Network-instance Route Leaking
This chapter provides information about route leaking from one network-instance to another.
Topics in this chapter include:
Applicability
The CLI in the latest update corresponds to SR Linux Release 26.3.
Overview
Network-instance route leaking refers to the process of copying a route from one network instance to another. Network administrators may need to leak routes between network instances on the same SRL node.
In the examples in this chapter, only BGP routes are leaked. It is possible to leak a copy of a BGP route (including its path attributes) from one network instance to another on the same node. In this chapter, BGP route leaking is shown for IPv4-unicast and IPv6-unicast. Leaking is supported from the default network-instance to an IP-VRF, from one IP-VRF to another IP-VRF, and from an IP-VRF to the default network-instance.
An IPv4 or IPv6 route becomes a candidate for leaking to another instance when an export policy that matches this route is applied in the inter-instance-policies context of the source network instance. Routes that are candidates for leaking to other instances show a leakable flag in the IPv4 or IPv6 route table of the source network instance.
To import a leakable route, the target network instance must be configured with a policy that matches and accepts the leakable route. There are import policies for IPv4 and IPv6 routes. In the target instance, the show network-instance <..> ipv4 route command displays leaked IPv4 routes in addition to routes learned from neighbors of the network instance. A leaked flag is added to the leaked entries. Network-instance route leaking process shows the process of network-instance route leaking.
Leaked BGP routes can be advertised to BGP neighbors (peers) of the destination network-instance. The BGP next hop of a leaked route is automatically reset to self whenever it is advertised to a peer of the destination network-instance. For example, for BGP routes leaked into an IP-VRF, the routes can be re-advertised by the IP-VRF as a BGP-IPVPN route when matching the VRF export policy. Normal VPN export rules apply: by default, the leaked route is exported if it is the overall best path and it is used as the active route to the destination.
In contrast, for BGP routes leaked from an IP-VRF to the default network-instance that must be re-advertised using BGP or labeled BGP, the leaked routes must be imported in the BGP RIB first. Without importing to the BGP RIB, the routes can be advertised using IS-IS when accepted by an IS-IS export policy or table-connection policy.
Configuration
Example topology shows the example topology used in this chapter, including the IPv4 addresses. For each of the examples, a dedicated figure shows the specific topology, which is a subset of the topology in Example topology. The interfaces also have IPv6 addresses, which are shown in BGP IPv6 route leaking between IP-VRFs and BGP IPv6 route leaking from default network-instance and IP-VRF to IP-VRF. IP-VRF-2 also has CEs attached, but for simplicity, these are not shown on the figures and no CLI is shown for any CE.
The following examples are described:
Initial configuration
The nodes in the example topology have the following initial configuration:
-
Interfaces
- Default and IP-VRF network-instances: IP-VRF-1 on PE-1; IP-VRF-2 on PE-1 and PE-2
-
IGP (IS-IS) between the PEs in default network-instance
-
LDP between the PEs in default network-instance
-
BGP (IBGP between the PEs; EBGP between PE-1 and the CEs). On the PEs, BGP is configured in the default network-instance and in the IP-VRFs.
-
Loopback addresses and black-hole static routes in the CEs. Different routes are exported to default network-instance and IP-VRF-1 on PE-1
Example 1 - BGP IPv4 route leaking between IP-VRFs
BGP IPv4 route leaking between IP-VRFs shows the topology for this example. CE-11 exports routes such as 192.168.90.2/32 to IP-VRF-1 on PE-1, and CE-12 exports routes such as 192.168.120.2/32 to IP-VRF-1 on PE-1.
All EBGP routes are by default rejected unless policies are configured. The following import policy is applied in IP-VRF-1.
# on PE-1:
enter candidate
routing-policy {
as-path-set AS-64501-64502 {
as-path-set-member [
64501
64502
]
}
policy pol_import-bgp {
statement stmt-10 {
match {
bgp {
as-path {
as-path-set AS-64501-64502
}
}
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-1 {
protocols {
bgp {
import-policy [
pol_import-bgp
]
The routing table for IP-VRF-1 on PE-1 includes IPv4 routes that are learned from CE-11 and CE-12, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv4 route
==============================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-1
----------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
-----------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
-----------------------------------------------------------------------------------------------
172.16.111.0/30 local 0 0 > 172.16.111.1(ethernet-1/11.1)
172.16.112.0/30 local 0 0 > 172.16.112.1(ethernet-1/12.1)
192.168.90.2/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.3/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.4/30 bgp 0 170 > 172.16.111.2(route:local)
192.168.120.2/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.3/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.4/30 bgp 0 170 > 172.16.112.2(route:local)
These BGP routes are not leakable, by default, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv4 route leakable
================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-1
------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------
The routing table for IP-VRF-2 does not include any of these routes because route leaking is disabled by default:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-2 ipv4 route
================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-2
------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------
172.16.2.2/32 bgp-ipvpn 10 170 > 192.0.2.2(tunnel:ldp, label:30000)
172.16.12.0/30 local 0 0 > 172.16.12.1(ethernet-1/2.2)
To configure inter-instance route leaking, an export policy is configured in IP-VRF-1, as follows:
# on PE-1:
enter candidate
routing-policy {
policy pol_make-bgp-routes-leakable {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-1 {
inter-instance-policies {
apply-policy {
export-policy [
pol_make-bgp-routes-leakable
]
}
}With the preceding configuration, the routes imported into the IP-VRF are marked as leakable, meaning they are available to be copied to other network instances. The routes originate from CE-11 or CE-12 in this example. The export policy on IP-VRF-1 controls what becomes leakable from IP-VRF-1.
The following command shows which BGP routes in IP-VRF-1 are marked as leakable:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-1 ipv4 route leakable
==============================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-1
----------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
----------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
----------------------------------------------------------------------------------------------
192.168.90.2/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.3/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.4/30 bgp 0 170 > 172.16.111.2(route:local)
192.168.120.2/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.3/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.4/30 bgp 0 170 > 172.16.112.2(route:local)
The following detailed output for one of the routes in the preceding list shows that the route is leakable from IP-VRF-1 to other network-instances (Leakable: yes) whereas the route is not leaked into IP-VRF-1 (Leaked: no):
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv4 route leakable 192.168.90.2/32 detail
================================================================================================================================
Prefix: 192.168.90.2/32
--------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-05-07T09:17:25.657Z (51 seconds ago)
Id : 0
Leakable : yes
Leaked : no
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 32082776
Net-Instance : IP-VRF-1
FIB Failed : no
Primary NH : 32082768
LB Weight : 1
Type : indirect
IP Address : 172.16.111.2
Resolved : yes
Resolving Route : 172.16.111.0/30(local)
Leakable routes from IP-VRF-1 can be imported into other network-instances. The import policy on IP-VRF-2 controls which leaked routes are installed into IP-VRF-2. Prefix lists can be used to filter specific routes for BGP leaking, but that is not configured in this example. The following policy to import BGP leakable routes is applied as an inter-instance import policy in IP-VRF-2 on PE-1:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-leakable-routes {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-2 {
inter-instance-policies {
apply-policy {
import-policy [
pol_import-leakable-routes
]
}
}The following command shows that IP-VRF-2 imported leaked BGP routes from IP-VRF-1. The L-flag indicates that the route is leaked.
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-2 ipv4 route leaked
==================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-2
------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------
192.168.90.2/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.3/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.4/30 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.120.2/32 bgp 0 170 >L 172.16.112.2(net-instance:IP-VRF-1, route:local)
192.168.120.3/32 bgp 0 170 >L 172.16.112.2(net-instance:IP-VRF-1, route:local)
192.168.120.4/30 bgp 0 170 >L 172.16.112.2(net-instance:IP-VRF-1, route:local)
The detailed output for a particular leaked BGP route shows that this route is not leakable from IP-VRF-2 (Leakable: no), but the route is leaked into IP-VRF-2 from IP-VRF-1 (Leaked: from IP-VRF-1), as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-2 ipv4 route 192.168.90.2/32 detail
==================================================================================================================
Prefix: 192.168.90.2/32
------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-04-29T07:22:03.157Z (3 minutes ago)
Id : 0
Leakable : no
Leaked : from IP-VRF-1
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 35659143
Net-Instance : IP-VRF-1
FIB Failed : no
Primary NH : 35659136
LB Weight : 1
Type : indirect
IP Address : 172.16.111.2
Resolved : yes
Resolving Route : 172.16.111.0/30(local)
PE-1 re-advertises the leaked routes in IP-VRF-2 as BGP-IPVPN routes to PE-2. The route table for IP-VRF-2 in the neighbor PE-2 includes these prefixes, as follows:
--{ +* candidate shared default }--[ ]--
A:admin@PE-2# show / network-instance IP-VRF-2 ipv4 route
================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-2
------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------
172.16.2.1/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
172.16.12.0/30 local 0 0 > 172.16.12.2(ethernet-1/1.2)
192.168.90.2/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.90.3/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.90.4/30 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.120.2/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.120.3/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.120.4/30 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
To restore the original configuration, the inter-instance-policies context is removed from IP-VRF-1 and IP-VRF-2, as follows:
# on PE-1:
enter candidate
network-instance IP-VRF-1 {
delete inter-instance-policies
}
network-instance IP-VRF-2 {
delete inter-instance-policies
}Example 2 - BGP IPv4 route leaking from IP-VRF to default network-instance
BGP IPv4 route leaking from IP-VRF to default network-instance shows the topology for this example. CE-11 and CE-12 export the same routes to IP-VRF-1. The routes originating from CE-11 are marked as leakable from IP-VRF-1 and leaked to the default network-instance.
The inter-instance export policy only marks the routes from CE-11 in AS 64501 as leakable from IP-VRF-1, as follows:
# on PE-1:
enter candidate
routing-policy {
as-path-set AS-64501 {
as-path-set-member [
64501
]
}
policy pol_make-CE-11-bgp-routes-leakable {
default-action {
policy-result reject
}
statement stmt-10 {
match {
bgp {
as-path {
as-path-set AS-64501
}
}
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-1 {
inter-instance-policies {
apply-policy {
export-policy [
pol_make-CE-11-bgp-routes-leakable
]
}
}The routing table for IP-VRF-1 in PE-1 contains the BGP routes exported by CE-11 and CE-12, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv4 route
=============================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-1
---------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------
172.16.111.0/30 local 0 0 > 172.16.111.1(ethernet-1/11.1)
172.16.112.0/30 local 0 0 > 172.16.112.1(ethernet-1/12.1)
192.168.90.2/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.3/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.4/30 bgp 0 170 > 172.16.111.2(route:local)
192.168.120.2/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.3/32 bgp 0 170 > 172.16.112.2(route:local)
192.168.120.4/30 bgp 0 170 > 172.16.112.2(route:local)
The routing table of the default network-instance does not include any of the BGP routes exported by the CEs, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default ipv4 route
=============================================================================================
IPv4-unicast route table for default network-instance
---------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------
172.17.111.0/30 local 0 0 > 172.17.111.1(ethernet-1/11.1000)
172.17.112.0/30 local 0 0 > 172.17.112.1(ethernet-1/12.1000)
192.0.2.2/32 isis 10 15 > 192.168.12.2(ethernet-1/2.1000)
192.168.12.0/30 local 0 0 > 192.168.12.1(ethernet-1/2.1000)
The following command shows that the BGP routes from CE-11 are leakable from IP-VRF-1:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv4 route leakable
============================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-1
--------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------
192.168.90.2/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.3/32 bgp 0 170 > 172.16.111.2(route:local)
192.168.90.4/30 bgp 0 170 > 172.16.111.2(route:local)
The leakable BGP routes in IP-VRF-1 can be imported into the default network-instance. The import policy is identical to the import policy in the preceding example, as follows:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-leakable-routes {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance default {
inter-instance-policies {
apply-policy {
import-policy [
pol_import-leakable-routes
]
}
}As a result, the leakable BGP routes from IP-VRF-1 are leaked to the default network-instance, as follows:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show / network-instance default ipv4 route leaked
==================================================================================================================
IPv4-unicast route table for default network-instance
------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------
192.168.90.2/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.3/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.4/30 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
The detailed information for any of these leaked routes shows that the route is leaked into the default network-instance (Leaked: from IP-VRF-1), but it is not leakable from the default network-instance (Leakable: no), as follows:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance default ipv4 route 192.168.90.2/32 detail
==================================================================================================================
Prefix: 192.168.90.2/32
------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-04-29T08:00:05.323Z (5 minutes ago)
Id : 0
Leakable : no
Leaked : from IP-VRF-1
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 35659143
Net-Instance : IP-VRF-1
FIB Failed : no
Primary NH : 35659136
LB Weight : 1
Type : indirect
IP Address : 172.16.111.2
Resolved : yes
Resolving Route : 172.16.111.0/30(local)
The route table for the default network-instance includes the leaked routes, as follows:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance default ipv4 route
==================================================================================================================
IPv4-unicast route table for default network-instance
------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------
172.17.111.0/30 local 0 0 > 172.17.111.1(ethernet-1/11.1000)
172.17.112.0/30 local 0 0 > 172.17.112.1(ethernet-1/12.1000)
192.0.2.2/32 isis 10 15 > 192.168.12.2(ethernet-1/2.1000)
192.168.12.0/30 local 0 0 > 192.168.12.1(ethernet-1/2.1000)
192.168.90.2/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.3/32 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
192.168.90.4/30 bgp 0 170 >L 172.16.111.2(net-instance:IP-VRF-1, route:local)
When routes are leaked to a destination IP-VRF network-instance, the leaked routes are re-advertised as BGP-VPN routes to neighbor PE-2. However, when routes are leaked to the default network-instance, PE-1 does not re-advertise the leaked routes to its peer PE-2, so the route table for the default network-instance on neighbor PE-2 does not include the corresponding prefixes, as follows:
--{ +* candidate shared default }--[ ]--
A:admin@PE-2# show network-instance default ipv4 route
==================================================================================================================
IPv4-unicast route table for default network-instance
------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------
192.0.2.1/32 isis 10 15 > 192.168.12.1(ethernet-1/1.1000)
192.168.12.0/30 local 0 0 > 192.168.12.2(ethernet-1/1.1000)
Re-advertise leaked BGP routes as BGP routes after import in RIB-IN
Import leaked BGP route into RIB-IN shows the process to make a route leakable in IP-VRF-1, import it into the route table of the default network-instance, and import it into the RIB-IN:
The following policy is configured to import the leaked BGP IPv4 route in the RIB-IN of the default network-instance:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-BGP-routes-in-RIB {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
bgp {
rib-management {
table ipv4-unicast {
route-table-import pol_import-BGP-routes-in-RIB
}
}When imported into the BGP RIB, the best leaked routes are advertised unless rejected by a peer export policy. PE-2 receives the following BGP routes from PE-1:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance default protocols bgp neighbor 192.0.2.1 received-routes ipv4
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer : 192.0.2.1, remote AS: 64500, local AS: 64500
Type : static
Description : None
Group : IBGP_IPv4
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Status Network Path-id Next Hop MED LocPref AsPath Origin |
+=======================================================================================================================================================================+
| u*> 192.168.90.2/32 0 192.0.2.1 - 0 [64501] i |
| u*> 192.168.90.3/32 0 192.0.2.1 - 0 [64501] i |
| u*> 192.168.90.4/30 0 192.0.2.1 - 0 [64501] i |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
3 received BGP routes : 3 used 3 valid
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The route table for the default network-instance on PE-2 now includes the three advertised BGP routes, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance default ipv4 route
=============================================================================================================
IPv4-unicast route table for default network-instance
-------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
-------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
-------------------------------------------------------------------------------------------------------------
192.0.2.1/32 isis 10 15 > 192.168.12.1(ethernet-1/1.1000)
192.168.12.0/30 local 0 0 > 192.168.12.2(ethernet-1/1.1000)
192.168.90.2/32 bgp 10 170 > 192.0.2.1(route:isis)
192.168.90.3/32 bgp 10 170 > 192.0.2.1(route:isis)
192.168.90.4/30 bgp 10 170 > 192.0.2.1(route:isis)
The following removes the RIB-management configuration:
enter candidate
network-instance default {
protocols {
bgp {
delete rib-managementRe-advertise leaked BGP routes as IS-IS routes
When the leaked BGP routes are not imported in the RIB-IN, the leaked routes can be advertised using IS-IS. The following export policy accepts the leaked routes from IP-VRF-1 and is applied in the IS-IS instance 0, as follows:
# on PE-1:
enter candidate
routing-policy {
policy pol_re-advertise-routes-leaked-from-IP-VRF-1 {
default-action {
policy-result reject
}
statement stmt-10 {
match {
origin-network-instance IP-VRF-1
network-instance-leaked-route true
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
isis {
instance 0 {
export-policy pol_re-advertise-routes-leaked-from-IP-VRF-1
The IS-IS export policy on PE-1 re-advertises the three leaked routes to the default network-instance on PE-2, so the route table on PE-2 includes these three prefixes:
--{ + running }--[ ]--
A:admin@PE-2# show network-instance default ipv4 route
===========================================================================================================================
IPv4-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------
192.0.2.1/32 isis 10 15 > 192.168.12.1(ethernet-1/1.1000)
192.168.12.0/30 local 0 0 > 192.168.12.2(ethernet-1/1.1000)
192.168.90.2/32 isis 10 160 > 192.168.12.1(ethernet-1/1.1000)
192.168.90.3/32 isis 10 160 > 192.168.12.1(ethernet-1/1.1000)
192.168.90.4/30 isis 10 160 > 192.168.12.1(ethernet-1/1.1000)
The original configuration is restored by removing the export policy from IS-IS instance 0, as follows:
# on PE-1:
enter candidate
network-instance default {
protocols {
isis {
instance 0 {
delete export-policy
Network-instance route leaking is disabled by removing the inter-instance-policies context from IP-VRF-1 and the default network-instance, as follows:
# on PE-1:
enter candidate
network-instance IP-VRF-1 {
delete inter-instance-policies
}
network-instance default {
delete inter-instance-policies
}
Example 3 - BGP IPv4 route leaking from default network-instance to IP-VRF
BGP IPv4 route leaking from default network-instance to IP-VRF shows the topology for this example, and the corresponding IP addresses. CE-11 exports routes such as 192.168.100.2/32 to the default network-instance and CE-12 exports routes such as 192.168.121.2/32 to the default network-instance. The routes are leaked from the default network-instance to IP-VRF-2 if matched by an import policy in the default network-instance of PE-1.
All EBGP routes are by default rejected unless policies are configured. The following import policy is applied in the default network-instance.
# on PE-1:
enter candidate
routing-policy {
as-path-set AS-64501-64502 {
as-path-set-member [
64501
64502
]
}
policy pol_import-bgp {
statement stmt-10 {
match {
bgp {
as-path {
as-path-set AS-64501-64502
}
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
bgp {
import-policy [
pol_import-bgp
]
The default network-instance in PE-1 includes BGP IPv4 routes learned from CE-11 and CE-12, as follows:
[--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default ipv4 route
===============================================================================================
IPv4-unicast route table for default network-instance
-----------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
-----------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
-----------------------------------------------------------------------------------------------
172.17.111.0/30 local 0 0 > 172.17.111.1(ethernet-1/11.1000)
172.17.112.0/30 local 0 0 > 172.17.112.1(ethernet-1/12.1000)
192.0.2.2/32 isis 10 15 > 192.168.12.2(ethernet-1/2.1000)
192.168.12.0/30 local 0 0 > 192.168.12.1(ethernet-1/2.1000)
192.168.100.2/32 bgp 0 170 > 172.17.111.2(route:local)
192.168.100.3/32 bgp 0 170 > 172.17.111.2(route:local)
192.168.100.4/30 bgp 0 170 > 172.17.111.2(route:local)
192.168.121.2/32 bgp 0 170 > 172.17.112.2(route:local)
192.168.121.3/32 bgp 0 170 > 172.17.112.2(route:local)
192.168.121.4/30 bgp 0 170 > 172.17.112.2(route:local)
On PE-1, the following policy accepts BGP routes and is applied as inter-instance export policy in the default network-instance:
# on PE-1:
enter candidate
routing-policy {
policy pol_make-bgp-routes-leakable {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance default {
inter-instance-policies {
apply-policy {
export-policy [
pol_make-bgp-routes-leakable
]
}
}The routing table for the default network-instance shows that the BGP IPv4 routes are leakable:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance default ipv4 route leakable
===========================================================================================================================
IPv4-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------
192.168.100.2/32 bgp 0 170 > 172.17.111.2(route:local)
192.168.100.3/32 bgp 0 170 > 172.17.111.2(route:local)
192.168.100.4/30 bgp 0 170 > 172.17.111.2(route:local)
192.168.121.2/32 bgp 0 170 > 172.17.112.2(route:local)
192.168.121.3/32 bgp 0 170 > 172.17.112.2(route:local)
192.168.121.4/30 bgp 0 170 > 172.17.112.2(route:local)
The leakable BGP routes in the default network-instance can be imported into IP-VRF-2. The import policy is identical to the import policy in the preceding examples, as follows:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-leakable-routes {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-2 {
inter-instance-policies {
apply-policy {
import-policy [
pol_import-leakable-routes
]
}
}The following command shows the leaked BGP routes in IP-VRF-2. The source of these leaked routes is the default network-instance, not an IP-VRF.
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv4 route leaked
===========================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-2
---------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------
192.168.100.2/32 bgp 0 170 >L 172.17.111.2(net-instance:default, route:local)
192.168.100.3/32 bgp 0 170 >L 172.17.111.2(net-instance:default, route:local)
192.168.100.4/30 bgp 0 170 >L 172.17.111.2(net-instance:default, route:local)
192.168.121.2/32 bgp 0 170 >L 172.17.112.2(net-instance:default, route:local)
192.168.121.3/32 bgp 0 170 >L 172.17.112.2(net-instance:default, route:local)
192.168.121.4/30 bgp 0 170 >L 172.17.112.2(net-instance:default, route:local)
Any of these leaked BGP routes is leaked into IP-VRF-2 (Leaked: from default), whereas none of these BGP routes is leakable from IP-VRF-2 (Leakable: no), as follows for prefix 192.168.100.2/32:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv4 route 192.168.100.2/32 detail
===========================================================================================================================
Prefix: 192.168.100.2/32
---------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-04-29T13:49:24.484Z (2 minutes ago)
Id : 0
Leakable : no
Leaked : from default
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 35659155
Net-Instance : default
FIB Failed : no
Primary NH : 35659148
LB Weight : 1
Type : indirect
IP Address : 172.17.111.2
Resolved : yes
Resolving Route : 172.17.111.0/30(local)
The leaked routes are re-advertised as BGP-IPVPN routes to IP-VRF-2 on PE-2, as follows:
--{ + running }--[ ]--
A:admin@PE-2# show / network-instance IP-VRF-2 ipv4 route
====================================================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: IP-VRF-2
----------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
----------------------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
----------------------------------------------------------------------------------------------------------------------------------------------------
172.16.2.1/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
172.16.12.0/30 local 0 0 > 172.16.12.2(ethernet-1/1.2)
192.168.100.2/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.100.3/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.100.4/30 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.121.2/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.121.3/32 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
192.168.121.4/30 bgp-ipvpn 10 170 > 192.0.2.1(tunnel:ldp, label:30000)
Again, the configuration is restored by removing the inter-instance-policies context from the default network-instance and the IP-VRF-2 network-instance:
# on PE-1:
enter candidate
network-instance default {
delete inter-instance-policies
}
network-instance IP-VRF-2 {
delete inter-instance-policies
}Example 4 - BGP IPv6 route leaking between IP-VRFs
BGP IPv6 route leaking between IP-VRFs shows the topology and the IP addresses used for this example. CE-11 exports routes such as 2001:db8:90::2/128 to IP-VRF-1 on PE-1, and CE-12 exports routes such as 2001:db8:120::2/128 to IP-VRF-1 on PE-1.
The following export policy is applied in the inter-instance-policies context of IP-VRF-1:
# on PE-1:
enter candidate
routing-policy {
policy pol_make-bgp-routes-leakable {
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-1 {
inter-instance-policies {
apply-policy {
export-policy [
pol_make-bgp-routes-leakable
]
}The following IPv6 route table includes three BGP routes exported by CE-11 and three BGP routes exported by CE-12:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-1 ipv6 route
===============================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-1
-----------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
-----------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
-----------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:3/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:4/126 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::120:2/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:3/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:4/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
6
2001:db8::16:111:0 local 0 0 > 2001:db8::16:111:1(ethernet-1/11.1)
/126
2001:db8::16:112:0 local 0 0 > 2001:db8::16:112:1(ethernet-1/12.1)
/126
The following command shows that all the received BGP IPv6 routes are marked as leakable from IP-VRF-1:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-1 ipv6 route leakable
============================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-1
--------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:3/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:4/126 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::120:2/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:3/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:4/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
6
The BGP leakable routes can be imported into IP-VRF-2 when the following import policy is configured and applied in IP-VRF-2:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-leakable-routes {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-2 {
inter-instance-policies {
apply-policy {
import-policy [
pol_import-leakable-routes
]The following command shows that IP-VRF-2 is importing the leaked BGP IPv6 routes from IP-VRF-1:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv6 route leaked
=====================================================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-2
---------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::90:3/128 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::90:4/126 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::120:2/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
8
2001:db8::120:3/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
8
2001:db8::120:4/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
6
The BGP routes are leaked into IP-VRF-2 (Leaked: from IP-VRF-1) while they are not leakable from IP-VRF-2 (Leakable: no), as follows:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv6 route 2001:db8::90:2/128 detail
=========================================================================================
Prefix: 2001:db8::90:2/128
-----------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-05-06T12:38:07.390Z (a minute ago)
Id : 0
Leakable : no
Leaked : from IP-VRF-1
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 1232896477
Net-Instance : IP-VRF-1
FIB Failed : no
Primary NH : 1232896474
LB Weight : 1
Type : indirect
IP Address : 2001:db8::16:111:2
Resolved : yes
Resolving Route : 2001:db8::16:111:0/126(local)
Example 5 - BGP IPv6 route leaking from default network-instance and from IP-VRF to IP-VRF
BGP IPv6 route leaking from default network-instance and IP-VRF to IP-VRF shows the topology and the IPv6 addresses used in this example. CE-11 exports IPv6 routes such as 2001:db8:90::2/128 to IP-VRF-1 and IPv6 routes such as 2001:db8:100::2/128 to the default network-instance. CE-12 exports IPv6 routes such as 2001:db8:120::2/128 to IP-VRF-1 and IPv6 routes such as 2001:db8:121::2/128 to the default network-instance.
The inter-instance export policy to mark BGP routes as leakable can be identical to the policy used in the preceding examples. However, in this case, prefix-lists are added as a filter. IP-VRF-1 may export routes such as 2001:db8:90::2/128 and 2001:db8:120::2/128 as leakable with the following configuration:
# on PE-1:
enter candidate
routing-policy {
prefix-set ps-ipv6-120 {
prefix 2001:db8::120:0/120 mask-length-range 120..128 {
}
}
prefix-set ps-ipv6-90 {
prefix 2001:db8::90:0/120 mask-length-range 120..128 {
}
}
policy pol_IP-VRF-1_IPv6_90_120_leakable {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
prefix {
prefix-set ps-ipv6-90
}
}
action {
policy-result accept
}
}
statement stmt-20 {
match {
protocol bgp
prefix {
prefix-set ps-ipv6-120
}
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-1 {
inter-instance-policies {
apply-policy {
export-policy [
pol_IP-VRF-1_IPv6_90_120_leakable
]
}
In a similar way, the default network-instance may export routes such as 2001:8db:100::2/128 as leakable:
# on PE-1:
enter candidate
routing-policy {
prefix-set ps-ipv6-100 {
prefix 2001:db8::100:0/120 mask-length-range 120..128 {
}
}
policy pol_base_IPv6_100_leakable {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
prefix {
prefix-set ps-ipv6-100
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
inter-instance-policies {
apply-policy {
export-policy [
pol_base_IPv6_100_leakable
]
}
}
}The IPv6 routing table in the default network-instance contains routes exported by CE-11 and CE-12, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default ipv6 route
================================================================================================================================
IPv6-unicast route table for default network-instance
--------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
--------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
--------------------------------------------------------------------------------------------------------------------------------
2001:db8::2:2/128 isis 10 15 > fe80::201:2ff:feff:0(ethernet-1/2.1000)
2001:db8::12:0/126 local 0 0 > 2001:db8::12:1(ethernet-1/2.1000)
2001:db8::100:2/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
8
2001:db8::100:3/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
8
2001:db8::100:4/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
6
2001:db8::121:2/12 bgp 0 170 > 2001:db8::17:112:2(route:local)
8
2001:db8::121:3/12 bgp 0 170 > 2001:db8::17:112:2(route:local)
8
2001:db8::121:4/12 bgp 0 170 > 2001:db8::17:112:2(route:local)
6
2001:db8::17:111:0 local 0 0 > 2001:db8::17:111:1(ethernet-1/11.1000)
/126
2001:db8::17:112:0 local 0 0 > 2001:db8::17:112:1(ethernet-1/12.1000)
/126
The IPv6 routing table for IP-VRF-1 contains other routes exported by CE-11 and CE-12, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance IP-VRF-1 ipv6 route
================================================================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-1
--------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
--------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
--------------------------------------------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:3/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:4/126 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::120:2/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:3/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:4/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
6
2001:db8::16:111:0 local 0 0 > 2001:db8::16:111:1(ethernet-1/11.1)
/126
2001:db8::16:112:0 local 0 0 > 2001:db8::16:112:1(ethernet-1/12.1)
/126
The following command shows which routes are marked as leakable in the default network-instance:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance default ipv6 route leakable
================================================================================================================================
IPv6-unicast route table for default network-instance
--------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
--------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
--------------------------------------------------------------------------------------------------------------------------------
2001:db8::100:2/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
8
2001:db8::100:3/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
8
2001:db8::100:4/12 bgp 0 170 > 2001:db8::17:111:2(route:local)
6
The following command shows which routes are marked as leakable in IP-VRF-1:
--{ + candidate shared default }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-1 ipv6 route leakable
================================================================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-1
--------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
--------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
--------------------------------------------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:3/128 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::90:4/126 bgp 0 170 > 2001:db8::16:111:2(route:local)
2001:db8::120:2/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:3/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
8
2001:db8::120:4/12 bgp 0 170 > 2001:db8::16:112:2(route:local)
6
On PE-1, a policy is created to import the BGP leakable routes (the same as in the preceding examples) and applied as inter-instance import policy in IP-VRF-2, as follows:
# on PE-1:
enter candidate
routing-policy {
policy pol_import-leakable-routes {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol bgp
}
action {
policy-result accept
}
}
}
}
network-instance IP-VRF-2 {
inter-instance-policies {
apply-policy {
import-policy [
pol_import-leakable-routes
]
}
}The following command shows the leaked IPv6 routes in IP-VRF-2:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv6 route leaked
================================================================================================================================
IPv6-unicast route table for ip-vrf network-instance: IP-VRF-2
--------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
--------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
--------------------------------------------------------------------------------------------------------------------------------
2001:db8::90:2/128 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::90:3/128 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::90:4/126 bgp 0 170 >L 2001:db8::16:111:2(net-instance:IP-VRF-1, route:local)
2001:db8::100:2/12 bgp 0 170 >L 2001:db8::17:111:2(net-instance:default, route:local)
8
2001:db8::100:3/12 bgp 0 170 >L 2001:db8::17:111:2(net-instance:default, route:local)
8
2001:db8::100:4/12 bgp 0 170 >L 2001:db8::17:111:2(net-instance:default, route:local)
6
2001:db8::120:2/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
8
2001:db8::120:3/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
8
2001:db8::120:4/12 bgp 0 170 >L 2001:db8::16:112:2(net-instance:IP-VRF-1, route:local)
6
Some of these routes are leaked from the default network-instance and other routes are leaked from IP-VRF-1. The detailed information for route 2001:db8:100::2/128 shows that the route is leaked from the default network-instance, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv6 route 2001:db8::100:2/128 detail
================================================================================================================================
Prefix: 2001:db8::100:2/128
--------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-05-06T11:28:13.830Z (6 minutes ago)
Id : 0
Leakable : no
Leaked : from default
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 37108882
Net-Instance : default
FIB Failed : no
Primary NH : 37108874
LB Weight : 1
Type : indirect
IP Address : 2001:db8::17:111:2
Resolved : yes
Resolving Route : 2001:db8::17:111:0/126(local)
Route 2001:db8:90::2/128 is leaked from IP-VRF-1, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show network-instance IP-VRF-2 ipv6 route 2001:db8::90:2/128 detail
================================================================================================================================
Prefix: 2001:db8::90:2/128
--------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp
Route Owner : bgp_mgr, 2026-05-06T11:29:06.693Z (7 minutes ago)
Id : 0
Leakable : no
Leaked : from IP-VRF-1
Metric : 0
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 37108883
Net-Instance : IP-VRF-1
FIB Failed : no
Primary NH : 37108875
LB Weight : 1
Type : indirect
IP Address : 2001:db8::16:111:2
Resolved : yes
Resolving Route : 2001:db8::16:111:0/126(local)
Conclusion
In these examples, BGP IPv4/IPv6 routes learned from BGP neighbors could be marked as leakable and imported into other network instances (IP-VRF to IP-VRF, IP-VRF to default network-instance, default network-instance to IP-VRF) without the use of communities in the routing policies.