12 mins read
RSVP – Link/Node Protection
1. Intro
The Junos implementation of facility backup is link protection. This feature is interface based rather than LSP based. Whereas fast reroute is trying to protect the whole LSP (1:1 protection), link protection (1:n) protects only the link, however, it can protect multiple LSPs. A bypass LSP must terminate on the downstream LSR. Bypass LSPs are calculated by CSPF. You can specify administrative groups and bandwidth for Bypass LSPs.
To configure RSVP link protection we need 2 elements, otherwise it will not work:
- activate link protection on each RSVP interface where protection is desired
- activate link/node protection on the LSP itself to make it eligible to make use of the facility backup.
Link Protection protects the interface where it is configured, whereas Node Link Protection automatically protects both link and downstream node.
The topology we will use to test Link/Node Protection:
Note:
- Based on the addressing being used you will be able to identify the link.
- For example. 17.6.7.7 is a link between router 6 and 7, and this is Router 7.
- Second example. 17.1.2.1 is a link between router 1 and 2, and this is Router 1.
The startup config is the following:
root@R1# show protocols mpls | display set
set protocols mpls admin-groups BLUE 0
set protocols mpls admin-groups GREEN 1
set protocols mpls admin-groups RED 2
set protocols mpls label-switched-path TO-R7 to 17.0.0.7
set protocols mpls label-switched-path TO-R7 primary RED-PATH admin-group include-any RED
set protocols mpls label-switched-path TO-R5 to 17.0.0.5
set protocols mpls label-switched-path TO-R5 primary RED-PATH admin-group include-any RED
set protocols mpls label-switched-path TO-R8 to 17.0.0.8
set protocols mpls label-switched-path TO-R8 primary RED-PATH admin-group include-any RED
set protocols mpls path BLUE-PATH
set protocols mpls path RED-PATH
set protocols mpls interface ge-0/0/2.0 admin-group BLUE
set protocols mpls interface ge-0/0/1.0 admin-group RED
set protocols mpls interface ge-0/0/1.0 admin-group GREEN
root@R1# run show rsvp session ingress
Ingress RSVP: 3 sessions
To From State Rt Style Labelin Labelout LSPname
17.0.0.5 17.0.0.1 Up 0 1 FF - 300704 TO-R5
17.0.0.7 17.0.0.1 Up 0 1 SE - 300688 TO-R7
17.0.0.8 17.0.0.1 Up 0 1 FF - 300720 TO-R8
Total 3 displayed, Up 3, Down 0As we can see, we have 3 LSPs: R1-to-R5, R1-to-R8, R1-to-R7. We want to protect all LSPs, so we will do this in the next section:
2. Link Protect basic config
Let’s protect the 3 LSPs: 3 LSPs: R1-to-R5, R1-to-R8, R1-to-R7. The 1st router in the path is R2, so let’s protect the R2-to-R4 link:
### Let's configure and commit the R2 router (interface to R4):
root@R2# set protocols rsvp interface ge-0/0/3 link-protection
### We know that we must also configure and commit link-protection on the LSP:
root@R1# set protocols mpls label-switched-path TO-R7 link-protection
### We can see the bypass is UP, and it is protecting one LSP,
### because we configured only one LSP for link protection:
root@R2# run show rsvp interface ge-0/0/3.0 extensive
ge-0/0/3.0 Index 359, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.2.4.2
ActiveResv 3, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 1, LSP: 1, Protected LSP: 1, Unprotected LSP: 0
1 Jul 29 02:25:25 New bypass Bypass->17.2.4.4
Bypass: Bypass->17.2.4.4, State: Up, Type: LP, LSP: 1, Backup: 0
4 Jul 29 02:25:27 Up
3 Jul 29 02:25:27 Record Route: 17.2.3.3(Label=301216) 17.3.4.4(Label=3)
2 Jul 29 02:25:27 CSPF: computation result accepted
1 Jul 29 02:25:25 Originate Call
### Let's configure one more LSP for link-protection:
root@R1# show | compare
com[edit protocols mpls label-switched-path TO-R5]
+ link-protection;
[edit]
root@R1# commit
commit complete
### We can now see Link protection is desired for this LSP
### Also, we can see protection is down for this link,
### because no interface on this R1 router is configured for link protection.
root@R1# run show rsvp session name TO-R5 extensive
Ingress RSVP: 3 sessions
17.0.0.5
From: 17.0.0.1, LSPstate: Up, ActiveRoute: 0
LSPname: TO-R5, LSPpath: Primary
LSPtype: Static Configured
Suggested label received: -, Suggested label sent: -
Recovery label received: -, Recovery label sent: 300752
Resv style: 1 SE, Label in: -, Label out: 300752
Time left: -, Since: Wed Jul 29 03:54:17 2026
Tspec: rate 0bps size 0bps peak Infbps m 20 M 1500
Port number: sender 1 receiver 40596 protocol 0
Link protection desired
Type: Protection down
1 Jul 29 03:54:19 Link protection disabled on outbound interface[2 times, first Jul 29 03:54:18 ]
Enhanced FRR: Enabled (Downstream)
PATH rcvfrom: localclient
Adspec: sent MTU 1500
Path MTU: received 1500
PATH sentto: 17.1.2.2 (ge-0/0/1.0) 1 pkts
outgoing message state: refreshing, Message ID: 379, Epoch: 10474068
RESV rcvfrom: 17.1.2.2 (ge-0/0/1.0) 3 pkts, Entropy label: Yes
incoming message handle: R-2066/3, Message ID: 424, Epoch: 10474044
Explct route: 17.1.2.2 17.2.4.4 17.4.5.5
Record route: <self> 17.0.0.2 (node-id) 17.1.2.2 17.0.0.4 (node-id) 17.2.4.4 17.0.0.5 (node-id) 17.4.5.5
Total 1 displayed, Up 1, Down 0
Egress RSVP: 1 sessions, 1 detours
Total 0 displayed, Up 0, Down 0
Transit RSVP: 1 sessions
Total 0 displayed, Up 0, Down 0
### At R2, link protection was already configured and up.
### We can now see the protected LSP is 2:
root@R2# run show rsvp interface ge-0/0/3.0 extensive
ge-0/0/3.0 Index 359, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.2.4.2
ActiveResv 3, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 1, LSP: 2, Protected LSP: 2, Unprotected LSP: 0
1 Jul 29 02:25:25 New bypass Bypass->17.2.4.4
Bypass: Bypass->17.2.4.4, State: Up, Type: LP, LSP: 2, Backup: 0
10 Jul 29 02:30:51 Up
9 Jul 29 02:30:51 Record Route: 17.1.2.1(Label=299824) 17.1.3.3(Label=301232) 17.3.4.4(Label=3)
8 Jul 29 02:30:51 CSPF: computation result accepted
7 Jul 29 02:30:49 Clear Call
6 Jul 29 02:30:49 No Route toward dest
5 Jul 29 02:30:49 Down
4 Jul 29 02:25:27 Up
3 Jul 29 02:25:27 Record Route: 17.2.3.3(Label=301216) 17.3.4.4(Label=3)
2 Jul 29 02:25:27 CSPF: computation result accepted
1 Jul 29 02:25:25 Originate Call
### So, we can consider configuring link-protection also on R1:
root@R1# show | compare
[edit protocols rsvp interface ge-0/0/1.0]
+ link-protection;
[edit]
root@R1# commit
commit complete
### Now, protection is UP also on R1:
root@R1# run show rsvp session name TO-R5 extensive
Ingress RSVP: 4 sessions
17.0.0.5
From: 17.0.0.1, LSPstate: Up, ActiveRoute: 0
LSPname: TO-R5, LSPpath: Primary
LSPtype: Static Configured
Suggested label received: -, Suggested label sent: -
Recovery label received: -, Recovery label sent: 300752
Resv style: 1 SE, Label in: -, Label out: 300752
Time left: -, Since: Wed Jul 29 03:54:17 2026
Tspec: rate 0bps size 0bps peak Infbps m 20 M 1500
Port number: sender 1 receiver 40596 protocol 0
Link protection desired
Type: Link protected LSP, using Bypass->17.1.2.2
3 Jul 29 03:59:49 Link protection up, using Bypass->17.1.2.2
2 Jul 29 03:59:19 Bypass in down state, Bypass->17.1.2.2
1 Jul 29 03:58:49 Link protection disabled on outbound interface[11 times, first Jul 29 03:54:18 ]
Enhanced FRR: Enabled (Downstream), LP-MP is 17.0.0.2
PATH rcvfrom: localclient
Adspec: sent MTU 1500
Path MTU: received 1500
PATH sentto: 17.1.2.2 (ge-0/0/1.0) 2 pkts
outgoing message state: refreshing, Message ID: 382, Epoch: 10474068
RESV rcvfrom: 17.1.2.2 (ge-0/0/1.0) 4 pkts, Entropy label: Yes
incoming message handle: R-2066/4, Message ID: 427, Epoch: 10474044
Explct route: 17.1.2.2 17.2.4.4 17.4.5.5
Record route: <self> 17.0.0.2 (node-id) 17.1.2.2 17.0.0.4 (node-id) 17.2.4.4 17.0.0.5 (node-id) 17.4.5.5
Total 1 displayed, Up 1, Down 0
Egress RSVP: 1 sessions, 1 detours
Total 0 displayed, Up 0, Down 0
Transit RSVP: 1 sessions
Total 0 displayed, Up 0, Down 0
root@R1# run show rsvp interface ge-0/0/1.0 extensive
ge-0/0/1.0 Index 357, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.1.2.1
ActiveResv 3, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 1, LSP: 2, Protected LSP: 2, Unprotected LSP: 0
1 Jul 29 03:59:19 New bypass Bypass->17.1.2.2
Bypass: Bypass->17.1.2.2, State: Up, Type: LP, LSP: 2, Backup: 0
4 Jul 29 03:59:21 Up
3 Jul 29 03:59:21 Record Route: 17.1.3.3(Label=301248) 17.2.3.2(Label=3)
2 Jul 29 03:59:21 CSPF: computation result accepted
1 Jul 29 03:59:19 Originate Call
### For the last LSP, let's configure node-link-protection instead:
root@R1# set protocols mpls label-switched-path TO-R8 node-link-protection
[edit]
root@R1# show | compare
[edit protocols mpls label-switched-path TO-R8]
+ node-link-protection;
[edit]
root@R1# commit
commit complete
### At both R1 and R2 routers we can see now Bypass paths for node protection:
root@R1# run show rsvp interface ge-0/0/1.0 extensive
ge-0/0/1.0 Index 357, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.1.2.1
ActiveResv 3, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 2, LSP: 3, Protected LSP: 3, Unprotected LSP: 0
2 Jul 29 04:01:53 New bypass Bypass->17.1.2.2->17.2.4.4
1 Jul 29 03:59:19 New bypass Bypass->17.1.2.2
Bypass: Bypass->17.1.2.2, State: Up, Type: LP, LSP: 2, Backup: 0
4 Jul 29 03:59:21 Up
3 Jul 29 03:59:21 Record Route: 17.1.3.3(Label=301248) 17.2.3.2(Label=3)
2 Jul 29 03:59:21 CSPF: computation result accepted
1 Jul 29 03:59:19 Originate Call
Bypass: Bypass->17.1.2.2->17.2.4.4, State: Up, Type: NP, LSP: 1, Backup: 0
4 Jul 29 04:01:55 Up
3 Jul 29 04:01:55 Record Route: 17.1.3.3(Label=301296) 17.3.4.4(Label=3)
2 Jul 29 04:01:55 CSPF: computation result accepted
1 Jul 29 04:01:53 Originate Call
root@R2# run show rsvp interface ge-0/0/3.0 extensive
ge-0/0/3.0 Index 359, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.2.4.2
ActiveResv 3, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 2, LSP: 3, Protected LSP: 3, Unprotected LSP: 0
2 Jul 29 04:01:51 New bypass Bypass->17.2.4.4->17.4.5.5
1 Jul 29 02:25:25 New bypass Bypass->17.2.4.4
Bypass: Bypass->17.2.4.4, State: Up, Type: LP, LSP: 2, Backup: 0
10 Jul 29 02:30:51 Up
9 Jul 29 02:30:51 Record Route: 17.1.2.1(Label=299824) 17.1.3.3(Label=301232) 17.3.4.4(Label=3)
8 Jul 29 02:30:51 CSPF: computation result accepted
[...]
Bypass: Bypass->17.2.4.4->17.4.5.5, State: Up, Type: NP, LSP: 1, Backup: 0
4 Jul 29 04:01:53 Up
3 Jul 29 04:01:53 Record Route: 17.2.3.3(Label=301280) 17.3.6.6(Label=301328) 17.5.6.5(Label=3)
2 Jul 29 04:01:53 CSPF: computation result accepted
1 Jul 29 04:01:51 Originate Call
### No longer shown here, but for more consistency, change all LSP to node protection. 3. Simulate some links down:
### After disabling a few links, particularly disable R2-to-R4 link:
root@R4# show | compare
[edit interfaces ge-0/0/3]
+ disable;
[edit]
root@R4# commit
commit complete
### We can see the events and labels on the LSP:
root@R1# run show mpls lsp name TO-R7 extensive
Ingress LSP: 3 sessions
17.0.0.7
From: 17.0.0.1, State: Up, ActiveRoute: 0, LSPname: TO-R7, LSPid: 12
ActivePath: RED-PATH (primary)
Node/Link protection desired
LSPtype: Static Configured, Penultimate hop popping
LoadBalance: Random
Follow destination IGP metric
Encoding type: Packet, Switching type: Packet, GPID: IPv4
LSP Self-ping Status : Enabled
*Primary RED-PATH State: Up
Priorities: 7 0
SmartOptimizeTimer: 180
Include Any: RED
Flap Count: 1
MBB Count: 1
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 5000)
17.1.2.2 S 17.2.4.4 S 17.4.5.5 S 17.5.8.8 S 17.7.8.7 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt 20=Node-ID):
17.0.0.2(flag=0x2b) 17.1.2.2(flag=0xb Label=300960) 17.5.6.5(Label=300928) 17.0.0.8(flag=0x20) 17.5.8.8(Label=300736) 17.0.0.7(flag=0x20) 17.7.8.7(Label=3)
92 Jul 29 04:49:40.805 CSPF failed: no route toward 17.0.0.7
91 Jul 29 04:49:40.804 CSPF: link down/deleted: 17.2.4.2(17.0.0.2:359)(17.0.0.2)->17.2.4.4(17.0.0.4:0)(17.0.0.4)
90 Jul 29 04:49:37.134 Link-protection Up
89 Jul 29 04:49:36.879 Record Route: 17.0.0.2(flag=0x2b) 17.1.2.2(flag=0xb Label=300960) 17.5.6.5(Label=300928) 17.0.0.8(flag=0x20) 17.5.8.8(Label=300736) 17.0.0.7(flag=0x20) 17.7.8.7(Label=3)
88 Jul 29 04:49:36.875 CSPF failed: no route toward 17.0.0.7
87 Jul 29 04:49:36.874 17.1.2.2: Tunnel local repaired
86 Jul 29 04:49:36.872 CSPF failed: no route toward 17.0.0.7
85 Jul 29 04:49:36.872 17.1.2.2: Tunnel local repaired[2 times, first Jul 29 04:49:36.872]
84 Jul 29 04:49:36.867 Link-protection Down
83 Jul 29 04:49:33.136 Link-protection Up
82 Jul 29 04:49:32.686 Link-protection Down
81 Jul 29 04:43:23.080 Make-before-break: Cleaned up old instance: Hold dead expiry
80 Jul 29 04:42:29.131 Link-protection Up
79 Jul 29 04:42:29.131 Link-protection Down
78 Jul 29 04:42:10.130 Link-protection Up
[...]
root@R2# run show rsvp interface ge-0/0/3.0 extensive
ge-0/0/3.0 Index 359, State Ena/Up
NoAuthentication, Aggregate, Reliable, LinkProtection
HelloInterval 9(second)
Address 17.2.4.2
ActiveResv 0, PreemptionCnt 0, MaxResvTh 0bps, 0%
Update threshold 10.000%, UpdateThresholdValue 100Mbps
Subscription 100%, Actual 100%
bc0 = ct0, StaticBW 1000Mbps
ct0: StaticBW 1000Mbps, AvailableBW 1000Mbps
MaxAvailableBW 1000Mbps = (bc0*subscription)
ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps
Protection: On, Bypass: 1, LSP: 3, Protected LSP: 3, Unprotected LSP: 0
3 Jul 29 04:44:57 Delete bypass Bypass->17.2.4.4, inactivity timeout
2 Jul 29 04:01:51 New bypass Bypass->17.2.4.4->17.4.5.5
1 Jul 29 02:25:25 New bypass Bypass->17.2.4.4
Bypass: Bypass->17.2.4.4->17.4.5.5, State: Up, Type: NP, LSP: 3, Backup: 3
4 Jul 29 04:01:53 Up
3 Jul 29 04:01:53 Record Route: 17.2.3.3(Label=301280) 17.3.6.6(Label=301328) 17.5.6.5(Label=3)
2 Jul 29 04:01:53 CSPF: computation
11:30:33.513740 MPLS (label 301328, exp 0, ttl 62) (label 300832, exp 0, ttl 63) (label 16, exp 0, [S], ttl 64) IP 192.168.1.1 > 192.168.7.1: ICMP echo request, id 39552, seq 4518, length 64
### On packet capture from the bypass links (R1-to-R6), we can see the stacked labels:
11:49:55.159851 MPLS (label 301328, exp 0, ttl 62) (label 300928, exp 0, ttl 63) (label 16, exp 0, [S], ttl 64) IP 192.168.1.1 > 192.168.7.1: ICMP echo request, id 49541, seq 3973, length 64
### label 300928 is the original LSP label.
### label 301328 is the stacked Bypass label. External Resources: