Segment Routing over IPv6 for VPRN
This chapter provides information about segment routing over IPv6 for VPRN.
Topics in this chapter include:
Applicability
The information and configuration in this chapter are based on SR OS Release 22.2.R1. Segment routing over IPv6 (SRv6) is supported on FP4-based equipment in SR OS Release 21.5.R2 and later.
Overview
SRv6 for VPRN allows the transport of VPRN-related IPv4 and IPv6 data across an SRv6-enabled network. To this end, VPRN-related data is sent to an ingress SRv6 router, where it is encapsulated and forwarded via an SRv6 tunnel. The SRv6 tunnel transports the encapsulated data across the SRv6-enabled network to an egress SRv6 router, where it is decapsulated and forwarded further as VPRN-related data. SRv6-tunneled data is encapsulated using an IPv6 header, where the destination address is a unique SRv6 segment identifier (SID), and is processed and forwarded in the IPv6 data plane.
An SRv6 SID is a preconfigured 128-bit routable IPv6 prefix address that is encoded in three parts: a locator, a function, and an argument. The locator is a summary IPv6 prefix for a set of SRv6 SIDs instantiated on an SRv6-capable router. It is used to route the data within the IPv6 transport network. Each participating SRv6-capable router needs its unique locator, based on a common block that all participating SRv6-capable routers share in the IPv6 address space. The function is an opaque identifier that indicates the local behavior at the endpoint of an SRv6 segment. The focus in this topic is on the SRv6 End.DT4 and the SRv6 End.DT6 functions for the VPRN, performing a prefix lookup in the VPRN service IPv4 route table (End.DT4) or in the VPRN service IPv6 route table (End.DT6). The argument is not used in SR OS 22.2.R1 and is set to all zeros.
The local router installs its locator prefix in its IPv6 route table and forwarding information base (FIB), and advertises its locator prefix in IS-IS with the SRv6 locator sub-TLV. Each remote router populates its route table and FIB with the received locator prefixes, including the tunneled next hop to the originating router. Each remote router also populates its VPRN service route table with the received network prefixes, including the tunneled next hop to the VPRN of the originating router.
SRv6 data transport requires additional processing at both the ingress and egress data planes. This processing relies on forwarding path extension (FPE), as described in the Segment Routing over IPv6 chapter.
Configuration
Example topology shows the example topology with three routers. The SRv6-enabled network that it represents comprises PE-1, PE-2, and a route reflector RR-3 in the control plane. The SRv6-enabled network has only IPv6 addresses and interfaces.
For the transport of IPv4 and IPv6 data from the VPRN on PE-1 to the VPRN on PE-2, PE-1 acts as the SRv6 ingress PE node, while PE-2 acts as the SRv6 egress PE node. For the transport of IPv4 and IPv6 data from the VPRN on PE-2 to the VPRN on PE-1, PE-2 acts as the SRv6 ingress PE node, while PE-1 acts as the SRv6 egress PE node. To explain SRv6 for VPRN, the topology does not need an SRv6 transit router, because SRv6 transit routers simply forward SRv6-encapsulated packets via IPv6 route table lookup without any other processing.
SRv6 and FPE are configured only on PE-1 and on PE-2. RR-3 acts as the BGP route reflector in the control plane. RR-3 does not participate in the SRv6 data transport that only exists between PE-1 and PE-2.
The ping and traceroute commands between IPv4 and IPv6 loopback addresses in the VPRNs simulate data transport.
The configuration for this example topology is symmetrical. All configure and show command output examples for PE-1 also apply to PE-2. The configure and show commands with deviating output examples for RR-3 are explicitly mentioned.
Configure the router
This configuration includes:
- ports and IPv6-only interfaces on PE-1, PE-2, and RR-3
- port cross-connect (PXC) on PE-1 and PE-2, using internal loopbacks on an FP4 MAC chip, as described in the Segment Routing over IPv6 chapter
- IS-IS
- On PE-1, PE-2, and RR-3, include:
- level 2 capability with wide metrics (for the 128-bit identifiers)
- native IPv6 routing
- On PE-1 and PE-2, as a best practice to advertise the router
capability within the autonomous system (AS), also configure:
- traffic-engineering
- traffic-engineering-options
- On PE-1, PE-2, and RR-3, include:
- BGP on PE-1, PE-2, and RR-3, with internal group “gr_v6_internal” that
includes:
- IPv4 and IPv6 families
- extended-nh-encoding for IPv4
- advertise-ipv6-next-hops for IPv4
- BGP neighbor system IPv6 addresses
- On PE-1 and PE-2 only: next-hop-self
The core network topology uses IPv6 for BGP peering (with 16 byte next hop addresses), so to advertise and receive IPv4 routes (which have 4 byte next hop addresses) with IPv6 next hop addresses, the commands advertise-ipv6-next-hops and extended-nh-encoding need to be configured at the BGP, group, or neighbor level. The advertise-ipv6-next-hops command instructs the system to advertise IPv4 routes with IPv6 next hop addresses. The extended-nh-encoding command configures BGP to advertise the capability to receive IPv4 routes with IPv6 next hop addresses.
The following example configuration applies for PE-1 and is similar for PE-2.
*A:PE-1# configure
router Base
interface "int-PE-1-PE-2"
description "interface between PE-1 and PE-2"
port 1/1/c1/1:1000
ipv6
address 2001:db8::168:12:1/126
exit
no shutdown
exit
interface "int-PE-1-RR-3"
description "interface between PE-1 and RR-3"
port 1/1/c2/1:1000
ipv6
address 2001:db8::168:13:1/126
exit
no shutdown
exit
interface "system"
description "system interface of PE-1"
ipv6
address 2001:db8::2:1/128
exit
no shutdown
exit
autonomous-system 64500
isis 0
router-id 1.1.1.1
level-capability level-2 # required for SRv6
area-id 49.0001
traffic-engineering
traffic-engineering-options
ipv6
application-link-attributes
exit
exit
advertise-router-capability as
ipv6-routing native
level 2
wide-metrics-only # required for SRv6
exit
interface "system"
passive
no shutdown
exit
interface "int-PE-1-PE-2"
interface-type point-to-point
no shutdown
exit
interface "int-PE-1-RR-3"
interface-type point-to-point
no shutdown
exit
no shutdown
exit
bgp
min-route-advertisement 1
router-id 2.2.2.1
rapid-withdrawal
split-horizon
group "gr_v6_internal"
description "internal bgp group on PE-1"
family ipv4 ipv6
next-hop-self
type internal
extended-nh-encoding ipv4
advertise-ipv6-next-hops ipv4
neighbor 2001:db8::2:3 # RR-3 system address
exit
exit
no shutdown
exit
exit all
The following example configuration applies for RR-3:
*A:RR-3# configure
router Base
interface "int-RR-3-PE-1"
description "interface between RR-3 and PE-1"
ipv6
address 2001:db8::168:13:2/126
exit
port 1/1/c1/1:1000
exit
interface "int-RR-3-PE-2"
description "interface between RR-3 and PE-2"
ipv6
address 2001:db8::168:23:2/126
exit
port 1/1/c2/1:1000
exit
interface "system"
description "system interface of RR-3"
ipv6
address 2001:db8::2:3/128
exit
exit
autonomous-system 64500
isis 0
router-id 1.1.1.3
level-capability level-2 # required for SRv6
area-id 49.0001
ipv6-routing native
level 2
wide-metrics-only # required for SRv6
exit
interface "system"
passive
no shutdown
exit
interface "int-RR-3-PE-1"
interface-type point-to-point
no shutdown
exit
interface "int-RR-3-PE-2"
interface-type point-to-point
no shutdown
exit
no shutdown
exit
bgp
min-route-advertisement 1
router-id 2.2.2.3
rapid-withdrawal
split-horizon
group "gr_v6_internal"
description "internal bgp group on RR-3"
family ipv4 ipv6
type internal
cluster 3.3.3.3
extended-nh-encoding ipv4
advertise-ipv6-next-hops ipv4
neighbor 2001:db8::2:1 # PE-1 system address
exit
neighbor 2001:db8::2:2 # PE-2 system address
exit
exit
no shutdown
exit
exit all
Configure the VPRN services on PE-1 and on PE-2
This configuration includes:
- an IPv4 address and an IPv6 address for a loopback interface "lb_itf_vprn"
- BGP, with external group “gr_v6_vprn” that includes the following
capabilities:
- IPv4 and IPv6 families
- extended-nh-encoding for IPv4
- advertise-ipv6-next-hops for IPv4
- BGP neighbor interface IPv6 addresses, with BGP neighbors in a different external AS
The following example configuration applies for VPRN 2 on PE-1 and is similar for VPRN 2 on PE-2.
*A:PE-1# configure service
vprn 2 name "VPRN_2" customer 1 create
description "VPRN 2 on PE-1"
autonomous-system 64500
interface "lb_itf_vprn" create
address 172.16.211.1/32
description "VPRN 2 interface on PE-1 for external subnet"
ipv6
address 2001:db8:211::1/128
exit
loopback
exit
bgp
group "gr_v6_vprn"
description "external bgp group for VPRN 2 on PE-1"
family ipv4 ipv6
extended-nh-encoding ipv4
advertise-ipv6-next-hops ipv4
neighbor 2001:db8:101::1
type external
peer-as 64501
exit
exit
no shutdown
exit
no shutdown
exit all
At this point, verify that data transport is not possible between the local VPRN on PE-1 and the remote VPRN on PE-2.
*A:PE-1# ping router 2 172.16.222.1
PING 172.16.222.1 56 data bytes
No route to destination. Address: 172.16.222.1, Service: 2
---snip---
---- 172.16.222.1 PING Statistics ----
5 packets transmitted, 0 packets received, 100% packet loss
*A:PE-1# ping router 2 2001:db8:222::1
PING 2001:db8:222::1 56 data bytes
No route to destination. Address: 2001:db8:222::1, Service: 2
---snip---
---- 2001:db8:222::1 PING Statistics ----
5 packets transmitted, 0 packets received, 100% packet lossThe result of the verification complies with the route table for the local VPRN on PE-1 that only contains local routes for its own loopback addresses:
*A:PE-1# show router 2 route-table ipv4
===============================================================================
Route Table (Service: 2)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Active Metric
-------------------------------------------------------------------------------
172.16.211.1/32 Local Local 00h01m11s 0
lb_itf_vprn Y 0
-------------------------------------------------------------------------------
No. of Routes: 1
---snip---
===============================================================================
*A:PE-1# show router 2 route-table ipv6
===============================================================================
IPv6 Route Table (Service: 2)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Active Metric
-------------------------------------------------------------------------------
2001:db8:211::1/128 Local Local 00h01m10s 0
lb_itf_vprn Y 0
-------------------------------------------------------------------------------
No. of Routes: 1
---snip---
===============================================================================
Perform the same verification for data transport between the remote VPRN on PE-2 and the local VPRN on PE-1.
Configure SRv6 in the router Base context on PE-1 and on PE-2
Configure the locator in the router Base segment-routing segment-routing-v6 context on PE-2 and similar on PE-1, with ip-prefix 2001:db8:aaaa:101::/64 for locator “PE-1_loc”.
*A:PE-2# configure router Base segment-routing segment-routing-v6
locator "PE-2_loc"
block-length 48
prefix
ip-prefix 2001:db8:aaaa:102::/64
exit
no shutdown
exit all
Configure the FPEs on PE-2 and identical on PE-1.
*A:PE-2# configure
fwd-path-ext
fpe 1 create
path pxc 1
srv6 origination
interface-a
exit
interface-b
exit
exit
exit
fpe 2 create
path pxc 2
srv6 termination
interface-a
exit
interface-b
exit
exit
exit
exit all
Use FPE 1 as the SRv6 origination FPE in the router Base segment-routing segment-routing-v6 context and FPE 2 as the SRv6 termination FPE in the router Base segment-routing segment-routing-v6 locator context on PE-2 and similar on PE-1, for locator “PE-1_loc”. For more information, see the Segment Routing over IPv6 chapter.
*A:PE-2# configure router Base segment-routing
segment-routing-v6
origination-fpe 1
locator "PE-2_loc"
termination-fpe 2
no shutdown
exit
exit allConfigure the SRv6 End function (equivalent to an IPv4 node SID) and SRv6 End.X functions (equivalent to IPv4 adjacency SIDs) in the router Base segment-routing segment-routing-v6 base-routing-instance locator context on PE-2 and similar on PE-1, for locator “PE-1_loc”.
*A:PE-2# configure router Base segment-routing
segment-routing-v6
locator "PE-2_loc"
static-function
max-entries 1
exit
no shutdown
exit
base-routing-instance
locator "PE-2_loc"
function
end-x-auto-allocate srh-mode psp protection unprotected
end 1
srh-mode usp
exit
exit
exit
exit
exit all
Advertise the locator in IS-IS while ensuring level 2 capability on PE-2 and similar on PE-1, for locator “PE-1_loc”.
*A:PE-2# configure router Base isis 0
segment-routing-v6
locator "PE-2_loc"
level-capability level-2
level 1
exit
level 2
exit
exit
no shutdown
exit all
A summary of the locator and origination FPE configuration can be displayed with the show router segment-routing-v6 summary command.
Verify the SRv6 local SIDs on PE-2 and similar on PE-1. Three SRv6 local SIDs are created: one for the statically configured SRv6 End function (configured in the router Base segment-routing segment-routing-v6 base-routing-instance locator context) and two for the automatically allocated SRv6 End.X functions (one facing PE-1 and one facing RR-3). All three SRv6 local SIDs are concatenated with the locator. The statically configured SRv6 End function appears first with function number 1. In the example, the automatically allocated SRv6 End.X functions receive function numbers 2 and 3 respectively. RR-3 has no SRv6 configuration and does not have these SRv6 local SIDs and SRv6 functions.
*A:PE-2# show router segment-routing-v6 local-sid
===============================================================================
Segment Routing v6 Local SIDs
===============================================================================
SID Type Function
Locator
Context
-------------------------------------------------------------------------------
2001:db8:aaaa:102:0:1000:: End 1
PE-2_loc
Base
2001:db8:aaaa:102:0:2000:: End.X 2
PE-2_loc
None
2001:db8:aaaa:102:0:3000:: End.X 3
PE-2_loc
None
-------------------------------------------------------------------------------
SIDs : 3
-------------------------------------------------------------------------------
===============================================================================
Verify the SRv6 base routing instance details on PE-2 and similar on PE-1. The SRv6 functions for the configured locator are listed. The SRv6 End function is statically configured. There is an automatically allocated SRv6 End.X function for each IS-IS neighbor.
*A:PE-2# show router segment-routing-v6 base-routing-instance
===============================================================================
Segment Routing v6 Base Routing Instance
===============================================================================
Locator
Type Function SID Status/InstId
SRH-mode Protection Interface
-------------------------------------------------------------------------------
PE-2_loc
End 1 2001:db8:aaaa:102:0:1000:: ok
USP
-------------------------------------------------------------------------------
Auto-allocated End.X: PSP Unprotected,
-------------------------------------------------------------------------------
End.X *2 2001:db8:aaaa:102:0:2000:: 0
PSP Unprotected int-PE-2-PE-1
ISIS Level: L2 Mac Address: 04:0a:01:01:00:01 Nbr Sys Id: 0010.0100.1001
End.X *3 2001:db8:aaaa:102:0:3000:: 0
PSP Unprotected int-PE-2-RR-3
ISIS Level: L2 Mac Address: 04:12:01:01:00:0b Nbr Sys Id: 0010.0100.1003
-------------------------------------------------------------------------------
===============================================================================
Legend: * - System allocated
Verify the IPv6 route table on PE-1. The IPv6 route table also has routes to the local and learned remote locators and to the local SRv6 function SIDs. The remotely configured locator prefix of PE-2 is reached via an SRv6 tunnel. The routes with protocol “SRV6” correspond with the locally configured locator prefix of PE-1 or the locally configured SRv6 End function.
*A:PE-1# show router route-table ipv6
===============================================================================
IPv6 Route Table (Router: Base)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
2001:db8::2:1/128 Local Local 00h10m37s 0
system 0
2001:db8::2:2/128 Remote ISIS 00h00m34s 18
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 10
2001:db8::2:3/128 Remote ISIS 00h00m34s 18
fe80::611:ffff:fe00:0-"int-PE-1-RR-3" 10
2001:db8::168:12:0/126 Local Local 00h10m35s 0
int-PE-1-PE-2 0
2001:db8::168:13:0/126 Local Local 00h10m36s 0
int-PE-1-RR-3 0
2001:db8::168:23:0/126 Remote ISIS 00h00m34s 18
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 20
2001:db8:aaaa:101::/64 Local SRV6 00h01m58s 3
fe80::201-"_tmnx_fpe_2.a" 0
2001:db8:aaaa:101:0:1000::/128 Local SRV6 00h01m13s 3
Black Hole 0
2001:db8:aaaa:101:0:2000::/128 Local ISIS 00h00m35s 18
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 10
2001:db8:aaaa:101:0:3000::/128 Local ISIS 00h00m35s 18
fe80::611:ffff:fe00:0-"int-PE-1-RR-3" 10
2001:db8:aaaa:102::/64 Remote ISIS 00h00m20s 18
2001:db8:aaaa:102::/64 (tunneled:SRV6-ISIS) 10
-------------------------------------------------------------------------------
No. of Routes: 11
---snip---
===============================================================================
Verify that the tunnel from PE-1 to the remote locator has SRv6 encapsulation and similar for the tunnel from PE-2. The tunnel table on RR-3 remains empty.
*A:PE-1# show router tunnel-table ipv6
===============================================================================
IPv6 Tunnel Table (Router: Base)
===============================================================================
Destination Owner Encap TunnelId Pref
Nexthop Color Metric
-------------------------------------------------------------------------------
2001:db8:aaaa:102::/64 srv6-isis SRV6 524289 0
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 10
-------------------------------------------------------------------------------
---snip---
===============================================================================
Verify that the tunnel from PE-1 to the remote locator uses the “int-PE-1-PE-2” interface and similar for the tunnel from PE-2, where the tunnel to the remote locator uses the “int-PE-2-PE-1” interface. Interface “int-PE-1-PE-2” is configured on port 1/1/c1/1:1000. The FP tunnel table on RR-3 remains empty.
*A:PE-1# show router fp-tunnel-table 1 ipv6
===============================================================================
IPv6 Tunnel Table Display
Legend:
label stack is ordered from bottom-most to top-most
B - FRR Backup
===============================================================================
Destination Protocol Tunnel-ID
Lbl/SID
NextHop Intf/Tunnel
Lbl/SID (backup)
NextHop (backup)
-------------------------------------------------------------------------------
2001:db8:aaaa:102::/64 SRV6 524289
-
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 1/1/c1/1:1000
-------------------------------------------------------------------------------
Total Entries : 1
-------------------------------------------------------------------------------
===============================================================================
Verify the IS-IS data base on PE-1 with show router isis database detail. The output of this command provides information on each IS-IS-enabled router. Per uniquely identified IS-IS-enabled router, the SRv6 information indicates:
- the IS-IS-advertised router capabilities
- the advertised SRv6 locator TLV
- the advertised configured SRv6 End SID and automatically allocated SRv6 End.X SIDs
*A:PE-1# show router isis database detail
===============================================================================
Rtr Base ISIS Instance 0 Database (detail)
===============================================================================
Displaying Level 1 database
-------------------------------------------------------------------------------
Level (1) LSP Count : 0
Displaying Level 2 database
-------------------------------------------------------------------------------
LSP ID : PE-1.00-00 Level : L2
Sequence : 0x5 Checksum : 0x6a3a Lifetime : 1165
Version : 1 Pkt Type : 20 Pkt Ver : 1
Attributes: L1L2 Max Area : 3 Alloc Len : 1492
SYS ID : 0010.0100.1001 SysID Len : 6 Used Len : 398
TLVs :
Area Addresses:
Area Address : (3) 49.0001
Supp Protocols:
Protocols : IPv4
Protocols : IPv6
IS-Hostname : PE-1
Router ID :
Router ID : 1.1.1.1
TE Router ID v6 :
Router ID : 2001:db8::2:1
Router Cap : 1.1.1.1, D:0, S:0
TE Node Cap : B E M P
SRv6 Cap: 0x0000
SR Alg: metric based SPF
Node MSD Cap: BMI : 0 SRH-MAX-SL : 10 SRH-MAX-END-POP : 9 SRH-MAX-H-ENCAPS : 1 SRH-MAX-END-D : 9
I/F Addresses IPv6 :
IPv6 Address : 2001:db8::2:1
IPv6 Address : 2001:db8::168:12:1
IPv6 Address : 2001:db8::168:13:1
TE IS Nbrs :
Nbr : PE-2.00
Default Metric : 10
Sub TLV Len : 60
IPv6 Addr : 2001:db8::168:12:1
Nbr IPv6 : 2001:db8::168:12:2
End.X-SID: 2001:db8:aaaa:101:0:2000:: flags: algo:0 weight:0 endpoint:End.X-PSP
TE IS Nbrs :
Nbr : RR-3.00
Default Metric : 10
Sub TLV Len : 42
IPv6 Addr : 2001:db8::168:13:1
End.X-SID: 2001:db8:aaaa:101:0:3000:: flags: algo:0 weight:0 endpoint:End.X-PSP
IPv6 Reach:
Metric: ( I ) 0
Prefix : 2001:db8::2:1/128
Metric: ( I ) 10
Prefix : 2001:db8::168:12:0/126
Metric: ( I ) 10
Prefix : 2001:db8::168:13:0/126
Metric: ( I ) 0
Prefix : 2001:db8:aaaa:101::/64
SRv6 Locator :
MT ID : 0
Metric: ( ) 0 Algo:0
Prefix : 2001:db8:aaaa:101::/64
Sub TLV :
End-SID : 2001:db8:aaaa:101:0:1000::, flags:0x0, endpoint:End-USP
-------------------------------------------------------------------------------
LSP ID : PE-2.00-00 Level : L2
Sequence : 0x5 Checksum : 0xe97e Lifetime : 1178
Version : 1 Pkt Type : 20 Pkt Ver : 1
Attributes: L1L2 Max Area : 3 Alloc Len : 398
SYS ID : 0010.0100.1002 SysID Len : 6 Used Len : 398
TLVs :
Area Addresses:
Area Address : (3) 49.0001
Supp Protocols:
Protocols : IPv4
Protocols : IPv6
IS-Hostname : PE-2
Router ID :
Router ID : 1.1.1.2
TE Router ID v6 :
Router ID : 2001:db8::2:2
Router Cap : 1.1.1.2, D:0, S:0
TE Node Cap : B E M P
SRv6 Cap: 0x0000
SR Alg: metric based SPF
Node MSD Cap: BMI : 0 SRH-MAX-SL : 10 SRH-MAX-END-POP : 9 SRH-MAX-H-ENCAPS : 1 SRH-MAX-END-D : 9
I/F Addresses IPv6 :
IPv6 Address : 2001:db8::2:2
IPv6 Address : 2001:db8::168:12:2
IPv6 Address : 2001:db8::168:23:1
TE IS Nbrs :
Nbr : PE-1.00
Default Metric : 10
Sub TLV Len : 60
IPv6 Addr : 2001:db8::168:12:2
Nbr IPv6 : 2001:db8::168:12:1
End.X-SID: 2001:db8:aaaa:102:0:2000:: flags: algo:0 weight:0 endpoint:End.X-PSP
TE IS Nbrs :
Nbr : RR-3.00
Default Metric : 10
Sub TLV Len : 42
IPv6 Addr : 2001:db8::168:23:1
End.X-SID: 2001:db8:aaaa:102:0:3000:: flags: algo:0 weight:0 endpoint:End.X-PSP
IPv6 Reach:
Metric: ( I ) 0
Prefix : 2001:db8::2:2/128
Metric: ( I ) 10
Prefix : 2001:db8::168:12:0/126
Metric: ( I ) 10
Prefix : 2001:db8::168:23:0/126
Metric: ( I ) 0
Prefix : 2001:db8:aaaa:102::/64
SRv6 Locator :
MT ID : 0
Metric: ( ) 0 Algo:0
Prefix : 2001:db8:aaaa:102::/64
Sub TLV :
End-SID : 2001:db8:aaaa:102:0:1000::, flags:0x0, endpoint:End-USP
-------------------------------------------------------------------------------
LSP ID : RR-3.00-00 Level : L2
Sequence : 0x3 Checksum : 0xdba6 Lifetime : 702
Version : 1 Pkt Type : 20 Pkt Ver : 1
Attributes: L1L2 Max Area : 3 Alloc Len : 193
SYS ID : 0010.0100.1003 SysID Len : 6 Used Len : 193
TLVs :
Area Addresses:
Area Address : (3) 49.0001
Supp Protocols:
Protocols : IPv4
Protocols : IPv6
IS-Hostname : RR-3
Router ID :
Router ID : 1.1.1.3
I/F Addresses IPv6 :
IPv6 Address : 2001:db8::2:3
IPv6 Address : 2001:db8::168:13:2
IPv6 Address : 2001:db8::168:23:2
TE IS Nbrs :
Nbr : PE-1.00
Default Metric : 10
Sub TLV Len : 0
TE IS Nbrs :
Nbr : PE-2.00
Default Metric : 10
Sub TLV Len : 0
IPv6 Reach:
Metric: ( I ) 0
Prefix : 2001:db8::2:3/128
Metric: ( I ) 10
Prefix : 2001:db8::168:13:0/126
Metric: ( I ) 10
Prefix : 2001:db8::168:23:0/126
Level (2) LSP Count : 3
-------------------------------------------------------------------------------
---snip---
===============================================================================
Verify the IS-IS routes on PE-1 and similar on PE-2.
*A:PE-1# show router isis routes
===============================================================================
Rtr Base ISIS Instance 0 Route Table
===============================================================================
Prefix[Flags] Metric Lvl/Typ Ver. SysID/Hostname
NextHop MT AdminTag/SID[F]
-------------------------------------------------------------------------------
2001:db8::2:1/128 0 2/Int. 2 PE-1
:: 0 0
2001:db8::2:2/128 10 2/Int. 9 PE-2
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 0 0
2001:db8::2:3/128 10 2/Int. 9 RR-3
fe80::611:ffff:fe00:0-"int-PE-1-RR-3" 0 0
2001:db8::168:12:0/126 10 2/Int. 4 PE-1
:: 0 0
2001:db8::168:13:0/126 10 2/Int. 4 PE-1
:: 0 0
2001:db8::168:23:0/126 20 2/Int. 9 PE-2
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 0 0
2001:db8:aaaa:101::/64 0 2/Int. 10 PE-1
:: 0 0
2001:db8:aaaa:102::/64 10 2/Int. 10 PE-2
fe80::60e:1ff:fe01:1-"int-PE-1-PE-2" 0 0
-------------------------------------------------------------------------------
No. of Routes: 8 (8 paths)
-------------------------------------------------------------------------------
---snip---
===============================================================================
This output corresponds with the information in the route table and in the FIB.
The BGP groups can be verified with the show router bgp group command. PE-1 and PE-2 know the internal and the external BGP groups. RR-3 only knows the internal BGP group.
The BGP next hops can be verified with the following commands:
- show router bgp next-hop ipv4
- show router bgp next-hop ipv6
- show router bgp next-hop vpn-ipv4
- show router bgp next-hop vpn-ipv6
Verify on PE-1 and similar on PE-2 that the locator prefixes are locally configured and advertised. In this example, PE-1 is aware of both locators. One locator is locally configured; the other is learned from the PE-2 advertisement.
*A:PE-1# show router isis segment-routing-v6 locator
===============================================================================
Rtr Base ISIS Instance 0 SRv6 Locator Table
===============================================================================
Prefix AdvRtr MT Lvl/Typ
AttributeFlags Tag Flags Algo
-------------------------------------------------------------------------------
2001:db8:aaaa:101::/64 PE-1 0 2/Int.
- 0 - 0
2001:db8:aaaa:102::/64 PE-2 0 2/Int.
- 0 - 0
-------------------------------------------------------------------------------
No. of Locators: 2
-------------------------------------------------------------------------------
---snip---
===============================================================================
Verify on PE-1 and similar on PE-2 that the SRv6 End SIDs are locally configured and advertised. In this example, PE-1 is aware of both SRv6 End SIDs. One End SID is locally configured; the other is learned from the PE-2 advertisement.
*A:PE-1# show router isis segment-routing-v6 end-sid
===============================================================================
Rtr Base ISIS Instance 0 SRv6 End SID Table
===============================================================================
Prefix AdvRtr MT Lvl/Typ
Sid Behavior Flags Algo
-------------------------------------------------------------------------------
2001:db8:aaaa:101::/64 PE-1 0 2/Int.
2001:db8:aaaa:101:0:1000:: End USP - 0
2001:db8:aaaa:102::/64 PE-2 0 2/Int.
2001:db8:aaaa:102:0:1000:: End USP - 0
-------------------------------------------------------------------------------
No. of End SIDs: 2
===============================================================================
Configure SRv6 for the VPRNs on PE-1 and on PE-2
On PE-1, PE-2, and RR-3, extend the BGP advertisements to include the VPN-IPv4 and VPN-IPv6 families.
configure
router Base
bgp
rapid-update vpn-ipv4 vpn-ipv6
group "gr_v6_internal"
family ipv4 ipv6 vpn-ipv4 vpn-ipv6
extended-nh-encoding ipv4 vpn-ipv4
advertise-ipv6-next-hops ipv4 vpn-ipv4 vpn-ipv6
exit
no shutdown
exit
exit
exit
On PE-2, create an SRv6 instance for the VPRN service. Use the locator from the router Base segment-routing segment-routing-v6 context and configure End.DT4 and End.DT6 functions for it.
Use the created SRv6 instance in the service vprn bgp-ipvpn segment-routing-v6 context, with the configured locator as the default locator. Ensure a unique route distinguisher. Use the unique PE-2 system IPv6 address as the source address. Perform a similar configuration on PE-1, with the PE-1 locator as the default locator, the PE-1 system IPv6 address as the source address, and a different route distinguisher.
*A:PE-2# configure service
vprn 2
segment-routing-v6 1 crea
locator "PE-2_loc"
function
end-dt4
end-dt6
exit
exit
exit
bgp-ipvpn
segment-routing-v6
route-distinguisher 192.0.2.2:2
srv6-instance 1 default-locator "PE-2_loc"
source-address 2001:db8::2:2
vrf-target target:64506:2
no shutdown
exit
exit
no shutdown
exit all
This configuration results in BGP update exchanges from PE-2 to PE-1, via RR-3, and similar from PE-1 to PE-2, via RR-3. PE-2 sends BGP updates to RR-3 for the VPN-IPv4 and the VPN-IPv6 families respectively. Each BGP update advertises the VPN-IPv4 or VPN-IPv6 address family, the reachable network prefixes, the AS to which they belong, and an SRv6 Services TLV. The SRv6 Services TLV indicates that resolution to an SRv6 SID is available, making use of the endpoint behavior that is configured for the VPN-IPv4 or VPN-IPv6 address family on the locator. PE-1 programs the route prefixes with an SRv6 tunnel next hop in its VPRN service route table and in its FIB. PE-1 and PE-2 advertise only the SRv6 SIDs for the SRv6 End.DT4 and SRv6 End.DT6 functions.
When debug logging for BGP updates is configured, this configuration results in the following BGP update logs for the VPN-IPv4 address family.
Consider the example for VPN-IPv4 prefix 172.16.222.1/32. Similar BGP update logs are generated also for VPN-IPv4 prefix 172.16.211.1/32, in the other direction.
The following BGP update log is for the VPN-IPv4 address family. It is sent by PE-2 and received (via RR-3) by PE-1:
*A:PE-1# show log log-id 2
---snip---
3 2022/06/21 13:45:48.507 UTC MINOR: DEBUG #2001 Base Peer 1: 2001:db8::2:3
"Peer 1: 2001:db8::2:3: UPDATE
Peer 1: 2001:db8::2:3 - Received BGP UPDATE:
Withdrawn Length = 0
Total Path Attr Length = 128
Flag: 0x90 Type: 14 Len: 45 Multiprotocol Reachable NLRI:
Address Family VPN_IPV4
NextHop len 24 NextHop 2001:db8::2:2
172.16.222.1/32 RD 192.0.2.2:2 Label 524288 (Raw label 0x800001)
Flag: 0x40 Type: 1 Len: 1 Origin: 0
Flag: 0x40 Type: 2 Len: 0 AS Path:
Flag: 0x40 Type: 5 Len: 4 Local Preference: 100
Flag: 0x80 Type: 9 Len: 4 Originator ID: 2.2.2.2
Flag: 0x80 Type: 10 Len: 4 Cluster ID:
3.3.3.3
Flag: 0xc0 Type: 16 Len: 8 Extended Community:
target:64506:2
Flag: 0xc0 Type: 40 Len: 37 Prefix-SID-attr:
SRv6 Services TLV (37 bytes):-
Type: SRV6 L3 Service TLV (5)
Length: 34 bytes, Reserved: 0x0
SRv6 Service Information Sub-TLV (33 bytes)
Type: 1 Len: 30 Rsvd1: 0x0
SRv6 SID: 2001:db8:aaaa:102::
SID Flags: 0x0 Endpoint Behavior: 0x13 Rsvd2: 0x0
SRv6 SID Sub-Sub-TLV
Type: 1 Len: 6
BL:48 NL:16 FL:20 AL:0 TL:20 TO:64
"
---snip---
Similar BGP update logs are generated for the VPN-IPv6 address family.
Consider the example for VPN-IPv6 prefix 2001:db8:222::1/128. Similar BGP update logs are generated also for VPN-IPv6 prefix 2001:db8:211::1/128, in the other direction.
The following BGP update log is for the VPN-IPv6 address family. It is sent by PE-2 and received (via RR-3) by PE-1:
---snip---
4 2022/06/21 13:45:48.508 UTC MINOR: DEBUG #2001 Base Peer 1: 2001:db8::2:3
"Peer 1: 2001:db8::2:3: UPDATE
Peer 1: 2001:db8::2:3 - Received BGP UPDATE:
Withdrawn Length = 0
Total Path Attr Length = 140
Flag: 0x90 Type: 14 Len: 57 Multiprotocol Reachable NLRI:
Address Family VPN_IPV6
NextHop len 24 NextHop 2001:db8::2:2
2001:db8:222::1/128 RD 192.0.2.2:2 Label 524287 (Raw label 0x7ffff1)
Flag: 0x40 Type: 1 Len: 1 Origin: 0
Flag: 0x40 Type: 2 Len: 0 AS Path:
Flag: 0x40 Type: 5 Len: 4 Local Preference: 100
Flag: 0x80 Type: 9 Len: 4 Originator ID: 2.2.2.2
Flag: 0x80 Type: 10 Len: 4 Cluster ID:
3.3.3.3
Flag: 0xc0 Type: 16 Len: 8 Extended Community:
target:64506:2
Flag: 0xc0 Type: 40 Len: 37 Prefix-SID-attr:
SRv6 Services TLV (37 bytes):-
Type: SRV6 L3 Service TLV (5)
Length: 34 bytes, Reserved: 0x0
SRv6 Service Information Sub-TLV (33 bytes)
Type: 1 Len: 30 Rsvd1: 0x0
SRv6 SID: 2001:db8:aaaa:102::
SID Flags: 0x0 Endpoint Behavior: 0x12 Rsvd2: 0x0
SRv6 SID Sub-Sub-TLV
Type: 1 Len: 6
BL:48 NL:16 FL:20 AL:0 TL:20 TO:64
"
---snip---
PE-1 receives from BGP peer RR-3 (peer router id 2.2.2.3) the information for network prefix 172.16.222.1/32 that PE-2 (originator id 2.2.2.2) advertised, as displayed in the RIB In Entries section in the following example. PE-1 programs route prefix 172.16.222.1/32 in its local VPRN service route table and FIB. The presence of the SRv6 Services TLV indicates that the next hop is the VPRN SRv6 End.DT4 SID which, in turn, is resolved to the remote locator for PE-2. PE-2 expects the data with VPN label 524288. PE-2 has concatenated the hexadecimal value 0x80000 of this VPN label to the remote SRv6 SID prefix 2001:db8:aaaa:102:: to form the remote SRv6 full SID 2001:db8:aaaa:102:8000:: that PE-1 must use. PE-1 uses the path that corresponds with this information (flags field). PE-1 sends SRv6 encapsulated IPv4 data from the VPRN in an SRv6 tunnel to the remote locator prefix of PE-2 on its “int-PE-1-PE-2” interface (as is shown in the output of the show router tunnel-table ipv6 command). PE-1 uses the VPRN 2 route table for the prefix lookup (VPRN imported field).
PE-1 advertises to BGP peer RR-3 (peer router id 2.2.2.3) the information for network prefix 172.16.211.1/32, as displayed in the RIB Out Entries section in the following example. RR-3 forwards this information to its BGP neighbors, in this case PE-2. PE-2 acts in a similar way as PE-1.
The following output shows the corresponding VPN-IPv4 BGP routes on PE-1:
*A:PE-1# show router bgp routes vpn-ipv4 hunt
===============================================================================
BGP Router ID:2.2.2.1 AS:64500 Local AS:64500
===============================================================================
---snip---
===============================================================================
BGP VPN-IPv4 Routes
===============================================================================
-------------------------------------------------------------------------------
RIB In Entries
-------------------------------------------------------------------------------
Network : 172.16.222.1/32
Nexthop : 2001:db8::2:2
Route Dist. : 192.0.2.2:2 VPN Label : 524288
Path Id : None
From : 2001:db8::2:3
Res. Nexthop : n/a
Local Pref. : 100 Interface Name : int-PE-1-PE-2
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64506:2
Cluster : 3.3.3.3
Originator Id : 2.2.2.2 Peer Router Id : 2.2.2.3
Fwd Class : None Priority : None
Flags : Used Valid Best IGP
Route Source : Internal
AS-Path : No As-Path
Route Tag : 0
Neighbor-AS : n/a
Orig Validation: N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h00m34s
SRv6 TLV Type : SRv6 L3 Service TLV (5)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:102::
Full Sid : 2001:db8:aaaa:102:8000::
Behavior : End.DT4 (19)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
VPRN Imported : 2
-------------------------------------------------------------------------------
RIB Out Entries
-------------------------------------------------------------------------------
Network : 172.16.211.1/32
Nexthop : 2001:db8::2:1
Route Dist. : 192.0.2.1:2 VPN Label : 524288
Path Id : None
To : 2001:db8::2:3
Res. Nexthop : n/a
Local Pref. : 100 Interface Name : NotAvailable
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : n/a
Connector : None
Community : target:64506:2
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 2.2.2.3
Origin : IGP
AS-Path : No As-Path
Route Tag : 0
Neighbor-AS : n/a
Orig Validation: N/A
Source Class : 0 Dest Class : 0
SRv6 TLV Type : SRv6 L3 Service TLV (5)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:101::
Full Sid : 2001:db8:aaaa:101:8000::
Behavior : End.DT4 (19)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
For IPv6 data transport, VPRN End.DT6 behavior is needed. The IPv6 data transport uses a different VPN label 524287, resulting in a different full SRv6 SID ending with 7fff:f000::. PE-1 sends SRv6 encapsulated IPv6 data from the VPRN in an SRv6 tunnel to the remote locator prefix of PE-2 on its “int-PE-1-PE-2” interface (as is shown in the output of the show router tunnel-table ipv6 command).
The following output shows the corresponding VPN-IPv6 BGP routes on PE-1:
*A:PE-1# show router bgp routes vpn-ipv6 hunt
===============================================================================
BGP Router ID:2.2.2.1 AS:64500 Local AS:64500
===============================================================================
---snip---
===============================================================================
BGP VPN-IPv6 Routes
===============================================================================
-------------------------------------------------------------------------------
RIB In Entries
-------------------------------------------------------------------------------
Network : 2001:db8:222::1/128
Nexthop : 2001:db8::2:2
Route Dist. : 192.0.2.2:2 VPN Label : 524287
Path Id : None
From : 2001:db8::2:3
Res. Nexthop : n/a
Local Pref. : 100 Interface Name : int-PE-1-PE-2
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64506:2
Cluster : 3.3.3.3
Originator Id : 2.2.2.2 Peer Router Id : 2.2.2.3
Fwd Class : None Priority : None
Flags : Used Valid Best IGP
Route Source : Internal
AS-Path : No As-Path
Route Tag : 0
Neighbor-AS : n/a
Orig Validation: N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h00m34s
SRv6 TLV Type : SRv6 L3 Service TLV (5)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:102::
Full Sid : 2001:db8:aaaa:102:7fff:f000::
Behavior : End.DT6 (18)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
VPRN Imported : 2
-------------------------------------------------------------------------------
RIB Out Entries
-------------------------------------------------------------------------------
Network : 2001:db8:211::1/128
Nexthop : 2001:db8::2:1
Route Dist. : 192.0.2.1:2 VPN Label : 524287
Path Id : None
To : 2001:db8::2:3
Res. Nexthop : n/a
Local Pref. : 100 Interface Name : NotAvailable
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : n/a
Connector : None
Community : target:64506:2
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 2.2.2.3
Origin : IGP
AS-Path : No As-Path
Route Tag : 0
Neighbor-AS : n/a
Orig Validation: N/A
Source Class : 0 Dest Class : 0
SRv6 TLV Type : SRv6 L3 Service TLV (5)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:101::
Full Sid : 2001:db8:aaaa:101:7fff:f000::
Behavior : End.DT6 (18)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
Verify that there are additional local SRv6 SIDs for PE-1 and PE-2. These local SRv6 SIDs correspond with the additional SRv6 behavior that is configured on the locator for the data transport between the local and the remote VPRN. Because RR-3 does not have SRv6 configuration, RR-3 does not have local SRv6 SIDs.
*A:PE-2# show router segment-routing-v6 local-sid
===============================================================================
Segment Routing v6 Local SIDs
===============================================================================
SID Type Function
Locator
Context
-------------------------------------------------------------------------------
---snip---
2001:db8:aaaa:102:7fff:f000:: End.DT6 524287
PE-2_loc
SvcId: 2 Name: VPRN_2
2001:db8:aaaa:102:8000:: End.DT4 524288
PE-2_loc
SvcId: 2 Name: VPRN_2
-------------------------------------------------------------------------------
SIDs : 5
-------------------------------------------------------------------------------
===============================================================================
Verify that there is SRv6 information for the VPRN service with service id 2.
*A:PE-2# show service id 2 segment-routing-v6 detail
===============================================================================
Segment Routing v6 Instance 1 Service 2
===============================================================================
Locator
Type Function SID Status
-------------------------------------------------------------------------------
PE-2_loc
End.DT4 *524288 2001:db8:aaaa:102:8000:: ok
End.DT6 *524287 2001:db8:aaaa:102:7fff:f000:: ok
===============================================================================
Legend: * - System allocated
At this point, verify that data transport is possible between the local VPRN on PE-1 and the remote VPRN on PE-2.
*A:PE-1# ping router 2 172.16.222.1
PING 172.16.222.1 56 data bytes
64 bytes from 172.16.222.1: icmp_seq=1 ttl=64 time=1.67ms.
---snip---
---- 172.16.222.1 PING Statistics ----
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min = 1.50ms, avg = 1.62ms, max = 1.70ms, stddev = 0.070ms
*A:PE-1# traceroute router 2 172.16.222.1
traceroute to 172.16.222.1, 30 hops max, 40 byte packets
1 172.16.222.1 (172.16.222.1) 1.39 ms 1.26 ms 1.36 ms
*A:PE-1# ping router 2 2001:db8:222::1
PING 2001:db8:222::1 56 data bytes
64 bytes from 2001:db8:222::1 icmp_seq=1 hlim=64 time=1.45ms.
---snip---
---- 2001:db8:222::1 PING Statistics ----
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min = 1.33ms, avg = 1.49ms, max = 1.59ms, stddev = 0.094ms
*A:PE-1# traceroute router 2 2001:db8:222::1
traceroute to 2001:db8:222::1, 30 hops max, 60 byte packets
1 2001:db8:222::1 (2001:db8:222::1) 1.70 ms 1.60 ms 1.46 ms
The result of the verification complies with the route table for the local VPRN on PE-1, which now also contains routes for the loopback addresses in the remote VPRN on PE-2. The same is true for data transport between the remote VPRN on PE-2 and the local VPRN on PE-1.
*A:PE-1# show router 2 route-table ipv4
===============================================================================
Route Table (Service: 2)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Active Metric
-------------------------------------------------------------------------------
172.16.211.1/32 Local Local 00h08m20s 0
lb_itf_vprn Y 0
172.16.222.1/32 Remote BGP VPN 00h00m59s 170
2001:db8:aaaa:102:8000:: (tunneled:SRV6) Y 10
-------------------------------------------------------------------------------
No. of Routes: 2
---snip---
===============================================================================
*A:PE-1# show router 2 route-table ipv6
===============================================================================
IPv6 Route Table (Service: 2)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Active Metric
-------------------------------------------------------------------------------
2001:db8:211::1/128 Local Local 00h08m18s 0
lb_itf_vprn Y 0
2001:db8:222::1/128 Remote BGP VPN 00h00m59s 170
2001:db8:aaaa:102:7fff:f000:: (tunneled:SRV6) Y 10
-------------------------------------------------------------------------------
No. of Routes: 2
---snip---
===============================================================================
Conclusion
SRv6 shortest path routing can be used as an IPv6 transport for implementing VPRN services across an IPv6 service provider network.