What Is MPLS TE (RSVP-TE)

An IGP picks a single shortest path per destination and puts all traffic on it. In MPLS TE (Traffic Engineering), the tunnel ingress (head-end) decides the path and sets up labels along it. The path can be given explicitly by the operator or computed by the head-end. This article explains how it works, then uses an IOS XR (XRd) lab to see what the tunnel does when an explicit path breaks.

The three components

Component	Role
IGP TE extensions	Flood link attributes to every router. Each router keeps them as the TED (TE database)
Path decision	The head-end checks an explicit path against the TED, or computes a path that meets the conditions with CSPF
RSVP-TE	Signals along the chosen path and distributes labels

How CSPF chooses a path under constraints such as bandwidth and color is covered in MPLS TE CSPF and Path Constraints.

Choosing the path: path-option

A tunnel can have several numbered path-options. The head-end tries them in ascending order and moves to the next one when a path-option cannot be used.

Type	Configuration	Path
Explicit path	`path-option 10 explicit name <name>`	Follows the hops listed in `explicit-path`
Dynamic path	`path-option 20 dynamic`	Computed by CSPF (the same as the IGP when there are no constraints)

A typical setup uses 10 for the explicit path and 20 for the dynamic path, so the tunnel stays up with the dynamic path when the explicit path cannot be used.

strict and loose

Each hop of an explicit path is strict or loose. RSVP-TE carries them in the EXPLICIT_ROUTE (ERO) of the Path message: a subobject with the L bit set is loose, and one without it is strict (RFC 3209 section 4.3.3).

Type	Meaning (section 4.3.3.1)	Choosing the next hop (section 4.3.4)
strict	No other node between it and the preceding node	If not directly connected, return Bad strict node (SHOULD)
loose	Other nodes may lie between it and the preceding node	Pick a next hop on the path toward that node

The RFC lets transit nodes expand a loose segment. However, when the head-end’s TED holds the whole path (for example within one area), IOS XR computes the loose segment itself and sends an ERO made only of strict hops. The benefit of loose is that the head-end keeps room to choose the path again.

RSVP-TE signalling

Message	Direction	Main objects
Path	head-end → tail-end	EXPLICIT_ROUTE (ERO), LABEL_REQUEST
Resv	tail-end → head-end	LABEL, RECORD_ROUTE (the path actually taken)
PathErr	Node that found the error → head-end	ERROR_SPEC (error code, value and the reporting node)

RFC 3209 states that labels are allocated downstream and distributed upstream in Resv (section 1.1). Routing problems use Error Code 24 (Routing Problem): value 2 is Bad strict node, value 4 is Bad initial subobject, and value 5 is No route available toward destination (section 4.5).

Behavior on failure

When a link along an explicit path goes down, things proceed as follows.

The node just before the failed link returns PathErr(24,5) (No route available toward destination) to the head-end
The head-end drops the LSP and tries the path-options again in order. An explicit path made only of strict hops can only compute the same path, so the tunnel comes back on the next path-option (the dynamic path)
An explicit path with a loose segment lets the head-end recompute that segment, so the tunnel comes back on the same path-option over a different route
Either way the old LSP is already unusable, so the new LSP cannot be brought up before the old one is removed (make-before-break). The tunnel goes down once and is signalled again

When the link comes back, the tunnel does not return to the original path-option on its own, because the current LSP is working. It moves back at periodic reoptimization or on a manual mpls traffic-eng reoptimize, which is make-before-break and does not interrupt traffic.

How a path-option is changed matters too

Removing the path-option in use with no tears the LSP and the tunnel is signalled again. Overwriting the same path-option number is treated as reoptimization and moves with make-before-break.

verbatim

IOS XR normally checks an explicit path against the TED before sending it. If strict hops that are not directly connected are listed, the head-end cannot compute a path and no Path is sent. With verbatim the TED check is skipped and the Path is sent with the configured ERO. Which node rejects it, and with which error, is examined in the lab.

Lab topology

An upper path and a lower path joined by rungs, like a ladder. The core runs OSPF area 0 and LDP, and CE1 and CE2 attach to the PEs through VRF CUST-A. No TE constraints (bandwidth, color) are used.

Segment	OSPF cost	Role
Upper PE1 - P1 - P2 - PE2	10 ×3 = 30	IGP shortest path, used by the dynamic path
Lower PE1 - P3 - P4 - PE2	20 ×3 = 60	Used by the explicit path
Rungs P1 - P3 / P2 - P4	30	Detour for loose

Router	Lo0	Role	Label range
PE1	2.2.2.2	head-end	24000 - 24999
P1 / P2	3.3.3.3 / 4.4.4.4	Upper path	33000 - / 44000 -
P3 / P4	5.5.5.5 / 6.6.6.6	Lower path	55000 - / 66000 -
PE2	7.7.7.7	tail-end	77000 - 77999
CE1 / CE2	1.1.1.1 / 8.8.8.8	AS 65101 / AS 65102	-

The label ranges are split per router. A TE tunnel changes label at every hop, so this makes who allocated a label readable in show mpls traffic-eng tunnels detail and in the forwarding table.

As the link along the explicit path, P3 - P4 is shut down on both ends. Before shutting it down, PE1 starts an LSP Ping through the tunnel (ping mpls traffic-eng tunnel-te 0, 600 probes at 100 ms intervals) to count the loss.

Overview of the test

STEP	Change	What it shows
0	Initial state (no tunnel)	The IGP shortest path is the upper path
1	`path-option 10 dynamic`	The upper path, same as the IGP. Path and Resv
2	Explicit path (lower path, all strict) as 10, dynamic as 20	Uses the lower path. The path-option in use was removed, so the tunnel is signalled again
3	Shut down P3 - P4 on both ends	PathErr(24,5). Signalled again on path-option 20 (upper path)
4	Restore P3 - P4 and reoptimize manually	Stays on 20 after restoration. Reoptimization returns it to 10 without interruption
5	Overwrite with an explicit path of strict P3 and loose PE2	The ERO is all strict. An overwrite, so no interruption
6	Shut down P3 - P4 on both ends again	Signalled again over the rung on path-option 10
7	Restore and overwrite 10 with a non-adjacent strict hop (P2 after P3)	The head-end rejects it and uses 20
8	Add `verbatim` to the same explicit path and reoptimize manually	A Path is sent and a transit node returns an error
9	Remove everything (final state)	Back to the STEP 0 state

The following sections are grouped by theme rather than by STEP.

Dynamic path and explicit path (STEP 1 and 2)

Configuration committed on PE1 in STEP 1
interface tunnel-te0
 ipv4 unnumbered Loopback0
 destination 7.7.7.7
 record-route
 path-option 10 dynamic
!

STEP 1 PE1 show mpls traffic-eng tunnels (the path)
  Path info (OSPF 1 area 0):
  Hop0: 10.2.3.3
  Hop1: 10.3.4.4
  Hop2: 10.4.7.7
  Hop3: 7.7.7.7

The dynamic path is the upper path (P1 → P2), the same as the IGP. No.6 in the capture between PE1 and P1 is the Path at this time.

STEP 1 No.6 PATH (PE1 to PE2, tshark -V excerpt)
    EXPLICIT ROUTE: IPv4 10.2.3.3, IPv4 10.3.4.4, IPv4 10.4.7.7,
        Length: 36
        Object class: EXPLICIT ROUTE object (20)
        C-Type: 1
        IPv4 Subobject - 10.2.3.3, Strict
            0... .... = Hop: Strict Hop
            Type: 1 (IPv4)
            Length: 8
            IPv4 hop: 10.2.3.3
            Prefix length: 32
        IPv4 Subobject - 10.3.4.4, Strict
            0... .... = Hop: Strict Hop
            Type: 1 (IPv4)
            Length: 8
            IPv4 hop: 10.3.4.4
            Prefix length: 32
        IPv4 Subobject - 10.4.7.7, Strict
            0... .... = Hop: Strict Hop
            Type: 1 (IPv4)
            Length: 8
            IPv4 hop: 10.4.7.7
            Prefix length: 32
        IPv4 Subobject - 7.7.7.7, Strict
            0... .... = Hop: Strict Hop

Download the pcap of the packet in the tshark output above (No.6 PATH)

The ERO lists the path computed by the head-end as strict hops. The Resv that P1 returns right after (No.7) carries the label pushed onto the tunnel.

STEP 1 No.7 RESV (P1 to PE1, tshark -V excerpt)
        LABEL: 33010
            Length: 8
            Object class: LABEL object (16)
            C-type: Packet Label (1)
            Label: 33010
        RECORD ROUTE: IPv4 10.2.3.3, IPv4 10.3.4.4, IPv4 10.4.7.7

Download the pcap of the packet in the tshark output above (No.7 RESV)

In STEP 2, an explicit path listing the lower path as all strict hops became path-option 10, and the dynamic path moved to 20.

Configuration committed on PE1 in STEP 2
explicit-path name LOWER-STRICT
 index 10 next-address strict ipv4 unicast 10.2.5.5
 index 20 next-address strict ipv4 unicast 10.5.6.6
 index 30 next-address strict ipv4 unicast 10.6.7.7
!
interface tunnel-te0
 no path-option 10 dynamic
 path-option 10 explicit name LOWER-STRICT
 path-option 20 dynamic
!

STEP 2 PE1 show mpls traffic-eng tunnels (path options)
    path option 10,  type explicit LOWER-STRICT (Basis for Setup, path weight 60)
      Accumulative metrics: TE 60 IGP 60 Delay 900000
      Accumulative biased metrics: TE 60 IGP 60 Delay 900000
    path option 20,  type dynamic

STEP 2 PE1 show mpls traffic-eng tunnels (the path)
  History:
    Tunnel has been up for: 00:03:05 (since Mon Oct 12 08:15:59 UTC 2026)
    Current LSP:
      Uptime: 00:03:05 (since Mon Oct 12 08:15:59 UTC 2026)
    Prior LSP:
      ID: 3 Path Option: 10
      Removal Trigger: path tear

  Path info (OSPF 1 area 0):
  Hop0: 10.2.5.5
  Hop1: 10.5.6.6
  Hop2: 10.6.7.7
  Hop3: 7.7.7.7

The tunnel moved to the lower path (P3 → P4) with the explicit path on path-option 10. However, Tunnel has been up for restarted at 12:34:11 and the previous LSP was removed by path tear. The path-option 10 dynamic in use was removed with no, so the tunnel went down once and was signalled again.

Link failure and restoration (STEP 3 and 4)

P3 - P4 along the explicit path is shut down on both ends.

Configuration committed on P3 in STEP 3
interface GigabitEthernet0/0/0/1
 shutdown
!

Configuration committed on P4 in STEP 3
interface GigabitEthernet0/0/0/0
 shutdown
!

STEP 3 PE1 show mpls traffic-eng tunnels (path option and error)
    path option 20,  type dynamic  (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000
    path option 10,  type explicit LOWER-STRICT
    Last PCALC Error: Mon Oct 12 08:24:15 2026
      Info: No path to destination, 7.7.7.7 (holdown)
    Last Signalled Error : Mon Oct 12 08:24:15 2026
      Info: [4] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.5.6.5

P3 (10.5.6.5) returned PathErr(24,5), and the tunnel was signalled again on the dynamic path of path-option 20 (upper path). No.127 between PE1 and P3 is that PathErr.

STEP 3 No.127 PATH ERROR (P3 to PE1, tshark -V excerpt)
        ERROR: IPv4, Error code: Routing Error, Value: 5, Error Node: 10.5.6.5
            Length: 12
            Object class: ERROR object (6)
            C-Type: IPv4 (1)
            Error node: 10.5.6.5
            Flags: 0x04 Path-State-Removed
                .... .1.. = Path State Removed: Set
                .... ..0. = NotGuilty: Not set
                .... ...0 = InPlace: Not set
            Error code: Routing Error (24)
            Error value: No route available toward destination (5)

Download the pcap of the packet in the tshark output above (No.127 PATH ERROR)

STEP 3 PE1 show mpls traffic-eng tunnels (the path)
  History:
    Tunnel has been up for: 00:03:55 (since Mon Oct 12 08:24:15 UTC 2026)
    Current LSP:
      Uptime: 00:03:55 (since Mon Oct 12 08:24:15 UTC 2026)
    Prior LSP:
      ID: 4 Path Option: 10
      Removal Trigger: path error

  Path info (OSPF 1 area 0):
  Hop0: 10.2.3.3
  Hop1: 10.3.4.4
  Hop2: 10.4.7.7
  Hop3: 7.7.7.7

The previous LSP was removed by path error, and the tunnel restarted at 12:42:28. Of the LSP Ping probes sent across the link failure, only 1 of 600 was Q (request not sent).

STEP 3 PE1 ping mpls traffic-eng tunnel-te 0 (600 packets across the link failure)
RP/0/RP0/CPU0:PE1#show clock

Mon Oct 12 08:24:03.561 UTC
08:24:03.603 UTC Mon Oct 12 2026
RP/0/RP0/CPU0:PE1#ping mpls traffic-eng tunnel-te 0 repeat 600 interval 100 timeout 1

Mon Oct 12 08:24:03.740 UTC

Sending 600, 100-byte MPLS Echos to tunnel-te0,
      timeout is 1 seconds, send interval is 100 msec:

Codes: '!' - success, 'Q' - request not sent, '.' - timeout,
  'L' - labeled output interface, 'B' - unlabeled output interface,
  'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch,
  'M' - malformed request, 'm' - unsupported tlvs, 'N' - no rx label,
  'P' - no rx intf label prot, 'p' - premature termination of LSP,
  'R' - transit router, 'I' - unknown upstream index,
  'X' - unknown return code, 'x' - return code 0

Type escape sequence to abort.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (600/600), round-trip min/avg/max = 10/16/102 ms
RP/0/RP0/CPU0:PE1#show clock

Mon Oct 12 08:25:05.329 UTC
08:25:05.373 UTC Mon Oct 12 2026

In STEP 4 the link was restored, and the state was checked 90 seconds later.

STEP 4 PE1 show mpls traffic-eng tunnels 0 (90 seconds after recovery, excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000
    path option 10,  type explicit LOWER-STRICT
    Last PCALC Error: Mon Oct 12 08:24:15 2026
      Info: No path to destination, 7.7.7.7 (holdown)
    Last Signalled Error : Mon Oct 12 08:24:15 2026
      Info: [4] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.5.6.5

STEP 4 PE1 show mpls traffic-eng topology path (computing the explicit path)
RP/0/RP0/CPU0:PE1#show mpls traffic-eng topology path destination 7.7.7.7 explicit-path name LOWER-STRICT

Mon Oct 12 08:34:55.142 UTC
Path Setup to 7.7.7.7: FULL_PATH
bw 0 (CT0), min_bw 1000000, metric: 60
Accumulated Metrics: TE: 60, IGP: 60, Delay: 900000
Accumulated Biased Metrics: TE: 60, IGP: 60, Delay: 900000
setup_pri 0, hold_pri 0
Affinity: 0x0/0x0
Biased-to explicit path:
Node hop count 3
Hop0:10.2.5.5
Hop1:10.5.6.6
Hop2:10.6.7.7
Hop3:7.7.7.7

Mon Oct 12 08:34:57.945 UTC

The explicit path can be computed, yet the tunnel stays on path-option 20. It was reoptimized manually.

STEP 4 PE1 manual reoptimization
RP/0/RP0/CPU0:PE1#mpls traffic-eng reoptimize 0

Mon Oct 12 08:34:58.441 UTC

Mon Oct 12 08:36:01.146 UTC

STEP 4 PE1 show mpls traffic-eng tunnels 0 (after reoptimization, path options)
    path option 10,  type explicit LOWER-STRICT (Basis for Setup, path weight 60)
      Accumulative metrics: TE 60 IGP 60 Delay 900000
      Accumulative biased metrics: TE 60 IGP 60 Delay 900000
    Last Signalled Error : Mon Oct 12 08:24:15 2026
      Info: [4] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.5.6.5
    path option 20,  type dynamic

STEP 4 PE1 show mpls traffic-eng tunnels 0 (after reoptimization, the path)
    Tunnel has been up for: 00:14:54 (since Mon Oct 12 08:24:15 UTC 2026)
    Current LSP:
      Uptime: 00:04:11 (since Mon Oct 12 08:34:58 UTC 2026)
    Prior LSP:
      ID: 5 Path Option: 20
      Removal Trigger: reoptimization completed

  Path info (OSPF 1 area 0):
  Hop0: 10.2.5.5
  Hop1: 10.5.6.6
  Hop2: 10.6.7.7
  Hop3: 7.7.7.7

The tunnel is back on path-option 10. The LSP is new from 12:53:22, but Tunnel has been up for continues from 12:42:28, and the previous LSP was removed by reoptimization completed. It is make-before-break, so there is no interruption.

loose (STEP 5 and 6)

In STEP 5, path-option 10 was overwritten with an explicit path that has P3 as strict and PE2 as loose.

Configuration committed on PE1 in STEP 5
explicit-path name LOWER-LOOSE
 index 10 next-address strict ipv4 unicast 10.2.5.5
 index 20 next-address loose ipv4 unicast 7.7.7.7
!
interface tunnel-te0
 path-option 10 explicit name LOWER-LOOSE
!

STEP 5 PE1 show mpls traffic-eng tunnels detail (the ERO that was sent, excerpt)
        Explicit Route:
          Strict, 10.2.5.5
          Strict, 10.5.6.6
          Strict, 10.6.7.7
          Strict, 7.7.7.7

      Record Route: Empty
      Tspec: avg rate=0 kbits, burst=1000 bytes, peak rate=0 kbits
      Session Attributes: Local Prot: Not Set, Node Prot: Not Set, BW Prot: Not Set
                          Soft Preemption Desired: Not Set

Loose was configured, yet all four ERO entries are Strict. The head-end filled in the loose segment (from P3 to PE2). In the Path No.4 between PE1 and P3, no subobject has the L bit either.

STEP 5 No.4 PATH (PE1 to P3, tshark -V excerpt)
        EXPLICIT ROUTE: IPv4 10.2.5.5, IPv4 10.5.6.6, IPv4 10.6.7.7,
            Length: 36
            Object class: EXPLICIT ROUTE object (20)
            C-Type: 1
            IPv4 Subobject - 10.2.5.5, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.2.5.5
                Prefix length: 32
            IPv4 Subobject - 10.5.6.6, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.5.6.6
                Prefix length: 32
            IPv4 Subobject - 10.6.7.7, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.6.7.7
                Prefix length: 32
            IPv4 Subobject - 7.7.7.7, Strict
                0... .... = Hop: Strict Hop

Download the pcap of the packet in the tshark output above (No.4 PATH)

STEP 5 PE1 show mpls traffic-eng tunnels (the path)
  History:
    Tunnel has been up for: 00:22:56 (since Mon Oct 12 08:24:15 UTC 2026)
    Current LSP:
      Uptime: 00:03:02 (since Mon Oct 12 08:44:09 UTC 2026)
    Prior LSP:
      ID: 6 Path Option: 10
      Removal Trigger: reoptimization completed

  Path info (OSPF 1 area 0):
  Hop0: 10.2.5.5
  Hop1: 10.5.6.6
  Hop2: 10.6.7.7
  Hop3: 7.7.7.7

Because the same number was overwritten, the previous LSP was removed by reoptimization completed and the tunnel was not interrupted (unlike STEP 2).

In STEP 6, the same P3 - P4 was shut down on both ends again.

Configuration committed on P3 in STEP 6
interface GigabitEthernet0/0/0/1
 shutdown
!

Configuration committed on P4 in STEP 6
interface GigabitEthernet0/0/0/0
 shutdown
!

STEP 6 PE1 show mpls traffic-eng tunnels (path options)
    path option 10,  type explicit LOWER-LOOSE (Basis for Setup, path weight 70)
      Accumulative metrics: TE 70 IGP 70 Delay 1200000
      Accumulative biased metrics: TE 70 IGP 70 Delay 1200000
    Last Signalled Error : Mon Oct 12 08:52:21 2026
      Info: [7] PathErr(24,5)-(Error: routing (24), Suberror: no route to dest (5)) at 10.5.6.5
    path option 20,  type dynamic

STEP 6 PE1 show mpls traffic-eng tunnels (the path)
  History:
    Tunnel has been up for: 00:03:54 (since Mon Oct 12 08:52:21 UTC 2026)
    Current LSP:
      Uptime: 00:03:54 (since Mon Oct 12 08:52:21 UTC 2026)
    Reopt. LSP:
      Last Failure:
        LSP not signalled, identical to the [CURRENT] LSP
        Date/Time: Mon Oct 12 08:50:51 UTC 2026 [00:05:24 ago]
    Prior LSP:
      ID: 7 Path Option: 10
      Removal Trigger: path error

  Path info (OSPF 1 area 0):
  Hop0: 10.2.5.5
  Hop1: 10.3.5.3
  Hop2: 10.3.4.4
  Hop3: 10.4.7.7
  Hop4: 7.7.7.7

P3 returned the same PathErr(24,5), but this time the tunnel was signalled again on path-option 10 over P3 → P1 (rung) → P2 → PE2 (path weight 70). This is the ERO of the Path right after re-signalling (No.127).

STEP 6 No.127 PATH (PE1 to P3, tshark -V excerpt)
        EXPLICIT ROUTE: IPv4 10.2.5.5, IPv4 10.3.5.3, IPv4 10.3.4.4, ...
            Length: 44
            Object class: EXPLICIT ROUTE object (20)
            C-Type: 1
            IPv4 Subobject - 10.2.5.5, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.2.5.5
                Prefix length: 32
            IPv4 Subobject - 10.3.5.3, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.3.5.3
                Prefix length: 32
            IPv4 Subobject - 10.3.4.4, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.3.4.4
                Prefix length: 32
            IPv4 Subobject - 10.4.7.7, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.4.7.7
                Prefix length: 32
            IPv4 Subobject - 7.7.7.7, Strict
                0... .... = Hop: Strict Hop

Download the pcap of the packet in the tshark output above (No.127 PATH)

The detour was made by the head-end, not by P3. The tunnel went down once and restarted at 13:10:40, and 3 LSP Ping probes were lost.

STEP 6 PE1 ping mpls traffic-eng tunnel-te 0 (600 packets across the link failure)
RP/0/RP0/CPU0:PE1#show clock

Mon Oct 12 08:52:09.811 UTC
08:52:09.851 UTC Mon Oct 12 2026
RP/0/RP0/CPU0:PE1#ping mpls traffic-eng tunnel-te 0 repeat 600 interval 100 timeout 1

Mon Oct 12 08:52:09.994 UTC

Sending 600, 100-byte MPLS Echos to tunnel-te0,
      timeout is 1 seconds, send interval is 100 msec:

Codes: '!' - success, 'Q' - request not sent, '.' - timeout,
  'L' - labeled output interface, 'B' - unlabeled output interface,
  'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch,
  'M' - malformed request, 'm' - unsupported tlvs, 'N' - no rx label,
  'P' - no rx intf label prot, 'p' - premature termination of LSP,
  'R' - transit router, 'I' - unknown upstream index,
  'X' - unknown return code, 'x' - return code 0

Type escape sequence to abort.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QQQ!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (597/600), round-trip min/avg/max = 12/18/81 ms
RP/0/RP0/CPU0:PE1#show clock

Mon Oct 12 08:53:11.484 UTC
08:53:11.566 UTC Mon Oct 12 2026

Non-adjacent strict hops and verbatim (STEP 7 and 8)

In STEP 7 the link was restored, and path-option 10 was overwritten with an explicit path listing P2 (10.4.7.4), which is not directly connected, as a strict hop after P3.

Configuration committed on PE1 in STEP 7
explicit-path name BAD-STRICT
 index 10 next-address strict ipv4 unicast 10.2.5.5
 index 20 next-address strict ipv4 unicast 10.4.7.4
!
interface tunnel-te0
 path-option 10 explicit name BAD-STRICT
!

Configuration committed on P3 in STEP 7
interface GigabitEthernet0/0/0/1
 no shutdown
!

Configuration committed on P4 in STEP 7
interface GigabitEthernet0/0/0/0
 no shutdown
!

STEP 7 PE1 show mpls traffic-eng tunnels (path option and error)
    path option 20,  type dynamic  (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000
    path option 10,  type explicit BAD-STRICT
    Last PCALC Error [Reopt]: Mon Oct 12 09:03:03 2026
      Info: No path to destination, 7.7.7.7 (unknown, Flags: 0)

STEP 7 PE1 show mpls traffic-eng tunnels (the path)
  History:
    Tunnel has been up for: 00:13:46 (since Mon Oct 12 08:52:21 UTC 2026)
    Current LSP:
      Uptime: 00:03:04 (since Mon Oct 12 09:03:03 UTC 2026)
    Reopt. LSP:
      Last Failure:
        LSP not signalled, identical to the [CURRENT] LSP
        Date/Time: Mon Oct 12 08:50:51 UTC 2026 [00:15:16 ago]
    Prior LSP:
      ID: 8 Path Option: 10
      Removal Trigger: reoptimization completed

  Path info (OSPF 1 area 0):
  Hop0: 10.2.3.3
  Hop1: 10.3.4.4
  Hop2: 10.4.7.7
  Hop3: 7.7.7.7

The head-end could not compute a path (No path to destination) and moved to the upper path on path-option 20 with make-before-break. This Path never appeared on any link (the captures contain no RSVP packet with 10.4.7.4).

In STEP 8, verbatim was added to the same explicit path.

Configuration committed on PE1 in STEP 8
interface tunnel-te0
 path-option 10 explicit name BAD-STRICT verbatim
!

STEP 8 PE1 show mpls traffic-eng tunnels 0 detail (after the commit, excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000
    path option 10, (verbatim) type explicit BAD-STRICT

Adding it alone does nothing. Path-option 20 is in use and meets the conditions, so there is no trigger for reoptimization. It was reoptimized manually.

STEP 8 PE1 manual reoptimization
RP/0/RP0/CPU0:PE1#mpls traffic-eng reoptimize 0

Mon Oct 12 09:11:53.979 UTC

Mon Oct 12 09:12:56.944 UTC

PE1 sent the ERO as configured (No.32 between PE1 and P3).

STEP 8 No.32 PATH (PE1 to P3, tshark -V excerpt)
        EXPLICIT ROUTE: IPv4 10.2.5.5, IPv4 10.4.7.4
            Length: 20
            Object class: EXPLICIT ROUTE object (20)
            C-Type: 1
            IPv4 Subobject - 10.2.5.5, Strict
                0... .... = Hop: Strict Hop
                Type: 1 (IPv4)
                Length: 8
                IPv4 hop: 10.2.5.5
                Prefix length: 32
            IPv4 Subobject - 10.4.7.4, Strict
                0... .... = Hop: Strict Hop

Download the pcap of the packet in the tshark output above (No.32 PATH)

P3 did not return Bad strict node. It removed its own subobject and forwarded the Path to P4 along the IGP route (No.33 between P3 and P4).

STEP 8 No.33 PATH (P3 to P4, tshark -V excerpt)
    EXPLICIT ROUTE: IPv4 10.4.7.4
        Length: 12
        Object class: EXPLICIT ROUTE object (20)
        C-Type: 1
        IPv4 Subobject - 10.4.7.4, Strict
            0... .... = Hop: Strict Hop

Download the pcap of the packet in the tshark output above (No.33 PATH)

Since the first ERO entry was not itself, P4 returned Bad initial subobject (24,4) (No.34).

STEP 8 No.34 PATH ERROR (P4 to P3, tshark -V excerpt)
        ERROR: IPv4, Error code: Routing Error, Value: 4, Error Node: 10.5.6.6
            Length: 12
            Object class: ERROR object (6)
            C-Type: IPv4 (1)
            Error node: 10.5.6.6
            Flags: 0x04 Path-State-Removed
                .... .1.. = Path State Removed: Set
                .... ..0. = NotGuilty: Not set
                .... ...0 = InPlace: Not set
            Error code: Routing Error (24)
            Error value: Bad initial subobject (4)

Download the pcap of the packet in the tshark output above (No.34 PATH ERROR)

STEP 8 PE1 show mpls traffic-eng tunnels 0 detail (after reoptimization, excerpt)
    path option 20,  type dynamic  (Basis for Setup, path weight 30)
      Accumulative metrics: TE 30 IGP 30 Delay 900000
      Accumulative biased metrics: TE 30 IGP 30 Delay 900000
    path option 10, (verbatim) type explicit BAD-STRICT
    Last Signalled Error [Reopt] : Mon Oct 12 09:11:54 2026
      Info: [10] PathErr(24,4)-(Error: routing (24), Suberror: bad initial sub-obj (4)) at 10.5.6.6

Reoptimization failed, and the LSP on path-option 20 stayed as it was. RFC 3209 asks a node whose strict next hop is not directly connected to return Bad strict node (SHOULD), but in this IOS XR lab the rejection came from the next node, with value 4.

Results by STEP

STEP	path-option used	Path	Tunnel re-signalled	LSP Ping
1	10 (dynamic)	Upper	-	-
2	10 (strict)	Lower	Yes (removed with `no`)	-
3	20 (dynamic)	Upper	Yes (PathErr 24,5)	599/600
4	10 (strict)	Lower	No (reoptimization)	-
5	10 (loose)	Lower	No (overwrite)	-
6	10 (loose)	P3 → P1 → P2	Yes (PathErr 24,5)	597/600
7	20 (dynamic)	Upper	No (reoptimization)	-
8	20 (verbatim failed)	Upper	No	-

Design notes

Always follow an explicit path with a dynamic path-option. An explicit path made only of strict hops becomes unusable when a link along it fails
With a loose hop, the tunnel can detour on the same path-option. Even so, on IOS XR the tunnel is signalled again once
The tunnel does not return to the original path after the failure is fixed. To move it back, use mpls traffic-eng reoptimize or wait for periodic reoptimization
Removing the path-option in use with no causes an interruption. To change it, overwrite the same number
verbatim skips the TED check. How the error appears depends on the implementation of the transit nodes, so use it only for segments that are not in the TED

Lab configuration and show outputs

In each STEP the following files were collected from all eight routers, one file per router. The lab configuration is the ..._run.txt (the final state is in the last STEP).

File	Contents
`..._show.txt`	`show version` / `show route` / `show ospf database opaque-area` / `show mpls traffic-eng tunnels` commands / `show explicit-paths` / `show rsvp` commands and more
`..._log.txt`	`show logging` limited to that STEP
`..._run.txt`	`show running-config` at that STEP (the lab configuration of that STEP)
`..._ping.txt`	`ping` (50 packets, 1-second timeout) and `traceroute` in that STEP
`..._oam.txt`	`ping` / `traceroute mpls traffic-eng tunnel-te 0` and `ping` / `traceroute mpls ipv4` (PE1 and PE2)
`..._trace.txt`	`show mpls traffic-eng trace head-end` / `link` and `show rsvp trace signalling` (six core routers)
`..._commit.cfg`	Only the configuration actually committed in that STEP, for the routers that changed
`..._lspping.txt`	LSP Ping sent across the link failure in STEP 3 and 6 (PE1)
`..._debug.txt`	`show` outputs and `mpls traffic-eng reoptimize 0` taken on PE1 before and after reoptimization in STEP 4 and 8

STEP 0: Initial state (no tunnel)

Router	show	syslog	running-config	clear	ping	OAM	trace
CE1	show	log	run	clear	ping	—	—
PE1	show	log	run	clear	ping	oam	trace
P1	show	log	run	clear	ping	—	trace
P2	show	log	run	clear	—	—	trace
P3	show	log	run	clear	ping	—	trace
P4	show	log	run	clear	—	—	trace
PE2	show	log	run	clear	ping	oam	trace
CE2	show	log	run	clear	ping	—	—

STEP 1: path-option 10 dynamic

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed
CE1	show	log	run	clear	ping	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg
P1	show	log	run	clear	ping	—	trace	—
P2	show	log	run	clear	—	—	trace	—
P3	show	log	run	clear	ping	—	trace	—
P4	show	log	run	clear	—	—	trace	—
PE2	show	log	run	clear	ping	oam	trace	—
CE2	show	log	run	clear	ping	—	—	—

STEP 2: Explicit path (lower path, all strict) as 10, dynamic as 20

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed
CE1	show	log	run	clear	ping	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg
P1	show	log	run	clear	ping	—	trace	—
P2	show	log	run	clear	—	—	trace	—
P3	show	log	run	clear	ping	—	trace	—
P4	show	log	run	clear	—	—	trace	—
PE2	show	log	run	clear	ping	oam	trace	—
CE2	show	log	run	clear	ping	—	—	—

STEP 3: Shut down P3 - P4 on both ends

Router	show	syslog	running-config	clear	ping	OAM	outage ping	trace	config committed
CE1	show	log	run	clear	ping	—	—	—	—
PE1	show	log	run	clear	ping	oam	lspping	trace	—
P1	show	log	run	clear	ping	—	—	trace	—
P2	show	log	run	clear	—	—	—	trace	—
P3	show	log	run	clear	ping	—	—	trace	cfg
P4	show	log	run	clear	—	—	—	trace	cfg
PE2	show	log	run	clear	ping	oam	—	trace	—
CE2	show	log	run	clear	ping	—	—	—	—

STEP 4: Restore P3 - P4 and reoptimize manually

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed	extra record
CE1	show	log	run	clear	ping	—	—	—	—
PE1	show	log	run	clear	ping	oam	trace	—	debug
P1	show	log	run	clear	ping	—	trace	—	—
P2	show	log	run	clear	—	—	trace	—	—
P3	show	log	run	clear	ping	—	trace	cfg	—
P4	show	log	run	clear	—	—	trace	cfg	—
PE2	show	log	run	clear	ping	oam	trace	—	—
CE2	show	log	run	clear	ping	—	—	—	—

STEP 5: Overwrite with an explicit path of strict P3 and loose PE2

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed
CE1	show	log	run	clear	ping	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg
P1	show	log	run	clear	ping	—	trace	—
P2	show	log	run	clear	—	—	trace	—
P3	show	log	run	clear	ping	—	trace	—
P4	show	log	run	clear	—	—	trace	—
PE2	show	log	run	clear	ping	oam	trace	—
CE2	show	log	run	clear	ping	—	—	—

STEP 6: Shut down P3 - P4 on both ends again

Router	show	syslog	running-config	clear	ping	OAM	outage ping	trace	config committed
CE1	show	log	run	clear	ping	—	—	—	—
PE1	show	log	run	clear	ping	oam	lspping	trace	—
P1	show	log	run	clear	ping	—	—	trace	—
P2	show	log	run	clear	—	—	—	trace	—
P3	show	log	run	clear	ping	—	—	trace	cfg
P4	show	log	run	clear	—	—	—	trace	cfg
PE2	show	log	run	clear	ping	oam	—	trace	—
CE2	show	log	run	clear	ping	—	—	—	—

STEP 7: Restore and overwrite 10 with a non-adjacent strict hop (P2 after P3)

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed
CE1	show	log	run	clear	ping	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg
P1	show	log	run	clear	ping	—	trace	—
P2	show	log	run	clear	—	—	trace	—
P3	show	log	run	clear	ping	—	trace	cfg
P4	show	log	run	clear	—	—	trace	cfg
PE2	show	log	run	clear	ping	oam	trace	—
CE2	show	log	run	clear	ping	—	—	—

STEP 8: Add verbatim to the same explicit path and reoptimize manually

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed	extra record
CE1	show	log	run	clear	ping	—	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg	debug
P1	show	log	run	clear	ping	—	trace	—	—
P2	show	log	run	clear	—	—	trace	—	—
P3	show	log	run	clear	ping	—	trace	—	—
P4	show	log	run	clear	—	—	trace	—	—
PE2	show	log	run	clear	ping	oam	trace	—	—
CE2	show	log	run	clear	ping	—	—	—	—

STEP 9: Remove everything (final state)

Router	show	syslog	running-config	clear	ping	OAM	trace	config committed
CE1	show	log	run	clear	ping	—	—	—
PE1	show	log	run	clear	ping	oam	trace	cfg
P1	show	log	run	clear	ping	—	trace	—
P2	show	log	run	clear	—	—	trace	—
P3	show	log	run	clear	ping	—	trace	—
P4	show	log	run	clear	—	—	trace	—
PE2	show	log	run	clear	ping	oam	trace	—
CE2	show	log	run	clear	ping	—	—	—

Packet captures were taken per STEP on four links.

STEP	PE1 - P1	PE1 - P3	P1 - P3	P3 - P4
0	pcap	pcap	pcap	pcap
1	pcap	pcap	pcap	pcap
2	pcap	pcap	pcap	pcap
3	pcap	pcap	pcap	pcap
4	pcap	pcap	pcap	pcap
5	pcap	pcap	pcap	pcap
6	pcap	pcap	pcap	pcap
7	pcap	pcap	pcap	pcap
8	pcap	pcap	pcap	pcap
9	pcap	pcap	pcap	pcap

References

Source	Sections used
RFC 3209 RSVP-TE: Extensions to RSVP for LSP Tunnels	1.1 (labels are distributed upstream in Resv), 2.5 (make-before-break), 4.3.3 and 4.3.3.1 (strict and loose, the L bit), 4.3.4 (ERO processing, Bad strict node), 4.5 (values of Error Code 24)

The behavior of path-options, the expansion of loose hops and the result of verbatim are observations on the lab router (XRd 26.1.1).