FRR: locators, the SID Manager, IS-IS SRv6 and TI-LFA

Episode 2 — Zero protected, and a draft that stopped being one

The situation · Dell lab conference room, Round Rock, 09:00 on day two

The operator’s question from last night is on the whiteboard; the architect’s is underneath it. Zero prefixes protected on a fabric where every node has the fast-reroute command configured — and a change-control policy that blocks pre-standard features, which the architect says takes TI-LFA out of the bake-off entirely. The design under both questions is the one Friday’s report has to defend: a four-node SRv6 core with a Dell SONiC box as pure IPv6 transit.^[7] Procurement asks whether fast reroute is a licensed feature — wrong question, right moment: nobody has measured what the fabric protects.

The first objection has expired. draft-ietf-rtgwg-segment-routing-ti-lfa was published as RFC 9855, Proposed Standard, in October 2025.^[6] The second is a configuration node, not a defect: FRR’s command is per interface, isis fast-reroute ti-lfa level-2 node-protection link-fallback, and typed under router isis it protects nothing and says nothing.^[2]

TI-LFA exists to make repair deterministic. The point of local repair pre-computes the post-convergence shortest path tree without the failed resource and encodes the detour as a loop-free segment list that steers the packet from P-space into Q-space.^[6] Node SIDs are preferred over long adjacency lists because Maximum SID Depth is a real hardware limit — the same MSD whose IS-IS values are treated as zero when nobody advertises them, which is its own way of dropping traffic silently.^[6]^[5]

Protection is a property of an interface, not of a router — and an MSD nobody advertises reads as zero. Both answers live in the FRR configuration tree, so start where the SIDs come from.

1zebra owns the address space: locators and the SID Manager

Everything SRv6 in FRR starts in zebra, because zebra owns the block of IPv6 space you set aside for SIDs and hands chunks of it to the daemons that ask. The configuration path is configure terminal then segment-routing → srv6 → locators → locator NAME.^[1]

Inside a locator there is one command that matters: prefix X:X::X:X/M [block-len (16-64)] [node-len (16-64)] [func-bits (0-64)].^[1] FRR states the constraint verbatim: “block-len, node-len and func-bits may be any value as long as block-len+node-len = locator-len and block-len+node-len+func-bits <= 128.”^[1] The first half ties the split to the prefix length you typed; the second is RFC 8986’s rule that L plus F plus A must not exceed 128 bits.^[11]

The defaults will surprise anyone coming from a uSID deployment. “When both block-len and node-len are omitted, the following default values are used: block-len = 24, node-len = prefix-len-24”, and “the function bits range is 16 bits by default”.^[1] So a bare prefix fcbb:bbbb:1::/48 gives you 24/24/16 — not the F3216 profile that RFC 9800 makes mandatory-to-implement and that Linux, Cumulus and every uSID deployment assume.^[9] In a uSID lab you type block-len 32 node-len 16 func-bits 16 every time.

Two more knobs complete the picture. behavior usid marks the locator as a micro-segment locator: “all the SRv6 SIDs allocated from the locator by the routing protocols are bound to the SRv6 uSID behaviors… BGP instantiates and advertises SRv6 uSID behaviors (e.g., uDT4 / uDT6 / uDT46) instead of classic SRv6 behaviors.”^[1] format NAME selects the allocation schema, and FRR supports exactly two: usid-f3216 and uncompressed.^[1] Separately, segment-routing → srv6 → encapsulation → source-address X:X::X:X sets the source address of the outer encapsulating IPv6 header.^[1]

Each locator also gets a default SID with the End local function, “usually allocated as PREFIX:1::”, and zebra divides the block into chunks and tracks who owns each one — owner system means unclaimed, owner isis or bgp means a daemon holds it.^[1] That ownership view is what show segment-routing srv6 sid prints, with columns SID, Behavior, Context, Daemon/Instance, Locator and Allocation Type; a healthy uSID node shows rows like fcbb:bbbb:1:: uN - isis(0) MAIN dynamic and fcbb:bbbb:1:e000:: uA Interface 'eth-sw1' isis(0) MAIN dynamic.^[1]

2staticd: the uSID-only static SID node

When there is no IGP or BGP to allocate SIDs — the Cumulus case, and the controller-driven SONiC case — SIDs are configured by hand under segment-routing → srv6 → static-sids:^[3]

segment-routing
 srv6
  static-sids
   sid fcbb:bbbb:1:fe01::/64 locator LOC1 behavior uDT6 vrf Vrf1
   sid fcbb:bbbb:1:fe02::/64 locator LOC1 behavior uDT4 vrf Vrf1
   sid fcbb:bbbb:1:fe03::/64 locator LOC1 behavior uDT46 vrf Vrf2
   sid fcbb:bbbb:1:fe04::/64 locator LOC1 behavior uA interface eth0 nexthop 2001::2

^[3] The grammar is sid X:X::X:X/M locator NAME behavior <uN|uA|uDT4|uDT6|uDT46> [vrf VRF] [interface IFNAME [nexthop X:X::X:X]], and FRR states the rules plainly: “if the action is set to ‘uN’, no vrf should be set. For uDT4, uDT6 and uDT46, it is necessary to specify a specific vrf. The uA behavior requires the outgoing interface and optionally the IPv6 address of the Layer 3 adjacency.”^[3]

Read what is missing. There is no classic End or End.DT46 under static-sids at all — staticd offers only the uSID behaviors.^[3] If a customer wants a statically configured RFC 8986 End on FRR, the answer is a Linux seg6local route, not staticd. This is also why the Cumulus Linux command surface in the next lesson looks the way it does: it is this node, exposed through NVUE.

Historically, static-sids arrived in FRR 10.3 (2025-03-21, “Add support for SRv6 static SIDs”, PR #16894) and uA in FRR 10.4 (2025-07-21).^[4] Anything older than 10.4 cannot do the configuration above, which is the first version question to ask about any FRR you did not build yourself.

3isisd: RFC 9352, one dummy interface, and the MSD trap

FRR’s IS-IS extensions implement RFC 9352 directly: “This feature enables extensions in IS-IS to support Segment Routing over IPv6 data plane (SRv6) as per RFC 9352.”^[2]^[5] The configuration is two lines inside the IS-IS instance:

router isis FOO
 net 49.0001.1111.1111.1111.00
 is-type level-2-only
 metric-style wide
 segment-routing srv6
  locator loc1

^[2] “Once the locator is configured, IS-IS automatically allocates prefix SID and adjacency SIDs, creates local SID entries in the data plane, and advertises them in the IGP domain.”^[2]

The step that is easy to miss is the dummy interface. Under segment-routing srv6, interface NAME specifies “the dummy interface used to install SRv6 SIDs in the Linux data plane. The interface must be created manually. By default, the interface is ‘sr0’.”^[2] FRR will not create it for you:

ip link add sr0 type dummy
ip link set sr0 up

^[2] Without it, IS-IS allocates SIDs, advertises them, and installs nothing — the control plane looks perfect and ip -6 route show | grep seg6local is empty.

Then the interop trap. RFC 9352 defines four IGP MSD types carried as sub-TLVs: 41 SRH Max Segments Left, 42 SRH Max End Pop, 44 SRH Max H.encaps and 45 SRH Max End D.^[5] Each has the same devastating default: for type 41, “If no value is advertised, the supported value is 0”; for 42, “if the advertised value is zero or no value is advertised, then the router cannot apply PSP or USP flavors”; for 44, a zero means the headend “can apply an SR Policy that only contains one segment without inserting any SRH header”; for 45, a zero means the router “cannot apply any behavior that results in decapsulation and forwarding of the inner packet if the outer IPv6 header contains an SRH”.^[5] Silence and zero are indistinguishable, so a node that simply never advertised looks like a node that supports nothing, and a headend that believes it drops or refuses to build the path. Node MSDs ride in a Router Capability TLV sub-TLV; link MSDs ride in sub-TLVs of TLVs 22, 23, 25, 141, 222 and 223.^[5]

Two other RFC 9352 objects are worth recognising in a decode: the SRv6 Capabilities sub-TLV, type 25, in the Router Capability TLV, whose only defined flag is the O-flag for RFC 9259 OAM, and the SRv6 Locator TLV, type 27, which carries the MTID and the locator entries.^[5]

3 segments · 40 B overhead

hop 1 / 6

containerlab Linux/FRR · uSID carrier

1. PE1 · Linux + FRR

SR source nodePUSH

Encapsulate with one CSID container as the Destination Address: fcbb:bbbb:2:3:4:e001::. No SRH is pushed — RFC 8986 §5.2 lets H.Encaps.Red omit it when the policy is a single segment.

The SR source node encapsulates: it pushes an outer IPv6 header whose Destination Address is the FIRST segment, and (for the uncompressed encodings) an SRH holding the rest. RFC 8402 calls this PUSH. The inner packet's Hop Limit is decremented once, here.

Packet state after this hop

Destination Address fcbb:bbbb:2:3:4:e001::

Segments Left n/a (no SRH)

SRH no SRH · 4 of 6 CSIDs · End-of-Carrier 0000 padding

Encapsulation overhead 40 B

Predict: what will the Destination Address be after the next hop? (optional, saved)

FAE angle: "SR supports per-flow explicit routing while maintaining per-flow state only at the ingress nodes to the SR domain" (RFC 8402 §1). The fabric holds no policy state — that is the whole scaling argument against RSVP-TE.

ip -6 route add 2001:db8:cafe::/64 encap seg6 mode encap.red \
  segs fcbb:bbbb:2:3:4:e001:: dev eth1
# one CSID container = one segment: encap.red omits the SRH entirely.

uSID carrier

RFC 9800 NEXT-C-SID, F3216: a 32-bit Locator-Block and 16-bit CSIDs, up to floor((128-32)/16) = 6 CSIDs in one 128-bit container, padded with the reserved End-of-Carrier 0000. One segment means no SRH at all — 40 bytes of overhead and Segments Left never enters the picture. RFC 9800 never uses the word "uSID"; that is industry vocabulary for this flavor.

Same path, three encodings: full SRH 96 B · reduced 80 B · uSID 40 B. The IPv6 floor is 1280 octets, so this is the number the MTU conversation turns on.

RFC 8986 §4–§5 — behaviors · encoding source · PUSH / NEXT / CONTINUE

Four FRR nodes around a vrnetlab/dell_sonic:4.5.1 node that is pure IPv6 transit. Three segments.

Walk the containerlab fabric hop by hop. Predict the destination address after each hop before revealing it, then switch the encoding to srh and count how many hops change from doing nothing to doing work.

4TI-LFA, now RFC 9855

Fast reroute was the last piece of segment routing still living in a draft, and it stopped being one: draft-ietf-rtgwg-segment-routing-ti-lfa was published as RFC 9855, “Topology Independent Fast Reroute Using Segment Routing”, Proposed Standard, October 2025.^[6] That is worth saying out loud to a customer whose change-control policy blocks pre-standard features: the objection expired in October 2025.

The mechanism in one paragraph. The point of local repair pre-computes the post-convergence shortest path tree without the failed resource and encodes the repair as a loop-free segment list.^[6] RFC 9855 defines P-space as “the set of routers reachable from R using the pre-convergence shortest paths without any of those paths (including equal-cost path splits) transiting through X”, and Q-space as “the set of routers from which R can be reached without any path (including equal-cost path splits) transiting through X”; a repair list steers the packet from P into Q.^[6] A pure adjacency-SID repair list is always available in theory but “may create very long SID lists that hardware may not be able to handle due to Maximum SID Depth (MSD) limitations”, which is why node SIDs are preferred — “the usage of Node-SIDs allow for maximizing ECMPs over the backup path”.^[6] That is the same MSD from Segment 3, showing up in a second place.

SRv6 gets a small break here. RFC 9855 §7.2: “The TI-LFA path computation algorithm is the same as in the SR-MPLS data plane. Note, however, that the Adjacency SIDs are typically globally routed. In such a case, there is no need for preceding an Adjacency SID with a Prefix-SID, and the resulting RL is likely shorter.”^[6]

In FRR it is one per-interface command:

interface eth1
 ip router isis FOO
 isis fast-reroute ti-lfa level-2 node-protection link-fallback

^[2] The grammar is isis fast-reroute ti-lfa [level-1|level-2] [node-protection [link-fallback]], and FRR documents link-fallback as enabling “the computation and use of link-protecting LFAs for destinations unprotected by node protection”.^[2] Omit it and node protection can leave prefixes bare with no warning.

Verification is show isis fast-reroute summary [level-1|level-2] and show isis route [level-1|level-2] [prefix-sid] [backup].^[2] Router-level knobs exist too — fast-reroute priority-limit, fast-reroute lfa tiebreaker [downstream|lowest-backup-metric|node-protecting] index (1-255), fast-reroute load-sharing disable — and by default “loopback prefixes have medium priority and non-loopback prefixes have low priority”, which matters if you set a priority limit and wonder why service prefixes went unprotected.^[2]

5The containerlab fabric and the verification ladder

The topology this module builds is four FRR containers around the vrnetlab/dell_sonic:4.5.1 node acting as pure IPv6 transit.^[7] That is architecturally correct rather than a compromise: RFC 8754 requires nothing SR-specific of a transit node — it forwards on the destination address like any IPv6 router.^[10]

Rendering diagram…

Diagram source (Mermaid)

flowchart LR
  H1[host1] --> R1[frr1 loc fcbb:bbbb:1::/48 uN]
  R1 --> D[dell_sonic 4.5.1 IPv6 transit only]
  D --> R2[frr2 loc fcbb:bbbb:2::/48 uN]
  R2 --> H2[host2]
  R1 -. IS-IS level-2 .- R2
  R1 -. TI-LFA backup .- R3[frr3 loc fcbb:bbbb:3::/48]
  R3 --> R2

Only the FRR nodes hold SIDs. The Dell node forwards IPv6 and appears in no segment list - which is exactly what RFC 8754 asks of a transit node.

It is also the honest design. Containerlab’s own documented session shows the Dell SONiC VM reporting Hello, this is FRRouting (version 8.2.2). — a version that predates the SID Manager (10.2), static SIDs (10.3) and uA (10.4) entirely.^[7]^[4] So step one of the lab is vtysh -c "show version" inside the Dell node, and writing down the answer. Do not design an FRR-SRv6 lab around that node until you have. While you are there: the node takes about two minutes to boot, default credentials are admin:admin, eth1 maps to Ethernet0 and each new port maps to the previous plus four, data interfaces get no addressing automatically, and a startup config must be supplied in full because partial configuration is not supported.^[7]

The verification ladder, in order, each rung eliminating one class of cause:

show segment-routing srv6 locator detail     # does zebra have the block, with the right lengths?
show segment-routing srv6 sid                # has any daemon claimed SIDs from it?
ip -6 route show | grep seg6local            # did they reach the data plane? (sr0 check)
show isis segment-routing srv6 node          # do neighbours see them?
show isis fast-reroute summary               # is anything actually protected?

^[1]^[2] Useful debugs when a rung fails: debug isis sr-events, debug isis lfa, debug isis route-events, debug isis spf-events.^[2] And one BGP fact that belongs in your head even though services are module 3: srv6-only is on by default the moment a locator is configured under router bgp, so existing MPLS VPN updates become invalid until you type no srv6-only.^[8]

Bring up one FRR node as a uSID endpoint: worked, faded, then yours

Goal: node frr1 becomes an SRv6 endpoint with locator fcbb:bbbb:1::/48 in the F3216 profile, advertising over IS-IS level 2, with TI-LFA on its two IS-IS interfaces.

Step 0 — version gate. vtysh -c "show version". You need 10.4 or newer for static-sids ... behavior uA; 10.2 is the floor for the SID Manager at all.^[4] Record the version in your notes; every later surprise gets checked against it first.

Step 1 — the dummy interface, before any FRR configuration.

ip link add sr0 type dummy
ip link set sr0 up
ip link show sr0

Expect state UNKNOWN and flags UP — a dummy is never LOWER_UP and that is fine.^[2]

Step 2 — the locator, with all three lengths typed out.

vtysh -c 'configure terminal' \
      -c 'segment-routing' -c 'srv6' -c 'locators' \
      -c 'locator loc1' \
      -c 'prefix fcbb:bbbb:1::/48 block-len 32 node-len 16 func-bits 16' \
      -c 'behavior usid'

Do not rely on the defaults: they are 24 and prefix minus 24, which would give 24/24 and take you off the F3216 profile every other implementation assumes.^[1]^[9]

Step 3 — IS-IS claims the locator.

router isis FOO
 net 49.0001.1111.1111.1111.00
 is-type level-2-only
 metric-style wide
 segment-routing srv6
  locator loc1

^[2]

Step 4 — TI-LFA on each IS-IS interface, not on the process.

interface eth1
 ip router isis FOO
 isis fast-reroute ti-lfa level-2 node-protection link-fallback
!
interface eth2
 ip router isis FOO
 isis fast-reroute ti-lfa level-2 node-protection link-fallback

^[2]

Step 5 — climb the ladder. show segment-routing srv6 locator detail (block 32, node 16, function 16); show segment-routing srv6 sid (a uN row owned by isis(0)); ip -6 route show | grep seg6local (the same SID as a kernel route); show isis segment-routing srv6 node on a neighbour (frr1’s locator visible); show isis fast-reroute summary (protected prefixes greater than zero).^[1]^[2]

Step 6 — prove the repair. Start a ping across the fabric, drop one IS-IS link with ip link set eth1 down on the far side, and record the loss. Rollback: ip link set eth1 up. Compare against the same test with TI-LFA removed from the interface.

What the LSP says

How it ended

The summary goes from zero to near-total the moment the command moves under the interfaces, and link-fallback picks up the prefixes that node protection left bare.^[2] Before calling the fabric protected you dump the IS-IS LSP and confirm all four MSD types are advertised non-zero on every node in the path, because silence and zero are indistinguishable there.^[5]

What you say to the architect: TI-LFA has been RFC 9855 since October 2025, and the number that decides whether you actually have it is per interface, not per router.^[6]^[2] He writes both halves down, then turns the quote around, taps the line with the Spectrum-4 leaves, and asks whether those switches do all of this too — because slide four of tomorrow’s deck says they replace his MPLS WAN.

Lab

Mutating steps ahead. Needs a maintenance window, out-of-band access (BMC/iDRAC/rshim console) and a rollback path. Record the pre-flight inventory before changing anything. Never on a production host.

Goal: prove a BlueField-3 Arm can be a real IS-IS SRv6 endpoint, and read its MSD advertisements from a remote node.

Pre-flight inventory on the BlueField-3 Arm: uname -r, vtysh -c 'show version' (or the FRR package version), ip -6 addr show, ip link show sr0 (expect: does not exist), and the current net.ipv6.conf.all.seg6_enabled. Record all of it.
Bring the ConnectX port that faces the containerlab fabric up with an IPv6 address and confirm reachability to one FRR container. Rollback: ip -6 addr del.
Kernel check on the Arm from lesson 2.1 — CONFIG_IPV6_SEG6_LWTUNNEL and CONFIG_NET_L3_MASTER_DEV, plus sysctl -w net.ipv6.conf.<port>.seg6_enabled=1. Rollback: the same line with =0.^[1]
ip link add sr0 type dummy && ip link set sr0 up on the Arm. Rollback: ip link del sr0.^[2]
Configure one FRR instance on the Arm: locator fcbb:bbbb:9::/48 block-len 32 node-len 16 func-bits 16, behavior usid, router isis with segment-routing srv6 / locator loc1, peered by IS-IS over the ConnectX port. Rollback: no segment-routing and no router isis <tag> in vtysh, then restore the saved configuration file.^[1]^[2]
From a remote containerlab node, run show isis segment-routing srv6 node and confirm the DPU’s locator and SIDs appear. This is the pass condition for the whole lab.^[2]
The high-value diagnostic: dump the IS-IS LSP the DPU originates and confirm all four MSD types — 41, 42, 44, 45 — are advertised and non-zero. If any is absent, record it: an unadvertised MSD is read as zero by every peer, and this is the single check that most often explains “the endpoint drops our packets”.^[5]
Restore to the step 0 inventory: remove the FRR SRv6 configuration, delete sr0, reset the sysctl, remove the address.

Boundary to state out loud, not to lab: none of this is available on an NVIDIA switch. Cumulus Linux performs no IGP SRv6 SID distribution at all — its SIDs are static only — so the IS-IS half of this lesson has no Spectrum equivalent. That is the subject of the next lesson.

Evidence / notes (commands run, outputs, what surprised you)

FRR: locators, the SID Manager, IS-IS SRv6 and TI-LFA

Before you read: what do you already know?

After this lesson you can