This specifies the fast-reroute method requested for this dynamic tunnel -- none, link-protect (backup covers a single failed link), or node-protect (backup also covers a failed downstream node, not just the link to it) -- and per the description cannot be changed once the tunnel entry is created. An admin chooses node-protect specifically when the next-hop router itself, not just the link to it, is a plausible failure point worth protecting against, since link-protect alone would leave the tunnel exposed if that router failed entirely. For example, a tunnel configured with node-protect(3) continues forwarding via a backup LSP even if the immediate next-hop router itself goes completely offline, something link-protect(2) alone would not cover.