Subject: [OSPF] Query regarding grace-period in Garceful-restart

From: Ashok Chandrashekar Holla <[email-masked]>
Date: Wed, 28 Jun 2006 15:03:51 +0530

Group,

I have a doubt regarding the grace-period interpretation in RFC 3623.

If a helper initially received the GR request with grace-period 100s, 
and after 30s, receives a new Grace-LSA with grace-period 200, what 
should the effective grace-period be?
1. Should the helper set the grace-period to 200s, of which 30s have 
already elapsed?
2. Should the grace-period be 300s (previous 100s + extended 200s), of 
which 30s have already elapsed?

Thanks,
Ashok

_______________________________________________
OSPF mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ospf

---

From: Ashok Chandrashekar Holla <[email-masked]>
Date: Wed, 28 Jun 2006 15:10:30 +0530

Or,
3. Should it set it to a fresh value of 200s (which means that the 
effective grace-period is 230s)?

Thanks,
Ashok

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Wed, 28 Jun 2006 08:21:54 -0700

Ashok

>> should the effective grace-period be?

In what type of scenario will it happen ?

Padma

>> 2. Should the grace-period be 300s (previous 100s + extended 200s), 
>> of which 30s have already elapsed?
>>
>>
>> Thanks,
>> Ashok
>>
>>

---

From: Ashok Chandrashekar Holla <[email-masked]>
Date: Thu, 29 Jun 2006 10:25:21 +0530

Padma Pillay-Esnault wrote:

>>> If a helper initially received the GR request with grace-period 
>>> 100s, and after 30s, receives a new Grace-LSA with grace-period 200, 
>>> what should the effective grace-period be?
>>
>>
>
Hi Padma,
The above case will occur when the administrator (or OSPF software) 
initially chose the grace-period to be small. Later, realizing that all 
adjacencies cannot be rebuilt within this time, requested for an 
extension of the grace-period.

In such cases, how will the new instance of Grace LSA be interpreted by 
the helper?
I feel the RFC defaults implicitly to the 3rd option (listed above) 
where the helper resets the Grace-period to the new value and ignores 
the time period that has already elapsed since the original request.

Am I correctly interpreting the RFC?

Regards,
Ashok

---

From: Ashok Chandrashekar Holla <[email-masked]>
Date: Thu, 29 Jun 2006 11:41:37 +0530

Don,

In my case, the Grace LSA would be a new instance, with an 
incremented/higher sequence number. This scenario is theoretical, but I 
am considering handling it for an implementation.

Best,
Ashok

Don Goodspeed wrote:

>Ashok, Padma,
>
>I see a case where a router has restarted in between but did
>not maintain the timer it had prior to the restart so it sent
>the configured value (say 200) again after coming back online.
>
>I'd be curious to know if the sequence # is the same or has
>incremented in Ashok's case (real or theoretical).
>
>-don
>
>-----Original Message-----
>From: Ashok Chandrashekar Holla [mailto:[email-masked]] 
>Sent: Wednesday, June 28, 2006 9:55 PM
>To: Padma Pillay-Esnault
>Cc: [email-masked]
>Subject: Re: [OSPF] Query regarding grace-period in Garceful-restart
>

---

From: "Don Goodspeed" <[email-masked]>
Date: Wed, 28 Jun 2006 22:41:42 -0700

Ashok, Padma,

-don

-----Original Message-----
From: Ashok Chandrashekar Holla [mailto:[email-masked]] 
Sent: Wednesday, June 28, 2006 9:55 PM
To: Padma Pillay-Esnault
Cc: [email-masked]
Subject: Re: [OSPF] Query regarding grace-period in Garceful-restart

Hi Padma,

Regards,
Ashok

---

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 29 Jun 2006 20:17:19 +0530

Hi,

For simplicity sake you could choose option 3. No two different LSA's
should have the same identifiers as far as possible.

Thanks,
Vishwas

---

From: Acee Lindem <[email-masked]>
Date: Thu, 29 Jun 2006 17:56:19 -0400

Hi Ashok,

When you accept the new grace LSA as specified in RFC 3623, you'll update
your restart timer to the new value (option 3) as specified above. I 
guess "updated
accordingly" could have been more precisely defined.

Hi Don,

When the new grace LSA is originated and the grace interval is 
different, the
checksum will be different (irrespective of the sequence number) and one
of the two LSAs (new or previous) will be more recent. Normal RFC 2328
 processing deals with both cases.  However, anytime the contents of any LSA
changes the originator should bump the sequence #.

Implementation Note: I do see the possibility of a DOS attack by a 
restarting
router that keeps changing it's restart interval. You may want to do some
rate limit.

Hope this helps,
Acee

Ashok Chandrashekar Holla wrote:

> incremented/higher sequence number. This scenario is theoretical, but 
> I am considering handling it for an implementation.
>
> Best,
> Ashok
>
>
> Don Goodspeed wrote:
>
>> Ashok, Padma,
>>
>> From: Ashok Chandrashekar Holla [mailto:[email-masked]] Sent: 
>> Wednesday, June 28, 2006 9:55 PM
>> To: Padma Pillay-Esnault
>> Cc: [email-masked]
>>>>> 100s, and after 30s, receives a new Grace-LSA with grace-period 
>>>>> 200, what should the effective grace-period be?
>>>>>       
>>>>
>>>>     
>>>
>> initially chose the grace-period to be small. Later, realizing that 
>> all adjacencies cannot be rebuilt within this time, requested for an 
>> In such cases, how will the new instance of Grace LSA be interpreted 
>> by the helper?
>>>>> 1. Should the helper set the grace-period to 200s, of which 30s 
>>>>> have already elapsed?
>>>>> 2. Should the grace-period be 300s (previous 100s + extended 
>>>>> 200s), of which 30s have already elapsed?
>>>>>
>>>>>
>>>>> Thanks,
>>>>> Ashok
>>>>>
>>>>>

---

From: "Vishwas Manral" <[email-masked]>
Date: Fri, 30 Jun 2006 11:45:45 +0530

Hi Acee,

Good point. More than rate limit, I prefer a hardlimit on the total
number of such LSA's that can be received, as well as some bounded
maximum value of time for which hitless restart can go on.

Thanks,
Vishwas

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Thu, 29 Jun 2006 23:28:10 -0700

Vishwas

I am in favor of having a max number of Grace LSA that can be received
( from 0 - meaning no other grace lsa is accepted once a helper received 
and initiated helping)
The maximum value of time a GR can go is anyway going to be 1hr assuming
that you do not have DNA lsas and DC configured.

Padma

---

From: Ashok Chandrashekar Holla <[email-masked]>
Date: Fri, 30 Jun 2006 12:08:51 +0530

Padma Pillay-Esnault wrote:

> ( from 0 - meaning no other grace lsa is accepted once a helper 
> received and initiated helping)
Actually, I think the 1800 seconds/{configuration defined Max 
Grace-period on Helper} will suffice to avoid any such problems.
The overall grace-period (sum of initial advertisement and all 
subsequent extensions) should continue to be less than 
1800/{configuration limit of Grace period on Helper}.There is no need 
for a LSA number/rate limit.
But, I am wondering whether the RFC, in its current wording, is clear 
enough to avoid inter-op issues w.r.t to interpretation of the length of 
grace-period in the case of multiple Grace LSAs..
-Ashok

---

From: sujay <[email-masked]>
Date: Fri, 30 Jun 2006 12:16:43 +0530

While it is a good point to add this condition  ie.controlling the Max
No. of LSA's.
this count should be kept by default as Zero.(0)

For once the restart has begun, the idea of once again sending grace
lsa's with varied contents
assuming the helpers will extend the lease period + ensuring they have
all received it. And,
all this happening when the control plane is undergoing a restart. 
Looks more like the initial grace period configured was a misfit.

The primary behaviour for helpers should be to reject any new grace
lsa's once in restart mode, or
the count as Zero.

Regds,
Sujay G
My Location;
http://maps.google.com/maps?ll=14.626109,76.959229&spn=4.724852,7.525085
&t=h&hl=en

This e-mail and attachments contain confidential information from
HUAWEI, which is intended only for the person or entity whose address is
listed above. Any use of the information contained herein in any way
(including, but not limited to, total or partial disclosure,
reproduction, or dissemination) by persons other than the intended
recipient's) is prohibited. If you receive this e-mail in error, please
notify the sender by phone or email immediately and delete it! 

-----Original Message-----
From: Padma Pillay-Esnault [mailto:[email-masked]] 
Sent: Friday, June 30, 2006 11:58 AM
To: Vishwas Manral
Cc: [email-masked]
Subject: Re: [OSPF] Query regarding grace-period in Garceful-restart

Vishwas

I am in favor of having a max number of Grace LSA that can be received (
from 0 - meaning no other grace lsa is accepted once a helper received 
and initiated helping)
The maximum value of time a GR can go is anyway going to be 1hr assuming
that you do not have DNA lsas and DC configured.

Padma

>> different, the checksum will be different (irrespective of the 
>> sequence number) and one of the two LSAs (new or previous) will be 
>> more recent. Normal RFC 2328  processing deals with both cases.  
>> However, anytime the contents of any LSA
>> restarting router that keeps changing it's restart interval. You may 
>> want to do some
>> rate limit.
>>
>> Hope this helps,
>> Acee
>>
>>
>>
>> > incremented/higher sequence number. This scenario is theoretical, 
>> > but I am considering handling it for an implementation.
>> >
>> > Best,
>> > Ashok
>> >
>> >
>> > Don Goodspeed wrote:
>> >
>> >> Ashok, Padma,
>> >>
>> >> I see a case where a router has restarted in between but did not 
>> >> maintain the timer it had prior to the restart so it sent the 
>> >> configured value (say 200) again after coming back online.
>> >>

>> >>>> 3. Should it set it to a fresh value of 200s (which means that 
>> >>>> the effective grace-period is 230s)?
>> >>>>
>> >>>> Thanks,
>> >>>> Ashok
>> >>>>
>> >>>>

>> >> The above case will occur when the administrator (or OSPF 
>> >> software) initially chose the grace-period to be small. Later, 
>> >> realizing that all adjacencies cannot be rebuilt within this time,

>> >> requested for an extension of the grace-period.
>> >>
>> >> In such cases, how will the new instance of Grace LSA be 
>> >> interpreted by the helper? I feel the RFC defaults implicitly to 
>> >> the 3rd option (listed above) where the helper resets the 
>> >> Grace-period to the new value and ignores the time period that has

>> >> already elapsed since the original request.
>> >>

>> >>>>> have already elapsed? 2. Should the grace-period be 300s 
>> >>>>> (previous 100s + extended 200s), of which 30s have already 
>> >>>>> elapsed?
>> >>>>>
>> >>>>>
>> >>>>> Thanks,
>> >>>>> Ashok
>> >>>>>
>> >>>>>
>> >>>>> [email-masked] https://www1.ietf.org/mailman/listinfo/ospf
>> >>>>>
>> >>>>>
>> >>>>

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Fri, 30 Jun 2006 00:48:32 -0700

Ashok Chandrashekar Holla wrote:

> enough to avoid inter-op issues w.r.t to interpretation of the length 
> of grace-period in the case of multiple Grace LSAs..
> -Ashok

I think the RFC is vague enough to allow people to tailor their 
implementations and I don't think that
there is an interoperability problem per se.
This is also an internal implemental decision of the helper which 
already has a number of possible
configs - when to accept to help for example.

Padma

>>>> but
>>>> interpreted

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Fri, 30 Jun 2006 00:50:40 -0700

>this count should be kept by default as Zero.(0)
Sujay

This should be only a recommendation for implementations.

Padma

>>>>>>>>I have a doubt regarding the grace-period interpretation in RFC
>>>>>>>>                
>>>>>>>>
>>>3623.
>>>      
>>>

---

From: sujay <[email-masked]>
Date: Fri, 30 Jun 2006 13:50:59 +0530

Padma,
I do see an inter-op issue for a simple scenario.

Where the restarting router has assumed the helpers
 have a incremented the lease period to (x+y) , whereas
one helper has not, but it could have, provided the behaviour was
defined.
Results in a pre-mature exit -gr condition for the sole reason of an
undefined
behavior.

Please correct me.

Regds,
Sujay G
My Location;

-----Original Message-----
From: Padma Pillay-Esnault [mailto:[email-masked]] 
Sent: Friday, June 30, 2006 1:19 PM
To: Ashok Chandrashekar Holla
Cc: [email-masked]
Subject: Re: [OSPF] Query regarding grace-period in Garceful-restart

Ashok Chandrashekar Holla wrote:

>> I am in favor of having a max number of Grace LSA that can be 
>> received ( from 0 - meaning no other grace lsa is accepted once a 
>> helper received and initiated helping) The maximum value of time a GR

>> can go is anyway going to be 1hr assuming that you do not have DNA 
>> lsas and DC configured.
>>
>> Padma
>>

Padma

>>>> sequence number) and one
>>>> restarting router that keeps changing it's restart interval. You 
>>>> may want to do some
>>>> rate limit.
>>>>
>>>> Hope this helps,
>>>> Acee
>>>>
>>>>
>>>>

>>>> >>>>> If a helper initially received the GR request with 
>>>> >>>>> grace-period 100s, and after 30s, receives a new Grace-LSA 
>>>> >>>>> with grace-period 200, what should the effective grace-period

>>>> >>>>> be?
>>>> >> realizing that all adjacencies cannot be rebuilt within this 
>>>> >> time, requested
>>>> for an
>>>> >> I feel the RFC defaults implicitly to the 3rd option (listed 
>>>> >> above) where the helper resets the Grace-period to the new value

>>>> >> and
>>>> ignores
>>>> >>>>> 1. Should the helper set the grace-period to 200s, of which 
>>>> >>>>> 30s have already elapsed? 2. Should the grace-period be 300s

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Fri, 30 Jun 2006 02:11:08 -0700

>one helper has not, but it could have, provided the behaviour was
IMHO, it should not assume that.

>>>>>your restart timer to the new value (option 3) as specified above.
>>>>>          
>>>>>
>I
>  
>
>>>>>guess "updated
>>>>>of the two LSAs (new or previous) will be more recent. Normal RFC
>>>>>          
>>>>>
>2328
>  
>
>>>>>>>Subject: Re: [OSPF] Query regarding grace-period in
>>>>>>>              
>>>>>>>
>>>>>Garceful-restart
>>>>>          
>>>>>
>>>>>the
>>>>>>>>>>I have a doubt regarding the grace-period interpretation in
>>>>>>>>>>                    
>>>>>>>>>>
>>>>>RFC 3623.
>>>>>          
>>>>>
>>>>>>>the time period that has already elapsed since the original
>>>>>>>              
>>>>>>>
>>>>>request.
>>>>>          
>>>>>

---

From: Hasmit Grover <[email-masked]>
Date: Fri, 30 Jun 2006 09:23:44 -0700

> IMHO, it should not assume that.

Well the reason for restarting router to send two grace LSAs would be to
inform its neighbors to increase its restart interval. If such use of grace
LSAs is not recommended it should be clearly specified otherwise the results
in such a case will become implementation dependent.

- Hasmit

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Fri, 30 Jun 2006 10:30:59 -0700

>in such a case will become implementation dependent.
Hi Hasmit

I actually don't buy into the argument that the implementation needs 
more time - if you want to be
safe configure the maximum time allowed and any good implementation 
should get out of GR asap
on success. This looks more like an operational/usage misconfig to me.

Padma

---

From: Hasmit Grover <[email-masked]>
Date: Fri, 30 Jun 2006 10:39:30 -0700

> on success. This looks more like an operational/usage misconfig to me.

I agree that we should not extend the grace interval on receiving multiple
grace LSAs. I wanted to make sure that this fact is documented so that all
implementations conform to this behavior and we don't have any future
interop issues.

- Hasmit