Containing 500 Flapping Cell Sites in a Single-Level IS-IS Domain
Your network runs one IS-IS Level-2 area across 1,850 routers: 24 P routers, 900 PEs, and roughly 900 aggregation/access devices, with LDP and iBGP sessions to two route reflectors. You are adding 500 cell-site routers for 5G backhaul, some on 20 Mbps microwave links that flap several times a day during weather events. Every flap now triggers domain-wide SPF: P-router CPU peaks near 85 percent, a single event floods roughly 3,000 LSPs, and measured convergence after a core cut is 4 to 6 seconds. The design standard requires sub-second reconvergence for core failures and stable routing while access links flap. No P-router hardware refresh is funded this year, existing L3VPN services must keep working through the change, and operations will not accept a design where the core carries customer prefixes.
1. Propose the IS-IS hierarchy change and justify it with the numbers in the scenario. Explain specifically how LDP and PE loopbacks keep working across the area boundary.
Read the worked answer
Split the domain into a small Level-2 core (the 24 P routers plus the two RRs) and regional Level-1 areas of about 150 to 200 nodes each. The P routers and a pair of L1/L2 boundary routers per region stay in Level 2; every access and cell-site router becomes Level 1 only. The effect is arithmetic: a flapping microwave link now floods inside one area of 150 nodes instead of 1,850, SPF on the core runs over 26 nodes rather than the full topology, and the core LSP count stops tracking access churn.
The LDP caveat is the part that breaks naive designs. If an L1 router simply receives a default route from its L1/L2 boundary, it has no RIB entry for a remote PE loopback, so LDP generates no label binding and VPN traffic blackholes at the area edge. Fix it by leaking the PE and P-router /32 loopbacks into each Level-1 area with a route-leak policy on the L1/L2 routers (prefix-list of loopback space only), while still injecting a default for everything else. Keep summarization away from /32s for the same reason.
Level 2 must not leak customer prefixes: PEs originate only loopbacks and infrastructure into IS-IS; customer routes stay in MP-BGP between PE loopbacks. Verify with a check that no L1 area contains a customer prefix and that every area has a label binding for every PE loopback.
2. Beyond hierarchy, which mechanism-level controls would you apply so that meteorological flapping on 500 access links does not destabilize routing or MPLS forwarding?
Read the worked answer
Treat the access layer as untrusted dynamics and damp it at the source rather than in the core.
- Interface dampening on cell-site interfaces, with a suppress threshold above a single weather event and a half-life long enough that a link does not re-enter service while still marginal.
- IS-IS LSP generation interval and exponential backoff on the cell-site routers so that a flapping adjacency produces one LSP every few seconds instead of one per transition.
- Hello/hold tuning on the access side (longer hold than the default) while keeping aggressive detection only on core links with BFD at 50 ms x 3.
- Do not enable BFD on the microwave links. BFD turns a marginal radio into an adjacency reset storm and amplifies the problem you are damping; it belongs where failure detection must be sub-second.
- Prefix suppression on P routers (transit-only interfaces carry no IP prefix) to shrink the LSDB and SPF cost, and point-to-point adjacency type on all router-to-router links to skip DIS election.
- IGP-LDP synchronization on access links so that a link is not advertised as a next hop until LDP is converged, preventing transient blackholes during the flap.
Finally, keep the cell sites out of the Level-2 flooding scope entirely; if the hierarchy change is done, dampening and timers become a second line of defense rather than the only one.
3. The design standard promises sub-second reconvergence for core failures. What must be true for that claim to hold, and how would you validate it?
Read the worked answer
Sub-second convergence is a property of the failure domain, not a global setting. For a core cut between two P routers, all of the following must be true:
- Detection: BFD at 50 ms x 3 on every core link, or link-layer failure signaling where available. IS-IS hello-based detection alone will not get you there.
- Pre-computed repair: TI-LFA (preferred) or LFA with remote-LFA coverage for the expected failure set, so forwarding changes before the SPF result is installed.
- SPF and LSP timers tuned: initial SPF delay in the low milliseconds with exponential backoff capped at a few hundred milliseconds, and fast flooding (mesh groups or point-to-point-only topologies) so the LSP reaches the far side in one shot.
- A small Level-2 topology: 26 nodes keeps the SPF computation trivial; if the core were 300 nodes the same timers would produce CPU churn.
- Micro-loop mitigation: segment routing or ordered FIB updates, otherwise the transient loop can outlast the SPF.
Validation should be measured, not asserted. Build a test with a physical or emulated core, break one link and one node, and measure traffic loss with a stream at line rate, recording the gap per destination prefix, not just "adjacency up". Confirm that repair paths carry the MPLS label stack the PE expects, and repeat after the access layer is loaded with flapping to prove the failure domains are truly isolated.