IP FRR (LFA/rLFA), microloops and Graceful Restart

Theoretical foundations and architecture

A carrier core does not lose traffic at the instant of a failure but in the window between the link going down and the moment the new forwarding table is programmed on every router. The window is the sum of failure detection, LSA/LSP flooding, the SPF run, the RIB/FIB update and the LDP label recomputation; untuned, it lasts from hundreds of milliseconds to several seconds. IP Fast Reroute (RFC 5714) removes most of it: the router precomputes a backup next hop and switches locally at the moment of failure without waiting for SPF. Loop-Free Alternate (RFC 5286) uses a neighbour that is guaranteed not to send the packet back; Remote LFA (RFC 7490) builds an LDP tunnel to a remote node when no direct LFA exists. The lesson covers the LFA and rLFA selection conditions, the causes of microloops during convergence (RFC 5715), SPF/LSA timer and BFD tuning, and Graceful Restart, NSF and NSR with their trade-offs. TI-LFA is only referenced here: it belongs to the Segment Routing module.

What the convergence time consists of

Traffic loss after a link failure is the sum of five stages. Detection: a hardware loss-of-carrier signal takes a few milliseconds, BFD with a 50 ms interval and multiplier 3 takes about 150 ms, whereas IS-IS (usually 10/30 s) and OSPF (10/40 s) Hello/Dead timers give tens of seconds. LSP/LSA generation and flooding: a few to tens of milliseconds per hop plus the generation timers. SPF: depends on database size and CPU, a few to tens of milliseconds for hundreds of nodes on modern platforms, plus the throttling delay. RIB and FIB update: from tens of milliseconds to seconds for hundreds of thousands of prefixes if the FIB is not hierarchical. Finally the LDP labels: with liberal retention the label of the next neighbour is already in the LIB, so recomputation reduces to FIB programming. IP FRR takes stages 2-4 off the critical path: the repair path is already in the FIB.

LFA: the condition and the kinds of protection

LFA (RFC 5286) selects a neighbour N of router S whose shortest path to the destination D does not pass through S. The basic loop-free condition is D(N,D) < D(N,S) + D(S,D), where D is the shortest-path metric. In the lab network, when the PE1-P1 link fails the candidate neighbour is P2: D(P2,PE2)=10 is less than D(P2,PE1)+D(PE1,PE2)=20+20=40, so P2 is a loop-free alternate. Node protection (if P1 itself fails) has a stricter condition: D(N,D) < D(N,E) + D(E,D), where E is the protected primary neighbour; if it fails, LFA protects the link only and a node failure may cause a loop. The downstream condition D(N,D) < D(S,D) guarantees no loop even for node failure but covers fewer destinations. With several candidates the implementation applies a tie-break (RFC 5286 section 3.8): node protection first, then lower metric, plus policies such as SRLG and ECMP awareness. LFA does not give 100% coverage: in rings and topologies with symmetric metrics the share of protected prefixes often drops, while in Clos and full-mesh layouts it stays high. Always verify coverage with the platform command instead of assuming it.

Remote LFA and PQ nodes

When no direct LFA exists, Remote LFA (RFC 7490) looks for a remote node PQ that lies both in the P-space (reachable from S without crossing the protected link) and in the Q-space (D is reachable from PQ without crossing the protected link). S builds a tunnel to PQ: in practice a targeted LDP session and the label PQ advertises for the destination FEC. The repair packet carries a two-label stack: the outer label is the transport label to PQ, the inner is the label of FEC D advertised by PQ. Therefore rLFA needs LDP on all nodes of the path and targeted Hellos (UDP 646, unicast instead of 224.0.0.2) to the PQ candidates, and PQ must accept such sessions (a "targeted-hello accept" style command or an automatic implementation). Limitations: it protects against link failure only (not node failure), coverage depends on the topology, and with many possible PQ nodes the choice may not be optimal for delay. TI-LFA from the Segment Routing module solves the same problem without LDP and gives full coverage in a topology without metric restrictions, but here it is only referenced.

Microloops

A microloop (RFC 5715) occurs because nodes do not converge simultaneously: a node that updated its FIB first sends a packet to a neighbour that still has the old table, and that neighbour sends it back. The loop lasts as long as the difference between FIB update moments, usually hundreds of milliseconds, until the TTL expires; the loss is caused by queue growth and link congestion, not by the failure. Microloops occur on failure and on recovery (link coming back): the latter is often ignored although it produces a second burst of loss. Mitigations: ordered FIB update (RFC 6976: a node waits until the nodes farther from the failure update), local RIB-update delay (RFC 8333, "local delay": the node next to the event postpones installing the new path long enough for the others to converge, typically hundreds of milliseconds to a few seconds), make-before-break on link recovery, and SR microloop protection (in the Segment Routing module). The price of the delay: the node keeps using the repair path longer, so choose the value for the size of the network.