Configure Topology-Independent Loop-Free Alternate (TI-LFA)

Topology-Independent Loop-Free Alternate (TI-LFA) uses segment routing to provide link, node, and Shared Risk Link Groups (SRLG) protection in topologies where other fast reroute techniques cannot provide protection.

  • Classic Loop-Free Alternate (LFA) is topology dependent, and therefore cannot protect all destinations in all networks. A limitation of LFA is that, even if one or more LFAs exist, the optimal LFA may not always be provided.

  • Remote LFA (RLFA) extends the coverage to 90-95% of the destinations, but it also does not always provide the most desired repair path. RLFA also adds more operational complexity by requiring a targeted LDP session to the RLFAs to protect LDP traffic.

TI-LFA provides a solution to these limitations while maintaining the simplicity of the IPFRR solution.

The goal of TI-LFA is to reduce the packet loss that results while routers converge after a topology change due to a link or node failure. Rapid failure repair (< 50 msec) is achieved through the use of pre-calculated backup paths that are loop-free and safe to use until the distributed network convergence process is completed.

The optimal repair path is the path that the traffic will eventually follow after the IGP has converged. This is called the post-convergence path. This path is preferred for the following reasons:

  • Optimal for capacity planning — During the capacity-planning phase of the network, the capacity of a link is provisioned while taking into consideration that such link with be used when other links fail.

  • Simple to operate — There is no need to perform a case-by-case adjustments to select the best LFA among multiple candidate LFAs.

  • Fewer traffic transitions — Since the repair path is equal to the post-convergence path, the traffic switches paths only once.

The following topology illustrates the optimal and automatic selection of the TI-LFA repair path.

Figure 1. TI-LFA Repair Path

Node 2 protects traffic to destination Node 5.

With classic LFA, traffic would be steered to Node 4 after a failure of the protected link. This path is not optimal, since traffic is routed over edge node Node 4 that is connected to lower capacity links.

TI-LFA calculates a post-convergence path and derives the segment list required to steer packets along the post-convergence path without looping back.

In this example, if the protected link fails, the shortest path from Node2 to Node5 would be:

Node2 → Node6 → Node7 → Node3 → Node5

Node7 is the PQ-node for destination Node5. TI-LFA encodes a single segment (prefix SID of Node7) in the header of the packets on the repair path.

TI-LFA Protection Types

TI-LFA supports the following protection:

  • Link protection — The link is excluded during the post-convergence backup path calculation.

  • Node protection — The neighbor node is excluded during the post convergence backup path calculation.

  • Shared Risk Link Groups (SRLG) protection — SRLG refer to situations in which links in a network share a common fiber (or a common physical attribute). These links have a shared risk: when one link fails, other links in the group might also fail. TI-LFA SRLG protection attempts to find the post-convergence backup path that excludes the SRLG of the protected link. All local links that share any SRLG with the protecting link are excluded.

When you enable link protection, you can also enable node protection, SRLG protection, or both, and specify a tiebreaker priority in case there are multiple LFAs.

The following example illustrates the link, node, and SRLG protection types. In this topology, Node2 applies different protection models to protect traffic to Node7.

Figure 2. TI-LFA Protection Types

Behaviors and Limitations of TI-LFA

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Increased Number of Labels on Topology-Independent Loop-Free Alternate Backup Paths

 Release 7.9.1

This feature increases the maximum number of labels that can be pushed on the Topology-Independent Loop-Free Alternate (TI-LFA) backup path (including the label of the protected prefix) from three to eight.

The increase in TI-LFA backup labels provides support for primary and backup paths that go over the same Shared Risk Link Groups (SRLG).

BFDv6-triggered TI-LFA

Release 7.3.2

Topology-Independent Loop-Free Alternate (TI-LFA) uses segment routing to provide link, node, and Shared Risk Link Groups (SRLG) protection in topologies where other fast reroute techniques cannot provide protection.

BFDv6-triggered TI-LFA allows you to obtain link, node, and SRLG protection using the Bidirectional Forwarding Detection (BFD) over IPv6 protocol.

BFDv4-triggered TI-LFA

Release 7.3.1

Topology-Independent Loop-Free Alternate (TI-LFA) uses segment routing to provide link, node, and Shared Risk Link Groups (SRLG) protection in topologies where other fast reroute techniques cannot provide protection.

BFD-triggered TI-LFA allows you to obtain link, node, and SRLG protection by using the Bidirectional Forwarding Detection (BFD) protocol.

These are the TI-LFA behaviors and limitations:

  • For a given destination prefix, TI-LFA does not support a backup path that uses the same next hop as a primary path when the backup path requires a different label stack. This limitation applies to Cisco 8000 platforms running IOS XR releases earlier than Release 25.1.1.

    Example scenario: In this example where we use TI-LFA with Weighted Remote Shared Risk Link Group (WR-SRLG), router 4 is reachable from router 1 through two ECMP primary paths and one TI-LFA backup path:

    Figure 3. Example scenario: TI-LFA with Weighted Remote Shared Risk Link Group

    Path

    Next Hop

    Route

    Labels

    Backup Patth
    Path 1 (Primary ECMP) Router 2 Router 1 → Router 2 → Router 4 [L4] Backup is Path 2
    Path 2 (Primary ECMP) Router 3 Router 1 → Router 3 → Router 4 [L4] Backup is Path 3
    Path 3 (Backup) Router 2 Router 1 → Router 2 → Router 5 → Router 4 [L5 L4] TI-LFA backup for Path 2

    In this example, Path 3 is the TI-LFA backup for Path 2. It uses same next-hop (Router 2) as Path 1 but with a different label stack that steers traffic through Router 5 to avoid using link 2-4 that belongs to same SRLG as the protected link 1-3.

    This scenario is not supported on Cisco 8000 platforms running IOS XR releases earlier than 25.1.1. Support for this scenario was added in IOS XR 25.1.1.

  • IGP directly programs a TI-LFA backup path requiring eight or fewer labels, including the label of the protected destination prefix.

  • Programming of TI-LFA backup paths requiring more than eight labels is not supported.

Table 2. TI-LFA functionality support on IS-IS and OSPFv2
TI-LFA Functionality IS-IS1 OSPFv2
Protected Traffic Types
Protection for SR labeled traffic Supported Supported
Protection of IPv4 unlabeled traffic Supported (IS-ISv4) Supported
Protection of IPv6 unlabeled traffic

Supported (IS-ISv6)

N/A
Protection Types
Link Protection Supported Supported
Node Protection Supported Supported
Local SRLG Protection

Supported

 Supported
Weighted Remote SRLG Protection

Supported

Supported
Line Card Disjoint Protection

Unsupported

 Unsupported
Interface Types
Ethernet Interfaces Supported Supported
Ethernet Bundle Interfaces Supported Supported
TI-LFA over GRE Tunnel as Protecting Interface Unsupported

Unsupported
Additional Functionality

Maximum number of labels that can be pushed on the backup path (including the label of the protected prefix)

8

8

BFDv4-triggered

Supported

Supported

BFDv6-triggered

Supported

N/A
Prefer backup path with lowest total metric

Unsupported

Unsupported
Prefer backup path from ECMP set

Unsupported

Unsupported
Prefer backup path from non-ECMP set

Unsupported

Unsupported
Load share prefixes across multiple backups paths

Supported

Supported
Limit backup computation up to the prefix priority Supported Supported
1 Unless specified, IS-IS support is IS-ISv4 and IS-ISv6

Configuring TI-LFA for IS-IS

This task describes how to enable per-prefix Topology Independent Loop-Free Alternate (TI-LFA) computation to converge traffic flows around link, node, and SRLG failures.

Before you begin

Ensure that the following topology requirements are met:

SUMMARY STEPS

  1. configure
  2. router isis instance-id
  3. interface type interface-path-id
  4. address-family { ipv4 | ipv6} [ unicast]
  5. fast-reroute per-prefix
  6. fast-reroute per-prefix ti-lfa
  7. fast-reroute per-prefix tiebreaker { node-protecting | srlg-disjoint } index priority

DETAILED STEPS

  Command or Action Purpose

Step 1

configure

Example:


RP/0/RP0/CPU0:router# configure

Enters global configuration mode.

Step 2

router isis instance-id

Example:


RP/0/RP0/CPU0:router(config)# router isis 1

Enables IS-IS routing for the specified routing instance, and places the router in router configuration mode.

Note

 
You can change the level of routing to be performed by a particular routing instance by using the is-type router configuration command.

Step 3

interface type interface-path-id

Example:


RP/0/RP0/CPU0:router(config-isis)# interface GigabitEthernet0/0/0/1

Enters interface configuration mode.

Step 4

address-family { ipv4 | ipv6} [ unicast]

Example:


RP/0/RP0/CPU0:router(config-isis-if)# address-family ipv4 unicast

Specifies the IPv4 or IPv6 address family, and enters router address family configuration mode.

Step 5

fast-reroute per-prefix

Example:


RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix

Enables per-prefix fast reroute .

Step 6

fast-reroute per-prefix ti-lfa

Example:


RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix ti-lfa

Enables per-prefix TI-LFA fast reroute link protection.

Step 7

fast-reroute per-prefix tiebreaker { node-protecting | srlg-disjoint } index priority

Example:


RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix srlg-disjoint index 100

Enables TI-LFA node or SRLG protection and specifies the tiebreaker priority. Valid priority values are from 1 to 255. The lower the priority value, the higher the priority of the rule. Link protection always has a lower priority than node or SRLG protection.

Note

 
The same attribute cannot be configured more than once on an interface.

TI-LFA has been successfully configured for segment routing.

Configuring TI-LFA for OSPF

This task describes how to enable per-prefix Topology Independent Loop-Free Alternate (TI-LFA) computation to converge traffic flows around link, node, and SRLG failures.


Note
TI-LFA can be configured on the instance, area, or interface. When configured on the instance or area, all interfaces in the instance or area inherit the configuration.

Before you begin

Ensure that the following topology requirements are met:

SUMMARY STEPS

  1. configure
  2. router ospf process-name
  3. area area-id
  4. interface type interface-path-id
  5. fast-reroute per-prefix
  6. fast-reroute per-prefix ti-lfa
  7. fast-reroute per-prefix tiebreaker { node-protecting | srlg-disjoint } index priority

DETAILED STEPS

  Command or Action Purpose

Step 1

configure

Example:


RP/0/RP0/CPU0:router# configure

Enters global configuration mode.

Step 2

router ospf process-name

Example:


RP/0/RP0/CPU0:router(config)# router ospf 1

Enables OSPF routing for the specified routing process, and places the router in router configuration mode.

Step 3

area area-id

Example:


RP/0/RP0/CPU0:router(config-ospf)# area 1

Enters area configuration mode.

Step 4

interface type interface-path-id

Example:


RP/0/RP0/CPU0:router(config-ospf-ar)# interface GigabitEthernet0/0/0/1

Enters interface configuration mode.

Step 5

fast-reroute per-prefix

Example:


RP/0/RP0/CPU0:router(config-ospf-ar-if)# fast-reroute per-prefix

Enables per-prefix fast reroute.

Step 6

fast-reroute per-prefix ti-lfa

Example:


RP/0/RP0/CPU0:router(config-ospf-ar-if)# fast-reroute per-prefix ti-lfa

Enables per-prefix TI-LFA fast reroute link protection.

Step 7

fast-reroute per-prefix tiebreaker { node-protecting | srlg-disjoint } index priority

Example:


RP/0/RP0/CPU0:router(config-isis-ar-if)# fast-reroute per-prefix srlg-disjoint index 100

Enables TI-LFA node or SRLG protection and specifies the tiebreaker priority. Valid priority values are from 1 to 255. The higher the priority value, the higher the priority of the rule. Link protection always has a lower priority than node or SRLG protection.

Note

 
The same attribute cannot be configured more than once on an interface.

TI-LFA has been successfully configured for segment routing.

TI-LFA Node and SRLG Protection: Examples

The following examples show the configuration of the tiebreaker priority for TI-LFA node and SRLG protection, and the behavior of post-convergence backup-path. These examples use OSPF, but the same configuration and behavior applies to IS-IS.

Example: Enable link-protecting and node-protecting TI-LFA


router ospf 1
 area 1
  interface GigabitEthernet0/0/2/1
    fast-reroute per-prefix 
    fast-reroute per-prefix ti-lfa
    fast-reroute per-prefix tiebreaker node-protecting index 100

Both link-protecting and node-protecting TI-LFA backup paths will be computed. If the priority associated with the node-protecting tiebreaker is higher than any other tiebreakers, then node-protecting post-convergence backup paths will be selected, if it is available.

Example: Enable link-protecting and SRLG-protecting TI-LFA


router ospf 1
 area 1
  interface GigabitEthernet0/0/2/1
    fast-reroute per-prefix 
    fast-reroute per-prefix ti-lfa
    fast-reroute per-prefix tiebreaker srlg-disjoint index 100

Both link-protecting and SRLG-protecting TI-LFA backup paths will be computed. If the priority associated with the SRLG-protecting tiebreaker is higher than any other tiebreakers, then SRLG-protecting post-convergence backup paths will be selected, if it is available.

Example: Enable link-protecting, node-protecting and SRLG-protecting TI-LFA


router ospf 1
 area 1
  interface GigabitEthernet0/0/2/1
    fast-reroute per-prefix 
    fast-reroute per-prefix ti-lfa
    fast-reroute per-prefix tiebreaker node-protecting index 200
    fast-reroute per-prefix tiebreaker srlg-disjoint index 100

Link-protecting, node-protecting, and SRLG-protecting TI-LFA backup paths will be computed. If the priority associated with the node-protecting tiebreaker is highest from all tiebreakers, then node-protecting post-convergence backup paths will be selected, if it is available. If the node-protecting backup path is not available, SRLG-protecting post-convergence backup path will be used, if it is available.

Configuring Global Weighted SRLG Protection

A shared risk link group (SRLG) is a set of links sharing a common resource and thus shares the same risk of failure. The existing loop-free alternate (LFA) implementations in interior gateway protocols (IGPs) support SRLG protection. However, the existing implementation considers only the directly connected links while computing the backup path. Hence, SRLG protection may fail if a link that is not directly connected but shares the same SRLG is included while computing the backup path. Global weighted SRLG protection feature provides better path selection for the SRLG by associating a weight with the SRLG value and using the weights of the SRLG values while computing the backup path.

To support global weighted SRLG protection, you need information about SRLGs on all links in the area topology. You can flood SRLGs for remote links using ISIS or manually configuring SRLGS on remote links.

Configuration Examples: Global Weighted SRLG Protection

There are three types of configurations that are supported for the global weighted SRLG protection feature.

  • local SRLG with global weighted SRLG protection

  • remote SRLG flooding

  • remote SRLG static provisioning

This example shows how to configure the local SRLG with global weighted SRLG protection feature. 


RP/0/RP0/CPU0:router(config)# srlg
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg-if)# exit
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/1
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg)# name group value 100
RP/0/RP0/CPU0:router(config)# router isis 1 
RP/0/RP0/CPU0:router(config-isis)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix srlg-protection weighted-global
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix tiebreaker srlg-disjoint index 1
RP/0/RP0/CPU0:router(config-isis)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-isis-if)# point-to-point 
RP/0/RP0/CPU0:router(config-isis-if)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix 
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix ti-lfa
RP/0/RP0/CPU0:router(config-isis)# srlg
RP/0/RP0/CPU0:router(config-isis-srlg)# name group1 
RP/0/RP0/CPU0:router(config-isis-srlg-name)# admin-weight 5000

This example shows how to configure the global weighted SRLG protection feature with remote SRLG flooding.The configuration includes local and remote router configuration. On the local router, the global weighted SRLG protection is enabled by using the fast-reroute per-prefix srlg-protection weighted-global command. In the remote router configuration, you can control the SRLG value flooding by using the advertise application lfa link-attributes srlg command. You should also globally configure SRLG on the remote router.

The local router configuration for global weighted SRLG protection with remote SRLG flooding is as follows: 

RP/0/RP0/CPU0:router(config)# router isis 1 
RP/0/RP0/CPU0:router(config-isis)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix srlg-protection weighted-global
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix tiebreaker srlg-disjoint index 1
RP/0/RP0/CPU0:router(config-isis-if-af)# exit
RP/0/RP0/CPU0:router(config-isis)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-isis-if)# point-to-point 
RP/0/RP0/CPU0:router(config-isis-if)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix 
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix ti-lfa
RP/0/RP0/CPU0:router(config-isis-if-af)# exit
RP/0/RP0/CPU0:router(config-isis)# srlg
RP/0/RP0/CPU0:router(config-isis-srlg)# name group1 
RP/0/RP0/CPU0:router(config-isis-srlg-name)# admin-weight 5000

The remote router configuration for global weighted SRLG protection with remote SRLG flooding is as follows:


RP/0/RP0/CPU0:router(config)# srlg
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg-if)# exit
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/1
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg)# name group value 100
RP/0/RP0/CPU0:router(config-srlg)# exit
RP/0/RP0/CPU0:router(config)# router isis 1
RP/0/RP0/CPU0:(config-isis)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-af)# advertise application lfa link-attributes srlg

This example shows configuring the global weighted SRLG protection feature with static provisioning of SRLG values for remote links. You should perform these configurations on the local router. 


RP/0/RP0/CPU0:router(config)# srlg
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg-if)# exit
RP/0/RP0/CPU0:router(config-srlg)# interface TenGigE0/0/0/1
RP/0/RP0/CPU0:router(config-srlg-if)# name group1
RP/0/RP0/CPU0:router(config-srlg)# name group value 100
RP/0/RP0/CPU0:router(config-srlg)# exit
RP/0/RP0/CPU0:router(config)# router isis 1
RP/0/RP0/CPU0:router(config-isis)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix srlg-protection weighted-global
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix tiebreaker srlg-disjoint index 1
RP/0/RP0/CPU0:router(config-isis)# interface TenGigE0/0/0/0
RP/0/RP0/CPU0:router(config-isis-if)# point-to-point 
RP/0/RP0/CPU0:router(config-isis-if)# address-family ipv4 unicast
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix 
RP/0/RP0/CPU0:router(config-isis-if-af)# fast-reroute per-prefix ti-lfa
RP/0/RP0/CPU0:router(config-isis)# srlg
RP/0/RP0/CPU0:router(config-isis-srlg)# name group1 
RP/0/RP0/CPU0:router(config-isis-srlg-name)# admin-weight 5000
RP/0/RP0/CPU0:router(config-isis-srlg-name)# static ipv4 address 10.0.4.1 next-hop ipv4 address 10.0.4.2
RP/0/RP0/CPU0:router(config-isis-srlg-name)# static ipv4 address 10.0.4.2 next-hop ipv4 address 10.0.4.1