Theoretical foundations and architecture

Two key developments of Segment Routing are TI-LFA (Topology-Independent Loop-Free Alternate) and SR Policy with Flexible Algorithm (Flex-Algo). 1. TI-LFA provides pre-computed protection of a link (and of a node or SRLG) in any topology where an alternative path exists after the failure. Classic LFA and Remote LFA do not cover part of the topologies (for example rings), while TI-LFA builds the backup along the post-convergence shortest path and, when needed, encodes it as a list of SIDs, so it does not create micro-loops. The switchover time is determined by failure detection and the platform; the target is tens of milliseconds. 2. SR Policy defines a path as a segment list (static or dynamic, including through a controller/PCE) and replaces RSVP-TE tunnels without per-path signaling. 3. Flex-Algo (RFC 9350) splits one topology into logical planes with their own metric and constraints: algorithm numbers 128-255 are assigned by the operator (for example 128 for minimum delay, 129 with an affinity constraint).

Two mechanisms on top of SR: protection and path control

The first task is to restore traffic quickly after a link or node failure without RSVP-TE. It is solved by TI-LFA (Topology-Independent LFA): the backup path is calculated in advance and written into the FIB. The second task is to carry traffic not along the IGP shortest path but along a given one: this is done by an SR Policy (RFC 9256), a segment list in a label stack instead of a signalled tunnel. Both mechanisms work on the same SIDs that were discussed earlier.

TI-LFA: the calculation

Classic LFA (RFC 5286) selects a neighbour whose shortest path to the destination does not cross the protected element; in rings and many other topologies there is no such neighbour. Remote LFA (RFC 7490) adds a tunnel to a remote node but requires targeted LDP. TI-LFA (RFC 9855, formerly draft-ietf-rtgwg-segment-routing-ti-lfa) removes both limitations: the backup path is built as the post-convergence path, that is, the path the IGP will choose after the failure, and a SID stack steers traffic along it.

For link protection the calculation is performed by the PLR (Point of Local Repair) node:

  1. The protected link is removed from the topology, and SPF finds the post-convergence path to every prefix.
  2. P-space is the set of nodes reachable from the PLR along shortest paths without crossing the protected link (the extended P-space adds nodes reachable from the PLR's neighbours). Q-space is the set of nodes that reach the destination along the shortest path without this link (a reverse SPF from the destination).
  3. We walk along the post-convergence path: if it contains a P-space node that is also in the Q-space (a PQ node), the repair list consists of one Node-SID of that node. If P and Q do not intersect but are connected by a link, an Adjacency-SID between them is added to the list: [Node-SID P, Adj-SID P-Q]. Most often the list has 1-2 labels, but with complex metrics it may be longer.
  4. For node and SRLG protection the calculation is repeated with the node or the group of links excluded.

The approach gives coverage in any topology where an alternative path exists at all (the network must stay connected after the failure). Implementation limits: the list must fit into the MSD of the head-end node, all nodes of the repair path must support SR and have a Prefix-SID, and on LAN interfaces protection depends on the platform.

TI-LFA: timing and behaviour

The backup next hop is written into the FIB in advance. After a failure is detected (loss of signal, BFD; the target is up to 50 ms with fast detection) the line card switches the traffic without waiting for the IGP. Then the IGP converges and the same path becomes the primary one, so there is no second switchover. Real timing depends on the detection method and the platform: without BFD on slow interfaces it is determined by the IS-IS timers.

During convergence micro-loops are possible: nodes recompute SPF at different times, and a packet may bounce between a node that has already moved to the new path and a node that is still on the old one. The SR microloop avoidance mechanism (draft-bashandy-rtgwg-segment-routing-uloop) temporarily uses on the PLR a segment list with the post-convergence path, postponing the RIB update by a configured interval.

SR Policy: structure

An SR Policy (RFC 9256) is uniquely identified by the triple headend, color, endpoint. The color is a 32-bit number whose meaning is defined by the operator (for example 100 means low delay); the endpoint is the address of the destination node. A policy has one or more candidate paths; each is defined by preference (default 100, higher is better), protocol-origin (defaults: PCEP 10, BGP SR-TE 20, local configuration 30), originator and discriminator. The active path is the valid candidate path with the highest preference, and in a tie the origin, originator and discriminator decide. A candidate path contains one or more segment lists with weights (weighted ECMP).

A path is explicit (the list is set by the operator) or dynamic (the headend or a PCE computes the path from constraints: IGP metric, TE metric or delay, affinity, disjoint path, Flex-Algo). A candidate path is invalid if the first segment does not resolve, the MSD is exceeded or there is no path. PCEP (RFC 8664) and BGP SR-TE serve to talk to a controller.

The Binding SID (BSID) is the local label of a policy. A packet with this label arriving at the headend is sent into the policy. Uses: stack reduction (an outer node knows one BSID instead of ten labels), policy nesting, crossing domains.