Definitive MPLS Network Designs [Electronic resources] نسخه متنی

Network Recovery Design

As with any network recovery design, you must first determine the requirements in terms of availability SLAs should a network element failure occur in the network. Therefore, Globenet conducted a detailed analysis covering several years of failure statistics. It turned out that the vast majority (more than 90 percent) of the failures had been link failures (fiber cut, local leased-line failures, and router interface failure to a much lesser extent). Unexpected router failures resulting in traffic loss were insignificant. On the other hand, planned router failure so as to perform software or hardware upgrades were handled by scripts that isolated the traffic from the elements to upgrade by increasing the attached link metrics of the router in question. Such operations have always been done during maintenance windows. During these times, the traffic load was low enough that all the traffic usually routed through the router in question could be rerouted to an alternate path while offering an equivalent QoS.

Globenet's requirement was primarily to protect the traffic from link failures, with an objective of rerouting the traffic within a few tens of milliseconds whenever possible. Unexpected router failures were considered sufficiently rare to tolerate longer rerouting times. Moreover, upon single-link failure, the equivalent QoS along the alternate path must be provided at least to all important CoSs (ATM pseudowire, VPN Voice, VPN Video, VPN Business Latency, and VPN Business Throughput).

Chapter 4), Globenet leases its circuits. This leads Globenet to always require diversely routed links from its leased-line providers or to lease capacity from different providers to increase its chances of having diverse links. Thus, SRLG protection was not required. Note that in the past, multiple links provided by different service providers simultaneously failed because of a shared network element failure (such as a transatlantic fiber). Such a shared risk is usually outside Globenet's knowledge and thus is impossible to protect against. However, such an event is rare.

Based on the considerations just discussed, Globenet adopted the following network recovery design:

Use MPLS Traffic Engineering Fast Reroute as its network recovery technology of choice on unprotected SONET-SDH circuits, protected SONET-SDH circuits (in case of router interface failure), unprotected DWDM links, and Ethernet links (intra-POP). This protects against any single-link failure. Note that both inter-POP and intra-POP links are protected by means of Fast Reroute, although most of the failures relate to inter-POP link failures.

In the AsiaPac region, where routers are interconnected by means of ATM PVCs, link failures are handled by both PNNI and MPLS TE Fast Reroute. Upon ATM VC failure, both PNNI and MPLS TE Fast Reroute trigger some recovery actions but operate at different time scales. As discussed later, a design that triggers recovery actions at both layers was Globenet's preferred option. When (or if) the ATM VC is restored, MPLS Traffic Engineering starts reusing it by means of MPLS TE reoptimization.

Tune the IS-IS parameters to achieve 5 seconds of rerouting time in case of unexpected node failure or multiple link failures that could not be handled by MPLS TE Fast Reroute.

MPLS TE Fast Reroute Design Within Globenet Regions

This section presents the detailed design of Fast Reroute as deployed in all regions of the Globenet network.

Failure Detection

Considering the broad set of link types, Globenet had to adopt different strategies in terms of failure detection mechanisms based on the Layer 2 protocol in use:

SONET-SDH links The SONET-SDH layer provides a very efficient failure detection mechanism whereby an alarm is usually received within a few milliseconds (usually less than 10 ms). Thus, for Globenet's network in North America, OC-3 and OC-48 link failures are detected within a few milliseconds.

[BFD]) protocol with a hello period of 100 ms and a dead timer (hold time) of 400 ms. Thus, a failure will be detected within at most 400 ms regardless of the failure's root cause.

Gigabit Ethernet links When two pieces of equipment are interconnected by point-to-point Ethernet links, failure detection times similar to SONET-SDH can be achieved. Conversely, the use of Layer 2 Gigabit Ethernet switches drastically increases the failure detection time if a router port fails since failure detection is performed by means of IGP hello-based protocol. Similar to the ATM case, Globenet elected to use BFD as its failure detection mechanism of choice for its Gigabit Ethernet links with the same set of parameters.

Router failures Various router failure types can lead to different failure detection times and have different impacts on the forwarding traffic. For instance, the case of a power supply failure on a router is equivalent to the simultaneous failures of its entire set of attached links. Therefore, the failure detection time is similar to the link failure case. A control plane failure on a distributed router architecture has no impact on the traffic forwarding. The routing protocol detects the failure, and the traffic is smoothly rerouted to an alternate path without any traffic disruption. Conversely, a route processor failure on a centralized router architecture affects both the control and forwarding planes. In turn, this provokes a traffic disruption until the routing protocol converges, because MPLS TE Fast Reroute is just used for link protection. Globenet considered the latter case sufficiently rare to not justify any particular special measures to handle such failures.

Set of Backup Tunnels

Because MPLS TE Fast Reroute protects the traffic from link failures, just next-hop backup tunnels are required in the network. Furthermore, as mentioned previously, the Globenet network does not contain any SRLG. Because the vast majority of the links are leased, Globenet managed to lease its circuit to different regional providers to get diverse links.

Backup Tunnel Constraints

The first constraint that backup tunnels must meet is, of course, to be diverse from the protected link.

The second backup tunnel constraint is related to the bandwidth. When a backup tunnel path must be computed to protect a facility such as a link, the backup tunnel can be provisioned with bandwidth equivalent to the protected link. (Another example is a specific bandwidth pool (such as BC1) if the decision is made to provide an equivalent QoS to the TE LSPs of class type CT1.) Although quite efficient in terms of QoS, such an approach would require the use of a sophisticated backup tunnel path computation tool to maximize the bandwidth sharing between backup tunnels that protect independent links. As a reminder, the backup tunnel is used during rerouting timesin other words, from the time the node immediately upstream of the failure triggers Fast Reroute to the reoptimization of the TE LSP by its headend router. In the case of the Globenet network, such rerouting times have been evaluated to likely be less than 1 second in the worst case. This means that such a backup tunnel would be used for at most 1 second. The second aspect of the study consisted of evaluating for each link failure the potential congestion that may occur along a backup tunnel provisioned with zero bandwidth. The simulations showed that even in Asia, where links (ATM VCs) are sized upon the traffic demands (with some margin) and link utilizations are pretty high, worst-case scenarios implied getting up to 80 percent of real-time traffic and 120 percent of non-real-time traffic onto some links during the rerouting period (less than 1 second). Globenet considered this satisfactory with respect to its SLAs. Thus, it chose to provision the set of next-hop backup tunnels with zero bandwidth. (The backup tunnels would then follow the IGP shortest path that avoids the protected link.)

Figure 5-45 shows the set of configured backup tunnels for the node of Washington. It shows a set of next-hop backup tunnels configured to protect the traffic from the failure of any of the attached links of the Washington node. Note that two backup tunnels are required for each protected link (one in each direction), although just one of them is shown in Figure 5-45 for the sake of clarity.

Such backup tunnels would protect any TE LSPs from a link or router interface failure in the core. But what about the intra-POP links (between PE routers and P routers)? Although such failures are less frequent compared to the long-distance links in the core, Globenet wanted to use Fast Reroute in case a router interface failed (PE router or P router). Because the mesh of TE LSPs is between the P routers, Globenet had to choose a specific network design for the intra-POP links protected by Fast Reroute.

The solution was to configure unconstrained one-hop primary TE LSPs between each PE router and P router, along with an appropriate diversely routed tunnel. Consider the Paris POP, shown in Figure 5-46 (a Type 1a POP).

hostname Globenet.Newyork.P1
!
interface pos3/0
isis hello-interval 1
isis hello-multiplier 4
!
router isis
lsp-gen 5 10 20
spf-interval 5 80 20
prc-interval 5 80 20