Back to Blog
★★★Advanced🌐 WAN / Service Provider
MPLSTraffic EngineeringRSVPWANService ProviderBest Practices

MPLS Traffic Engineering: RSVP-TE Tunnels, Constraints, and Fast Reroute

March 13, 2026·10 min read

Overview

Standard MPLS and OSPF send traffic on the shortest path by default — which means all traffic between two nodes uses the same link even if an alternate uncongested path exists. MPLS-TE lets you explicitly route LSPs (Label Switched Paths) based on bandwidth, link color, affinity, or administrative constraints. Combined with Fast Reroute, TE tunnels recover from failures in under 50ms — faster than any routing protocol can converge.

MPLS-TE Components

ComponentRoleProtocol
CSPF (Constrained SPF)Computes path satisfying TE constraints (bandwidth, affinity)Runs locally on head-end
RSVP-TESignals and reserves bandwidth along the computed pathRSVP with TE extensions
TE Database (TED)Stores link attributes (available BW, admin groups) flooded by IGPOSPF TE extensions (Opaque LSA Type 10)
TE TunnelVirtual interface representing the LSP — traffic steered via autoroute or staticTunnel interface
Fast Reroute (FRR)Pre-computed backup LSP — activates in <50ms on link/node failureRSVP-TE make-before-break

Topology

// MPLS-TE — PRIMARY LSP + FRR BACKUP PATH PE-1 (Head) 10.0.0.1/32 P-1 10.0.0.2/32 P-2 10.0.0.3/32 P-3 10.0.0.4/32 PE-2 (Tail) 10.0.0.5/32 Primary TE LSP: PE-1 → P-1 → P-3 → PE-2 (1Gbps reserved) FRR backup path: PE-1 → P-2 → P-3 → PE-2 FRR activates in <50ms when P-1 or the PE-1→P-1 link fails — no RSVP re-signaling needed

Part 1 — Prerequisites: Enable MPLS-TE in OSPF

cisco
! Enable MPLS globallympls traffic-eng tunnelsmpls label protocol ldp! Enable TE extensions in OSPF — floods link attributes into TEDrouter ospf 1 mpls traffic-eng router-id Loopback0 mpls traffic-eng area 0! Enable TE on each physical interface that will carry TE tunnelsinterface GigabitEthernet0/0 mpls traffic-eng tunnels ip rsvp bandwidth 1000000 ! Reserve max 1Gbps of RSVP bandwidth on this 1G interface ! Typical: reserve 75-80% of link capacity for TE

Part 2 — Configure a TE Tunnel

cisco
! Tunnel interface on the head-end (PE-1)interface Tunnel1 ip unnumbered Loopback0 tunnel mode mpls traffic-eng tunnel destination 10.0.0.5 ! Destination = tail-end router ID (PE-2 loopback) tunnel mpls traffic-eng bandwidth 500000 ! Reserve 500Mbps on this LSP tunnel mpls traffic-eng path-option 1 dynamic ! Dynamic = CSPF computes best path satisfying constraints ! Alternative: path-option 1 explicit name EXPLICIT-PATH-TO-PE2 ! (explicit path manually defines each hop) tunnel mpls traffic-eng priority 5 5 ! Setup priority / holding priority — lower = higher priority ! Priority 0 = highest (can preempt others), 7 = lowest tunnel mpls traffic-eng record-route ! Record the actual path taken — visible in "show mpls traffic-eng tunnels"

Explicit Path (when you need to force a specific route)

cisco
ip explicit-path name PATH-PE1-TO-PE2 enable next-address 10.0.0.2 ! P-1 next-address 10.0.0.4 ! P-3 next-address 10.0.0.5 ! PE-2interface Tunnel1 tunnel mpls traffic-eng path-option 1 explicit name PATH-PE1-TO-PE2 tunnel mpls traffic-eng path-option 2 dynamic ! Fallback to dynamic if explicit path becomes unavailable
PE-1 — show mpls traffic-eng tunnels tunnel 1 detail
PE-1# show mpls traffic-eng tunnels tunnel 1 detail
Name: PE-1_t1         (Tunnel1) Destination: 10.0.0.5  (PE-2 loopback)
Status:
  Admin: up   Oper: up   Path: valid   Signalling: connected
  path option 1, type dynamic (Basis for Setup, path weight 30)
Config Parameters:
  Bandwidth: 500000 kbps (500 Mbps) Priority: 5 5  Affinity: 0x0/0xFFFF
  Metric Type: TE   AutoRoute: enabled   LockDown: disabled
  Record-Route: Enabled
RSVP Signalling Info:
  Src 10.0.0.1, Dst 10.0.0.5, Tun_Id 1, Tun_Instance 2
  RSVP Path Info:
    My Address: 10.0.0.1
    Explicit Route: 10.0.0.2 10.0.0.4 10.0.0.5  <-- CSPF path: P-1 → P-3 → PE-2
    Record Route:   10.0.0.1 10.0.0.2 10.0.0.4 10.0.0.5
    Tspec: ave rate=500000 kbits, burst=1000 bytes, peak rate=500000 kbits
  RSVP Resv Info:
    Record Route:  10.0.0.5 10.0.0.4 10.0.0.2 10.0.0.1
    Fspec: ave rate=500000 kbits, burst=1000 bytes, peak rate=500000 kbits
History:
  Tunnel: Time since created: 2 days, 4 hours
          Time since path change: 4 hours, 31 min  LSP instances used: 2
Admin / Oper
up / up
tunnel is active and forwarding
RSVP reserved BW
500 Mbps
guaranteed on every hop
CSPF path taken
P-1 → P-3 → PE-2
Record-Route confirms actual path

Part 3 — Steer Traffic into the Tunnel

Option A — Autoroute (recommended)

cisco
interface Tunnel1 tunnel mpls traffic-eng autoroute announce ! Makes the tunnel visible to OSPF/BGP as a "shortcut" ! Traffic destined to PE-2 or beyond PE-2 uses Tunnel1 automatically tunnel mpls traffic-eng autoroute metric relative -10 ! Makes OSPF prefer this tunnel by lowering its metric by 10 ! Useful for load balancing across parallel tunnels

Option B — Static Route into Tunnel

cisco
ip route 10.200.0.0 255.255.0.0 Tunnel1! All traffic to 10.200.0.0/16 goes into Tunnel1 (explicit steering)

Part 4 — Fast Reroute (FRR)

FRR pre-installs a bypass LSP from each node to the next-next hop. When a link or node fails, the PLR (Point of Local Repair) immediately redirects traffic onto the bypass without any RSVP re-signaling.

cisco
! On the tunnel (head-end) — request FRR protectioninterface Tunnel1 tunnel mpls traffic-eng fast-reroute tunnel mpls traffic-eng fast-reroute protect bandwidth ! "protect bandwidth" — bypass must have enough BW for this tunnel! On transit nodes — enable FRR facility backupmpls traffic-eng fast-reroute promote tunnels! Tells this node to build bypass tunnels to protect its downstream linksinterface GigabitEthernet0/0 mpls traffic-eng backup-path Tunnel100 ! Explicitly assign bypass tunnel (optional — auto-created if not specified)! Verify FRR statePE-1# show mpls traffic-eng fast-reroute database! Shows protected LSPs and their bypass tunnel assignments! "State: Ready" means bypass is in place and will activate on failure

Real-World Scenario

The situation: A service provider has two parallel 10G links between their two core P routers. During business hours, video streaming fills 70% of the first link. VoIP traffic also uses the same link and experiences jitter. The second link is only 15% utilized.

Fix — Use MPLS-TE to steer VoIP onto the underloaded link:

cisco
! Mark VoIP interfaces with TE affinity color "low-latency" (bit 0 = 0x1)interface GigabitEthernet0/1 ! The underloaded parallel link mpls traffic-eng attribute-flags 0x1 ! This link is "colored" as low-latency! VoIP TE tunnel — only use links with color 0x1interface Tunnel10 description VOIP-TE-LSP ip unnumbered Loopback0 tunnel destination 10.0.0.5 tunnel mode mpls traffic-eng tunnel mpls traffic-eng bandwidth 500000 tunnel mpls traffic-eng affinity 0x1 mask 0x1 ! CSPF only picks links with bit 0 set — forces VoIP onto the low-latency link tunnel mpls traffic-eng path-option 1 dynamic tunnel mpls traffic-eng autoroute announce tunnel mpls traffic-eng fast-reroute! Result: VoIP goes via Gi0/1 (underloaded), video stays on Gi0/0! Show the path CSPF chose:PE-1# show mpls traffic-eng tunnels tunnel 10 detail | include path

Troubleshooting

TE tunnel in Down/Down state — RSVP path not established

Symptom: show mpls traffic-eng tunnels tunnel 1 shows Admin: up Oper: down State: no-path.

Cause: CSPF can't find a path satisfying the constraints — not enough bandwidth reserved, affinity mismatch, or OSPF TE extensions not flooded.

Fix:

cisco
! Check TED for available bandwidthPE-1# show mpls traffic-eng topology path destination 10.0.0.5! Shows available bandwidth on each link in the TE domain! Check RSVP bandwidth config on all transit interfacesP-1# show ip rsvp interface GigabitEthernet0/0! "BW" column shows allocated vs available! Relax bandwidth constraint temporarily for testinginterface Tunnel1 tunnel mpls traffic-eng bandwidth 100 ! If tunnel comes up with 100kbps, the issue is bandwidth exhaustion

FRR not activating on link failure

Symptom: Link fails, FRR bypass was shown as Ready, but convergence still takes 2-3 seconds.

Cause: tunnel mpls traffic-eng fast-reroute not configured on the protected tunnel, or the bypass tunnel wasn't pre-established.

Fix:

cisco
PE-1# show mpls traffic-eng fast-reroute database! Look for: "FRR-label: Push NNN" — if blank, FRR not configured on tunnelinterface Tunnel1 tunnel mpls traffic-eng fast-reroute ! Add this if missing! Force bypass to rebuildPE-1# mpls traffic-eng reoptimizePE-1# show mpls traffic-eng fast-reroute database! State should change to "Ready"

Autoroute not advertising tunnel to routing table

Symptom: TE tunnel is Up but traffic doesn't use it. show ip route 10.0.0.5 shows IGP path, not Tunnel1.

Cause: autoroute announce not configured, or tunnel metric is higher than the IGP metric.

Fix:

cisco
interface Tunnel1 tunnel mpls traffic-eng autoroute announce tunnel mpls traffic-eng autoroute metric absolute 10 ! Set a very low metric so OSPF prefers this tunnel! Verify:PE-1# show mpls traffic-eng autoroute! Should list Tunnel1 and the destinations it announces into the routing table

MPLS-TE Deployment Checklist

  • OSPF TE extensions enabled: mpls traffic-eng router-id and mpls traffic-eng area 0 in router ospf
  • ip rsvp bandwidth configured on every physical interface that TE tunnels traverse
  • TE tunnels use record-route — essential for verifying the actual path taken by CSPF
  • path-option 2 dynamic as fallback when explicit paths are configured — prevents tunnel staying down during maintenance
  • Fast Reroute: bypass tunnels verified as State: Ready before cutting over production traffic
  • Autoroute metric carefully tuned — don't accidentally attract all traffic onto a single TE tunnel
  • TE tunnel bandwidth reservation ≤ 75% of physical link capacity — leave headroom for non-TE traffic
  • CSPF logs monitored for path computation failures — indicates BW exhaustion or topology change
  • Reoptimization timer set: mpls traffic-eng reoptimize timers frequency 3600 — allows CSPF to find better paths after topology changes