Summary

  • In TRILL, an Appointed Forwarder has bounded authority to ingress and egress native frames for a particular VLAN on a particular link. That status does not govern TRILL Data or IS-IS traffic.
  • A switch can retain that appointment while DRB, root-change or VLAN inhibition timers require it to suppress the affected native frames. Inhibition is a safety state, not an appointment revocation.
  • An operator therefore needs separate receipts for DRB election, appointment source, VLAN and port eligibility, the signal that started inhibition, timer expiry, actual frame handling and end-station service.

The alarming line in an incident console is not always an error. It may say that a switch is the Appointed Forwarder and, a few columns later, that forwarding is inhibited.

Read those words as one binary status and the machine appears incoherent. Read them as two decisions and the design becomes precise. The appointment answers who is assigned to handle native traffic for one VLAN on one link. Inhibition asks whether that assigned switch may exercise the assignment now, while the surrounding topology is settling or another switch claims the same role.

The difference is a useful entry into Radia Perlman's standards record. She is often introduced through the spanning-tree algorithm, IS-IS and TRILL. The Internet Hall of Fame describes those contributions and inducted her as a pioneer in 2014. The IETF record observed in September 2026 lists 22 RFCs under her name. Those facts supply identity and continuity, not ownership of every mechanism or every implementation.

RFC 6439, which clarified the Appointed Forwarder mechanism in 2011, was collective Standards Track work by Perlman, Donald Eastlake 3rd, Yizhou Li, Ayan Banerjee and Fangwei Hu. The current account must also move beyond that document. RFC 8139, written by a different author group in 2017, obsoletes RFC 6439 and updates the TRILL base and adjacency specifications. Version history is part of the evidence.

The badge belongs to a VLAN on a link

TRILL was designed to combine link-state routing with Ethernet service. Inside a TRILL campus, switches use IS-IS and forward encapsulated TRILL Data frames with a hop count. At an edge, however, end stations send and receive ordinary, or native, frames. A multi-access link can attach more than one TRILL switch, which raises a hazardous question: which one may bring a native frame into the campus or deliver it back to that LAN?

The answer is scoped. For VLAN-x on one link, an Appointed Forwarder is the TRILL switch assigned to ingress and egress native frames. The Designated RBridge, or DRB, is the default and may appoint other switches for selected VLANs. A single switch may cover many VLANs; different VLANs may be divided among switches.

None of that creates a campus-wide title. The appointment is not “primary switch” in the abstract. It names a link, a VLAN and a native-frame function. It has no effect on reception, transmission or forwarding of TRILL Data or TRILL IS-IS frames. A dashboard that reduces the state to appointed=true deletes the dimensions that make the statement meaningful.

Even the source of appointment matters. RFC 8139 describes DRB self-assumption, assignments distributed through a link-scoped IS-IS database, assignments carried in TRILL Hellos, changes caused by DRB elections, Port-Shutdown handling and local configuration. The specification keeps both a semi-permanent E-L1CS appointment database and the most recent Hello appointment database. One green badge can therefore summarize more than one record with different lifetimes.

Why the assigned switch may stand down

The danger is simultaneous action. If two switches both ingress and egress native frames for the same VLAN on the same link, part of a loop may consist of unencapsulated frames. That portion does not carry the TRILL hop count that would otherwise limit circulation. VLAN mapping within a bridged LAN can create a related risk across two VLAN identifiers.

The standards try to prevent conflicting appointments. They also assume that distributed state does not become consistent everywhere at one instant. An additional brake is needed between “I have an appointment” and “I will act on it.”

RFC 8139 specifies three families of inhibition timers on every link where a switch can offer end-station service. A DRB inhibition timer starts when a port believes it has won the DRB election, giving the link time to reveal competing state. A VLAN inhibition timer is extended when a switch receives a Hello in which another sender asserts that it is the Appointed Forwarder for that VLAN. Enabling a VLAN that was previously absent also starts caution rather than immediate service.

A root-bridge-change timer starts when the common spanning-tree root seen from an attached bridged LAN changes; its default is 30 seconds, with shorter values and optimizations available when settling behavior is known.

These are not identical causes. Election change, role conflict, VLAN enablement and spanning-tree movement should not be flattened into “port blocked.” The cause determines the scope, expected duration, investigation owner and safe recovery.

The timer granularity encodes the cost. Fine per-VLAN timers keep uncertainty in one VLAN from unnecessarily stopping another. Implementations may merge some timers when resources are constrained, but RFC 8139 requires at least two logical classes and forbids combining a VLAN for which the switch is appointed with one for which it is not. Coarser safety can remain correct while causing more loss. Correctness and availability are not the same metric.

The appointment survives the silence

When the relevant timer has not expired, an inhibited Appointed Forwarder does not output a decapsulated native frame onto the affected link and does not queue it there. A native frame that would normally be ingressed from that link is ignored, apart from possible address learning.

Yet the switch continues to indicate in its Hellos whether it believes it is Appointed Forwarder. The appointment record remains visible because peers need it to diagnose and converge. Nor does inhibition stop TRILL Data or IS-IS traffic. The control plane and encapsulated campus forwarding continue while one native edge function is restrained.

This is the central evidence boundary. A revocation would change who holds the assignment. Inhibition changes whether the current holder may perform the affected action for a time. Confusing the two can produce opposite mistakes. An operator may reassign traffic unnecessarily because the appointment appears “broken,” or may restore native forwarding too early because the appointment still appears valid.

The system needs a state vector, not a slogan:

  1. Which port currently wins the DRB election, and in which election generation?
  2. Which database or Hello assigned which switch to which VLANs?
  3. Is the VLAN enabled and the port eligible to offer end-station service?
  4. Which received Hello, configuration change or root event started inhibition?
  5. What is the timer's remaining value and the rule for its expiry?
  6. Are native ingress and egress actually suppressed for the affected scope?
  7. Are TRILL Data and IS-IS paths continuing as required?
  8. Has another forwarder been appointed, and did end stations regain service?

An answer to item two does not answer item six. A timer reaching zero does not answer item eight.

Prove the negative branch

Running-code evidence begins with the action that should not occur. In a controlled test, create or simulate the relevant conflict, record the exact Hello or topology signal, and show that the VLAN timer moves to the required value. Then send native traffic in both directions. Counters, packet capture and peer observation should agree that the switch did not ingress from or egress onto the inhibited link/VLAN.

The test also has to protect the negative boundary from spreading. TRILL Data and IS-IS packets should still be received and forwarded. Other VLANs with independent timer state should continue unless their own conditions require inhibition. A device that drops every frame has demonstrated outage, not faithful inhibition.

Expiry is another transition, not a conclusion. Capture the timer reaching zero, the continuing appointment basis and the first permitted native-frame action. Then test reachability and duplication from the end station's point of view. Absence of a loop in one capture window does not prove durable service, just as a successful ping does not reconstruct which switch ingressed every broadcast.

When adjacency to an appointed switch disappears, RFC 8139 says the DRB should rapidly appoint another switch or take over if the traffic still needs handling. That creates a separate handoff receipt: lost adjacency, reassignment decision, new effective appointment, old path suppressed, new path active and service restored. Port-Shutdown messages can shorten detection, but their receipt is not proof that every peer changed state correctly.

Safety has an availability price

Inhibition intentionally accepts temporary native-frame loss to avoid a potentially persistent loop. The price should be measured, not hidden behind the word “safe.” A 30-second settling interval may be prudent for one attached bridged LAN and unnecessarily costly for another whose convergence is well understood. Shortening it without evidence raises loop exposure; leaving it coarse may prolong avoidable service loss.

Unnecessary changes of Appointed Forwarders have a similar cost. The standard discourages them because moving the assignment can interrupt end-station service. An optimization that continually redistributes VLANs may look balanced in configuration while generating more transitions, more timer activity and more moments in which no edge is prepared to deliver a frame.

The operational object is therefore not maximum appointment churn or minimum inhibition time. It is bounded uncertainty. Operators need enough time for conflicting topology information to surface, fine enough scope to protect unaffected traffic, and an observable path back to service.

Perlman's contribution without a founder myth

Perlman's public record makes this problem especially legible. Her work repeatedly addresses how distributed networks keep operating when participants have incomplete or changing views. But RFC authorship is not a certificate of sole invention, and an RFC is not an implementation receipt.

The proper attribution is layered. RFC 6325 established the base protocol through five co-authors. RFC 6439 documented and refined Appointed Forwarders through another five-author team that included Perlman. Six years later, RFC 8139 replaced that document, expanded the appointment machinery and added operational details under a different list of authors. Operators and implementers then make their own choices within those semantics.

That history strengthens rather than weakens the lesson. Durable coordination does not require one permanent owner. It requires small, explicit state distinctions that later participants can revise without erasing the evidence boundary. Here the crucial distinction is simple enough to fit in a shift log: this switch is appointed; this switch is inhibited; these statements can both be true.

Sources