MPLS TE Fast Reroute (Link and Node Protection)

When a link or node along an MPLS TE tunnel fails, the head-end signals the tunnel again over another path. Until that finishes, traffic does not flow. FRR (Fast Reroute) lets the router just before the failure switch immediately to a bypass it has prepared, and keeps forwarding without waiting for the head-end (RFC 4090). This article explains how it works, then uses an IOS XR (XRd) lab to look at the labels on L3VPN packets while they are rerouted, and at the outage seen from the CE.

The basics of tunnels and explicit paths are covered in What Is MPLS TE (RSVP-TE).

PLR and MP

Term	Meaning (RFC 4090 section 2)
PLR (Point of Local Repair)	Entry of the bypass. Sits just before the failure and switches traffic onto the bypass
MP (Merge Point)	Exit of the bypass. Rejoins the protected LSP
NHOP bypass	Avoids the next link. Protects against a link failure
NNHOP bypass	Avoids the next node and rejoins at the node after it. Protects against a node failure

Protection needs configuration in two places. The head-end requests protection for the tunnel, and routers along the path prepare bypasses as PLRs. RFC 4090 requires every LSR on a protected LSP except the egress to follow the PLR behavior (section 6).

One-to-one and facility

Method	Backup	Section
One-to-one backup	A separate backup LSP (detour) for each protected LSP	3.1
Facility backup	One bypass tunnel protects every LSP that crosses the same link or node	3.2

Facility backup uses the MPLS label stack. The PLR swaps the label for one that the MP understands as the protected LSP, then pushes the bypass tunnel’s label on top (section 3.2). A rerouted packet carries one more label. IOS XR supports facility backup, and fast-reroute on a tunnel has no detour option.

Requesting protection and the RRO flags

The head-end requests protection with flags in the SESSION_ATTRIBUTE of the Path message (section 4.3).

Flag	Value	Meaning
Local protection desired	0x01	Asks for FRR
Label recording desired	0x02	Asks every LSR to record the label it receives in the RRO
Node protection desired	0x10	Asks for node protection

RFC 4090 requires the head-end to “either set the local protection desired flag or include a FAST_REROUTE object, or both”, and to set label recording desired for LSPs requesting local protection (section 5, both MUST). IOS XR requests protection with the flags only and does not use the FAST_REROUTE object. The PLR learns the label that the MP assigned to the protected LSP from the labels recorded in the RRO.

The PLR reports its state in its own subobject of the RRO returned in Resv (sections 4.4 and 6).

Flag	Value	Condition
Local protection available	0x01	A backup path is available (MUST)
Local protection in use	0x02	Traffic is actually being sent into the backup
Node protection	0x08	The backup also protects against a failure of the next node (SHOULD)

When node protection is requested, the PLR first tries node protection, and then link protection if that is not feasible (section 6). If an interface has both an NHOP and an NNHOP bypass, an LSP requesting node protection uses the NNHOP bypass.

Labels while rerouted

In the lab topology below, a VPN packet from CE1 to CE2 carries these labels.

Link	Normal	Rerouted over NHOP	Rerouted over NNHOP
PE1 - P1	2 (tunnel + VPN)	2	2
P1 - P4	-	3 (bypass + P2’s label + VPN)	3 (bypass + P3’s label + VPN)
Last link of the bypass	-	2 (P5 - P2)	2 (P6 - P3)
P3 - PE2	1 (VPN)	1	1

The bypass label is removed one hop before the MP (PHP), and the MP receives the protected LSP’s label and forwards the packet as usual (section 3.2).

Notifying the head-end and re-signalling

The rerouted path is not necessarily optimal. The PLR sends a PathErr (Error Code 25 Notify, value 3 Tunnel locally repaired) to the head-end (section 6.5.1, SHOULD), and the head-end signals the LSP again over a better path. Because traffic keeps flowing over the bypass, the head-end can bring up the new LSP before removing the old one (make-before-break). The tunnel does not go down. Until the new LSP is in place, traffic keeps using the bypass.

Without FRR, a transit router returns PathErr(24,5), or the head-end decides the explicit path can no longer be used, and the tunnel goes down before it is signalled again. The VPN has no forwarding path in the meantime.

How a failure is detected is outside the scope of RFC 4090 (link down, BFD and so on are left to the implementation).

Lab topology

Two tunnels (PE1 to PE2 and PE2 to PE1) follow the upper row as strict explicit paths, and autoroute announce points the route to the remote PE’s loopback at the tunnel. CE1 and CE2 attach to the PEs through VRF CUST-A, and PE1 - PE2 is a VPNv4 iBGP session. Every link has OSPF cost 10.

Router	Lo0	Role
PE1 / PE2	11.11.11.11 / 22.22.22.22	head-end / tail-end
P1	1.1.1.1	PLR for the forward LSP
P2	2.2.2.2	MP of the forward NHOP bypass, PLR for the reverse LSP (link protection)
P3	3.3.3.3	MP of the forward NNHOP bypass, PLR for the reverse LSP (node protection)
P4 / P5 / P6	4.4.4.4 / 5.5.5.5 / 6.6.6.6	Carry the bypasses
CE1 / CE2	101.101.101.101 / 102.102.102.102	192.168.1.0/24 / 192.168.2.0/24

No LDP sessions are used. Transport is the two tunnels only. However, IOS XR does not resolve VPN routes over a tunnel without an mpls ldp line, so the PEs have only mpls ldp (no interfaces)
Failures are created by shutting down both ends at the same time. On CML’s XRd, a shutdown on one side is not seen by the other side, so the PLR side is shut down as well to put the PLR in the state of having detected the failure
The outage is measured with a ping from CE1 (count 300 interval 100 timeout 1). While there is no reply each probe waits 1 second, so the number of lost probes is roughly the outage in seconds

Overview of the test

STEP	Change	What it shows
0	Tunnels in both directions (upper row as strict = 10, dynamic = 20) and autoroute	CE reachability. VPN packets carry 2 labels
1	Shut down P1 - P2 on both ends without FRR	The tunnel goes down and is signalled again. Outage at the CE
2	Restore, add `fast-reroute` to both tunnels, reoptimize back to the upper row	SESSION_ATTRIBUTE flags
3	NHOP bypasses and `backup-path` on P1 and P2	FRR database Ready, RRO flags and recorded labels
4	Shut down P1 - P2 on both ends	3 labels on the bypass, PathErr(25,3), the tunnel stays up. Outage at the CE
5	Restore and reoptimize back to the upper row	The FRR database returns to Ready
6	`fast-reroute protect node` and NNHOP bypasses on P1 and P3	The NNHOP bypass is used, Node protection in the RRO
7	P2 failure (all P2 interfaces plus the P1 and P3 sides shut down)	The third label is the MP’s (P3) label. Outage at the CE
8	Remove everything (final state)

Link failure without FRR (STEP 0 and 1)

Configuration committed on PE1 in STEP 0
RP/0/RP0/CPU0:PE1#show configuration commit changes last 1
Tue Sep 15 02:33:59.900 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
explicit-path name UPPER
 index 10 next-address strict ipv4 unicast 10.1.11.1
 index 20 next-address strict ipv4 unicast 10.1.2.2
 index 30 next-address strict ipv4 unicast 10.2.3.3
 index 40 next-address strict ipv4 unicast 10.3.22.22
!
interface tunnel-te0
 ipv4 unnumbered Loopback0
 autoroute announce
 !
 destination 22.22.22.22
 record-route
 path-option 10 explicit name UPPER
 path-option 20 dynamic
!
end

STEP 0 CE1 traceroute 192.168.2.1
RP/0/RP0/CPU0:CE1#traceroute 192.168.2.1 source 192.168.1.1
Tue Sep 15 02:39:10.973 UTC

Type escape sequence to abort.
Tracing the route to 192.168.2.1

 1  10.11.101.11 23 msec  4 msec  4 msec 
 2  10.1.11.1 [MPLS: Labels 24000/24015 Exp 0] 19 msec  16 msec  39 msec 
 3  10.1.2.2 [MPLS: Labels 24000/24015 Exp 0] 19 msec  18 msec  19 msec 
 4  10.2.3.3 [MPLS: Labels 24000/24015 Exp 0] 19 msec  21 msec  19 msec 
 5  10.3.22.22 [MPLS: Label 24015 Exp 0] 21 msec  21 msec  19 msec 
 6  10.22.102.102 33 msec  *  20 msec 

From P1 to P3 the packet carries the tunnel and VPN labels, P3 removes the tunnel label, and PE2 receives only the VPN label. No.377 between PE1 and P1 is CE1’s echo request.

STEP 0 No.377 ICMP Echo request (PE1 to P1, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24000, Exp: 0, S: 0, TTL: 254
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.377 Echo request)

In STEP 1, P1 - P2 was shut down on both ends with no FRR configured.

STEP 1 CE1 ping 192.168.2.1 (300 probes across the link failure)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 300 interval 100 timeout 1

Tue Sep 15 02:41:52.000 UTC
Type escape sequence to abort.
Sending 300, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!................!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 94 percent (284/300), round-trip min/avg/max = 16/29/148 ms

16 probes were lost (about 16 seconds).

STEP 1 PE2 show mpls traffic-eng tunnels (excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 60)
      Accumulative metrics: TE 60 IGP 60 Delay 1800000 
      Accumulative biased metrics: TE 60 IGP 60 Delay 1800000 
    path option 10,  type explicit UPPER
    Last PCALC Error: Tue Sep 15 02:42:03 2026
      Info: No path to destination, 11.11.11.11 (holdown)
    Last Signalled Error : Tue Sep 15 02:42:03 2026
      Info: [3] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.1.2.2

STEP 1 PE2 show mpls traffic-eng tunnels (excerpt)
  History:
    Tunnel has been up for: 00:04:20 (since Tue Sep 15 02:42:03 UTC 2026)
    Current LSP:
      Uptime: 00:04:20 (since Tue Sep 15 02:42:03 UTC 2026)
    Prior LSP:
      ID: 3 Path Option: 10
      Removal Trigger: path error

P2 (10.1.2.2) returned PathErr(24,5), Tunnel has been up for restarted at 02:42:03, and the tunnel was signalled again over the dynamic path. After that, packets on P1 - P4 still carry 2 labels (No.30).

STEP 1 No.30 ICMP Echo request (P1 to P4, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24000, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.30 Echo request)

Requesting protection and the bypass (STEP 2 and 3)

Configuration committed on PE1 in STEP 2
RP/0/RP0/CPU0:PE1#show configuration commit changes last 1
Tue Sep 15 02:51:10.401 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
interface tunnel-te0
 fast-reroute
!
end

This is the Path after reoptimizing back to the upper row (No.74 between PE1 and P1).

STEP 2 No.74 PATH (PE1 to P1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.11.11, Dst: 10.1.11.1
            Message Type: PATH Message.  (1)
        SESSION ATTRIBUTE: SetupPrio 7, HoldPrio 7, Local Protection, Label Recording, SE Style,  [PE1_t0]
            Flags: 0x07
                .... ...1 = Local protection: Desired
                .... ..1. = Label recording: Desired
                .... .1.. = SE style: Desired
                .... 0... = Bandwidth protection: Not Desired
                ...0 .... = Node protection: Not Desired

Download the pcap of the packet in the tshark output above (No.74 PATH)

Local protection and Label recording are Desired. There is no bypass yet, so nothing is protected.

Configuration committed on P1 in STEP 3
RP/0/RP0/CPU0:P1#show configuration commit changes last 1
Tue Sep 15 02:59:16.470 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
explicit-path name NHOP-P2
 index 10 next-address strict ipv4 unicast 10.1.4.4
 index 20 next-address strict ipv4 unicast 10.4.5.5
 index 30 next-address strict ipv4 unicast 10.2.5.2
!
interface tunnel-te100
 ipv4 unnumbered Loopback0
 destination 2.2.2.2
 path-option 10 explicit name NHOP-P2
!
mpls traffic-eng
 interface GigabitEthernet0/0/0/1
  backup-path tunnel-te 100
 !
!
end

backup-path names tunnel-te100 as the bypass that protects Gi0/0/0/1 (towards P2).

STEP 3 P1 show mpls traffic-eng fast-reroute database
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database
Tue Sep 15 03:00:35.829 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [5]                24002    Gi0/0/0/1:24002    tt100:24002        Ready  

STEP 3 P1 show mpls traffic-eng tunnels protection (excerpt)
PE1_t0 Tunnel Id: 0 
  LSP Midpoint, signaled, connection up
  Src: 11.11.11.11, Dest: 22.22.22.22, Instance: 5
  Fast Reroute Protection: Requested
    Inbound: FRR Inactive
     LSP signalling info:
      Original: in i/f: GigabitEthernet0/0/0/0, label:  24002, phop: 10.1.11.11
    Outbound: FRR Ready
     Backup tunnel-te100 to LSP nhop
      tunnel-te100: out i/f: GigabitEthernet0/0/0/2
     LSP signalling info:
      Original: out i/f: GigabitEthernet0/0/0/1, label:  24002, nhop: 10.1.2.2
      With FRR: out i/f: tunnel-te100, label:  24002
     LSP bw: 0 kbps, Backup level: any-class unlimited, type: CT0 

STEP 3 P1 show mpls forwarding detail (excerpt)
24002  24002       TE: 0              Gi0/0/0/1    10.1.2.2        107         
     Updated: Sep 15 02:59:16.069
     Path Flags: 0x400 [  BKUP-IDX:1 (0x8aa5a0a0) ]
     Version: 17, Priority: 2
     Label Stack (Top -> Bottom): { 24002 }
     NHID: 0x5, Encap-ID: N/A, Path idx: 0, Backup path idx: 1, Weight: 0
     MAC/Encaps: 14/18, MTU: 1500
     Outgoing Interface: GigabitEthernet0/0/0/1 (ifhandle 0x00000010)
     Packets Switched: 2

       24002       TE: 0              tt100        point2point     0            (!)
     Updated: Sep 15 02:59:15.972
     Path Flags: 0x100 [  BKUP, NoFwd ]
     Version: 17, Priority: 2
     Label Stack (Top -> Bottom): { 24002 24002 }
     NHID: 0x0, Encap-ID: N/A, Path idx: 1, Backup path idx: 0, Weight: 0
     MAC/Encaps: 14/22, MTU: 1500
     Outgoing Interface: tunnel-te100 (ifhandle 0x0000001c)
     Packets Switched: 0
     (!): FRR pure backup

The forwarding table now has the backup label stack { 24002 24002 }. The top 24002 is the label of P4, the next hop on the bypass, and the bottom 24002 is the label that the MP (P2) assigned to the protected LSP. The RRO in the Resv that P1 returned to PE1 (No.11) records this label.

STEP 3 No.11 RESV (P1 to PE1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.11.1, Dst: 10.1.11.11
            Message Type: RESV Message.  (2)
        RECORD ROUTE: IPv4 1.1.1.1 (Node-id), Label 24002, IPv4 10.1.11.1, ... (Node-id) (Node-id) (Node-id)
            IPv4 Subobject - 1.1.1.1 (Node-id), Local Protection Available
                Flags: 0x21
                    .... ...1 = Local Protection: Available
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 10.1.11.1, Local Protection Available
                Flags: 0x01
                    .... ...1 = Local Protection: Available
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 2.2.2.2 (Node-id)
                Flags: 0x20
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 10.1.2.2
                Flags: 0x00
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002

Download the pcap of the packet in the tshark output above (No.11 RESV)

P1’s subobject says Local Protection Available, and the label after P2 (2.2.2.2) is 24002.

Link failure with FRR (STEP 4 and 5)

STEP 4 CE1 ping 192.168.2.1 (300 probes across the link failure)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 300 interval 100 timeout 1

Tue Sep 15 03:06:28.413 UTC
Type escape sequence to abort.
Sending 300, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (299/300), round-trip min/avg/max = 15/32/187 ms

Only 1 probe was lost. It was a reply on the return path; P1 forwarded all 300 requests.

STEP 4 P1 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database

Tue Sep 15 03:06:45.151 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [5]                24002    tt100:24002                           Active 

STEP 4 P1 show mpls traffic-eng tunnels protection (right after the failure, excerpt)
PE1_t0 Tunnel Id: 0 
  LSP Midpoint, signaled, connection up
  Src: 11.11.11.11, Dest: 22.22.22.22, Instance: 5
  Fast Reroute Protection: Requested
    Inbound: FRR Inactive
     LSP signalling info:
      Original: in i/f: GigabitEthernet0/0/0/0, label:  24002, phop: 10.1.11.11
    Outbound: FRR Active
     Backup tunnel-te100 to LSP nhop
      tunnel-te100: out i/f: GigabitEthernet0/0/0/2
     LSP signalling info:
      Original: out i/f: GigabitEthernet0/0/0/1, label:  24002, nhop: 10.1.2.2
      With FRR: out i/f: tunnel-te100, label:  24002
     LSP bw: 0 kbps, Backup level: any-class unlimited, type: CT0 

This is CE1’s packet on the bypass (No.16 between P1 and P4).

STEP 4 No.16 ICMP Echo request (P1 to P4, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.16 Echo request)

The packet carries 3 labels. Around the same time, P1 sent a PathErr to PE1 (No.236 between PE1 and P1, 03:06:40.265).

STEP 4 No.236 PATH ERROR (P1 to PE1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.11.1, Dst: 10.1.11.11
            Message Type: PATH ERROR Message.  (3)
        ERROR: IPv4, Error code: RSVP Notify Error, Value: 3, Error Node: 10.1.11.1
            Error node: 10.1.11.1
            Error code: RSVP Notify Error (25)
            Error value: Tunnel locally repaired (3)

Download the pcap of the packet in the tshark output above (No.236 PATH ERROR)

STEP 4 PE1 show mpls traffic-eng tunnels (excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 60)
      Accumulative metrics: TE 60 IGP 60 Delay 1800000 
      Accumulative biased metrics: TE 60 IGP 60 Delay 1800000 
    path option 10,  type explicit UPPER
    Last PCALC Error [Reopt]: Tue Sep 15 03:06:40 2026
      Info: Explicit path has unknown address 10.1.2.2 in OSPF 1 area 0
    Last Signalled Error : Tue Sep 15 03:06:40 2026
      Info: [5] PathErr(25,3)-(Error: notify (25), Suberror: local repair (3)) at 10.1.11.1

STEP 4 PE1 show mpls traffic-eng tunnels (excerpt)
  History:
    Tunnel has been up for: 00:29:29 (since Tue Sep 15 02:42:03 UTC 2026)
    Current LSP:
      Uptime: 00:04:50 (since Tue Sep 15 03:06:42 UTC 2026)
    Reopt. LSP:
      Last Failure:
        LSP not signalled, has no S2Ls
        Date/Time: Tue Sep 15 03:06:40 UTC 2026 [00:04:52 ago]
    Prior LSP:
      ID: 5 Path Option: 10
      Removal Trigger: reoptimization completed

Tunnel has been up for still counts from 02:42:03, and the new LSP replaced the old one with reoptimization completed. In STEP 5 the link was restored and the tunnels were reoptimized back to the upper row (the FRR database returned to Ready).

Node protection (STEP 6 and 7)

Configuration committed on PE1 in STEP 6
RP/0/RP0/CPU0:PE1#show configuration commit changes last 1
Tue Sep 15 03:24:33.311 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
interface tunnel-te0
 fast-reroute protect node
!
end

Configuration committed on P1 in STEP 6
RP/0/RP0/CPU0:P1#show configuration commit changes last 1
Tue Sep 15 03:24:46.377 UTC
!! Building configuration...
!! IOS XR Configuration 26.1.1
explicit-path name NNHOP-P3
 index 10 next-address strict ipv4 unicast 10.1.4.4
 index 20 next-address strict ipv4 unicast 10.4.5.5
 index 30 next-address strict ipv4 unicast 10.5.6.6
 index 40 next-address strict ipv4 unicast 10.3.6.3
!
interface tunnel-te200
 ipv4 unnumbered Loopback0
 destination 3.3.3.3
 path-option 10 explicit name NNHOP-P3
!
mpls traffic-eng
 interface GigabitEthernet0/0/0/1
  backup-path tunnel-te 200
 !
!
end

STEP 6 No.7 PATH (PE1 to P1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.11.11, Dst: 10.1.11.1
            Message Type: PATH Message.  (1)
        SESSION ATTRIBUTE: SetupPrio 7, HoldPrio 7, Local Protection, Label Recording, SE Style, Node Protection,  [PE1_t0]
            Flags: 0x17
                .... ...1 = Local protection: Desired
                .... ..1. = Label recording: Desired
                .... .1.. = SE style: Desired
                .... 0... = Bandwidth protection: Not Desired
                ...1 .... = Node protection: Desired

Download the pcap of the packet in the tshark output above (No.7 PATH)

STEP 6 P1 show mpls traffic-eng tunnels protection (excerpt)
PE1_t0 Tunnel Id: 0 
  LSP Midpoint, signaled, connection up
  Src: 11.11.11.11, Dest: 22.22.22.22, Instance: 7
  Fast Reroute Protection: Requested
    Inbound: FRR Inactive
     LSP signalling info:
      Original: in i/f: GigabitEthernet0/0/0/0, label:  24002, phop: 10.1.11.11
    Outbound: FRR Ready
     Backup tunnel-te200 to LSP nnhop
      tunnel-te200: out i/f: GigabitEthernet0/0/0/2
     LSP signalling info:
      Original: out i/f: GigabitEthernet0/0/0/1, label:  24002, nhop: 10.1.2.2
      With FRR: out i/f: tunnel-te200, label:  24002
     LSP bw: 0 kbps, Backup level: any-class unlimited, type: CT0 

Gi0/0/0/1 has both an NHOP bypass (tunnel-te100) and an NNHOP bypass (tunnel-te200), and PE1_t0 uses the NNHOP bypass.

STEP 6 No.18 RESV (P1 to PE1, tshark -V excerpt)
Internet Protocol Version 4, Src: 10.1.11.1, Dst: 10.1.11.11
            Message Type: RESV Message.  (2)
        RECORD ROUTE: IPv4 1.1.1.1 (Node-id), Label 24002, IPv4 10.1.11.1, ... (Node-id) (Node-id) (Node-id)
            IPv4 Subobject - 1.1.1.1 (Node-id), Local Protection Available, Backup is Next-Next-Hop
                Flags: 0x29
                    .... ...1 = Local Protection: Available
                    .... 1... = Node Protection: Available
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 10.1.11.1, Local Protection Available, Backup is Next-Next-Hop
                Flags: 0x09
                    .... ...1 = Local Protection: Available
                    .... 1... = Node Protection: Available
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 2.2.2.2 (Node-id)
                Flags: 0x20
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 10.1.2.2
                Flags: 0x00
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002
            IPv4 Subobject - 3.3.3.3 (Node-id)
                Flags: 0x20
            Label Subobject - 24002, The label will be understood if received on any interface
                Flags: 0x01
                Label: 24002

Download the pcap of the packet in the tshark output above (No.18 RESV)

P1’s subobject now says Node Protection Available, and label 24002 is recorded after P3 (3.3.3.3). The backup in P1’s forwarding table is { 24004 24002 }, and 24002 is P3’s label.

STEP 6 P1 show mpls forwarding detail (excerpt)
24002  24002       TE: 0              Gi0/0/0/1    10.1.2.2        28808       
     Updated: Sep 15 03:24:45.967
     Path Flags: 0x400 [  BKUP-IDX:1 (0x8aa22190) ]
     Version: 29, Priority: 2
     Label Stack (Top -> Bottom): { 24002 }
     NHID: 0x6, Encap-ID: N/A, Path idx: 0, Backup path idx: 1, Weight: 0
     MAC/Encaps: 14/18, MTU: 1500
     Outgoing Interface: GigabitEthernet0/0/0/1 (ifhandle 0x00000010)
     Packets Switched: 276

       24002       TE: 0              tt200        point2point     0            (!)
     Updated: Sep 15 03:24:45.967
     Path Flags: 0x100 [  BKUP, NoFwd ]
     Version: 29, Priority: 2
     Label Stack (Top -> Bottom): { 24004 24002 }
     NHID: 0x0, Encap-ID: N/A, Path idx: 1, Backup path idx: 0, Weight: 0
     MAC/Encaps: 14/22, MTU: 1500
     Outgoing Interface: tunnel-te200 (ifhandle 0x00000024)
     Packets Switched: 0
     (!): FRR pure backup

STEP 6 P3 show mpls forwarding
RP/0/RP0/CPU0:P3#show mpls forwarding
Tue Sep 15 03:26:45.836 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes       
Label  Label       or ID              Interface                    Switched    
------ ----------- ------------------ ------------ --------------- ------------
24002  Pop         TE: 0              Gi0/0/0/1    10.3.22.22      29243       
24003  24003       TE: 0              Gi0/0/0/0    10.2.3.2        214         
       24003       TE: 0              tt200        point2point     0            (!)
24004  24001       TE: 200            Gi0/0/0/2    10.3.6.6        0           

In STEP 7, all P2 interfaces and the P2-facing interfaces of P1 and P3 were shut down at the same time.

STEP 7 CE1 ping 192.168.2.1 (300 probes across the node failure)
RP/0/RP0/CPU0:CE1#ping 192.168.2.1 source 192.168.1.1 count 300 interval 100 timeout 1

Tue Sep 15 03:31:52.062 UTC
Type escape sequence to abort.
Sending 300, 100-byte ICMP Echos to 192.168.2.1 timeout is 1 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (299/300), round-trip min/avg/max = 17/32/188 ms

Only 1 probe was lost. It was a reply on the return path that was passing through P2 at the moment P2 went down; P1 forwarded all 300 requests.

STEP 7 P1 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P1#show mpls traffic-eng fast-reroute database

Tue Sep 15 03:32:09.142 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
11.11.11.11 0 [7]                24002    tt200:24002                           Active 

STEP 7 P3 show mpls traffic-eng fast-reroute database (right after the failure)
RP/0/RP0/CPU0:P3#show mpls traffic-eng fast-reroute database

Tue Sep 15 03:32:13.000 UTC
LSP midpoint FRR information:
LSP identifier                   In-label Out Intf : Label   FRR Intf : Label   Status 
-------------------------------- -------- ------------------ ------------------ -------
22.22.22.22 0 [8]                24003    tt200:24003                           Active 

These are packets at the bypass entry (No.14 between P1 and P4) and just before its exit (No.13 between P6 and P3).

STEP 7 No.14 ICMP Echo request (P1 to P4, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24004, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 253
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.14 Echo request)

STEP 7 No.13 ICMP Echo request (P6 to P3, tshark -V excerpt)
MultiProtocol Label Switching Header, Label: 24002, Exp: 0, S: 0, TTL: 250
MultiProtocol Label Switching Header, Label: 24015, Exp: 0, S: 1, TTL: 254
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.2.1
    Type: Echo (ping) request (8)

Download the pcap of the packet in the tshark output above (No.13 Echo request)

On P1 - P4 the packet carries 3 labels (24004 / 24002 / 24015). P6 removes the bypass label, and P3 receives 2 labels: its own label 24002 and the VPN label.

STEP 7 PE1 show mpls traffic-eng tunnels (excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 60)
      Accumulative metrics: TE 60 IGP 60 Delay 1800000 
      Accumulative biased metrics: TE 60 IGP 60 Delay 1800000 
    path option 10,  type explicit UPPER
    Last PCALC Error [Reopt]: Tue Sep 15 03:32:03 2026
      Info: Explicit path has unknown address 10.2.3.3 in OSPF 1 area 0
    Last Signalled Error : Tue Sep 15 03:32:03 2026
      Info: [7] PathErr(25,3)-(Error: notify (25), Suberror: local repair (3)) at 10.1.11.1

Results by STEP

STEP	Failure	CE1 to CE2	Labels while rerouted (P1 - P4)	Tunnel
1	Link (no FRR)	284/300 (about 16 s)	2 (re-signalled LSP)	Went down and was signalled again
4	Link (NHOP)	299/300	3: 24002 / 24002 / 24015	Stayed up (PathErr 25,3)
7	Node (NNHOP)	299/300	3: 24004 / 24002 / 24015	Stayed up (PathErr 25,3)

XRd forwards in software, so the outage durations are for reference only.

Design notes

Protection works only when both the head-end request (fast-reroute) and a bypass at the PLR are in place. With only one of them, the LSP stays 0 protected
For node protection, prepare an NNHOP bypass at the PLR. An NNHOP bypass skips one node before the MP, so it cannot be built by the router just before the tail-end
FRR only covers the switchover itself. If failure detection (link down or BFD) is slow, the outage grows by that much

Lab configuration and show outputs

In each STEP the following files were collected from all ten routers, one file per router. The lab configuration is the ..._run.txt (the final state is in the last STEP).

File	Contents
`..._show.txt`	`show version` / `show route` / `show mpls traffic-eng tunnels` commands / `show mpls traffic-eng fast-reroute database` / `show mpls traffic-eng tunnels backup` and `protection` / `show mpls forwarding detail` / `show rsvp` commands / VPN shows and more
`..._log.txt`	`show logging` limited to that STEP
`..._run.txt`	`show running-config` at that STEP (the lab configuration of that STEP)
`..._ping.txt`	`ping` (50 packets, 1-second timeout) and `traceroute` in that STEP
`..._oam.txt`	`ping` / `traceroute mpls traffic-eng tunnel-te 0` (PE1 and PE2)
`..._trace.txt`	`show mpls traffic-eng trace head-end` / `link` / `bselect` and `show rsvp trace signalling` (eight core routers)
`..._commit.cfg`	Only the configuration actually committed in that STEP, for the routers that changed
`..._failping.txt`	CE1’s ping across the failure in STEP 1, 4 and 7
`..._debug.txt`	`show` outputs taken right after the failure and before and after reoptimization
`.pcap`	Captures of that STEP (PE1 - P1 / P1 - P2 / P1 - P4 / P2 - P5 / P3 - P6)

STEP 0: Tunnels in both directions (upper row as strict = 10, dynamic = 20) and autoroute

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	-
P2	show	log	run	-	-	trace	-
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

STEP 1: Shut down P1 - P2 on both ends without FRR

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: CE1 failping

STEP 2: Restore, add fast-reroute to both tunnels, reoptimize back to the upper row

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

Additional records: PE1 debug / PE2 debug

STEP 3: NHOP bypasses and backup-path on P1 and P2

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

STEP 4: Shut down P1 - P2 on both ends

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: CE1 failping / PE1 debug / P1 debug / P2 debug

STEP 5: Restore and reoptimize back to the upper row

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	-
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: PE1 debug / PE2 debug

STEP 6: fast-reroute protect node and NNHOP bypasses on P1 and P3

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	-
P3	show	log	run	-	-	trace	cfg
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

STEP 7: P2 failure (all P2 interfaces plus the P1 and P3 sides shut down)

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	-
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	cfg
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	-
CE2	show	log	run	ping	-	-	-

Additional records: CE1 failping / PE1 debug / P1 debug / P3 debug

STEP 8: Remove everything (final state)

Router	show output	syslog	running-config	ping	OAM	trace	commit
CE1	show	log	run	ping	-	-	-
PE1	show	log	run	ping	oam	trace	cfg
P1	show	log	run	-	-	trace	cfg
P2	show	log	run	-	-	trace	cfg
P3	show	log	run	-	-	trace	cfg
P4	show	log	run	-	-	trace	-
P5	show	log	run	-	-	trace	-
P6	show	log	run	-	-	trace	-
PE2	show	log	run	ping	oam	trace	cfg
CE2	show	log	run	ping	-	-	-

Packet captures were taken per STEP on the following five links.

STEP	PE1 - P1	P1 - P2	P1 - P4	P2 - P5	P3 - P6
0	pcap	pcap	pcap	pcap	pcap
1	pcap	pcap	pcap	pcap	pcap
2	pcap	pcap	pcap	pcap	pcap
3	pcap	pcap	pcap	pcap	pcap
4	pcap	pcap	pcap	pcap	pcap
5	pcap	pcap	pcap	pcap	pcap
6	pcap	pcap	pcap	pcap	pcap
7	pcap	pcap	pcap	pcap	pcap
8	pcap	pcap	pcap	pcap	pcap

References

Source	Sections used
RFC 4090 Fast Reroute Extensions to RSVP-TE for LSP Tunnels	2 (PLR / MP / NHOP / NNHOP), 3.1 and 3.2 (one-to-one and facility, label stacking), 4.3 and 4.4 (SESSION_ATTRIBUTE and RRO flags), 5 (head-end request, label recording), 6 (PLR behavior and RRO flags), 6.2 (no node protection at the penultimate hop), 6.5.1 (PathErr Notify / Tunnel locally repaired)

The need for mpls ldp on IOS XR, the availability of facility backup only, and the switchover times are observations on the lab router (XRd 26.1.1).