WO2002078250A2

WO2002078250A2 - High availability packet forwarding apparatus and method

Info

Publication number: WO2002078250A2
Application number: PCT/CA2002/000424
Authority: WO
Inventors: Scott S. Pegrum; Matthew M. Yuen; Nabila Ould-Brahim
Original assignee: Nortel Networks Limited
Priority date: 2001-03-27
Filing date: 2002-03-27
Publication date: 2002-10-03
Also published as: EP1374500A2; US20020141429A1; US7206309B2; US20030198182A1; US7342874B2; CA2441470A1; WO2002078250A3

Abstract

A high availability packet forwarding router (102) for an internet protocol (IP) network, includes two control processors (104,106), one or more service termination cards (STCs)(112) with forwarding information bases (FIBs)(108,110), and a packet forwarding engine (214). The two processors run asynchronously in a master/standby relationship. Integrity of processes running on the control processors is monitored and the forwarding engine forwards packets according to a FIB maintained by an in-service one of the control processors. Hitless failover and hitless software upgrades are supported.

Description

HIGH AVAILABILITY PACKET FORWARDING APPARATUS

AND METHOD

TECHNICAL FIELD

The present invention relates in general to routers and packet forwarding engines and, in particular, to an apparatus and method that provides high packet forwarding availability.

BACKGROUND OF THE INVENTION

Existing router architectures and routing protocols lack certain desirable features. For the purposes of this discussion, router architectures and routing protocols include bridging spanning tree protocols (STPs) as well as routing protocols such as Open Shortest Path First (OSPF) and BGP-4 (Border Gateway Protocol version 4) .

OSPF is a link-state routing protocol . It is designed to be run internally of a single Autonomous System (AS) . Each OSPF router maintains an identical database describing the AS's topology. From this database, a routing table is calculated by constructing a shortest-path tree. OSPF recalculates routes quickly in response to topological changes, utilizing a minimum of routing protocol traffic. OSPF provides support for equal-cost multipath. An area routing capability is also provided, enabling an additional level of routing protection and a reduction in routing protocol traffic. In addition, all OSPF routing protocol exchanges are authenticated. BGP-4 is an inter-Autonomous System routing protocol. The primary function of a BGP-4 enabled system is to exchange network reachability information with other BGP-4 systems. The network reachability information includes information about a list of ASs that reachability information traverses. The reachability information is sufficient to construct a graph of AS connectivity from which routing loops may be pruned and certain policy decisions at the AS level may be enforced. BGP-4 also provides a new set of mechanisms for supporting classless inter-domain routing. These mechanisms include support for advertising an Internet Protocol (IP) prefix and eliminates the concept of network class within BGP . BGP-4 also introduces mechanisms that allow aggregation of routes, including aggregation of AS paths. To characterize the set of policy decisions that can be enforced using BGP, one must focus on the rule that a BGP-4 speaker advertises to its peers (other BGP-4 speakers with which it communicates) in neighboring ASs only those routes that it uses itself. This rule reflects the "hop-by-hop" routing paradigm generally used throughout the current Internet .

It should be noted that some policies cannot be enforced by the "hop-by-hop" routing paradigm, and thus require methods such as source routing. For example,

BGP-4 does not enable one AS to send traffic to a neighboring AS with the intention that the traffic take a different route from that taken by traffic originating in the neighboring AS. On the other hand, BGP-4 can support any policy conforming to the "hop-by-hop" routing paradigm. Since the current Internet only uses the "hop-by-hop" routing paradigm, and since BGP-4 can support any policy that conforms to that paradigm, BGP-4 is highly applicable as an inter-AS routing protocol for the current Internet .

L3 (layer 3 of the open system interconnection model) routing and bridging protocols were not designed to easily permit dual or synchronous standby architectures within routing switches to provide high availability. Typically, high availability for packet forwarding equipment is achieved through physical duplication of switches. Physical duplication has a high cost due to increased footprint, ongoing management, and cabling costs. It is therefore advantageous to be able to provide a highly reliable and available solution to minimize these costs. Furthermore, physical duplication generally fails to address the most common point of failure in modern packet forwarding equipment, namely software crashes caused by errors in program code . Due to the increasing complexity and feature support in modern packet forwarding software, it is difficult to provide software loads that are completely error free . Current packet forwarding systems, however, fail to adequately address detection and failover when a software fault occurs.

High availability for packet forwarding requires a number of features, including: 1) the ability to perform hitless software upgrades; 2) the ability to provide hitless control path failover due to either software or hardware faults; 3) the ability to provide hitless line card failover; 4) the ability to provide hitless path failover, and 5) other features, including synchronization of Routing/Bridging states using database synchronization, which is difficult to provide due to the large amount of state information required to maintain synchronization. Currently, packet forwarding technology does not support hitless software upgrade or failover, much less the other desirable features listed above.

It therefore remains highly desirable to provide a means of achieving a high level of packet forwarding availability at a reasonable cost and complexity.

OBJECTS OF THE INVENTION It is therefore an object of the invention to provide an apparatus and method for high availability packet forwarding that permits hitless software upgrades and software or hardware failover.

It is a further object of the invention to provide a means of achieving a high level of packet forwarding availability at a reasonable cost and complexity.

It is yet a further object of the invention to provide a packet forwarding engine having first and second control processors that respectively and asynchronously run a plurality of packet receiving and forwarding processes. It is yet a further object of the invention to provide first and second forwarding information bases

(FIBs) that respectively store forwarding information maintained by the respective first and second control processors.

It is yet another object of the invention to provide a packet forwarding engine which includes service termination cards that forward packets in accordance with one of the first and second FIBs, depending on an integrity of the processes running on the respective first and second control processors .

It is yet another object of the invention to provide a method of monitoring selected processes executed by the first and second control processors to ensure that both hardware and software faults are detected as they occur, and failover process are timely initiated.

SUMMARY OF THE INVENTION

Accordingly, the invention provides an apparatus (102) for providing high availability packet forwarding, comprising a service termination card (112) having a packet forwarding engine (214) for receiving and forwarding packets in accordance with a forwarding information base (FIB) ; a first control processor (104) running a plurality of processes (404) and communicatively coupled to the service termination card; a first forwarding information base on the service termination card having forwarding information maintained by the f irst control processor, C H A R A C T E R I Z E D by :

a second control processor (106) running a plurality of processes asynchronously with respect to the first control processor, the second control processor being communicatively coupled to the service termination card;

a second FIB (110) on the service termination card having forwarding information maintained by the bases, depending on an integrity of the processes running on the respective first and second control processors.

According to an aspect of the invention there is provided a method of ensuring high availability in a packet forwarding process, C H A R A C T E R I Z E D by operating first and second control processors independently and asynchronously to generate first and second FIBs. The FIBs are respectively provided to a service termination card. The service termination card operates to forward packets using information from one of the FIBs depending on an integrity of selected processes running on the respective first and second control processors .

In accordance with an embodiment of the invention, the integrity of the processes run by the first and second control processors is determined by monitoring selected processes executed by the first and second control processors. This ensures that both hardware and software faults are detected as they occur, and failover process are timely initiated.

In accordance with an aspect of the invention, full bandwidth utilization is ensured during failover by a bandwidth manager, which releases bandwidth reserved by a failed control processor. The released bandwidth can then be utilized by the operating control processor.

In accordance with another aspect of the invention, line protection is provided for core MPLS traffic by diversely setup label paths through the two control processors. A FIB manager controls MPLS FIBs so that primary labels switched paths (LSPs) and secondary LSPs are generated by different control processors in each of the first and second FIBs .

In accordance with a further aspect of the invention, there is provided

BRIEF DESCRIPTION OF THE DRAWINGS

Further features and advantages of the present invention will become apparent from the following detailed description, taken in combination with the appended drawings, in which:

FIG. 1 is a schematic diagram of a computer network including an apparatus in accordance with the invention;

FIG. 2 is a block diagram of a service termination card shown in FIG. 1; Fig 3 ; is a block diagram of a heartbeat tester shown in FIG. 2 and

FIG. 4 is a block diagram of a control processor shown in FIG. 1.

It will be noted that throughout the appended drawings, like features are identified by like reference numerals.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The invention provides an apparatus and method for ensuring high availability for packet forwarding in a packet network. The apparatus has dual control processors that operate asynchronously in parallel to compute separate forwarding information bases (FIBs) selectively used by service termination cards (STCs) for packet forwarding. During normal operation, the STCs use master control processor FIBs for packet forwarding. If integrity of the master control processor is lost, the

STCs switch to the FIBs of the alternate control processor. Control processor integrity is determined by the STCs, which send heartbeat query messages to selected software processes running on each control processor.

This ensures rapid detection of software and hardware faults in a control processor to improve availability.

FIG. 1 is a schematic diagram of a computer network 100 that includes a router 102 in accordance with the .invention. The router 102 includes a first control processor (CPO) 104 and a second control processor

(CP1) 106. Each control processor 104,106 can function as a master, or a standby control processor. Each control processor 104,106 creates and maintains a respective forwarding information base

(FIB0,FIB1) 108,110. Each control processor 104,106 is communicatively connected to one or more service termination cards (STCs) 112 by communications busses^' 109 and 111, respectively. Each of the STCs 112 is connected by links 114 via an NNI (network to network interface) 115 to a network core 116. The STCs 112 are also connected 118 to a respective I/O interface 120 that each have a respective Ethernet connection 122 available. The control processors 104,106 are both communicatively connected to an operations, administration and management

(OAM) workstation 124.

FIG. 2 is a block diagram 200 of an STC 112 shown in FIG. 1. The STC 112 includes a lookup memory 204 that stores the FIB0 108, which includes an internet protocol forwarding information base (IP FIB0) 206 and a first multi-protocol label switching (MPLS) primary and backup label switched paths (LSPs)

(MPLS FIB0) 210. The lookup memory 204 also stores the FIB1 110, which includes an IP FIB1 208 and an MPLS FIB1 212. The STC 112 further includes a packet forwarding engine 214 that is communicatively coupled at 217A to the FIB0 108 and coupled at 217B to the FIB1 110. The STC 112 has a heartbeat monitor 220 communicatively coupled at 222 to the CPO 104 and CP1 106 shown in FIG. 1. The function of the heartbeat monitor 220 will be described below with reference to FIGs. 3 and 4. Each control processor 104,106 runs all relevant routing protocol applications independently and • produces the relevant tables required for packet forwarding. The forwarding information bases (FIBO 108 and FIB1 110) derived from the respective control processors 104,106 are distributed to all STCs 112 regardless of their interface association. It should be noted that the respective FIBs are not necessarily identical, but are expected to contain the same reachability information. The next hop information will most likely not be the same, however. The packet forwarding engine 214 selects a set of FIBs to use at run-time, typically based on control processor association information. In accordance with an embodiment of the invention, A FIB manager 230 receives FIB information form the respective control processors 104,106 via busses 109,111 and writes the FIB information in the respective FIBO 108 and FIB1 110. The FIB manager 230 is preferably programmed to write the MPLS FIBs so that the primary LSPs of FIBO are created and maintained by control processor 104, while the backup LSPs of FIBO are created and maintained by control processor 106. In FIB1, the primary LSPs are created and maintained by control processor 106, while the backup LSPs are written by control processor 104. Consequently, on transit core network traffic, diversely setup LSPs through the control processors 104,106 permit both line and equipment protection to be achieved in a single router 102 in accordance with the invention. During a control processor reset, or software upgrade that causes a control processor 104,106 to go out-of-service, the STCs 112 are informed in a timely manner and switch to use the set of FIBs of the remaining active control processor. Multicast IP packet services, multi-protocol label switching (MPLS) , bridging, and various media related protocols use a hot-standby control processor model . In accordance with one embodiment of the invention, full bandwidth utilization is ensured by a bandwidth manager 240. The bandwidth manager 240 accepts bandwidth allocation requests from the respective control processors 104,106 via busses 109,111. The bandwidth manager allocates bandwidth to the respective control processors 104,106, as required and updates the appropriate FIB information using bus 244 to write to lookup memory 204. However, if one of the control processors is out-of-service, the bandwidth manager is advised of the control processor's condition by the heart beat monitor 224, which sends an appropriate signal over connection 242. On being advised that a control processor is out-of-service, the bandwidth manager releases all bandwidth allocated to the out-of-service control processor, so that it is available to the in-service control processor, which can allocate the bandwidth as required. This permits more efficient failover engineering in the core networks.

The monitoring of a control processor to determine whether it is in-service is performed by monitoring critical software processes that it runs. The monitoring of an integrity of critical processes running on a control processor 104,106 is described with reference to FIGs . 3 and 4, and is performed by a heartbeat monitor 220. Integrity of a control processor is defined as being "in-service" or "out-of-service" . The heartbeat monitor 220 includes a tables of critical processes 304 that contain a list of selected processes 404 that run on the respective control processors 104,106. The tables are referenced by a heartbeat inquiry generator 306, which generates heartbeats 306A, 306B, . . . 306C for respectively monitoring the integrity of process 404A, 404B and . . 404C running on the control processors 104,106. The heartbeat monitor 220 sequentially generates and transmits the heartbeat inquiries 306A, 306B, 306C to corresponding processes 404A, 04B, 404C (FIG. 4) . If each process 404A, 404B, 404C returns a heartbeat response 308A,308B, . . .308C within a predetermined period of time, the integrity of each process is declared "in-service". If any of the processes 404A, 404B, 04C fails to return a heartbeat response 308A, 308B, 308C within the predetermined period of time, the integrity of that process 404A, 404B, 404C and the processor 104,106 that runs it is declared to be "out-of-service" .

The invention supports a hitless control processor reset and also supports hitless software upgrades, as long as the packet forwarding engine 214 on STCs 112 does not require reset .

It should further be understood that the assignment of routed interfaces is done at the physical or logical interface level. Therefore, given an STC 112, it is not necessary for all interfaces 224 to be mastered by the same control processor. It should also be noted that a mix of routed and stub routed interfaces to the STCs 112 is permissible.

All packet services run on both control processors 104,106 at a steady state. This includes both unicast and multicast IP protocols, and all MPLS signaling protocols such as RSVP (reservation protocol) and LDP (label distribution protocol) . In general, the control processors are unaware of each other. There are exceptions to this rule, however. First, all local interface (host) routes and subnet routes are injected into the IP forwarding table of both control processors . This exception applies to both UNI 119 and NNI 115 interfaces. Second, for services other than IP unicast, MPLS and RSVP (i.e. services that must be kept synchronized) software on each control processor 104,106 must be aware of its current state, being a master or a standby, and behaves accordingly.

At steady state, core-to-core traffic is routed between routed interfaces of the same control processor. Customer-to-core traffic may be distributed between routed interfaces of both control processors 104,106. Core-to-customer traffic is distributed on ingress between routed interfaces of both control processors . During a control processor reset or software upgrade, the STC 112 is notified that one of the control processors has become unavailable. The STC 112 updates all the logical interfaces to associate with the remaining control processor as the master, which effectively instructs the packet forwarding engine 214 to forward all traffic related to the forwarding table of the remaining active control processor. Note that logic of the packet forwarding engine 214 does not change, and theoretically there should be no packet loss as a result of control processor reset or software upgrade, as long as the packet forwarding engine 214 is not reset. When one control processor is unavailable, core-to- core traffic is routed from any routed interface to the routed interface of the remaining control processor. Customer-to-core traffic is routed towards a routed interface of the remaining control processor.

IP multicast forwarding tables are downloaded from the master control processor to the STCs 112. As there is only a single copy of the IP multicast forwarding table on the STC, no decision is required to select which table to use, as is the case with unicast traffic. During a control processor reset or software upgrade, the STCs 112 are notified that a control processor has become unavailable. Initially, the STC 112 will do nothing, but when one ^'of the following two conditions is met, the FIB manager 230 on the STC 112 will erase all the original content of the forwarding information base. The first condition is met if a timeout has expired. The second condition is met if the new master control processor has re-learnt and distributed the same routes that the FIB manager 230 has already installed. IP multicast continues to use the original routes when the master control processor becomes unavailable for a period of time, or after the same set of routes are re-learnt by the new master control processor. A network topology change during control processor switch-over potentially causes packet loss.

When a control processor 104 (for the purpose of the following discussion designated CPx) becomes unavailable due to a software crash, hardware fault, or for any other reason except a software upgrade (which is discussed below in some detail) all STCs 112 and the other control processor (designated CPy in this example) are notified. The packet forwarding engine 214 adjusts the control processor mastership of all affected interfaces to associate with the remaining control processor CPy. The packet forwarding engine 214 adjusts all UNI Layer 1 and Layer 2 physical and logical port records to associate with the remaining control processor, the packet forwarding engine 214 also adjusts a control processor selection algorithm for any Layer 3 static (stub) interface (either NNI or UNI) . CPy operates as if nothing has happened. The Cpy still advertises its own routes, along with all the local routes of the CPx.

Routing peers of CPx stop hearing from CPx for the duration of the reset. Take OSPF (open shortest path first) as an example, it will take 3 times a single hello time (30 seconds) to detect that CPx is unavailable. Normally, CPx will recover in much less than 30 seconds during a warm restart. Hence, any immediate network wide route flap is minimized. Of course, in the event of a persistent hardware or software failure, routing peers will eventually detect the problem and route around all of the routed interfaces of CPx. After CPx recovers, all routing protocol stacks on CPx restart . CPx then re-establishes peering with its original routing peers. Route flap will occur during this stage for a short period of time. CPx then continues to converge and update its forwarding information bases table on STCs 112.

After a predefined period of time, STCs 112 are notified that the CPx forwarding tables are now ready to be used. The packet forwarding engine 214, control processor mastership of all applicable interfaces, and control processor selection algorithm are reset to their original configuration. The delayed notification of CPx availability to STC 112 is intended to minimize routing loops in the carrier core network while CPx is converging.

Assumptions relevant to the control processor reset discussion above include: 1) The STCs 112 rely on at least one control processor being operational; and 2) Logical interface configuration and operational status are propagated to both control processors 104,106, regardless of control processor mastership of the related interface^'.

A discussion of how software upgrades are conducted is also relevant to the operation and maintenance of the apparatus in accordance with the invention. One way of upgrading a general purpose CPU software load requires an upgrade of software on the CP 104,106 as well as on STC 112. Note that other options for performing software upgrades may exist without departing from the scope of the present invention. Further, although network processor software upgrades may be impacted, they are not described.

The invention provides a method of performing hitless software upgrades. For example, if a control processor 104 (CPx) is to be upgraded, the CPx is taken out-of-service, but CPy 106 and STC 112 behave exactly as they do in the CP reset scenario described above . The CPx is then .reloaded with the new software load and starts running after a reboot. From the perspective of the CPx, all interfaces are down, even though they are still forwarding ingress traffic using CPy's forwarding information bases.

Each STC 112 is respectively reloaded with the new software version, and restarted. The packet forwarding engine 214 is still forwarding traffic based on CPy's forwarding table. While the STC CPUs are restarting, local services such as loopback detection and MAC address learning are unavailable.

Following reboot after the new software load,

CPx enables its interfaces and establishes peering with neighboring routers. The CPx then downloads its forwarding information bases to the STCs 112. After a predefined period of time, the STCs 112 switch back to using forwarding information bases of the CPx. CPy is subsequently reloaded with the new software version and reboots to start running. CPy then establishes peering with neighboring, routers. CPy downloads its forwarding information bases to STCs 112. After running protocol convergence and sanity checks, the STCs 112 switch to using the FIB of CPx, and the software upgrade is complete .

The invention therefore provides an apparatus and method for high availability packet processing that permits hitless software upgrades and hitless software and hardware fault failover.

While the preferred embodiments of the invention were described in specific terms, it should be noted that alternative network structures can be similarly utilized within the inventive concepts without straying from the intended scope of the invention. Persons skilled in the art will appreciate that there are other alternative implementations and modifications for implementing the present invention, and that the above implementation is only an illustration of one embodiment of the invention. Accordingly, the scope of the invention is intended only to be limited by the claims included herein.

Claims

CLAIMS :

An apparatus (102) for providing high availability packet forwarding, comprising a service termination card (112) having a packet forwarding engine (214) for receiving and forwarding packets in accordance with a forwarding information base (FIB) ; a first control processor (104) running a plurality of processes (404) and communicatively coupled to the service termination card; a first forwarding information base on the service termination card having forwarding information maintained by the first control processor, C H A R A C T E R I Z E D by: a second control processor (106) running a plurality of processes asynchronously with respect to the first control processor, the second control processor being communicatively coupled to the service termination card; a second FIB (110) on the service termination card having forwarding information maintained by the second control processor; and means (230) for permitting the packet forwarding engine to forward packets in accordance with one of the first and second forwarding information bases, depending on an integrity of the processes running on the respective first and second control processors. An apparatus as claimed in claim 1 wherein the service termination card (112) further comprises a heartbeat monitor (220) for determining the integrity of the processes (304a-c) running on the first and second control processors (104,106) .

An apparatus as claimed in claim 2 wherein the heartbeat monitor (220) comprises a table (Table 1) listing the selected processes (404) running on the first control processor (104) and a table (Table 2) listing the selected processes running on the second control processor (106) .

An apparatus as claimed in claim 3 wherein the heartbeat monitor (220) is adapted to send heartbeat inquiry messages (306A-C) to the processes (404) listed in the respective tables (Tables 1,2), and further adapted to conditionally receive heartbeat response messages (308A-C) from the processes, in accordance with the integrity of the respective processes.

An apparatus as claimed in any preceding claim further comprising an input/output interface through which the first and second control processors (104, 106) receive protocol data units (PDUs) providing information for maintaining the respective first and second forwarding information bases (108, 110) .

6. An apparatus as claimed in any preceding claim further comprising an operations and management workstation (124) connected to the respective first and second control processors

(104,106) .

7. An apparatus as claimed in any preceding claim wherein the first and second forwarding information bases (108,110) on the service termination card (112) respectively comprise an Internet protocol forwarding information base.

8. An apparatus as claimed in any preceding claim wherein the first and second forwarding information bases (108,110) on the service termination card (112) respectively comprise a multi -protocol label switching forwarding information base.

9. An apparatus as claimed in any preceding claim further comprising a forwarding information base (FIB) manager (230) that receives FIB information from the first and second control processors (104,106) and stores the FIB information in a memory (204) of the service termination card.

10. An apparatus as claimed in claim 9 wherein the FIB manager stores primary and backup label switched paths (LSPs) (210,212) in each of the first and second FIBs (206,208) so that the primary LSPs in the first FIB are created and maintained by the first control processor (104) and the backup LSPs in the first FIB are created and maintained by the second control processor (106) , while the FIB manager stores the primary and secondary LSPs in a reverse order in the second FIB, to provide line ^' protection for label switched paths .

11. An apparatus as claimed in any preceding claim further comprising a bandwidth manager (240) for controlling reservation of local input/output bandwidth between the first and second control processors (104,106).

12. An apparatus as claimed in claim 11 wherein the bandwidth manager (240) is communicatively connected to a heart beat monitor (220) that monitors an integrity of process (404) running on the fist and second control processors (104,106), and informs the bandwidth manager if one of the control processors is declared out-of-service.

13. An apparatus as claimed in claim 12 wherein the bandwidth manager (240) is adapted to release bandwidth allocated to the out-of-service control processor so that the bandwidth can be utilized by the in-service control processor.

14. An apparatus as claimed in any preceding claim wherein the first and second control processes (104,106) are respectively adapted to advertise all local interfaces, so that reachability is maintained in a core network in an event that one of the control processors becomes out-of-service .

15. A method of providing high availability in a packet forwarding process, C H A R A C T E R I Z E D by: operating first and second control processors (104,106) independently and asynchronously to generate and maintain first and second forwarding information bases (FIBs) (108,110) respectively provided to a service termination card (112) ; and operating the service termination card to forward packets using information from one of the FIBs depending on an integrity of selected processes

(404) running on the respective first and second control processors .

16. A method as claimed in claim 15 further comprising a step of dynamically determining an integrity of the selected processes (404) running on the respective first and second control processors

(104,106) .

17. A method as claimed in claim 16 wherein the step of dynamically determining comprises a step of sending heartbeat inquiry messages (306A-C) to each of the selected processes (404) on the respective first and second control processors (104,106) .

18. A method as claimed in claim 17 wherein the step of sending further comprises a step of sending the heartbeat inquiry messages (306A-C) from a heartbeat monitor (220) that is operative on the service termination card (112) .

19. A method as claimed in claim 18 further comprising a step of receiving heartbeat response messages (308A-C) from the respective selected processes (404) run by the respective first and second control processors (104,106).

20. A method as claimed in claim 19 further comprising a step of declaring a one of the control processors (104,106) out-of-service if a one of the processes (404) running on the one of the control processors fails to return a heartbeat response message (308A-C) within a predetermined period of time.

21. A method as claimed in claim 18 further comprising a step of switching to a second FIB (110) if information in the first FIB (108) is being maintained by the control processor (104,106) declared out-of-service .

22. A method as claimed in claim 21 further comprising a step of switching back to the first FIB (108) if the control processor (104) that maintains the forwarding information in the first FIB is declared to be in-service.

23. A method as claimed in claim 22 wherein the step of switching back is delayed for a predefined period of time to minimize routing loops in a carrier core network while the first control processor (104) is converging .

24. A method as claimed in any one of claims 15-23 further comprising a step of installing a new software load on one of the control processors (104,106) by taking the control processor out-of-service, and permitting the other control processor to continue to maintain forwarding information bases (108,110) used by the service termination card to forward packets.

25. A method as claimed in claim 24 further comprising a step of installing a new software load on the service termination card (112) while a packet forwarding engine (214) continues to forward packets using one of the forwarding information bases (108, 110) .

26. A method as claimed in claim 25 further comprising a step of returning the one of the control processors (104,106) to in-service so that it rebuilds and maintains forwarding information bases

(108,110) to be used by the service termination card (112) .

27. A method as claimed in claim 26 further comprising a step of taking the other control processor (104,106) out-of-service, and permitting the one of the control processors to continue to maintain forwarding information bases (108,110) used by the service termination card (112) to forward packets.

28. A method as claimed in any one of claims 15-27 wherein when a service termination card (112) is advised that one of the control processors

'(104,106) it out-of-service, the method further comprising a step of erasing all original content of the FIB (108,110) when one of a timeout has expired, and a remaining in-service control processor (104,106) has relearned and distributed the same routes that a FIB manager (230) of the service termination card (112) has already installed.

29. A method as claimed in claim 28 further comprising a step of continuing to use original routes for IP multicast when the control processor (104,106) becomes out-of-service for a period of time, or after a same set of routes are relearned by the in-service control processor.