BGP for L3VPN using SRv6

L3VRF SRv6 configuration

BGP SRv6 basic configuration

The operator must configure a locator on the router, and reference it on the default BGP instance that will be configured with the L3VPN service. The locator is generally configured on a loopback interface, and redistributed by an IGP. This implies that when a BGP speaker receives an IPv6 prefix with a SID value derived from that locator, it must know the SID reachability.

vsr running config# / vrf main routing segment-routing ipv6 locator LOCATOR prefix 2001:db8:0:1::/64
vsr running config# / vrf main routing bgp as 65500
vsr running config# / vrf main routing bgp router-id 192.0.2.1
vsr running config# / vrf main routing bgp segment-routing ipv6 locator LOCATOR
vsr running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:0:1::/64

Note

When receiving a SID attribute in BGP updates, the next-hop of the incoming BGP prefixes is not used, and is replaced by the SID value. The operator must ensure ensure that the SID IP address is reachable in the IPv6 core network.

The operator will complete the configuration by adding the L3VPN service to be deployed. Instead of configuring a label value to export, a SID value will be exported with the l3vpn export ipv6-sid command. A SID index will be configured, either manually by configuring the value, or automatically. That SID index will be written in the function part of the SID. The SID value will be encoded in two parts, by using the SID transposition algorithm: in the label part of the NLRI prefix, and in the SID attribute.

Note

Currently, the SID transposition algorithm implemented in BGP handles incorrectly the SRv6 locators with function length greater than 20 bits. To prevent issues, we currently limit the function length to 20 bits.

BGP SRv6 configuration example

The topology below is used to interconnect VPN networks behind an SRv6 network. An iBGP peering is performed between pe1 and pe2. An IPv6 address out of the locator range may be used to act as a BGP source address and also as BGP nexthop attribute.

Note

Operator may already have a deployed IPv6 network (with a following IPv6 address: 2001:db8:ffff::1/64) before the configuration of SRv6. Therefore the separate address 2001:db8:0:1::/64 is reserved for srv6.

It is assumed an IPv6 IGP like the IS-IS routing protocol is deployed in the rt3 and rt4 devices that physically separate the two PEs.

The iBGP peering permits prefix exchanges between pe1 and pe2. From pe1 perspective, two operations take place: - a BGP prefix is received from rt2, its SID attribute is taken and will be used as next hop; a segs route is installed in the green L3VRF. - The prefixes from the green L3VRF are redistributed by BGP and advertised with the local SID allocated from the green L3VRF. A seg6local local route is installed in the default L3VRF to properly handle the return traffic.

This behavior is presented in the figure below:

../../../../../_images/srv6_bgp_l3vpn_2.svg

Example of SRv6 BGP L3VRF behavior.

L3VRF SRv6 End.DT4 configuration

An example of SRv6 End.DT4 behavior is presented in the figure below, where the node from Network A sends an IPv4 packet to Network C. When packet reaches pe1,it is encapsulated into an IPv6 packet that is transmitted to pe2. At the moment when IPv4 in IPv6 packet arrives at pe2, it is decapsulated. The outer IPv6 header is stripped and the IPv4 packet is directed to the green L3VRF and finally to Network C.

../../../../../_images/srv6_bgp_dt4_2.svg

Example of SRv6 End.DT4 behavior.

To configure the End.DT4 operation on the pe1 device, use the following configuration:

pe1

pe1 running config# / vrf main interface physical eth2 port pci-b0s5
pe1 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:1::1/64
pe1 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::1/128
pe1 running config# / vrf main interface loopback loopback2 ipv6 address 2001:db8:0:1::/64
pe1 running config# / vrf main routing interface eth2 isis area-tag coresrv6
pe1 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe1 running config#! / vrf main routing interface loopback1 isis area-tag coresrv6
pe1 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe1 running config#! / vrf main routing interface loopback2 isis area-tag coresrv6
pe1 running config#! / vrf main routing interface loopback2 isis ipv6-routing true
pe1 running config#! / vrf main routing bgp as 65500
pe1 running config#! / vrf main routing bgp router-id 192.0.2.1
pe1 running config#! / vrf main routing bgp segment-routing ipv6 locator srv6-locator1
pe1 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::2 remote-as 65500
pe1 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::2 capabilities extended-nexthop true
pe1 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::2 update-source loopback1
pe1 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::2 address-family ipv4-unicast enabled false
pe1 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::2 address-family ipv4-vpn
pe1 running ipv4-vpn#! / vrf main routing isis instance coresrv6 is-type level-1
pe1 running ipv4-vpn# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0001.00
pe1 running ipv4-vpn# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast
pe1 running ipv6-unicast# / vrf main routing segment-routing ipv6 locator srv6-locator1 prefix 2001:db8:0:1::/64
pe1 running ipv6-unicast# / vrf main l3vrf green table-id 10
pe1 running ipv6-unicast# / vrf main l3vrf green interface physical eth1 port pci-b0s4
pe1 running ipv6-unicast# / vrf main l3vrf green interface physical eth1 ipv4 address 192.168.10.1/24
pe1 running ipv6-unicast# / vrf main l3vrf green routing bgp as 65500
pe1 running ipv6-unicast# / vrf main l3vrf green routing bgp router-id 192.0.2.1
pe1 running ipv6-unicast# / vrf main l3vrf green routing bgp address-family ipv4-unicast network 192.168.10.0/24
pe1 running network 192.168.10.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export vpn true
pe1 running network 192.168.10.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export route-target 2:55
pe1 running network 192.168.10.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65500:1
pe1 running network 192.168.10.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export ipv6-sid auto
pe1 running network 192.168.10.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn import vpn true
pe1 running network 192.168.10.0/24#! / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn import route-target 2:55

To configure the End.DT4 operation on the pe2 device, use the following configuration:

pe2

pe2 running config# / vrf main interface physical eth2 port pci-b0s5
pe2 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:3::2/64
pe2 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::2/128
pe2 running config# / vrf main interface loopback loopback2 ipv6 address 2001:db8:0:2::/64
pe2 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe2 running config#! / vrf main routing interface loopback2 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface loopback2 isis ipv6-routing true
pe2 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe2 running config#! / vrf main routing bgp as 65500
pe2 running config#! / vrf main routing bgp router-id 192.0.2.2
pe2 running config#! / vrf main routing bgp segment-routing ipv6 locator srv6-locator1
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 remote-as 65500
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 capabilities extended-nexthop true
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 update-source loopback1
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 address-family ipv4-unicast enabled false
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 address-family ipv4-vpn
pe2 running ipv4-vpn#! / vrf main routing isis instance coresrv6 is-type level-1
pe2 running ipv4-vpn# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0002.00
pe2 running ipv4-vpn# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast
pe2 running ipv6-unicast# / vrf main routing segment-routing ipv6 locator srv6-locator1 prefix 2001:db8:0:2::/64
pe2 running ipv6-unicast# / vrf main l3vrf green table-id 10
pe2 running ipv6-unicast# / vrf main l3vrf green interface physical eth1 port pci-b0s4
pe2 running ipv6-unicast# / vrf main l3vrf green interface physical eth1 ipv4 address 192.168.11.2/24
pe2 running ipv6-unicast# / vrf main l3vrf green routing bgp as 65500
pe2 running ipv6-unicast# / vrf main l3vrf green routing bgp router-id 192.0.2.2
pe2 running ipv6-unicast# / vrf main l3vrf green routing bgp address-family ipv4-unicast network 192.168.11.0/24
pe2 running network 192.168.11.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export vpn true
pe2 running network 192.168.11.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export route-target 2:55
pe2 running network 192.168.11.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65500:2
pe2 running network 192.168.11.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn export ipv6-sid auto
pe2 running network 192.168.11.0/24# / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn import vpn true
pe2 running network 192.168.11.0/24#! / vrf main l3vrf green routing bgp address-family ipv4-unicast l3vpn import route-target 2:55

The pe3 and the pe4 configuration is given below:

pe3

pe3 running config# / vrf main interface physical eth2 port pci-b0s5
pe3 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:1::3/64
pe3 running config# / vrf main interface physical eth1 port pci-b0s4
pe3 running config# / vrf main interface physical eth1 ipv6 address 2001:db8:1:2::3/64
pe3 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::3/128
pe3 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe3 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe3 running config#! / vrf main routing interface eth1 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface eth1 isis ipv6-routing true
pe3 running config#! / vrf main routing isis instance coresrv6 is-type level-1
pe3 running config# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0003.00
pe3 running config# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast

pe4

pe4 running config# / vrf main interface physical eth1 port pci-b0s4
pe4 running config# / vrf main interface physical eth1 ipv6 address 2001:db8:1:2::4/64
pe4 running config# / vrf main interface physical eth2 port pci-b0s5
pe4 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:3::4/64
pe4 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::4/128
pe4 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe4 running config#! / vrf main routing interface eth1 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface eth1 isis ipv6-routing true
pe4 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe4 running config#! / vrf main routing isis instance coresrv6 is-type level-1
pe4 running config# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0004.00
pe4 running config# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast

The seg6local route of pe1 can be seen below with the show ipv6-routes command.

pe1

pe1> show ipv6-routes
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF default:
C>* 2001:db8:0:1::/64 is directly connected, loopback2, 00:00:38
B>* 2001:db8:0:1:1::/128 [20/0] is directly connected, green, seg6local End.DT4 table 10, weight 1, 00:00:36
I>* 2001:db8:0:2::/64 [115/40] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:00
C>* 2001:db8:1:1::/64 is directly connected, eth2, 00:00:37
I>* 2001:db8:1:2::/64 [115/20] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:06
I>* 2001:db8:1:3::/64 [115/30] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:03
C>* 2001:db8:ffff::1/128 is directly connected, loopback1, 00:00:38
I>* 2001:db8:ffff::2/128 [115/40] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:00
I>* 2001:db8:ffff::3/128 [115/20] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:06
I>* 2001:db8:ffff::4/128 [115/30] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:03
C * fe80::/64 is directly connected, sr0, 00:00:38
C * fe80::/64 is directly connected, loopback2, 00:00:38
C>* fe80::/64 is directly connected, loopback1, 00:00:38
C * fe80::/64 is directly connected, eth2, 00:04:39
C * fe80::/64 is directly connected, fptun0, 00:04:40

15 routes displayed.

The command below displays the remote SID attribute of the bgp 192.168.11.0/24 prefix in L3VRF green on the pe1 device:

pe1

pe1> show bgp l3vrf green ipv4 prefix 192.168.11.0/24
BGP routing table entry for 192.168.11.0/24, version 2
Paths: (1 available, best #1, l3vrf green)
  Not advertised to any peer
  Imported from 65500:2:192.168.11.0/24
  Local
    2001:db8:ffff::2 (metric 40) from :: (192.0.2.1) l3vrf default(0) announce-nh-self
      Origin IGP, metric 0, localpref 100, valid, sourced, local, best (First path received)
      Extended Community: RT:2:55
      Remote label: 16
      Remote SID: 2001:db8:0:2::
      Last update: Thu Feb 26 11:20:08 2026

To show the routes in the L3VRF green on the pe1 device, use the following command:

pe1

pe1> show ipv4-routes l3vrf green
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF green:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:40
C>* 192.168.10.0/24 is directly connected, eth1, 00:00:40
B>  192.168.11.0/24 [200/0] via 2001:db8:ffff::2 (l3vrf default) (recursive), label 16, seg6 2001:db8:0:2:1::, weight 1, 00:00:01
  *                         via fe80::dced:1ff:fefe:3f88, eth2 (l3vrf default), label 16, seg6 2001:db8:0:2:1::, weight 1, 00:00:01

3 routes displayed.

Note

To reach from a source IPv4 subnet 192.168.10.0/24 behind the pe1 the destination IPv4 subnet 192.168.11.0/24 behind the `pe2 the above BGP route is used. The nexthop of the BGP route is IPv6 address 2001:db8:ffff::2 that correponds to loopback1 of pe2. The IPv6 address 2001:db8:ffff::2 is not used as it is replaced by the SRv6 SID value.

From pe2 perspective, the incoming traffic is handled by the highlighted seg6local route.

pe2

pe2> show ipv6-routes
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF default:
I>* 2001:db8:0:1::/64 [115/40] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
C>* 2001:db8:0:2::/64 is directly connected, loopback2, 00:00:33
B>* 2001:db8:0:2:1::/128 [20/0] is directly connected, green, seg6local End.DT4 table 10, weight 1, 00:00:31
I>* 2001:db8:1:1::/64 [115/30] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
I>* 2001:db8:1:2::/64 [115/20] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
C>* 2001:db8:1:3::/64 is directly connected, eth2, 00:00:32
I>* 2001:db8:ffff::1/128 [115/40] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
C>* 2001:db8:ffff::2/128 is directly connected, loopback1, 00:00:33
I>* 2001:db8:ffff::3/128 [115/30] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
I>* 2001:db8:ffff::4/128 [115/20] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:03
C * fe80::/64 is directly connected, sr0, 00:00:33
C * fe80::/64 is directly connected, loopback2, 00:00:33
C>* fe80::/64 is directly connected, loopback1, 00:00:33
C * fe80::/64 is directly connected, eth2, 00:04:42
C * fe80::/64 is directly connected, fptun0, 00:04:43

15 routes displayed.

The return traffic from pe2 to pe1 is handled by the seg route:

pe2

pe2> show bgp l3vrf green ipv4 prefix 192.168.10.0/24
BGP routing table entry for 192.168.10.0/24, version 2
Paths: (1 available, best #1, l3vrf green)
  Not advertised to any peer
  Imported from 65500:1:192.168.10.0/24
  Local
    2001:db8:ffff::1 (metric 40) from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin IGP, metric 0, localpref 100, valid, sourced, local, best (First path received)
      Extended Community: RT:2:55
      Remote label: 16
      Remote SID: 2001:db8:0:1::
      Last update: Thu Feb 26 11:20:09 2026

To show the routes in L3VRF green on the pe2 device, use the following command:

pe2

pe2> show ipv4-routes l3vrf green
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF green:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:35
B>  192.168.10.0/24 [200/0] via 2001:db8:ffff::1 (l3vrf default) (recursive), label 16, seg6 2001:db8:0:1:1::, weight 1, 00:00:04
  *                         via fe80::dced:1ff:fe85:be21, eth2 (l3vrf default), label 16, seg6 2001:db8:0:1:1::, weight 1, 00:00:04
C>* 192.168.11.0/24 is directly connected, eth1, 00:00:35

3 routes displayed.

L3VRF SRv6 End.DT6 configuration

Similar to SRv6 End.DT4 behavior, the End.DT6 behavior allows to instantiate IPv6 in IPv6 services, where the node from Network E sends the IPv6 packet to Network G. When the packet reaches pe1, it is encapsulated into an IPv6 packet that is transmitted to pe2. When encapsulated packet arrives at pe2, the outer IPv6 header is stripped and the IPv6 packet is directed to the L3VRF and finally to Network G.

To configure the End.DT6 operation on the pe1 device, use the following configuration:

../../../../../_images/srv6_bgp_dt6_2.svg

Example of SRv6 End.DT6 behavior.

pe1 running config# / vrf main interface
pe1 running interface# / vrf main interface physical eth2 port pci-b0s5
pe1 running interface# / vrf main interface physical eth2 ipv6 address 2001:db8:1:1::1/64
pe1 running interface# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::1/128
pe1 running interface# / vrf main interface loopback loopback2 ipv6 address 2001:db8:0:1::/64
pe1 running interface# / vrf main routing interface eth2 isis area-tag coresrv6
pe1 running interface#! / vrf main routing interface eth2 isis ipv6-routing true
pe1 running interface#! / vrf main routing interface loopback1 isis area-tag coresrv6
pe1 running interface#! / vrf main routing interface loopback1 isis ipv6-routing true
pe1 running interface#! / vrf main routing interface loopback2 isis area-tag coresrv6
pe1 running interface#! / vrf main routing interface loopback2 isis ipv6-routing true
pe1 running interface#! / vrf main routing bgp as 65500
pe1 running interface#! / vrf main routing bgp router-id 192.0.2.1
pe1 running interface#! / vrf main routing bgp segment-routing ipv6 locator srv6-locator1
pe1 running interface#! / vrf main routing bgp neighbor 2001:db8:ffff::2 remote-as 65500
pe1 running interface#! / vrf main routing bgp neighbor 2001:db8:ffff::2 capabilities extended-nexthop true
pe1 running interface#! / vrf main routing bgp neighbor 2001:db8:ffff::2 update-source loopback1
pe1 running interface#! / vrf main routing bgp neighbor 2001:db8:ffff::2 address-family ipv6-vpn
pe1 running ipv6-vpn#! / vrf main routing isis instance coresrv6 is-type level-1
pe1 running ipv6-vpn# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0001.00
pe1 running ipv6-vpn# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast
pe1 running ipv6-unicast# / vrf main routing segment-routing ipv6 locator srv6-locator1 prefix 2001:db8:0:1::/64
pe1 running ipv6-unicast# / vrf main l3vrf magenta table-id 20
pe1 running ipv6-unicast# / vrf main l3vrf magenta interface physical eth1 port pci-b0s4
pe1 running ipv6-unicast# / vrf main l3vrf magenta interface physical eth1 ipv6 address 2001:db8:aaaa:1::1/64
pe1 running ipv6-unicast# / vrf main l3vrf magenta routing bgp as 65500
pe1 running ipv6-unicast# / vrf main l3vrf magenta routing bgp router-id 192.0.2.1
pe1 running ipv6-unicast# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast network 2001:db8:aaaa:1::1/64
pe1 running network 2001:db8:aaaa:1::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export vpn true
pe1 running network 2001:db8:aaaa:1::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export route-target 6:55
pe1 running network 2001:db8:aaaa:1::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export route-distinguisher 65500:3
pe1 running network 2001:db8:aaaa:1::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export ipv6-sid auto
pe1 running network 2001:db8:aaaa:1::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn import vpn true
pe1 running network 2001:db8:aaaa:1::/64#! / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn import route-target 6:55

To configure the End.DT6 operation on the pe2 device, use the following configuration:

pe2 running config# / vrf main interface physical eth2 port pci-b0s5
pe2 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:3::2/64
pe2 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::2/128
pe2 running config# / vrf main interface loopback loopback2 ipv6 address 2001:db8:0:2::/64
pe2 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe2 running config#! / vrf main routing interface loopback2 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface loopback2 isis ipv6-routing true
pe2 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe2 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe2 running config#! / vrf main routing bgp as 65500
pe2 running config#! / vrf main routing bgp router-id 192.0.2.2
pe2 running config#! / vrf main routing bgp segment-routing ipv6 locator srv6-locator1
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 remote-as 65500
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 capabilities extended-nexthop true
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 update-source loopback1
pe2 running config#! / vrf main routing bgp neighbor 2001:db8:ffff::1 address-family ipv6-vpn
pe2 running ipv6-vpn#! / vrf main routing isis instance coresrv6 is-type level-1
pe2 running ipv6-vpn# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0002.00
pe2 running ipv6-vpn# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast
pe2 running ipv6-unicast# / vrf main routing segment-routing ipv6 locator srv6-locator1 prefix 2001:db8:0:2::/64
pe2 running ipv6-unicast# / vrf main l3vrf magenta table-id 20
pe2 running ipv6-unicast# / vrf main l3vrf magenta interface physical eth1 port pci-b0s4
pe2 running ipv6-unicast# / vrf main l3vrf magenta interface physical eth1 ipv6 address 2001:db8:aaaa:2::2/64
pe2 running ipv6-unicast# / vrf main l3vrf magenta routing bgp as 65500
pe2 running ipv6-unicast# / vrf main l3vrf magenta routing bgp router-id 192.0.2.2
pe2 running ipv6-unicast# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast network 2001:db8:aaaa:2::2/64
pe2 running network 2001:db8:aaaa:2::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export vpn true
pe2 running network 2001:db8:aaaa:2::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export route-target 6:55
pe2 running network 2001:db8:aaaa:2::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export route-distinguisher 65500:4
pe2 running network 2001:db8:aaaa:2::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn export ipv6-sid auto
pe2 running network 2001:db8:aaaa:2::/64# / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn import vpn true
pe2 running network 2001:db8:aaaa:2::/64#! / vrf main l3vrf magenta routing bgp address-family ipv6-unicast l3vpn import route-target 6:55

The pe3 and the pe4 configuration is given below:

pe3

pe3 running config# / vrf main interface physical eth2 port pci-b0s5
pe3 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:1::3/64
pe3 running config# / vrf main interface physical eth1 port pci-b0s4
pe3 running config# / vrf main interface physical eth1 ipv6 address 2001:db8:1:2::3/64
pe3 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::3/128
pe3 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe3 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe3 running config#! / vrf main routing interface eth1 isis area-tag coresrv6
pe3 running config#! / vrf main routing interface eth1 isis ipv6-routing true
pe3 running config#! / vrf main routing isis instance coresrv6 is-type level-1
pe3 running config# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0003.00
pe3 running config# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast

pe4

pe4 running config# / vrf main interface physical eth1 port pci-b0s4
pe4 running config# / vrf main interface physical eth1 ipv6 address 2001:db8:1:2::4/64
pe4 running config# / vrf main interface physical eth2 port pci-b0s5
pe4 running config# / vrf main interface physical eth2 ipv6 address 2001:db8:1:3::4/64
pe4 running config# / vrf main interface loopback loopback1 ipv6 address 2001:db8:ffff::4/128
pe4 running config# / vrf main routing interface loopback1 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface loopback1 isis ipv6-routing true
pe4 running config#! / vrf main routing interface eth1 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface eth1 isis ipv6-routing true
pe4 running config#! / vrf main routing interface eth2 isis area-tag coresrv6
pe4 running config#! / vrf main routing interface eth2 isis ipv6-routing true
pe4 running config#! / vrf main routing isis instance coresrv6 is-type level-1
pe4 running config# / vrf main routing isis instance coresrv6 area-address 49.001a.0000.0000.0004.00
pe4 running config# / vrf main routing isis instance coresrv6 multi-topology ipv6-unicast

The seg6local route of pe1 can be seen below with the show ipv6-routes command.

pe1> show ipv6-routes
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF default:
C>* 2001:db8:0:1::/64 is directly connected, loopback2, 00:00:39
B>* 2001:db8:0:1:1::/128 [20/0] is directly connected, magenta, seg6local End.DT6 table 20, weight 1, 00:00:37
I>* 2001:db8:0:2::/64 [115/40] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:00
C>* 2001:db8:1:1::/64 is directly connected, eth2, 00:00:37
I>* 2001:db8:1:2::/64 [115/20] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:06
I>* 2001:db8:1:3::/64 [115/30] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:04
C>* 2001:db8:ffff::1/128 is directly connected, loopback1, 00:00:39
I>* 2001:db8:ffff::2/128 [115/40] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:00
I>* 2001:db8:ffff::3/128 [115/20] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:06
I>* 2001:db8:ffff::4/128 [115/30] via fe80::dced:1ff:fefe:3f88, eth2, weight 1, 00:00:04
C * fe80::/64 is directly connected, loopback2, 00:00:39
C * fe80::/64 is directly connected, loopback1, 00:00:39
C>* fe80::/64 is directly connected, sr0, 00:02:32
C * fe80::/64 is directly connected, eth2, 00:06:33
C * fe80::/64 is directly connected, fptun0, 00:06:34

15 routes displayed.

The command below displays the remote SID attribute of the BGP 2001:db8:aaaa:2::/64 prefix in L3VRF magenta on the pe1 device.

pe1> show bgp l3vrf magenta ipv6 prefix 2001:db8:aaaa:2::/64
BGP routing table entry for 2001:db8:aaaa:2::/64, version 2
Paths: (1 available, best #1, l3vrf magenta)
  Not advertised to any peer
  Imported from 65500:4:2001:db8:aaaa:2::/64
  Local
    2001:db8:ffff::2 (metric 40) from :: (192.0.2.1) l3vrf default(0) announce-nh-self
      Origin IGP, metric 0, localpref 100, valid, sourced, local, best (First path received)
      Extended Community: RT:6:55
      Remote label: 16
      Remote SID: 2001:db8:0:2::
      Last update: Thu Feb 26 11:22:03 2026

To show the routes in L3VRF magenta on the pe1 device, use the following command:

pe1> show ipv6-routes l3vrf magenta protocol bgp
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF magenta:
B>  2001:db8:aaaa:2::/64 [200/0] via 2001:db8:ffff::2 (l3vrf default) (recursive), label 16, seg6 2001:db8:0:2:1::, weight 1, 00:00:02
  *                              via fe80::dced:1ff:fefe:3f88, eth2 (l3vrf default), label 16, seg6 2001:db8:0:2:1::, weight 1, 00:00:02

1 routes displayed.

The seg6local route of pe2 can be seen below with the show ipv6-routes command.

pe2> show ipv6-routes
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF default:
I>* 2001:db8:0:1::/64 [115/40] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
C>* 2001:db8:0:2::/64 is directly connected, loopback2, 00:00:34
B>* 2001:db8:0:2:1::/128 [20/0] is directly connected, magenta, seg6local End.DT6 table 20, weight 1, 00:00:32
I>* 2001:db8:1:1::/64 [115/30] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
I>* 2001:db8:1:2::/64 [115/20] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
C>* 2001:db8:1:3::/64 is directly connected, eth2, 00:00:33
I>* 2001:db8:ffff::1/128 [115/40] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
C>* 2001:db8:ffff::2/128 is directly connected, loopback1, 00:00:34
I>* 2001:db8:ffff::3/128 [115/30] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
I>* 2001:db8:ffff::4/128 [115/20] via fe80::dced:1ff:fe85:be21, eth2, weight 1, 00:00:04
C * fe80::/64 is directly connected, loopback2, 00:00:34
C * fe80::/64 is directly connected, loopback1, 00:00:34
C>* fe80::/64 is directly connected, sr0, 00:02:28
C * fe80::/64 is directly connected, eth2, 00:06:37
C * fe80::/64 is directly connected, fptun0, 00:06:38

15 routes displayed.

The command below displays the remote SID attribute of the bgp 2001:db8:aaaa:1::/64 prefix in L3VRF magenta on the pe2 device:

pe2> show bgp l3vrf magenta ipv6 prefix 2001:db8:aaaa:1::/64
BGP routing table entry for 2001:db8:aaaa:1::/64, version 2
Paths: (1 available, best #1, l3vrf magenta)
  Not advertised to any peer
  Imported from 65500:3:2001:db8:aaaa:1::/64
  Local
    2001:db8:ffff::1 (metric 40) from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin IGP, metric 0, localpref 100, valid, sourced, local, best (First path received)
      Extended Community: RT:6:55
      Remote label: 16
      Remote SID: 2001:db8:0:1::
      Last update: Thu Feb 26 11:22:03 2026

To show the routes in the L3VRF magenta on the pe2 device, use the following command:

pe2> show ipv6-routes l3vrf magenta protocol bgp
Codes: K - kernel route, C - connected, S - static, R - RIPng,
       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, 6 - 6PE, p - SRTE,
       > - selected route, * - FIB route, r - rejected, b - backup

L3VRF magenta:
B>  2001:db8:aaaa:1::/64 [200/0] via 2001:db8:ffff::1 (l3vrf default) (recursive), label 16, seg6 2001:db8:0:1:1::, weight 1, 00:00:04
  *                              via fe80::dced:1ff:fe85:be21, eth2 (l3vrf default), label 16, seg6 2001:db8:0:1:1::, weight 1, 00:00:04

1 routes displayed.

L3VPN coexistence between MPLS and SRv6

The following chapter provides the available commands in order to make co-exist SRv6 and MPLS networks together.

BGP SRv6 and MPLS basic configuration

The following initial setup established an eBGP peering between two devices configured with L3VPN, namely dut and router. The l3vrf1 L3VRF of dut has 2 prefixes which are advertised as MPLS updates.

dut

dut-vm running config# / vrf main interface physical eth0 port pci-b0s5
dut-vm running config# / vrf main interface physical eth0 ipv6 address 2001::1/64
dut-vm running config# / vrf main l3vrf l3vrf1 table-id 10
dut-vm running config# / vrf main l3vrf l3vrf1 interface physical eth1 port pci-b0s4
dut-vm running config# / vrf main l3vrf l3vrf1 interface physical eth1 ipv6 address 2001:8::1/64
dut-vm running config# / vrf main l3vrf l3vrf1 interface physical eth1 ipv4 address 192.168.8.1/24
dut-vm running config# / vrf main routing bgp as 65500
dut-vm running config# / vrf main routing bgp router-id 192.0.2.1
dut-vm running config# / vrf main routing bgp ebgp-requires-policy false
dut-vm running config# / vrf main routing bgp neighbor 2001::2 remote-as 65501
dut-vm running config# / vrf main routing bgp neighbor 2001::2 update-source 2001::1
dut-vm running config# / vrf main routing bgp neighbor 2001::2 capabilities extended-nexthop true
dut-vm running config# / vrf main routing bgp neighbor 2001::2 timers keepalive-interval 3 hold-time 10
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-unicast enabled false
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-vpn enabled true
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv6-vpn enabled true
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp ebgp-requires-policy false
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export vpn true
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export route-target 55:55
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 1:11
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn import vpn true
dut-vm running config#! / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn import route-target 55:55
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export label 200
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast redistribute connected
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export vpn true
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export route-target 55:55
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export route-distinguisher 1:10
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn import vpn true
dut-vm running config#! / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn import route-target 55:55
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export label 300
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast redistribute connected
dut-vm running config# / vrf main routing interface eth0 bgp mpls accept-connected-ebgp-routes true

router

router-vm running config# / vrf main interface physical eth0 port pci-b0s5
router-vm running config# / vrf main interface physical eth0 ipv6 address 2001::2/64
router-vm running config# / vrf main l3vrf l3vrf1 table-id 10
router-vm running config# / vrf main routing bgp as 65501
router-vm running config# / vrf main routing bgp router-id 192.0.2.2
router-vm running config# / vrf main routing bgp ebgp-requires-policy false
router-vm running config# / vrf main routing bgp neighbor 2001::1 remote-as 65500
router-vm running config# / vrf main routing bgp neighbor 2001::1 update-source 2001::2
router-vm running config# / vrf main routing bgp neighbor 2001::1 capabilities extended-nexthop true
router-vm running config# / vrf main routing bgp neighbor 2001::1 timers keepalive-interval 3 hold-time 10
router-vm running config# / vrf main routing bgp neighbor 2001::1 address-family ipv4-unicast enabled false
router-vm running config# / vrf main routing bgp neighbor 2001::1 address-family ipv4-vpn enabled true
router-vm running config# / vrf main routing bgp neighbor 2001::1 address-family ipv6-vpn enabled true
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp ebgp-requires-policy false
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export vpn true
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export route-target 55:55
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 2:11
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn import vpn true
router-vm running config#! / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn import route-target 55:55
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast redistribute connected
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export vpn true
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export route-target 55:55
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export route-distinguisher 2:10
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn import vpn true
router-vm running config#! / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn import route-target 55:55
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast redistribute connected
router-vm running config# / vrf main routing interface eth0 bgp mpls accept-connected-ebgp-routes true

The below output shows the 2 updates received by router.

router

router-vm running vrf main# show bgp ipv6 vpn prefix 2001:8::/64
BGP routing table entry for 1:10:2001:8::/64, version 1
not allocated
Paths: (1 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    2001::1 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 300
      Last update: Fri Nov 14 18:18:47 2025
router-vm running vrf main# show bgp ipv4 vpn prefix 192.168.8.0/24
BGP routing table entry for 1:11:192.168.8.0/24, version 1
not allocated
Paths: (1 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    0.0.0.0 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 200
      Last update: Fri Nov 14 18:18:47 2025

If the dut is required to advertise both MPLS and SRv6 updates, an SRv6 configuration is pushed ( Configuring SRv6 L3VPN). By default, without the mpls-enabled command, the dut exports only srv6 route updates. To ensure that both MPLS and SRv6 routes are advertised, enable the mpls-enabled command under the bgp segment-routing ipv6 configuration node of the L3VRF where prefixes originate.

dut

dut-vm running config# / vrf main routing segment-routing ipv6 locator loc1 prefix 2001:db8:1:1::/64 block-length 40 node-length 24 function-length 16
dut-vm running config# / vrf main routing bgp segment-routing ipv6 locator loc1
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp segment-routing ipv6 mpls-enabled true
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn export ipv6-sid 4
dut-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn export ipv6-sid 8

The below output shows for each address-family, 2 BGP paths per prefix, one for MPLS and the other for SRv6. Both are considered equal as the flag multipath is used.

dut

dut-vm> show bgp ipv6 vpn prefix 2001:8::/64
BGP routing table entry for 1:10:2001:8::/64, version 3
not allocated
Paths: (2 available, best #1)
  Advertised to non peer-group peers:
  2001::2
  Local
    :: from :: (192.0.2.1) vrf l3vrf1(6) announce-nh-self
      Origin incomplete, metric 0, weight 32768, valid, sourced, local, multipath, best (Locally configured route)
      Extended Community: RT:55:55
      Originator: 192.0.2.1
      Remote label: 128
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      Last update: Fri Nov 14 18:21:21 2025
  Local
    :: from :: (192.0.2.1) vrf l3vrf1(6) announce-nh-self
      Origin incomplete, metric 0, weight 32768, valid, sourced, local, multipath
      Extended Community: RT:55:55
      Originator: 192.0.2.1
      Remote label: 300
      Last update: Fri Nov 14 18:21:21 2025
dut-vm> show bgp ipv4 vpn prefix 192.168.8.0/24
BGP routing table entry for 1:11:192.168.8.0/24, version 3
not allocated
Paths: (2 available, best #1)
  Advertised to non peer-group peers:
  2001::2
  Local
    0.0.0.0 from 0.0.0.0 (192.0.2.1) vrf l3vrf1(6) announce-nh-self
      Origin incomplete, metric 0, weight 32768, valid, sourced, local, multipath, best (Locally configured route)
      Extended Community: RT:55:55
      Originator: 192.0.2.1
      Remote label: 64
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      Last update: Fri Nov 14 18:21:21 2025
  Local
    0.0.0.0 from 0.0.0.0 (192.0.2.1) vrf l3vrf1(6) announce-nh-self
      Origin incomplete, metric 0, weight 32768, valid, sourced, local, multipath
      Extended Community: RT:55:55
      Originator: 192.0.2.1
      Remote label: 200
      Last update: Fri Nov 14 18:21:21 2025

The router device has not been updated with the two prefixes, because the addpath functionality has to be used.

dut

dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-vpn addpath tx-all-paths true
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv6-vpn addpath tx-all-paths true

Consequently, the router can see both prefixes.

router

router-vm> show bgp ipv6 vpn prefix 2001:8::/64
BGP routing table entry for 1:10:2001:8::/64, version 9
not allocated
Paths: (2 available, best #2)
  Advertised to non peer-group peers:
  2001::1
  65500
    2001::1 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, multipath
      Extended Community: RT:55:55
      Remote label: 300
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:24:41 2025
  65500
    2001::1 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, multipath, best (Nothing left to compare)
      Extended Community: RT:55:55
      Remote label: 128
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      AddPath ID: RX 2, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:24:41 2025
router-vm> show bgp ipv4 vpn prefix 192.168.8.0/24
BGP routing table entry for 1:11:192.168.8.0/24, version 9
not allocated
Paths: (2 available, best #2)
  Advertised to non peer-group peers:
  2001::1
  65500
    0.0.0.0 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, multipath
      Extended Community: RT:55:55
      Remote label: 200
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:24:41 2025
  65500
    0.0.0.0 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, multipath, best (Nothing left to compare)
      Extended Community: RT:55:55
      Remote label: 64
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      AddPath ID: RX 2, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:24:41 2025

In order to process SRv6, the router device must also be configured with srv6. No IGP has been used in that configuration, and the locator network must be distributed between both devices either via BGP or by using static routing. As the SIDs values advertised by dut are obtained in the loc1 prefix, the router device will need to check the reachability before considering the srv6 VPN path. Also the mpls-enabled command is enabled on the default L3VRF in order to also consider imported MPLS prefixes.

router

router-vm running config# / vrf main routing segment-routing ipv6 locator loc1 prefix 2001:db8:2:2::/64 block-length 40 node-length 24 function-length 16
router-vm running config# / vrf main routing bgp segment-routing ipv6 locator loc1
router-vm running config# / vrf main routing bgp segment-routing ipv6 mpls-enabled true
router-vm running config# / vrf main routing static ipv6-route 2001:db8:1:1::/64 next-hop 2001::1

BGP SRv6 and MPLS route-map filtering tools

Receiving both prefixes for a device is interesting in a migration plan where MPLS is replaced by SRv6 dataplane. For instance, one can imagine a two-step procedure where the MPLS route is first chosen. The below route-map configuration helps in filtering out SRv6 updates when importing BGP paths to the l3vrf1 L3VRF.

router

router-vm running config# / routing route-map rmap seq 10 policy deny
router-vm running config# / routing route-map rmap seq 10 match vpn encapsulation srv6
router-vm running config# / routing route-map rmap seq 20 policy permit
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv4-unicast l3vpn import route-map rmap
router-vm running config# / vrf main l3vrf l3vrf1 routing bgp address-family ipv6-unicast l3vpn import route-map rmap

The below output shows only the 2 MPLS prefixes are imported by router on the l3vrf1 L3VRF.

router

router-vm> show bgp l3vrf l3vrf1 ipv6 unicast prefix 2001:8::/64
BGP routing table entry for 2001:8::/64, version 11
Paths: (1 available, best #1, l3vrf l3vrf1)
  Not advertised to any peer
  Imported from 1:10:2001:8::/64
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 0, valid, sourced, local, best (First path received)
      Extended Community: RT:55:55
      Remote label: 300
      Last update: Fri Nov 14 18:26:23 2025
router-vm> show bgp l3vrf l3vrf1 ipv4 unicast prefix 192.168.8.0/24
BGP routing table entry for 192.168.8.0/24, version 11
Paths: (1 available, best #1, l3vrf l3vrf1)
  Not advertised to any peer
  Imported from 1:11:192.168.8.0/24
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 0, valid, sourced, local, best (First path received)
      Extended Community: RT:55:55
      Remote label: 200
      Last update: Fri Nov 14 18:26:23 2025

Secondly, the route-map could be modified in order to filter out MPLS updates, like the below configuration suggests. Note that additional match criteria can be used to add granularity to a specific L3VRF, such as matching a specific subnet…

router

router-vm running config# / routing route-map rmap seq 10 match vpn encapsulation mpls

As an alternative to configure the receiving router, the decision can be done on the dut device by configuring an outgoing route-map that modifies the BGP paths. In an iBGP peering, the local-preference keyword can be used. On eBGP peering, the metric value can be modified. After having removed the route-map from the router device, the below dut configuration uses an outgoing route-map to set a bigger metric on SRv6 path.

dut

dut-vm running config# / routing route-map rmap seq 10 policy permit
dut-vm running config# / routing route-map rmap seq 10 match vpn encapsulation srv6
dut-vm running config# / routing route-map rmap seq 10 set metric 10
dut-vm running config# / routing route-map rmap seq 20 policy permit
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-vpn route-map out route-map-name rmap
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv6-vpn route-map out route-map-name rmap

As expected, the two BGP paths are received on the router, imported on the l3vrf1 L3VRF, and because of the bigger metric, only the MPLS path is selected.

router

router-vm> show bgp l3vrf l3vrf1 ipv6 unicast prefix 2001:8::/64
BGP routing table entry for 2001:8::/64, version 15
Paths: (2 available, best #1, l3vrf l3vrf1)
  Not advertised to any peer
  Imported from 1:10:2001:8::/64
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 0, valid, sourced, local, best (MED)
      Extended Community: RT:55:55
      Remote label: 300
      Last update: Fri Nov 14 18:29:38 2025
  Imported from 1:10:2001:8::/64
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 10, valid, sourced, local
      Extended Community: RT:55:55
      Remote label: 128
      Remote SID: 2001:db8:1:1::
      Last update: Fri Nov 14 18:30:01 2025
router-vm> show bgp l3vrf l3vrf1 ipv4 unicast prefix 192.168.8.0/24
BGP routing table entry for 192.168.8.0/24, version 15
Paths: (2 available, best #1, l3vrf l3vrf1)
  Not advertised to any peer
  Imported from 1:11:192.168.8.0/24
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 0, valid, sourced, local, best (MED)
      Extended Community: RT:55:55
      Remote label: 200
      Last update: Fri Nov 14 18:29:38 2025
  Imported from 1:11:192.168.8.0/24
  65500
    2001::1 from :: (192.0.2.2) l3vrf default(0) announce-nh-self
      Origin incomplete, metric 10, valid, sourced, local
      Extended Community: RT:55:55
      Remote label: 64
      Remote SID: 2001:db8:1:1::
      Last update: Fri Nov 14 18:30:01 2025

Ultimately, the update of the metric for the SRv6 path will permit router to remove the MPLS installed paths.

BGP SRv6 and MPLS neighbor commands

It may also be desirable to split the advertisements in two. In order to get more clarity, some migration scenarios require to dedicate some devices for MPLS, and others for SRv6. For instance, having two route reflectors respectively providing SRv6 and MPLS services can be useful to disconnect progressively the existing deployed machines from MPLS to SRv6.

In order to send either MPLS or SRv6 updates, a per-peer configuration command is available. To send MPLS only updates from dut to router device, use the following command:

dut

dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-vpn encapsulation mpls
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv6-vpn encapsulation mpls

Consequently, only the MPLS prefixes will be sent to the router device.

router

router-vm> show bgp ipv6 vpn prefix 2001:8::/64
BGP routing table entry for 1:10:2001:8::/64, version 10
not allocated
Paths: (1 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    2001::1 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 300
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:32:48 2025
router-vm> show bgp ipv4 vpn prefix 192.168.8.0/24
BGP routing table entry for 1:11:192.168.8.0/24, version 10
not allocated
Paths: (1 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    0.0.0.0 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 200
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:32:48 2025

Note that the same command can be used at reception side on router to always consider valid the chosen dataplane. After removing the encapsulation mpls command on dut side, the following is applied to router:

dut

dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv4-vpn encapsulation mpls-and-srv6
dut-vm running config# / vrf main routing bgp neighbor 2001::2 address-family ipv6-vpn encapsulation mpls-and-srv6

router

router-vm running config# / vrf main routing bgp neighbor 2001::1 address-family ipv4-vpn encapsulation srv6
router-vm running config# / vrf main routing bgp neighbor 2001::1 address-family ipv6-vpn encapsulation srv6

Effectively, the two prefixes are present on router and the srv6 prefix has been correctly selected. The MPLS prefixes are considered as invalid.

router

router-vm> show bgp ipv6 vpn prefix 2001:8::/64
BGP routing table entry for 1:10:2001:8::/64, version 11
not allocated
Paths: (2 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    2001::1 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 10, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 128
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      AddPath ID: RX 2, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:35:34 2025
  65500
    2001::1 (inaccessible, import-check enabled) from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, invalid, external
      Extended Community: RT:55:55
      Remote label: 300
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:35:34 2025
router-vm> show bgp ipv4 vpn prefix 192.168.8.0/24
BGP routing table entry for 1:11:192.168.8.0/24, version 11
not allocated
Paths: (2 available, best #1)
  Advertised to non peer-group peers:
  2001::1
  65500
    0.0.0.0 from 2001::1 (192.0.2.1)
      Origin incomplete, metric 10, valid, external, best (First path received)
      Extended Community: RT:55:55
      Remote label: 64
      Remote SID: 2001:db8:1:1::, sid structure=[40 24 16 0 16 64]
      AddPath ID: RX 2, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:35:34 2025
  65500
    0.0.0.0 (inaccessible, import-check enabled) from 2001::1 (192.0.2.1)
      Origin incomplete, metric 0, invalid, external
      Extended Community: RT:55:55
      Remote label: 200
      AddPath ID: RX 3, TX-All 0 TX-Best-Per-AS 0 TX-Best-Selected 0
      Last update: Fri Nov 14 18:35:34 2025