Fast convergence techniques
Requirement / business driver
Minimize traffic loss on failure to meet application SLAs (voice/video, storage, trading).
The convergence budget - attack each phase
Detect -> propagate -> compute (SPF/DUAL) -> update FIB. You shrink total loss by improving every phase, not just one.
- Detection: carrier-delay/debounce tuning, link-down vs keepalive, BFD (sub-second, protocol-independent), IP event dampening.
- Propagation / compute: IGP SPF/PRC and LSA/LSP throttling, incremental SPF, prioritized prefixes.
- Precomputed backups: LFA -> rLFA -> TI-LFA (classic LFA coverage is topology-dependent - some topologies offer no loop-free neighbor at all; rLFA tunnels to a remote safe point to patch those holes, and TI-LFA, which needs SR, generalizes the idea for ~full coverage on the post-convergence path); EIGRP feasible successors; BGP PIC for prefix-independent failover.
- Microloop avoidance: TI-LFA / ordered FIB.
The zeroth repair: topology with equal-cost paths
Before any LFA machinery, the cheapest precomputed backup is a topology that already holds two equal-cost paths - the campus "build triangles, not squares" rule. In a triangle (two equal-cost uplinks toward the destination), a link or node failure is absorbed entirely in the FIB: CEF deletes the dead path and the survivor is already programmed, so recovery is hardware-speed and needs no SPF/DUAL run at all. In a square, the alternate is not equal-cost, so the identical failure must wait for routing-protocol convergence - detection, propagation, computation - turning a milliseconds event into a protocol event. ECMP is therefore the deterministic, zero-computation baseline; LFA/rLFA/TI-LFA exist for the places where the physical or cost topology cannot afford the triangle.
TI-LFA in numbers - the protection timeline and the scope ladder
Decompose a protected failure and the 50 ms budget stops being folklore. T0 failure -> T1 detection: 1-5 ms when the light goes down - and coherent ZR-class pluggables give ordinary router ports light-down-grade detection on DCI spans (Optical transport - CWDM vs DWDM) - versus ~20-50 ms when BFD must time out: the detection method, not the repair, dominates the sub-50 ms budget. From T1 -> T2 the hierarchical FIB invalidates the failed interface's shared path object in a few milliseconds - the same one-pointer-rewrite mechanism PIC uses below - and traffic is already riding the precomputed backup: T2-T0 under 50 ms, under ~10 ms with light-down detection. Only afterwards, in the background, does the IGP reconverge (~500 ms) - and because the TI-LFA backup is the post-convergence path, the hand-off from protection to converged forwarding moves nothing and cannot microloop (Factors affecting convergence). Protection and convergence are deliberately decoupled: the SLA rides the first; network state catches up in the second.
TI-LFA also asks what you want protecting against - a scope ladder: link -> node -> local SRLG -> SRLG + node -> weighted remote SRLG (steer clear of the failed link's shared-risk members even where they reappear deeper in the path). Each rung buys a stronger guarantee at the price of a longer backup path and a data dependency: SRLG protection is only as good as the SRLG membership advertised into the IGP (Transport resiliency, diversity, and migration owns finding what actually fails together). Pick the rung per interface or prefix class from real fate-sharing evidence, not maximal paranoia - node-protecting everything lengthens every backup for failures that are overwhelmingly single links.
Comparison
BGP PIC: constant-time repair at the edge
PIC (Prefix Independent Convergence, a.k.a. BGP FRR) precomputes one backup path per destination and installs it in the RIB/FIB beside the best path. The speed comes from the hierarchical FIB: prefixes point at a shared path-list/next-hop object, so on failure the router rewrites that one object - interface, label, rewrite - and every dependent prefix is repaired simultaneously, in tens of milliseconds regardless of table size. That is the "prefix-independent": repair cost stops scaling with prefix count, which is exactly what a full table or a large VPNv4 edge needs.
Two failure classes split the design. PIC Core - the BGP next hop survives but the IGP path beneath it moves; repair is purely the IGP/FIB swapping the underlying route, BGP untouched. PIC Edge - the next hop itself dies (an egress PE is lost); detection is the disappearance of the peer's /32 from the IGP plus next-hop tracking, so PIC Edge inherits the IGP's detection speed - a slow IGP makes "fast" BGP repair slow. And the backup must already be visible: reflection normally hides second-best paths, so PIC Edge depends on add-paths, a unique-RD-per-PE design, or best-external - the border advertising its best external path into iBGP even while an iBGP path is winning - to pre-position the alternate. PIC also constrains the VPN service-label mode: an aggregate per-VRF label offers no pre-installable backup rewrite, so convergence-critical VPNs pair PIC with per-CE or per-prefix labels (MPLS L3VPN and L2VPN).
Forward through it, or route around it (GR/NSF and NSR)
Everything above races to route around a failure; a second philosophy is to forward through it. On an SSO (dual-RP) platform, Graceful Restart (GR, a.k.a. NSF) asks the neighbors - in helper mode - to suppress reconvergence while the restarting router's protocol state is restored, and NSR keeps the state refreshed on the standby internally, needing no peer cooperation at a higher resource cost; both keep the data plane forwarding on known routes through a control-plane switchover (GR exists for OSPF/IS-IS/EIGRP/BGP and LDP; NSR typically for IS-IS/BGP). The design tension: this is the opposite philosophy to aggressive detection - BFD tuned for sub-second failover will declare a restarting neighbor dead and route around it before GR ever helps. So choose per adjacency: route around (fast detection + precomputed repair) where alternates exist, forward through (SSO + GR/NSR, relaxed timers on that adjacency) where there is nothing to route around to - single-homed edges, appliance and CE adjacencies, stub sites.
Recommendation / justification
BFD for detection + LFA/TI-LFA (with SR) for protection + BGP PIC at scale, with conservatively tuned IGP timers. Justify by the SLA: each technique buys back part of the budget; the key tradeoff is aggressive timers vs stability (too tight = false failures and flaps).
What would change this
- SR underlay available -> TI-LFA for guaranteed protection.
- Very large BGP edge -> prioritize BGP PIC + add-paths.
- Unstable/flapping links -> back off timers, add dampening, fix the physical layer first.
IPv6 / dual-stack note
BFD and LFA/TI-LFA apply to IPv6 too - confirm both address families are protected, not just v4.
Related
Spaced repetition
Name the four phases of the convergence budget.
Detect, propagate, compute (SPF/DUAL), update FIB.
The sub-second, protocol-independent failure-detection mechanism is [...].
The sub-second, protocol-independent failure-detection mechanism is BFD.
Which backup-path technique gives ~100% coverage along the post-convergence path, and what does it require?
TI-LFA; it requires a Segment Routing underlay.
BGP prefix-independent convergence ([...]) speeds failover but needs a backup path already present.
BGP prefix-independent convergence (BGP PIC) speeds failover but needs a backup path already present.
The core tradeoff when tuning timers/BFD aggressively is [...].
The core tradeoff when tuning timers/BFD aggressively is speed vs stability (false failures and route flap).
Graceful Restart vs fast convergence - why do they conflict, and where does each belong?
GR/NSF (with SSO) asks helper neighbors to keep forwarding through a control-plane restart, while aggressive BFD declares the restarting peer dead and routes around it first - so per adjacency pick one philosophy: route around where alternates exist; forward through (GR/NSR) where there is no alternate, like single-homed edges.
Why do "triangles, not squares" converge faster than any tuned protocol?
With two equal-cost paths the backup is already in the FIB - CEF just deletes the dead path, no SPF/DUAL run; a square's alternate is not equal-cost, so the same failure must wait for full routing-protocol convergence.
PIC Core vs PIC Edge - what fails, and what must pre-exist for Edge?
Core: the BGP next hop survives and only the IGP path under it moves - the IGP/FIB repairs alone. Edge: the next hop (egress PE) dies - detected by its /32 vanishing from a fast IGP plus next-hop tracking, and the alternate must already be visible via add-paths, unique RD per PE, or best-external.
PIC's speed comes from the hierarchical FIB: prefixes share a path-list, so failover rewrites [...] instead of every prefix - and [...] keeps a backup visible even while an iBGP path is winning.
PIC's speed comes from the hierarchical FIB: prefixes share a path-list, so failover rewrites one shared next-hop object instead of every prefix - and best-external keeps a backup visible even while an iBGP path is winning.
In the TI-LFA timeline, what dominates the sub-50 ms protection budget, and what are the working anchors?
Detection - light-down 1-5 ms (coherent pluggables give router ports this class on DCI spans) vs BFD ~20-50 ms; hierarchical-FIB invalidation adds only a few ms, and IGP reconvergence (~500 ms) happens afterwards in the background on the already-installed post-convergence path.
TI-LFA's protection scopes form a ladder - link, node, local SRLG, SRLG+node, [...] - each rung a stronger guarantee bought with a longer backup and a dependency on SRLG data in the IGP.
TI-LFA's protection scopes form a ladder - link, node, local SRLG, SRLG+node, weighted remote SRLG - each rung a stronger guarantee bought with a longer backup and a dependency on SRLG data in the IGP.
Sources
- Cisco Live BRKSP-2551 (2026), Introduction to Segment Routing - A foundation for Autonomous Networks (Donzelli, Cisco / Gorovoy, Nebius; incl. the Microsoft AI-fabric and Nebius DCI material)
- Cisco Live BRKMPL-2103 (2026): PIC core/edge split, hierarchical-FIB constant-time repair, backup-visibility prerequisites.
- Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - build triangles not squares - ECMP as the zero-computation repair
- Cisco Press, Optimal Routing Design (high availability & fast convergence).