RFC 9355

OSPF Bidirectional Forwarding Detection (BFD) Strict-Mode

📅 published February 2023, from ietf

OSPF Bidirectional Forwarding Detection (BFD) Strict-Mode 🎀

Part 1 of 3 💖 Okay bestie, this is RFC 9355 from the IETF (Internet Engineering Task Force) 💅 It's a Standards Track doc, dated February 2023, with ISSN 2070-1721.

The authors are K. Talaulikar (Ed.), P. Psenak, A. Fu, and M. Rajesh. Talaulikar and Psenak are at Cisco Systems, Inc., Fu is at Bloomberg, and Rajesh is at Juniper Networks. 🧚

It updates RFC 2328 (that's OSPFv2) 🦋 Its header doesn't have an Obsoletes line, so it isn't replacing any older RFC.

Abstract 💖

Okay so this doc adds OSPF extensions that let a router say "hey, I need a BFD session up before we form an adjacency" 🔥 The signal rides on Link-Local Signaling (LLS), and it's advertised with strict-mode BFD for each OSPF adjacency. If both neighbours advertise BFD strict-mode, the adjacency is blocked until a BFD session has been successfully established. Iconic behaviour 👑

It also updates RFC 2328 by adding a check to the OSPF neighbour state machine. Before moving from Init to 2-Way state, the router checks that the BFD session is up, but only when it's running OSPF BFD strict-mode. ✨

Status of This Memo 📜

This is an Internet Standards Track document. 🌈

It's a product of the IETF, and it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841.

For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9355 🦋

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at https://trustee.ietf.org/license-info, as they stand on the publication date. Please read them carefully, because they explain your rights and restrictions for this doc 🙈 Code Components pulled out of this document must include the Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Revised BSD License.

Table of Contents 🗂️

1.  Introduction
  1.1.  Requirements Language
2.  LLS B-Bit Flag
3.  Local Interface IPv4 Address TLV
4.  Procedures
  4.1.  OSPFv3 IPv4 AF Specifics
  4.2.  Graceful Restart Considerations
5.  Operations and Management Considerations
6.  Backward Compatibility
7.  IANA Considerations
8.  Security Considerations
9.  References
  9.1.  Normative References
  9.2.  Informative References
Acknowledgements
Authors' Addresses

1. Introduction ✨

Okay, BFD [RFC5880] lets routers keep an eye on the data plane and catch faults in the two-way path between them 👀 Routing protocols like OSPFv2 [RFC2328] and OSPFv3 [RFC5340] use BFD to spot connectivity failures on established adjacencies faster than the OSPF Hello dead timer can, and then reroute traffic around the problem. Main character energy 💅 The use of BFD for monitoring routing protocol adjacencies is described in [RFC5882].

So when a network operator turns on BFD monitoring for OSPF adjacencies, the BFD session gets bootstrapped from the neighbour address info that comes in through OSPF Hello packets. If BFD catches a bidirectional forwarding fault, the OSPF adjacency goes down with it 💀 Now a degraded or janky link can drop packets on and off. Older implementations, the ones from before this doc, might still bring an OSPF adjacency up over that kind of link 😭 But BFD runs on much more aggressive monitoring intervals, so the BFD session might never come up, or it might flap. The packets forwarded over that link get dropped, and when BFD fails to establish, you don't get fast routing convergence. Result: OSPF adjacency flaps, because OSPF brings the adjacency up and then BFD tears it right back down 🙃

To avoid that routing churn, it would be great not to let OSPF establish an adjacency until a BFD session is successfully up and stable 🧁 But that would break OSPF in environments where not every OSPF router supports BFD or has it enabled on the link. 🥺 The fix is to block OSPF adjacency establishment until a BFD session comes up, as long as both neighbours advertise that requirement. This way of using OSPF BFD is called "strict-mode". Strict-mode adds signaling support to OSPF so adjacency formation is blocked until BFD session establishment happens, as described in Section 4.1 of [RFC5882]. 🔒

This doc specifies the OSPF protocol extensions that use Link-Local Signaling (LLS) [RFC5613]. They let a router tell its neighbour that it's willing to require BFD strict-mode for OSPF adjacency establishment (see Section 2) 🫶 It also adds an OSPFv3 LLS extension for the interface IPv4 address (see Section 3). That address is used to set up the BFD session when OSPFv3 runs an IPv4 Address Family (AF) instance. 🌸

This doc updates [RFC2328] by adding a check to the OSPF neighbour state machine. Before moving from Init to 2-Way state, the router verifies that the BFD session is up, but only when it's operating in OSPF BFD strict-mode. 👑

The strict-mode extensions and procedures also apply to adjacencies over virtual links that use BFD multi-hop [RFC5883] procedures. 🦋

A similar feature for IS-IS is specified in [RFC6213]. 🍓

1.1. Requirements Language 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. ✨

2. LLS B-Bit Flag 🔥

This doc defines the B-bit in the LLS Type 1 Extended Options and Flags 🎀 It's defined for the LLS block that goes in Hello and Database Description (DD) packets. The B-bit says that BFD is enabled on the link, and that the router is requesting OSPF BFD strict-mode. Section 7 describes where the B-bit sits. 💖

A router MUST include the LLS block with the B-bit set in the LLS Type 1 Extended Options and Flags in its Hello and DD packets when OSPF BFD strict-mode is enabled on the link. 🚨

3. Local Interface IPv4 Address TLV 🧚

The Local Interface IPv4 Address TLV is an LLS TLV defined for the OSPFv3 IPv4 AF instance [RFC5838] protocol operation, as described in Section 4.1 🌈

It has the following format:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |              Type             |             Length            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                 Local Interface IPv4 Address                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Where:

Type: 21 🎀
Length: 4 octets 💜
Local Interface IPv4 Address: The primary IPv4 address of the local interface. 🌸

4. Procedures ✨

okay so a router running OSPF BFD strict-mode says so in its Hello packets, see Section 2 🎀 Then, when it spots a new neighbor that also runs strict-mode, it sets up a BFD session with that neighbor first, and only after that does it bring up the OSPF adjacency. main character energy 👑

This document updates the OSPF neighbor state machine from [RFC2328] 📚 The Init state gets tweaked when strict-mode is on, so here's the before and after:

Init (without OSPF BFD strict-mode): A Hello packet just came in from the neighbor 📨 but two-way chat isn't set up yet, aka my router's name isn't in their Hello. Every neighbor at Init or higher gets listed in the Hello packets we send out that interface.

Init (with OSPF BFD strict-mode): Same deal, a Hello just arrived and two-way isn't working yet (my router isn't in their Hello). Now a BFD session with the neighbor is requested if it isn't already up, like when it drops from 2-Way. Neighbors at Init or higher show up in our Hello packets only if they either have a BFD session established or they never advertised strict-mode in the LLS Type 1 Extended Options and Flags in their Hello. 🫶

When the neighbor drops to Down, OSPF asks for the BFD session to be removed. When it moves back into Init, OSPF asks for a new BFD session to be set up. If OSPF is the only client that cares about that BFD session with the neighbor address, this can mean the session gets deleted and then created again 🔄

An implementation MUST NOT wait for BFD session establishment in Init state unless OSPF BFD strict-mode is enabled by the operator on the interface and the specific neighbor indicates OSPF BFD strict-mode capability via the LLS Type 1 Extended Options and Flags advertised in the Hello packet. When BFD is enabled but strict-mode hasn't been signaled by both neighbors, an implementation SHOULD start BFD session establishment only in 2-Way or greater state. This is the magic part ✨ It means one OSPF router can run BFD in strict-mode on some interfaces and normal mode on others, or even with different neighbors on the same multi-access interface. Iconic flexibility 💅

Once the OSPF state machine has moved past Init, any change in the B-bit in later Hello packets MUST NOT result in any trigger in either the OSPF adjacency or the BFD session management. The B-bit only counts while you're in Init state, period 🙅‍♀️ Turning off BFD (or OSPF BFD strict-mode) on an OSPF interface means it stops setting the B-bit in the LLS Type 1 Extended Options and Flags in later Hello packets. Turning off strict-mode doesn't touch BFD operations at all and won't bring down any BFD sessions that are already running. Turning off BFD does bring the BFD session down because of AdminDown State (described in Section 3.2 of [RFC5882]), but it won't take the OSPF adjacency down with it 🦋

When BFD gets enabled on an interface where we already have an OSPF adjacency, the router starts setting the B-bit in its later Hello packets and kicks off BFD session establishment with the neighbor. If the adjacency is already up (meaning its terminal state of Full, or 2-Way with routers that aren't designated routers on a multi-access interface) and the neighbor also supports OSPF BFD strict-mode, an implementation SHOULD NOT drop this adjacency back into Init. Nobody wants routing drama 💀 Instead, it only waits for OSPF BFD strict-mode after a transition to Init state. But if the adjacency isn't up, an implementation MAY bring it down so it can use OSPF BFD strict-mode for setup. 🌸

4.1. OSPFv3 IPv4 AF Specifics

Supporting multiple AFs in OSPFv3 [RFC5838] means using an IPv6 link-local address as the source address for Hello packets, even when the adjacencies are for IPv4 AF instances 🌈 In most OSPFv3 IPv4 AF deployments, BFD is required to monitor and verify IPv4 data plane connectivity between the routers on the link, so the BFD session gets set up with IPv4 neighbor addresses. Here's the catch: the IPv4 neighbor address on the interface only gets learned later in adjacency formation, when the neighbor's Link-LSA (Link State Advertisement) arrives. So the BFD IPv4 session ends up being set up either after the adjacency is already established or later in the sequence 😭

To run OSPF BFD strict-mode, an OSPF router has to learn its neighbor's IPv4 link address during the Init state of adjacency formation (ideally when it gets the very first Hello). The Local Interface IPv4 Address TLV (as defined in Section 3) in the LLS block sent in OSPFv3 Hello packets for IPv4 AF instances is what makes this possible 🧚 Implementations that support OSPF BFD strict-mode for OSPFv3 IPv4 AF instances MUST include the Local Interface IPv4 Address TLV in the LLS block of their Hello packets whenever the B-bit is also set in the LLS Type 1 Extended Options and Flags. A receiver MUST ignore the B-bit (meaning it does not operate in strict-mode for BFD) when the Local Interface IPv4 Address TLV is missing from OSPFv3 Hello messages for OSPFv3 IPv4 AF instances. No TLV, no strict-mode, no cap 🚫

4.2. Graceful Restart Considerations

An implementation has to handle the situation where graceful restart (GR) and OSPF BFD strict-mode are both deployed together 🎀 The graceful restart stuff about process restart scenarios in Section 3.3 of [RFC5882] applies to OSPF BFD strict-mode too. There's an extra wrinkle, though: because OSPF adjacency formation is delayed until the BFD session is established in strict-mode, that delay can affect or even break GR-based recovery 😬 In those cases, it is RECOMMENDED that the GR timers are set long enough to cover normal BFD session establishment delays.

5. Operations and Management Considerations

An implementation SHOULD report the BFD session status alongside the OSPF Init adjacency state when OSPF BFD strict-mode is enabled, and it should support logging for neighbor state transitions that include BFD events 📝 This lets an operator spot when an OSPF adjacency is stuck waiting on BFD session establishment. Good catch, operator ✨

On networks with noisy or degraded links and intermittent packet loss, BFD sessions can flap, which makes OSPF adjacencies flap too. That can cause routing churn 🌪️ Using OSPF BFD strict-mode together with things like hold-down (a delay in bringing up the initial OSPF adjacency after BFD session establishment) and/or dampening (a delay in bringing up the OSPF adjacency after a failure detected by BFD) may help cut down on adjacency flaps and the routing churn that comes with them. The details of these mechanisms are outside the scope of this document 🙈

[RFC9129] specifies the base OSPF YANG module. The configuration and operational elements needed for this feature are expected to be added as augmentations to that base OSPF YANG module 🍓

6. Backward Compatibility

An implementation MUST support OSPF adjacency formation and operations with a neighbor that doesn't advertise the OSPF BFD strict-mode capability. That includes a neighbor that doesn't support BFD at all, and a neighbor that supports BFD but doesn't signal OSPF BFD strict-mode the way this document describes 🫶 Implementations MAY provide a local configuration option to force BFD to operate only in OSPF BFD strict-mode, meaning the adjacency won't come up unless the BFD session is established. In that setup, an OSPF adjacency with a neighbor that doesn't support OSPF BFD strict-mode would not be established successfully 🚧 Implementations MAY also provide a local configuration option to enable BFD without OSPF BFD strict-mode. That makes the router skip advertising the B-bit, and BFD operates the same way it did before this specification 💖

The signaling in this document happens at the link-local level between routers on that link. A router that doesn't support this specification ignores the B-bit in the LLS block of its neighbors' Hello packets, and it keeps establishing BFD sessions (if enabled) without delaying OSPF adjacency formation 🦋 Since a router that doesn't support this specification never sets the B-bit in the LLS block of its own Hello packets, its neighbors that do support this specification won't use OSPF BFD strict-mode with those routers. So things behave exactly as they would without this specification. Therefore, there are no backward compatibility issues or implementation considerations beyond what is specified herein. Phew 😌

7. IANA Considerations

This specification makes the following updates under the "Open Shortest Path First (OSPF) Link Local Signaling (LLS) - Type/Length/Value Identifiers (TLV)" parameters 📋

In the "LLS Type 1 Extended Options and Flags" registry, the B-bit has been assigned the bit position 0x00000010 🎯
In the "Link Local Signaling TLV Identifiers (LLS Types)" registry, Type 21 has been assigned to the Local Interface IPv4 Address TLV 🧾

8. Security Considerations

The security considerations for "OSPF Link-Local Signaling" [RFC5613] also apply to the extension in this document. 🔐

🚨 Inappropriate use of the B-bit in the LLS block of an OSPF Hello message could stop an OSPF adjacency from forming, or lead to failure in detecting bidirectional forwarding failures. Do not play with the B-bit carelessly, bestie!

If authentication is used in the OSPF routing domain [RFC5709] [RFC7474], then the Cryptographic Authentication TLV [RFC5613] MUST also be used to protect the contents of the LLS block. Lock it down 🔒💜

9. References

9.1. Normative References

okay so these are the must-read ones bestie, the stuff the spec literally leans on 📚✨

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC2328]  Moy, J., "OSPF Version 2", STD 54, RFC 2328,
           DOI 10.17487/RFC2328, April 1998,
           <https://www.rfc-editor.org/info/rfc2328>.

[RFC5340]  Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
           for IPv6", RFC 5340, DOI 10.17487/RFC5340, July 2008,
           <https://www.rfc-editor.org/info/rfc5340>.

[RFC5613]  Zinin, A., Roy, A., Nguyen, L., Friedman, B., and D.
           Yeung, "OSPF Link-Local Signaling", RFC 5613,
           DOI 10.17487/RFC5613, August 2009,
           <https://www.rfc-editor.org/info/rfc5613>.

[RFC5838]  Lindem, A., Ed., Mirtorabi, S., Roy, A., Barnes, M., and
           R. Aggarwal, "Support of Address Families in OSPFv3",
           RFC 5838, DOI 10.17487/RFC5838, April 2010,
           <https://www.rfc-editor.org/info/rfc5838>.

[RFC5882]  Katz, D. and D. Ward, "Generic Application of
           Bidirectional Forwarding Detection (BFD)", RFC 5882,
           DOI 10.17487/RFC5882, June 2010,
           <https://www.rfc-editor.org/info/rfc5882>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

9.2. Informative References

these ones are the extra reading for when you want the deeper lore 🧚💖

[RFC5709]  Bhatia, M., Manral, V., Fanto, M., White, R., Barnes, M.,
           Li, T., and R. Atkinson, "OSPFv2 HMAC-SHA Cryptographic
           Authentication", RFC 5709, DOI 10.17487/RFC5709, October
           2009, <https://www.rfc-editor.org/info/rfc5709>.

[RFC5880]  Katz, D. and D. Ward, "Bidirectional Forwarding Detection
           (BFD)", RFC 5880, DOI 10.17487/RFC5880, June 2010,
           <https://www.rfc-editor.org/info/rfc5880>.

[RFC5883]  Katz, D. and D. Ward, "Bidirectional Forwarding Detection
           (BFD) for Multihop Paths", RFC 5883, DOI 10.17487/RFC5883,
           June 2010, <https://www.rfc-editor.org/info/rfc5883>.

[RFC6213]  Hopps, C. and L. Ginsberg, "IS-IS BFD-Enabled TLV",
           RFC 6213, DOI 10.17487/RFC6213, April 2011,
           <https://www.rfc-editor.org/info/rfc6213>.

[RFC7474]  Bhatia, M., Hartman, S., Zhang, D., and A. Lindem, Ed.,
           "Security Extension for OSPFv2 When Using Manual Key
           Management", RFC 7474, DOI 10.17487/RFC7474, April 2015,
           <https://www.rfc-editor.org/info/rfc7474>.

[RFC9129]  Yeung, D., Qu, Y., Zhang, Z., Chen, I., and A. Lindem,
           "YANG Data Model for the OSPF Protocol", RFC 9129,
           DOI 10.17487/RFC9129, October 2022,
           <https://www.rfc-editor.org/info/rfc9129>.

Acknowledgements

the authors gave a shoutout to the people who reviewed the draft and dropped inputs: Acee Lindem, Manish Gupta, Balaji Ganesh, Les Ginsberg, Robert Raszuk, Gyan Mishra, Muthu Arul Mozhi Perumal, Russ Housley, and Wes Hardaker 🫶✨

they also gave a special thank you to Dylan van Oudheusden 🌟 for spotting the problems with using OSPF BFD strict-mode on BFD sessions for OSPFv3 IPv4 AF instances, and to Baalajee S 💜 for suggestions on how to fix it.

and the authors thanked John Scudder 👑 for his AD review and his ideas for making the document better 💅

Authors' Addresses

here's who wrote it, with their contact info 🎀

Ketan Talaulikar (editor)
Cisco Systems, Inc.
India
Email: ketant.ietf@gmail.com


Peter Psenak
Cisco Systems, Inc.
Apollo Business Center
Mlynske nivy 43
821 09 Bratislava
Slovakia
Email: ppsenak@cisco.com


Albert Fu
Bloomberg
United States of America
Email: afu14@bloomberg.net


Rajesh M
Juniper Networks
India
Email: mrajesh@juniper.net

📦 where this page comes from

ietf: rfc9355 2023-02
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms