Segment Routing Path Verification: Reading the Label Stack
SR moves intelligence to the edge — verification means reading labels, not LDP state.
Segment Routing throws away the per-flow signalling of LDP and RSVP. The path is encoded as a stack of labels imposed at the edge. Verification, therefore, is about reading that stack and confirming the SIDs resolve.
Step 1: confirm Node SID allocation
Every node owns a globally significant Node SID drawn from the SRGB. If two nodes claim the same index, traffic is silently misrouted.
from netmiko import ConnectHandler
def node_sids(host):
conn = ConnectHandler(device_type="cisco_xr", host=host,
username="ro", password="••••")
rows = conn.send_command("show isis segment-routing label table",
use_textfsm=True)
return {r["prefix"]: r["sid"] for r in rows}
# detect duplicate SID indexes across the domain
seen = {}
for host in ["10.0.0.1", "10.0.0.2", "10.0.0.3"]:
for prefix, sid in node_sids(host).items():
seen.setdefault(sid, []).append((host, prefix))
dupes = {sid: owners for sid, owners in seen.items() if len(owners) > 1}Step 2: read the imposed label stack
For a given destination, the forwarding table shows exactly which labels get pushed.
stack = conn.send_command("show cef 192.168.50.0/24 detail", use_textfsm=True)
labels = stack[0]["labels"] # e.g. ['16002', '16005']
print("Imposed stack:", labels)Step 3: verify the TI-LFA backup exists
A path is only protected if TI-LFA has precomputed a backup. Confirm a backup path and its repair label are programmed before a failure, not during one.
bk = conn.send_command("show isis fast-reroute 192.168.50.0/24", use_textfsm=True)
protected = any(r.get("backup_next_hop") for r in bk)
if not protected:
print("UNPROTECTED prefix — no TI-LFA backup programmed")Turn it into an invariant
Bundle the three checks — unique SIDs, resolvable stack, protected prefix — into a single run that emits one finding per violation. Keyed as sr/unprotected/192.168.50.0, those findings feed straight into the Intent and RCA engines.
Was this helpful?
Generate scripts for the task covered in this post
Describe what you need and NAPT writes production-ready automation in Netmiko, NAPALM, or Nornir.
Open Script Generator →Related posts
From Noise to Narrative: How the RCA Engine Builds a Causal Story From Your Findings
The Root Cause Analysis engine reads every finding your scripts produce and stitches them into a single causal chain — root, contributing, symptom.
Read →The Streaming Console: A Live Terminal That Remembers Everything
Run any diagnostic script against any device, watch output stream in real time, and end up with structured findings the platform can reason about.
Read →Intent: Saying What You Mean and Proving the Network Agrees
Write a one-line statement of how the network should behave. The Intent engine compiles it into checks and tells you where reality diverges.
Read →