Topology Independent Fast Reroute Using Segment Routing
Extracted elements (28)
An implementation MAY choose to use only unprotected Adjacency segments in the RL to avoid double FRR activation: if a protected Adj-SID in the RL itself fails, the nested FRR could cause unexpected behavior. FRR is designed to protect against a single pre-planned failure.
Combining Node-SIDs and Adjacency SIDs in the RL is preferred over Adjacency-SIDs only, because pure Adjacency-SID lists can exceed Maximum SID Depth (MSD) hardware limits. Node-SIDs also maximize ECMP over the backup path. Each implementation may independently optimize the segment list.
Early IGP convergence at the PLR followed by early release of TI-LFA paths can cause micro-loops, particularly for paths computed via Sections 5.2–5.4. Local convergence delay (RFC 8333) is one mechanism to prevent this.
SR eliminates the need for Targeted LDP sessions required by RLFA and DLFA, since all SIDs needed for repair paths are present in the IGP Link State Database. This removes the need to prefer LFAs over RLFAs/DLFAs or to minimize the number of repair nodes.
TI-LFA cannot guarantee that a backup path protecting one segment in an SR policy honors the policy's path constraints, because those constraints are computed locally at the head-end or controller and are not visible at the PLR. For policy-compliant backup, end-to-end protection or a Flexible Algorithm node segment should be used instead.
TI-LFA paths are pre-computed and pre-installed before failure, activated the instant the PLR detects a local link failure and remaining active until IGP convergence completes at the PLR. Because they are pre-installed, they are not susceptible to micro-loops from asynchronous convergence across traversed nodes.
TI-LFA uses the expected post-convergence path for FRR backup to align with network capacity planning assumptions (traffic redistributed post-failure), reducing the need for operator-configured local policies. This is a non-obvious choice because the post-convergence path may differ from the actual failure scenario.
Q-space computation requiring a reverse SPT per destination raises scaling concerns (noted in RFC 7490). TI-LFA implementations must determine their own tradeoff between scaling and optimization accuracy when computing Q-space.
TI-LFA procedures are complementary to micro-loop avoidance procedures: TI-LFA paths are pre-computed for urgent restoration, while micro-loop avoidance paths typically cannot be pre-computed. Both are needed for complete protection.
When TI-LFA uses Node-SIDs associated with the SR default algorithm, loop-freedom is not guaranteed if a local policy overrides the expected IGP path, since local policies are operator-defined. This situation also exists with current RLFA deployments.
An implementation MAY determine P-space/extended P-space and Q-space properties for nodes along the expected post-convergence path to reduce the repair segment list size.
For the MPLS data plane: if the active segment is a node segment but the PHP condition is not met, it MUST be popped and then pushed again with a label value computed according to the SRGB of Q (the RL endpoint), and then the RL MUST be pushed.
When building the RL for Flexible Algorithm Node-SIDs, an implementation SHOULD use only Node-SIDs/Adj-SIDs bound to that Flexible Algorithm and/or unprotected Adj-SIDs of the regular SPF. Using other SIDs does not ensure traffic honors the Flexible Algorithm constraints during the FRR period.
When protecting an [Adjacency, Adjacency] segment list, S MUST apply a NEXT operation on Adj-SID(S-F) and then one or more PUSH operations. If the RL terminates on F, only RL segments are pushed; otherwise a node segment of F is pushed first.
When protecting an [Adjacency, Node] segment list where the next segment is node(T), S MUST apply a NEXT operation on the Adjacency segment for S-F, followed by a PUSH of an RL redirecting traffic to a node Q whose path to node(T) is unaffected by the failure.
When the active segment is a node segment, it MUST be kept on the SR header unchanged and the RL MUST be added. The active segment becomes the first segment after the RL.
When TI-LFA protects Node-SIDs associated with a Flexible Algorithm, an implementation SHOULD use the constrained SPF algorithm bound to that Flexible Algorithm (per RFC 9350) instead of regular Dijkstra in all SPF and reverse-SPF computations, including P-space, Q-space, and post-convergence path computation.
For SRv6, Adjacency SIDs are typically globally routed, so there is no need to precede an Adjacency SID with a Prefix-SID, resulting in a likely shorter RL compared to SR-MPLS. Transit node protection adds an SRv6 SID list per RFC 8986 head-end behaviors; Segment Endpoint nodes execute endpoint processing first, then apply transit protection.
FRR path using a direct neighbor: when a direct neighbor is in both P(S,X) and Q(D,X) and lies on the post-convergence path, the outgoing interface is set to that neighbor and the RL is empty. This is equivalent to a post-convergence LFA repair.
FRR path using a PQ node: when a remote node R is in both P(S,X) and Q(D,X) and on the post-convergence path, the RL consists of a single node segment to R. This is comparable to a post-convergence RLFA repair tunnel.
FRR path using adjacent P and Q nodes: when P is in P(S,X) and Q is in Q(D,X), both on the post-convergence path and adjacent, the RL contains two segments: Node-SID(P) followed by Adj-SID(P->Q). This is comparable to a post-convergence DLFA repair tunnel.
P-space P(R, X) is the set of routers reachable from R using pre-convergence shortest paths without any path transiting through resource X. Extended P-space P'(R, X) is the union of P-spaces of neighbors of R that are reachable without using X.
Q-space Q(R, X) is the set of routers from which router R can be reached without any path (including ECMP splits) transiting through resource X. A Q node belongs to this set.
The TI-LFA repair path consists of an outgoing interface and a Repair List (RL) of segments inserted on the SR header. The RL encodes an explicit, loop-free post-convergence path to the destination that avoids the protected resource X, guaranteed loop-free irrespective of FIB states along the explicit path.
TI-LFA provides protection against any single link failure, single node failure, or single Shared Risk Link Group (SRLG) failure for destinations internal to a link-state IGP area. Protection of domain exit routers or links to another routing domain is out of scope.
When P and Q nodes are not adjacent along the post-convergence path, the PLR may encode the inter-segment path as a list of Adjacency SIDs or compute a shorter optimized segment list. The general RL form is (Node-SID(P), EP(P,Q)) where EP(P,Q) is an explicit SR path.
This document introduces no additional security concerns beyond those in RFC 5286 (LFA), RFC 7490 (RLFA), RFC 8402 (SR architecture), RFC 8660 (SR-MPLS), RFC 8754 (SRH), and RFC 8986 (SRv6 programming). Implementors should review all applicable SR security considerations.
TI-LFA is an internal router function that steers traffic to the post-convergence path as quickly as possible upon local failure, minimizing disruption and providing a modest security enhancement. It does not protect external destinations or resources outside the IGP area.