<pre>Network Working Group                                          L. Berger
Request for Comments: 4873                               LabN Consulting
Updates: <a href="./rfc3473">3473</a>, <a href="./rfc4872">4872</a>                                           I. Bryskin
Category: Standards Track                                   ADVA Optical
                                                        D. Papadimitriou
                                                                 Alcatel
                                                               A. Farrel
                                                      Old Dog Consulting
                                                                May 2007


                         <span class="h1">GMPLS Segment Recovery</span>

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The IETF Trust (2007).

Abstract

   This document describes protocol specific procedures for GMPLS
   (Generalized Multi-Protocol Label Switching) RSVP-TE (Resource
   ReserVation Protocol - Traffic Engineering) signaling extensions to
   support label switched path (LSP) segment protection and restoration.
   These extensions are intended to complement and be consistent with
   the RSVP-TE Extensions for End-to-End GMPLS Recovery (<a href="./rfc4872">RFC 4872</a>).
   Implications and interactions with fast reroute are also addressed.
   This document also updates the handling of NOTIFY_REQUEST objects.
















<span class="grey">Berger, et al.              Standards Track                     [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


Table of Contents

   <a href="#section-1">1</a>. Introduction ....................................................<a href="#page-3">3</a>
      <a href="#section-1.1">1.1</a>. Conventions Used in This Document ..........................<a href="#page-3">3</a>
   <a href="#section-2">2</a>. Segment Recovery ................................................<a href="#page-4">4</a>
      <a href="#section-2.1">2.1</a>. Segment Protection .........................................<a href="#page-6">6</a>
      <a href="#section-2.2">2.2</a>. Segment Re-routing and Restoration .........................<a href="#page-6">6</a>
   <a href="#section-3">3</a>. ASSOCIATION Object ..............................................<a href="#page-6">6</a>
      <a href="#section-3.1">3.1</a>. Format .....................................................<a href="#page-7">7</a>
      <a href="#section-3.2">3.2</a>. Procedures .................................................<a href="#page-7">7</a>
           <a href="#section-3.2.1">3.2.1</a>. Recovery Type Processing ............................<a href="#page-7">7</a>
           <a href="#section-3.2.2">3.2.2</a>. Resource Sharing Association Type Processing ........<a href="#page-7">7</a>
   <a href="#section-4">4</a>. Explicit Control of LSP Segment Recovery ........................<a href="#page-8">8</a>
      <a href="#section-4.1">4.1</a>. Secondary Explicit Route Object Format .....................<a href="#page-8">8</a>
           <a href="#section-4.1.1">4.1.1</a>. Protection Subobject ................................<a href="#page-8">8</a>
      <a href="#section-4.2">4.2</a>. Explicit Control Procedures ................................<a href="#page-9">9</a>
           <a href="#section-4.2.1">4.2.1</a>. Branch Failure Handling ............................<a href="#page-10">10</a>
           <a href="#section-4.2.2">4.2.2</a>. Resv Message Processing ............................<a href="#page-11">11</a>
           <a href="#section-4.2.3">4.2.3</a>. Admin Status Change ................................<a href="#page-12">12</a>
           <a href="#section-4.2.4">4.2.4</a>. Recovery LSP Teardown ..............................<a href="#page-12">12</a>
      <a href="#section-4.3">4.3</a>. Teardown From Non-Ingress Nodes ...........................<a href="#page-12">12</a>
           <a href="#section-4.3.1">4.3.1</a>. Modified NOTIFY_REQUEST Object Processing ..........<a href="#page-13">13</a>
           <a href="#section-4.3.2">4.3.2</a>. Modified Notify and Error Message Processing .......<a href="#page-14">14</a>
   <a href="#section-5">5</a>. Secondary Record Route Objects .................................<a href="#page-14">14</a>
      <a href="#section-5.1">5.1</a>. Format ....................................................<a href="#page-14">14</a>
      <a href="#section-5.2">5.2</a>. Path Processing ...........................................<a href="#page-15">15</a>
      <a href="#section-5.3">5.3</a>. Resv Processing ...........................................<a href="#page-15">15</a>
   <a href="#section-6">6</a>. Dynamic Control of LSP Segment Recovery ........................<a href="#page-16">16</a>
      <a href="#section-6.1">6.1</a>. Modified PROTECTION Object Format .........................<a href="#page-16">16</a>
      <a href="#section-6.2">6.2</a>. Dynamic Control Procedures ................................<a href="#page-17">17</a>
   <a href="#section-7">7</a>. Updated RSVP Message Formats ...................................<a href="#page-18">18</a>
   <a href="#section-8">8</a>. Security Considerations ........................................<a href="#page-20">20</a>
   <a href="#section-9">9</a>. IANA Considerations ............................................<a href="#page-21">21</a>
      <a href="#section-9.1">9.1</a>. New Association Type Assignment ...........................<a href="#page-21">21</a>
      <a href="#section-9.2">9.2</a>. Definition of PROTECTION Object Reserved Bits .............<a href="#page-21">21</a>
      <a href="#section-9.3">9.3</a>. Secondary Explicit Route Object ...........................<a href="#page-21">21</a>
      <a href="#section-9.4">9.4</a>. Secondary Record Route Object .............................<a href="#page-21">21</a>
      <a href="#section-9.5">9.5</a>. New Error Code ............................................<a href="#page-22">22</a>
      <a href="#section-9.6">9.6</a>. Use of PROTECTION Object C-type ...........................<a href="#page-22">22</a>
   <a href="#section-10">10</a>. References ....................................................<a href="#page-23">23</a>
      <a href="#section-10.1">10.1</a>. Normative References .....................................<a href="#page-23">23</a>
      <a href="#section-10.2">10.2</a>. Informative References ...................................<a href="#page-23">23</a>









<span class="grey">Berger, et al.              Standards Track                     [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>.  Introduction</span>

   [<a id="ref-RFC4427">RFC4427</a>] covers multiple types of protection, including end-to-end
   and segment-based approaches.  "RSVP-TE Extensions in Support of
   End-to-End Generalized Multi-Protocol Label Switching (GMPLS)
   Recovery" [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>] defines a set of extensions to support multiple
   types of recovery.  The supported types include 1+1 unidirectional/
   1+1 bidirectional protection, LSP protection with extra-traffic
   (including 1:N protection with extra-traffic), pre-planned LSP re-
   routing without extra-traffic (including shared mesh), and full LSP
   re-routing.  In all cases, the recovery is provided on an end-to-end
   basis, i.e., the ingress and egress nodes of both the protected and
   the protecting LSP are the same.

   [<a id="ref-RFC4090">RFC4090</a>] provides a form of segment recovery for packet MPLS-TE
   networks.  Two methods of fast reroute are defined in [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>].  The
   one-to-one backup method creates detour LSPs for each protected LSP
   at each potential point of local repair.  The facility backup method
   creates a bypass tunnel to protect a potential failure point that is
   shared by multiple LSPs and uses label stacking.  Neither approach
   supports the full set of recovery types supported by [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].
   Additionally, the facility backup method is not applicable to most
   non-PSC (packet switch capable) switching technologies.

   The extensions defined in this document allow for support of the full
   set of recovery types supported by [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>], but on a segment, or
   portion of the LSP, basis.  The extensions allow (a) the signaling of
   desired LSP segment protection type, (b) upstream nodes to optionally
   identify where segment protection starts and stops, (c) the optional
   identification of hops used on protection segments, and (d) the
   reporting of paths used to protect an LSP.  The extensions also widen
   the topological scope over which protection can be supported.  They
   allow recovery segments that protect against an arbitrary number of
   nodes and links.  They enable overlapping protection and nested
   protection.  These extensions are intended to be compatible with fast
   reroute, and in some cases used with fast reroute.

<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>.  Conventions Used in This Document</span>

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [<a href="./rfc2119" title="&quot;Key words for use in RFCs to Indicate Requirement Levels&quot;">RFC2119</a>].

   In addition, the reader is assumed to be familiar with the
   terminology used in [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>], [<a href="./rfc3471" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling Functional Description&quot;">RFC3471</a>], and [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>], as well as
   [<a href="./rfc4427" title="&quot;Recovery (Protection and Restoration) Terminology for Generalized Multi-Protocol Label Switching (GMPLS)&quot;">RFC4427</a>], [<a href="./rfc4426" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Recovery Functional Specification,&quot;">RFC4426</a>], [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>], and [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>].





<span class="grey">Berger, et al.              Standards Track                     [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>.  Segment Recovery</span>

   Segment recovery is used to provide protection and restoration over a
   portion of an end-to-end LSP.  Such segment protection and
   restoration is useful to protect against a span failure, a node
   failure, or failure over a particular portion of a network used by an
   LSP.

   Consider the following topology:

                        A---B---C---D---E---F
                                 \     /
                                  G---I

   In this topology, end-to-end protection and recovery is not possible
   for an LSP going between node A and node F, but it is possible to
   protect/recover a portion of the LSP.  Specifically, if the LSP uses
   a working path of [A,B,C,D,E,F], then a protection or restoration LSP
   can be established along the path [C,G,I,E].  This LSP protects
   against failures on spans {C,D} and {D,E}, as well as a failure of
   node D.  This form of protection/restoration is referred to as
   Segment Protection and Segment Restoration, or as Segment Recovery,
   collectively.  The LSP providing the protection or restoration is
   referred to as a segment protection LSP or a segment restoration LSP.
   The term "segment recovery LSP" is used to cover either a segment
   protection LSP or a segment restoration LSP.  The term "branch node"
   is used to refer to a node that initiates a recovery LSP, e.g., node
   C in the figure shown above.  This is equivalent to the point of
   local repair (PLR) used in [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>].  As with [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>], the term
   "merge node" is used to refer to a node that terminates a recovery
   LSP, e.g., node E in the figure shown above.

   Segment protection or restoration is signaled using a working LSP and
   one or more segment recovery LSPs.  Each segment recovery LSP is
   signaled as an independent LSP.  Specifically, the Sender_Template
   object uses the IP address of the node originating the recovery path,
   e.g., node C in the topology shown above, and the Session object
   contains the IP address of the node terminating the recovery path,
   e.g., node E shown above.  There is no specific requirement on LSP ID
   value, Tunnel ID, and Extended Tunnel ID.  Values for these fields
   are selected normally, including consideration for the make-before-
   break concept (as described in [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>]).  Intermediate nodes follow
   standard signaling procedures when processing segment recovery LSPs.
   A segment recovery LSP may be protected itself using segment or end-
   to-end protection/restoration.  Note, in PSC environments, it may be
   desirable to construct the Sender_Template and Session objects per
   [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>].




<span class="grey">Berger, et al.              Standards Track                     [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   When [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>] isn't being used, the association between segment
   recovery LSPs with other LSPs is indicated using the ASSOCIATION
   object defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  The ASSOCIATION object is used to
   associate recovery LSPs with the LSP they are protecting.  Working
   and protecting LSPs, as well as primary and secondary LSPs, are
   identified using LSP Status as described in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  The O-bit in
   the segment flags portion of the PROTECTION object is used to
   identify when a recovery LSP is carrying the normal (active) traffic.

   An upstream node can permit downstream nodes to dynamically identify
   branch and merge points by setting the desired LSP segment protection
   bits in the PROTECTION object.  These bits are defined below.

   Optionally, an upstream node, usually the ingress node, can identify
   the endpoints of a segment recovery LSP.  This is accomplished using
   a new object.  This object uses the same format as an Explicit Route
   Object (ERO) and is referred to as a Secondary Explicit Route object
   (SERO); see <a href="#section-4.1">Section 4.1</a>.  SEROs also support a new subobject to
   indicate the type of protection or restoration to be provided.  At a
   minimum, an SERO will indicate a recovery LSP's initiator,
   protection/restoration type and terminator.  Standard ERO semantics
   (see [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>]) can optionally be used within and SERO to explicitly
   control the recovery LSP.  A Secondary Record Route object (SRRO) is
   defined for recording the path of a segment recovery LSP; see <a href="#section-5">Section</a>
   <a href="#section-5">5</a>.

   SEROs are carried between the node creating the SERO, typically the
   ingress, and the node initiating a recovery LSP.  The node initiating
   a recovery LSP uses the SERO to create the ERO for the recovery LSP.
   At this (branch) node, all local objects are removed, and the new
   protection subobject is used to create the PROTECTION object for the
   recovery LSP.  It is also possible to control the handling of a
   failure to establish a recovery LSP.

   SRROs are carried in Path messages between the node terminating a
   recovery LSP, the merge node, and the egress.  SRROs are used in Resv
   messages between a branch node and the ingress.  The merge node of a
   recovery LSP creates an SRRO by copying the RRO from the Path message
   of the associated recovery LSP into a new SRRO object.  Any SRROs
   present in the recovery LSP's Path message are also copied.  The
   branch node of a recovery LSP creates an SRRO by copying the RRO from
   the Resv message of associated recovery LSP into a new SRRO object.
   Any SRROs present in the recovery LSP's Resv message are also copied.

   Notify request processing is also impacted by LSP segment recovery.
   Per [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>], only one NOTIFY_REQUEST object is meaningful and
   should be propagated.  Additional NOTIFY_REQUEST objects are used to
   identify recovery LSP branch nodes.



<span class="grey">Berger, et al.              Standards Track                     [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>.  Segment Protection</span>

   Three approaches for end-to-end protection are defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>]:
   1+1 Unidirectional Protection (<a href="#section-5">Section 5</a>), 1+1 Bidirectional
   Protection (<a href="#section-6">Section 6</a>), and 1:1 Protection With Extra-Traffic
   (<a href="#section-7">Section 7</a>).  The segment protection forms of these protection
   approaches all operate much like their end-to-end counterparts.  Each
   behaves just like its end-to-end counterpart, with the exception that
   the protection LSP protects only a portion of the working LSP.  The
   type of protection to be used on a segment protection LSP is
   indicated, to the protection LSP's ingress, using the protection SERO
   subobject defined in <a href="#section-4.1">Section 4.1</a>.

   The switch-over processing for segment 1+1 Bidirectional protection
   and 1:1 Protection With Extra-Traffic follows the same procedures as
   end-to-end protection forms; see Sections <a href="#section-6.2">6.2</a> and <a href="#section-7.2">7.2</a> of [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>]
   for details.

<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>.  Segment Re-routing and Restoration</span>

   Three re-routing and restoration approaches are defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>]:
   Re-routing without Extra-Traffic (<a href="#section-8">Section 8</a>), Shared-Mesh Restoration
   (<a href="#section-9">Section 9</a>), (Full) LSP Re-routing (<a href="#section-11">Section 11</a>).  As with protection,
   these approaches are supported on a segment basis.  The segment forms
   of re-routing and restoration operate exactly like their end-to-end
   counterparts, with the exception that the restoration LSP recovers
   only a portion of the working LSP.  The type of re-routing or
   restoration to be used on a segment restoration LSP is indicated, to
   the restoration LSP's ingress, using the new protection SERO
   subobject.

<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>.  ASSOCIATION Object</span>

   The ASSOCIATION object is used for the association of segment
   protection LSPs when [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>] isn't being used.  The ASSOCIATION
   object is defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  In this document, we define a new
   Association Type field value to support make-before-break; the
   formats and procedures defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>] are not otherwise
   modified.












<span class="grey">Berger, et al.              Standards Track                     [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>.  Format</span>

   Association Type: 16 bits

      Value       Type
      -----       ----
        2         Resource Sharing (R)

   See [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>] for the definition of other fields and values.

<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>.  Procedures</span>

   The ASSOCIATION object is used to associate different LSPs with each
   other.  In the protection and restoration context, the object is used
   to associate a recovery LSP with the LSP it is protecting.  The
   ASSOCIATION object is also used to support resource sharing during
   make-before-break.  This object MUST NOT be used when association is
   made according to the methods defined in [<a href="./rfc4090" title="&quot;Fast Reroute Extensions to RSVP-TE for LSP Tunnels&quot;">RFC4090</a>].

<span class="h4"><a class="selflink" id="section-3.2.1" href="#section-3.2.1">3.2.1</a>.  Recovery Type Processing</span>

   Recovery type processing procedures are the same as those defined in
   [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>], but processing and identification occur with respect to
   segment recovery LSPs.  Note that this means that multiple
   ASSOCIATION objects of type recovery may be present on an LSP.

<span class="h4"><a class="selflink" id="section-3.2.2" href="#section-3.2.2">3.2.2</a>.  Resource Sharing Association Type Processing</span>

   The ASSOCIATION object with an Association Type with the value
   Resource Sharing is used to enable resource sharing during make-
   before-break.  Resource sharing during make-before-break is defined
   in [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>].  The defined support only works with LSPs that share
   the same LSP egress.  With the introduction of segment recovery LSPs,
   it is now possible for an LSP endpoint to change during make-before-
   break.

   A node includes an ASSOCIATION object with a Resource Sharing
   Association Type in an outgoing Path message when it wishes to
   indicate resource sharing across an associated set of LSPs.  The
   Association Source is set to the originating node's router address.
   The Association ID MUST be set to a value that uniquely identifies
   the association of LSPs.  This MAY be set to the working LSP's LSP
   ID.  Once included, an ASSOCIATION object with a Resource Sharing
   Association Type SHOULD NOT be removed from the Path messages
   associated with an LSP.






<span class="grey">Berger, et al.              Standards Track                     [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   Any node processing a Path message for which the node does not have a
   matching state, and which contains an ASSOCIATION object with a
   Resource Sharing type, examines existing LSPs for matching
   Association Type, Association Source, and Association ID values.  If
   any match is found, then [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>] style resource sharing SHOULD be
   provided between the new and old LSPs.  See [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>] for additional
   details.

<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>.  Explicit Control of LSP Segment Recovery</span>

   Secondary Explicit Route objects, or SEROs, are defined in this
   document.  They may be used to indicate the branch and merge nodes of
   recovery LSPs.  They may also provide additional information that is
   to be carried in a recovery LSP's ERO.  When upstream control of
   branch and merge nodes is not desired, SEROs are not used.

<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a>.  Secondary Explicit Route Object Format</span>

   The format of a SECONDARY_EXPLICIT_ROUTE object is the same as an
   EXPLICIT_ROUTE object.  This includes the definition of subobjects
   defined for EXPLICIT_ROUTE object.  The class of the
   SECONDARY_EXPLICIT_ROUTE object is 200 (of the form 11bbbbbb).

<span class="h4"><a class="selflink" id="section-4.1.1" href="#section-4.1.1">4.1.1</a>.  Protection Subobject</span>

   A new subobject, called the protection subobject, is defined for use
   in the SECONDARY_EXPLICIT_ROUTE object.  As mentioned above, the new
   protection subobject is used to create the PROTECTION object for the
   recovery LSP.  Specific procedures related to the protection
   subobject are provided in <a href="#section-4.2">Section 4.2</a>.  The protection subobject is
   not valid for use with the Explicit and Record Route objects and MUST
   NOT be included in those objects.

   The format of the protection subobject is defined as follows:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |L|    Type     |     Length    |    Reserved   |   C-Type      |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                  PROTECTION Object Contents                   |
      |                              ...                              |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      L-bit

         This is defined in [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>] and MUST be set to zero for
         protection subobjects.



<span class="grey">Berger, et al.              Standards Track                     [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


      Type

         37 Protection

      Length

         As defined in <a href="./rfc3209#section-4.3.3">[RFC3209], Section&nbsp;4.3.3</a>.

      Reserved

         This field is reserved.  It MUST be set to zero on transmission
         and MUST be ignored on receipt.

      C-Type

         The C-Type of the included PROTECTION object.

      PROTECTION Object Contents

         The contents of the PROTECTION object, with the format matching
         the indicated C-Type, excluding the object header.

<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a>.  Explicit Control Procedures</span>

   SEROs are carried in Path messages and indicate at which node a
   recovery LSP is to be initiated relative to the LSP carrying the
   SERO.  More than one SERO MAY be present in a Path message.

   To indicate the branch and merge nodes of a recovery LSP, an SERO is
   created and added to the Path message of the LSP being recovered.
   The decision to create and insert an SERO is a local matter and
   outside the scope of this document.

   An SERO SHOULD contain at least three subobjects.  The first
   subobject MUST indicate the node that is to originate the recovery
   LSP, i.e. the segment branch node.  The address used SHOULD also be
   listed in the ERO or another SERO.  This ensures that the branch node
   is along the LSP path.  The second subobject SHOULD be a protection
   subobject and should indicate the protection or restoration to be
   provided by the recovery LSP.  When the protection subobject is
   present, the LSP Segment Recovery Flags in the protection subobject
   MUST be ignored.  The final subobject in the SERO MUST be the merge
   node of the recovery LSP, and MAY have the L-bit set.  Standard ERO
   subobjects MAY be inserted between the protection subobject and the
   final subobject.  These subobjects MAY be loose or strict.

   A node receiving a Path message containing one or more SEROs SHOULD
   examine each SERO to see if it indicates a local branch point.  This



<span class="grey">Berger, et al.              Standards Track                     [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   determination is made by examining the first object of each SERO and
   seeing if the address indicated in the subobject can be associated
   with the local node.  If any of indicated addresses are associated
   with the local node, then the local node is a branch node.  If the
   local node is not a branch node, all received SEROs MUST be
   transmitted, without modification, in the corresponding outgoing Path
   message.

   At a branch node, the SERO, together with the Path message of LSP
   being recovered, provides the information to create the recovery LSP.
   The Path message for the recovery LSP is created at the branch node
   by cloning the objects carried in the incoming Path message of the
   LSP being protected.  Certain objects are replaced or modified in the
   recovery LSP's outgoing Path message.  The Sender_template object
   MUST be updated to use an address (in its Tunnel Sender Address
   field) on the local node, and the LSP ID MUST be updated to ensure
   uniqueness.  The Session object MUST be updated to use the address
   indicated in the final subobject of the SERO as the tunnel endpoint
   address, the tunnel ID MAY be updated, and the extended tunnel ID
   MUST be set to the local node address.  The PROTECTION object is
   replaced with the contents of the matching SERO protection subobject,
   when present.  In all cases, the R-bit of a new PROTECTION object is
   reset (0).  Any RROs and EROs present in the incoming Path message
   MUST NOT be included in the recovery LSP.  A new ERO MUST be
   included, with the contents of the SERO that indicated a local
   branch.  As with all EROs, no local information (local address and
   any protection subobjects) is carried in the ERO carried in the
   recovery LSP's outgoing Path message.  The SERO that indicated a
   local branch MUST be omitted from the recovery LSP's outgoing Path
   message.  Note, by default, all other received SEROs are passed in
   the recovery LSP's outgoing Path message.  SEROs MAY be omitted, from
   the recovery LSP's outgoing Path message as well as the outgoing Path
   message for the LSP being protected, when the SERO does not relate to
   the outgoing path message.

   The resulting Path message is used to create the recovery LSP.  From
   this point on, Standard Path message processing is used in processing
   the resulting Path message.

<span class="h4"><a class="selflink" id="section-4.2.1" href="#section-4.2.1">4.2.1</a>.  Branch Failure Handling</span>

   During setup, it is possible that a processing node will be unable to
   support a requested branch.  Additionally, during setup and normal
   operation, PathErr messages may be received at a branch node.  The
   processing of these events depend on a number of factors.

   When a failure or received PathErr message is associated with the LSP
   being protected, the event is first processed per standard processing



<span class="grey">Berger, et al.              Standards Track                    [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   rules.  This includes generation of a standard PathErr message.  When
   LSP state is removed due to a local failure or a PathErr message with
   the Path_State_Removed flag set (1), the node MUST send a PathTear
   message downstream on all other branches.

   When a failure or received PathErr message is associated with a
   recovery LSP, processing is based on the R-bit in addition to the
   Path_State_Removed flag.  In all cases, a received PathErr message is
   first processed per standard processing rules and the failure or
   received PathErr message SHOULD trigger the generation of a PathErr
   message upstream for the LSP being protected.  The outgoing PathErr
   message SHOULD indicate an error of "Routing Problem/LSP Segment
   Protection Failed".  The outgoing PathErr message MUST include any
   SEROs carried in a received PathErr message.  If no SERO is present
   in a received PathErr message or when the failure is local, then an
   SERO that matches the errored LSP or failed branch MUST be added to
   the outgoing PathErr message.

   When a PathErr message with the Path_State_Removed flag cleared (0)
   is received, the outgoing (upstream) PathErr message SHOULD be sent
   with the Path_State_Removed flag cleared (0).

   When a PathErr message for a recovery LSP with the Path_State_Removed
   flag set (1) is received, the processing node MUST examine the R-bit
   (as defined below) of the LSP being protected.  The R-bit is carried
   in the PROTECTION object that triggered the initiation of the
   recovery LSP.  When the R-bit is not set (0), the outgoing (upstream)
   PathErr message SHOULD be sent with the Path_State_Removed flag
   cleared (0).  When the R-bit is set (1), the outgoing (upstream)
   PathErr message MUST be sent with the Path_State_Removed flag set
   (1).

   In all cases where an outgoing (upstream) PathErr message is sent
   with the Path_State_Removed flag set (1), all path state for the LSP
   being protected MUST be removed, and the node MUST send a PathTear
   message downstream on all active branches.

<span class="h4"><a class="selflink" id="section-4.2.2" href="#section-4.2.2">4.2.2</a>.  Resv Message Processing</span>

   Branch nodes will process Resv messages for both recovery LSPs and
   LSPs being protected.  Resv messages are propagated upstream of
   branch nodes only after a Resv message is received for the protected
   LSP.  Resv messages on recovery LSPs will typically not trigger
   transmission of upstream Resv messages (for the LSP being protected).
   Exceptions to this include when RROs/SRROs are being collected and
   during certain ADMIN_STATUS object processing.  See below for more
   information on related processing.




<span class="grey">Berger, et al.              Standards Track                    [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h4"><a class="selflink" id="section-4.2.3" href="#section-4.2.3">4.2.3</a>.  Admin Status Change</span>

   In general, objects in a recovery LSP are created based on the
   corresponding objects in the LSP being protected.  The ADMIN_STATUS
   object is created the same way, but it also requires some special
   coordination at branch nodes.  Specifically, in addition to normal
   processing, a branch node that receives an ADMIN_STATUS object in a
   Path message also MUST relay the ADMIN_STATUS object in a Path on
   every recovery LSP.  All Path messages MAY be concurrently sent
   downstream.

   Downstream nodes process the change in the ADMIN_STATUS object per
   [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>], including generation of Resv messages.  When the most
   recently received upstream ADMIN_STATUS object has the R bit set,
   branch nodes wait for a Resv message with a matching ADMIN_STATUS
   object to be received on all branches before relaying a corresponding
   Resv message upstream.

<span class="h4"><a class="selflink" id="section-4.2.4" href="#section-4.2.4">4.2.4</a>.  Recovery LSP Teardown</span>

   Recovery LSP removal follows standard procedures defined in [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>]
   and [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>].  This includes with and without setting the
   administrative status.

<span class="h5"><a class="selflink" id="section-4.2.4.1" href="#section-4.2.4.1">4.2.4.1</a>.  Teardown Without Admin Status Change</span>

   The node initiating the teardown originates a PathTear message.  Each
   node that receives a PathTear message processes the PathTear message
   per standard processing (see [<a href="./rfc3209" title="&quot;RSVP-TE: Extensions to RSVP for LSP Tunnels&quot;">RFC3209</a>] and [<a href="./rfc2205" title="&quot;Resource ReSerVation Protocol (RSVP) -- Version 1 Functional Specification&quot;">RFC2205</a>]), and MUST also
   relay a PathTear on every recovery LSP.  All PathTear messages
   (received from upstream and locally originated) may be concurrently
   sent downstream.

<span class="h5"><a class="selflink" id="section-4.2.4.2" href="#section-4.2.4.2">4.2.4.2</a>.  Teardown With Admin Status Change</span>

   Per [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>], the ingress node originates a Path message with the D
   and R bits set in the ADMIN_STATUS object.  The admin status change
   procedure defined in <a href="#section-4.2.3">Section 4.2.3</a> MUST then be followed.  Once the
   ingress receives all expected Resv messages, it MUST follow the
   teardown procedure described in <a href="#section-4.2.4.1">Section 4.2.4.1</a>.

<span class="h3"><a class="selflink" id="section-4.3" href="#section-4.3">4.3</a>.  Teardown From Non-Ingress Nodes</span>

   As with any LSP, any node along a recovery LSP may initiate removal
   of the recovery LSP.  To do this, the node initiating the teardown
   sends a PathErr message with the appropriate Error Code and the
   Path_State_Removed flag cleared (0) toward the LSP ingress.  As
   described above, the recovery LSP ingress will propagate the error to



<span class="grey">Berger, et al.              Standards Track                    [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   the LSP ingress, which can then signal the removal of the recovery
   LSP.

   It is also possible for the node initiating the teardown to remove a
   Recovery LSP in a non-graceful manner.  In this case, the initiator
   sends a PathTear message downstream and a PathErr message with a
   "Confirmation" indication (error code and value set to zero), and the
   Path_State_Removed flag set (1) toward the LSP ingress node.  This
   manner of non-ingress node teardown is NOT RECOMMENDED because in
   some cases it can result in the removal of the LSP being protected.

<span class="h4"><a class="selflink" id="section-4.3.1" href="#section-4.3.1">4.3.1</a>.  Modified NOTIFY_REQUEST Object Processing</span>

   A parallel set of rules are applied at branch and merge nodes to
   enable the branch or merge node to add a NOTIFY_REQUEST object to the
   Path and Resv messages of protected and recovery LSPs.  Branch nodes
   add NOTIFY_REQUEST objects to Path messages, and merge nodes add
   NOTIFY_REQUEST objects to Resv messages.

   When a node is branching or merging a recovery LSP, the node SHOULD
   include a single NOTIFY_REQUEST object in the Path message of the
   recovery LSP, in the case of a branch node, or the Resv message of
   the recovery LSP, in the case of a merge node.  The notify node
   address MUST be set to the router address of the processing node.

   Branch and merge nodes SHOULD also add a NOTIFY_REQUEST object to the
   LSP being protected.  For branch nodes, the notify node address is
   set to the address used in the sender template object of the
   associated recovery LSP.  For merge nodes, the notify node address is
   set to the address used in the session object of the associated
   recovery LSP.  A locally added NOTIFY_REQUEST object MUST be listed
   first in an outgoing message; any received NOTIFY_REQUEST objects
   MUST then be listed in the message in the order that they were
   received.  Note that this can result in a stack (or ordered list) of
   objects.

   Normal notification procedures are then followed for the LSP being
   protected.  That is, the notifying node MUST issue a Notify message
   to the recipient indicated by the notify address of the first listed
   NOTIFY_REQUEST object.  Under local policy control, a node issuing a
   Notify message MAY also send a Notify message to the Notify Node
   Address indicated in the last, or any other, NOTIFY_REQUEST object
   carried in the Path or Resv message.

   Recovery LSP merge and branch nodes remove the object added by the
   recovery branch or merge node from outgoing Path and Resv messages
   for the LSP being protected.  This is done by removing the
   NOTIFY_REQUEST object that, in the case of a merge node, matches the



<span class="grey">Berger, et al.              Standards Track                    [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   source address of the recovery LSP and, in the case of a branch node,
   matches the tunnel endpoint address of the recovery LSP.  The
   matching NOTIFY_REQUEST object will normally be the first of the
   listed NOTIFY_REQUEST objects.  Note, to cover certain backwards
   compatibility scenarios, the NOTIFY_REQUEST object SHOULD NOT be
   removed if it is the sole NOTIFY_REQUEST object.

   Note this requires the following change to <a href="./rfc3473#section-4.2.1">[RFC3473], Section&nbsp;4.2.1</a>:

   o old text:
      If a message contains multiple NOTIFY_REQUEST objects, only the
      first object is meaningful.  Subsequent NOTIFY_REQUEST objects MAY
      be ignored and SHOULD NOT be propagated.

   o new text:
      If a message contains multiple NOTIFY_REQUEST objects, only the
      first object used is in notification.  Subsequent NOTIFY_REQUEST
      objects MUST be propagated in the order received.

<span class="h4"><a class="selflink" id="section-4.3.2" href="#section-4.3.2">4.3.2</a>.  Modified Notify and Error Message Processing</span>

   Branch and merge nodes MUST support the following modification to
   Notify message processing.  When a branch or merge node receives
   notification of an LSP failure and it is unable to recover from that
   failure, it MUST notify the node indicated in the first
   NOTIFY_REQUEST object received in the Path message (for branch nodes)
   or Resv message (for merge nodes) associated with the LSP.

<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>.  Secondary Record Route Objects</span>

   Secondary Record Route objects, or SRROs, are used to record the path
   used by recovery LSPs.

<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>.  Format</span>

   The format of a SECONDARY_RECORD_ROUTE object is the same as a
   RECORD_ROUTE object, Class number 21.  This includes the definition
   of subobjects defined for RECORD_ROUTE object.  The class of the
   SECONDARY_RECORD_ROUTE object is 201 (of the form 11bbbbbb).

   The protection subobject defined above can also be used in
   SECONDARY_RECORD_ROUTE objects.









<span class="grey">Berger, et al.              Standards Track                    [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>.  Path Processing</span>

   SRROs may be carried in Path messages and indicate the presence of
   upstream recovery LSPs.  More than one SRRO MAY be added and present
   in a Path message.

   Any received SRRO MUST be transmitted by transit nodes, without
   modification, in the corresponding outgoing Path message.

   SRROs are inserted in Path messages by recovery LSP merge nodes.  The
   SRRO is created by copying the contents of an RRO received by the
   recovery LSP into a new SRRO object.  This SRRO is added to the
   outgoing Path message of the recovered LSP.  Note that multiple SRROs
   may be present.  The collection of SRROs is controlled via the
   segment-recording-desired flag in the SESSION_ATTRIBUTE object.  This
   flag MAY be set even when SEROs are not used.

<span class="h3"><a class="selflink" id="section-5.3" href="#section-5.3">5.3</a>.  Resv Processing</span>

   SRROs may be carried in Resv messages and indicate the presence of
   downstream recovery LSPs.  More than one SRRO MAY be added and
   present in a Resv message.

   Any received SRRO MUST be transmitted by transit nodes, without
   modification, in the corresponding outgoing Resv message.  When Resv
   messages are merged, the resulting merged Resv SHOULD contain all
   SRROs received in downstream Resv messages.

   SRROs are inserted in Resv messages by branch nodes of recovery LSPs.
   The SRRO SHOULD be created with the first two objects being the local
   node address, followed by a protection subobject with the contents of
   the recovery LSP's PROTECTION object.  The remainder of the SRRO
   SHOULD be created by copying the contents of the RRO received by the
   recovery LSP.  This SRRO SHOULD be added to the outgoing Resv message
   of the recovered LSP.  Again, multiple SRROs may be present.

   If the newly added SRRO causes the message to be too big to fit in a
   Resv message, SRRO subobjects SHOULD be removed from any present
   SRROs.  When removing subobjects, the first two subobjects and the
   last subobject in an SRRO MUST NOT be removed.  Note that the
   subobject that followed a removed subobject MUST be updated with the
   L-bit set (1).  If after removing all but the first and last
   subobjects in all SRROs the resulting message is still too large to
   fit, then whole SRROs SHOULD be removed until the message does fit.







<span class="grey">Berger, et al.              Standards Track                    [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>.  Dynamic Control of LSP Segment Recovery</span>

   Dynamic identification of branch and merge nodes is supported via the
   LSP Segment Recovery Flags carried in the PROTECTION object.  The LSP
   Segment Recovery Flags are carried within one of the Reserved fields
   defined in the PROTECTION object defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  LSP Segment
   Recovery Flags are used to indicate when LSP segment recovery is
   desired.  When these bits are set, branch and merge nodes are
   dynamically identified.

   Note, the procedures defined in this section parallel the explicit
   control procedures defined above in <a href="#section-4.2">Section 4.2</a>.  The primary
   difference is in the creation of a recovery LSP's ERO.

<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>.  Modified PROTECTION Object Format</span>

   LSP Segment Recovery Flags are carried in the PROTECTION object of
   the same C-Type defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  The format of the flags are:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |            Length             | Class-Num(37) | C-Type (2)    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |S|P|N|O| Reserved  | LSP Flags |     Reserved      | Link Flags|
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |I|R|   Reserved    | Seg.Flags |           Reserved            |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      In-Place (I): 1 bit

         When set (1) indicates that the desired segment recovery type
         indicated in the LSP Segment Recovery Flag is already in place
         for the associated LSP.

      Required (R): 1 bit

         When set (1) indicates that failure to establish the indicated
         protection should result in a failure of the LSP being
         protected.

      Segment Recovery Flags (Seg.Flags): 6 bits

         This field is used to indicate when an upstream node desires
         LSP Segment recovery to be dynamically initiated where
         possible.  The values used in this field are identical to the
         values defined for LSP Flags; see [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].




<span class="grey">Berger, et al.              Standards Track                    [Page 16]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-17" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   See [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>] for the definition of other fields.

<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>.  Dynamic Control Procedures</span>

   LSP Segment Recovery Flags are set to indicate that LSP segment
   recovery is desired for the LSP being signaled.  The type of recovery
   desired is indicated by the flags.  The decision to set the LSP
   Segment Recovery Flags is a local matter and outside the scope of
   this document.  A value of zero (0) means that no dynamic
   identification of segment recovery branch nodes are needed for the
   associated LSP.  When the In-Place bit is set, it means that the
   desired type of recovery is already in place for that particular LSP.

   A transit node receiving a Path message containing a PROTECTION
   object with a non-zero LSP Segment Recovery Flags value and the In-
   Place bit clear (0) SHOULD consider if it can support the indicated
   recovery type and if it can identify an appropriate merge node for a
   recovery LSP.  Dynamic identification MUST NOT be done when the
   processing node is identified as a branch node in an SERO.  If a node
   is unable to provide the indicated recovery type or identify a merge
   node, the Path message MUST be processed normally, and the LSP
   Segment Recovery Flags MUST NOT be modified.

   When a node dynamically identifies itself as a branch node and
   identifies the merge node for the type of recovery indicated in the
   LSP Segment Recovery Flags, it attempts to setup a recovery LSP.  The
   dynamically identified information, together with the Path message of
   LSP being recovered, is used to create the recovery LSP.

   The Path message for the recovery LSP is created at the branch node
   by cloning the objects carried in the incoming Path message of the
   LSP being protected.  Certain objects are replaced or modified in the
   recovery LSP's outgoing Path message.  The Sender_template object
   MUST be updated to use an address (in its Tunnel Sender Address
   field) on the local node, and the LSP ID MUST be updated to ensure
   uniqueness.  The Session object MUST be updated to use the address of
   the dynamically identified merge node as the tunnel endpoint address,
   the tunnel ID MAY be updated, and the extended tunnel ID MUST be set
   to the local node address.  The PROTECTION object is updated with the
   In-Place bit set (1).  Any RROs and EROs present in the incoming Path
   message MUST NOT be included in the recovery LSP.  A new ERO MAY be
   created based on any path information dynamically computed by the
   local node.








<span class="grey">Berger, et al.              Standards Track                    [Page 17]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-18" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   The resulting Path message is used to create the recovery LSP.  While
   the recovery LSP exists, the PROTECTION object in the original Path
   message  (unless overridden by local policy) MUST also be updated
   with the In-Place bit set (1).  From this point on, Standard Path
   message processing is used in processing the resulting and original
   Path messages.

   The merge node of a dynamically controlled recovery LSP SHOULD reset
   (0) the In-Place bit in the PROTECTION object of the outgoing Path
   message associated with the terminated recovery LSP.

   Unlike with explicit control, if the creation of a dynamically
   identified recovery LSP fails for any reason, the recovery LSP is
   removed, and no error message or indication is sent upstream.  With
   this exception, all the other procedures for explicitly controlled
   recovery LSPs apply to dynamically controlled recovery LSPs.  These
   other procedures are defined above in Sections <a href="#section-4.2.1">4.2.1</a> through <a href="#section-4.2.4">4.2.4</a>.

<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>.  Updated RSVP Message Formats</span>

   This section presents the RSVP message related formats as modified by
   this document.  Where they differ, formats for unidirectional LSPs
   are presented separately from bidirectional LSPs.

   The format of a Path message is as follows:

   &lt;Path Message&gt; ::=   &lt;Common Header&gt; [ &lt;INTEGRITY&gt; ]
                        [ [&lt;MESSAGE_ID_ACK&gt; | &lt;MESSAGE_ID_NACK&gt;] ... ]
                        [ &lt;MESSAGE_ID&gt; ]
                        &lt;SESSION&gt; &lt;RSVP_HOP&gt;
                        &lt;TIME_VALUES&gt;
                        [ &lt;EXPLICIT_ROUTE&gt; ]
                         &lt;LABEL_REQUEST&gt;
                         [ &lt;PROTECTION&gt; ]
                         [ &lt;LABEL_SET&gt; ... ]
                         [ &lt;SESSION_ATTRIBUTE&gt; ]
                         [ &lt;NOTIFY_REQUEST&gt; ... ]
                         [ &lt;ADMIN_STATUS&gt; ]
                         [ &lt;ASSOCIATION&gt; ... ]
                         [ &lt;SECONDARY_EXPLICIT_ROUTE&gt; ... ]
                         [ &lt;POLICY_DATA&gt; ... ]
                         &lt;sender descriptor&gt;









<span class="grey">Berger, et al.              Standards Track                    [Page 18]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-19" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   The format of the sender description for unidirectional LSPs is:

   &lt;sender descriptor&gt; ::=  &lt;SENDER_TEMPLATE&gt; &lt;SENDER_TSPEC&gt;
                            [ &lt;ADSPEC&gt; ]
                            [ &lt;RECORD_ROUTE&gt; ]
                            [ &lt;SUGGESTED_LABEL&gt; ]
                            [ &lt;RECOVERY_LABEL&gt; ]
                            [ &lt;SECONDARY_RECORD_ROUTE&gt; ... ]

   The format of the sender description for bidirectional LSPs is:

   &lt;sender descriptor&gt; ::=  &lt;SENDER_TEMPLATE&gt; &lt;SENDER_TSPEC&gt;
                            [ &lt;ADSPEC&gt; ]
                            [ &lt;RECORD_ROUTE&gt; ]
                            [ &lt;SUGGESTED_LABEL&gt; ]
                            [ &lt;RECOVERY_LABEL&gt; ]
                            &lt;UPSTREAM_LABEL&gt;
                            [ &lt;SECONDARY_RECORD_ROUTE&gt; ... ]

   The format of a PathErr message is as follows:

   &lt;PathErr Message&gt; ::= &lt;Common Header&gt; [ &lt;INTEGRITY&gt; ]
                         [ [&lt;MESSAGE_ID_ACK&gt; | &lt;MESSAGE_ID_NACK&gt;] ... ]
                         [ &lt;MESSAGE_ID&gt; ]
                         &lt;SESSION&gt; &lt;ERROR_SPEC&gt;
                         [ &lt;ACCEPTABLE_LABEL_SET&gt; ... ]
                         [ &lt;SECONDARY_EXPLICIT_ROUTE&gt; ... ]
                         [ &lt;POLICY_DATA&gt; ... ]
                         &lt;sender descriptor&gt;

   The format of a Resv message is as follows:

   &lt;Resv Message&gt; ::=    &lt;Common Header&gt; [ &lt;INTEGRITY&gt; ]
                         [ [&lt;MESSAGE_ID_ACK&gt; | &lt;MESSAGE_ID_NACK&gt;] ... ]
                         [ &lt;MESSAGE_ID&gt; ]
                         &lt;SESSION&gt; &lt;RSVP_HOP&gt;
                         &lt;TIME_VALUES&gt;
                         [ &lt;RESV_CONFIRM&gt; ]  [ &lt;SCOPE&gt; ]
                         [ &lt;NOTIFY_REQUEST&gt; ... ]
                         [ &lt;ADMIN_STATUS&gt; ]
                         [ &lt;POLICY_DATA&gt; ... ]
                         &lt;STYLE&gt; &lt;flow descriptor list&gt;

   &lt;flow descriptor list&gt; ::= &lt;FF flow descriptor list&gt;
                            | &lt;SE flow descriptor&gt;






<span class="grey">Berger, et al.              Standards Track                    [Page 19]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-20" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   &lt;FF flow descriptor list&gt; ::= &lt;FLOWSPEC&gt; &lt;FILTER_SPEC&gt;
                            &lt;LABEL&gt; [ &lt;RECORD_ROUTE&gt; ]
                            [ &lt;SECONDARY_RECORD_ROUTE&gt; ... ]
                            | &lt;FF flow descriptor list&gt;
                            &lt;FF flow descriptor&gt;

   &lt;FF flow descriptor&gt; ::= [ &lt;FLOWSPEC&gt; ] &lt;FILTER_SPEC&gt; &lt;LABEL&gt;
                            [ &lt;RECORD_ROUTE&gt; ]
                            [ &lt;SECONDARY_RECORD_ROUTE&gt; ... ]

   &lt;SE flow descriptor&gt; ::= &lt;FLOWSPEC&gt; &lt;SE filter spec list&gt;

   &lt;SE filter spec list&gt; ::= &lt;SE filter spec&gt;
                            | &lt;SE filter spec list&gt; &lt;SE filter spec&gt;

   &lt;SE filter spec&gt; ::=     &lt;FILTER_SPEC&gt; &lt;LABEL&gt; [ &lt;RECORD_ROUTE&gt; ]
                            [ &lt;SECONDARY_RECORD_ROUTE&gt; ... ]

<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>.  Security Considerations</span>

   This document introduces new message objects for use in GMPLS
   signaling [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>].  It does not introduce any new signaling
   messages, nor change the relationship between LSRs that are adjacent
   in the control plane.

   The procedures defined in this document result in an increase in the
   amount of topology information carried in signaling messages since
   the presence of SEROs and SRROs necessarily means that there is more
   information about LSP paths carried than in simple EROs and RROs.
   Thus, in the event of the interception of a signaling message,
   slightly more could be deduced about the state of the network than
   was previously the case, but this is judged to be a very minor
   security risk as this information is already available via routing.

   Otherwise, this document introduces no additional security
   considerations.  See [<a href="./rfc3473" title="&quot;Generalized Multi-Protocol Label Switching (GMPLS) Signaling - Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions&quot;">RFC3473</a>] for relevant security considerations.















<span class="grey">Berger, et al.              Standards Track                    [Page 20]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-21" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>.  IANA Considerations</span>

   IANA has assigned the following values for the namespaces defined in
   this document and reviewed in this section.

<span class="h3"><a class="selflink" id="section-9.1" href="#section-9.1">9.1</a>.  New Association Type Assignment</span>

   IANA has made the following assignment to the "GMPLS Signaling
   Parameters" Registry (see [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>]) located at
   <a href="http://www.iana.org/assignments/gmpls-sig-parameters">http://www.iana.org/assignments/gmpls-sig-parameters</a>.

      Value       Type
      -----       ----
        2         Resource Sharing (R) [<a href="./rfc4873">RFC4873</a>]

<span class="h3"><a class="selflink" id="section-9.2" href="#section-9.2">9.2</a>.  Definition of PROTECTION Object Reserved Bits</span>

   This document defines bits carried in the Reserved field of the
   PROTECTION object defined in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>].  As no IANA registry for
   these bits is requested in [<a href="./rfc4872" title="&quot;RSVP-TE Extensions in support of End-to-End Generalized Multi-Protocol Label Switching (GMPLS) Recovery&quot;">RFC4872</a>], no IANA action is required
   related to this definition.

<span class="h3"><a class="selflink" id="section-9.3" href="#section-9.3">9.3</a>.  Secondary Explicit Route Object</span>

   IANA has made the following assignments in the "Class Names, Class
   Numbers, and Class Types" section of the "RSVP PARAMETERS" registry
   located at <a href="http://www.iana.org/assignments/rsvp-parameters">http://www.iana.org/assignments/rsvp-parameters</a>.

   A new class named SECONDARY_EXPLICIT_ROUTE has been created in the
   11bbbbbb range (200) with the following definition:
      Class Types or C-types:

      Same values as EXPLICIT_ROUTE object (C-Num 20)

      For Class 1, C-Type 1, the following additional Subobject type is
      defined:

         37   PROTECTION              [<a href="./rfc4873">RFC4873</a>]

<span class="h3"><a class="selflink" id="section-9.4" href="#section-9.4">9.4</a>.  Secondary Record Route Object</span>

   IANA has made the following assignments in the "Class Names, Class
   Numbers, and Class Types" section of the "RSVP PARAMETERS" registry
   located at <a href="http://www.iana.org/assignments/rsvp-parameters">http://www.iana.org/assignments/rsvp-parameters</a>.







<span class="grey">Berger, et al.              Standards Track                    [Page 21]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-22" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


   A new class named SECONDARY_RECORD_ROUTE has been created in the
   11bbbbbb range (201) with the following definition:

      Class Types or C-types:

      Same values as RECORD_ROUTE object (C-Num 21)

      For Class 1, C-Type 1, the following additional Subobject type is
      defined:

         37   PROTECTION              [<a href="./rfc4873">RFC4873</a>]

<span class="h3"><a class="selflink" id="section-9.5" href="#section-9.5">9.5</a>.  New Error Code</span>

   IANA has made the following assignments in the "Routing Problem"
   subsection of "Error Codes and Values" section of the "RSVP
   PARAMETERS" registry located at
   <a href="http://www.iana.org/assignments/rsvp-parameters">http://www.iana.org/assignments/rsvp-parameters</a>.

   21 = LSP Segment Protection Failed [<a href="./rfc4873">RFC4873</a>]

<span class="h3"><a class="selflink" id="section-9.6" href="#section-9.6">9.6</a>.  Use of PROTECTION Object C-type</span>

   This document modifies the PROTECTION object, class number 37, C-Type
   2 (defined in <a href="./rfc4872#section-14.1">Section&nbsp;14.1. of [RFC4872]</a>).


























<span class="grey">Berger, et al.              Standards Track                    [Page 22]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-23" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


<span class="h2"><a class="selflink" id="section-10" href="#section-10">10</a>.  References</span>

<span class="h3"><a class="selflink" id="section-10.1" href="#section-10.1">10.1</a>.  Normative References</span>

   [<a id="ref-RFC2119">RFC2119</a>]   Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.

   [<a id="ref-RFC2205">RFC2205</a>]   Braden, R., Zhang, L., Berson, S., Herzog, S., and S.
               Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1
               Functional Specification", <a href="./rfc2205">RFC 2205</a>, September 1997.

   [<a id="ref-RFC3209">RFC3209</a>]   Awduche, D., Berger, L., Gan, D., Li, T., Srinivasan, V.,
               and G. Swallow, "RSVP-TE: Extensions to RSVP for LSP
               Tunnels", <a href="./rfc3209">RFC 3209</a>, December 2001.

   [<a id="ref-RFC3471">RFC3471</a>]   Berger, L., Ed., "Generalized Multi-Protocol Label
               Switching (GMPLS) Signaling Functional Description", <a href="./rfc3471">RFC</a>
               <a href="./rfc3471">3471</a>, January 2003.

   [<a id="ref-RFC3473">RFC3473</a>]   Berger, L., Ed., "Generalized Multi-Protocol Label
               Switching (GMPLS) Signaling - Resource ReserVation
               Protocol-Traffic Engineering (RSVP-TE) Extensions", <a href="./rfc3473">RFC</a>
               <a href="./rfc3473">3473</a>, January 2003.

   [<a id="ref-RFC4872">RFC4872</a>]   Lang, J.P., Ed., Rekhter, Y., Ed., and D. Papadimitriou,
               Ed., "RSVP-TE Extensions in support of End-to-End
               Generalized Multi-Protocol Label Switching (GMPLS)
               Recovery", <a href="./rfc4872">RFC 4872</a>, May 2007.

<span class="h3"><a class="selflink" id="section-10.2" href="#section-10.2">10.2</a>.  Informative References</span>

   [<a id="ref-RFC4090">RFC4090</a>]   Pan, P., Swallow, G., and A. Atlas, "Fast Reroute
               Extensions to RSVP-TE for LSP Tunnels", <a href="./rfc4090">RFC 4090</a>, May
               2005.

   [<a id="ref-RFC4426">RFC4426</a>]   Lang, J., Ed., Rajagopalan, B., Ed., and D.
               Papadimitriou, Ed., "Generalized Multi-Protocol Label
               Switching (GMPLS) Recovery Functional Specification," <a href="./rfc4426">RFC</a>
               <a href="./rfc4426">4426</a>, March 2006.

   [<a id="ref-RFC4427">RFC4427</a>]   Mannie, E., Ed., and D. Papadimitriou, Ed., "Recovery
               (Protection and Restoration) Terminology for Generalized
               Multi-Protocol Label Switching (GMPLS)", <a href="./rfc4427">RFC 4427</a>, March
               2006.







<span class="grey">Berger, et al.              Standards Track                    [Page 23]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-24" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


Authors' Addresses

   Lou Berger
   LabN Consulting, L.L.C.

   Phone:  +1 301-468-9228
   EMail:  lberger@labn.net


   Igor Bryskin
   ADVA Optical
   7926 Jones Branch Drive
   Suite 615
   McLean VA, 22102

   EMail:  IBryskin@advaoptical.com


   Dimitri Papadimitriou
   Alcatel
   Francis Wellesplein 1
   B-2018 Antwerpen, Belgium

   Phone:  +32 3 240-8491
   EMail:  dimitri.papadimitriou@alcatel-lucent.be


   Adrian Farrel
   Old Dog Consulting

   Phone:  +44 (0) 1978 860944
   EMail:  adrian@olddog.co.uk



















<span class="grey">Berger, et al.              Standards Track                    [Page 24]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-25" ></span>
<span class="grey"><a href="./rfc4873">RFC 4873</a>                 GMPLS Segment Recovery                 May 2007</span>


Full Copyright Statement

   Copyright (C) The IETF Trust (2007).

   This document is subject to the rights, licenses and restrictions
   contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   <a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.







Berger, et al.              Standards Track                    [Page 25]
</pre>