MPLS TE Fast Reroute (Auto-Tunnel Backup and SRLG)

MPLS TE Fast Reroute (FRR) works because the router just before a failure, the PLR, has a bypass tunnel ready. Configuring a bypass by hand for every protected link makes the configuration grow with the number of links. IOS XR auto-tunnel backup lets the PLR build bypasses automatically once you name the interfaces to protect. An automatically computed bypass, however, may take a path that fails for the same reason as the link it protects. SRLG (Shared Risk Link Group) is how you avoid that. This article explains the mechanism and uses an IOS XR (XRd) lab to look at the bypasses that auto-tunnel backup builds, and at the outage seen from the CE with and without SRLG exclusion.

PLR and MP, NHOP / NNHOP bypasses, and how facility backup stacks labels are explained in MPLS TE Fast Reroute (Link and Node Protection).

How the Bypass Path Is Chosen

RFC 4090 sets the constraints a PLR applies when it computes a bypass path with CSPF (Section 6.2).

Constraint	Content
Destination	The bypass destination is the MP (MUST)
What to avoid	Do not traverse the protected downstream link or node. If the PLR is the penultimate hop, node protection is not possible and only the link is avoided
SRLG	The path may be computed to be SRLG disjoint from the link or node being avoided
Resources	Satisfy the bandwidth and link attribute requirements of the protected LSP

SRLG disjoint means a path that uses no link or node belonging to the same SRLG as the given link or node (Section 2). Whether to avoid the SRLG is a choice in the PLR’s computation; the protocol does not require it. A PLR that cannot bring up a backup path tries again later (Section 6.2).

Auto-Tunnel Backup

Auto-tunnel backup is an IOS XR feature, not something RFC 4090 defines. It is configured in two places.

Configuration	Where	Meaning
`auto-tunnel backup tunnel-id min 1000 max 1099`	`mpls traffic-eng`	Tunnel number range for automatic bypasses
`auto-tunnel backup`	`mpls traffic-eng / interface X`	Build bypasses for LSPs that leave through this interface

For each protected interface, IOS XR builds these two bypasses.

Bypass	Destination	Name (Signalled-Name)
NHOP	The neighbor	`autob_<PLR>_t<number>_<IF>`
NNHOP	The router after the neighbor	`autob_<PLR>_t<number>_<IF>_<avoided node>`

When both exist, IOS XR uses the NNHOP bypass even for an LSP that asks only for link protection. The NNHOP bypass avoids the neighbor node altogether, so it also covers a link failure. To build only NHOP bypasses, add nhop-only to the interface. A bypass that has no path to its destination without the node it must avoid does not come up.

An automatic bypass has two path options.

Path option	Preference	Used when
`autob_nhop_srlg_te<number>`	10	SRLG exclusion (`exclude srlg`) is configured
`autob_nhop_te<number>`	20	SRLG is not excluded (default)

SRLG

An SRLG is a 32-bit number given to links that fail for the same reason (fiber in the same conduit, the same line card, and so on). OSPF carries it in the Link TLV of the TE Opaque-LSA as sub-TLV 16 (Shared Risk Link Group), a list of the SRLG numbers the link belongs to (RFC 4203 Section 1.3). On IOS XR it is set with srlg / interface X / value 100.

Advertising SRLGs in the IGP does not change the bypass by itself. The PLR computes an SRLG-disjoint path only after auto-tunnel backup exclude srlg is added on its interface.

Option	Behavior (IOS XR help)
`exclude srlg`	SRLG exclusion is mandatory
`exclude srlg preferred`	SRLG exclusion is preferred but not mandatory
`exclude srlg weighted`	Adds cost to links that share an SRLG in the computation

A bypass that does not avoid the SRLG is useless when it fails together with the protected link. The PLR switches, but the bypass is cut further along, so packets do not arrive. The outage then lasts until either the PLR re-signals its bypass or the head-end re-signals the LSP, and which finishes first depends on timing. If the reverse PLR’s bypass fails for the same reason, that direction has to wait for its head-end.

Lab Setup

Two tunnels over the upper row (PE1 → PE2 and PE2 → PE1) use a strict explicit path and request link protection with fast-reroute. CE1 and CE2 connect to the PEs in VRF CUST-A, and PE1 - PE2 run VPNv4 iBGP. Every link has OSPF cost 10.

Router	Lo0	Role
PE1 / PE2	11.11.11.11 / 22.22.22.22	head-end / tail-end
P1	1.1.1.1	PLR for the forward LSP (protects P1 - P2)
P2	2.2.2.2	MP for the forward LSP, PLR for the reverse LSP (protects P2 - P1)
P5	5.5.5.5	End of P2 - P5. P2 - P5 has the same SRLG 100 as P1 - P2
P3 / P4 / P6	3.3.3.3 / 4.4.4.4 / 6.6.6.6	Carry the bypasses
CE1 / CE2	101.101.101.101 / 102.102.102.102	192.168.1.0/24 / 192.168.2.0/24

P1 - P2 and P2 - P5 get the same SRLG 100. P1’s NHOP bypass goes P1 → P4 → P5 → P2 (cost 30) without SRLG exclusion, and P1 → P4 → P5 → P6 → P3 → P2 (cost 50) with it. PE1’s only core link is to P1.

No LDP sessions; the transport is only the tunnels in both directions (the PEs carry just an mpls ldp line so that IOS XR resolves VPN routes over the tunnels)
Failures are made by shutting down all four ends at once, because on CML XRd a one-sided shutdown is not seen by the peer
The outage is measured with a ping from CE1 (count 300 interval 100 timeout 1). Each lost probe waits 1 second, so the number of lost probes is roughly the outage in seconds

Lab Overview

STEP	Operation	What to check
0	Tunnels in both directions, autoroute, `fast-reroute`	No bypass yet. CE reachability
1	`auto-tunnel backup` on P1 and P2	NHOP and NNHOP bypasses are built and P1 uses NNHOP. P2’s NNHOP does not come up
2	`nhop-only` on P1 and P2	NNHOP disappears and NHOP is used
3	SRLG 100 on P1 - P2 and P2 - P5	Sub-TLV 16 in the LSU. The bypass still goes through P5 - P2
4	Shut down P1 - P2 and P2 - P5 together (bypass not avoiding the SRLG)	The bypass is cut too. Outage at the CE and its direction
5	Restore, `exclude srlg` on P1 and P2, reoptimize back to the upper row	The bypass moves to P6 - P3
6	Shut down P1 - P2 and P2 - P5 together (bypass avoiding the SRLG)	Both directions are rerouted. Outage at the CE
7	Remove everything (final state)

Auto-Tunnel Backup (STEP 1 and 2)

Configuration committed on P1 in STEP 1
RP/0/RP0/CPU0:P1#show configuration commit changes last 1
Tue Sep 15 04:00:19.806 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
mpls traffic-eng
 interface GigabitEthernet0/0/0/1
  auto-tunnel backup
  !
 !
 auto-tunnel backup
  tunnel-id min 1000 max 1099
 !
!
end

STEP 1 P1 show mpls traffic-eng tunnels backup
RP/0/RP0/CPU0:P1#show mpls traffic-eng tunnels backup
Tue Sep 15 04:01:49.597 UTC

tunnel-te1000 (auto-tunnel backup)
 Signalled-Name: autob_P1_t1000_Gi0_0_0_1_2.2.2.2
 Admin: up, Oper: up
 Src: 1.1.1.1, Dest: 3.3.3.3, Instance: 2
 Fast Reroute Backup Provided:
  Protected LSPs: 1 (0 active, 0 soft preempted)
  Protected S2L Sharing Families: 0
  Protected S2Ls: 0
  Backup BW: any-class (no limit specified), Inuse: 0 kbps
             soft preempted: 0 kbps
  Protected i/fs: Gi0/0/0/1
tunnel-te1001 (auto-tunnel backup)
 Signalled-Name: autob_P1_t1001_Gi0_0_0_1
 Admin: up, Oper: up
 Src: 1.1.1.1, Dest: 2.2.2.2, Instance: 2
 Fast Reroute Backup Provided:
  Protected LSPs: 0 (0 active, 0 soft preempted)
  Protected S2L Sharing Families: 0
  Protected S2Ls: 0
  Backup BW: any-class (no limit specified), Inuse: 0 kbps
             soft preempted: 0 kbps
  Protected i/fs: Gi0/0/0/1

tunnel-te1000 is the NNHOP bypass (to 3.3.3.3, avoiding P2) and tunnel-te1001 is the NHOP bypass (to 2.2.2.2). The one protecting the LSP is tunnel-te1000.

STEP 1 P1 show mpls traffic-eng tunnels summary (excerpt)
AutoTunnel Backup Summary:
    AutoTunnel Backups:
             2 created, 2 up, 0 down, 1 unused
             1 NHOP, 1 NNHOP, 0 SRLG strict, 0 SRLG preferred, 0 SRLG weighted, 0 BW protected
    Protected LSPs:
             0 NHOP, 0 NHOP+SRLG, 0 NHOP+BW, 0 NHOP+BW+SRLG
             1 NNHOP, 0 NNHOP+SRLG, 0 NNHOP+BW, 0 NNHOP+BW+SRLG

STEP 1 P1 show mpls traffic-eng fast-reroute database
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database
Tue Sep 15 04:01:49.178 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [3]                24002    Gi0/0/0/1:24002    tt1000:24002       Ready  

No.6 between P1 and P4 is the Path of the NNHOP bypass.

STEP 1 No.6 PATH (P1 to P4, tshark -V excerpt)
Internet Protocol Version 4, Src: 1.1.1.1, Dst: 3.3.3.3
        Message Type: PATH Message.  (1)
    SESSION: IPv4-LSP, Destination 3.3.3.3, Short Call ID 0, Tunnel ID 1000, Ext ID 1010101. 
    EXPLICIT ROUTE: IPv4 10.1.4.4, IPv4 10.4.5.5, IPv4 10.5.6.6, ...
        IPv4 Subobject - 10.1.4.4, Strict
        IPv4 Subobject - 10.4.5.5, Strict
        IPv4 Subobject - 10.5.6.6, Strict
        IPv4 Subobject - 10.3.6.3, Strict
        IPv4 Subobject - 3.3.3.3, Strict
    SESSION ATTRIBUTE: SetupPrio 7, HoldPrio 7, SE Style,  [autob_P1_t1000_Gi0_0_0_1_2.2.2.2]
        Flags: 0x04
            .... ...0 = Local protection: Not Desired
            .... ..0. = Label recording: Not Desired
            .... .1.. = SE style: Desired
            .... 0... = Bandwidth protection: Not Desired
            ...0 .... = Node protection: Not Desired
        Name: autob_P1_t1000_Gi0_0_0_1_2.2.2.2

Download the pcap of the packet in the tshark output above (No.6 PATH)

The explicit route goes to P3 without passing P2, and the name ends with the avoided node (2.2.2.2). The flags are only 0x04 (SE Style); the bypass itself does not ask for protection.

P2 is the PLR for the reverse direction. P2’s NNHOP bypass has to reach PE1 without passing P1, and PE1 has no path that avoids P1.

STEP 1 P2 show mpls traffic-eng tunnels backup
RP/0/RP0/CPU0:P2#show mpls traffic-eng tunnels backup
Tue Sep 15 04:02:11.149 UTC

tunnel-te1000 (auto-tunnel backup)
 Signalled-Name: 
 Admin: up, Oper: down
 Src: 0.0.0.0, Dest: 11.11.11.11
 Fast Reroute Backup Provided:
  Protected LSPs: 0 (0 active, 0 soft preempted)
  Protected S2L Sharing Families: 0
  Protected S2Ls: 0
  Backup BW: any-class (no limit specified), Inuse: 0 kbps
             soft preempted: 0 kbps
  Protected i/fs: Gi0/0/0/0
tunnel-te1001 (auto-tunnel backup)
 Signalled-Name: autob_P2_t1001_Gi0_0_0_0
 Admin: up, Oper: up
 Src: 2.2.2.2, Dest: 1.1.1.1, Instance: 2
 Fast Reroute Backup Provided:
  Protected LSPs: 1 (0 active, 0 soft preempted)
  Protected S2L Sharing Families: 0
  Protected S2Ls: 0
  Backup BW: any-class (no limit specified), Inuse: 0 kbps
             soft preempted: 0 kbps
  Protected i/fs: Gi0/0/0/0

The NNHOP tunnel-te1000 does not come up, and the NHOP tunnel-te1001 protects the LSP. In STEP 2, nhop-only was added.

Configuration committed on P1 in STEP 2
RP/0/RP0/CPU0:P1#show configuration commit changes last 1
Tue Sep 15 04:07:52.301 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
mpls traffic-eng
 interface GigabitEthernet0/0/0/1
  auto-tunnel backup
   nhop-only
  !
 !
!
end

STEP 2 P1 show mpls traffic-eng tunnels backup
RP/0/RP0/CPU0:P1#show mpls traffic-eng tunnels backup
Tue Sep 15 04:08:50.929 UTC

tunnel-te1001 (auto-tunnel backup)
 Signalled-Name: autob_P1_t1001_Gi0_0_0_1
 Admin: up, Oper: up
 Src: 1.1.1.1, Dest: 2.2.2.2, Instance: 2
 Fast Reroute Backup Provided:
  Protected LSPs: 1 (0 active, 0 soft preempted)
  Protected S2L Sharing Families: 0
  Protected S2Ls: 0
  Backup BW: any-class (no limit specified), Inuse: 0 kbps
             soft preempted: 0 kbps
  Protected i/fs: Gi0/0/0/1

STEP 2 P1 show mpls traffic-eng fast-reroute database
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database
Tue Sep 15 04:08:50.441 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [3]                24002    Gi0/0/0/1:24002    tt1001:24002       Ready  

The NNHOP bypass was removed with a PathTear (No.6 between P1 and P4).

STEP 2 No.6 PATH TEAR (P1 to P4, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.4.1, Dst: 10.1.4.4
        Message Type: BUNDLE Message.  (12)
            Message Type: PATH TEAR Message.  (5)
        SESSION: IPv4-LSP, Destination 3.3.3.3, Short Call ID 0, Tunnel ID 1000, Ext ID 1010101. 
        SENDER TEMPLATE: IPv4-LSP, Tunnel Source: 1.1.1.1, Short Call ID: 0, LSP ID: 2. 

Download the pcap of the packet in the tshark output above (No.6 PATH TEAR)

SRLG (STEP 3)

Configuration committed on P2 in STEP 3
RP/0/RP0/CPU0:P2#show configuration commit changes last 1
Tue Sep 15 04:14:51.249 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
srlg
 interface GigabitEthernet0/0/0/0
  8 value 100
 !
 interface GigabitEthernet0/0/0/2
  8 value 100
 !
!
end

This is the LSU that P1 sent with the Link TLV for P1 - P2 (No.7 between P1 and P2).

STEP 3 No.7 LS UPDATE (P1 to 224.0.0.5, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.2.1, Dst: 224.0.0.5
        Message Type: LS Update (4)
            LS Type: Opaque LSA, Area-local scope (10)
            Advertising Router: 1.1.1.1
                Link Information
                    Link Type: 1 - Point-to-point
                    Link ID: 2.2.2.2
                    Local Interface IP Address: 10.1.2.1
                    Remote Interface IP Address: 10.1.2.2
                    Shared Risk Link Group
                        TLV Type: 16: Shared Risk Link Group
                        Shared Risk Link Group: 100

Download the pcap of the packet in the tshark output above (No.7 LS UPDATE)

STEP 3 P1 show ospf database opaque-area (excerpt)
  Link State ID: 1.0.0.3
  Opaque Type: 1
  Opaque ID: 3
  Advertising Router: 1.1.1.1
  LS Seq Number: 80000003
  Checksum: 0x61bf
  Length: 212

    Link connected to Point-to-Point network
      Link ID : 2.2.2.2
      (all bandwidths in bytes/sec)
      Interface Address : 10.1.2.1
      Neighbor Address : 10.1.2.2
      Admin Metric : 10
      Maximum bandwidth : 125000000
      Maximum reservable bandwidth global: 125000000
      Number of Priority : 8
      Priority 0 :            125000000  Priority 1 :            125000000
      Priority 2 :            125000000  Priority 3 :            125000000
      Priority 4 :            125000000  Priority 5 :            125000000
      Priority 6 :            125000000  Priority 7 :            125000000
      Affinity Bit : 0
      IGP Metric : 10
      GMPLS Shared Risked Link Group : Length: 4
        Number of SRLGs (1)
        [1]: 100

The SRLG is advertised, but the bypass does not change.

STEP 3 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
Name: tunnel-te1001  Destination: 2.2.2.2  Ifhandle:0x34 (auto-tunnel backup)
  Signalled-Name: autob_P1_t1001_Gi0_0_0_1
  Status:
    Admin:    up Oper:   up   Path:  valid   Signalling: connected

    path option (autob_nhop_te1001), preference 20,  type explicit (autob_nhop_te1001) (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000 
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000 
    path option (autob_nhop_srlg_te1001), preference 10,  type explicit (autob_nhop_srlg_te1001) [disabled]

STEP 3 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
  Path info (OSPF 1 area 0):
  Hop0: 10.1.4.4
  Hop1: 10.4.5.5
  Hop2: 10.2.5.2
  Hop3: 2.2.2.2

The path in use is autob_nhop_te1001 (cost 30), and the SRLG-aware autob_nhop_srlg_te1001 is [disabled]. The path goes P5 → P2, over a link with the same SRLG 100 as the protected P1 - P2.

Double Failure with a Bypass That Does Not Avoid the SRLG (STEP 4)

STEP 4 CE1 ping 192.168.2.1 (300 probes across the double failure)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 300 interval 100 timeout 1

Tue Sep 15 04:22:08.902 UTC
Type escape sequence to abort.
Sending 300, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!................!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 94 percent (284/300), round-trip min/avg/max = 18/30/150 ms

16 probes were lost. Splitting the capture by direction shows that P1 forwarded all 300 requests and that all 16 lost probes were replies on the return path.

STEP 4 P1 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database

Tue Sep 15 04:22:25.417 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [3]                24002    tt1001:24002                          Active 

STEP 4 P1 show mpls traffic-eng tunnels protection (right after the failure, excerpt)
PE1_t0 Tunnel Id: 0 
  LSP Midpoint, signaled, connection up
  Src: 11.11.11.11, Dest: 22.22.22.22, Instance: 3
  Fast Reroute Protection: Requested
    Inbound: FRR Inactive
     LSP signalling info:
      Original: in i/f: GigabitEthernet0/0/0/0, label:  24002, phop: 10.1.11.11
    Outbound: FRR Active
     Backup tunnel-te1001 to LSP nhop
      tunnel-te1001: out i/f: GigabitEthernet0/0/0/2
     LSP signalling info:
      Original: out i/f: GigabitEthernet0/0/0/1, label:  24002, nhop: 10.1.2.2
      With FRR: out i/f: tunnel-te1001, label:  24002
     LSP bw: 0 kbps, Backup level: any-class unlimited, type: CT0 

P1 switched over, but P5 - P2 beyond tunnel-te1001 is also down.

STEP 4 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
Name: tunnel-te1001  Destination: 2.2.2.2  Ifhandle:0x34 (auto-tunnel backup)
  Signalled-Name: autob_P1_t1001_Gi0_0_0_1
  Status:
    Admin:    up Oper:   up   Path:  valid   Signalling: connected

    path option (autob_nhop_te1001), preference 20,  type explicit (autob_nhop_te1001) (Basis for Setup, path weight 50)
      Accumulative metrics: TE 50 IGP 50 Delay 1500000 
      Accumulative biased metrics: TE 50 IGP 50 Delay 1500000 
    Last Signalled Error : Tue Sep 15 04:22:20 2026
      Info: [2] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.2.5.5
    path option (autob_nhop_srlg_te1001), preference 10,  type explicit (autob_nhop_srlg_te1001) [disabled]

STEP 4 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
  History:
    Tunnel has been up for: 00:01:34 (since Tue Sep 15 04:22:20 UTC 2026)
    Current LSP:
      Uptime: 00:01:34 (since Tue Sep 15 04:22:20 UTC 2026)
    Prior LSP:
      ID: 2 Path Option: 20
      Removal Trigger: path error

STEP 4 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
  Path info (OSPF 1 area 0):
  Hop0: 10.1.4.4
  Hop1: 10.4.5.5
  Hop2: 10.5.6.6
  Hop3: 10.3.6.3
  Hop4: 10.2.3.2
  Hop5: 2.2.2.2

After a PathErr(24,5) from P5 (10.2.5.5), P1 re-signalled the bypass through P6 - P3 at 04:22:20. Forward packets used this new bypass (No.21 between P6 and P3).

STEP 4 No.21 ICMP Echo request (P6 to P3, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24000, Exp: 0, S: 0, TTL: 250
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.21 Echo request)

The middle label 24002 is P2’s label. The packet goes back from P3 to P2 and joins the upper row at P2. P2, the PLR for the reverse direction, has no usable bypass.

STEP 4 P2 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P2#show mpls traffic-eng fast-reroute database

Tue Sep 15 04:22:28.757 UTC

STEP 4 PE2 show mpls traffic-eng tunnels (excerpt)
  History:
    Tunnel has been up for: 00:04:25 (since Tue Sep 15 04:22:20 UTC 2026)
    Current LSP:
      Uptime: 00:04:25 (since Tue Sep 15 04:22:20 UTC 2026)
    Prior LSP:
      ID: 3 Path Option: 10
      Removal Trigger: path error

PE2’s tunnel restarted Tunnel has been up for at 04:22:20; it went down and was signalled again. Replies did not arrive until that re-signalling finished.

Bypass That Avoids the SRLG (STEP 5 and 6)

Configuration committed on P1 in STEP 5
RP/0/RP0/CPU0:P1#show configuration commit changes last 1
Tue Sep 15 04:32:24.870 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
mpls traffic-eng
 interface GigabitEthernet0/0/0/1
  auto-tunnel backup
   exclude srlg
  !
 !
!
end

STEP 5 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
Name: tunnel-te1001  Destination: 2.2.2.2  Ifhandle:0x34 (auto-tunnel backup)
  Signalled-Name: autob_P1_t1001_Gi0_0_0_1
  Status:
    Admin:    up Oper:   up   Path:  valid   Signalling: connected

    path option (autob_nhop_srlg_te1001), preference 10,  type explicit (autob_nhop_srlg_te1001) (Basis for Setup, path weight 50)
      Accumulative metrics: TE 50 IGP 50 Delay 1500000 
      Accumulative biased metrics: TE 50 IGP 50 Delay 1500000 
    path option (autob_nhop_te1001), preference 20,  type explicit (autob_nhop_te1001) [disabled]

STEP 5 P1 show mpls traffic-eng tunnels (tunnel-te1001, excerpt)
  Path info (OSPF 1 area 0):
  Hop0: 10.1.4.4
  Hop1: 10.4.5.5
  Hop2: 10.5.6.6
  Hop3: 10.3.6.3
  Hop4: 10.2.3.2
  Hop5: 2.2.2.2

STEP 5 P1 show mpls traffic-eng fast-reroute database
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database
Tue Sep 15 04:34:44.278 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [5]                24002    Gi0/0/0/1:24002    tt1001:24002       Ready  

autob_nhop_srlg_te1001 (cost 50) is used, and the path is now P6 → P3 → P2. P2’s bypass takes the mirror-image path to P1. In STEP 6, the same two links as in STEP 4 were shut down together.

STEP 6 CE1 ping 192.168.2.1 (300 probes across the double failure)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 300 interval 100 timeout 1

Tue Sep 15 04:40:53.468 UTC
Type escape sequence to abort.
Sending 300, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (299/300), round-trip min/avg/max = 18/42/182 ms

Only 1 probe was lost. It was a reply on the return path that was in flight at the moment of the failure; P1 forwarded all 300 requests.

STEP 6 P1 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database

Tue Sep 15 04:41:10.683 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [5]                24002    tt1001:24002                          Active 

STEP 6 P2 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P2#show mpls traffic-eng fast-reroute database

Tue Sep 15 04:41:14.223 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
22.22.22.22 0 [5]                24003    tt1001:24003                          Active 

STEP 6 P1 show mpls traffic-eng fast-reroute log
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute log
Tue Sep 15 04:42:38.313 UTC

Location Protected              When                   Switching Time
         Interface                                         (usec)    
-------- ---------------------- ---------------------- --------------
0/RP0/CPU0 Gi0/0/0/1              Sep 15 03:06:40.201019        0
0/RP0/CPU0 Gi0/0/0/1              Sep 15 03:32:03.823695    41000
0/RP0/CPU0 Gi0/0/0/1              Sep 15 04:22:20.522406        0
0/RP0/CPU0 Gi0/0/0/1              Sep 15 04:41:05.166629     1000

STEP 6 P2 show mpls traffic-eng fast-reroute log
RP/0/RP0/CPU0:P2#show mpls traffic-eng fast-reroute log
Tue Sep 15 04:42:59.482 UTC

Location Protected              When                   Switching Time
         Interface                                         (usec)    
-------- ---------------------- ---------------------- --------------
0/RP0/CPU0 Gi0/0/0/0              Sep 15 03:06:40.087167        0
0/RP0/CPU0 Gi0/0/0/0              Sep 15 03:32:03.260112        0
0/RP0/CPU0 Gi0/0/0/0              Sep 15 04:22:20.357922        0
0/RP0/CPU0 Gi0/0/0/0              Sep 15 04:41:05.054282        0

The PLRs for both directions switched at 04:41:05 (the 04:22:20 line is STEP 4, and the two lines before it are switchovers on the same interface before STEP 0). These are a forward request on the bypass (No.18 between P1 and P4) and a reply (No.18 between P3 and P6).

STEP 6 No.18 ICMP Echo request (P1 to P4, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24006, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.18 Echo request)

STEP 6 No.18 ICMP Echo reply (P3 to P6, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24001, Exp: 0, S: 0, TTL: 251
MultiProtocol Label Switching Header, Label: 24003, Exp: 0, S: 0, TTL: 252
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.2.1, Dst: 192.168.1.1
    Type: Echo (ping) reply (0)

Download the pcap of the packet in the tshark output above (No.18 Echo reply)

Both carry 3 labels, and the middle one is the MP’s label (P2’s 24002 forward, P1’s 24003 on the return).

STEP 6 PE2 show mpls traffic-eng tunnels (excerpt)
  History:
    Tunnel has been up for: 00:23:07 (since Tue Sep 15 04:22:20 UTC 2026)
    Current LSP:
      Uptime: 00:04:22 (since Tue Sep 15 04:41:05 UTC 2026)
    Reopt. LSP:
      Last Failure:
        LSP not signalled, identical to the [CURRENT] LSP
        Date/Time: Tue Sep 15 04:28:39 UTC 2026 [00:16:48 ago]
    Prior LSP:
      ID: 5 Path Option: 10
      Removal Trigger: reoptimization completed

PE2’s tunnel still counts from 04:22:20, and the new LSP replaced the old one with reoptimization completed.

Results by STEP

STEP	P1’s bypass	CE1 → CE2	Lost packets	Tunnel
4	Does not avoid the SRLG (via P5 - P2)	284/300	16 replies on the return path (forward was protected by the re-signalled bypass)	Forward stayed up; return (PE2) went down and was signalled again
6	Avoids the SRLG (via P6 - P3)	299/300	1 reply on the return path at the moment of the failure	Both directions stayed up

XRd forwards in software, so the outage lengths are reference values. The forward direction in STEP 4 was saved by the PLR’s re-signalling because of this lab’s timing; if that re-signalling is late, the forward direction also stops until the head-end re-signals.

Design Notes

Advertising SRLGs in the IGP is not enough. The PLR that computes the bypass needs exclude srlg
exclude srlg without a keyword is mandatory, and preferred is not (IOS XR help). Choose between them with that in mind if some part of the network has no SRLG-disjoint path
Assign SRLG numbers to what actually fails together (the same conduit, the same transmission equipment, the same line card). A link without an SRLG cannot be avoided by the computation
Auto-tunnel backup builds NNHOP bypasses by default. If link protection is enough, nhop-only reduces the number of bypasses

Verification Config and show Output

In each STEP, the following file types were collected from all 10 routers, one file per router. The verification config is the ..._run.txt file (the final state is the one from the last STEP).

File	Contents
`..._show.txt`	`show version` / `show route` / `show ospf database opaque-area` / `show mpls traffic-eng tunnels` family / `show mpls traffic-eng fast-reroute database` and `log` / `show mpls traffic-eng tunnels backup` and `protection` / `show mpls forwarding detail` / `show rsvp` family / VPN show commands and more
`..._log.txt`	`show logging` limited to that STEP
`..._run.txt`	`show running-config` at that STEP (the verification config for that STEP)
`..._ping.txt`	That STEP’s `ping` (50 probes, timeout 1 second) and `traceroute`
`..._oam.txt`	`ping` / `traceroute mpls traffic-eng tunnel-te 0` (PE1 and PE2)
`..._trace.txt`	`show mpls traffic-eng trace head-end` / `link` / `bselect` and `show rsvp trace signalling` (8 core routers)
`..._commit.cfg`	Only the configuration actually committed in that STEP, for the routers whose configuration changed. P1 and P2 in STEP 5, and P1, P2 and P5 in STEP 7, committed twice, so only the second commit remains
`..._failping.txt`	CE1’s ping across the failure in STEP 4 and 6
`..._debug.txt`	`show` output taken right after the failure and before and after reoptimization
`.pcap`	That STEP’s capture (PE1 - P1 / P1 - P2 / P1 - P4 / P2 - P5 / P3 - P6)

STEP 0: Tunnels in both directions, autoroute, fast-reroute

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	-
P2	show	log	run	-	-	trace	-
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

STEP 1: auto-tunnel backup on P1 and P2

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

STEP 2: nhop-only on P1 and P2

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

STEP 3: SRLG 100 on P1 - P2 and P2 - P5

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	cfg
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

STEP 4: Shut down P1 - P2 and P2 - P5 together (bypass not avoiding the SRLG)

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	cfg
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: CE1 failping / PE1 debug / P1 debug / P2 debug

STEP 5: Restore, exclude srlg on P1 and P2, reoptimize back to the upper row

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	cfg
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: PE1 debug / PE2 debug

STEP 6: Shut down P1 - P2 and P2 - P5 together (bypass avoiding the SRLG)

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	cfg
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: CE1 failping / PE1 debug / P1 debug / P2 debug

STEP 7: Remove everything (final state)

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	cfg
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

Packet captures were taken per STEP on the following five links.

STEP	PE1 - P1	P1 - P2	P1 - P4	P2 - P5	P3 - P6
0	pcap	pcap	pcap	pcap	pcap
1	pcap	pcap	pcap	pcap	pcap
2	pcap	pcap	pcap	pcap	pcap
3	pcap	pcap	pcap	pcap	pcap
4	pcap	pcap	pcap	pcap	pcap
5	pcap	pcap	pcap	pcap	pcap
6	pcap	pcap	pcap	pcap	pcap
7	pcap	pcap	pcap	pcap	pcap

References

Source	Sections referred to
RFC 4090 Fast Reroute Extensions to RSVP-TE for LSP Tunnels	Section 2 (SRLG disjoint), Section 6.2 (backup path computation, no node protection at the penultimate hop, the path may be SRLG disjoint)
RFC 4203 OSPF Extensions in Support of Generalized Multi-Protocol Label Switching (GMPLS)	Section 1.3 (Link TLV sub-TLV 16, Shared Risk Link Group)

The behavior of auto-tunnel backup (which bypasses it builds, using NNHOP, the path option names) and the exclude srlg options are observations and help output on the test router (XRd 26.1.1).