important that new additions to LDP interoperate with existing
   implementations at least in provision of the existing levels of
   function.



<span class="grey">Farrel                       Informational                     [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] do this through rules for handling the
   absence of the FT optional negotiation object during session
   initialization.

   Additionally, [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] is able to perform limited recovery (i.e.,
   redistribution of state) even when only one of the participating LSRs
   supports the procedures.  This may offer considerable advantages in
   interoperation with legacy implementations.

<span class="h3"><a class="selflink" id="section-7.13" href="#section-7.13">7.13</a>.  Interaction With Other Label Distribution Mechanisms</span>

   Many LDP LSRs also run other label distribution mechanisms.  These
   include management interfaces for configuration of static label
   mappings, other distinct instances of LDP, and other label
   distribution protocols.  The last example includes traffic
   engineering label distribution protocol that are used to construct
   tunnels through which LDP LSPs are established.

   As with re-use of individual labels by LDP within a restarting LDP
   system, care must be taken to prevent labels that need to be retained
   by a restarting LDP session or protocol component from being used by
   another label distribution mechanism.  This might compromise data
   security, amongst other things.

   It is a matter for implementations to avoid this issue through the
   use of techniques, such as a common label management component or
   segmented label spaces.

<span class="h3"><a class="selflink" id="section-7.14" href="#section-7.14">7.14</a>.  Applicability to CR-LDP</span>

   CR-LDP [<a href="./rfc3212" title="&quot;Constraint-Based LSP Setup using LDP&quot;">RFC3212</a>] utilizes Downstream-On-Demand label distribution.
   [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] describes Downstream-On-Demand as an area for future study
   and is therefore not applicable for CR-LDP.  [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] is suitable
   for use in a network entirely based on CR-LDP or in one that is mixed
   between LDP and CR-LDP.

<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>.  Security Considerations</span>

   This document is informational and introduces no new security
   concerns.

   The security considerations pertaining to the original LDP protocol
   [<a href="./rfc3036" title="&quot;LDP Specification&quot;">RFC3036</a>] remain relevant.

   [<a id="ref-RFC3478">RFC3478</a>] introduces the possibility of additional denial-of- service
   attacks.  All of these attacks may be countered by use of an
   authentication scheme between LDP peers, such as the MD5-based scheme
   outlined in [LDP].



<span class="grey">Farrel                       Informational                     [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


   In MPLS, a data mis-delivery security issue can arise if an LSR
   continues to use labels after expiration of the session that first
   caused them to be used.  Both [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>] are open to
   this issue.

<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>.  Intellectual Property Statement</span>

   The IETF takes no position regarding the validity or scope of any
   intellectual property or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; neither does it represent that it
   has made any effort to identify any such rights.  Information on the
   IETF's procedures with respect to rights in standards-track and
   standards-related documentation can be found in <a href="https://www.rfc-editor.org/bcp/bcp11">BCP-11</a>.  Copies of
   claims of rights made available for publication and any assurances of
   licenses to be made available, or the result of an attempt made to
   obtain a general license or permission for the use of such
   proprietary rights by implementors or users of this specification can
   be obtained from the IETF Secretariat.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights which may cover technology that may be required to practice
   this standard.  Please address the information to the IETF Executive
   Director.

<span class="h2"><a class="selflink" id="section-10" href="#section-10">10</a>.  References</span>

<span class="h3"><a class="selflink" id="section-10.1" href="#section-10.1">10.1</a>.  Normative References</span>

   [<a id="ref-RFC2026">RFC2026</a>]    Bradner, S., "The Internet Standards Process -- Revision
                3", <a href="https://www.rfc-editor.org/bcp/bcp9">BCP 9</a>, <a href="./rfc2026">RFC 2026</a>, October 1996.

   [<a id="ref-RFC2119">RFC2119</a>]    Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.

   [<a id="ref-RFC3036">RFC3036</a>]    Andersson, L., Doolan, P., Feldman, N., Fredette, A. and
                B. Thomas, "LDP Specification", <a href="./rfc3036">RFC 3036</a>, January 2001.

   [<a id="ref-RFC3478">RFC3478</a>]    Leelanivas, M., Rekhter, Y. and R. Aggarwal, "Graceful
                Restart Mechanism for LDP", <a href="./rfc3478">RFC 3478</a>, February 2003.

   [<a id="ref-RFC3479">RFC3479</a>]    Farrel, A., Editor, "Fault Tolerance for the Label
                Distribution Protocol (LDP)", <a href="./rfc3479">RFC 3479</a>, February 2003.






<span class="grey">Farrel                       Informational                     [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


<span class="h3"><a class="selflink" id="section-10.2" href="#section-10.2">10.2</a>.  Informative References</span>

   [<a id="ref-RFC2547">RFC2547</a>]    Rosen, E. and Y. Rekhter, "BGP/MPLS VPNs", <a href="./rfc2547">RFC 2547</a>,
                March 1999.

   [<a id="ref-RFC3212">RFC3212</a>]    Jamoussi, B., Editor, Andersson, L., Callon, R., Dantu,
                R., Wu, L., Doolan, P., Worster, T., Feldman, N.,
                Fredette, A., Girish, M., Gray, E., Heinanen, J., Kilty,
                T. and A. Malis, "Constraint-Based LSP Setup using LDP",
                <a href="./rfc3212">RFC 3212</a>, January 2002.

   [<a id="ref-RFC3469">RFC3469</a>]    Sharma, V., Ed., and F. Hellstrand, Ed., "Framework for
                Multi-Protocol Label Switching (MPLS)-based Recovery",
                <a href="./rfc3469">RFC 3469</a>, February 2003.

<span class="h2"><a class="selflink" id="section-11" href="#section-11">11</a>.  Acknowledgements</span>

   The author would like to thank the authors of [<a href="./rfc3478" title="&quot;Graceful Restart Mechanism for LDP&quot;">RFC3478</a>] and [<a href="./rfc3479" title="&quot;Fault Tolerance for the Label Distribution Protocol (LDP)&quot;">RFC3479</a>]
   for their work on fault tolerance of LDP.  Many thanks to Yakov
   Rekhter, Rahul Aggarwal, Manoj Leelanivas and Andrew Malis for their
   considered input to this applicability statement.

<span class="h2"><a class="selflink" id="section-12" href="#section-12">12</a>.  Author's Address</span>

   Adrian Farrel
   Old Dog Consulting

   Phone:  +44 (0) 1978 860944
   EMail:  adrian@olddog.co.uk






















<span class="grey">Farrel                       Informational                     [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc3612">RFC 3612</a>        Applicability for LDP Restart Mechanisms  September 2003</span>


<span class="h2"><a class="selflink" id="section-13" href="#section-13">13</a>.  Full Copyright Statement</span>

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assignees.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Farrel                       Informational                     [Page 16]
</pre>