RFC 5714
IP Fast Reroute Framework
1. Introduction ✨
Okay bestie, so this doc is the IP Fast Reroute Framework 🦋. It's written by M. Shand and S. Bryant from Cisco Systems, it's Informational (not a Standards Track spec, so nobody's forcing you to implement it), and it came out in January 2010 as RFC 5714 💜. Its ISSN is 2070-1721. The title block doesn't list any RFCs that it obsoletes or updates, so it's just doing its own thing 💅. This is Part 1 of 3 🌸.
When a link or node fails in a routed network, there's inevitably a gap where traffic doesn't get delivered properly 😭. The network has to re-converge on the new topology, and until it does, packets headed for destinations that used to go through the broken piece can get dropped or get stuck looping. Historically those gaps lasted at least several seconds, and most apps were built to put up with that kind of quality of service 🙈.
Routers have gotten way faster 🔥. For carefully configured networks running link state IGPs, the gap is now under a second. But new Internet services are showing up that can be sensitive to loss windows that are orders of magnitude shorter than that 💀.
Here's the tricky part: the distributed nature of the network puts an intrinsic limit on how fast convergence can ever be, so you can't just brute-force your way out of it 😤.
The alternative is lowkey genius 🧚. You compute backup routes ahead of time, so the router (or routers) that spot the failure can repair it locally, without having to tell everyone else first ⭐. The disruption then only lasts as long as it takes to detect the adjacent failure and switch over to those backup routes. It's basically the same vibe as MPLS fast-reroute [RFC4090], but the backup-route mechanisms for pure IP networks are necessarily very different 🎀.
This document is the framework for developing that approach 💖.
Also, to keep the impact on user applications small, the network may need to be designed so that backup paths with suitable characteristics (for example, capacity and/or delay) are available for the algorithms to pick from 🍓. Those design considerations are outside the scope of this document 🫶.
2. Terminology 🌈
This section defines the words and acronyms used in this document and in other documents that talk about IP fast-reroute 📚. Here's the full glossary, exactly as it's written:
D Used to denote the destination router under
discussion.
Distance_opt(A,B) The metric sum of the shortest path from A to B.
Downstream Path This is a subset of the loop-free alternates
where the neighbor N meets the following
condition:
Distance_opt(N, D) < Distance_opt(S,D)
E Used to denote the router that is the primary
neighbor to get from S to the destination D.
Where there is an ECMP set for the shortest path
from S to D, these are referred to as E_1, E_2,
etc.
ECMP Equal cost multi-path: Where, for a particular
destination D, multiple primary next-hops are
used to forward traffic because there exist
multiple shortest paths from S via different
output layer-3 interfaces.
FIB Forwarding Information Base. The database used
by the packet forwarder to determine what actions
to perform on a packet.
IPFRR IP fast-reroute.
Link(A->B) A link connecting router A to router B.
LFA Loop-Free Alternate. A neighbor N, that is not a
primary neighbor E, whose shortest path to the
destination D does not go back through the router
S. The neighbor N must meet the following
condition:
Distance_opt(N, D) < Distance_opt(N, S) +
Distance_opt(S, D)
Loop-Free Neighbor A neighbor N_i, which is not the particular
primary neighbor E_k under discussion, and whose
shortest path to D does not traverse S. For
example, if there are two primary neighbors E_1
and E_2, E_1 is a loop-free neighbor with regard
to E_2, and vice versa.
Loop-Free Link-Protecting Alternate
A path via a Loop-Free Neighbor N_i that reaches
destination D without going through the
particular link of S that is being protected. In
some cases, the path to D may go through the
primary neighbor E.
Loop-Free Node-Protecting Alternate
A path via a Loop-Free Neighbor N_i that reaches
destination D without going through the
particular primary neighbor (E) of S that is
being protected.
N_i The ith neighbor of S.
Primary Neighbor A neighbor N_i of S which is one of the next hops
for destination D in S's FIB prior to any
failure.
R_i_j The jth neighbor of N_i.
Repair Path The path used by a repairing node to send traffic
that it is unable to send via the normal path
owing to a failure.
Routing Transition The process whereby routers converge on a new
topology. In conventional networks, this process
frequently causes some disruption to packet
delivery.
RPF Reverse Path Forwarding, i.e., checking that a
packet is received over the interface that would
be used to send packets addressed to the source
address of the packet.
S Used to denote a router that is the source of a
repair that is computed in anticipation of the
failure of a neighboring router denoted as E, or
of the link between S and E. It is the viewpoint
from which IP fast-reroute is described.
SPF Shortest Path First, e.g., Dijkstra's algorithm.
SPT Shortest path tree
Upstream Forwarding Loop
A forwarding loop that involves a set of routers,
none of which is directly connected to the link
that has caused the topology change that
triggered a new SPF in any of the routers.3. Scope and Applicability 🎯
Okay so the initial scope of this work is link state IGPs 💅. Link state protocols give you ubiquitous topology information, and that's exactly what makes it possible to compute repair paths 🧠.
Providing similar facilities in non-link state IGPs and BGP is a matter for further study 🔍. But here's the thing: making sure the repair mechanisms still behave correctly for traffic whose destination is outside the IGP domain is an important consideration for any solution built on this framework 👑.
And complete protection against multiple unrelated failures? Out of scope for this work 🙈.
That's the end of Part 1 🦋 more coming in Part 2 💜
4. Problem Analysis ✨
okay so bestie, let's talk about why routing changes cause packet chaos 🙈 The amount of time packets get dropped during a conventional routing transition depends on a few things:
- Detecting the failure. This can take a few milliseconds if it's caught at the physical layer, or up to several tens of seconds when a routing protocol Hello is used. Packets are unavoidably lost during this time 💀
- The local router reacting. This usually means generating and flooding new routing updates (maybe after some hold-down delay) and recomputing the router's FIB 🛠️
- Telling everyone else. Without any routing protocol packet loss, this is typically between 10 milliseconds and 100 milliseconds per hop 🐢
- Recomputing the forwarding tables. For a link state protocol using Dijkstra's algorithm, this is typically a few milliseconds 🧮
- Loading the new tables into the forwarding hardware. This one is super implementation dependent and also depends on how many prefixes the failure affects. It can be several hundred milliseconds, which is a lot when you're waiting 😭
The disruption doesn't end until the routers next to the failure finish steps 1 and 2, and until every router whose paths were affected finishes the rest.
The first packet loss happens because the router(s) next to the failure keep trying to send packets across the broken link until they notice it's broken. That loss is unavoidable, but the detection time can be cut down to a few tens of milliseconds, as covered in Section 5.1 ✨
In some topologies, extra packet loss can come from "micro-loops" 🌀 These can form because routers' forwarding tables are briefly out of sync with each other [RFC5715]. Steps 3, 4, and 5 above cause those inconsistencies. For many routers, step 5 is the biggest factor and also the one that varies the most between routers 👀 The big variance comes from implementation differences and from the fact that the same failure hits each router differently. For example, the number of prefixes affected can vary wildly from one router to another.
So if we want packet disruption to be about as short as the failure detection time, two mechanisms may be needed:
a. A way for the router(s) next to the failure to quickly switch over to a repair path, one that isn't affected by any later re-convergence 🏃♀️
b. In topologies that are prone to micro-loops, a micro-loop control mechanism may be needed [RFC5715] 🔁
Doing the first without the second means the repair path gets starved of traffic and ends up being pointless. Doing the second without the first means the router(s) next to the failure end up throwing traffic away 🗑️
Repair paths can be used on their own when the failure is short-lived. In that case, the repair paths can stay in place until the failure gets fixed, so there's no need to tell other routers about the failure at all 🦋
Micro-loop avoidance can also be used on its own to prevent loops caused by planned management actions. The link or node being shut down can stay in service for a short while after its removal has been announced to the network, so it can act as its own "repair path" 🫶
Also, micro-loops can happen when a link or node comes back into service, so a micro-loop avoidance mechanism may be needed for both link up and link down cases 💜
5. Mechanisms for IP Fast-Reroute 🦋
Getting an effective solution to this problem takes a set of mechanisms, and we're going to break them down into the sub-problems in this section.
5.1. Mechanisms for Fast Failure Detection ⚡
Keeping failure detection time as small as possible is critical, bestie 😤 There are a few well-documented approaches, such as:
- Physical detection, like loss of light 💡
- Protocol detection that doesn't depend on the routing protocol, like the Bidirectional Failure Detection protocol [BFD] 🤝
- Routing protocol detection, like using "fast Hellos" 🏎️
When you set up packet-based failure detection, you really need to think about how likely false failure indications are and what happens if they show up 🙃 You can cut down on false indications by properly prioritizing how the packets used to detect link or node failure are sent, received, and processed. This isn't a problem that's specific to IPFRR, though, so it's not just our issue 💅
5.2. Mechanisms for Repair Paths 🩹
Once one of the mechanisms above spots a failure, traffic that used to cross the failure gets sent over one or more repair paths. The repair paths should be designed so they can be calculated ahead of time for each local failure and be ready to use with minimal delay ⏱️ There are three basic kinds of repair paths:
- Equal cost multi-paths (ECMP). If these exist, and one or more of the alternate paths don't cross the failure, they can easily be used as repair paths 🎀
- Loop-free alternate paths. One of these exists when a direct neighbor of the router next to the failure has a path to the destination that's guaranteed not to cross the failure 🌸
- Multi-hop repair paths. If there's no feasible loop-free alternate path, it may still be possible to find a router that's more than one hop away from the router next to the failure, where traffic can be forwarded to the destination without crossing the failure 🧭
ECMP and loop-free alternate paths (as described in [RFC5286]) are the simplest repair paths, so they're what you'd normally use whenever they're available 👑 It's expected that around 80% of failures (see Section 5.2.2) can be fixed with these basic methods alone 🙌
Multi-hop repair paths are way more complex, both in the calculations needed to find out if they exist and in the mechanisms needed to invoke them 😵💫 They can be broken down further into:
a. Mechanisms where one or more alternate FIBs are pre-computed in all routers, and the repaired packet is told to be forwarded using a "repair FIB". This is done with some kind of per-packet signaling, like detecting a "U-turn" [UTURN], [FIFR] or by marking the packet [SIMULA] 🏷️
b. Mechanisms that work like a loose source route, invoked using the normal FIB. These include tunnels [TUNNELS], alternative shortest paths [ALT-SP], and label-based mechanisms 🚇
c. Mechanisms that use special addresses or labels installed in the FIBs of all routers that have routes pre-computed to avoid certain parts of the network. For example, see [NOTVIA] 🙈
In lots of cases, a repair path that reaches two hops away from the router that detected the failure is enough, and around 98% of failures (see Section 5.2.2) can be fixed this way 🥰 But if you want complete repair coverage, you generally need some longer multi-hop repair paths too 💖
5.2.1. Scope of Repair Paths 🔭
A repair path might be valid for every destination that needs repair, or it might only work for some of them. If a repair path is valid for a node directly downstream of the failure, then it's valid for every destination that used to be reachable by going through the failure 🙌 But sometimes that kind of repair path is hard to set up because it needs a high-order multi-hop repair path. In that case, you might still be able to find lower-order repair paths (maybe even loop-free alternate paths) that fix most of the destinations 🧩 When IPFRR can't provide complete repair, it's desirable to be able to figure out how much repair coverage you have and report it through network management 📊
There's a trade-off between keeping the number of repair paths you compute small and keeping the overhead low when you use higher-order multi-hop repair paths for destinations that don't strictly need them ⚖️ Figuring out repair paths for each individual destination can get really expensive computationally, though 😩
Lots of the time, most destinations can be repaired with just the "basic" repair mechanism, and only a smaller group needs one of the fancier multi-hop methods. A hybrid approach like this can help balance completeness and complexity 🫶
Using repair paths can push too much traffic over a link, which causes congestion discards 💀 That makes IPFRR less effective, so mechanisms that spread out repaired traffic to reduce this effect are desirable 🌈
5.2.2. Analysis of Repair Coverage 📈
How much repair coverage you get depends on the repair strategy, and it depends a lot on the detailed topology and metrics too 🗺️ The coverage estimates in this document are for illustrative purposes only, and they may not always be achievable 🙃
With some repair strategies, you can repair every single link or node failure in the network for all possible destinations. That's called 100% coverage 👑 But when coverage is less than 100%, it's important to define what a percentage means if you want to compare different proposed repair strategies. There are four possibilities:
- The percentage of links (or nodes) that can be fully protected, meaning for all destinations. This fits when you need to protect all traffic, but some failures may be identified as impossible to protect 🔒
- The percentage of destinations that can be protected against all link (or node) failures. This fits when you need to protect against every possible failure, but some destinations may be identified as impossible to protect 🎯
- For all destinations (d) and all failures (f), the percentage of the total potential failure cases (d*f) that are protected. This fits when the goal is overall "best-effort" protection 🤷♀️
- The percentage of packets normally passing through the network that will keep reaching their destination. This needs a traffic matrix for the network as part of the analysis 📦
5.2.3. Link or Node Repair ✨
okay so a repair path can be computed to protect against an adjacent link failing, or an adjacent node failing. 🫶 link protection is generally simpler to achieve, bestie. a repair that protects against node failure will also protect against link failure for all destinations, except the ones where the adjacent node is a single point of failure 💀
sometimes you need to tell a link failure apart from a node failure so the optimal repair strategy gets invoked 🔥 methods for doing that determination might be based on techniques like BFD [BFD]. you can make that determination before invoking any repairs, but that increases the period of packet loss after a failure, unless the determination can be done as part of the failure detection mechanism itself 😭 or you can do a subsequent determination that optimizes a default strategy that was already invoked. iykyk 🦋
5.2.4. Maintenance of Repair Paths 🧚
so to hit the response-time goals, it's expected (though not required) that repair paths and their associated FIB entries get pre-computed and installed, ready to go the moment a failure is detected 💅 once they're invoked, the repair paths stay in effect until they're no longer required. that normally happens when the routing protocol has re-converged on the new topology that accounts for the failure, and traffic has stopped using the repair paths 🌸
the repair paths are unaffected by any topology changes caused by the failure that instantiated them, so there's no need to re-compute them during the convergence period 🙈 they can be affected by an unrelated simultaneous topology change, but those events are out of scope for this work (see Section 5.2.6) 💜
once the routing protocol has re-converged, all repair paths need to take the new topology into account 🎀 there are various optimizations that can efficiently identify repair paths that aren't affected by the change, so they don't need a full re-computation ✨ since the new repair paths won't be needed until the next failure happens, the re-computation can run as a background task and be subject to a hold-down. but excessive delay in finishing this will raise the risk of a new failure happening before the repair paths are in place 😭🔥
5.2.5. Local Area Networks 🌈
protecting against partial or complete failure of LANs is way more complex than the point-to-point case 💀 in general there's a trade-off between how simple the repair is and how well you can provide complete and optimal repair coverage 🍓
5.2.6. Multiple Failures and Shared Risk Link Groups 👑
complete protection against multiple unrelated failures is out of scope for this work 🙈 however, a second failure happening while one failure is being repaired should not result in a level of service that's significantly worse than what you'd have without any repair strategy at all. that's non-negotiable, periodt 💅
Shared Risk Link Groups (SRLGs) are an example of multiple related failures, and the more complex parts of protecting them are a matter for further study 🦋
one SRLG example that's clearly within scope is a node failure 🫶 it causes multiple links to fail at the same time, but their tightly defined topological relationship makes the problem more tractable ✨
5.3. Mechanisms for Micro-Loop Prevention 🌸
ensuring there are no micro-loops is important, not just because they can cause packet loss in traffic affected by the failure, but because by saturating a link with looping packets, micro-loops can cause congestion 😭 and that congestion can then lead to routers discarding traffic that would otherwise be totally unaffected by the failure. main character energy? nope, villain energy 💀
a bunch of solutions to micro-loop formation have been proposed and are summarized in [RFC5715] 💖 the following factors are significant in classifying them:
- Partial or complete protection against micro-loops.
- Convergence delay.
- Tolerance of multiple failures (from node failures, and in general).
- Computational complexity (pre-computed or real time).
- Applicability to scheduled events.
- Applicability to link/node reinstatement.
- Topological constraints.
6. Management Considerations 🎀
while many of the management requirements will be specific to particular IPFRR solutions, the following general aspects need to be addressed 💅
- Configuration A. Enabling/disabling IPFRR support. B. Enabling/disabling protection on a per-link or per-node basis. C. Expressing preferences regarding the links/nodes used for repair paths. D. Configuration of failure detection mechanisms. E. Configuration of loop-avoidance strategies
- Monitoring and operational support A. Notification of links/nodes/destinations that cannot be protected. B. Notification of pre-computed repair paths, and anticipated traffic patterns. C. Counts of failure detections, protection invocations, and packets forwarded over repair paths. D. Testing repairs.
7. Security Considerations 🔐
okay bestie, this is the serious part, so listen up 🫶 this framework document does not itself introduce any security issues. but attention must be paid to the security implications of any proposed solutions to the problem 😭
⚠️ where the chosen solution uses tunnels, it is necessary to ensure the tunnel is not used as an attack vector. one method of addressing this is to use a set of tunnel endpoint addresses that are excluded from use by user traffic. this is not optional vibes, this is a real thing 💀
there's a compatibility issue between IPFRR and reverse path forwarding (RPF) checking 🙈 many of the solutions described in this document result in traffic arriving from a direction that's inconsistent with a standard RPF check. when a network relies on RPF checking for security purposes, an alternative security mechanism will need to be deployed in order to permit IPFRR to be used 🔥
finally, because the repair path will often be a different length than the pre-failure path, security mechanisms that rely on specific Time to Live (TTL) values will be adversely affected 😭💜
8. Acknowledgements 🫶
the authors would like to acknowledge contributions made by Alia Atlas, Clarence Filsfils, Pierre Francois, Joel Halpern, Stefano Previdi, and Alex Zinin 🌟 literally the squad 👑
9. Informative References 📚
[ALT-SP] Tian, A., "Fast Reroute using Alternative Shortest Paths",
Work in Progress, July 2004.
[BFD] Katz, D. and D. Ward, "Bidirectional Forwarding
Detection", Work in Progress, January 2010.
[FIFR] Nelakuditi, S., Lee, S., Lu, Y., Zhang, Z., and C. Chuah,
"Fast Local Rerouting for Handling Transient Link
Failures", IEEE/ACM Transactions on Networking, Vol. 15,
No. 2, DOI 10.1109/TNET.2007.892851, available
from http://www.ieeexplore.ieee.org, April 2007.
[NOTVIA] Shand, M., Bryant, S., and S. Previdi, "IP Fast Reroute
Using Not-via Addresses", Work in Progress, July 2009.
[RFC4090] Pan, P., Swallow, G., and A. Atlas, "Fast Reroute
Extensions to RSVP-TE for LSP Tunnels", RFC 4090,
May 2005.
[RFC5286] Atlas, A. and A. Zinin, "Basic Specification for IP Fast
Reroute: Loop-Free Alternates", RFC 5286, September 2008.
[RFC5715] Shand, M. and S. Bryant, "A Framework for Loop-Free
Convergence", RFC 5715, January 2010.
[SIMULA] Kvalbein, A., Hansen, A., Cicic, T., Gjessing, S., and O.
Lysne, "Fast IP Network Recovery using Multiple Routing
Configurations", Infocom 10.1109/INFOCOM.2006.227,
available from http://www.ieeexplore.ieee.org, April 2006.
[TUNNELS] Bryant, S., Filsfils, C., Previdi, S., and M. Shand, "IP
Fast Reroute using tunnels", Work in Progress,
November 2007.
[UTURN] Atlas, A., "U-turn Alternates for IP/LDP Fast-Reroute",
Work in Progress, February 2006.Authors' Addresses 💌
Mike Shand
Cisco Systems
250, Longwater Avenue.
Reading, Berks RG2 6GB
UK
EMail: mshand@cisco.com
Stewart Bryant
Cisco Systems
250, Longwater Avenue.
Reading, Berks RG2 6GB
UK
EMail: stbryant@cisco.com📦 where this page comes from
- ietf: rfc5714 2010-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms