6PE Next-Hop Resolution
This chapter provides information about 6PE next hop resolution.
Topics in this chapter include:
Applicability
The CLI in the current edition is based on SR Linux Release 26.3.3.
Overview
IPv6 provider edge (6PE) enables IPv6 communication between IPv6 domains over an IPv4 multi-protocol label switching (MPLS) cloud. IPv6 packets are forwarded in an MPLS tunnel from one dual-stack 6PE router to another, as shown in IPv6 provider edge (6PE).
The 6PE route next hop resolution is configured using the following command:
# on PE-1:
enter candidate
network-instance default {
protocols {
bgp {
afi-safi ipv6-labeled-unicast {
ipv6-labeled-unicast {
next-hop-resolution
ipv4-next-hops
tunnel-resolution
allowed-tunnel-types [ ?
A:admin@PE-1# allowed-tunnel-types [ <values>
usage: allowed-tunnel-types [ <bgp|ldp|sr-isis|te-policy-sr-mpls-colored|te-policy-sr-mpls-uncolored (1-* times)> ]
List of allowed tunnel types
Positional arguments:
values [bgp|ldp|sr-isis|te-policy-sr-mpls-colored|te-policy-sr-mpls-uncolored]
The allowed-tunnel-types must contain at least one of the mentioned protocol values.
The tunnels are selected based on availability and tunnel table manager (TTM) preference. The order of preference of TTM tunnels is: Uncolored SR‑MPLS TE‑Policy (8), LDP (9), SR-ISIS (11), BGP (LU) (12), Colored SR‑MPLS TE‑Policy (14).
For LDP to be used, it is sufficient to enable LDP on the interfaces in the MPLS network. For segment routing to be used, an SR-signaled path to the 6PE next hop destination must be available. For SR-ISIS to be used, segment routing must be enabled as described in Segment Routing with IS-IS Control Plane. For Colored/Uncolored SR-MPLS TE-Policy to be used, a Colored/Uncolored SR-MPLS TE-Policy to the 6PE next-hop destination must be configured. For BGP labeled routes to be used, the 6PE next hop must have been learned via a BGP peering carrying labeled unicast routes and placed in the active route table.
Configuration
Example topology shows the example topology with two dual-stack 6PE routers (PE-1 and PE-4), a core router (P-2), and a route reflector (RR-3). IPv4 is used in the core network; IPv6 is used between the CEs and the PEs.
The initial configuration on the nodes is as follows:
Interfaces
IS-IS as IGP in the core IPv4 network
- Segment routing enabled (SR-ISIS)
LDP enabled on the interfaces between the PEs and P-2, but not toward RR-3
MPLS enabled on the interfaces between the PEs and P-2, but not toward RR-3
BGP configuration
BGP is configured for the ipv6-labeled-unicast address family on PE-1, PE-4, and RR-3, but not on P-2. The BGP configuration on both PEs defines how the 6PE next hops is resolved: in the example setup, the tunnel-resolution allowed-tunnel-types contains three options: LDP, SR-ISIS, and Uncolored SR‑MPLS TE‑Policy. The BGP configuration is identical on PE-1 and PE-4.
# on PE-1, PE-4:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
router-id 192.0.2.1 # 192.0.2.1 on PE-4
autonomous-system 64496
bgp-label {
labeled-unicast {
dynamic-label-block dlb-bgp-lu
}
}
afi-safi ipv6-labeled-unicast {
admin-state enable
ipv6-labeled-unicast {
next-hop-resolution {
ipv4-next-hops {
tunnel-resolution {
allowed-tunnel-types [
ldp
sr-isis
te-policy-sr-mpls-uncolored
]
}
}
}
}
}
group grp_IBGP {
peer-as 64496
export-policy [
rp_export-6pe
]
}
neighbor 192.0.2.3 {
peer-group grp_IBGP
}The export policy rp_export-6pe exports the IPv6 prefixes that are local to the PE, for example 2001:db8::1:11:1:0/120 on PE-1, and is defined as follows:
# on PE-1, PE-4:
enter candidate
routing-policy {
policy rp_export-6pe {
default-action {
policy-result reject
}
statement stmt-10 {
match {
protocol local
}
action {
policy-result accept
}
}The BGP configuration on RR-3 does not include any export policy or any next-hop resolution settings, as follows:
# on RR-3:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
router-id 192.0.2.3
autonomous-system 64496
afi-safi ipv6-labeled-unicast {
admin-state enable
}
group grp_IBGP {
peer-as 64496
route-reflector {
client true
cluster-id 192.0.2.3
}
}
neighbor 192.0.2.1 {
peer-group grp_IBGP
}
neighbor 192.0.2.4 {
peer-group grp_IBGP
}Network instance configuration
On PE-1, an interface with an IPv6 address toward CE-11 is configured in the default network instance, as follows:
# on PE-1:
enter candidate
interface ethernet-1/5 {
admin-state enable
vlan-tagging true
ethernet {
port-speed 100G
}
subinterface 1 {
type routed
description int-PE-1-CE-11
admin-state enable
ipv6 {
admin-state enable
address 2001:db8::1:11:1:1/120 {
}
}
vlan {
encap {
single-tagged {
vlan-id 1
}
}
}
}The configuration on PE-4 for an interface with an IPv6 address toward CE-41 is similar; the IPv6 address on interface int-PE-4-CE-41 is different: 2001:db8::1:11:4:1/120.
A BGP labeled IPv6 tunnel, which is active in the routing table, is established between the PEs, as follows:
A:admin@PE-1# show / network-instance default ipv6 route all
=========================================================================================================================================================
IPv6-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
2001:db8::1:11:1:0 local 0 0 > 2001:db8::1:11:1:1(ethernet-1/5.1)
/120
2001:db8::1:11:4:0 bgp-label 20 170 > mpls(192.0.2.4/32, ldp:65538, label:40000)
/120On PE-1, an IP-VRF CE-11 is configured, as follows:
# on PE-1:
enter candidate
network-instance CE-11 {
admin-state enable
type ip-vrf
description CE-11
router-id 172.20.11.1
interface int-CE-11-PE-1 {
interface-ref {
interface ethernet-1/6
subinterface 1
}
}
protocols {
bgp-ipvpn {
bgp-instance 1 {
admin-state enable
mpls {
next-hop-resolution {
allowed-tunnel-types [
ldp
]
}
}
}
}
}
static {
next-hop-group nhg_2001:db8::1:11:1:1 {
next-hop 1 {
}
}
next-hop 1 {
ip-address 2001:db8::1:11:1:1
}
}
static-routes {
admin-state enable
route ::/0 {
admin-state enable
static-next-hop-group nhg_2001:db8::1:11:1:1
}
}
}
interface ethernet-1/6 {
admin-state enable
vlan-tagging true
ethernet {
port-speed 100G
}
subinterface 1 {
type routed
description int-CE-11-PE-1
admin-state enable
ipv6 {
admin-state enable
address 2001:db8::1:11:1:11/120 {
}
}
vlan {
encap {
single-tagged {
vlan-id 1
}
}
}
}
}A static route is configured in the IP-VRF toward the default network instance, to allow the use of the BGP labeled IPv6 tunnel between the PEs.
The configuration on PE-4 for IP-VRF CE-41 is similar; the IPv6 address on interface int-CE-41-PE-4 is different: 2001:db8::1:11:4:41/120.
6PE next hop resolved to an LDP tunnel
CE-11 can send IPv6 packets with source address 2001:db8::1:11:1:11 to destination address 2001:db8::1:11:4:41 on CE-41, as follows:
A:admin@PE-1# ping6 2001:db8::1:11:4:41 network-instance CE-11 -I 2001:db8::1:11:1:11 -c 5
Using network instance CE-11
PING 2001:db8::1:11:4:41 (2001:db8::1:11:4:41) from 2001:db8::1:11:1:11 : 56 data bytes
64 bytes from 2001:db8::1:11:4:41: icmp_seq=1 ttl=61 time=3.47 ms
64 bytes from 2001:db8::1:11:4:41: icmp_seq=2 ttl=61 time=3.88 ms
64 bytes from 2001:db8::1:11:4:41: icmp_seq=3 ttl=61 time=4.20 ms
64 bytes from 2001:db8::1:11:4:41: icmp_seq=4 ttl=61 time=4.21 ms
64 bytes from 2001:db8::1:11:4:41: icmp_seq=5 ttl=61 time=3.88 ms
--- 2001:db8::1:11:4:41 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 3.467/3.926/4.205/0.271 msOn PE-1, the route for prefix 2001:db8::1:11:4:0/120 uses a tunnel to 6PE next hop 192.0.2.4, as follows:
A:admin@PE-1# show / network-instance default ipv6 route all
=========================================================================================================================================================
IPv6-unicast route table for default network-instance
---------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
---------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
---------------------------------------------------------------------------------------------------------------------------------------------------------
2001:db8::1:11:1:0 local 0 0 > 2001:db8::1:11:1:1(ethernet-1/5.1)
/120
2001:db8::1:11:4:0 bgp-label 20 170 > mpls(192.0.2.4/32, ldp:65538, label:40000)
/120LDP is enabled on the interfaces between the PEs and P-2, which is sufficient for 6PE next hop resolution to an LDP tunnel. Uncolored SR‑MPLS TE‑Policy tunnels have a higher priority, but they have not been configured yet on the PEs. The tunnel table on PE-1 shows that the only tunnel to 6PE next hop 192.0.2.4 is an LDP tunnel, as follows:
A:admin@PE-1# show / network-instance default tunnel-table all
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 tunnel table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
+------------------------+----------------+----------+-----+----------+---------+--------------------------+---------------+---------------+
| IPv4 Prefix | Tunnel Type | Tunnel | FIB | Metric | Prefere | Last Update | Next-hop | Next-hop |
| | | ID | | | nce | | (Type) | |
+========================+================+==========+=====+==========+=========+==========================+===============+===============+
| 192.0.2.2/32 | ldp | 65537 | Y | 10 | 9 | 2026-06-12T08:59:03.239Z | 192.168.12.2 | ethernet- |
| | | | | | | | (mpls) | 1/2.1 |
| 192.0.2.4/32 | ldp | 65538 | Y | 20 | 9 | 2026-06-12T09:01:16.585Z | 192.168.12.2 | ethernet- |
| | | | | | | | (mpls) | 1/2.1 |
+------------------------+----------------+----------+-----+----------+---------+--------------------------+---------------+---------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
2 LDP tunnels, 2 active, 0 inactive
---------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv6 tunnel table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
<no_entries>
---------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------The detailed route information on PE-1 for IPv6 prefix 2001:db8::1:11:4:0/120 shows that the 6PE next hop 192.0.2.4 is resolved to an LDP tunnel:
A:admin@PE-1# show / network-instance default ipv6 route 2001:db8::1:11:4:0/120 detail
=========================================================================================================================================================
Prefix: 2001:db8::1:11:4:0/120
---------------------------------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp-label
Route Owner : bgp_label_mgr, 2026-06-12T09:18:25.632Z (50 minutes ago)
Id : 0
Leakable : no
Leaked : no
Metric : 20
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 31289618
Net-Instance : default
FIB Failed : no
Primary NH Count : 1
Backup NH Count : 0
Primary NH : 31289612
LB Weight : 1
Type : mpls
MPLS-Tunnel : 192.0.2.4/32
Type : ldp
Tunnel ID : 65538
MPLS Lbl Stack : 400006PE next hop resolved to an LDP tunnel shows that the 6PE next hop is resolved to an LDP tunnel. No other tunnels are available in the IPv4 core network.
6PE next hop resolved to an Uncolored SR‑MPLS TE‑Policy tunnel
IS-IS Segment Routing is enabled on the PEs and P-2. For more information about SR-ISIS, see the Segment Routing with IS-IS Control Plane chapter. On PE-1, the configuration is as follows:
# on PE-1:
enter candidate
network-instance default {
protocols {
isis {
dynamic-label-block dlb-asid
instance 0 {
segment-routing {
mpls {
dynamic-adjacency-sids {
all-interfaces true
}
}
}
}
}
}
segment-routing {
mpls {
global-block {
label-range slb-nsid
}
local-prefix-sid 1 {
interface system0.0
ipv4-label-index 1
node-sid true
}
}
}
}
system {
mpls {
label-ranges {
static slb-nsid {
start-label 25000
end-label 25099
}
dynamic dlb-asid {
start-label 26000
end-label 26099
}
}
}
}The configuration on P-2 and on PE-4 is similar, with ipv4-label-index 2 on P-2 and ipv4-label-index 4 on PE-4.
On PE-1 and PE-4, an Uncolored SR‑MPLS TE‑Policy is configured toward the peer PE; for example, on PE-1:
# on PE-1:
enter candidate
network-instance default {
protocols {
isis {
instance 0 {
te-database-install {
}
traffic-engineering {
advertisement true
ipv4-te-router-id 192.0.2.1
}
}
}
}
traffic-engineering {
ipv4-te-router-id 192.0.2.1
interface ethernet-1/2.1 {
interface-ref {
interface ethernet-1/2
subinterface 1
}
}
}
traffic-engineering-policies {
policy te-pol_PE-1-PE-4 {
policy-type sr-mpls-uncolored
admin-state enable
endpoint 192.0.2.4
segment-list 10 {
admin-state enable
segment-list-type primary
dynamic {
path-algorithm local-cspf
}
}
}
}The configuration is similar on PE-4, with policy te-pol_PE-4-PE-1, endpoint 192.0.2.1, and ipv4-te-router-id 192.0.2.4. No additional configuration is required on P-2.
The following output shows that three tunnels are available to 6PE next hop 192.0.2.4/32: an LDP tunnel, an SR-ISIS tunnel, and an Uncolored SR‑MPLS TE‑Policy tunnel:
A:admin@PE-1# show / network-instance default tunnel-table ipv4 192.0.2.4/32
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 tunnel table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
| IPv4 Prefix | Tunnel Type | Tunnel ID | FIB | Metric | Preference | Last Update | Backup | Next-hop | Next-hop |
| | | | | | | | Nexthops | (Type) | |
+==============+==============+==============+==============+==============+==============+==============+==============+==============+==============+
| 192.0.2.4/32 | ldp | 65538 | Y | 20 | 9 | 2026-06- | | 192.168.12.2 | ethernet- |
| | | | | | | 12T09:01:16. | | (mpls) | 1/2.1 |
| | | | | | | 585Z | | | |
| 192.0.2.4/32 | sr-isis | 25004 | Y | 20 | 11 | 2026-06- | | 192.168.12.2 | ethernet- |
| | | | | | | 12T10:23:10. | | (mpls) | 1/2.1 |
| | | | | | | 438Z | | | |
| 192.0.2.4/32 | te-policy- | 1 | Y | 20 | 8 | 2026-06- | | 192.0.2.4/32 | ethernet- |
| | sr-mpls- | | | | | 12T10:27:22. | | (sr-isis) | 1/2.1 |
| | uncolored | | | | | 739Z | | | |
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
1 LDP tunnels, 1 active, 0 inactive
1 SR-ISIS tunnels, 1 active, 0 inactive
1 TE-POLICY-SR-MPLS-UNCOLORED tunnels, 1 active, 0 inactive
---------------------------------------------------------------------------------------------------------------------------------------------------------For 6PE next hop resolution, Uncolored SR‑MPLS TE‑Policy tunnels are preferred over any other tunnel type in the tunnel table, so the BGP next hop 192.0.2.4 is resolved to an Uncolored SR‑MPLS TE‑Policy tunnel, as follows:
A:admin@PE-1# show / network-instance default ipv6 route 2001:db8::1:11:4:0/120 detail
=========================================================================================================================================================
Prefix: 2001:db8::1:11:4:0/120
---------------------------------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp-label
Route Owner : bgp_label_mgr, 2026-06-12T10:27:22.740Z (6 minutes ago)
Id : 0
Leakable : no
Leaked : no
Metric : 20
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 31289624
Net-Instance : default
FIB Failed : no
Primary NH Count : 1
Backup NH Count : 0
Primary NH : 31289618
LB Weight : 1
Type : mpls
MPLS-Tunnel : 192.0.2.4/32
Type : te-policy-sr-mpls-uncolored
Tunnel ID : 1
MPLS Lbl Stack : 400006PE next hop resolved to an Uncolored SR‑MPLS TE‑Policy tunnel shows that the 6PE next hop 192.0.2.4 is resolved to an Uncolored SR‑MPLS TE‑Policy tunnel, even though an LDP tunnel and an SR-ISIS tunnel are available too.
6PE next hop resolved to an SR-ISIS tunnel
To verify that LDP tunnels are preferred over SR-ISIS tunnels, the Uncolored SR‑MPLS TE‑Policy is disabled, as follows:
# on PE-1:
enter candidate
network-instance default {
traffic-engineering-policies {
policy te-pol_PE-1-PE-4 {
admin-state disableThe following output shows that two tunnels are available toward 6PE next hop 192.0.2.4/32: an LDP tunnel and an SR-ISIS tunnel.
A:admin@PE-1# show / network-instance default tunnel-table ipv4 192.0.2.4/32
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 tunnel table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
| IPv4 Prefix | Tunnel Type | Tunnel ID | FIB | Metric | Preference | Last Update | Backup | Next-hop | Next-hop |
| | | | | | | | Nexthops | (Type) | |
+==============+==============+==============+==============+==============+==============+==============+==============+==============+==============+
| 192.0.2.4/32 | ldp | 65538 | Y | 20 | 9 | 2026-06- | | 192.168.12.2 | ethernet- |
| | | | | | | 12T09:01:16. | | (mpls) | 1/2.1 |
| | | | | | | 585Z | | | |
| 192.0.2.4/32 | sr-isis | 25004 | Y | 20 | 11 | 2026-06- | | 192.168.12.2 | ethernet- |
| | | | | | | 12T10:23:10. | | (mpls) | 1/2.1 |
| | | | | | | 438Z | | | |
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
1 LDP tunnels, 1 active, 0 inactive
1 SR-ISIS tunnels, 1 active, 0 inactive
---------------------------------------------------------------------------------------------------------------------------------------------------------For 6PE next-hop resolution, the LDP tunnel is preferred over the SR-ISIS tunnel, as follows:
A:admin@PE-1# show / network-instance default ipv6 route 2001:db8::1:11:4:0/120 detail
=========================================================================================================================================================
Prefix: 2001:db8::1:11:4:0/120
---------------------------------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp-label
Route Owner : bgp_label_mgr, 2026-06-12T10:44:13.098Z (19 seconds ago)
Id : 0
Leakable : no
Leaked : no
Metric : 20
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 31289626
Net-Instance : default
FIB Failed : no
Primary NH Count : 1
Backup NH Count : 0
Primary NH : 31289620
LB Weight : 1
Type : mpls
MPLS-Tunnel : 192.0.2.4/32
Type : ldp
Tunnel ID : 65538
MPLS Lbl Stack : 40000When also LDP is disabled on interface int-PE-1-P-2 on PE-1, the only remaining tunnel is an SR-ISIS tunnel, as follows:
# on PE-1:
enter candidate
network-instance default {
protocols {
ldp {
discovery {
interfaces {
interface ethernet-1/2.1 {
ipv4 {
admin-state disableA:admin@PE-1# show / network-instance default tunnel-table ipv4 192.0.2.4/32
---------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 tunnel table of network-instance "default"
---------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
| IPv4 Prefix | Tunnel Type | Tunnel ID | FIB | Metric | Preference | Last Update | Backup | Next-hop | Next-hop |
| | | | | | | | Nexthops | (Type) | |
+==============+==============+==============+==============+==============+==============+==============+==============+==============+==============+
| 192.0.2.4/32 | sr-isis | 25004 | Y | 20 | 11 | 2026-06- | | 192.168.12.2 | ethernet- |
| | | | | | | 12T10:23:10. | | (mpls) | 1/2.1 |
| | | | | | | 438Z | | | |
+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
---------------------------------------------------------------------------------------------------------------------------------------------------------
1 SR-ISIS tunnels, 1 active, 0 inactive
---------------------------------------------------------------------------------------------------------------------------------------------------------The 6PE next hop 192.0.2.4 is resolved to an SR-ISIS tunnel, as follows:
A:admin@PE-1# show / network-instance default ipv6 route 2001:db8::1:11:4:0/120 detail
=========================================================================================================================================================
Prefix: 2001:db8::1:11:4:0/120
---------------------------------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp-label
Route Owner : bgp_label_mgr, 2026-06-12T11:16:21.848Z (32 seconds ago)
Id : 0
Leakable : no
Leaked : no
Metric : 20
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 31289628
Net-Instance : default
FIB Failed : no
Primary NH Count : 1
Backup NH Count : 0
Primary NH : 31289622
LB Weight : 1
Type : mpls
MPLS-Tunnel : 192.0.2.4/32
Type : sr-isis
Tunnel ID : 25004
MPLS Lbl Stack : 400006PE next hop resolved to an SR-ISIS tunnel shows that the 6PE next hop 192.0.2.4 is resolved to an SR-ISIS tunnel after the Uncolored SR‑MPLS TE‑Policy and LDP are disabled on the interfaces between the PEs and P-2. No other tunnels are available.
Conclusion
The 6PE next hops can be resolved to different types of MPLS tunnels, each with a different preference.