Page MenuHomeVyOS Platform
Create Task
Maniphest T7722

Backup next-hop is not installed in IS-IS LFA as expected
In progress, NormalPublicBUG
Actions

Description

After configuration of Loop Free Alternate (LFA) in ISIS for IP-FRR, the backup next-hop is not installed into the forwarding plane.

vyos@R1# show protocols isis | commands 
set fast-reroute lfa local priority-limit medium level-2
set fast-reroute lfa local tiebreaker lowest-backup-metric
set interface eth0 network point-to-point
set interface eth1 network point-to-point
set interface eth2 network point-to-point
set interface lo passive
set level 'level-2'
set net '49.0001.1920.0000.0001.00'
[edit]
vyos@R1#
vyos@R1# run show ip route 192.0.0.4 
Routing entry for 192.0.0.4/32
  Known via "isis", distance 115, metric 20, best
  Last update 00:21:17 ago
  * 10.1.4.4, via eth2, weight 1

[edit]
vyos@R1# run show ip route forward 192.0.0.4 
192.0.0.4 nhid 30 via 10.1.4.4 dev eth2 proto isis metric 20 
[edit]
vyos@R1# run show isis fast-reroute summary 
Area VyOS:
 IS-IS L2 IPv4 Fast ReRoute summary:

 Protection \ Priority     Critical  High      Medium    Low       Total   
 --------------------------------------------------------------------------
 Classic LFA               0         0         0         0         0       
 Remote LFA                0         0         0         0         0       
 Topology Independent LFA  0         0         0         0         0       
 ECMP                      0         0         0         3         3       
 Unprotected               0         0         3         3         6       
 Protection coverage       0.00%     0.00%     0.00%     50.00%    33.33%

Details

Version
1.4.3
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

rmuino created this task.Aug 14 2025, 5:17 PM
fernando added a project: VyOS Rolling.Aug 14 2025, 5:20 PM
fernando subscribed.
pasik subscribed.Aug 14 2025, 8:32 PM
Viacheslav subscribed.Aug 15 2025, 8:34 AM

Could you share the interface configuration or topology and expected entries?
What about the latest rolling?

Viacheslav triaged this task as Normal priority.Aug 15 2025, 8:34 AM
rmuino added a comment.EditedAug 18 2025, 10:56 AM

here's the topology and full cofig. running on VyOS 2025.05.29-0019-rolling

{F16199351}

set interfaces ethernet eth0 address '10.1.3.1/24'
set interfaces ethernet eth0 description 'to_R3'
set interfaces ethernet eth0 hw-id '0c:f9:fd:41:00:00'
set interfaces ethernet eth1 address '10.1.2.1/24'
set interfaces ethernet eth1 description 'to_R2'
set interfaces ethernet eth1 hw-id '0c:f9:fd:41:00:01'
set interfaces ethernet eth2 address '10.1.4.1/24'
set interfaces ethernet eth2 description 'to_R4'
set interfaces ethernet eth2 hw-id '0c:f9:fd:41:00:02'
set interfaces ethernet eth3 hw-id '0c:f9:fd:41:00:03'
set interfaces ethernet eth4 hw-id '0c:f9:fd:41:00:04'
set interfaces loopback lo address '192.0.0.1/32'
set protocols isis fast-reroute lfa local priority-limit medium level-2
set protocols isis fast-reroute lfa local tiebreaker lowest-backup-metric
set protocols isis interface eth0 network point-to-point
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth2 network point-to-point
set protocols isis interface lo passive
set protocols isis level 'level-2'
set protocols isis net '49.0001.1920.0000.0001.00'
fernando added a comment.Aug 18 2025, 7:44 PM

bug case in frr: https://github.com/FRRouting/frr/issues/19431

rmuino added a comment.Aug 19 2025, 5:12 PM

some config is missing in FRR when configured from VyOS CLI:

isis fast-reroute lfa level-2

is requiered at interface level but this option is not available from VyOS CLI.

nterface eth0
 ip router isis VyOS
 ipv6 router isis VyOS
** isis fast-reroute lfa level-2**
 isis network point-to-point
exit

after configuration at interface level in FRR:

vyos@R1# run show isis fast-reroute summary 
Area VyOS:
 IS-IS L2 IPv4 Fast ReRoute summary:

 Protection \ Priority     Critical  High      Medium    Low       Total   
 --------------------------------------------------------------------------
 Classic LFA               0         0         3         0         3       
 Remote LFA                0         0         0         0         0       
 Topology Independent LFA  0         0         0         0         0       
 ECMP                      0         0         0         3         3       
 Unprotected               0         0         0         3         3       
 Protection coverage       0.00%     0.00%     100.00%   50.00%    66.67%

and backup path is installed in FIB:

vyos@R1# run show ip route 192.0.0.4
Routing entry for 192.0.0.4/32
  Known via "isis", distance 115, metric 20, best
  Last update 00:02:30 ago
  * 10.1.4.4, via eth2, weight 1, backup 0,1
      b 10.1.3.3, via eth0, weight 1
      b 10.1.2.2, via eth1, weight 1

[edit]
vyos@R1#
fernando added a comment.Aug 19 2025, 5:15 PM

basically with our test, it's missing a command which enable on the interfaces that can talk lfa with other isis routers, we should add this feature to solve this problmes

frr:

interface eth0
isis fast-reroute lfa level-2

vyos-cli

set protocols isis interface eth0 fast-reroute lfa level-2

if we add this new command, allow works properly and find the backup route.

a.apostoliuk changed the task status from Open to In progress.Aug 25 2025, 3:35 PM
a.apostoliuk claimed this task.
a.apostoliuk added a comment.Aug 27 2025, 2:20 PM
https://github.com/vyos/vyos-1x/pull/4682
a.apostoliuk added a comment.Sep 9 2025, 11:37 AM
Added commands:



set protocols isis interface <INTERFACE NAME> fast-reroute lfa <level-1 | level-2> enable
set protocols isis interface <INTERFACE NAME> fast-reroute lfa  <level-1 | level-2>  exclude interface <INTERFACE NAME> 
set protocols isis interface <INTERFACE NAME> fast-reroute remote-lfa <level-1 | level-2> maximum-metric <METRIC>
set protocols isis interface <INTERFACE NAME> fast-reroute remote-lfa  [level-1 | level-2] tunnel mpls-ldp
set protocols isis interface <INTERFACE NAME> fast-reroute ti-lfa  <level-1 | level-2> [node-protection [link-fallback]]
a.apostoliuk mentioned this in rVYOSONEX5098fa8eb575: isis: T7722: Added interface fast-reroute configuration commands.Sep 9 2025, 2:18 PM
Restricted Repository Identity mentioned this in rVYOSONEX1124d3f9aa05: Merge pull request #4682 from aapostoliuk/T7722-current.Sep 9 2025, 2:18 PM
Unknown Object (User) edited projects, added VyOS 1.4 Sagitta (1.4.4); removed VyOS 1.4 Sagitta.Oct 10 2025, 10:51 AM
Unknown Object (User) added a project: VyOS 1.5 Circinus (1.5-stream-2025-Q3).
Unknown Object (User) moved this task from Need Triage to Completed on the VyOS Rolling board.
Unknown Object (User) moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.4) board.Oct 10 2025, 10:54 AM
Unknown Object (User) moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.
dmbaturin renamed this task from LFA and IP-FRR to Backup next-hop is not installed in IS-IS LFA as expected.Thu, Nov 13, 12:37 AM
dmbaturin edited projects, added VyOS 1.5 Circinus (2025.11); removed VyOS 1.5 Circinus (1.5-stream-2025-Q3), VyOS 1.4 Sagitta (1.4.4), VyOS Rolling.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.