Summary

  • RFC 9692 normally sends detailed topology north and aggregated defaults south. A fallen leaf exposes the cost of that economy: one plane can retain a default while lacking the specific southbound path.
  • Positive disaggregation attracts traffic to routers that still have reachability and stops after one level; negative disaggregation removes failed next hops and can propagate to the ingress leaf where plane selection occurs.
  • A received negative Prefix TIE, a settled RIFT database or an abstract RIB entry does not prove that every hardware FIB changed or that packets escaped loss. Those observations need separate records.

The alarm that matters may not be “default route missing.” It may be the opposite: the default is still present, syntactically healthy and broadly useful. Only one destination hidden inside it has ceased to be reachable through one of the available planes.

RFC 9692, an IETF Standards Track document published in April 2025, defines RIFT for Clos and fat-tree fabrics. Its scale economy is directional. Detailed link state and attached prefixes travel north in North TIEs. Southbound information is deliberately smaller: a node normally advertises its adjacencies and IPv4 and IPv6 defaults, with exceptions only when needed. The RFC record describes the same hybrid as link state toward the spines and distance vector toward the leaves.

That compression is useful precisely because most edge devices need not carry the whole fabric. It also means a default can summarize paths that are no longer uniformly true. RFC 9692 calls a leaf reachable by only a subset of Top-of-Fabric nodes a “fallen leaf.” In a multi-plane fabric, an ingress leaf may choose the plane before any higher node can redirect the packet. A stale choice can therefore send traffic into a plane whose default survives although its path to the destination leaf does not.

Two repairs for two topologies

Positive disaggregation is the narrower repair. A node that can still reach an affected prefix advertises the more-specific prefix in a positive South Prefix TIE. Longest-prefix matching attracts traffic toward the capable parents. The advertisement is non-transitive: a receiver one level down does not reproduce it farther south merely because it received it.

This can be enough when the advertising ToF nodes collectively cover the nodes in the broken plane. They form a ceiling that catches northbound traffic before it reaches an incapable parent. The benefit is containment: the extra state and flooding remain near the failure.

Negative disaggregation addresses the harder case. A ToF that cannot reach the fallen leaf advertises its prefixes negatively. The negative route is not an independent destination. It is meaningful only inside a shorter positive aggregate, whose next-hop set it inherits. The router then removes the parents that advertised the negative exception. RFC 9692 illustrates the result as a hole punched in a default: the RIB keeps the negative route and its tie-breaking information, while the FIB receives the remaining positive forwarding instructions.

The exception becomes transitive only under a strict condition. An intermediate node must see no child advertising the prefix and negative advertisements from all of its parents. It then originates the same negative prefix farther south. Recursion can carry the warning to the leaf that chooses a plane. If one parent withdraws its negative advertisement, the intermediate node must withdraw its own transitive advertisement too.

RFC 9692 gives two ways a negative exception arises. A ToF can compare reachability derived from all North Node TIEs, including horizontal ToF links, with its normal southbound SPF and identify leaves absent from the latter. Farther down, a router can discover during prefix attachment that every viable next hop inherited from the shorter aggregate has been pruned by negative advertisements. Both are control-plane computations. Neither is a packet delivery report.

The repair has multiple receipts

A disciplined incident record should not collapse the repair into one green status. The first receipt is the physical or logical adjacency event: a port transition, LIE timeout or optional BFD observation. RFC 9692 allows BFD, while RFC 5880 and RFC 5881 define rapid bidirectional failure detection. Fast detection says that a bounded path failed its liveness test. It does not say that the correct leaf prefixes were identified.

The second receipt is information movement: changed North Node and Prefix TIEs, complete ToF knowledge across planes, and the resulting positive or negative South Prefix TIE. The third is computation: the complete-graph versus S-SPF comparison, the chosen route type and the RIB next-hop set after inheritance and pruning. The fourth is installation: the actual hardware FIB entry and the next hops programmed on each relevant ingress device.

The fifth receipt is observation through the data plane. An active check such as the two-way method standardized in RFC 5357 can show what one probe experienced over one interval. It should be varied across ingress leaves, destination prefixes, address families and ECMP hashes. Even then, a successful probe does not certify application state, capacity under load or every alternative path. The sixth receipt is the delivered service itself.

RFC 9719 helps expose RIFT configuration and operational state, including interfaces, neighbors, TIE databases and SPF statistics. That is valuable evidence, but its scope remains management of the routing protocol. A clean modeled database should not be renamed “forwarding verified” unless hardware and traffic observations support the claim.

Withdrawal deserves the same test

Repair completion is not the last control-plane event. When reachability returns, an originator withdraws a negative disaggregate by re-advertising the TIE without that prefix. Downstream nodes must recalculate inherited next-hop sets and withdraw their transitive negatives. A stale exception may preserve reachability through fewer planes than necessary, concentrate traffic or hide restored redundancy.

RFC 9696 supplies useful operational context. It says negative disaggregation needs complete prefix knowledge at the ToF and notes that FIB programming can be recursive and more complex than ordinary routes. It also warns that ECMP does not itself guarantee delivery or bounded latency. The document explains applicability; it does not report performance or conformance for a named implementation.

The current RFC 9692 errata record contains a held technical correction about omitted Thrift material in Section 7.2. It does not change the fallen-leaf or disaggregation procedures described here.

The editorial frame comes from Heng Lu’s essays on running-code primacy, minimum initial specification and reality layers. They suggest keeping the written rule, implementation behavior and observed outcome separate. They are not IETF requirements and provide no evidence about a RIFT deployment.

The bounded conclusion is simple. RFC 9692 defines a credible way to repair the lie told by an overbroad default. Acceptance begins only when operators can trace the repair from failure detection through TIE movement, computation, FIB installation, probe outcome and delivered service—and trace the withdrawal back again.