How would you design a campus to recover from a link or switch failure in under a second?
Show the answer
Say this first
Detect fast, have the alternate path ready, and keep the change local. Use routed point-to-point fiber links so a failure is loss of light, detected in milliseconds, and BFD where something sits in between. Build triangles so ECMP already has the second path installed. Summarize at distribution and use stubs so a failure does not trigger work across the network. Avoid STP and FHRP in the failover path where possible, and use NSF/SSO on dual-supervisor chassis. Then prove it by pulling links under load.
Go deeper
1. Detection
- Direct routed links between switches. When the fiber or optic fails, the interface goes down and routing reacts at once. Hello timers are only a backstop.
- Where a carrier circuit or media converter hides the failure, run BFD. Three missed 50 ms packets means about 150 ms detection. Supported minimum intervals vary by platform.
2. Precomputed alternates
- Triangles, not squares. Each access switch connects to both distribution switches. The two paths are equal cost and both are in the forwarding table, so losing one is a local removal, not a recalculation. In a square the backup path has to be computed first.
- EIGRP feasible successors and OSPF loop-free alternates (where supported) give a backup next hop in advance on non-ECMP topologies.
3. Limit the work
- Summarize each distribution block toward the core. A failure inside the block changes nothing outside.
- EIGRP stub on access switches keeps queries from spreading. OSPF areas keep LSA flooding local.
- SPF throttle with a short initial wait so the first event is processed quickly.
4. Remove layer 2 from the path
Routed access takes STP and HSRP out of uplink failover. If you keep layer 2 access, use Rapid PVST+, a loop-free design and tuned FHRP timers.
5. Survive supervisor failures
NSF/SSO lets a dual-supervisor chassis keep forwarding while the standby takes over and neighbors help resynchronize. Aggressive hello or BFD timers toward that chassis can declare it dead before the switchover completes, so pick timers that let NSF work.
Example on IOS-XE
interface TenGigabitEthernet1/1/1
no switchport
ip address 10.1.255.0 255.255.255.254
ip ospf network point-to-point
bfd interval 50 min_rx 50 multiplier 3
!
router ospf 1
bfd all-interfaces
timers throttle spf 10 100 5000Prove it
Send steady traffic (a traffic generator, or pings at a short interval) and pull a link, then a switch. Lost packets multiplied by the interval gives the real outage. Measure, do not assume.
They will ask next
Why use BFD instead of setting OSPF hellos to sub-second?
Fast hellos run in the routing process for each protocol and each neighbor, cost CPU and can flap when the control plane is busy. BFD is a light, single-purpose protocol, often handled in hardware or a dedicated process, and one BFD session can serve OSPF, BGP and static routes at once. On a direct fiber link, loss of light beats both.
What does triangles not squares mean?
Connect each lower-layer switch to two upper-layer switches, so a router has two equal paths in its table. If you instead chain switches in a square, the alternate path exists only after the routing protocol recomputes, which is slower.
Traps
- Tuning timers everywhere before fixing the topology. Detection by loss of light and ECMP matter more.
- Claiming sub-second convergence without having measured it.