MPLS TE Tunnel Protection Group

A tunnel protection group implements E2E MPLS TE tunnel protection. If a working tunnel in a protection group fails, traffic quickly switches to a protection tunnel, minimizing traffic interruptions.

Related Concepts

As shown in Figure 1, concepts related to a tunnel protection group are as follows:

Working tunnel: a tunnel to be protected.
Protection tunnel: a tunnel that protects a working tunnel.
Protection switchover: quickly switches traffic from a faulty working tunnel to a protection tunnel in a tunnel protection group, which improves network reliability.

Figure 1 Tunnel protection group

A working tunnel (tunnel-1) and a protection tunnel (tunnel-2) are established on LSRA on the network shown in Figure 1.

On LSRA (ingress), tunnel-2 is configured as the protection tunnel for tunnel-1 (working tunnel). If the ingress detects a fault in tunnel-1, traffic switches to tunnel-2, and LSRA attempts to reestablish tunnel-1. If tunnel-1 is successfully established, LSRA determines whether to switch traffic back to the working tunnel based on the configured policy.

Implementation

An MPLS TE tunnel protection group uses a pre-configured protection tunnel to protect traffic on the working tunnel to improve tunnel reliability. Therefore, networking planning needs to be performed before you deploy MPLS TE tunnel protection groups. To ensure the improved performance of the protection tunnel, the protection tunnel must exclude links and nodes through which the working tunnel passes.

Table 1 describes the implementation of a tunnel protection group.

**Table 1** Implementation of a tunnel protection group
No.	Process	Description
1	Establishment	The working and protection tunnels must have the same ingress and destination address. The tunnel establishment process is the same as that of as an ordinary TE tunnel. The protection tunnel can use attributes that differ from those for the working tunnel. To implement better protection, ensure that the working and protection tunnels are established over different paths as much as possible. NOTE: A protection tunnel cannot be protected or enabled with TE FRR. Attributes for a protection tunnel can be configured independently of those for the working tunnel, which facilitates network planning. The working and protection tunnels must be bidirectional. The following types of bidirectional tunnels are supported: Dynamic bidirectional associated LSPs Static bidirectional associated LSPs Static bidirectional co-routed LSPs
2	Binding	After the tunnel protection group function is enabled for a working tunnel, the working tunnel and protection tunnel are bound to form a tunnel protection group based on the tunnel ID of the protection tunnel.
3	Fault detection	MPLS OAM/MPLS-TP OAM is used to detect faults in an MPLS TE tunnel protection group, so that protection switching can be quickly triggered.
4	Protection switching	The tunnel protection group supports either of the following protection switching modes: Manual switching: The network administrator runs a command to forcibly switch traffic. Automatic switching: Traffic is automatically switched to the protection tunnel when a fault is detected on the working tunnel. A switching interval can be set for automatic switching. An MPLS TE tunnel protection group only supports bidirectional switching. Specifically, if a traffic switchover is performed for traffic in one direction, a traffic switchover is also performed for traffic in the opposite direction.
5	Switchback	After protection switching is complete, the system attempts to reestablish the working tunnel. If the working tunnel is successfully established, the system determines whether to switch traffic back to the working tunnel according to the configured switchback policy.

Differences Between CR-LSP Backup and a Tunnel Protection Group

CR-LSP backup and a tunnel protection group are both end-to-end protection mechanisms in MPLS TE. Table 2 describes the differences between the two protection mechanisms.

**Table 2** Differences between CR-LSP backup and a tunnel protection group
Item	CR-LSP Backup	Tunnel Protection Group
Protected object	Primary and backup CR-LSPs are established for the same tunnel. The backup CR-LSP protects the primary CR-LSP.	In a tunnel protection group, one tunnel protects another.
TE FRR	TE FRR protection is supported only by the primary CR-LSP, not the backup CR-LSP.	A tunnel protection group depends on a reverse LSP, and a reverse LSP does not support TE FRR. Therefore, tunnels in a tunnel protection group do not support TE FRR.
LSP attributes	The primary and backup CR-LSPs have the same attributes (such as bandwidth, setup priority, and hold priority), except for the TE FRR attribute.	The attributes of the tunnels in the protection group are independent of each other. For example, a protection tunnel without bandwidth can protect a working tunnel requiring bandwidth protection.