ISIS-SR with TI-LFA in OcNOS: Topology-Independent Fast Reroute

Part of IP Infusion's guide to Segment Routing.

Fast Reroute (FRR) is the network's ability to pre-compute backup paths and switch to them in under 50 milliseconds when a link or node fails, before routing protocols have had time to reconverge. TI-LFA (Topology-Independent Loop-Free Alternate) is the most advanced FRR mechanism available today, providing 100% protection coverage against single link, node, and SRLG failures across any topology, without the coverage gaps of classic LFA or Remote LFA.

FRR Evolution: LFA, RLFA, and TI-LFA

TI-LFA achieves this coverage by computing the post-convergence path (the path traffic would take after the network fully reconverges following the failure) and encoding it as an SR segment stack. This stack is pre-computed and pre-installed. When the failure occurs, the router immediately redirects traffic using the segment stack, with no need for signaling.

TI-LFA Network Topology

Configuring ISIS-SR with TI-LFA in OcNOS

! OcNOS -- IS-IS SR with TI-LFA
! Shown on R2, the Point of Local Repair (PLR) analyzed in this lab.
! Enable TI-LFA on every router in the IS-IS domain.
!
! ---- Prerequisite: IS-IS Segment Routing (from the ISIS-SR setup) ----
! segment-routing mpls is enabled under the IS-IS instance; the node
! SID is set on the loopback with prefix-sid index. R2's node SID label
! seen in the SR forwarding plane is 16102 (SRGB base 16000 + index 102).
!
router isis OCNOS
  is-type level-2-only
  segment-routing mpls
!
interface lo
  ip address 10.10.10.102/32
  ip router isis OCNOS
  prefix-sid index 102
!
! ---- Core interfaces (IS-IS point-to-point) ----
! xe4.95  faces R1  (neighbor 10.10.12.1, metric 10)
! xe21.93 faces R4  (neighbor 10.10.24.4, metric 45)
interface xe4.95
  ip router isis OCNOS
  isis network point-to-point
  isis metric 10
!
interface xe21.93
  ip router isis OCNOS
  isis network point-to-point
  isis metric 45
!
! ---- Enable TI-LFA for IS-IS level-2, IPv4 ----
router isis OCNOS
  fast-reroute ti-lfa level-2 proto ipv4
  commit
!
! Note: the fast-reroute TI-LFA command must be enabled for the
! respective IS-IS levels on every router in the domain. Node protection
! is computed automatically when a valid PQ path exists (see below).

Verification Commands

! OcNOS -- TI-LFA verification (run on R2, the PLR)
!
! Step 1: IS-IS topology and metrics
show isis topology
! Tag OCNOS:  VRF : default
! IS-IS paths to level-2 routers
! System Id     Metric   Next-Hop        Interface       SNPA
! R4            45       R4    xe21.93    e8c5.7a46.5c33
! R1            10       R1    xe4.95     e8c5.7aa0.a142
! R6            65       R4    xe21.93    e8c5.7a46.5c33

! Step 2: TI-LFA P-space / Q-space / PQ node for a destination (R6)
show isis tilfa pq | be Node: R6.00-00
! ... lists P node / Q node entries, then:
! PQ Node: R1.00-00 backup dist:10
! PQ Node (Node Protection): R1.00-00 backup dist:10

! Step 3: Primary and TI-LFA backup path for a prefix (R6 = 10.10.10.106/32)
show ip isis route tilfa | be 10.10.10.106/32
! 10.10.10.106/32
!  L2: Primary Path Nexthop  : 10.10.24.4, xe21.93
!     SR Incoming Label      : 16106
!     SR outgoing Label      : 16106
!     PQ node : 10.10.10.101
!     Backup outgoing Label  : 16106
!     Bypass_trunk id : 2203
!     Backup out interface : xe4.95
!     Protection Type: Node Proctecting

! Step 4: MPLS forwarding-table (FTN) -- primary and backup on the source router
show mpls forwarding-table 10.10.10.106/32
! FEC              FTN-ID  Nhlfe-ID  Pri  LSP-Type      Out-Label  Out-Intf  Nexthop
! 10.10.10.106/32  5       19        Yes  LSP_DEFAULT   16106      xe21.93   10.10.24.4
! 10.10.10.106/32  11      59        No   LSP_DEFAULT   16106      xe4.95    10.10.12.1

! Step 5: MPLS ILM-table -- primary and backup on the transit router
show mpls ilm-table 10.10.10.106/32
! FEC/VRF/L2CKT    ILM-ID  In-Label  Out-Label  Out-Intf/VRF  Nexthop      pri
! 10.10.10.106/32  142     16106     16106      xe21.93       10.10.24.4   Yes
! 10.10.10.106/32  306     16106     16106      xe4.95        10.10.12.1   No

Node Protection vs. Link Protection

! OcNOS -- Node protection vs link protection
!
! In this OcNOS lab, TI-LFA computes a node-protecting backup automatically
! whenever a valid PQ path exists; there is no separate node-protection
! configuration keyword beyond the fast-reroute ti-lfa command above.
! The result is reported per prefix, and "Node Proctecting" means the backup
! protects against both link and node failure.
!
! The PQ computation lists both the link-protecting and node-protecting PQ node:
show isis tilfa pq | be Node: R6.00-00
! PQ Node: R1.00-00 backup dist:10
! PQ Node (Node Protection): R1.00-00 backup dist:10
!
! The per-prefix route output reports the protection type and the repair
! (Bypass) trunk that carries the pre-computed segment stack:
show ip isis route tilfa | be 10.10.10.106/32
! PQ node : 10.10.10.101
! Bypass_trunk id : 2203
! Backup out interface : xe4.95
! Protection Type: Node Proctecting
!
! The repair tunnel detail (label stack + nexthop) is shown under the
! PQ node's own FTN entry:
show ip isis route tilfa | be 10.10.10.101/32
! Trunk : 2203 :10.10.10.101_nh_327843935   ftn_ix : 15 ref_cnt:3
! Number Of outgoing label : 1
!  16101
! Nexthop address : 10.10.12.1

• Segment Routing Explained: SR-MPLS Fundamentals
• LDP to SR Migration Guide
• Flex-Algo in OcNOS: Fundamentals
• OcNOS-SP Product Page
• Contacter IP Infusion

IP Infusion Engineering Team