RFC 6041
Forwarding and Control Element Separation (ForCES) Applicability Statement
🎀 RFC 6041: Forwarding and Control Element Separation (ForCES) Applicability Statement 🦋
- RFC number and title: RFC 6041, Forwarding and Control Element Separation (ForCES) Applicability Statement 💅
- Authors: A. Crouch, H. Khosravi (Intel), A. Doria, Ed. (LTU), X. Wang (Huawei), and K. Ogawa (NTT Corporation) 👑
- Category: Informational, so it's not a standard, just useful info 🧚
- Date: October 2010 📅
- ISSN: 2070-1721 🔥
- Obsoletes and updates: The header has no Obsoletes or Updates line, so this RFC doesn't replace or update any other RFC 🫶
Abstract ✨
okay so ForCES is this standard framework and mechanism for connecting control elements and forwarding elements in IP routers and similar devices 🌸 this doc is all about where ForCES fits, with example deployment scenarios and what it can do, plus the apps where ForCES would be a total no 💀
Status of This Memo 📋
bestie, this one's not an Internet Standards Track spec, it's just published for info purposes 🍓
it's a product of the IETF, so it reflects what the IETF community agreed on 🌈 it got public review and the IESG approved it for publication ✨ but not everything the IESG approves is up for any level of Internet Standard. check Section 2 of RFC 5741 for that 🦋
you can find the current status, errata, and ways to send feedback at http://www.rfc-editor.org/info/rfc6041 💜
Copyright Notice ⚖️
Copyright (c) 2010 IETF Trust and the people listed as document authors. All rights reserved 🎀
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents at http://trustee.ietf.org/license-info, which were in effect on the publication date 📜 please read them carefully because they spell out your rights and restrictions 🫶 any Code Components pulled out of this doc have to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty as described in that license 💅
this doc might contain stuff from IETF Documents or IETF Contributions that were published or publicly available before November 10, 2008 😭 the people who own the copyright on some of that material might not have given the IETF Trust permission to allow changes outside the IETF Standards Process. so unless you get a proper license from those copyright holders, this doc can't be modified outside the IETF Standards Process, and derivative works can't be made outside it either. the exceptions are formatting it for publication as an RFC or translating it into languages other than English 🌸
Table of Contents 🗺️
1. Introduction ....................................................3
2. Purpose .........................................................4
3. Terminology .....................................................4
4. Applicability to IP Networks ....................................4
4.1. Applicable Services ........................................5
4.1.1. Association, Capability Discovery, and
Information Exchange ................................5
4.1.2. Topology Information Exchange .......................6
4.1.3. Configuration .......................................6
4.1.4. Routing Exchange ....................................6
4.1.5. QoS Capabilities Exchange and Configuration .........7
4.1.6. Security Exchange ...................................7
4.1.7. Filtering Exchange and Firewalls ....................7
4.1.8. Encapsulation/Tunneling Exchange ....................7
4.1.9. NAT and Application-Level Gateways ..................7
4.1.10. Measurement and Accounting .........................7
4.1.11. Diagnostics ........................................8
4.1.12. Redundancy and Failover ............................8
4.2. CE-FE Link Capability ......................................8
4.3. CE/FE Locality .............................................8
5. Security Considerations .........................................9
6. ForCES Manageability ............................................9
6.1. The NE as an Atomic Element ...............................10
6.2. The NE as Composed of Manageable Elements .................10
6.3. ForCES Protocol MIB .......................................10
6.3.1. MIB Management of an FE ............................11
6.4. The FEM and CEM ...........................................12
7. Contributors ...................................................12
8. Acknowledgments ................................................12
9. References .....................................................12
9.1. Normative References ......................................12
9.2. Informative References ....................................131. Introduction 🌷
okay so ForCES is a standard framework and mechanism for swapping info between the logically separate control plane and data forwarding plane of IP routers and similar devices 🧠 it's all about the communication needed to split control plane stuff, like routing protocols, signaling protocols, and admission control, away from the data forwarding plane's per-packet work, like packet forwarding, queuing, and header editing ✨
this doc defines where the ForCES mechanisms apply 💖 it describes the types of configurations and settings where ForCES fits best, and it also covers the scenarios where ForCES would not be a good idea 🙈
2. Purpose 🎯
the whole point of the ForCES Applicability Statement is to capture what the ForCES protocol [RFC5810] designers intended, meaning how the protocol could be used together with the ForCES model [RFC5812] and a Transport Mapping Layer [RFC5811] 🦋
3. Terminology 📖
a bunch of ForCES concepts were introduced in "Requirements for Separation of IP Control and Forwarding" [RFC3654] and in "Forwarding and Control Element Separation (ForCES) Framework" [RFC3746] 🌈 the terminology for those concepts and for the protocol elements is defined in "Forwarding and Control Element Separation (ForCES) Protocol Specification" [RFC5810] 💜
go to those docs for the conceptual intro and the definitions, including these acronyms:
- CE: control element
- CEM: CE Manager
- FE: forwarding element
- FEM: FE Manager
- ForCES: Forwarding and Control Element Separation protocol
- LFB: Logical Function Block
- NE: ForCES network element
- TML: Transport Mapping Layer
4. Applicability to IP Networks 🌐
this section lists where ForCES applies in IP network devices 🫧 some pretty low-end routing systems run on simple hardware that handles both control and packet forwarding, and ForCES may not be useful for those devices 😅
higher-end routing systems usually spread the work across several interface-processing elements. those devices (FEs) need to talk to the control element(s) so they can do their job 🔥 a higher-end router might also split control processing across several processing elements (CEs), and ForCES gives a standard way to handle that communication 👑 ForCES also supports high-availability setups with a primary CE and one or more secondary CEs 🫶
the rest of this section covers the services ForCES may support, the applicable FE functionality, the applicable CE-FE link scenarios, and the topologies where ForCES may be deployed 💅
4.1. Applicable Services 🛎️
in this section we go over where ForCES applies to these control-forwarding-plane services:
- Association, Capability Discovery, and Information Exchange
- Topology Information Exchange
- Configuration
- Routing Exchange
- Quality of Service (QoS) Exchange
- Security Exchange
- Filtering Exchange
- Encapsulation/Tunneling Exchange
- NAT and Application-Level Gateways
- Measurement and Accounting
- Diagnostics
- CE Redundancy or CE Failover
4.1.1. Association, Capability Discovery, and Information Exchange 🤝
association is the first step of the ForCES protocol exchange, where capability discovery and exchange happen between one or more CEs and the FEs ✨ ForCES assumes the CEs and FEs already have enough info to start talking in a secure way 🔐 the ForCES protocol only applies after the CEs and FEs have found each other 🫶 ForCES doesn't care whether that discovery used a dynamic protocol or just static configuration 🙌 you can read more about how that can happen in Section 6.4 of this document 📖
during the association phase, CEs and FEs swap capability info 💖 for example, the FEs say how many interface ports they have, plus the static and configurable attributes of each port 🌸
besides the initial config, the CEs and FEs also exchange dynamic configuration changes using ForCES 🔄 for example, FEs asynchronously tell the CEs when the resources or capabilities on the FE go up or down 📈📉
4.1.2. Topology Information Exchange 🗺️
in this context, topology info is about how the FEs connect to each other in terms of packet forwarding 🦋 topology discovery is outside the scope of the ForCES protocol 🙅♀️ an implementation can pick its own way to discover topology. for example, it can use a standard topology discovery protocol or apply a static topology configuration policy 🧩 once the topology is set up, the ForCES protocol may be used to send the resulting info to the CEs 💜
4.1.3. Configuration ⚙️
ForCES is used to configure the FEs 🎀 for example, CEs set configurable FE attributes such as IP addresses, etc. for their interfaces 🌈
4.1.4. Routing Exchange 🛣️
ForCES may be used to deliver the packet forwarding info that comes out of CE routing calculations 🚀 for example, CEs may send forwarding table updates to the FEs so the FEs can make forwarding decisions ✨ FEs may tell the CEs when there's a forwarding table miss 👀 ForCES may also be used to configure Equal Cost Multi-Path (ECMP) capability 🍓
4.1.5. QoS Capabilities Exchange and Configuration 🎚️
ForCES may be used to exchange QoS capabilities between CEs and FEs 💅 for example, an FE may express its QoS capabilities to the CE 🫧 those capabilities might include metering, policing, shaping, and queuing functions 🌊 the CE may then use ForCES to configure these capabilities 🧚
Part 1 of 3 done, bestie! Part 2 picks up with 4.1.6 Security Exchange 🔐💖
4.1.6. Security Exchange 🔐
okay so ForCES can be used to swap security info between a CE and the FEs it controls 🫶 for example, the FE can use ForCES to say which kinds of encryption it's able to use in an IP Security (IPsec) tunnel. then the CE can use ForCES to set that tunnel up. the CEs are the ones in charge of the NE dynamic key exchanges and updates 🔑 they're the bouncers of the whole key situation 💅
4.1.7. Filtering Exchange and Firewalls 🧱
ForCES can be used to swap filtering info too 🦋 like, FEs can use it to show off the filtering functions they can do, such as classification and action, and the CE can configure those capabilities. full main character energy for the FE 👑
4.1.8. Encapsulation/Tunneling Exchange 🎀
ForCES can be used to exchange an FE's encapsulation capabilities, such as tunneling, plus the config for all of that 🌸
4.1.9. NAT and Application-Level Gateways 🌐
ForCES can be used to exchange config info for Network Address Translators 💜 ngl, ForCES isn't specifically built for configuring application-level gateway stuff. BUT it might be in scope for some types of application-level gateways, so keep that in mind 👀
4.1.10. Measurement and Accounting 📊
ForCES can be used to exchange config info about traffic measurement and accounting 💖 this area kinda overlaps with the stuff network management tools like the Simple Network Management Protocol (SNMP) already do 🙈 sometimes ForCES is used to pass info up to the CE so it can be reported externally using SNMP. we talk more about this in Section 6 of this document, so stay tuned ✨
4.1.11. Diagnostics 🩺
CEs and FEs can use ForCES to swap diagnostic info 🍓 for example, an FE can send its self-test results to a CE. self-checks, but make it social 💅
4.1.12. Redundancy and Failover 🔁
the ForCES architecture has mechanisms that let you have multiple redundant CEs and FEs in one ForCES NE 🌈 the ForCES-model LFB definitions give enough component details, through component identifiers, to be universally unique within an NE 🧚 the ForCES protocol also has mechanisms that help with transactions and with atomicity across the NE. it's giving organized 📋
so, with all that, it's totally possible to deploy redundant CEs and FEs that include failover ⭐ backup squad assemble 🫡
4.2. CE-FE Link Capability 🛣️
when you're using ForCES, the bandwidth of the CE-FE link matters a LOT and you can't just ignore it 😭 for example, sending a full routing table is totally fine over a high-bandwidth link, but over a lower-bandwidth link it could be a whole thing 💀 ForCES should also be future-proof enough to work in situations where routing tables grow to several orders of magnitude bigger than they are now 🚀 but also, not every IP router needs full routing tables, so there's that 🙃
4.3. CE/FE Locality 📍
ForCES is meant for environments where one of the following applies:
- The control interconnect is some form of local bus, switch, or LAN, where reliability is high, closely controlled, and not susceptible to external disruption that does not also affect the CEs and/or FEs.
- The control interconnect shares its fate with the FE's forwarding function. Typically this is because the control connection is also the FE's primary packet forwarding connection, and so if that link goes down, the FE cannot forward packets anyway.
the key guideline is that the reliability of the device should not be significantly reduced by separating control and forwarding functionality 🫶 keep that vibe in mind.
so with that in mind, ForCES is applicable in the following CE/FE localities:
Single Box NE: chassis with multiple CEs and FEs set up. ForCES is applicable in localities consisting of control and forwarding elements that are components in the same physical box.
Example: a network element with a single control blade, and one or more forwarding blades, all present in the same chassis and sharing an interconnect such as Ethernet or Peripheral Component Interconnect (PCI). in this locality, most of the data traffic being forwarded typically doesn't go over the same links as the ForCES control traffic 🧚
Multiple Box NE: separated CE and FE, where physical locality could be the same rack, room, or building, or long distances that could span across continents and oceans 🌍 ForCES is applicable in localities consisting of control and forwarding elements that are separated by a single hop or multiple hops in the network 🦋
5. Security Considerations 🚨
okay bestie, this part is SERIOUS 😤 the ForCES protocol allows for a variety of security levels [RFC5810]. when the operator is working in a secured physical environment, or has other operational concerns (sometimes performance issues), they can turn off all the security functions between CEs and FEs 🙈 but when the operator decides to secure the path between the FEs and CEs, they pick from one of the options the TML provides. the security choices the TML provides take effect during the pre-association phase of the ForCES protocol 🔒 an operator can use all, some, or none of the security services the TML provides in a CE-FE connection.
a ForCES NE is required to provide CE/FE node authentication services, and it may provide message integrity and confidentiality services 💖 it can provide these by using IPsec or Transport Layer Security (TLS), depending on which TML was chosen for the NE deployment. no cap, this is the stuff that keeps everything safe 🛡️✨
6. ForCES Manageability 🛠️
from the architecture side, the ForCES NE is a single network element 🦋 for example, if the ForCES NE is specifically a router that needs managing, then it should be managed in essentially the same way any router should be managed 🌸 from another angle, element management could directly view the individual entities and interfaces that make up a ForCES NE. HOWEVER, any element management updates made directly on these entities and interfaces may compromise the control relationship between the CEs and the FEs, unless the update mechanism has been accounted for in the model the NE uses 🙅♀️ so be careful, bestie.
6.1. The NE as an Atomic Element ⚛️
from the ForCES Requirements [RFC3654], Section 4, point 4:
A NE MUST support the appearance of a single functional device.
as a single functional device, a ForCES NE runs protocols, and each of those protocols has its own existing manageability aspects that are documented elsewhere 📚 for example, a router would also have a configuration interface. seen this way, the NE is controlled as a single routing entity, and no new management beyond what's already available for routers and routing protocols would be required for a ForCES NE ✨ management commands sent to the NE's management interface will arrive at the CE, and may need ForCES interactions between the CE and FEs to finish. this can affect the atomicity of those commands, so the CE needs to be implemented carefully 🫶
6.2. The NE as Composed of Manageable Elements 🧩
from the management point of view, when you break things down into a set of elements, the ForCES NE is divided into a set of one of more control elements, forwarding elements, and the interfaces between them 💜 the interface functionality between the CE and the FE is provided by the ForCES protocol. a MIB module is provided for gaining management info on the operation of the protocol described in Section 6.3 of this document 📊
the architecture also makes provisions for configuration control of the individual CEs and FEs 👑 this is handled by elements called the FE Manager (FEM) and the CE Manager (CEM). specifically, from the ForCES Requirements RFC [RFC3654], Section 4, point 4:
However, external entities (e.g., FE Managers and CE Managers) MAY have direct access to individual ForCES protocol elements for providing information to transition them from the pre-association to the post-association phase.
6.3. ForCES Protocol MIB 📋
the ForCES MIB [RFC5813] defines a mostly read-only MIB module that captures info related to the ForCES protocol 🌈 this includes state info about the associations between CE(s) and FE(s) in the NE.
the ForCES MIB does not include info that's specified in other MIB modules, like packet counters for interfaces, etc. 🙅♀️
more specifically, the info in the ForCES MIB module about associations includes:
- identifiers of the elements in the association
- state of the association
- configuration parameters of the association
- statistics of the association
6.3.1. MIB Management of an FE 🔍
it's possible to manage an FE from an element manager, but several requirements about this have been included in the ForCES Requirements 🧐
from the ForCES Requirements [RFC3654], Section 4, point 14:
1. The ability for a management tool (e.g., SNMP) to be used to read (but not change) the state of FE SHOULD NOT be precluded. 2. It MUST NOT be possible for management tools (e.g., SNMP, etc) to change the state of a FE in a manner that affects overall NE behavior without the CE being notified.
the ForCES Framework [RFC3746], Section 5.7, goes further and talks about how FEs should handle management requests that are aimed directly at the FE 🎀
(For a ForCES NE that is an IP router,) RFC 1812 [RFC1812] also dictates that "Routers must be manageable by SNMP". In general, for the post-association phase, most external management tasks (including SNMP) should be done through interaction with the CE in order to support the appearance of a single functional device. Therefore, it is recommended that an SNMP agent be implemented by CEs and that the SNMP messages received by FEs be redirected to their CEs. AgentX framework defined in RFC 2741 [RFC2741]) may be applied here such that CEs act in the role of master agent to process SNMP messages while FEs act in the role of subagent to provide access to the MIB objects residing on FEs. AgentX protocol messages between the master agent (CE) and the subagent (FE) are encapsulated and transported via ForCES, just like data packets from any other application layer protocols.
6.4. The FEM and CEM 🧑💻
even though it's out of scope for the initial ForCES specification effort, the ForCES architecture includes two entities: the CE Manager (CEM) and the FE Manager (FEM). from the ForCES Protocol Specification [RFC5810]:
CE Manager (CEM): a logical entity responsible for generic CE management tasks. It is particularly used during the pre-association phase to determine with which FE(s) a CE should communicate.
FE Manager (FEM): a logical entity responsible for generic FE management tasks. It is used during the pre-association phase to determine with which CE(s) an FE should communicate.
7. Contributors 💕
Mark Handley was an initial author involved in the earlier versions of this document 🌟
8. Acknowledgments 🫶
many of the participants in the ForCES WG, as well as fellow employees of the authors, have provided valuable input into this work 💖 particular thanks go to Jamal Hadi Salim, our WG chair and document shepherd, and to Adrian Farrel, the AD for the area, for their review, comments, and encouragement, without which this document might never have been completed 🥹✨
9. References 📚
9.1. Normative References ✨
okay bestie, these are the must-read receipts 📚 Every entry below is a normative reference, so the spec leans on them for real 💅
[RFC1812] Baker, F., "Requirements for IP Version 4 Routers",
RFC 1812, June 1995.
[RFC5810] Doria, A., Hadi Salim, J., Haas, R., Khosravi, H., Wang,
W., Dong, L., Gopal, R., and J. Halpern, "Forwarding and
Control Element Separation (ForCES) Protocol
Specification", RFC 5810, March 2010.
[RFC5811] Hadi Salim, J. and K. Ogawa, "SCTP-Based Transport
Mapping Layer (TML) for the Forwarding and Control
Element Separation (ForCES) Protocol", RFC 5811,
March 2010.
[RFC5812] Halpern, J. and J. Hadi Salim, "Forwarding and Control
Element Separation (ForCES) Forwarding Element Model",
RFC 5812, March 2010.
[RFC5813] Haas, R., "Forwarding and Control Element Separation
(ForCES) MIB", RFC 5813, March 2010.9.2. Informative References 🌸
and now the extra reading 📖 these ones give you the background and the vibes, but they aren't the core spec, so no pressure to memorize them 🫶
[RFC2741] Daniele, M., Wijnen, B., Ellison, M., and D. Francisco,
"Agent Extensibility (AgentX) Protocol Version 1",
RFC 2741, January 2000.
[RFC3654] Khosravi, H. and T. Anderson, "Requirements for
Separation of IP Control and Forwarding", RFC 3654,
November 2003.
[RFC3746] Yang, L., Dantu, R., Anderson, T., and R. Gopal,
"Forwarding and Control Element Separation (ForCES)
Framework", RFC 3746, April 2004.Authors' Addresses 🎀
the people who made this happen, and how to reach them 💖 the girls (and guys) behind the spec
Alan Crouch
Intel
2111 NE 25th Avenue
Hillsboro, OR 97124
USA
Phone: +1 503 264 2196
EMail: alan.crouch@intel.com
Hormuzd Khosravi
Intel
2111 NE 25th Avenue
Hillsboro, OR 97124
USA
Phone: 1-503-264-0334
EMail: hormuzd.m.khosravi@intel.com
Avri Doria (editor)
LTU
Lulea University of Technology
Sweden
Phone: +46 73 277 1788
EMail: avri@acm.org
Xin-ping Wang
Huawei
Beijing
China
Phone: +86 10 82836067
EMail: carly.wang@huawei.com
Kentaro Ogawa
NTT Corporation
3-9-11 Midori-cho
Musashino-shi, Tokyo 180-8585
Japan
EMail: ogawa.kentaro@lab.ntt.co.jpthat's the whole doc, bestie! 🌈✨ thank you for hanging in there through all three parts 😭🫶
📦 where this page comes from
- ietf: rfc6041 2010-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms