TI-LFA with Segment Routing: Topology-Free Fast Reroute

2026年9月12日 LOG admin

Classic LFA only works when the topology happens to provide a loop-free alternate. Add a ring, a single-homed node or a pair of links that share a risk group and the repair path disappears — which is why so many operators ended up running RSVP-TE purely for FRR. TI-LFA (Topology-Independent LFA) removes that dependency: it computes a post-convergence path using segment routing labels and, in most topologies, protects every link, node and SRLG without any per-site tuning. This article covers how it works, how to configure it, and how to verify that protection is actually installed.

The idea in one paragraph

When the IGP fails a link, every router in the network already knows the post-convergence shortest path tree. TI-LFA asks a simple question: can I reach a node on that new path using only labels that will not route traffic back through the failed link? It answers with an explicit list of segments — typically a node-SID plus an adjacency-SID — and installs that as a backup route in the forwarding table. The repair path is pre-computed, so the switch happens in the data plane in the same timeframe as any other fast reroute: tens of milliseconds, not seconds.

Why Classic LFA Fails

To appreciate what TI-LFA solves, recall why plain LFA is conditional. LFA looks for a neighbour whose shortest path to the destination does not pass through the router doing the protecting. If that neighbour exists, traffic can be punted to it and the packet still reaches the destination after the failure. The condition is loop-freeness, and it is surprisingly easy to break:

Rings and single-homed stubs. On a ring, a router's only other neighbour forwards back toward the failed link, so its path to the destination does traverse the protected router — no LFA.
Shared risk groups. Two parallel links that ride the same conduit, card, or wavelength cannot protect each other, because an SRLG failure takes both. LFA computes a repair that a real-world failure will also destroy.
Node protection. Even where link protection exists, protecting against the node's failure requires a neighbour whose path avoids the whole router, which is a strictly harder condition and often unsatisfiable.

Operators responded by layering RSVP-TE tunnels purely as repair paths — a second control plane, an extra set of state, and one more thing to keep in sync with the IGP. TI-LFA collapses that back into the IGP by using segment routing to express the repair explicitly, so the alternate does not depend on what the topology happens to offer.

How TI-LFA Builds the Repair Path

The computation is elegant. On detecting the protected resource (a link, a node, or an SRLG), the router computes the post-convergence path — the path it would use once the IGP has fully reconverged. It then finds the closest point on that path that is reachable without traversing the failed resource. Call the set of nodes reachable without crossing the failure the P-space, and the set of nodes that can reach the destination without crossing the failure the Q-space. TI-LFA needs a node in the intersection, plus enough segments to steer traffic to it. In practice that segment list is short:

A single node-SID when the post-convergence next-hop is directly adjacent and loop-free.
A node-SID plus an adjacency-SID when traffic must be pushed through a specific neighbour to avoid the failure — the adjacency-SID forces the packet onto the exact link that leads into the safe part of the topology.
Occasionally a short stack of two or three segments in awkward topologies, which is why hardware support for a few repair labels matters.

Because the segments are absolute (they name specific nodes and links, not "shortest path to X"), the repair does not re-loop after the failure. That is the property plain LFA cannot guarantee.

Configuration (Junos style)

# Enable segment routing with IS-IS
set protocols isis source-packet-routing node-segment ipv4-index 1
set protocols isis level 2 wide-metrics-only

# Enable TI-LFA for all interfaces (and optionally for SRLGs)
set protocols isis backup-spf-options use-post-convergence-lfa
set protocols isis backup-spf-options use-source-packet-routing
set protocols isis interface ge-0/0/0.0 level 2 backup-spf-options use-post-convergence-lfa

# SRLG-aware protection
set routing-options srlg srlg1 srlg-value 100

The equivalent IOS XR pattern is segment-routing mpls plus fast-reroute per-prefix ti-lfa under the IGP, with fast-reroute per-prefix tiebreaker node-protecting index to prefer node protection over link protection. Nokia SR Linux exposes LFA, RLFA and TI-LFA through loopfree-alternate statements under the IGP instance.

Configuration on IOS XR and SR Linux

On IOS XR the same intent is expressed under the IGP instance. Note the tiebreaker ordering: putting node-protecting first makes the router prefer a repair that survives the whole neighbour, not just the link.

! IOS XR: SR-MPLS + TI-LFA under IS-IS
router isis CORE
 address-family ipv4 unicast
  segment-routing mpls
  fast-reroute per-prefix
  fast-reroute per-prefix ti-lfa
  fast-reroute per-prefix tiebreaker node-protecting index
 !
 interface GigabitEthernet0/0/0/0
  point-to-point
  address-family ipv4 unicast
   fast-reroute per-prefix
   fast-reroute per-prefix ti-lfa
 !
!
segment-routing
 global-block 16000 23999
 !

! SR Linux: TI-LFA under the IGP instance
network-instance default
 protocols isis instance 1
  loopfree-alternate
   ti-lfa
    enable
    node-protection true

Two knobs are worth calling out. The global block (or SRGB) on each platform maps the node-SIDs the IGP advertises into the local label space; the values themselves are local, but the mapping must be consistent across the segment routing domain. The tiebreaker order is the difference between "the link came back and traffic survived" and "the whole box died and traffic still survived": node protection is stricter, and you should ask for it explicitly rather than accept whatever the default ordering gives.

Verification: the part people skip

show route table inet.3 10.0.0.1/32 detail
show isis route 10.0.0.1/32 detail     ! look for "Backup"
show route forwarding-table destination 10.0.0.1/32 extensive
show isis backup coverage
show isis backup label-switched-path

Coverage is your KPI: show isis backup coverage tells you the percentage of prefixes with a repair path. Anything below 100 % in a well-designed fabric points at an unprotected stub or an SRLG that TI-LFA cannot bypass.
The backup route must be installed, not just computed — check the forwarding table, because a computed repair path that is not programmed is worth nothing.
Test it for real: shut a transit link during a window and confirm label continuity with traceroute mpls / ping mpls, then confirm the IGP reconverges without a second outage.

On IOS XR the equivalent checks are a text search for the repair path and the CEF entry:

show isis fast-reroute summary
show isis fast-reroute 10.0.0.1/32 detail
show route 10.0.0.1/32 detail     ! look for "Backup Path"
show cef 10.0.0.1/32 detail       ! the repair must be in CEF

Read show isis fast-reroute as a coverage report: it lists how many interfaces, prefixes and nodes have protection and, crucially, which of the three types. A prefix that is link-protected but not node-protected is only half-covered; if the topology allows node protection elsewhere, that gap is the first thing to investigate.

Measuring Real Failover Time

Coverage is a static assertion; failover time is the number that actually keeps you inside the SLA. Reproduce the failure the way it happens in production rather than by typing shutdown:

# Junos: BFD with aggressive timers validates sub-second detection
set protocols bfd 1-hop-minimum-interval 300000
set protocols isis interface ge-0/0/0.0 bfd-liveness-detection minimum-interval 300

# Continuous loss measurement across the switch
ping mpls rsvp 10.0.0.1/32 count 1000 interval 0.01

Unplug the fibre, or disable the physical interface so BFD and the IGP both see a real failure. A soft shutdown can hide the detection path and make failover look faster than it is. The target to design for is under 50 ms of loss for link protection; a well-tuned node-protection scenario lands in the same range, while anything that requires reconvergence will not.

TI-LFA and SRv6

TI-LFA is a segment-routing feature and does not care whether the segments are MPLS labels or SRv6 SIDs. In an SRv6 domain the repair path is expressed as a compressed SID list in the segment routing header instead of an MPLS label stack, but the computation is identical: find the post-convergence path, select the closest reachable node, and encode the repair as an explicit segment list. The operational consequence is that a single fast-reroute design covers both transports, which is one of the quieter arguments for standardising on segment routing. If you are still choosing between the two data planes, the trade-offs are covered in the segment-routing comparison linked below.

Avoiding Micro-Loops During Convergence

Fast reroute and loop-free convergence are two halves of the same problem. The repair path delivers traffic to the destination immediately after a failure, but while the IGP is still reconverging some routers may hold the pre-failure view and forward a packet back toward the failed link — a transient forwarding loop, commonly called a micro-loop. TI-LFA narrows the window because repaired traffic follows an explicit segment list rather than the pre-convergence shortest path, but it does not remove micro-loops for the packets that were never protected in the first place, such as those on an unprotected stub.

Two mechanisms reduce the exposure. Ordered FIB updates delay each router’s new next-hop until its neighbours have converged, which removes the loops at the cost of slightly longer convergence. Segment routing offers a second lever: a node can keep forwarding along the post-convergence path expressed as an explicit segment list even before its own FIB is updated, which is the anti-micro-loop behaviour some vendors surface as an SR-based convergence option. Neither is a prerequisite for the sub-50 ms repair, but both matter when you measure end-to-end convergence rather than the repair alone.

Design notes and limits

TI-LFA requires segment routing (SR-MPLS or SRv6) to be enabled with the IGP; it is not a stand-alone feature. It also cannot protect against every SRLG by itself — if two links in the same SRLG are the only paths to a node, the repair path needs the SRLG configured so the computation knows to avoid both. And protection is only as good as the topology: a single-homed access node has no alternate, no matter what algorithm you run. Check coverage after every topology change, not after every incident.

An Operational Checklist

Enable segment routing and advertise a node-SID on every participating router before you enable TI-LFA — there is nothing to protect until the SIDs exist.
Turn on post-convergence LFA with source-packet-routing repair, then immediately run show isis backup coverage to baseline the number.
Configure SRLGs for links that share physical fate, so the computation avoids both at once.
Verify the repair is in the forwarding table, not just the route table.
Measure failover with a real link failure and BFD timers, not a soft shutdown.
Re-run coverage after every hardware or topology change, and alert on any drop below the baseline.

Get those six steps into your change process and TI-LFA stops being a feature you configured once and quietly lost, and becomes a measured property of the network.