RFC 4781

Graceful Restart Mechanism for BGP with MPLS

📅 published January 2007, from ietf

RFC 4781: Graceful Restart Mechanism for BGP with MPLS 🎀✨

Okay bestie, let's get the important facts out of the way first. 💅 This is RFC 4781, published in January 2007 by the Network Working Group. The authors are Y. Rekhter and R. Aggarwal from Juniper Networks. It's a Standards Track doc, so it's a real spec people are supposed to implement. It doesn't list anything it obsoletes or updates. 🦋

Status of This Memo 📝

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. 🌸 If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 💖

Copyright Notice ©️

Copyright (C) The Internet Society (2007).

Abstract 🧚

okay so BGP already has a mechanism that helps cut down on the routing mess when BGP restarts. It's described in its own separate doc ("Graceful Restart Mechanism for BGP") 🫶. This doc takes that same idea and extends it to the MPLS forwarding side. The goal is to limit the damage on MPLS forwarding when an LSR's control plane restarts, specifically when its BGP component restarts, in the case where BGP is carrying MPLS labels and the LSR can keep its MPLS forwarding state through the restart. ✨

The mechanism is also totally chill about which address types show up in the BGP Network Layer Reachability Information (NLRI) field. So it works with any address family BGP can carry (IPv4, IPv6, and so on). It's giving flexible 💅

Table of Contents 📚

1. Introduction ....................................................2
   1.1. Specification of Requirements ..............................3
2. General Requirements ............................................3
3. Capability Advertisement ........................................4
4. Procedures for the Restarting LSR ...............................4
   4.1. Case 1 .....................................................4
   4.2. Case 2 .....................................................5
   4.3. Case 3 .....................................................5
5. Alternative Procedures for the Restarting LSR ...................6
6. Procedures for a Neighbor of a Restarting LSR ...................6
7. Comparison between Alternative Procedures for the
   Restarting LSR ..................................................7
8. Security Considerations .........................................8
9. Acknowledgments .................................................9
10. References .....................................................9
   10.1. Normative References ......................................9
   10.2. Informative References ....................................9

1. Introduction 🌈

Picture this: an LSR (Label Switching Router) can keep its MPLS forwarding state even when its control plane restarts, especially its BGP part, and BGP is what's carrying the MPLS labels (like in [RFC3107]). In that case it may be desirable to not disturb the LSPs going through that LSR after the BGP component fails or restarts. That includes the LSPs that BGP set up. 🦋 This doc describes a mechanism that gets you there. It works together with the mechanism in [RFC4724], and it places no restrictions on which address types (address families) it can support. 💜

This mechanism applies to all LSRs. That includes the ones that can keep their forwarding state during a BGP restart and the ones that can't, though the ones that can't only need to implement a subset of it. 🙈 Now, an LSR that can't preserve its MPLS forwarding state across a restart won't reduce the negative impact on MPLS traffic just by supporting that subset. The impact does get smaller if its neighbors can keep their forwarding state across their own control plane restarts and they implement this mechanism too. 🫶 The subset is every procedure in this document except the ones in Sections 4.1, 4.2, 4.3, and 5.

For brevity, when we say "MPLS forwarding state," we mean one of these mappings:

<incoming label -> (outgoing label, next hop)>
<Forwarding Equivalence Class (FEC) -> (outgoing label, next hop)>
<incoming label -> label pop, next hop>
<incoming label, label pop>

In this document, the forwarding state that [RFC4724] talks about means MPLS forwarding state, as defined above. And "next hop" means the next hop as advertised in BGP. 🍓

1.1. Specification of Requirements 🔑

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💅

2. General Requirements 📋

Okay, first things first 👑: an LSR MUST implement the Graceful Restart Mechanism for BGP, as specified in [RFC4724]. Second, the LSR SHOULD be capable of preserving its MPLS forwarding state across the restart of its control plane (including the restart of BGP). Third, for the <Forwarding Equivalence Class (FEC) -> label> bindings distributed via BGP, the LSR SHOULD be able either (a) to reconstruct the same bindings it had before the restart (see Section 4), or (b) to create new <FEC -> label> bindings after restart, while temporarily keeping MPLS forwarding state for both the bindings from before the restart and the newly created bindings (see Section 5). 🦋

Fourth, as long as the LSR keeps the MPLS forwarding state it preserved across the restart, the labels from that state cannot be used to create new local label bindings. They can be used to reconstruct the existing bindings, per the procedures in Section 4. 🫶 Finally, for each next hop, if that next hop is reachable via a Label Switched Path (LSP), then the restarting LSR MUST be able to preserve the MPLS forwarding state associated with that LSP across the restart. 🔥

Now here's a twist 🌀. Sometimes label bindings on an LSR are created or maintained not just by the BGP component, but also by other protocol components (like LDP or RSVP-TE). And the LSR might restart those components individually (say BGP restarts but LDP doesn't). In that case the LSR MUST be able to preserve, across the restart, the information about which protocol assigned which labels. 💜

After the LSR restarts, it MUST follow the procedures specified in [RFC4724]. On top of that, if the LSR can preserve its MPLS forwarding state across the restart, the LSR SHOULD tell its neighbors by appropriately setting the Flag for Address Family field in the Graceful Restart Capability for all applicable AFI/SAFI pairs. ✨

3. Capability Advertisement 📣

An LSR that supports the mechanism in this document tells its peer about it by using the Graceful Restart Capability, as specified in [RFC4724]. The Subsequent Address Family Identifier (SAFI) in the advertised capability MUST indicate that the Network Layer Reachability Information (NLRI) field carries not only addressing information, but also labels (see [RFC3107] for an example of an NLRI carrying labels). It's the main character move for SAFI 🎀.

4. Procedures for the Restarting LSR 🔄

The procedures in this section apply when a restarting LSR is able to reconstruct the same <FEC -> label> bindings it had before the restart. 🧚

The procedures here are conceptual. You don't have to implement them exactly as written, as long as your implementation provides the described functionality and its externally visible behavior is the same. 🌸

Once the LSR completes its route selection (as specified in Section 4.1, "Procedures for the Restarting Speaker", of [RFC4724]), then in addition to those procedures, the LSR does one of the following:

4.1. Case 1 🎯

This applies when (a) the best route the LSR selected was received with a label, (b) that label is not an Implicit NULL, and (c) the LSR advertises this route with itself as the next hop.

In this case, the LSR searches its MPLS forwarding state (the state preserved across the restart) for an entry with <outgoing label, next hop> equal to the one in the received route. If it finds such an entry, the LSR no longer marks the entry as stale. ✅ Also, if the entry is of type <incoming label, (outgoing label, next hop)> rather than <Forwarding Equivalence Class (FEC), (outgoing label, next hop)>, the LSR uses the incoming label from the entry when advertising the route to its neighbors. If the found entry has no incoming label, or if no such entry is found at all, the LSR allocates a new label when advertising the route to its neighbors. (This assumes there are neighbors the LSR has to advertise the route to with a label.) 💖

4.2. Case 2 🌷

This applies when (a) the best route the LSR selected was received either without a label, with an Implicit NULL label, or the route was originated by the LSR; (b) the LSR advertises this route with itself as the next hop; and (c) the LSR has to generate a (non-Implicit NULL) label for the route.

In this case, the LSR searches its MPLS forwarding state for an entry that indicates the LSR has to perform a label pop, with the next hop equal to the next hop of the route in question. If it finds such an entry, the LSR uses the incoming label from that entry when advertising the route to its neighbors. If no such entry is found, the LSR allocates a new label when advertising the route to its neighbors. 🫶

The paragraph above assumes the LSR generates the same label for all the routes with the same next hop. If that's not the case, and the LSR generates a unique label for each such route, then the LSR needs to preserve across the restart not only the <incoming label, (outgoing label, next hop)> mapping, but also the Forwarding Equivalence Class (FEC) associated with that mapping. 🤯 In that case the LSR would search its MPLS forwarding state for an entry that (a) indicates label pop (meaning no outgoing label), (b) indicates the next hop equal to the next hop of the route, and (c) has the same FEC as the route. If it finds such an entry, the LSR uses the incoming label from the entry when advertising the route to its neighbors. If no such entry is found, the LSR allocates a new label when advertising the route to its neighbors. 🎀

4.3. Case 3 🌙

This applies when the LSR does not set the BGP next hop to self.

In this case, when advertising its best route for a particular NLRI, the LSR just uses the label that was received with that route. And if the route was received with no label, the LSR advertises the route with no label as well. Either way, the LSR does not allocate a label for that route. 🧸

5. Alternative Procedures for the Restarting LSR 🦋

okay so this section is a whole alternative to the procedures in Section "Procedures for the restarting LSR" 💅

These procedures kick in when a restarting LSR does NOT rebuild the same <FEC -> label> bindings it had before the restart. Instead, it makes brand new <FEC -> label> bindings after the restart, and for a while it keeps MPLS forwarding state for both the old bindings AND the new ones. two outfits at once, no cap 👗✨

The procedures in this section require that, for use by BGP graceful restart, the LSR SHOULD have (at least) as many unallocated labels as labels allocated for the <FEC -> label> bindings distributed by BGP. The BGP ones are the MPLS forwarding state the LSR managed to keep across the restart. The unallocated ones are what it uses for allocating labels after the restart 🧚

To create new local label bindings after the restart, the LSR uses unallocated labels. (this is pretty much the normal procedure, lowkey 🌸)

The LSR SHOULD retain the MPLS forwarding state it preserved across the restart at least until the LSR sends an End-of-RIB marker to all of its neighbors. by that point the LSR has already finished its route selection process and advertised its Adj-RIB-Out to its neighbors 💜 The LSR MAY retain the forwarding state even a bit longer, and the amount of extra time MAY be controlled by configuration on the LSR. the point of that extra time is to give the neighbors a chance to receive and process the routes the LSR advertised 🫶 After that, the LSR SHOULD delete the MPLS forwarding state that it preserved across the restart.

Note that while an LSR is in the middle of restarting, it may have not one, but TWO local label bindings for a given BGP route. one was retained from before the restart, and the other was created after it 👀 Once the LSR completes its restart, the former gets deleted. but both of these bindings have the same outgoing label (and the same next hop), so honestly it's giving continuity 🍓

6. Procedures for a Neighbor of a Restarting LSR 🎀

The neighbor of a restarting LSR (the receiving router terminology used in [RFC4724]) follows the procedures specified in [RFC4724]. so the neighbor just follows the same rules as the RFC that defines graceful restart 📖 On top of that, the neighbor treats the MPLS labels it gets from the restarting LSR the same way it treats the routes it gets from that LSR, both before AND after the restart. labels and routes, same energy ✨

Replacing the stale routes with the routing updates from the restarting LSR involves replacing or updating the appropriate MPLS labels. so the labels get the same glow-up as the routes 💅

Also, if the Flags in the Graceful Restart Capability received from the restarting LSR indicate that the LSR wasn't able to retain its MPLS state across the restart, the neighbor SHOULD immediately remove all the NLRI and the associated MPLS labels that it previously acquired via BGP from the restarting LSR. bye bye, no leftovers 🙈

An LSR, once it creates a binding between a label and a Forwarding Equivalence Class (FEC), SHOULD keep the value of the label in this binding for as long as the LSR has a route to the FEC in the binding. hot take: stability is everything 💖 If the route to the FEC disappears and then re-appears later, the LSR may end up using a different label value, because when the route comes back, the LSR creates a new <label, FEC> binding. so the label can change in that case 🦋

To minimize the potential misrouting caused by the label change, when creating a new <label, FEC> binding, the LSR SHOULD pick up the least recently used label. Once an LSR releases a label, the LSR SHALL NOT re-use this label for advertising a <label, FEC> binding to a neighbor that supports graceful restart for at least the Restart Time, as advertised by the neighbor to the LSR. This rule SHALL apply to any label release at any time. this one is non-negotiable, bestie 🚫🫶

7. Comparison between Alternative Procedures for the Restarting LSR 💜

so here's the tea on the two approaches ☕

Procedures described in Section 4 involve more computational overhead on the restarting router than do the procedures described in Section 5. so Section 4 is more work for the restarting router 😩

Procedures described in Section 5 require twice as many labels as those described in Section 4. so Section 5 is the label-hungry one 🏷️

Procedures described in Section 4 cause fewer changes to the MPLS forwarding state in the neighbors of the restarting router than the procedures described in Section 5. so Section 4 is the chill option for the neighbors 🌈

In principle, it is possible for an LSR to use procedures described in Section 4 for some AFI/SAFI(s) and procedures described in Section 5 for other AFI/SAFI(s). mix and match is allowed, iykyk 🧚

8. Security Considerations 💀

The security considerations pertaining to the BGP protocol [RFC4271] remain relevant. the old BGP security stuff still applies, sorry not sorry 🙃

In addition, the mechanism described here makes LSRs that implement it vulnerable to additional denial-of-service attacks, as follows:

An intruder may impersonate a BGP peer in order to force a failure and reconnection of the TCP connection, where the intruder sets the Forwarding State (F) bit (as defined in [RFC4724]) to 0 on reconnection. This forces all labels received from the peer to be released. 😱
An intruder could intercept the traffic between BGP peers and override the setting of the Forwarding State (F) bit to be set to 0. This forces all labels received from the peer to be released. 😭

All of these attacks may be countered by use of an authentication scheme between BGP peers, such as the scheme outlined in [RFC2385]. so yes, authentication is the fix 🔐

As with BGP carrying labels, a security issue may exist if a BGP implementation continues to use labels after expiration of the BGP session that first caused them to be used. this may arise if the upstream LSR detects the session failure after the downstream LSR has released and re-used the label. The problem is most obvious with the platform-wide label space, and it could result in misrouting of data to destinations other than those intended. it's also conceivable that these behaviors may be deliberately exploited, either to obtain services without authorization or to deny services to others. this is the scary part, not gonna lie 🥺

In this document, the validity of the BGP session may be extended by the Restart Time, and the session may be re-established in this period. After the expiry of the Restart Time, the session must be considered to have failed, and the same security issue applies as described above.

However, the downstream LSR may declare the session as failed before the expiration of its Restart Time. This increases the period during which the downstream LSR might reallocate the label while the upstream LSR continues to transmit data using the old usage of the label. To reduce this issue, this document requires that labels are not re-used until at least the Restart Time. so the fix is to hold labels until the Restart Time is up 🛡️✨

9. Acknowledgments 🌸

We would like to thank Chaitanya Kodeboyina and Loa Andersson for their review and comments. The approach described in Section 5 is based on the idea suggested by Manoj Leelanivas. big thank-yous to these legends 🫶💖

10. References 📚

10.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2385] Heffernan, A., "Protection of BGP Sessions via the TCP MD5 Signature Option", RFC 2385, August 1998.
[RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006.
[RFC4724] Sangli, S., Chen, E., Fernando, R., Scudder, J., and Y. Rekhter, "Graceful Restart Mechanism for BGP", RFC 4724, January 2007.

10.2. Informative References

[RFC3107] Rekhter, Y. and E. Rosen, "Carrying Label Information in BGP-4", RFC 3107, May 2001.

Authors' Addresses 💌

Yakov Rekhter
Juniper Networks
1194 N.Mathilda Ave
Sunnyvale, CA 94089

EMail: yakov@juniper.net


Rahul Aggarwal
Juniper Networks
1194 N.Mathilda Ave
Sunnyvale, CA 94089

EMail: rahul@juniper.net

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🔍

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 🎉

Funding for the RFC Editor function is currently provided by the Internet Society. 💜

📦 where this page comes from

ietf: rfc4781 2007-01
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms