OcNOS의 ISIS-SR과 TI-LFA――토폴로지 독립적 패스트 리라우트

Part of IP Infusion's guide to 세그먼트 라우팅.

Fast Reroute (FRR) is the network's ability to pre-compute backup paths and switch to them in under 50 milliseconds when a link or node fails, before routing protocols have had time to reconverge. TI-LFA (Topology-Independent Loop-Free Alternate) is the most advanced FRR mechanism available today, providing 100% protection coverage against single link, node, and SRLG failures across any topology, without the coverage gaps of classic LFA or Remote LFA.

FRR Evolution: LFA, RLFA, and TI-LFA

Mechanism	작동 방식	커버리지	Limitation
LFA	Pre-computed neighbor that is not affected by the failure	~60 to 80%	Topology-dependent; many failures have no LFA
RLFA	LDP tunnel to remote repair node	~95%	Requires LDP; repair node must be P-space
TI-LFA	SR segment stack to any post-convergence path node	100%	Requires Segment Routing (IS-IS or OSPF)

TI-LFA achieves this coverage by computing the post-convergence path (the path traffic would take after the network fully reconverges following the failure) and encoding it as an SR segment stack. This stack is pre-computed and pre-installed. When the failure occurs, the router immediately redirects traffic using the segment stack, with no need for signaling.

TI-LFA Network Topology

IS-IS SR topology: seven OcNOS routers R1 to R7 with loopbacks 10.10.10.101 to 10.10.10.107 and node-SIDs 16101 to 16107. R2 is the Point of Local Repair and R6 the destination: the solid SPF primary path runs R2 to R4 to R6 at cost 65, and the dashed TI-LFA repair for an R2 to R4 failure runs R2, R1, R3, R5, R7, R6 with R1 as the PQ node. Each link is labelled with its IGP metric. — IS-IS Segment Routing with TI-LFA in OcNOS. Seven routers R1 to R7 carry loopbacks 10.10.10.101 to 10.10.10.107 and prefix node-SIDs 16101 to 16107. R2 is the Point of Local Repair and R6 the destination: R2 reaches R6 through R4 at a cost of 65 (45 + 20), shown solid. TI-LFA protects the R2 to R4 link, and the repair it pre-installs is the post-convergence path R2, R1, R3, R5, R7, R6, shown dashed, with R1 as the PQ node. IGP metrics are on the links: R1-R2 10, R1-R3 10, R2-R4 45, R3-R5 10, R4-R5 30, R4-R6 20, R5-R7 20, R6-R7 20. There is no R2-R3 link.

Configuring ISIS-SR with TI-LFA in OcNOS

! OcNOS -- IS-IS SR with TI-LFA
! Shown on R2, the Point of Local Repair (PLR) analyzed in this lab.
! Enable TI-LFA on every router in the IS-IS domain.
!
! ---- Prerequisite: IS-IS Segment Routing (from the ISIS-SR setup) ----
! segment-routing mpls is enabled under the IS-IS instance; the node
! SID is set on the loopback with prefix-sid index. R2's node SID label
! seen in the SR forwarding plane is 16102 (SRGB base 16000 + index 102).
!
router isis OCNOS
  is-type level-2-only
  segment-routing mpls
!
interface lo
  ip address 127.0.0.1/8
  ip address 10.10.10.102/32 secondary
  ip router isis OCNOS
  prefix-sid index 102
!
! ---- Core interfaces (IS-IS point-to-point) ----
! xe4.95  faces R1  (neighbor 10.10.12.1, metric 10)
! xe21.93 faces R4  (neighbor 10.10.24.4, metric 45)
interface xe4.95
  ip router isis OCNOS
  isis network point-to-point
  isis metric 10
!
interface xe21.93
  ip router isis OCNOS
  isis network point-to-point
  isis metric 45
!
! ---- Enable TI-LFA for IS-IS level-2, IPv4 ----
router isis OCNOS
  fast-reroute ti-lfa level-2 proto ipv4
  commit
!
! Note: the fast-reroute TI-LFA command must be enabled for the
! respective IS-IS levels on every router in the domain. Node protection
! is computed automatically when a valid PQ path exists (see below).

Verification Commands

These commands walk the case in the figure above: destination R6, reached through R4 at a cost of 65, with the R2 to R4 link protected. Which node becomes the PQ node depends on one value, the R1 to R3 metric, and it is worth changing it to watch the repair move. At the 10 shown above the PQ node is R1; raise it to 30 and the PQ node becomes R3; raise it to 100 and there is no common PQ node at all, so TI-LFA falls back to a disjoint P and Q pair. Note which command you need: isis metric is the narrow metric and OcNOS caps it at 63, so the first two cases are isis metric 10 and isis metric 30, while the third is isis wide-metric 100. One metric change and a re-run of the three commands below is the whole demonstration.

! OcNOS -- TI-LFA verification (run on R2, the PLR)
!
! Step 1: IS-IS topology and metrics
show isis topology
! Tag OCNOS:  VRF : default
! IS-IS paths to level-2 routers
! System Id     Metric   Next-Hop        Interface       SNPA
! R4            45       R4    xe21.93    e8c5.7a46.5c33
! R1            10       R1    xe4.95     e8c5.7aa0.a142
! R6            65       R4    xe21.93    e8c5.7a46.5c33

! Step 2: TI-LFA P-space / Q-space / PQ node for a destination (R6)
show isis tilfa pq | be Node: R6.00-00
! ... lists P node / Q node entries, then:
! PQ Node: R1.00-00 backup dist:10
! PQ Node (Node Protection): R1.00-00 backup dist:10

! Step 3: Primary and TI-LFA backup path for a prefix (R6 = 10.10.10.106/32)
show ip isis route tilfa | be 10.10.10.106/32
! 10.10.10.106/32
!  L2: Primary Path Nexthop  : 10.10.24.4, xe21.93
!     SR Incoming Label      : 16106
!     SR outgoing Label      : 16106
!     PQ node : 10.10.10.101
!     Backup outgoing Label  : 16106
!     Bypass_trunk id : 2203
!     Backup out interface : xe4.95
!     Protection Type: Node Proctecting

! Step 4: MPLS forwarding-table (FTN) -- primary and backup on the source router
show mpls forwarding-table 10.10.10.106/32
! FEC              FTN-ID  Nhlfe-ID  Pri  LSP-Type      Out-Label  Out-Intf  Nexthop
! 10.10.10.106/32  5       19        Yes  LSP_DEFAULT   16106      xe21.93   10.10.24.4
! 10.10.10.106/32  11      59        No   LSP_DEFAULT   16106      xe4.95    10.10.12.1

! Step 5: MPLS ILM-table -- primary and backup on the transit router
show mpls ilm-table 10.10.10.106/32
! FEC/VRF/L2CKT    ILM-ID  In-Label  Out-Label  Out-Intf/VRF  Nexthop      pri
! 10.10.10.106/32  142     16106     16106      xe21.93       10.10.24.4   Yes
! 10.10.10.106/32  306     16106     16106      xe4.95        10.10.12.1   No

Node Protection vs. Link Protection

! OcNOS -- Node protection vs link protection
!
! In this OcNOS lab, TI-LFA computes a node-protecting backup automatically
! whenever a valid PQ path exists; there is no separate node-protection
! configuration keyword beyond the fast-reroute ti-lfa command above.
! The result is reported per prefix, and "Node Proctecting" means the backup
! protects against both link and node failure.
!
! The PQ computation lists both the link-protecting and node-protecting PQ node:
show isis tilfa pq | be Node: R6.00-00
! PQ Node: R1.00-00 backup dist:10
! PQ Node (Node Protection): R1.00-00 backup dist:10
!
! The per-prefix route output reports the protection type and the repair
! (Bypass) trunk that carries the pre-computed segment stack:
show ip isis route tilfa | be 10.10.10.106/32
! PQ node : 10.10.10.101
! Bypass_trunk id : 2203
! Backup out interface : xe4.95
! Protection Type: Node Proctecting
!
! The repair tunnel detail (label stack + nexthop) is shown under the
! PQ node's own FTN entry:
show ip isis route tilfa | be 10.10.10.101/32
! Trunk : 2203 :10.10.10.101_nh_327843935   ftn_ix : 15 ref_cnt:3
! Number Of outgoing label : 1
!  16101
! Nexthop address : 10.10.12.1

IP Infusion Engineering Team