Theoretical foundations and architecture
Laboratory: MPLS Fast Reroute (FRR, RFC 4090) in an RSVP-TE core. When a link is cut, full recovery from the head-end (PathErr to the ingress PE, CSPF recomputation, signaling a replacement LSP) takes from hundreds of milliseconds to seconds, depending on detection time and the number of tunnels. FRR shortens this: a backup path is computed and signaled in advance, and the switchover is performed by the node nearest to the failure, the Point of Local Repair (PLR). There are two flavors: 1. One-to-One (Detour): a separate detour LSP per protected tunnel. 2. Facility Backup (bypass tunnel): one shared bypass protects a link (link protection) or the next node (node protection) for many LSPs; it is the most widely deployed flavor. On failure the PLR switches traffic into the bypass by pushing the bypass label. The switchover target is tens of milliseconds, but the real time depends on the failure detection method (LOS, BFD) and the platform.
Why local repair is needed
When a link on the path of a TE LSP fails, end-to-end recovery goes through a chain: failure detection, PathErr/ResvTear to the head-end, a repeated CSPF on the head-end, signaling of a new LSP. This takes several seconds or more: the IGP has to report the change, and the head-end has to recompute and bring up a new path. Fast Reroute (RFC 4090) moves the repair to the node in front of the failure: it has prepared a detour in advance and switches traffic right after detection, without waiting for the head-end.
Roles:
- PLR (Point of Local Repair) - the node that sees the failure and switches traffic onto the detour.
- MP (Merge Point) - the node where the detour rejoins the protected LSP.
- Backup tunnel / bypass - an LSP from the PLR to the MP that goes around the protected element.
- Link protection (NHOP, next-hop bypass): the MP is the next node beyond the protected link. Node protection (NNHOP, next-next-hop bypass): the MP is the node after the next one, and the detour goes around the node itself. The last node of an LSP cannot be protected as a node: there is no MP after it; the penultimate node can only protect the link to the tail.
Two methods
| Method | How it protects | Scale | Feature |
|---|---|---|---|
| Facility backup (bypass) | one bypass LSP protects all LSPs that pass through the link or node | the number of bypass tunnels depends on the number of protected elements, not on LSPs | the detour carries a label stack: the main label + the bypass label |
| One-to-one backup (detour) | a separate detour LSP is built for each LSP at each node | the number of detours grows with the number of LSPs and hops | the detour merges with the primary LSP at one of the following nodes; no stack |
Facility backup is the main option in provider networks: state on transit nodes does not grow with the number of LSPs. Detour is rarer and is not supported everywhere.
What the head-end signals
The head-end requests protection when setting up the LSP in one of two ways. Through the SESSION_ATTRIBUTE flags (0x01 - local protection desired, 0x08 - bandwidth protection desired, 0x10 - node protection desired) or through the FAST_REROUTE object (RFC 4090, Class-Num 205): it adds the setup/hold priority for the backup, hop limit, bandwidth, include-any/exclude-any/include-all and the method flags (0x01 - one-to-one, 0x02 - facility). For NNHOP the PLR needs the label assigned by the MP (the node beyond the protected one), and it can learn it only from an RRO with labels, so label recording (0x02 in SESSION_ATTRIBUTE) is enabled.
When the PLR is really ready to protect an LSP, it sets flags in the RRO subobject: 0x01 - local protection available, 0x04 - bandwidth protection, 0x08 - node protection; during an active repair 0x02 - local protection in use is added. This is how the head-end sees that the LSP is protected. An FRR flag on a tunnel without a prepared backup protects nothing.
What happens in the data plane
Preparation (before the failure): the PLR chooses a backup tunnel that suits the protected interface and the LSP properties, and records it in the FRR table: for each protected LSP it stores a pair "main label, outgoing interface" and the "backup label".
Repair (after the failure): the PLR (1) selects the label the MP expects: for NHOP this is the ordinary outgoing label of the LSP (the MP already passed it in Resv), for NNHOP it is the label of the node beyond the protected one, taken from an RRO with labels, (2) pushes the label of the bypass tunnel on top and (3) sends the packet out of the bypass interface. Example for VPN traffic PE1 -> PE2 when the PE1-P1 link fails: the packet had the stack [VPN][TE label towards P1]; after the switch the stack becomes [VPN][the label P1 expects][bypass label]. The transit P2 is the penultimate node of the bypass: it pops the bypass label (PHP), so P1 receives the packet with the ordinary label of the protected LSP and does not know about the repair. All changes happen in the hardware table: there is no computation or signaling at the moment of failure.
While traffic follows the detour, the stack is one level deeper (plus 4 bytes per packet), so the core MTU must leave headroom for the bypass label.
Failure detection and timing
Repair happens within a fraction of a second only after detection. Sources:
- loss of signal (LOS) on an optical interface: units to tens of milliseconds; on links through a transport network or an L2 switch the signal does not disappear and the failure is invisible;
- BFD on the link (50 ms interval, multiplier 3 gives about 150 ms);
- RSVP Hello (RFC 3209): seconds; Junos defaults to hello-interval 9 s, keep-multiplier 3;
- IGP (hello/dead): tens of seconds without tuning; without BFD the repair is postponed until the IGP reacts.
The figure "under 50 ms" is a design target for the FIB switchover, not a guarantee: the total time is detection plus programming. There is no such thing as zero loss: packets that are on the link at the moment of failure will be lost.
After the repair
The PLR sends the head-end a PathErr with Error Code 25 (Notify) and subcode 3 (Tunnel locally repaired). In response the head-end re-signals the LSP along a new path (make-before-break) and tears down the old one; until that happens, traffic goes through the bypass, and an LSP in the repaired state is not protected against the next failure in the same area (double failure). The head-end recomputes the path only after it receives the IGP update, until then traffic stays on the bypass; do not disable re-optimization.
QoS and bandwidth: a bypass can reserve bandwidth (bandwidth protection, Cisco bw-protect, Junos via the bandwidth of the bypass): without it the detour does not guarantee that it has enough capacity for all LSPs, and traffic under repair can experience congestion. A bandwidth reservation for the bypass does not replace load control and must be agreed with the policy.
Configuration models
- Cisco: the bypass is an ordinary TE tunnel to the MP (router-id address), bound to the protected interface with the command
mpls traffic-eng backup-path TunnelN; the head-end tunnel enablesfast-reroute. The bypass path is set withexclude-addressor an explicit path; withoutautoroutethe bypass does not carry ordinary traffic. - Huawei: a bypass tunnel (
mpls te bypass-tunnel) withmpls te protected-interface, and the primary tunnel enablesmpls te fast-reroute. - Junos:
link-protectionon the RSVP interface of the PLR creates the bypass automatically through CSPF (excluding the protected link); on the LSP,link-protection(facility) ornode-link-protectionrequests protection;fast-rerouteon the LSP is the detour method.
Typical failures
- No bypass: the FRR flag is on, but the backup is not up (no path found, incompatible constraints).
- The bypass passes through the same SRLG or the partner link: both go down on failure.
- The failure is not detected: the link goes through L2/transport and BFD is not enabled.
- Label recording/RRO is not enabled: NNHOP cannot learn the label of the MP.
- Not enough MTU: packets with the extra label are fragmented or dropped.
- The service stays on the bypass after restoration because the head-end did not perform re-optimization.
Architecture Diagram & Topology
primary LSP (protected link)
+---------+ ====================X====================> +--------+ ====> tail
| PLR | failed link | MP |
| (PE-1) | | (P-1) |
+---------+ ===> [bypass LSP around the link] =======> +--------+
Link protection: the MP is the next node after the protected link.
Node protection: the MP is the node after the next one; the bypass avoids the next node.Traffic Flow & Label Stack Scheme
FRR facility backup, link protection:
1. The head-end signals the primary LSP asking for local protection (SESSION_ATTRIBUTE flags).
2. The PLR (PE-1) uses a pre-signaled bypass tunnel that avoids the protected link and ends at the merge point (MP).
3. The PLR prepares the backup next hop in its forwarding plane before any failure.
4. A failure is detected (loss of signal, BFD or other detection).
5. The PLR switches the LSP into the bypass: it swaps the label to the one the MP expects and pushes the bypass label.
6. The penultimate node of the bypass pops the bypass label (PHP), so the MP receives the packet with its normal LSP label.
7. The PLR notifies the head-end (PathErr/Resv with notification) and the head-end re-optimizes make-before-break.