Absolute and Dynamic Adjacency SIDs

[FM_Drew]

Good afternoon,

We're currently working on deploying segment-routing on what is more or less a greenfield network, which consists of N540-24Q8L2DD-SYS and NCS-57C3-MOD-SYS routers. We've assigned absolute SID values for both the prefix SIDs and adjacency SIDs, but I ran into a few items regarding the adjacency SIDs that have me a little puzzled. For every OSPF adjacency we have in our network, we have three adjacency SIDs. Two dynamic, and one absolute. Here is an example for one of our routers:

show ospf neighbor detail 
Tue Aug 15 12:58:06.103 CDT

* Indicates MADJ interface
# Indicates Neighbor awaiting BFD session up

Neighbors for OSPF 1

 Neighbor 10.48.0.42, interface address 10.58.0.30
    In the area 0 via interface Bundle-Ether1 , BFD enabled, Mode: Default
    Neighbor priority is 1, State is FULL, 6 state changes
    DR is 0.0.0.0 BDR is 0.0.0.0
    Options is 0x52  
    LLS Options is 0x1 (LR)
    Dead timer due in 00:00:02
    Neighbor is up for 21:07:47
    Number of DBD retrans during last exchange 0
    Index 1/1, retransmission queue length 0, number of retransmission 1
    First 0(0)/0(0) Next 0(0)/0(0)
    Last retransmission scan length is 1, maximum is 1
    Last retransmission scan time is 0 msec, maximum is 0 msec
    LS Ack list: NSR-sync pending 0, high water mark 0
    Adjacency SIDs:
        Label: 24000,    Dynamic, Unprotected
        Label: 24001,    Dynamic,   Protected (Has backup)
        Label: 580031, Configured,   Protected (Has backup)
    Neighbor BFD status: Session up
    Neighbor Interface ID: 83

 Neighbor 10.48.0.61, interface address 10.58.0.39
    In the area 0 via interface Bundle-Ether2 , BFD enabled, Mode: Default
    Neighbor priority is 1, State is FULL, 6 state changes
    DR is 0.0.0.0 BDR is 0.0.0.0
    Options is 0x52  
    LLS Options is 0x1 (LR)
    Dead timer due in 00:00:02
    Neighbor is up for 21:17:14
    Number of DBD retrans during last exchange 0
    Index 2/2, retransmission queue length 0, number of retransmission 15
    First 0(0)/0(0) Next 0(0)/0(0)
    Last retransmission scan length is 1, maximum is 2
    Last retransmission scan time is 0 msec, maximum is 0 msec
    LS Ack list: NSR-sync pending 0, high water mark 0
    Adjacency SIDs:
        Label: 24002,    Dynamic, Unprotected
        Label: 24003,    Dynamic,   Protected (Has backup)
        Label: 580038, Configured,   Protected (Has backup)
    Neighbor BFD status: Session up
    Neighbor Interface ID: 74

To note, we do have the absolute SIDs set to be protected as seen in the output above. What I don't understand is why we have three labels assigned to a given adjacency. My initial understanding is that when a manual adjacency SID is assigned, the dynamic label is removed. I also assumed that the manually assigned adjacency SID would be used for the protect path of each adjacency as well. The best I could come up with so far is that a label is dynamically allocated for the protect or backup path for each manually assigned SID, but that still doesn't get me to three labels per adjacency. Perhaps a dynamic SID still gets allocated in addition to the absolute SID?

This is the case for every router within our network, as shown in the output below. There are three adjacency SIDs for every link in our network:

show segment-routing traffic-eng ipv4 topology summary 
Tue Aug 15 12:51:17.877 CDT

XTC Agent's topology database summary:
--------------------------------

Topology nodes:               33
Prefixes:                     33
  Prefix SIDs:                33
Links:                        72
  Adjacency SIDs:            216

At this point I believe I'm missing something on a fundamental level with the adjacency SIDs, so I'm hoping someone more knowledgeable than I can shed a little light on this for me.

Thanks!

[M02@rt37]

Hello @FM_Drew,

The output you provided does show multiple adjacency SIDs for each link.

In your case, for each OSPF adjacency, you have three adjacency SIDs: two dynamic and one absolute. The reason for this is related to protection and backup paths.

Dynamic Adjacency SIDs: These are dynamically assigned adjacency SIDs for your links. They are used for the primary (non-protected) path for traffic. In your output, the dynamic adjacency SIDs have labels like 24000, 24001, 24002, etc. These labels are assigned by the router as part of its normal operation.

Absolute (Configured) Adjacency SIDs: These are manually configured adjacency SIDs. They are used for your protected paths (backup paths) in case the primary path fails. In your output, the configured adjacency SIDs have labels like 580031, 580038, etc. These labels are assigned by you, and you have indicated that these are protected.

Protected Paths: When you designate an adjacency SID as "protected," it means that this SID is used for the backup path. If the primary path (dynamic SID) fails, the router switches over to using the manually configured SID for the backup path. This is why you see both dynamic and configured SIDs for each link.

--> The reason you're seeing three labels per adjacency is that each link has:

One dynamic adjacency SID for the primary path.

One configured adjacency SID for the protected path.

One more dynamic adjacency SID, which is most likely allocated for the backup path.

Having multiple adjacency SIDs for each link is expected behavior in a network that supports protection and failover. The configured (absolute) adjacency SID is used for the backup path, ensuring your traffic is rerouted in case of failures.

[FM_Drew]

Thanks for the quick response M02@rt37. I am on board with most of what was stated there with the exception of the manual adjacency-SID protection based on Cisco's documentation from https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5xx/segment-routing/65x/b-segment-routing-cg-65x-ncs540/b-segment-routing-cg-65x-ncs540_chapter_010.html

"An adjacency SID can be allocated dynamically from the dynamic label range or configured manually from the segment routing local block (SRLB) range of labels.

Adjacency SIDs that are dynamically allocated do not require any special configuration, however there are some limitations:

• A dynamically allocated Adj-SID value is not known until it has been allocated, and a controller will not know the Adj-SID value until the information is flooded by the IGP.

• Dynamically allocated Adj-SIDs are not persistent and can be reallocated after a reload or a process restart.

• Each link is allocated a unique Adj-SID, so the same Adj-SID cannot be shared by multiple links.

Manually allocated Adj-SIDs are persistent over reloads and restarts. They can be provisioned for multiple adjacencies to the same neighbor or to different neighbors. You can specify that the Adj-SID is protected. If the Adj-SID is protected on the primary interface and a backup path is available, a backup path is installed. By default, manual Adj-SIDs are not protected."

My takeaway from what you stated and from the configuration guide is that while we do have a manual adjacency SID assigned, the router still dynamically allocates an adjacency SID as well. This is done for both the primary path and the backup path for each link since dynamically allocated adjacency SIDs are protected by default. To break it down based on the output in my first post:

Adjacency SIDs:
Label: 24002, Dynamic, Unprotected <--- This is the dynamic label used for the backup/protect path for the other link on the router

Label: 24003, Dynamic, Protected (Has backup) <--- This is the dynamic label used for the primary path, and is protected by a "Dynamic, Unprotected" label on the backup link. Based on my original post, that label would be label 24000 assigned to the other link.

Label: 580038, Configured, Protected (Has backup) <--- This is the manual label assigned from the SRLB used for the primary path and is also protected by the same "Dynamic, Unprotected" label that label 24003 is using on the backup link. ie label 24000.

Based on the configuration guide and the output from "show ospf neighbor detail" my understanding is that having "adjacency-sid absolute xxxxx protected" configured means that the manual adjacency SID is protected and will have a backup path installed since that does not happen by default like it does with the dynamic adjacency SIDs. It does not mean that it will be the protect path for the primary/dynamic SID that the router assigned.

Manual adjacency SIDs effectively add one more adjacency SID to the table for persistence across router reloads, and for the sake of SR-TE. They do not replace dynamically allocated adjacency SIDs. Does that sound like a reasonable conclusion?

Thanks!

[M02@rt37 · Accepted solution]

@FM_Drew,

Your detailed explanation aligns well with the concepts described in the Cisco documentation, and you've highlighted the distinction between dynamically allocated and manually configured adjacency SIDs, as well as how protection is applied. This insight will be valuable for others working with similar Cisco setups and considering the use of manual adjacency SIDs for better control and persistence.

In summary:

Dynamically allocated adjacency SIDs are automatically assigned by the router for primary and backup paths. They are not persistent across reloads and can be reallocated after a restart.

Manual adjacency SIDs, when configured with the "protected" keyword, are used to designate a specific label for the primary path and ensure it's protected with a backup path.

Manual adjacency SIDs do not replace dynamically allocated ones; rather, they add a level of persistence and control over the assigned labels.

Thanks.