RFC 5212: A Multi-Layer Route Is Not Service Proof

Summary

RFC 5212 lets a GMPLS control plane see traffic-engineering links across multiple layers and regions. It also permits a route to be computed while the necessary lower-layer connection does not yet exist.
Capability advertisement, a virtual TE link and a stable link identifier are planning evidence. A defensible service claim additionally needs boundary-resource allocation, lower-layer instantiation, inherited-risk provenance, verification, OAM correlation and observed client traffic.

One database, several realities

RFC 5212 is an Informational requirements document, not a protocol specification. It distinguishes a data-plane layer, such as a particular TDM granularity, from a control-plane region identified by switching type. A multi-layer network may contain several layers of one switching type; a multi-region network contains at least two switching types. In the model, one GMPLS control-plane instance may consolidate their TE links into one Traffic Engineering Database.

That consolidation is powerful. A path calculator can examine packet, Layer 2, TDM, wavelength and fibre switching resources without maintaining an isolated worldview for every layer. It can optimise more than the route visible to one client technology. But a richer map remains a map. It records abstractions supplied by distributed systems at particular times and under particular policies.

The document makes this limit unusually visible. Routing and signalling should be able to operate with partial TE information. A virtual TE link can be advertised upward as though an underlying LSP had been established when it has not. A computed multi-layer route may not be connected in the same layer as its endpoints. The design assumes that triggered signalling at a boundary will create or select the missing lower-layer LSP.

The route is therefore a plan containing future verbs.

The boundary owns the scarce verb

An Interface Switching Capability Descriptor tells the control plane what kind of forwarding an interface supports, its encoding and relevant bandwidth characteristics. It does not allocate the internal resource that terminates one technology and presents traffic to another.

RFC 5212 calls those termination and adjustment resources out separately. Hybrid nodes should maintain their internal-link resources, and path computation should consider their availability. Otherwise a higher-layer LSP can reach the boundary and fail because the lower layer cannot supply the adaptation it needs.

This is the operational centre of the article. The topology can show two compatible surfaces while the transformation between them is exhausted, reserved, administratively forbidden or faulted. A capability statement answers “could this node perform this class of function?” Availability answers “can it do so for this request now?” Allocation answers whether the request acquired the resource. Verification asks whether the resulting data link is actually correct. Those are four receipts, not one field.

A virtual link is an honest option, not a hidden circuit

The RFC's virtual TE link is useful precisely because it separates possibility from pre-provisioning. Reserving every lower-layer LSP in advance would waste bandwidth and adaptation resources. Instead, the upper layer may see preferred connectivity before the server-layer LSP exists. If an upper-layer setup uses that virtual link, the underlying LSP must then be signalled immediately.

Nothing is deceptive about that mechanism when its state is preserved. The error begins when an inventory, dashboard or assurance system flattens “advertised possibility,” “signalling in progress,” “established LSP,” “verified data link” and “carrying client traffic” into one green object.

Even a real advertised TE link can conceal change. RFC 5212 requires an FA-LSP to be reroutable while the corresponding interface identifiers remain stable. A lower layer may dynamically change the server path. Stable identity is valuable to the client layer, but it is not proof of stable physical fate.

Reliability can disappear during inheritance

When a lower-layer LSP becomes a TE link for the layer above, properties must move with it: switching capability, metrics, bandwidth, protection and Shared Risk Link Group information. RFC 5212 does not say this is mechanical. Inheritance follows policy; a higher-layer metric need not be the sum of lower-layer metrics. Hiding the lower route can lose information needed to judge reliability, and the document leaves detailed SRLG inheritance for further work.

This creates a governance boundary inside a technical abstraction. Someone decides which risk is exposed, aggregated or withheld. Two client links can look disjoint while their hidden server paths share a duct, amplifier, power source or administrative dependency. Protection advertised above may not mean what an operator assumes below. The abstraction is not false, but its assurance claim is no stronger than the provenance of the inherited attributes.

RFC 5212 also recognises that optimisation can disturb traffic. Reconfiguring a Virtual Network Topology, releasing an underused FA-LSP or moving nested traffic can affect upper-layer service. Make-before-break is a mitigation. It is not a measurement of loss, reordering or application impact.

Establishment ends one question

Section 5.9 draws the cleanest line. Once a lower-layer LSP is established for use as an upper-layer data link, it may be verified for correct connectivity and data integrity before being made available. The technology-specific test is outside the document, while GMPLS should coordinate it.

If establishment already proved service, that paragraph would be redundant. It is not. Signalling completion proves a control-plane transaction reached a defined state. Verification can prove properties of the resulting server link. Client-layer OAM then needs to remain meaningful across that hidden segment, and relevant server alarms must reach the client layer. Finally, observed traffic establishes what the service did from a stated vantage and interval.

The useful evidence chain is: request generation; route and layer transitions; boundary policy decision; adjustment allocation; virtual-to-real state; server LSP identity and resource reservation; attribute and SRLG provenance; connectivity and integrity test; client/server OAM correlation; client forwarding; application outcome.

That receipt is editorial guidance, not a requirement imposed by RFC 5212. Its purpose is to stop one layer's success from impersonating another layer's result.

The map has authority only over the map

Heng Lu's broader doctrine separates an administrative record from the system it describes and authority from visibility. The same discipline fits multi-layer traffic engineering. A TED entry is authoritative evidence that the control plane received and retained a representation. It does not authorise a separate administrative domain, spend a scarce adapter, reveal every shared risk or certify a service.

This does not diminish the control plane. It makes its contribution auditable. A good map permits computation. A good signalling system attempts state change. A good verifier tests the created link. A good assurance system binds those records without erasing their owners or timestamps.

The dangerous dashboard is the one that celebrates the first success and silently borrows the rest.

The Map Crossed Every Layer. The Circuit Stopped at the Adapter.

Why it matters

Summary

One database, several realities

The boundary owns the scarce verb

A virtual link is an honest option, not a hidden circuit

Reliability can disappear during inheritance

Establishment ends one question

The map has authority only over the map

Sources

Deeper Profile Context

Strategic Circle

Leadership Alliance

Strategic Circle Briefing

Leadership Alliance Briefing