# FRR Node Protection (XR)

Load **mpls.te.frr.init.cfg**

```
#IOS-XE
config replace flash:mpls.te.frr.init.cfg

#IOS-XR
configure
load bootflash:mpls.te.frr.init.cfg
commit replace
y
```

A TE tunnel using the path XRv11 - XRv12 - CSR9 - CSR1 - CSR4 is setup on XRv11. Configure FRR node protection so that if CSR9 goes down, traffic is rerouted around this failure at XR12 and stitched back together at CSR1. Test that the fast reroute works by shutting Gi2 on CSR9 and Gi0/0/0/0.592 on XRv12.

## Answer <a href="#id-92d7c96a-d58a-4b07-ab5e-3e0b3cf4b2e6" id="id-92d7c96a-d58a-4b07-ab5e-3e0b3cf4b2e6"></a>

```
#XRv11
int tunnel-te0
 fast-reroute protect node
 ! or
 fast-reroute

#XRv12
explicit-path name AVOID_CSR9
 index 10 exclude-address ipv4 unicast 9.9.9.9
!
int tunnel-te0
 destination 1.1.1.1
 ip unn lo0
 path-option 1 explicit name AVOID_CSR9
!
mpls traffic-eng
 int GigabitEthernet0/0/0/0.592
  backup-path tunnel-te 0
```

Node protection is very similar to link protection, except the backup tunnel excludes the entire node rather than just a link address. This is sometimes called a NNHOP (next next-hop) tunnel because XRv12 is repairing the path at the next-hop of its own next-hop, which is CSR1.

XRv12 must learn CSR1’s label for the primary path. This happens via RSVP. When XRv12 request fast-reroute for node protection specifically, a label recording option is requested in the PATH message. The RRO in the RESV message contains the label at every single hop. This allows any NNHOP tunnel to be built along the LSP.

Note that requesting node protection specifically does not appear to be necessary. The label recording request happens whether or not node protection is requested. The **node** option, to me, appears to be an interoperability feature to work with non-Cisco devices in the MPLS-TE domain. The **node** option turns on the “node protection requested” flag in the PATH message. But on an IOS-XE or IOS-XR PLR, it does not appear to need this flag in order to provide node protection. The link or node protection designation is simply based on the backup tunnel’s destination.

Just like with link protection, we can see that XRv12 is ready to protect the primary tunnel.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FYYgxiAoocrHP8Qbtk58O%2Fimage.png?alt=media&#x26;token=1a92beab-b093-41f8-aea3-69e3dc902ed1" alt=""><figcaption></figcaption></figure></div>

The backup tunnel is taking the path XRv12-CSR6-CSR1:

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FMh4Jq6SZct8dj7UV0Tqa%2Fimage.png?alt=media&#x26;token=446f53ce-b08a-48ba-91c3-92e76765c8a1" alt=""><figcaption></figcaption></figure></div>

We must bring down both Gi2 on CSR9 and Gi0/0/0/0.592 on XRv12. This is because XRv does not support BFD, nor RSVP Hellos. Once the interfaces are down, we can see the FRR status is “active.” This will stay in place permanently, because the primary path has only an explicit-path that must go through CSR9, which is now down.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FGg3CcWbFCPHonmeNxqWK%2Fimage.png?alt=media&#x26;token=8de36839-936e-4563-aa98-1cd98dd5bc73" alt=""><figcaption></figcaption></figure></div>

We can see at XRv11 it is in “reroute pending” although the tunnel remains up and connected.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FCeXSdcTqh5Kk9rT4X3VR%2Fimage.png?alt=media&#x26;token=a8461cb3-348e-4062-89be-d508df6140f8" alt=""><figcaption></figcaption></figure></div>

If XRv11 finds a new path, the FRR protection would go away on XRv12. On XRv11 we can see that the last error is from XRv12 which signaled a PathErr but that local repair was in place. This allowed XRv11 to try to do make-before-break.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FJA5ALE8nHrFshMP2DZXa%2Fimage.png?alt=media&#x26;token=21f64e9f-1177-4f42-a631-68f51c187432" alt=""><figcaption></figcaption></figure></div>
