Abstract: A method is implemented by a network device to determine loop free alternatives (LFA) for each next hop in a default route to border nodes of a level 1 intermediate system-intermediate system (IS-IS) area of the network device. The method selects a next next-hop for the default route and looks up a corresponding border node for the selected next-hop in a local routing information base (RIB). A next next-hop of the corresponding border node is selected. A check is made whether the selected next-hop of the corresponding border node is the same as selected next-hop of default route. Then an LFA of the selected next-hop of the corresponding border node is assigned as LFA of the selected next-hop of the default route.

Abstract: A method and system implemented by a network device, where the network device is in a network having a plurality of nodes. The method computes a loop free alternative (LFA) next hop as a backup for a primary path next hop for intermediate system-intermediate system (IS-IS). The method improves LFA computation efficiency by minimizing expansion of prefixes. The method includes expanding all prefixes of the next LFA shortest path first (SPF) destination node and inheriting a next candidate next hop as a current LFA next hop where the next candidate next hop provides link or node protection and better protection than the current LFA next hop.

Abstract: A method and implementing system calculates a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables consideration of the LFA next hop where a link to the next hop has a reverse cost that has a maximum value. The method includes selecting a next candidate next hop from a set of candidate next hops in the network, checking whether a link to the next candidate next hop is an administratively allowable link, and checking whether the link has a maximum forward cost. The method further checks whether the link is bi-directional and computes the LFA using the next candidate next hop where the link is administratively allowable link, where the link does not have a maximum forward cost and where the link is bi-directional without consideration of reverse cost of the link.

Abstract: A method and system are provided to install a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables testing of the LFA next hop to ensure proper handling of data forwarding on the LFA. The method includes receiving a trigger message from an administrative module indicating a switch to the LFA next hop the message including a prefix and an interface. A check is made whether a set of primary path next hops of the prefix have been exhausted. A next primary path next hop is selected from the set of primary path next hops of the prefix. A check is made whether the next primary path next hop matches the interface. The next primary path next hop is replaced by installing the LFA next hop into a global routing information base.

Abstract: The method and system to computes an LFA next hop as a backup for a primary path next hop that enables an administrator to control LFA selection for a given destination node using a tag and a weight. The method includes checking whether an interface of a next candidate node has a tag with a tag value matching a tag value of a primary SPF path for the destination node. The method further includes checking whether the destination node has any LFA, checking whether a stored tag differs from the tag value of the primary SPF path, and checking whether the interface of the next candidate node is preferred based on a comparison of a weight values, and replacing a stored LFA for the destination node with the next candidate node. Where conditions are met a stored LFA is replaced with the next candidate node.

Abstract: A method is executed by a network device to determine a loop free alternate (LFA) for a multi-homed prefix in an IS-IS area or IS-IS domain. The method includes selecting a next node from the IS-IS area or the IS-IS domain and selecting a next prefix for the selected node. A check is made whether the selected prefix is a multi-homed prefix (MHP). A check is made whether a shortest path first (SPF) cost of the selected node and cost to the selected prefix is equal to an SPF cost of the selected prefix, whether a next hop of selected prefix is same as next hop of selected node, and whether a LFA next hop of the selected node is better protection than a current next hop protection of the selected prefix and the LFA next hop of the selected node is then inherited for the selected prefix.

Abstract: A method is implemented by a network device to determine loop free alternatives (LFA) for each next hop in a default route to border nodes of a level 1 intermediate system—intermediate system (IS-IS) area of the network device. The method selects a next next-hop for the default route and looks up a corresponding border node for the selected next-hop in a local routing information base (RIB). A next next-hop of the corresponding border node is selected. A check is made whether the selected next-hop of the corresponding border node is the same as selected next-hop of default route. Then an LFA of the selected next-hop of the corresponding border node is assigned as LFA of the selected next-hop of the default route.

Abstract: A method is executed by a network device to a calculate loop free alternative (LFA) for each node in an intermediate system-intermediate system (IS-IS) area or IS-IS domain where the network device is connected with other nodes via multiple parallel links. The method includes a shortest path first (SPF) computation of the primary paths for the network device that tracks directly connected links from each node in the IS-IS area or IS-IS domain to the network device which is a source node for the SPF. These tracked links can then be utilized in subsequent LFA computations to avoid unnecessary calculations.

Abstract: A method of a network device identifies multi-homed prefixes in an intermediate system-intermediate system (IS-IS) area or IS-IS domain during shortest path first (SPF) computation for use in a loop free alternate (LFA) computation. The method and network device select a next node in a shortest path tree (SPT) and determine a set of prefixes associated with the selected node in the SPT. A next prefix from the set of prefixes of the selected node is selected and a check is made whether the selected prefix exists in the local RIB associated with another node of a same level, then the selected prefix is marked as a multi-homed prefix in the local RIB. A check is made whether all prefixes associated with the selected node are processed and whether all nodes in the SPT have been processed, before downloading the local RIB to a global RIB.

Abstract: An automated key transition method is executed by a node in a network. The network includes a set of nodes utilizing a current key identifier. A key identifier specifies an authentication protocol and an authentication key for use in the authentication of intermediate-system to intermediate-system (IS-IS) protocol data units. The method includes a set of steps including receiving a message at the node, where, the message includes a most recent key identifier to replace the current key identifier, verifying whether all reachable nodes in the set of nodes have advertised the most recent key identifier, continuing authentication using the current key identifier until all reachable nodes in the set of nodes have been verified to advertise the most recent key identifier, and switching authentication at the node to use the most recent key identifier upon verification that all reachable nodes in the set of nodes have advertised the most recent key identifier.

Abstract: An automated key transition method is executed by a node in a network. The network includes a set of nodes utilizing a current key identifier provided by a group key management server or provisioned manually. A key identifier specifies an authentication protocol and an authentication key for use in the authentication of intermediate-system to intermediate-system (IS-IS) protocol data units. The method includes receiving a message from the group key management server that includes a most recent key field to replace the current key identifier, advertising the most recent key identifier to all reachable nodes, verifying whether all reachable nodes have advertised the most recent key identifier, continuing authentication using the current key identifier until all reachable nodes have been verified to advertise the most recent key identifier, and switching authentication to use the most recent key identifier upon verification that all reachable nodes have advertised the most recent key identifier.

Abstract: A method is executed by a router for improved Intermediate System to Intermediate System (IS-IS) protocol and Neighbor Discovery (ND) protocol execution to avoid dropped data traffic caused by Media Access Control (MAC) address resolution for next hops of routes determined by the IS-IS protocol. An IS-IS adjacency is established between the router and a neighbor router over a link, where a MAC address for the neighbor router is received from the neighbor router. A routing information base (RIB) is updated to include the neighbor router as a next hop for at least one destination address by the IS-IS process. The MAC address of the neighbor router is provided to an ND process to update the RIB, a forwarding information base (FIB) or L2 forwarding table of at least one line card of the router to include the MAC address of the neighbor router in response to the providing of the MAC address to the ND process.

Abstract: Methods and apparatus for a network element to handle LSID collisions to prevent different LSAs associated with different routes from sharing the same LSID. According to one embodiment, responsive to determining that a tentative LSID that is generated for a first route that is being added collides with an LSID that is assigned to an LSA for a second route, and that one of the first and second routes is a host route, the host route is suppressed. If the first route is the host route, suppressing includes not originating an LSA for the first route. If the second route is the host route, suppressing includes purging the LSA for the second route and not originating an LSA for the second route. Although the host route is suppressed, network reachability of the range subsuming the host route is provided through the route that is not the host route.

Abstract: A network element supports Transmission Control Protocol Authentication Option (TCP-AO) with a Key Management Protocol (KMP) to authenticate TCP segments over a TCP session. The network element negotiates multiple traffic keys to authenticate TCP segments over a TCP session with a peer network element, and protects the TCP session with the negotiated traffic keys.

Abstract: A network element supports Transmission Control Protocol Authentication Option (TCP-AO) with a Key Management Protocol (KMP) to authenticate TCP segments over a TCP session. The network element negotiates multiple traffic keys to authenticate TCP segments over a TCP session with a peer network element, and protects the TCP session with the negotiated traffic keys.

Abstract: Methods and apparatus for a network element to handle LSID collisions to prevent different LSAs associated with different routes from sharing the same LSID. According to one embodiment, responsive to determining that a tentative LSID that is generated for a first route that is being added collides with an LSID that is assigned to an LSA for a second route, and that one of the first and second routes is a host route, the host route is suppressed. If the first route is the host route, suppressing includes not originating an LSA for the first route. If the second route is the host route, suppressing includes purging the LSA for the second route and not originating an LSA for the second route. Although the host route is suppressed, network reachability of the range subsuming the host route is provided through the route that is not the host route.

Abstract: Methods and apparatus for a network element to handle LSID collisions to prevent different LSAs associated with different routes from sharing the same LSID. According to one embodiment, responsive to determining that a tentative LSID that is generated for a first route that is being added collides with an LSID that is assigned to an LSA for a second route, and that one of the first and second routes is a host route, the host route is suppressed. If the first route is the host route, suppressing includes not originating an LSA for the first route. If the second route is the host route, suppressing includes purging the LSA for the second route and not originating an LSA for the second route. Although the host route is suppressed, network reachability of the range subsuming the host route is provided through the route that is not the host route.

Abstract: Methods and apparatus for a network element to handle LSID collisions to prevent different LSAs associated with different routes from sharing the same LSID. According to one embodiment, responsive to determining that a tentative LSID that is generated for a first route that is being added collides with an LSID that is assigned to an LSA for a second route, and that one of the first and second routes is a host route, the host route is suppressed. If the first route is the host route, suppressing includes not originating an LSA for the first route. If the second route is the host route, suppressing includes purging the LSA for the second route and not originating an LSA for the second route. Although the host route is suppressed, network reachability of the range subsuming the host route is provided through the route that is not the host route.