Updates to MPLS Transport Profile Linear Protection
updates
- rfc-6378 — MPLS Transport Profile (MPLS-TP) Linear Protection
Extracted elements (21)
A strict FSM reading of RFC 6378 would require a node to transition through Normal (N) state when the highest-priority of two simultaneous inputs is removed, even though a lower-priority request remains. This is deemed unreasonable because no sensible justification exists for a node behaving as if conditions are normal when a known remote request is still active.
Even when a permanent PT or R mismatch exists, the protection domain SHOULD still be allowed to forward traffic on the Working LSP under no-failure conditions, since the mismatch only affects recovery behavior and not normal data-plane operation.
The Protection Type priority order UP > BS > BP was chosen to resolve mismatch deterministically without negotiation. PSC has no explicit negotiation facility, so a fixed priority allows both endpoints to converge without additional signaling.
RFC 7271, which defines an alternate operating mode for MPLS-TP PSC built on RFC 6378's message structures and procedures, is indirectly affected by this document's updates to RFC 6378, even though RFC 7271 is not directly updated.
A remote No Request message (regardless of FPath and Path values) SHALL be ignored if the node is in local Protecting Administrative state. This generalizes the previous rule that only ignored NR(0,0), clarifying that all NR variants trigger the same behavior.
A well-formed but unknown or unexpected TLV value MUST be ignored, and the rest of the PSC message processed as if the ignored TLV did not exist. An implementation detecting a malformed TLV SHOULD alert the operator.
An implementation SHOULD alert the operator to an irreconcilable capability mismatch (PT or R) and SHOULD allow traffic to be sent on the Working LSP as long as there is no failure (e.g., NR state) regardless of any mismatch.
An implementation SHOULD validate malformed PSC messages by checking field consistency per RFC 6378 Section 4.2, verifying overall message length equals TLV Length plus 12, and confirming the sum of all TLV lengths matches the TLV Length field.
If a received PSC message fails any malformed message check, the implementation MUST drop the message and SHOULD alert the operator via mechanisms such as syslog or console messages.
If the current state is due to a local or remote Manual Switch, a local Signal Fail indication on the protection path SHALL cause the LER to enter local Unavailable state and begin transmission of an SF(0,0) message. This corrects RFC 6378 which could leave a node incorrectly sending NR(0,1) despite a protection LSP failure.
If the LER is in local Protecting Administrative state due to a local Forced Switch, a local Signal Fail indication on the protection path SHALL be ignored.
If the LER is in remote Protecting Administrative state due to a remote Forced Switch, a local Signal Fail indication on the protection path SHALL cause the LER to remain in remote Protecting Administrative state and transmit an SF(0,1) message.
If the R (Revertive) bits do not match between protection domain endpoints, the node indicating non-revertive MUST switch to Revertive mode if it is supported. If not supported, the node must behave as specified in Section 4.3.
If there is a trigger that would cause the protection LSP to be used (such as SF or MS) and there is an irreconcilable capability mismatch, a node MUST NOT use the protection LSP to carry traffic.
The Length field of a PSC TLV MUST be a multiple of 4 octets, and the Value field MUST likewise be a multiple of 4 octets; explicit padding may be used to achieve alignment.
When a Protection Type (PT) mismatch occurs, nodes MUST converge using a defined priority: UP > BS > BP. The lower-priority node MUST switch to the higher-priority mode if that mode is supported; for example, a node transmitting BP in a {BP, UP} mismatch MUST switch to UP mode if supported.
IANA has marked the value 0 in the 'MPLS PSC TLV Registry' as 'Reserved, not to be allocated' and updated the references to include both RFC 6378 and RFC 7324. This documents an action already taken by IANA that was not recorded in RFC 6378.
The changes and clarifications in this document raise no new security concerns. RFC 6941 ('MPLS Transport Profile (MPLS-TP) Security Framework') provides the baseline security discussion for MPLS-TP, and PSC as described in RFC 6378 and this document falls under that umbrella. Section 2.2 additionally clarifies how to react to malformed or unexpected messages.
Multiple simultaneous PSC inputs: when the highest-priority input (local or remote) is removed or replaced, the PSC Control logic SHALL immediately reevaluate all inputs (both local and remote), transitioning into a new state only upon completion of that reevaluation. This prevents a transient and incorrect passage through Normal state.
Reversion deadlock fix: if a node is in Protecting Failure state due to a remote SF-W and receives NR(0,1), this SHALL cause the node to begin recovery procedures. For revertive behavior, the LER enters Wait-to-Restore state, starts the WTR timer, and begins transmitting WTR(0,1); for non-revertive behavior, it enters Do-Not-Revert state and begins transmitting DNR(0,1).
PSC TLV format: Type (2-octet field encoding a type value from the IANA MPLS PSC TLV Registry), Length (2-octet field encoding the length in octets of the Value field, MUST be a multiple of 4), and Value (variable-length payload, also MUST be a multiple of 4 octets, may include explicit padding). The total length of a single TLV is the Value field length plus 4.