[c-nsp] MPLS VPN Design with very fast convergence

[Oliver Boehmer (oboehmer)]

Peer Kohlstetter <> wrote on Monday, November 03, 2008 23:31:

> Hi,
> 
> I'm currently working on a Design for a MPLS VPN with very fast
> convergence times.
> 
> We have the goal to reach a maximum convergence time of 1,5 seconds
> when a single error occurs.
> 
> In the Backbone I try to work with FRR (FastReRoute). Between PE and
> CE I'm not sure what protocol to use. I'm also thinking about L3VPN or
> L2VPN solution.
> 
> Are there any information, whitepapers, designs about such a solution
> in the web?
> 
> Do somebody have experience with such convergence times in a MPLS
> environment?

generally in IOS, 1.5 sec is tricky to achieve (especially in scaled
configs), and it might not be for free.

In a nutshell:
For core failures, you can tune your IGP to converge in sub-second,
assuming you can detect core link/node failures quickly enough, so you
might need to evaluate BFD. I wouldn't run TE-FRR for this target.
Edge/PE failures are detected via IGP and reacted upon using BGP NHT.
But invalidating the next-hops involve a table walk in IOS, so depending
on your size of the BGP table on the PEs, this can take its time. Make
sure all PEs have an alternate next-hop to converge to already imported
in the VRF to avoid import-scanner delay.
PE-CE link failures might also require BFD to be detected quickly, and
rely on BGP processing (as well as table scans, so BGP table size
matters). New features like "PE-CE Link Protection" could help here.

We're working on BGP-PIC (Prefix Independent Convergence) to speed up
things, but this is not yet available in IOS (IOS-XR already uses part
of it and optimized other things as well).

Not running a PE-CE protocol can speed up things in some configs (i.e.
directly-connected voice gateways where PEs speak HSRP)..

I guess you'll achieve 1-1.5 sec in the lab, but scaling this up in IOS
is tricky..

	oli