When a link or router fails in an IP network, the routing protocol (OSPF, IS-IS) must detect the failure, flood a new link-state update, run SPF on every router, and install new forwarding entries. Historically this took seconds. For voice, video, and financial trading traffic, seconds are catastrophic. MPLS Fast Reroute solved this for label-switched paths, but pure IP networks were left out in the cold. RFC 5286 fixed that with a beautifully simple idea: precompute a backup next-hop for every destination, and switch to it the instant the primary fails.

The mechanism is called Loop-Free Alternates (LFA). When a router computes its SPF tree, it also examines each neighbor N (other than the primary next-hop) and asks: "If I sent this packet to N, would N send it back to me?" The formal test is the loop-free condition:

Distance(N, D) < Distance(N, S) + Distance(S, D)

Where S is the computing router, N is a candidate backup neighbor, and D is the destination. If N's shortest path to D doesn't traverse S, then S can safely dump packets on N during a failure without creating a micro-loop. The router installs this backup in the FIB alongside the primary. On failure detection — typically via BFD in a few milliseconds — the linecard flips to the backup entry with no control-plane involvement. Convergence drops from seconds to sub-50ms.

The paper also defines stronger conditions: node-protecting LFAs (safe even if the entire next-hop router died, not just the link) and downstream LFAs (safe under multiple simultaneous failures because N is strictly closer to D than S is). Operators pick the flavor based on their topology and paranoia level.

The key design decision was ruthless simplicity. LFA required no new protocol messages, no signaling, no changes to OSPF/IS-IS on the wire. Every router computes its own backups independently using information it already has. Deployment could be incremental — one router at a time, one vendor at a time. This is why LFA shipped in Cisco IOS, Juniper Junos, and every major router OS within a couple of years, and why it now runs invisibly in essentially every tier-1 ISP backbone.

The honest limitation is coverage. On ring topologies (common in metro networks) and other symmetric designs, no neighbor satisfies the loop-free condition — packets sent to any backup would loop back. LFA coverage in real networks often sits around 60-80%. This gap drove the follow-up work on Remote LFAs (RFC 7490, which tunnels to a distant "PQ node") and eventually Topology-Independent LFA (TI-LFA) using Segment Routing, which achieves 100% coverage by encoding the backup path as an SR label stack. Every modern SR-MPLS or SRv6 deployment uses TI-LFA — and TI-LFA is a direct lineal descendant of RFC 5286's condition.

Alia Atlas, the lead editor, was at Avici Systems and later Juniper, and became one of the most influential figures in IP fast-reroute research. The RFC is short by IETF standards — under 30 pages — because the math is so tight. Read it and you'll never look at a routing table the same way: those "primary" next-hops are always shadowed by a silent understudy waiting for the lights to fail.