Context
Subscriber edge is the least forgiving position in a service provider network. It is stateful — every session is an anchor that cannot simply be rerouted — and it is the point at which a fault becomes a customer-visible outage rather than a statistic on a dashboard.
This reference architecture describes how we design that layer: session termination, policy enforcement, redundancy and the assurance loop around it.
The constraints that shape the design
- State is expensive to move. Subscriber sessions carry authentication, address assignment, accounting and QoS state. A failover that discards it forces every affected subscriber to re-authenticate simultaneously — an event that can be worse than the original fault.
- Convergence has a hard budget. Voice and interactive traffic tolerate packet loss measured in tens of milliseconds. The 200 ms design target is chosen so that a single link or node failure never becomes a call drop.
- Scale ceilings are physical. Session count, queue instances and policer counts are bounded by the forwarding silicon. Design has to fit under those limits with headroom, not discover them under load.
Architecture
Underlay. IS-IS with a flat, summarised topology and aggressive but stable timers. BFD provides sub-second liveness detection independent of the routing protocol’s own hellos, so a link that is up but not forwarding is detected as quickly as one that is physically down.
Traffic engineering. Segment Routing removes the per-flow state that RSVP-TE would otherwise put in the core. Paths are expressed as segment lists at the edge; the core simply forwards. Fewer moving parts, and TI-LFA gives pre-computed backup paths that activate without waiting for reconvergence.
Subscriber plane. PPPoE and IPoE termination with RADIUS-driven policy — address assignment, per-subscriber QoS hierarchies, and accounting. Sessions are distributed across redundancy groups so that any single node failure redistributes a bounded fraction of total state.
Redundancy. N+1 at the node level with state synchronisation between protection pairs, so a failover preserves sessions rather than resetting them. The trade-off — synchronisation bandwidth and complexity against re-auth storms — is documented explicitly, because it is the decision most likely to be revisited.
Closed-loop assurance
The part that most designs leave until last, and shouldn’t:
- Streaming telemetry over gNMI with OpenConfig models, at a 10-second cadence for service-affecting counters. Not SNMP polling, which cannot see a microburst and adds control-plane load precisely when the device is busiest.
- Service-level indicators, not device counters. Session establishment success rate, authentication latency percentiles, and per-service-class drop ratios — the things a subscriber actually experiences.
- Burn-rate alerting against an explicit error budget, so an alert means “customers are being affected at a rate that matters” rather than “a counter crossed a threshold”.
- A model-driven source of truth. Device configuration is rendered from a YANG model and validated before deployment; the diff is reviewed like code.
Verification
A design is a hypothesis until it is tested. The verification plan covers:
- Convergence measurement under link, line-card and node failure, using a traffic generator with a known packet cadence so loss translates directly to outage duration.
- Session scale ramp to the design ceiling, holding at scale long enough to expose slow leaks in control-plane memory.
- Failover with state, confirming sessions survive protection switching and measuring how many do not.
- Throughput characterisation using RFC 2544 and Y.1564 methodology with a realistic flow mix, reporting latency distributions rather than averages.
What this demonstrates
Convergence budgets, state redundancy and assurance are not three separate workstreams — they are one design. This architecture shows how we hold them together, and how we make the trade-offs visible rather than implicit.