Theoretical foundations and architecture
Carrier backbone design demands a disciplined and robust IP addressing architecture. All PE and P routers require dedicated virtual Loopback0 interfaces configured with a /32 subnet mask. This /32 loopback performs three mission-critical roles: it provides a unique Router-ID for IGP (OSPF/IS-IS), the LSR-ID for LDP/SR signaling, and the termination endpoint/Next-Hop for MP-BGP sessions (VPNv4/EVPN). Transit core links use /30 or /31 subnets (RFC 3021) for address conservation. The inviolable golden rule of Service Provider engineering: customer networks and VRF prefixes must NEVER leak into the core IGP! The core IGP exists solely to distribute router loopbacks and internal transit interconnects. If a physical link fails, the IGP reroutes around the fault; iBGP/MP-BGP sessions peer to the stable /32 loopback, so they survive a single link failure (only the path changes). The LDP session with the neighbor on the failed link closes together with its adjacency, and LSPs are rebuilt over the remaining sessions.
Three roles of a single /32
Loopback0 in an SP core is not "just another interface" but the identity of the node. The same address 10.255.0.1/32 serves at once as: (1) the IGP router-id (the OSPF router-id and the basis of the IS-IS System-ID); (2) the LSR-ID and transport address for LDP (the LDP session is opened over TCP/646 between transport addresses, while Hellos go to 224.0.0.2 over UDP/646); (3) the source and target of iBGP/MP-BGP sessions (update-source Loopback0) and the next hop for VPN routes. As long as at least one live path to the /32 exists, sessions and LSPs survive even if a particular physical link fails. If a session is bound to a link address instead, the failure of that link tears down BGP and the VPNs although a backup path exists.
The /32 mask is mandatory for two reasons. First, LDP by default builds FECs from RIB prefixes and expects an exact match: an LSP to PE2 exists only if the table contains exactly 10.255.0.2/32. Second, summarizing loopbacks at an area boundary (ABR, L1/L2) breaks the exact match, and the LSP turns into Untagged/No Label. If the core has to be split into domains, use Seamless MPLS (BGP-LU, RFC 8277) or explicit label filters, not IGP summarization.
What exactly the IGP advertises
OSPF advertises a loopback as a stub link in the Router-LSA (Type 1). On Cisco a loopback is always announced as a /32 host route regardless of the configured mask; on other platforms and in IS-IS (TLV 135 Extended IP Reachability) the prefix is sent with the mask configured on the interface, so set /32 explicitly on Huawei and Junos. The loopback metric in the Router-LSA is 1 on Cisco, 0 on Huawei and 0 on Junos for a passive lo0. Hence the "metric to the same node" differs between platforms - that is normal as long as paths are compared within one vendor. In IS-IS the loopback gets the interface metric in TLV 135.
Only two categories of prefixes live in the IGP: node loopbacks and transit core links. Customer networks, VRF prefixes and PE-CE link addresses must not get there: they travel in MP-BGP. Violating this rule inflates the LSDB, lengthens SPF and (on Cisco) causes LDP labels to be allocated for every IGP prefix, because labels are created by default for all routes in the RIB. Junos by default advertises labels only for /32 loopbacks (egress-policy), Huawei only for host routes (lsp-trigger host by default). On Cisco the restriction is made with mpls ldp label allocate global prefix-list or mpls ldp advertise-labels for.
Addressing plan
A working scheme that scales to hundreds of nodes:
| Block | Purpose | Note |
|---|---|---|
| 10.255.0.0/24 | Node Loopback0 | .1-.10 PE, .11-.20 P, .100-.109 RR; one /32 per node |
| 10.0.0.0/16 | Core P2P links | a /31 per link (RFC 3021) |
| 172.16.0.0/16 | PE-CE links (in VRFs) | not announced into the core IGP |
| 2001:db8:ffff::/64 | IPv6 loopbacks | a /128 per node (example from the documentation block) |
For IPv6 links use /127 (RFC 6164): a /64 on a point-to-point link leaves a window for neighbor-cache attacks (ND exhaustion). A /31 saves two addresses per link and removes Network/Broadcast; an Ethernet link with a /31 must still be switched to point-to-point, otherwise OSPF will run a DR/BDR election between two nodes.
Router-ID and NET derived from the loopback
The OSPF router-id is a 32-bit number in IPv4 form and must be unique in the domain; a duplicate router-id makes two nodes re-originate LSAs constantly and causes SPF storms (Cisco logs %OSPF-4-DUP_RTRID_NBR). If the router-id is not set explicitly, Cisco picks the highest loopback IP, otherwise the highest IP among active interfaces, and changing that address silently changes the node identity - so always set the router-id by hand. The IS-IS System-ID is 6 bytes; the common practice is to rewrite every octet of the loopback with three decimal digits and split into groups of 4 digits: 10.255.0.1 -> 010.255.000.001 -> 0102.5500.0001, NET = 49.0001.0102.5500.0001.00 (AFI 49 is private address space, 0001 is the area, 00 is the NSEL). Then the System-ID in show isis hostname and in logs immediately tells which node is meant.
