| Internet-Draft | Problem Statement for Network Resilience | November 2026 |
| Zhao, et al. | Expires 6 May 2027 | [Page] |
This document examines the problem space for network resilience, focusing on the ability of networks to maintain acceptable service levels and recover from disruptive conditions. It identifies limitations of existing protection and recovery mechanisms under correlated, cascading, or evolving failures, and when resources or systems required for recovery are themselves impaired. It analyzes resilience challenges across risk anticipation, disruption absorption and adaptation, service recovery, and continuous improvement, and identifies corresponding capability gaps to be addressed.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 6 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Current IP network reliability mechanisms are largely built around redundancy, fast failure detection, protection switching, and topology convergence. These mechanisms are effective for many anticipated and relatively well-bounded failures. However, as network scale, service dependency, and operational complexity increase, failures may become correlated across layers, evolve dynamically, consume the resources needed for recovery, or degrade service without causing a clear binary "up/down" state. In these conditions, static protection alone may not be sufficient to preserve service continuity.¶
In this document, network resilience refers to the ability of a network to anticipate and reduce risks, absorb and contain disruptions, maintain an acceptable level of service under adverse conditions, adapt to changing network conditions, and restore the intended service level within defined recovery objectives.¶
Network resilience builds upon existing reliability, protection, and survivability mechanisms rather than replacing them. These mechanisms provide important capabilities for maintaining service continuity and recovering from network failures. However, their effectiveness may be limited when the assumptions underlying protection and recovery no longer hold, such as when failures are correlated, backup resources become insufficient, or the control and management functions required for recovery are impaired.¶
The fundamental concern of network resilience is therefore not only whether a failure can be detected or a protection mechanism can be activated, but whether the network can continue to provide acceptable service, contain the impact of disruptions, and restore service under changing and potentially degraded conditions.¶
This definition of network resilience is aligned with common resilience framing; it is distinguished from classical reliability, which focuses primarily on failure detection and fast restoration under independent-failure assumptions.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 RFC2119 [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Existing IP networks employ redundancy, failure detection, protection switching, routing convergence, and traffic engineering mechanisms to maintain service continuity and recover from network failures. These mechanisms are effective in handling many anticipated and relatively well-bounded failures. However, their effectiveness may be limited when disruptions involve correlated failures, evolving network conditions, resource constraints, or degradation of the systems required for recovery.¶
The fundamental network resilience problem is not simply the occurrence of failures, but the possibility that existing protection and recovery mechanisms cannot maintain acceptable service levels or achieve the intended recovery objectives under adverse conditions.¶
For example, protection mechanisms may successfully restore connectivity after a single link failure, but may not provide the expected protection when multiple paths share an underlying physical dependency. Similarly, rerouting traffic to an alternative path may restore reachability but introduce congestion and service degradation if the available resources are insufficient.¶
These situations illustrate how network disruptions can expose limitations in existing protection and recovery mechanisms, resulting in service degradation, failure propagation, or incomplete recovery.¶
The following subsections examine representative disruptions and latent vulnerabilities, the limitations they expose in existing mechanisms, and the resulting consequences for service continuity and recovery.¶
+-------------------------------------------------------------------------+
| Disruptions and Latent Vulnerabilities |
| |
| Physical, configuration, design, protocol, performance, and security |
| conditions; hidden dependencies and evolving disruptions |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------+
| Limitations of Existing Protection and Recovery |
| |
| - Incomplete failure coverage and hidden dependencies |
| - Insufficient resources for protection and recovery |
| - Incomplete awareness of network and service conditions |
| - Uncoordinated recovery actions |
| - Degradation of recovery systems |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------+
| Consequences for Service Continuity and Recovery |
| |
| - Correlated or cascading failures and expanded impact |
| - Service degradation despite retained connectivity |
| - Prolonged, unstable, or incomplete recovery |
| - Residual risks after service restoration |
+-------------------------------------------------------------------------+
Network disruptions may originate from a variety of physical, operational, design, protocol, performance, and security-related conditions. Representative sources include:¶
Physical Interruptions: Failures of links, ports, devices, or supporting infrastructure that affect network connectivity or forwarding capabilities.¶
Configuration Errors: Incorrect or inconsistent configurations introduced during provisioning, maintenance, or policy changes, potentially affecting reachability, routing, traffic engineering, or service isolation.¶
Planning and Design Defects: Latent weaknesses in network topology, protection design, dependency assumptions, or capacity planning that may remain undetected during normal operation.¶
Control-plane and Protocol Anomalies: Abnormal protocol behavior, inconsistent control-plane state, or unstable interactions between routing and protection mechanisms.¶
Implicit Deterioration (Gray Failures): Conditions in which network components remain operational while traffic experiences unacceptable packet loss, delay, jitter, or other performance degradation.¶
Security Incidents: Malicious or unauthorized activities that affect network resources, compromise control or management information, or disrupt normal forwarding and recovery operations.¶
These conditions do not necessarily result in service disruption individually. Some may be handled effectively by existing protection mechanisms, while others may remain latent until the network experiences additional stress or failures.¶
For example, a network may contain hidden shared-risk dependencies between nominally redundant paths. Such dependencies may not affect normal operation but can cause simultaneous failures when a common underlying resource becomes unavailable.¶
Moreover, different disruptive conditions may interact. A physical failure may trigger traffic redistribution, which increases resource utilization and causes performance degradation. The resulting instability may further trigger routing changes or additional protection actions.¶
Consequently, network resilience challenges cannot be characterized solely by identifying individual failure sources. It is also necessary to consider how latent vulnerabilities and disruptive conditions interact with existing protection and recovery mechanisms.¶
Existing protection and recovery mechanisms operate under certain assumptions concerning failure scenarios, resource availability, network state, and the availability of supporting control and management functions. Under complex disruptive conditions, these assumptions may no longer hold. The following limitations are particularly relevant to network resilience.¶
Protection and recovery mechanisms may assume that sufficient resources are available to accommodate traffic after a failure.¶
In practice, alternative forwarding paths may have limited bandwidth, forwarding plane capacity, or queue resources. A recovery action that is valid from a connectivity perspective may therefore cause congestion or unacceptable performance degradation under the actual traffic load.¶
Resource constraints may also affect the control and management planes. Excessive protocol processing, repeated recovery actions, or telemetry overload may consume resources required for fault diagnosis, routing convergence, and recovery coordination.¶
Consequently, the existence of a backup path or recovery mechanism does not necessarily guarantee that acceptable service can be maintained during disruption.¶
Conventional failure detection and protection mechanisms often rely on observable changes in component or protocol state. However, service degradation does not always correspond to an explicit link or node failure. A network path may remain operational while affected traffic experiences excessive delay, packet loss, jitter, or intermittent forwarding problems.¶
Although OAM and telemetry mechanisms provide information about network conditions, the available observations may be fragmented across devices, layers, and operational domains.¶
Without sufficient correlation between network state, resource conditions, and service performance, recovery mechanisms may fail to recognize the extent of degradation or select an appropriate mitigation action.¶
Networks may employ multiple protection, routing, traffic engineering, and management mechanisms that operate independently or at different timescales. Under complex failure conditions, actions taken by one mechanism may change the operating conditions observed by another. For example, protection switching may redistribute traffic and cause congestion, while subsequent routing changes may further alter traffic distribution.¶
Such interactions may lead to repeated switching, routing oscillation, forwarding instability, or additional service disruption.¶
Therefore, mechanisms that function correctly in isolation may not necessarily produce an effective recovery outcome when operating together.¶
Network recovery increasingly depends on monitoring systems, control and management connectivity, controllers, orchestration platforms, and other operational functions.¶
These systems may themselves be affected by the same disruption that they are expected to mitigate.¶
For example, management connectivity may become unavailable, telemetry information may be delayed or incomplete, or control-plane resources may be exhausted during a large-scale failure.¶
In such circumstances, the network may retain usable forwarding resources but lack the operational capabilities required to assess the situation, coordinate mitigation, or verify the recovery outcome.¶
This creates a particular resilience challenge: the mechanisms required for recovery may themselves become unavailable or unreliable when they are most needed.¶
The limitations described above may prevent network disruptions from being contained within their original scope and may reduce the effectiveness of protection and recovery.¶
A localized disruption can evolve into a larger service-impacting event through correlated failures, traffic redistribution, resource contention, or interactions among recovery mechanisms.¶
For example, a physical link failure may trigger traffic rerouting to an alternative path. If the alternative path lacks sufficient capacity, congestion and packet loss may occur. The resulting degradation may trigger additional protocol or recovery actions, further expanding the affected scope.¶
In such scenarios, successful activation of a protection mechanism does not necessarily imply successful preservation of service continuity.¶
The impact on service continuity also extends beyond binary availability. A network may remain connected while providing degraded service performance, or it may restore connectivity without recovering the capacity and performance required by affected services.¶
The consequences of a disruption therefore need to be considered in terms of:¶
Impact Scope: The services, traffic flows, network resources, or domains affected by the disruption.¶
Degradation Severity: The extent to which service performance deviates from its acceptable operating level.¶
Impact Duration: The period during which service performance remains degraded or unavailable, including intermittent or recurring disruption.¶
Recovery Effectiveness: The ability to restore the intended service level within the applicable recovery objectives and maintain a stable recovered state.¶
The acceptable degree and duration of degradation depend on the requirements and criticality of individual services. A short interruption may be tolerable for one service but unacceptable for another.¶
Moreover, service restoration does not necessarily eliminate the underlying resilience risk. A network may recover traffic forwarding while continuing to operate with reduced redundancy, insufficient spare capacity, or unresolved shared-risk dependencies.¶
Therefore, the network resilience problem extends beyond detecting failures and restoring connectivity. It concerns the ability to anticipate and reduce exposure to disruptive conditions, absorb and contain their effects, adapt protection and recovery actions to changing conditions, maintain acceptable service levels, and achieve effective and sustainable recovery.¶
These challenges reveal capability gaps across the pre-event, in-event, and post-event stages of the failure lifecycle, as discussed in the following section.¶
The network resilience challenges identified in the previous section reveal limitations in the ability to anticipate disruptive conditions, maintain service continuity during disruption, and achieve effective recovery.¶
These limitations can be analyzed across three stages of the failure lifecycle: pre-event, in-event, and post-event.¶
The three stages represent complementary aspects of network resilience rather than strictly separated operational phases. Risk assessment, monitoring, mitigation, and recovery activities may overlap and interact throughout a disruption.¶
The following subsections identify the major capability gaps at each stage.¶
+----------------------+ +----------------------+ +----------------------+
| PRE-EVENT | | IN-EVENT | | POST-EVENT |
| Risk & readiness |-->| Containment & adapt. |-->| Assure & improve |
+----------------------+ +----------------------+ +----------------------+
| | | | | |
| Hidden dependencies | | Service-impact gaps | | Incomplete service |
| | | | | recovery checks |
| Untested compound | | Propagation gaps | | |
| failure scenarios | | | | Recovery outcomes |
| | | Resource blindness | | poorly assessed |
| Unvalidated recovery | | | | |
| resources | | Recovery conflicts | | Residual risks |
| | | | | |
| Limited degraded- | | Impaired recovery | | Limited validated |
| mode preparedness | | functions | | feedback |
| | | | | |
+----------------------+ +----------------------+ +----------------------+
|
<-----------------------------------------------------+
Validated feedback to preparedness
Before a disruptive event occurs, network resilience depends on the ability to identify potential vulnerabilities, assess their consequences, and prepare protection and recovery strategies for adverse conditions.¶
Existing network planning, configuration management, and operational monitoring mechanisms provide important foundations for these activities. However, several limitations may remain.¶
Incomplete Awareness of Latent Risks and Dependencies: Network topology and operational information may not adequately represent shared-risk dependencies, hidden failure correlations, or vulnerabilities introduced by network design and configuration. As a result, potential common-cause failures and failure propagation paths may remain unidentified before a disruption occurs.¶
Insufficient Assessment of Complex Failure Scenarios: Protection and recovery planning may focus primarily on individual or anticipated failures, with limited evaluation of concurrent failures, cascading effects, or interactions between different network mechanisms. Consequently, the network's ability to withstand complex disruptions may not be adequately assessed.¶
Limited Validation of Recovery Resources: The capacity and availability of backup paths, forwarding resources, and control and management functions may not be sufficiently evaluated under realistic failure and traffic conditions. Recovery strategies that appear effective during normal operation may therefore become ineffective when activated under disruption.¶
Insufficient Preparation for Degraded Operation: Network planning may emphasize restoration to normal operation without adequately considering how critical services can be maintained when parts of the network or its control and management systems remain unavailable.¶
These limitations expose a fundamental pre-event resilience gap: the network may lack sufficient understanding of its vulnerabilities and may not be adequately prepared to maintain acceptable service levels under complex disruptive conditions.¶
During a disruption, network resilience depends on the ability to understand evolving network conditions, limit the propagation of failures, maintain acceptable service levels, and adapt recovery actions to the resources and functions that remain available.¶
Although existing OAM, protection, and recovery mechanisms support fault detection and mitigation, several capability gaps may limit their effectiveness under complex disruptive conditions.¶
Insufficient Awareness of Service Impact: Network component and protocol status may not adequately reflect the actual performance of affected services. Fragmented observations across devices, layers, and domains may prevent timely assessment of the scope, severity, and evolution of service degradation. Consequently, recovery actions may not adequately reflect service continuity objectives.¶
Limited Awareness of Failure Propagation: Existing mechanisms may detect individual faults without sufficient understanding of the dependencies and interactions through which their effects propagate. This may prevent the timely identification and containment of correlated or cascading failures.¶
Insufficient Adaptation to Dynamic Resource Conditions: Protection and recovery actions may not adequately account for the changing availability of bandwidth, forwarding plane capacity, processing resources, or alternative paths. Traffic may therefore be redirected to resources that cannot sustain the additional load, causing further service degradation.¶
Limited Coordination of Recovery Mechanisms: Independent protection, routing, traffic engineering, and management mechanisms may react to the same disruption without sufficient coordination. Their combined actions may introduce instability, repeated switching, or additional resource contention, rather than effectively containing the disruption.¶
Insufficient Recovery Capability Under Degraded Conditions: The sensing, decision-making, control, and management functions required for recovery may themselves become degraded or unavailable. Existing recovery processes may not adequately support continued operation or safe mitigation when these supporting functions are impaired.¶
These limitations expose a central in-event resilience gap: the network may be able to detect a failure and initiate recovery, but still lack the ability to contain its effects, adapt to changing conditions, and maintain acceptable service performance throughout the disruption.¶
After a disruption, network resilience depends not only on restoring network connectivity and operational state, but also on verifying service recovery, identifying remaining vulnerabilities, and improving preparedness for future disruptions. Existing fault and incident management processes provide important information for these activities. However, several capability gaps remain.¶
Insufficient Service-oriented Recovery Verification: Recovery may be considered complete when failed components, protocol sessions, or forwarding paths return to an operational state. However, these indicators do not necessarily demonstrate that affected services have recovered their required performance or that the network has returned to a stable operating condition.¶
Limited Assessment of Recovery Effectiveness: Recovery processes may not systematically evaluate the duration and severity of service degradation, the effectiveness of containment actions, or the resources consumed during recovery. This limits the ability to determine whether recovery objectives were achieved and which mechanisms contributed to successful or unsuccessful outcomes.¶
Incomplete Identification of Residual Risks: Following service restoration, the network may continue to operate with reduced redundancy, depleted resources, temporary configurations, or unresolved dependencies. Without adequate assessment of these conditions, the network may remain vulnerable to subsequent disruptions despite appearing to have recovered.¶
Limited Feedback into Resilience Improvement: Information obtained from disruptive events, including failure propagation, service impact, recovery actions, and recovery outcomes, may not be systematically incorporated into subsequent risk assessment, network planning, and protection strategies. In addition, changes derived from operational experience may not be sufficiently validated before deployment, potentially introducing new vulnerabilities.¶
These limitations expose a post-event resilience gap: restoring network operation does not necessarily ensure that service recovery has been verified, residual vulnerabilities have been addressed, or the network is better prepared for future disruptions.¶
The capability gaps across the three lifecycle stages are closely related. Incomplete risk awareness before a disruption can limit the effectiveness of protection and containment during the event, while insufficient recovery assurance and feedback afterward may allow the same vulnerabilities to persist. Addressing these gaps requires complementary capabilities for proactive risk assessment, disruption absorption and containment, resource-aware adaptation, service-oriented recovery, and continuous resilience improvement. These capabilities are further discussed in the following section.¶
The resilience capability gaps identified in the previous section indicate that maintaining service continuity under complex disruptive conditions requires capabilities beyond individual failure detection, protection switching, and recovery mechanisms.¶
These capabilities are intended to complement existing network reliability, protection, OAM, and service assurance mechanisms. They address the need to anticipate risks, absorb and contain disruptions, adapt to changing network conditions, and achieve effective recovery. The following technical capabilities are identified for network resilience enhancement:¶
Proactive Risk and Dependency Assessment: The capability to identify latent vulnerabilities and dependencies that may affect network resilience, including shared-risk dependencies, configuration and design weaknesses, and insufficient protection resources. This capability supports the assessment of potential failure propagation and service impact before disruptions occur.¶
Service-impact and Failure-propagation Awareness: The capability to correlate network state, resource conditions, dependency relationships, and service performance information to assess the scope, severity, and evolution of disruptions. This includes identifying service degradation that may not be reflected by conventional failure indicators and understanding how the effects of a disruption may propagate through the network.¶
Disruption Containment and Resource-aware Adaptation: The capability to limit the propagation of failures and adapt forwarding, protection, and recovery actions according to changing network conditions and available resources. This includes considering alternative path capacity, resource contention, and service priorities to maintain acceptable service levels and avoid recovery actions that introduce additional degradation.¶
Coordinated and Survivable Recovery: The capability to coordinate different protection and recovery mechanisms to avoid conflicting actions, repeated switching, and recovery-induced instability. Recovery capabilities also need to account for the degradation or unavailability of supporting control, management, and monitoring functions, allowing appropriate recovery or continued operation under constrained conditions.¶
Service-oriented Recovery Assurance: The capability to verify recovery outcomes against applicable service objectives rather than relying solely on the restoration of network component or protocol states. This includes assessing the scope and duration of service degradation, recovery effectiveness, the stability of the restored state, and residual risks that may affect subsequent disruptions.¶
Validated Resilience Improvement: The capability to use operational evidence, including disruptive conditions, service impact, recovery actions, and recovery outcomes, to improve future risk assessment, protection strategies, and recovery preparedness. Changes derived from operational experience need to be evaluated and validated to avoid introducing additional vulnerabilities.¶
These capabilities are complementary and may contribute to multiple stages of the failure lifecycle. Their realization may involve device-local mechanisms, distributed network functions, network-level management and control systems, or combinations of these approaches.¶
This document does not prescribe a specific implementation architecture or protocol solution. Instead, the identified capabilities provide a basis for evaluating existing mechanisms and determining where further network resilience enhancements may be needed.¶
TBD.¶
Resilience mechanisms may introduce new attack vectors, for example injection of falsified telemetry data to trigger unnecessary path changes or routing oscillations. Future frameworks for network resilience SHOULD include identity-based authentication for sensing data and policy updates.¶
TBD.¶
TBD.¶