Basic Specification for IP Fast Reroute: Loop-Free Alternates
updated by
- rfc-8518 — Selection of Loop-Free Alternates for Multi-Homed Prefixes
Extracted elements (25)
A per-next-hop LFA simplification computes a single link-protecting LFA per outgoing next-hop rather than per destination, reducing computation cost. This may reduce coverage: in ECMP topologies, a next-hop that has no per-hop LFA might still have an LFA when considering the specific destination prefix.
LFAs are classified as LP (link-protecting), NP (node-protecting), and SP (SRLG-protecting) with distinct coverage vs. complexity trade-offs. LP+NP+SP gives maximum coverage; downstream paths guarantee no micro-loop but offer poor network-wide coverage; plain LFAs give good coverage but can produce loops under unprotected failures.
The loop-free condition (Inequality 1) ensures neighbor N will not route back through S to reach D. A more restrictive downstream path criterion (D_opt(N,D) < D_opt(S,D)) prevents micro-loops in more complex failure scenarios such as node failures, at the cost of reduced coverage.
The mechanism applies only to intra-domain routing (OSPF or IS-IS); Fast Reroute for BGP inter-domain routing is explicitly out of scope. Both the primary path and the alternate path must reside in the same routing area, as the SPF computations are area-scoped and cross-area topology is not fully visible.
When a node fails and only link-protecting LFAs were installed, both S and the alternate neighbor N may simultaneously redirect traffic to each other, causing a forwarding micro-loop. Node-protecting LFAs or downstream paths prevent this by ensuring N's path to D does not transit E.
BGP prefixes inherit alternate next-hops automatically from IGP: BGP resolves its next-hop to the AS exit router via IGP routes, and the IGP-computed LFA for that exit router's router-id becomes BGP's alternate. The BGP decision process is unaltered. Multicast BGP routes do not copy alternate next-hops.
With ECMP, alternate next-hops are determined separately for each primary next-hop. Other primary next-hops are not guaranteed to provide protection against all failure scenarios of concern; for example, two ECMP next-hops over the same link cannot protect each other against link failure.
A router MUST limit the time an alternate next-hop is used after primary failure, to ensure the network converges to new primary next-hops. Use of the alternate SHOULD terminate when: (a) the new primary was loop-free before the failure, (b) a configured hold-down expires, or (c) an unrelated topological change is received.
A router MUST NOT use an alternate next-hop along a link whose cost or reverse cost is LSInfinity (OSPF) or maximum cost (IS-IS), or where the IS-IS overload bit is set. For OSPF, if all links from S to neighbor N_i have reverse cost LSInfinity, S MUST NOT use N_i as an alternate.
A router SHOULD attempt to select at least one loop-free alternate next-hop for each primary next-hop. Selection rules prioritize: (1) node-protecting over link-protecting; (2) link-and-node-protecting over node-protecting-only; (3) other primary (ECMP) next-hops over non-primary alternates when they provide adequate protection.
A router SHOULD compute the alternate next-hop for an IGP multi-homed prefix by considering alternate paths via all routers that have announced that prefix. A router MAY simplify by treating the MHP as solely attached to its pre-failure optimal attachment point, at the risk of missing possible repairs.
A router SHOULD NOT specify the 'local protection available' IS-IS flag as a result of having LFAs, and SHOULD NOT use an alternate next-hop along a link advertised with 'link excluded from local protection path' or 'local maintenance required' attributes (per RFC 5029).
Alternate next-hops used by implementations MUST conform to the basic loop-free condition: Distance_opt(N, D) < Distance_opt(N, S) + Distance_opt(S, D). This guarantees that forwarding traffic to an LFA will not result in a loop after a link failure.
An implementation SHOULD continue using alternate next-hops for forwarding even after new routing information based on the changed topology is available, until one of the termination conditions is met. Premature switchover to a new primary that has not yet converged can cause micro-forwarding loops.
For LDP traffic to follow LFA paths, an LSR MUST distribute labels for all FECs to all neighbors (not just upstream), operate in liberal label retention mode to store labels from non-primary neighbors, and use downstream unsolicited mode. If these requirements are met, no targeted sessions or signaling extensions are needed.
For node-protecting alternates, neighbor N must satisfy D_opt(N,D) < D_opt(N,E) + D_opt(E,D). If this inequality is not strictly met, it SHOULD be assumed that the alternate does not offer node protection, because N may have equal-cost paths through E.
Loop-free alternates should not be used in the OSPF backbone area if virtual links are configured (unless a full mesh of virtual links exists among transit area ABRs), for inter-area routes in areas with more than one alternate ABR, or for AS External routes in specific multi-area ASBR configurations that allow area transiting.
Multicast traffic is out of scope for this IP Fast Reroute specification. Alternate next-hops SHOULD NOT be used for multicast Reverse Path Forwarding (RPF) checks.
When a next-hop failure is detected, the router SHOULD remove the failed primary next-hop and install the pre-computed loop-free alternate if not already installed. The alternate MUST only be used for traffic routed according to the shortest path; multicast traffic is explicitly out of scope.
When an OSPF AS-external LSA has a forwarding address set, alternate next-hops SHOULD be computed by selecting among alternate paths to the forwarding link(s) rather than alternate paths to the ASBR itself.
When the primary next-hop uses a broadcast link, an alternate SHOULD be loop-free with respect to that link's pseudo-node (PN): D_opt(N,D) < D_opt(N,PN) + D_opt(PN,D). A node-protecting LFA on a broadcast interface is not automatically link-protecting.
For multi-homed prefixes, the prefix is treated in SPF computations as a virtual node with unidirectional links from each announcing router. Multiple prefixes sharing identical connectivity and relative metrics may share a single virtual node representation, enabling computation of true best-protection alternates.
SRLG protection is limited to SRLGs containing links directly connected to the calculating router (SRLG_local(S)). Each node D is associated with SRLG_set(N,D) — the set of SRLGs crossed forwarding through neighbor N — computed during SPT(N) by taking the union of parent SRLG sets plus locally-connected SRLG memberships.
The LFA selection algorithm iterates candidate next-hops H_h for each primary next-hop P_i, tracking cand_type (NONE/LOOP-FREE/PRIMARY), cand_link-protect, cand_node-protect, and cand_srlg-protect. Candidates failing the loop-free inequality or link cost checks are skipped; the best candidate replaces the running alternate based on protection level, SRLG coverage, and distance tie-breakers.
LFA does not modify any routing protocol messages, introducing no new threats from packet modification or replay attacks. Temporary rerouting via non-primary next-hops is not a new threat because those routers could be used under different topological conditions anyway. LDP's wider FEC label distribution remains within trusted LDP session boundaries and liberal label retention mode is believed to have no significant security impact.