Notification Message support for BGP Graceful Restart

For many classes of errors, the BGP protocol must send a NOTIFICATION message and reset the peering session to handle the error condition. The BGP Graceful Restart extension defined in requires that normal BGP procedures defined in be followed when a NOTIFICATION message is sent or received. This document defines an extension to BGP Graceful Restart that permits the Graceful Restart procedures to be performed when the BGP speaker receives a NOTIFICATION message or the Hold Time expires. This permits the BGP speaker to avoid flapping reachability and continue forwarding while the BGP speaker restarts the session to handle errors detected in the BGP protocol. At a high level, this document can be summed up as follows. When a BGP session is reset, both speakers operate as "Receiving Speakers" according to , meaning they retain each other's routes. This is also true for HOLDTIME expiration. The functionality can be defeated using a "Hard Reset" subcode for the BGP NOTIFICATION Cease Error code. If a Hard Reset is used, a full session reset is performed.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The BGP Graceful Restart Capability is augmented to signal the Graceful Restart support for BGP NOTIFICATION messages. In particular, the Restart flags field and the Flags field for Address Family are augmented as follows:

The second most significant bit ("N") is defined as the BGP Graceful Notification bit, which is used to indicate Graceful Restart support for BGP NOTIFICATION messages. A BGP speaker indicates support for the procedures of this document, by advertising a Graceful Restart Capability with its Graceful NOTIFICATION bit set (value 1). This also implies support for the format for a BGP NOTIFICATION Cease message defined in .

The usage of second most significant bit "N" (which was defined in a previous draft version of this specification) is deprecated. This bit MUST be advertised as 0 and MUST be ignored upon receipt.

A new BGP NOTIFICATION Cease message subcode is defined known as the BGP Hard Reset Subcode. The value of this subcode is discussed in . We refer to a BGP NOTIFICATION Cease message with the Hard Reset subcode as a Hard Reset message, or just a Hard Reset.

A Hard Reset message is used to indicate to a peer with which the Graceful Notification flag has been exchanged, that the session is to be fully terminated. When sending a Hard Reset, the data portion of the NOTIFICATION is encoded as follows:

ErrCode is a BGP Error Code (as documented in the IANA BGP Error Codes registry) that indicates the reason for the hard reset. Subcode is a BGP Error Subcode (as documented in the IANA BGP Error Subcodes registry) as appropriate for the ErrCode. Similarly, Data is as appropriate for the ErrCode and Subcode.

Whenever a BGP speaker receives a Hard Reset, the speaker MUST terminate the BGP session following the standard procedures in .

A BGP speaker that is willing to receive and send BGP NOTIFICATION messages in Graceful mode MUST advertise the BGP Graceful Notification "N" bit using the Graceful Restart Capability as defined in . When such a BGP speaker has received the "N" bit from its peer, and receives from that peer a BGP NOTIFICATION message other than a Hard Reset, it MUST follow the rules for the Receiving Speaker mentioned in . The BGP speaker generating the BGP NOTIFICATION message MUST also follow the rules for the Receiving Speaker. When a BGP speaker resets its session due to a HOLDTIME expiry, it should generate the relevant BGP NOTIFICATION message as mentioned in , but subsequently it MUST follow the rules for the Receiving Speaker mentioned in . A BGP speaker SHOULD NOT send a Hard Reset to a peer from which it has not received the "N" bit. We note, however, that if it did so the effect would be as desired in any case, since according to and any NOTIFICATION message, whether recognized or not, results in a session reset. Thus the only negative effect to be expected from sending the Hard Reset to a peer that hasn't advertised compliance to this specification would be that the peer would be unable to properly log the associated information. Once the session is re-established, both BGP speakers SHOULD set their "Forwarding State" bit to 1. If the "Forwarding State" bit is not set, then according to the procedures of S. 4.2, the relevant routes will be flushed, defeating the goals of this specification.

S. 4.2 defines rules for the Receiving Speaker. These are modified as follows. As part of this extension, routes from the peer previously marked as stale MUST NOT be deleted, until and unless the timer mentioned in the final paragraph of S. 4.2 expires, or unless a Hard Reset is performed. This supersedes the "consecutive restarts" requirement of S. 4.2. In addition to the rules already specified in S. 4.2 for how variations in the received Graceful Restart Capability should be interpreted (the paragraph that begins "Once the session is re-established..."), if the Graceful Notification ("N") bit is not set in the newly received Graceful Restart Capability, no new actions are triggered on the Receiving Speaker -- in particular, a clear "N" bit does not trigger deletion of stale routes. Other than these modifications, the rules for the Receiving Speaker are as specified in S. 4.2.

The authors would like to thank Jim Uttaro for the suggestion, and Bruno Decraene, Chris Hall, Paul Mattes and Robert Raszuk for their review and comments.

IANA is requested to assign a new subcode in the "BGP Cease NOTIFICATION message subcodes" registry. The suggested name for the code point is "Hard Reset". The suggested value is 9.

This extension to BGP does not change the underlying security issues inherent in the existing and .