Remote Loop-Free Alternate (LFA) Fast Reroute (FRR)
Extracted elements (29)
Extended P-space is introduced because S only uses a repair path after detecting failure of S-E, so the initial hop need not follow normal forwarding. By also including the P-spaces of S's neighbors, S can reach candidate PQ nodes that are unreachable via S's own P-space, substantially increasing repair coverage.
RLFA is deliberately scoped to point-to-point link failures only, excluding broadcast/NBMA failed interfaces and node failures, to keep the mechanism simple. MPLS-TE FRR already exists to handle arbitrary topologies at greater complexity cost.
The original 2002/2004 IP-FRR tunnel proposal targeted 100% coverage and included mechanisms beyond remote LFA, making it computationally intensive and not pursued as a WG item. Remote LFA is positioned as a simpler second step after local LFA, accepting less-than-100% coverage in exchange for tractable complexity.
The PQ node closest to S is preferred as the default choice because choosing the closest node maximizes the opportunity for load balancing once the packet is released from the tunnel.
The Q-space of E is used as a proxy for the per-destination Q-space rather than computing per-destination repair tunnel endpoints, because a per-destination SPF computation would not currently be considered scalable. This is analogous to using link LFAs rather than per-prefix LFAs.
The repair path computation is confined to a single area or level-2 routing domain. Cross-area PQ nodes should be treated as tunnel adjacencies per RFC 5286 Section 6. This simplification avoids the complexity of inter-area loop-freedom analysis.
Forward SPFs rooted at PLR neighbors must account for IS-IS overload, OSPF stub router advertisement (RFC 6987), and costed-out links. A repair tunnel path may otherwise traverse a node or link that should be excluded, requiring two additional MUST NOT checks on the first-hop metric and tunnel endpoint overload state.
In the absence of a protocol to advertise the preferred IP address for targeted LDP, an LSR should attempt a TLDP session using the Router ID as defined in RFC 2328, RFC 5305, RFC 5340, RFC 6119, or OSPF-RI, unless configured otherwise.
No protection is available until the TLDP session has been established and a label for the destination has been learned from the remote LFA repair target. New tunnels require TLDP session setup and label acquisition before they can carry repair traffic, limiting the speed of bringing a new tunnel into service.
When the failure is a node failure rather than a link failure, RLFA repairs can loop: two neighbors of the failed node, each with the failed node as next-hop to some destination, may attempt to repair via each other, forming a mutual repair loop. Mitigations include dropping re-arrived repair packets, requiring node-protecting paths, or applying a downstream constraint.
If for any reason the targeted LDP session to the repair tunnel endpoint cannot be established, an implementation SHOULD advise the operator about the protection setup issue through the network management system.
IP repair tunnel endpoints SHOULD be assigned from a set of addresses that are not reachable from outside the routing domain to prevent their use as an attack vector.
It is RECOMMENDED that the PQ node with the lowest cost S->P be the default choice for the repair tunnel endpoint. In the event of a tie, the router with the lowest node identifier SHOULD be selected.
The PLR MUST NOT use a repair tunnel endpoint with the IS-IS overload bit set or where all outgoing interfaces have cost set to MaxLinkMetric for OSPF, as such nodes signal a desire to not carry transit traffic.
The repair tunnel endpoint MUST be reachable from the tunnel source without traversing the failed link, and packets released from the tunnel MUST proceed towards their destination without being attracted back over the failed link.
The repair tunnel MUST NOT be advertised by the routing protocol as a link that may be used to carry normal user traffic or routing protocol traffic.
The repair tunnel MUST NOT be used for normal traffic; it is only activated upon detection of a link failure. OAM traffic used to verify the viability of the repair MAY traverse the tunnel prior to a failure.
The repair tunnel MUST NOT traverse the protected link S-E. Routing traffic through the failed link would defeat the purpose of the repair.
The repair tunnel used MUST be provisioned beforehand in anticipation of failure so that traffic can be immediately redirected when a failure is detected. Since tunnel location is dynamically determined, tunnels must be established automatically.
A PQ node is a node that is a member of both the extended P-space of S with respect to link S-E and the Q-space of E with respect to that link. Repair tunnel endpoints are chosen from the set of PQ nodes; they guarantee loop-free delivery after a single link failure.
A repair tunnel is a tunnel established from the Point of Local Repair (PLR) to a PQ node so that the PQ node functions as a virtual loop-free alternate neighbor. The tail end of the tunnel is the PQ node, not the far-end router E of the protected link.
A targeted LDP (TLDP) session must be established between the repairing node and the repair tunnel endpoint so the repairing node can learn the PQ node's label binding for each destination. The LSP from S to the PQ node is already available as a basic property of LDP, requiring no new protocol extensions.
An optional downstream constraint (Apply_Downstream_Constraint) requires that the PQ node be strictly closer to the destination than the repairing node, i.e., D_opt(PQ,dest) < D_opt(self,dest). This prevents loop formation when the failure is worse than expected (e.g., node failure) at the cost of reduced repair coverage.
Extended P-space of S with respect to link S-E is the union of the P-spaces of each of S's neighbors (excluding E) with respect to that link. A router P is in extended P-space if D_opt(N,P) < D_opt(N,S) + D_opt(S,P) for some neighbor N. Extended P-space allows S to reach potential repair tunnel endpoints unreachable via plain P-space.
In an MPLS/LDP environment, the RLFA label stack uses two labels: the outer label is S's neighbor's label for the PQ node (repair tunnel endpoint), and the inner label is the PQ node's label for the packet destination, obtained via a targeted LDP session to the PQ node.
P-space of a router S with respect to a protected link S-E is the set of routers reachable from S using pre-convergence shortest paths without any of those paths transiting the protected link, including ECMP splits. In cost terms, {P} are nodes for which D_opt(S,P) < D_opt(S,E,P).
Q-space of E with respect to link S-E is the set of routers from which E can be reached by normal forwarding without traversing S-E. Computed via a reverse SPT rooted at E with the subtree potentially traversing S-E excised. In cost terms, {Q} are nodes for which D_opt(Q,E) < D_opt(Q,S) + D_opt(S,E).
The cost-based RLFA algorithm proceeds in four steps: (1) compute forward SPF from self; (2) compute SPFs at each neighbor for extended P-space; (3) compute reverse SPF at the far-end node for Q-space; (4) intersect extended P-space and Q-space, excluding pseudonodes, to find valid tunnel endpoints.
The security considerations of RFC 5286 apply. Targeted LDP sessions and MPLS tunnels are normal MPLS features and raise no additional security concerns in this application. IP repair tunnel endpoints SHOULD be assigned from addresses not reachable from outside the routing domain to prevent use as attack vectors, and the repair tunnel MUST NOT be advertised for normal traffic.