Remote-LFA Node Protection and Manageability
Extracted elements (19)
A candidate node-protecting PQ-node being in node-protecting extended P-space does not guarantee the full R-LFA alternate path is node-protecting; it guarantees only the S-to-PQ-node segment avoids E. A separate per-destination check via forward SPF on the PQ-node is required to validate the PQ-node-to-destination segment.
RFC 7490 remote-LFA guarantees only link protection; the resulting PQ-nodes may not provide node protection for all destinations in the event of primary next-hop node failure. This document defines procedures to determine whether a PQ-node actually guarantees node protection for a specific destination.
The additional forward SPF on each PQ-node also collects complete path attributes for the second R-LFA path segment (PQ-node to destination), enabling the alternate-selection policy from RFC 7916 Section 6.2.4 to evaluate both path segments rather than only the S-to-PQ-node segment.
The proposal runs one extra forward SPF per PQ-node rather than per destination; since PQ-nodes are significantly more numerous than directly connected neighbors, a configurable subset limit (default 16) is introduced to keep computational overhead bounded — an explicit tradeoff between coverage breadth and SPF computation time.
Without the mechanism in Section 2.3.2, two R-LFA alternates with identical first-segment characteristics but different second-segment attributes would appear equivalent to the policy engine; the proposed per-PQ-node SPF resolves this ambiguity at the cost of additional computation.
All metrics needed for the node-protecting extended P-space inequality are already collected during standard LFA (RFC 5286) forward SPFs rooted at each direct neighbor; no additional SPF runs are needed for the S-to-PQ-node segment check beyond what RFC 5286 requires.
SPF implementations that produce a traversed-node list can use path-list inspection as an alternative to the inequality checks in Figures 4 and 6: a PQ-node provides node protection only if no primary next-hop node appears in the shortest-path node list from the PQ-node to the destination.
For destinations with multiple ECMP primary next-hop nodes, the R-LFA path from the PQ-node to the destination MUST satisfy the node-protecting condition (Figure 6) for all primary next-hop nodes to qualify as a node-protecting R-LFA path.
Implementations MUST choose a subset from the entire set of PQ-nodes with a finite limit on the number of PQ-nodes (to bound SPF overhead). Implementations MUST choose a default value for this limit; this document suggests 16 as the default.
Implementations MUST evaluate default preference criteria when selecting PQ-nodes for the subset, and MAY allow operators to override these criteria via policy configuration.
Implementations SHOULD run the node-protecting extended P-space inequality (D_opt(Ni,Y) < D_opt(Ni,E) + D_opt(E,Y)) for all direct neighbors other than primary next-hop E to determine whether a node Y is a candidate node-protecting PQ-node.
Implementations SHOULD use a default PQ-node preference ordering: prefer PQ-nodes covering more primary interfaces, then prefer closer PQ-nodes (lower metric), then prefer lower router-id (or system-id for IS-IS) as a tiebreaker.
Link-Protecting Extended P-Space MUST exclude any direct neighbor for which there is at least one ECMP path from that neighbor traversing the link (S-E) being protected.
To compute all shortest paths from a candidate node-protecting PQ-node to destinations, the computing router MUST run a forward SPF rooted at each candidate node-protecting PQ-node. After the SPF, it SHOULD apply the inequality D_opt(Y,D) < D_opt(Y,E) + D_opt(E,D) once per destination to verify node protection.
Candidate Node-Protecting PQ-Space: a node Y is in candidate node-protecting PQ-space if and only if Y is present in both the node-protecting extended P-space and the Q-space for the protected link. Membership guarantees only that the S-to-PQ-node path segment avoids the primary next-hop node E, not the full alternate path.
Link-Protecting Extended P-Space: the set of routers reachable from direct neighbors of S (except primary next-hop E) without traversing the S-E link on any shortest path. Any direct neighbor with at least one ECMP path traversing S-E must be excluded.
Node-Protecting Extended P-Space for a primary next-hop node E is the set of routers reachable from one or more direct neighbors of S (excluding E) without traversing node E, excluding any direct neighbor with at least one ECMP path traversing node E.
Q-Space for link S-E: the set of nodes that can reach primary next-hop E without traversing the S-E link on any shortest path, excluding any node with at least one ECMP path to E traversing S-E. Cost condition: D_opt(Y,E) < D_opt(S,E) + D_opt(Y,S).
This document introduces no changes to any protocol specification. It only proposes running an additional forward SPF rooted at each discovered PQ-node; therefore it introduces no new security considerations beyond those of the base remote-LFA specification (RFC 7490).