L         ____
   S----------F--{____}--D
  _|_       ___________ /  
 {___}--R--{___________}                                                 

                                                                                                                   
                                                                                                                   

Figure 1: Link Protection

We use Figure 1 to illustrate the three objectives that have to be met when implementing SR FRR.

First, the protecting router S needs to find a detour path around the protected link. Intuitively, the Point of Local Repair (PLR) needs to find a node R (a repair node) that is capable of safely forwarding the traffic affected by the failure of the protected link L. We leverage the algorithms defined in the IP-FRR framework to achieve this first goal, as explained in Section 2.

Second, S must ensure proper forwarding behavior once the packet reaches the repair node R. We define the segment operations to be applied by the protecting node to ensure consistency with the forwarding state of the repair node in Section 3.

We will observe, in Section 4, that the MPLS instantiation of SR improves the scalability and operation of the FRR solution by not requiring multi-hop LDP sessions to distant repair nodes.

2. Protection lists

The protection list is the list of segments encoding a detour path from the protecting node S to the repair node R, avoiding the protected link L. In this section, we define how to encode the LFA, RLFA, and DLFA repair paths with protection lists. These protection lists contain at most two segments.

2.1. LFA based protection list

According to the LFA FRR approach, if a path to a destination D from a neighbor N of S does not contain S (i.e. N is a loop-free alternate of S for the failure of link S-F), then S can pre-install a repair forwarding information, in order to deviate the packet to N upon the failure of S-F.

In the case of LFA applicability, the SR protection list is thus empty. All what a protecting router S needs to do is to send the protected packet as is to its LFA neighbor N.

2.2. RLFA based protection list

If there is no such LFA neighbor, then S may be able to create a virtual LFA by using a tunnel to carry the packet to a point in the network that is not a direct neighbor of S, and from which the packet will be delivered to the destination without looping back to S. The Remote LFA proposal [I-D.ietf-rtgwg-remote-lfa] calls such a tunnel a repair tunnel. The tail-end of this tunnel (R in figure 1) is called a "remote LFA" or a "PQ node". We refer to the RLFA document for the definitions of the P and Q sets.

In the case of RLFA applicability for the protection of a segment, the protection list is made of a nodal segment to the PQ node. It thus matches [nodal(PQ), …]

2.3. DLFA based protection list

There are some cases where there is no remote LFA coverage for some links/destinations, due to topological properties in the neighborhood of the protecting node. If there is no such RLFA PQ node, we propose to use a Directed LFA (DLFA) repair tunnel to a Q node that is adjacent to the P space [I-D.bryant-ipfrr-tunnels].

In the case of applicability of RLFA with directed forwarding (DLFA), the protection list is made of a nodal segment to the P node followed by an Adjacency segment to the Q node. It thus matches [nodal(P), Adj(P→Q), …]

In networks with symmetric IGP metrics (the metric of a link AB is the same as the metric of the reverse link BA), we can prove that either the P and the Q sets intersect or there is at least one P node that is adjacent to a Q node. Thanks to the DLFA extension, we thus have a guaranteed LFA-based FRR technique for any network with symmetric IGP metrics.

Future versions of the document will describe the solutions leveraging SR capabilities to provide guaranteed FRR applicability in any IGP topology.

3. Protecting segments

In this section, we explain how a protecting router S processes the active segment of a packet upon the failure of the primary adjacency along which the packet should be forwarded. The behavior depends on the type of active segment to be protected.

3.1. The active segment is a node segment

The definition of the protection of a nodal segment is a direct translation of IP-FRR behaviors into the SR terminology. That is, traffic for nodal segment D will be rerouted to a safe node R whose shortest paths for D do not contain the failed component.

As nodal segments semantics are known by all nodes of the domain, no specific signaling needs to be done to let R correctly process the detoured packet. A packet whose active segment matches [nodal(D),…], arriving at a protecting node S will leave S with a segment list matching [PS(R), nodal(D),…]. The actual value used to encode nodal(D) is set by S based on the SRSB obtained from the IGP [I-D.filsfils-rtgwg-segment-routing].

PS(R) is the computed Protection list to reach R, as discussed in section 2, and depends on the available type of protection: per-prefix LFA, Remote LFA or Directed LFA. The packet will follow the detour path defined by PS(R), and will finally reach R. When reaching R, the active segment of the packet is nodal(D), and the packet resumes its course along the original segment list.

3.2. The active segment is an adjacency segment

The operator may forbid protection of an adjacency segment by policy (?-Flag in [ISIS]/[OSPF]). For example, this is useful when the operator prefers an end-to-end protection mechanism triggered by the source of a multi-hop transport conduit.

We define hereafter the FRR behavior applied by S for any packet received with an active segment L for which protection was enabled. We distinguish the case where this active segment is followed by another adjacency segment from the case where it is followed by a nodal segment.

3.2.1. Protecting [Adjacency, Adjacency] segment lists

If the next segment in the list is an Adjacency Segment, then the packet has to be conveyed to F.

To do so, S applies a “NEXT” operation on Adj(L) and then two consecutive “PUSH” operations: first it pushes a nodal Segment for F, and then it pushes a protection list allowing to reach F while bypassing L.

Upon failure of L, a packet reaching S with a segment list matching [adj(L),adj(M),…] will thus leave S with a segment list matching [PS(F),nodal(F),adj(M)].

The protection list PS(F) will define the course of the packet from S to F, and F will resume the the course of the original segment list, receiving it with an active segment list matching [nodal(F), adj(M),…].

3.2.2. Protecting [Adjacency, Nodal] segment lists

If the next segment in the stack is a nodal segment, say for node T, the packet segment list matches [adj(L),nodal(T),…].

A first solution would consist in steering the packet back to F while avoiding L, similarly to the previous case. To do so, S applies a “NEXT” operation on Adj(L) and then two consecutive “PUSH” operations: first it pushes a nodal Segment for F, and then it pushes a protection list allowing to reach F while bypassing L.

Upon failure of L, a packet reaching S with a segment list matching [adj(L),nodal(T),…] will thus leave S with a segment list matching [PS(F),nodal(F),nodal(T)].

Another solution is to not steer the packet back via F. In this case, S just needs to apply a “NEXT” operation on the Adjacency segment related to L, and push a protection segment list redirecting the traffic to a node R, capable of whose path to nodal segment T is not affected by the failure.

Upon failure of L, packets reaching S with a segment list matching [adj(L), nodal(T), …], would leave S with a segment list matching [PS(R),nodal(T), …].

4. SR FRR benefits in LDP environments

In this section, we describe the operational and scaling benefits of SR when used to implement RLFA and DLFA protection for LDP-based transport. We will also observe that a partial SR deployment, limited to the network region where the SR benefits are most desired, already provides the mentioned scaling benefits.

        X
        |
 Y--A---B---E--Z
    |   |    \
    D---C--F--G 
            30