Theoretical foundations and architecture
The acceptance test plan (ATP) is the stage before a network enters commercial service: a reproducible series of tests T01-T12 with expectations and numeric thresholds written in advance; each result is recorded as Pass or Fail together with evidence (command output, generator files, syslog). The project core is IS-IS + SR-MPLS + TI-LFA; RSVP FRR is not used. The main tests: 1. Link failure PE1-P1 (T03): with a 10 000 pps flow at most 500 packets are lost (50 ms) thanks to TI-LFA; the failure method is stated explicitly (loss of carrier, not an administrative shutdown) and detection through BFD is a separate item with a threshold of about 350 ms. 2. Node failure P1 (T04): traffic uses the second plane and converges within 1 s; sessions to RR1 (behind P1) drop while those to RR2 stay. 3. RR1 failure (T05): RR2 keeps the sessions and existing flows are not lost. 4. BNG (T11): 5000 PPPoE logins in 60 s, at least 99.9% successful, AAA response under 1 s. 5. MTU (T02): a 1500 ping with DF in VRF A, B and EVI 300 and a 1600 ping over the links. 6. Isolation (T06): probes A -> B, A -> SUBS and C -> A find no foreign prefixes. A leak between customers (T06) and an unverified rollback (T12) block acceptance regardless of the other results.
What acceptance is and how it differs from "everything pings"
Acceptance (ATP) is a reproducible series of tests with expected results and numeric thresholds recorded in advance. It proves that the network meets the requirements from sp-design, not that it "works right now". Entry conditions: all phases of sp-build-plan are built, the gates are passed, clocks are synchronised over NTP, and the baseline outputs and configurations are saved. Each test has an ID (T01-T12), a method of fault injection, an expected result and a KPI; the result is recorded as Pass or Fail together with evidence (command outputs, traffic generator graphs, syslog timestamps).
Test matrix
| ID | Test | Fault injection method | Expected result | KPI |
|---|---|---|---|---|
| T01 | Baseline connectivity and labels | ping and ping mpls between all loopbacks | the label to each SID = 16000 + index on all nodes | 56 pairs, 0 mismatches, 0 loss |
| T02 | MTU | ping 1500 with DF in VRF A, B and EVI 300; 1600 over the links | packets pass without fragmentation | 100% |
| T03 | PE1-P1 link failure | physical disconnection under a 10 000 pps flow | TI-LFA switches to P2, then the IGP converges | at most 500 lost packets (50 ms) |
| T04 | P1 node failure | power off P1 | traffic goes through plane 2; sessions with RR1 go down (RR1 is behind P1), sessions with RR2 stay | convergence at most 1 s; services alive |
| T05 | RR1 failure | stop BGP or reboot RR1 | RR2 keeps the sessions, routes are not withdrawn | 0 loss for existing flows |
| T06 | Customer isolation | probes A -> B, A -> SUBS, C -> A | no foreign prefixes in VRFs and EVI | 100% blocking, 0 packets |
| T07 | Inter-AS customer B | reset the ASBR1 eBGP, exceed maximum-prefix | B routes return, foreign RTs are dropped | at most 120 s to recover |
| T08 | EVPN-MPLS of customer C | move a MAC from PE2 to PE3 | Type 2 with a new sequence number, traffic goes to PE3 | at most 3 s |
| T09 | QoS under load | 148 Mbit/s into a 100 Mbit/s channel (voice 8, video 30, data 50, bulk 60) | voice is not lost | 0% voice loss, delay variation at most 10 ms |
| T10 | SR policy color 100 | trace and disconnect P2 | traffic follows the segment list through P2; rebuilds on failure | the path matches the plan, loss at most 50 ms |
| T11 | BNG under load | 5000 PPPoE logins in 60 s (about 83 per second) | subscribers get an address and a profile from RADIUS | at least 99.9% successful, AAA answer under 1 s |
| T12 | Rollback and automation | commit confirmed / configure replace, Ansible --check | the configuration returns, no differences | at most 5 minutes, empty diff |
How to measure convergence time
Loss is measured with a traffic generator, not with the ping command: ICMP once a second does not see an event of 50 ms. A 10 000 pps flow gives a resolution of 0.1 ms; the outage duration = the number of lost packets divided by the rate (500 packets at 10 000 pps = 50 ms). The measurement is repeated at least three times, and the worst result goes into the report, not the average. Both ends of the flow are synchronised over NTP, and the event marks are taken from syslog with milliseconds.
It is important to separate detection from repair. TI-LFA performs the switch locally as soon as the node has seen the failure. On loss of carrier (a physical break, LOS) this happens within a few milliseconds, and the total outage fits into 50 ms. If the failure is not visible physically (intermediate L2 equipment), it is detected by BFD with 100 ms x 3 timers: the outage is then about 300-350 ms. That is why T03 states the failure method explicitly: an administrative shutdown on one side is not equal to a fibre break, and the BFD check is recorded as a separate item T03b with a 350 ms threshold. After the switch the normal IGP convergence follows; with micro-loop protection enabled there must be no repeated loss, and this is checked too.
Label consistency
T01 checks the main SR property: for each of the eight SIDs on every node the outgoing label equals the SRGB base of the next node plus the index. With a single SRGB 16000-23999 this is simply 16000 + index, for example 16002 for PE2 on all nodes. There are 8 x 7 = 56 such pairs; any mismatch means a wrong SRGB, a duplicate index or an LFIB that did not update. For the end-to-end check ping mpls and traceroute mpls to the loopback of every PE are used: they check exactly the path by labels, not only the routing.
