HPE FlexNetwork MSR958X_2003X Routers Comware 9 Segment Routing Configuration Guide
বিজ্ঞাপন
বিজ্ঞাপন
HPE FlexNetwork MSR958X_2003XRouters
Comware 9 Segment Routing Configuration Guide
Software version: CMW910-R9119
Document version: 6W100-20221201
© Copyright 2022 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
Contents
Configuring SR-MPLS ··················································································· 1
i
Configuring SRv6······················································································· 112
ii
Configuring SRv6 TE policies ···································································· 154
iii
iv
Configuring IP L3VPN over SRv6 ······························································ 223
Configuring EVPN L3VPN over SRv6 ························································ 245
v
Configuring EVPN VPWS over SRv6 ························································· 266
Configuring EVPN VPLS over SRv6 ·························································· 287
vi
Configuring distributed SRv6 gateways ····················································· 306
Configuring IP public network over SRv6 ··················································· 323
vii
Configuring SRv6 OAM ············································································· 336
Configuring SRv6 service chains ······························································· 346
Document conventions and icons ······························································ 397
Support and other resources ····································································· 399
viii
Index ·········································································································· 402
ix
Configuring SR-MPLS
About SR-MPLS
Segment Routing (SR) is a source routing technology. The source node selects a path for the packets, and then encodes the path in the packet header as an ordered list of segments. Each segment is identified by a label called the segment identifier (SID). The SR nodes along the path forward the packets based on the SIDs in the packets. Only the source node needs to maintain the path status.
SR can operate with MPLS. In an MPLS network, SR uses MPLS labels as SIDs to forward packets on an LSP.
SR-MPLS characteristics
SR-MPLS has the following characteristics:
•
SR-MPLS forwards packets based on the existing MPLS infrastructure. No infrastructure modifications are needed to implement SR on an MPLS network. For more information about the MPLS infrastructure, see MPLS basics configuration in MPLS Configuration Guide .
•
SR-MPLS expands and optimizes existing IGPs and BGP and uses the IGPs and BGP to distribute labels.
•
SR-MPLS implements network features such as MPLS TE in a simpler way, eliminating issues such as heavy and complicated routing protocol deployment.
Basic concepts
•
SR node —A node enabled with the SR-MPLS feature. The ingress node (source node) adds labels to packets. The transit nodes forward packets based on labels. The egress node
(endpoint node) removes labels and forwards packets to the destination networks. SR nodes form an SR domain.
•
Segment —An instruction an SR node executes on the incoming packet.
•
SID —Segment ID, which is MPLS label in SR-MPLS.
•
Segment type —The following types of segments are available:
Prefix segment —SIDs are assigned to nodes based on destination address prefix. The nodes create prefix-specific forwarding entries.
Adjacency segment —SIDs are assigned to nodes based on adjacency.
•
SRLSP —Segment routing label switched path, an LSP along which SR uses MPLS labels as
SIDs to forward packets.
•
SRGB —Segment routing global block, a range of global labels dedicated for SR-MPLS prefix
SIDs. Different nodes can have different SRGBs. The minimum label value of an SRGB label range is referred to as the base value of the SRGB.
•
SRLB —Segment routing local block, a range of local labels dedicated for SR-MPLS adjacency
SIDs. All nodes share the same SRLB. The minimum label value of the SRLB label range is referred to as the base value of the SRLB.
How SR-MPLS works
SR-MPLS involves the following steps:
1
1. Label allocation for all nodes and links along the packet forwarding paths.
The following methods are available:
Dynamic SID allocation through an IGP
2.
Label forwarding entry installation based on SIDs . All SR-MPLS devices in the SR domain use
the allocated labels to create label forwarding entries.
3.
SRLSP setup . You can manually configure SRLSPs, or use an IGP, BGP, or a controller to
dynamically create SRLSPs.
When the ingress node of an SRLSP receives a packet, it adds labels to the packet and forwards the packet to the egress node through the SRLSP. After receiving a packet from the SRLSP, the egress node removes the label and forwards the packet based on the routing table.
You can bind a higher layer application (for example, MPLS TE) to an SRLSP to forward traffic of the application through the SRLSP..
Static segment configuration
Static SR-MPLS provides the following methods for configuring static segments for a destination:
•
Prefix segment method —Manually configure the incoming label, outgoing label, and next hop for the destination address prefix on each SR node.
•
Adjacency segment method —Manually configure the incoming label and next hop for the adjacency to the neighbor on each SR node.
Dynamic SID allocation through an IGP
SR-MPLS expands IGP protocols such as IS-IS and OSPF to advertise SIDs in IGP protocol packets.
SR-MPLS provides the following methods for dynamically allocating and advertising SIDs:
•
Prefix SID.
•
Adjacency SID.
Prefix SID
After you configure an SID for the loopback address on each SR node, the SIDs uniquely identify the
SR nodes. All SR nodes in the SR domain use an IGP to advertise their own prefix SIDs. After receiving advertised prefix SIDs, each SR node calculates the prefix SIDs to the advertisers.
The prefix SID advertisement can be one of the following types:
•
Absolute value advertisement —Each SR node advertises the prefix SID absolute value and the SRGB.
•
Index value advertisement —Each SR node advertises the prefix SID index and the SRGB.
Each SR node is assigned a globally unique index value for the node's prefix. The prefix SID an SR node allocates to a prefix equals the SRGB base of the SR node plus the index for that prefix.
NOTE:
The device supports only the index value advertisement in the current software release.
Adjacency SID
SR nodes use an IGP to advertise SIDs allocated to the IGP adjacencies (that is, the links to its IGP neighbors). The SIDs are used to identify the links.
The adjacency SIDs can be allocated automatically or manually.
2
•
Automatic adjacency SID allocation —SR nodes allocate labels in SRLBs to the IGP adjacencies as SIDs.
•
Manual adjacency SID allocation —You can assign adjacency SID by using absolute values or index values. If you use index values, the adjacency SID of a link is the base value of the
SRLB plus the index value for the link.
Dynamic SID allocation through BGP
SR-MPLS expands BGP to advertise prefix SIDs in BGP protocol packets. BGP uses routing policies to assign SIDs to prefixes when redistributing routes. The SIDs uniquely identify the SR nodes. All
SR nodes in the SR domain use BGP to advertise their own prefix SIDs, including the SIDs and SID index values. From received advertisement packets, each SR node derives the prefix SIDs for the advertisers.
BGP prefix SIDs can be exchanged between BGP peers only through IPv4 unicast routes.
Dynamic SID allocation through BGP applies to MPLS VPN inter-AS option C networks.
SID allocation through BGP EPE
The BGP Egress Peer Engineering (BGP EPE) feature assigns BGP peering SIDs to segments across ASs. The device sends BGP peering SIDs to the controller through BGP-LS extensions. The controller orchestrates IGP SIDs and BGP peering SIDs for inter-AS forwarding over optimal paths.
You can manually specify the BGP peering SIDs to be assigned to the BGP peers or peer groups or let the device randomly assign these SIDs.
BGP EPE supports the following types of BGP peering SIDs:
•
Peer-Node-SID —Identifies a peer node. Each BGP session is assigned a Peer-Node-SID. An
EBGP peer session established based on a loopback interface might use multiple physical links.
The Peer-Node-SID for the EBGP peer therefore might have multiple outgoing interfaces. The device will load-share traffic among these outgoing interfaces when it forwards the traffic based on the Peer-Node-SID.
•
Peer-Adj-SID —Identifies an adjacency to a peer. An EBGP peer session established based on a loopback interface might use multiple physical links. Each physical link will be assigned a
Peer-Adj-SID. The device forwards traffic through a specific outgoing interface when it forwards the traffic based on a Peer-Adj-SID.
•
Peer-Node-Adj-SID —Identifies a peer node or one or multiple adjacencies to a peer.
•
Peer-Set-SID —Identifies a set of peers. BGP EPE supports adding a group of peers to a set and assigning the set a Peer-Set-SID. The device will load-share traffic among the peers in the set when it forwards the traffic based on a Peer-Set-SID. A Peer-Set-SID identifies the set of which Peer-Node-SIDs or Peer-Adj-SIDs are members.
3
Figure 1 BGP EPE diagram
PE 1 Loop1
AS 100
BGP EPE
ASBR 1
18001
PeerAdj SID
PeerAdj SID
18002
28001
ASBR 3
PeerNode SID
PeerNode
SID
28002
PeerNode
SID
28003
ASBR 4
PE 2
ASBR 2
PeerNode
SID
28004
PeerSet SID
29001 ASBR 5
Loop1
AS 200
AS 300
PE 3
PE 4
BGP EPE
As shown in Figure 1 , BGP EPE allocates SID labels as follows:
•
ASBR 1 and ASBR 3 are directly connected through two physical links. The two ASBRs establish an EBGP peer relationship with each other through loopback interfaces. BGP EPE assigns Peer-Node-SID 28001 to the peer node and assigns Peer-Adj-SIDs 18001 and 18002 to the two physical links. Traffic between the two ASBRs will be load-shared on the two physical links when it is forwarded based on the Peer-Node-SID.
•
An EBGP peer relationship is established over a physical link between ASBR 1 and ASBR 5,
ASBR 2 and ASBR 4, and ASBR 2 and ASBR 5. BGP EPE only assigns labels
(Peer-Node-SIDs 28002, 28003, and 28004) to the peer nodes.
•
ASBR 4 and ASBR 5 both establish an EBGP peer relationship with ASBR 2. BGP EPE adds
ASBR 4 and ASBR 5 to a BGP EPE peer set and assigns the set Peer-Set-SID 29001. Traffic will be sent to the devices in the peer set for load sharing when it is forwarded based on the
Peer-Set-SID.
SIDs that BGP EPE assigns are locally significant. These SIDs are not advertised to other devices and are not affected by route types exchanged between BGP peers.
SID allocation through BGP EPE is typically used for MPLS VPN inter-AS option B.
Label forwarding entry installation based on SIDs
Label forwarding entry installation based on IGP prefix SIDs
Label forwarding entries based on prefix SIDs can be static or dynamic.
•
Static label forwarding entries —The device creates local label forwarding entries based on manually configured incoming labels, outgoing labels, and next hops.
•
Dynamic label forwarding entries —The device uses the IGP to flood in the SR domain the local SRGB and the index of the prefix SID for the local loopback interface. Based on the flooded information, the other devices in the domain calculates their local label forwarding entries by using the following rules:
Incoming label = Local SRGB base value + Index
Outgoing label = SRGB base value of the next hop + Index
4
Figure 2 Creating label forwarding entries based on IGP prefix SIDs
In Label
16201
Nexthop
Device B
Out Label
16201
In Label
16201
Nexthop
Device C
Out Label
16201
In Label
16201
.1
/32
.1
.1
0
201
Device A
SRGB Base
16000
Range
1000
Device B
SRGB Base
16000
Range
1000
Device C
SRGB Base
16000
Range
1000
shows how dynamic label forwarding entries are created. After you assign index value 201 to loopback address 1.1.1.1/32 on Device C, Device C uses an IGP packet to advertise the index value and its local SRGB. Then, the devices calculate incoming and outgoing labels according to the previously mentioned label calculation rules.
•
Devices C calculates its incoming label, which is 16201.
•
Device B calculates its incoming label and outgoing label and creates a label forwarding entry.
The incoming label is 16201. The outgoing label is 16201. The next hop is Device C.
•
Device A calculates its incoming label and outgoing label and creates a label forwarding entry.
The incoming label is 16201. The outgoing label is 16201. The next hop is Device B.
Label forwarding entry installation based on BGP prefix SIDs
The device redistributes routes to BGP and assigns prefix SIDs to redistributed routes based on routing policies. Then, the device uses BGP to flood in the SR domain the prefix SIDs and the indexes of the prefix SIDs. Based on the flooded information, the other devices in the domain calculates their local label forwarding entries by using the following rules:
•
Incoming label = Local SRGB base value + Index
•
Outgoing label = Received SID
Figure 3 Creating label forwarding entries based on BGP prefix SIDs
In Label
16201
Nexthop
Device C
Out Label
16201 In Label
16201
In Label
16201
Nexthop
Device B
Out Label
16201
In Label
16201
Nexthop
Device D
Out Label
16201
AS 100 AS 200
IBGP EBGP IBGP
.1
/32
.1
.1
0
201
SRGB Base
16000
Device A
Range
8000
SRGB Base
16000
Device B
Range
8000
Device C
SRGB Base
16000
Range
8000
Device D
SRGB Base
16000
Range
8000
shows how label forwarding entries are created. After you assign index value 201 to loopback address 1.1.1.1/32 on Device D, Device D redistributes the route of the address and assigns it an SID (16201 in this example). Then, the device uses a BGP packet to advertise the SID and index value. The devices in the SR domain calculate incoming and outgoing labels according to the previously mentioned label calculation rules and create label forwarding entries.
•
Devices D calculates its incoming label, which is 16201.
•
Device C calculates its incoming label and outgoing label and creates a label forwarding entry.
The incoming label is 16201. The outgoing label is 16201. The next hop is Device D.
5
•
Device B calculates its incoming label and outgoing label and creates a label forwarding entry.
The incoming label is 16201. The outgoing label is 16201. The next hop is Device C.
•
Device A calculates its incoming label and outgoing label and creates a label forwarding entry.
The incoming label is 16201. The outgoing label is 16201. The next hop is Device B.
Label forwarding entry installation based on BGP EPE
Configure BGP EPE on border routers to assign SIDs to specific peers or peer groups.
Figure 4 Creating label forwarding entries by using BGP EPE
AS 100
In Label
5000
Nexthop
Device C IBGP
AS 200
Device C
EBGP
Device A
IBGP
Device B
EBGP
Device E
In Label
6000
Nexthop
Device D
IBGP
Device D
As shown in Figure 4 , you can configure BGP EPE on Device B to assign BGP peering SIDs to
EBGP neighbors Device C and Device D. BGP peering SIDs are locally significant and are not advertised to neighbors.
Label forwarding entry installation based on adjacency SIDs
When using adjacency SIDs, each device allocates a static or dynamic incoming label to the link to its neighbor. The label has local significance. Multiple devices can use the same adjacency SID.
Figure 5 Creating label forwarding entries based on adjacency SIDs
In Label
203
Nexthop
Device B
In Label
202
Nexthop
Device C
In Label
201
Nexthop
Device D
Device A Device B Device C Device D
As shown in Figure 5 , the devices are running the same IGP. After IGP adjacencies are established
between the devices, Device A, Device B, and Device C allocates labels and creates label forwarding entries as follows:
•
Device A allocates label 203 to the link to its neighbor Device B.
•
Device B allocates label 202 to the link to its neighbor Device C.
•
Device C allocates label 201 to the link to its neighbor Device D.
•
Device A creates a label forwarding entry with incoming label 203 and next hop Device B.
•
Device B creates a label forwarding entry with incoming label 202 and next hop Device C.
•
Device C creates a label forwarding entry with incoming label 201 and next hop Device D.
SRLSP setup
You can use the following methods to create SRLSPs:
•
Manually configure an SRLSP.
6
To configure an SRLSP, you must specify the label stack for packets to be forwarded along the
SRLSP on the ingress node. Each label in the stack corresponds to a prefix SID or adjacency
SID. The system can look for the outgoing label and next hop based on the prefix SID or adjacency SID.
•
Configure SR nodes to use BGP or an IGP to dynamically establish an SRLSP.
SR nodes follow these steps to establish SRLSPs: a. Use BGP or an IGP to collect prefix SID information from the SR-MPLS network. b. Calculate the shortest paths to other SR nodes based on the collected prefix SID information and the BGP or IGP network topology. c. Establish SRLSPs based on the shortest paths.
•
Configure a controller to deploy SRLSP configuration to the device so the device creates
SRLSPs.
For more information about controller configuration, see the user guide for the controller.
Packet forwarding in SR-MPLS
Based on the SID allocation method, SR-MPLS uses one of the following packet forwarding methods:
•
Prefix SID-based packet forwarding —The ingress node encapsulates the prefix SID for the egress node to a packet. The transit nodes forward the packet based on label forwarding entries.
•
Adjacency SID-based packet forwarding —The ingress node encapsulates the label stack that contains the adjacency SIDs of all links along the forwarding path to a packet. Each transit node uses the top label in the label stack to determine the next hop and pops the top label before forwarding the packet to the next hop.
•
Prefix and adjacency SID-based packet forwarding —The nodes use prefix SID-based packet forwarding in combination with adjacency-based packet forwarding.
Prefix SID-based packet forwarding within the same AS
shows how a packet is forwarded along the SRLSP from Device A to Device E based on prefix SIDs. In this example, the outgoing label for the packet is 16201 on Device A.
1. Ingress node Device A searches for a forwarding entry for label 16201, adds outgoing label
16201 to the packet and sends the packet to the next hop (Device B).
2. When transit node Device B receives the packet, it searches for a label forwarding entry that matches the label in the packet. Then, Device B uses the outgoing label of the matched entry
(16201) to replace the label in the packet and forwards the packet to the next hop (Device C).
3. Transit nodes Device C and Device D process the packet in the same way Device B does.
4. When egress node Device E receives the packet, it removes the label and forwards the packet by IP address.
7
Figure 6 Prefix SID-based packet forwarding within the same AS
SRGB: 16000-17000
16201
IP data
16201
IP data
16201
IP data
16201
IP data
In Label
16201
Device A
Nexthop
Device B
Out Label
16201
Device B
In Label
16201
Device C
Nexthop
Device D
Out Label
16201
Device D Device E
In Label
16201
In Label
16201
Nexthop
Device C
Out Label
16201
In Label
16201
Nexthop
Device E
Out Label
16201
Prefix SID-based packet forwarding across ASs
shows how a packet is forwarded along the SRLSP from Device A to Device D based on prefix SIDs. In this example, the outgoing label for the packet is 16201 on Device A.
1. Ingress node Device A searches for a forwarding entry for label 16201, adds outgoing label
16201 to the packet, and sends the packet to the next hop (Device B).
2. When transit node Device B receives the packet, it searches for a label forwarding entry that matches the label in the packet (16201). Then, Device B uses the outgoing label of the matched entry (16201) to replace the label in the packet and forwards the packet to the next hop (Device
C).
3. Transit nodes Device C processes the packet in the same way Device B does.
4. When egress node Device D receives the packet, it removes the label and forwards the packet by IP address.
Figure 7 Prefix SID-based packet forwarding across ASs
AS 100 AS 200
16201
IP data
16201
IP data
16201
IP data
In Label
16201
IBGP
Device A
Nexthop
Device B
Out Label
16201
In Label
16201
Device B
Nexthop
Device C
EBGP
In Label
16201
Out Label
16201
Device C
Nexthop
Device D
IBGP
Out Label
16201
Device D
In Label
16201
BGP EPE-based packet forwarding across ASs
As shown in Figure 8 , you can configure BGP EPE and an SRLSP used for the MPLS TE tunnel on
Device B to steer packets to travel through Device C or Device D to Device E. In this example, packets travel from Device A through Device B and Device D to Device E. Device B uses BGP EPE to assign SID 6000 to Device D. A static SRLSP is established between Device B and Device D for the MPLS TE tunnel and Device B also assigns SID 6000 to the SRLSP.
1. Within AS 100, source node Device A adds label 16204 to the packet according to the SRLSP, and sends the packet to Device B.
2. When Device B receives the packet, it searches for a label forwarding entry and finds that it should forward the packet through the MPLS TE tunnel. Then, Device B removes label 16204 from the packet, and forwards the packet through the MPLS TE tunnel to Device D.
8
3. Within AS 200, Device D searches for a label forwarding entry based on the SRLSP, adds label
16201 to the packet, and sends the packet to Device E.
4. When egress node Device E receives the packet, it removes label 16201 and forwards the packet by IP address.
Figure 8 BGP EPE-based packet forwarding across ASs
AS 100
In Label
5000
Nexthop
Device C
EBGP
Device C
IBGP
AS 200
IBGP
EBGP
Device A Device B Device E
In Label
6000
Nexthop
Device D
IBGP
16204
IP data
IP data
Device D
16201
IP data
Adjacency SID-based packet forwarding
shows how a packet is forwarded along the SRLSP from Device A to Device E based on adjacency SIDs. In this example, the label stack for the packet is configured as (200, 201, 202, and
203) on Device A.
1. Ingress node Device A searches for a forwarding entry for the top label (200) to determine the next hop. Then, Device A adds label stack (201, 202, and 203) to the packet, and forwards the packet to the next hop (Device B).
2. When transit node Device B receives the packet, it searches for a forwarding entry for the top label (201) to determine the next hop. Then, Device B removes the top label from the stack and forwards the packet to the next hop (Device C).
3. When transit node Device C receives the packet, it searches for a forwarding entry for the top label (202) to determine the next hop. Then, Device C removes the top label from the stack and forwards the packet to the next hop (Device D).
4. When transit node Device D receives the packet, it searches for a forwarding entry for the label
(203) to determine the next hop. Then, Device D removes the label stack from the packet and forwards the packet to the next hop (Device E).
5. When egress node Device E receives the packet, it forwards the packet by IP address.
Figure 9 Adjacency SID-based packet forwarding
201
202
203
IP data
202
203
IP data
203
IP data IP data
Device A
In Label
200
Nexthop
Device B
Device B
In Label
201
Nexthop
Device C
Device C
In Label
202
Nexthop
Device D
Device D
In Label
203
Nexthop
Device E
Device E
9
Prefix and adjacency SID-based packet forwarding
shows how a packet is forwarded along the SRLSP from Device A to Device E based on prefix SIDs and adjacency SIDs. In this example, the index value for the prefix SID of Device C is 1.
The prefix SIDs for Device A, Device B, and Device C are all 16001. The Adjacency SIDs that Device
C and Device D allocate to the adjacencies are 16 and 17, respectively. On Device A, the label stack for the packet is (16001, 16, 17).
1. Ingress node Device A searches for a forwarding entry for label 16001 to determine the outgoing label (16001) and next hop (Device B). Device A adds label stack (16001, 16, 17) to the packet and sends the packet to the next hop (Device B).
2. When transit node Device B receives the packet, it searches for a label forwarding entry that matches the top label in the label stack (16001). Then, Device B uses the outgoing label of the matched entry (16001) to replace the top label and forwards the packet to the next hop (Device
C).
3. When transit node Device C receives the packet, it removes the top label 16001 and searches for a forwarding entry for the next label (16) to determine the next hop. Then, Device C removes label 16 from the stack and forwards the packet to the next hop (Device D).
4. When transit node Device D receives the packet, it searches for a forwarding entry for the label
(17) to determine the next hop. Then, Device D removes the label stack from the packet and forwards the packet to the next hop (Device E).
5. When egress node Device E receives the packet, it forwards the packet by IP address.
Figure 10 Prefix and adjacency SID-based packet forwarding
16001
16
17
IP data
16001
16
17
IP data
17
IP data IP data
Device E
In Label
16001
Device A
Nexthop
Device B
Out Label
16001
Device B
In Label
16001
Nexthop
Device C
Out Label
16001
Device C
In Label
16001
In Label
17
Device D
Nexthop
Device E
In Label
16
Nexthop
Device D
MPLS SR and LDP interworking
IGP SR and LDP interworking enables SR-MPLS networks that use an IGP for SID advertisement to communicate and cooperate with MPLS LDP networks.
IGP SR and LDP interworking supports the following modes:
•
SR to LDP —Maps prefixes on an LDP network to SR-MPLS SIDs to forward traffic from an
SR-MPLS network to an MPLS LDP network.
•
LDP to SR —Uses an IGP protocol to advertise SIDs and associates SIDs with LDP labels to forward traffic from an MPLS LDP network to an SR-MPLS network.
•
SR over LDP —Enables SR-MPLS networks to communicate through an LDP network.
SR to LDP
The SR to LDP mode defines the following roles:
•
Segment Routing Mapping Server (SRMS) —Advertises prefix-SID mappings on behalf of
SR-incapable devices (LDP devices). You must configure prefix-SID mappings on the SRMS.
10
•
Segment Routing Mapping Client (SRMC) —Receives prefix-SID mappings advertised by the
SRMS and creates SR-MPLS label forwarding entries.
As shown in Figure 11 , Device A and Device B are running SR-MPLS, and Device B, Device C, and
Device D are running LDP. After Device D assigns a label for destination address 3.3.3.3/32, Device
B and Device C each install an LDP label forwarding entry.
The following steps establish a mapping between the SRLSP and the LDP LSP:
1. Device B acts as an SRMS. It assigns SID index value 201 to the IP address of loopback interface 0 on Device D (3.3.3.3/32), and then advertises an IP prefix-SID mapping TLV to
Device A.
2. Device A acts as an SRMC. After receiving the advertised mapping TLV, it creates an
SR-MPLS label forwarding entry.
A mapping is established between the SRLSP and the LDP LSP.
Figure 11 SR to LDP packet forwarding
IP data
16201
IP data
16201
IP data
SR
20
IP data
LDP
IP data
Type
SR
Device A
SRMC
In Label
16201
Out Label
16201
Device B
SRMS
Type
LDP
Device C
In Label
20
Out Label
-
Device D
Type
SR
LDP
In Label
16201
-
Out Label
-
20
If Device A uses an SRLSP to send a packet to Device D, the packet is forwarded as follows:
3. Ingress node Device A adds label 16201 to the packet and then sends the packet to transit node Device B.
4. When transit node Device B receives the packet, it searches for a label forwarding entry that matches incoming label 16201. Because the entry does not have an outgoing label, Device B searches for a valid LDP outgoing label for destination address 3.3.3.3/32. Then, Device B adds the LDP label (20) to the packet as the SR outgoing label and forwards the packet to the next hop (Device C).
5. When transit node Device C receives the packet, it searches for an LDP label forwarding entry for incoming label 20. Then, it removes the label from the packet and forwards the packet to egress node Device D.
6. The egress node forwards the packet by IP address.
LDP to SR
As shown in Figure 12 , Device C and Device D are running SR-MPLS, and Device A, Device B, and
Device C are running LDP. Each device running LDP assigns a label to destination address
3.3.3.3/32 and then installs an LDP label forwarding entry.
The following steps establish an association between the SR-MPLS label and the LDP label:
11
1. After you assign SID index value 201 to the IP address of loopback interface 0 on Device D
(3.3.3.3/32), Device D sends an IGP protocol packet to advertise the index value and the local
SRGB.
2. After receiving the packet, Device C creates an SR-MPLS label forwarding entry.
The SR-MPLS label and the LDP label are associated on Device C.
Figure 12 LDP to SR packet forwarding
IP data
20
IP data
30
IP data
16201
IP data
LDP SR
Device A
Type
LDP
Device B
In Label
20
Out Label
30
Device C
Type
SR
Device D
In Label
16201
Type
LDP
In Label
-
Out Label
20
Type
SR
LDP
In Label
16201
30
Out Label
16201
-
A packet from Device A to Device D is forwarded as follows:
3. Ingress node Device A adds an LDP label (20) to the packet and forwards the packets to the next hop (Device B).
4. Device B searches for an LDP label forwarding entry, uses 30 as the outgoing label, and forwards the packet to the next hop (Device C).
5. Device C searches for an LDP label forwarding entry for incoming label 30 and finds no outgoing label. Because valid SR-MPLS outgoing label 16201 exists for the destination address
3.3.3.3.32, Device C uses the label (16201) as the outgoing label and forwards the packet to
Device D.
6. Egress node Device D deletes label 16201 from the packet and forwards the packet by IP address.
SR over LDP
For SR-MPLS networks to communicate across an LDP network, the SR/LDP border devices must be able to connect the SR LSP and the LDP LSP as follows:
•
SR-MPLS to LDP interworking —The border device installs SR-to-LDP label forwarding entries. For a packet from the SR-MPLS network to the LDP network, the SR-MPLS label forwarding entry on the border device does not have an outgoing label. The border device uses the outgoing label of the LDP label forwarding entry for the same destination address as the outgoing label of the packet.
•
LDP to SR-MPLS interworking —The border device installs LDP-to-SR label forwarding entries. For a packet from the LDP network to the SR-MPLS network, the LDP forwarding entry on the border device does not have an outgoing label. The border device must use the outgoing label of the SR-MPLS forwarding entry for the same destination address as the outgoing label of the packet.
12
Figure 13 SR-MPLS over LDP
16201
IP data
SR
20
IP data
LDP
30
IP data
16201
IP data
SR
Type
SR
Device A
In Label
16201
Out Label
16201
Device B
Type
LDP
Device C
In Label
20
Out Label
30
Device D
Type
SR
Device E
In Label
16201
Type
SR
LDP
In Label
16201
-
Out Label
-
20
Type
SR
LDP
In Label
16201
30
Out Label
16201
-
As shown in Figure 13 , Device A, Device B, Device D, and Device E are running SR-MPLS. After you
assign index value 201 to loopback interface address 3.3.3.3/32 on Device E, Device E will advertise the index value and the local SRGB. After Device A, Device B, and Device D receive the message, they will install their respective SR-MPLS label forwarding entries. Device B, Device C, and Device D are running LDP. They allocate labels to destination address 3.3.3.3/32 to generate the LDP label forwarding entries.
A packet that Device A sends to Device E will be forwarded as follows:
1. Ingress node Device A encapsulates label 16201 to the packet and forwards the packet to transit node Device B.
2. Transit node Device B searches for an SR-MPLS label forwarding entry for incoming label
16201 and finds that the entry does not have an outgoing label. Because an LDP label forwarding entry with outgoing label 20 exists for the destination address (3.3.3.3/32), Device B encapsulates outgoing label 20 in the packet. Then Device B sends the packet to transit node
Device C.
3. Device C forwards the packet to Device D based on its LDP label forwarding entries. The outgoing label is 30.
4. Device D searches for an LDP label forwarding entry for incoming label 30 and finds that the entry does not have an outgoing label. Because an SR-MPLS label forwarding entry with outgoing label 16201 exists for the destination address (3.3.3.3/32), Device B encapsulates outgoing label 16201 in the packet. Then Device D sends the packet to egress node Device E.
5. Egress node Device E deletes the incoming label and forwards the packet by IP address.
TI-LFA FRR
Topology-Independent Loop-Free Alternate Fast Re-Route (TI-LFA FRR) provides link and node protection. When a link or node fails, TI-LFA FRR switches the traffic to the backup path to ensure continuous data forwarding.
TI-LFA FRR advantages
SR-based TI-LFA FRR has the following advantages:
•
It satisfies the basic requirements for IP FRR fast convergence.
•
Traffic protection is not affected by the network environment.
•
The algorithm is not too complicated.
•
It uses the converged route as the backup path. All devices have finished route convergence before the forward process begins.
13
TI-LFA FRR concepts
•
P space —Use the source node of the protected link as the root to establish a shortest path tree.
All nodes that are reachable from the source node without passing the protected link form the P space. Nodes in the P space are called P nodes.
•
Extended P space —Use the source node of the protected link and its neighbors as the roots to establish shortest path trees. All nodes that are reachable from the source node or one of its neighbors without passing the protected link form the extended P space. The P space is a subset of the extended P space.
•
Q space —Use the destination node of the protected link as the root to establish a reverse shortest path tree. All nodes that are reachable from the root node without passing the protected link form the Q space. Nodes in the Q space are called Q nodes.
•
TI-LFA algorithm —In real networks, the P space and Q space do not have common nodes or directly connected nodes. The device cannot calculate the backup path and cannot meet the high availability requirement. The TI-LFA algorithm can calculate the extended P space, Q space, converged shortest path tree, repair list, and backup output interface for the protected link to get the backup next hop.
•
Repair list —A constraint path used to indicate how a P node reaches a Q node when the P space and Q space do not have common nodes. The repair list contains the following labels
(SIDs):
Labels of P nodes.
Adjacency labels from P nodes to Q nodes.
TI-LFA FRR protection types
The following TI-LFA traffic protection types are available:
•
Link protection —Protects traffic that traverses a specific link.
•
Node protection —Protects traffic that traverses a specific node.
Node protection takes precedence over link protection.
TI-LFA FRR path calculation
The numbers on links represent the link costs. A data flow traverses PE 1, P 1, and PE 2. To protect data against P 1 failure, TI-LFA FRR calculates the extended P space, Q space, shortest path tree converged after P 1 fails, repair list, and backup output interface, and creates the backup forwarding entry.
TI-LFA FRR calculates the backup path by using the following steps:
1. Calculates the extended P space: P 2.
2. Calculates the Q space: PE 2 and P 4.
3. Calculates the shortest path tree converged after P 1 fails: PE 1 --> P 2 --> P 4 --> PE 2.
4. Calculates the repair list: Node label of P 2 (16030), adjacency label of P 2 to P 3 (2168), and adjacency label of P 3 to P 4 (2178).
5. Calculates the backup output interface, that is, the output interface to the next hop after the link from PE 1 to P 1 fails.
14
Figure 14 TI-LFA FRR diagram
PE 1 P 1
10 900
PE 2
50 10
920
10
Q space
SID: 2168
1000
P 2 SID: 16030
Extended
P space
P 3
Repair List
16030
2168
2178
SID: 2178
900
P 4
Backup output interface
Failed node
TI-LFA FRR forwarding process
After TI-LFA FRR finishes backup path calculation, traffic will be switched to the backup path in response to a primary path failure.
As shown in Figure 15 , P 2 is a P node and P 4 is a Q node. When the next hop on the primary path
(P 1) fails, TI-LFA FRR switches the traffic to the backup path. The following are the detailed steps:
1. PE 1 encapsulates a label stack to a packet according to the repair list. The labels, from the outmost to inmost, are as follows:
Node label of P node P2 (16030), which equals the SRGB base value to the next hop of P 2 plus the SID index value of P 2.
Adjacency labels from P node P2 to Q node P 4, which are 2168 and 2178.
The destination's node label 16010, which equals the SRGB base value of Q node P 4 plus the SID index value of destination node PE 2.
2. P2 receives the packet, searches for a label forwarding entry based on the outmost label, pops label 2168, and forwards the packet to P 3.
3. P3 receives the packet, searches for a label forwarding entry based on the outmost label, pops label 2178, and forwards the packet to P 4.
4. P4 receives the packet, and searches for a label forwarding entry based on the outmost label.
Because the outgoing label is 16010 and the next hop is PE 2, P 4 encapsulates 16010 as the outmost label and forwards the packet to PE 2.
15
Figure 15 Data forwarding over the TI-LFA FRR backup path
PE 1 P 1 PE 2
SRGB=[16000-17000]
SID Index=10
2168
2178
16010
IP data
16030
16010
IP data
Q space
2168
2178
P 2
SRGB=[16000-17000]
16010
SID Index=30
IP data
Extended
P space
P 3
2178
16010
IP data
P 4
SRGB=[16000-17000]
Primary path
Backup path
Failed node
Microloop avoidance after a network failure
As shown in Figure 16 , when Device B fails, traffic to Device C will be switched to the backup path
calculated by TI-LFA. After Device A finishes route convergence, traffic will be switched to the post-convergence path. If Device D and Device F have not finished route convergence and still forward traffic along the pre-convergence path, a loop is formed between Device A and Device F.
The loop exists until Device D and Device F finish route convergence.
FRR microloop avoidance and SR microloop avoidance can resolve this issue. After you configure
TI-LFA, Device A first switches traffic to the backup path calculated by TI-LFA when Device B fails.
Then, Device A waits for Device D and Device F to finish route convergence before starting route convergence. After Device A also finishes route convergence, Device A switches the traffic to the converged route.
Figure 16 Diagram for microloop avoidance after a network failure
Device A Device B Device C
Device D Device E
Device F Device G Device H
16
Pre-convergence path
Post-convergence path
Backup path
Failed node
Microloop avoidance after a failure recovery
As shown in Figure 17 , before the link between Device B and Device C recovers, traffic traverses
along the backup path. After the link recovers, Device A will forward the traffic to Device B if Device A finishes route convergence before Device B. Before Device B also finishes route convergence,
Device B still forwards the traffic along the backup path. A loop is formed between Device A and
Device B.
SR microloop avoidance can resolve this issue. After the link recovers, SR microloop avoidance automatically calculates the optimal path from Device A to Device C and forwards traffic along the path. To forward a packet along the newly calculated path, Device A adds, for example, the adjacency label from Device B to Device C to the packet and then sends the packet to Device B.
Then, Device B forwards the packet to Device C based on the path information.
When the microloop avoidance RIB-update-delay timer expires, Device B should have finished route convergence. Device A does not add path information to packets anymore, and it forwards packets to Device C as usual.
Figure 17 Diagram for microloop avoidance after a failure recovery
Device A
Label B
Label C
IP data
Device B
Label C
IP data
Device C
Device E Device D
Backup path after a failure
Path after the failure is removed
Failed link
Device F
Protocols and standards
• draft-bashandy-rtgwg-segment-routing-ti-lfa-04
• draft-ietf-spring-segment-routing-mpls-00
• draft-ietf-spring-segment-routing-02
• draft-ietf-isis-segment-routing-extensions-06
• draft-ietf-spring-segment-routing-11
•
3draft-ietf-idr-bgpls-segment-routing-epe-15
• draft-ietf-idr-bgp-prefix-sid-19
•
RFC 7752, North-Bound Distribution of Link-State and Traffic Engineering (TE) Information
Using BGP
SR-MPLS tasks at a glance
IP traffic forwarding over SRLSPs tasks at a glance
To forward IP traffic over SRLSPs, perform the following configuration tasks:
17
1. Configuring segments
Select one of the following tasks:
Configuring IGP-based SID advertisement
2. Configuring the SRLSP establishment triggering policy
3.
(Optional.) Configuring the device to prefer SRLSPs in traffic forwarding
4. (Optional.)
Configuring IGP SR and LDP interworking
5.
(Optional.) Configuring TI-LFA FRR
6.
(Optional.) Configuring SR OAM
MPLS TE traffic forwarding over static SRLSPs tasks at a glance
To forward MPLS TE traffic over static SRLSPs, perform the following configuration tasks:
1. Configuring segments
Select one of the following tasks:
Configuring IGP-based SID advertisement
Configuring BGP-based SID advertisement
2.
Configuring an MPLS TE tunnel over a static SRLSP
3.
(Optional.) Configuring IGP SR and LDP interworking
4.
(Optional.) Configuring TI-LFA FRR
5.
(Optional.) Configuring SR OAM
MPLS TE traffic forwarding over explicit paths tasks at a glance
To forward MPLS TE traffic over explicit paths, perform the following configuration tasks:
1.
Configuring IGP-based SID advertisement
2.
Configuring an MPLS TE tunnel over an explicit-path SRLSP
3.
(Optional.) Configuring IGP SR and LDP interworking
4.
(Optional.) Configuring TI-LFA FRR
5.
(Optional.) Configuring SR OAM
MPLS TE traffic forwarding over PCE-calculated SRLSPs tasks at a glance
To forward MPLS TE traffic over PCE-calculated SRLSPs, perform the following configuration tasks:
1.
Configuring an MPLS TE tunnel over a PCE-calculated SRLSP
2.
(Optional.) Configuring IGP SR and LDP interworking
3.
(Optional.) Configuring TI-LFA FRR
4.
(Optional.) Configuring SR OAM
18
Configuring MPLS SRGBs
Restrictions and guidelines
The global MPLS SRGB is used for static prefix segments and BGP prefix SIDs. If no MPLS SRGB is configured for a protocol process, the process uses the global MPLS SRGB.
If you have configured prefix SIDs when you configure an SRGB, the SRGB must contain the configured prefix SIDs.
In the following situations, a configured SRGB takes effect after a device reboot:
•
The SRGB contains a label that is already used by another protocol. For example, the SRGB contains a label that is already used by LDP.
•
The SRGB overlaps with the label range of another protocol.
Configuring the global MPLS SRGB
1. Enter system view. system-view
2. Enter segment routing view. segment-routing
3. Configure the global MPLS SRGB. global-block minivalue maxivalue
By default, the minimum label value is 16000, and the maximum label value is 24000.
Configuring the MPLS SRGB for IS-IS
1. Enter system view. system-view
2. Enter IS-IS view. isis process-id
3. Configure the MPLS SRGB. segment-routing global-block minivalue maxivalue
By default, the minimum label value is 16000, and the maximum label value is 24000.
Configuring the MPLS SRGB for OSPF
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Configure the MPLS SRGB. segment-routing global-block minivalue maxivalue
By default, the minimum label value is 16000, and the maximum label value is 24000.
Configuring the MPLS SRLB
About this task
The segment routing local block (SRLB) is the range of local labels dedicated for SR-MPLS adjacency SIDs.
19
Restrictions and guidelines
Before configuring the MPLS SRLB, use the display mpls label command to display MPLS label usage information. Make sure that all labels in the specified range are idle. If a label in the range is not idle, the configured MPLS SRLB takes effect only after you save the running configuration and reboot the device. For more information about the display mpls label command, see MPLS Command Reference .
Procedure
1. Enter system view. system-view
2. Enter segment routing view. segment-routing
3. Configure the MPLS SRLB. local-block minimum-value maximum-value
By default, the minimum label value is 15000, and the maximum label value is 15999.
Configuring static segments
Prerequisites for configuring static segments
Before you configure static segments, perform the following tasks:
•
Determine the ingress node, transit nodes, and egress node of a static SRLSP.
•
Determine the incoming label for the adjacency segment from a node to next hop of the node.
Determine the incoming label for the destination IP address for the prefix segment on each node. On a device, a static SRLSP, a static LSP, and a static CRLSP cannot use the same incoming label.
•
Enable MPLS on all nodes and interfaces that will participate in MPLS forwarding. For information about enabling MPLS, see basic MPLS configuration in MPLS Configuration Guide .
Configuring a static adjacency segment
Restrictions and guidelines
This task is required on all nodes of a static SRLSP.
Multiple static SRLSPs can share an adjacency segment.
If you specify the next hop address for a static adjacency segment, make sure the following requirements are met:
•
The device has a route to the next hop address.
•
MPLS is enabled on the output interface of the route.
If you specify an output interface for a static adjacency segment, make sure the following requirements are met:
•
The interface is up.
•
The interface can receive direct routes.
•
MPLS is enabled on the interface.
A static adjacency segment must use a different incoming label than existing static LSPs, static PWs, and static CRLSPs. If not, the configured adjacency segment is unavailable. The adjacency segment cannot become available even if you change the incoming label of the static LSP, static PW, or static
20
CRLSP. To resolve this problem, you must delete the existing adjacency segment and configure a new one with a different incoming label.
Procedure
1. Enter system view. system-view
2. Configure a static adjacency segment.
static-sr-mpls adjacency adjacency-path-name in-label label-value
{ nexthop ip-address | outgoing-interface interface-type interface-number }
The next hop address for a static adjacency segment cannot be a local public IP address.
Configuring a static prefix segment
Restrictions and guidelines
This task is required on all nodes of a static SRLSP.
Multiple static SRLSPs to the same destination can share a prefix segment.
A prefix segment must use the next hop or output interface of the optimal route to the destination address of the prefix segment. You can configure multiple prefix segments to the destination address for load sharing if the optimal route has more than one next hop or output interface. To avoid configuration failure, make sure all prefix segments use the same prefix segment name and incoming label.
Procedure
1. Enter system view. system-view
2. Configure a static prefix segment.
static-sr-mpls prefix prefix-path-name destination ip-address
{ mask-length | mask } in-label in-label-value [ { nexthop ip-address
| outgoing-interface interface-type interface-number } out-label out-label-value ]
The next hop address for a static prefix segment cannot be a local public IP address.
Configuring IGP-based SID advertisement
IGP-based prefix SID advertisement tasks at a glance
Perform the following tasks on each node along an SRLSP:
1.
Configuring the IGP to support SR-MPLS
2.
3.
IGP-based adjacency SID advertisement tasks at a glance(for non-member interfaces)
Perform the following tasks on each node along an SRLSP:
1.
Configuring the IGP to support SR-MPLS
21
2.
Enabling SR-MPLS adjacency label allocation for the IGP
The device will allocate SIDs to adjacencies randomly.
3. (Optional.)
You can assign adjacency SIDs to adjacencies manually.
4.
IGP-based adjacency SID advertisement tasks at a glance
(for member interfaces)
Perform the following tasks on each node along an SRLSP:
1.
Configuring the IGP to support SR-MPLS
2.
Prerequisites for configuring IGP-based SID advertisement
Before you configure IGP-based SID advertisement, perform the following tasks:
•
Determine the ingress node, transit nodes, and egress node of an SRLSP.
•
Determine the SIDs, MPLS SRGBs, and MPLS SRLBs for nodes.
•
Enable MPLS on all nodes and interfaces that will participate in MPLS forwarding. For information about enabling MPLS, see basic MPLS configuration in MPLS Configuration Guide .
Configuring the IGP to support SR-MPLS
Prerequisites
For SR-MPLS to take effect, perform the following tasks before configuring the IGP to support
SR-MPLS:
•
If the IGP is IS-IS, set the cost style to wide, compatible, or wide-compatible before configuring
IS-IS to support SR-MPLS. For more information about the cost style, see IS-IS configuration in
Layer 3
—
IP Routing Configuration Guide .
•
If the IGP is OSPF, enable opaque LSA reception and advertisement capability. For more information about the capability, see OSPF configuration in Layer 3
—
IP Routing Configuration
Guide .
Configuring IS-IS to support SR-MPLS
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable SR-MPLS. segment-routing mpls
By default, SR-MPLS is disabled.
22
Configuring OSPF to support SR-MPLS
1. Enter system view. system-view
2. Enter OSPF view.
ospf process-id
3. Enable SR-MPLS. segment-routing mpls
By default, SR-MPLS is disabled.
Configuring prefix SIDs
About this task
Configuring a prefix SID in loopback interface view binds the SID with the IP address of the loopback interface.
To configure a prefix SID, use one of the following methods:
•
Specify an absolute value. The absolute value is used as the prefix SID. The prefix SID takes effect only if the absolute value is in the SRGB of the node.
•
Specify an index value. The sum of the index value and the SRGB base value is used as the prefix SID. The prefix SID takes effect only if it is in the SRGB.
Restrictions and guidelines
To use a prefix SID for a group of SR nodes in anycast scenarios, specify the n-flag-clear keyword to set the Node-SID flag bit of the prefix SID to 0.
To configure an IS-IS prefix SID, you must enable an IS-IS process on the loopback interface.
Configuring an IS-IS prefix SID
1. Enter system view. system-view
2. Enter loopback interface view. interface loopback interface-number
3. Configure an IS-IS prefix SID. isis [ process-id process-id ] prefix-sid [ algorithm algorithm-id ]
{ absolute absolute-value | index index-value } [ n-flag-clear |
{ explicit-null | no-php } ] *
By default, no IS-IS prefix SID is configured.
Configuring an OSPF prefix SID
1. Enter system view. system-view
2. Enter loopback interface view. interface loopback interface-number
3. Configure an OSPF prefix SID.
ospf process-id prefix-sid { absolute absolute-value | index index-value } [ n-flag-clear | { explicit-null | no-php } ] *
By default, no OSPF prefix SID is configured.
23
Enabling SR-MPLS adjacency label allocation for the IGP
Restrictions and guidelines
For this feature to take effect, you must enable SR-MPLS.
Enabling SR-MPLS adjacency label allocation for IS-IS
1. Enter system view. system-view
2. Enter IS-IS view. isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable SR-MPLS adjacency label allocation. segment-routing adjacency enable
By default, SR-MPLS adjacency label allocation is disabled.
Enabling SR-MPLS adjacency SID allocation for OSPF
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Enable SR-MPLS adjacency SID allocation. segment-routing adjacency enable
By default, SR-MPLS adjacency SID allocation is disabled.
Assigning adjacency SIDs
About this task
After you enable SR-MPLS adjacency label allocation, the device randomly allocates adjacency
SIDs to the links to its IGP neighbors. If the link to an IGP neighbor flaps, the adjacency SID of the link keeps changing. For a link to always use the same adjacency SID, use this feature to assign a specific adjacency SID to the link.
If you assign the same adjacency SID to the adjacencies on multiple interfaces, multiple forwarding paths are available for adjacency SID-based forwarding. By default, packets are assigned to the adjacencies evenly. If the adjacencies have different bandwidths, you can set the load balancing weights for the adjacencies to avoid congestion. The traffic ratio on an adjacency will be its load balancing weight divided by the total load balancing weights of the adjacencies with the same adjacency SID.
Restrictions and guidelines
To assign adjacency SIDs by using absolute values, make sure the SIDs are in the label range of the
SRLB. To assign adjacency SIDs by using index values, make sure the index values plus the base value of the SRLB are in the label range of the SRLB.
The assigned adjacency SIDs take effect after you enable SR-MPLS and SR-MPLS adjacency label allocation.
24
Prerequisites
Before assigning adjacency SIDs, execute the display mpls label command to display the usage status of the labels that you want to assign as adjacency SIDs. Make sure the labels are in
Idle state.
A label that is not in Idle state is being used by another protocol. If you assign it to a link as an adjacency SID, the adjacency SID is not available even if the status of the label changes to Idle later.
To use the adjacency SID, you must remove the adjacency SID assignment and assign the adjacency SID again.
Assigning adjacency SIDs to IS-IS adjacencies
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Assign an adjacency SID to an IS-IS adjacency. isis adjacency-sid { absolute absolute-value | index index-value }
[ nexthop nexthop-address ]
By default, an IS-IS adjacency does not have an adjacency SID.
Assigning adjacency SIDs to OSPF adjacencies
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Assign an adjacency SID to an OSPF adjacency. ospf adjacency-sid { absolute absolute-value | index index-value }
[ nexthop nexthop-address ]
By default, an OSPF adjacency does not have an adjacency SID.
4. (Optional.) Set the load balancing weight for an OSPF adjacency. ospf adjacency-sid weight weight-value
By default, the load balancing weight for an OSPF adjacency is not set.
Configuring BGP-based SID advertisement
BGP-based SID advertisement tasks at a glance
Perform the following tasks on each node along an SRLSP:
1.
Configuring BGP to support SR-MPLS
2.
Prerequisites for configuring BGP-based SID advertisement
Before you configure BGP-based SID advertisement, perform the following tasks:
•
Determine the ingress node, transit nodes, and egress node of an SRLSP.
•
Determine the index value for the prefix SID of each node:
•
Enable MPLS on all nodes and interfaces that will participate in MPLS forwarding. For information about enabling MPLS, see basic MPLS configuration in MPLS Configuration Guide .
25
Configuring BGP to support SR-MPLS
1. Enter system view. system-view
2. Enable BGP and enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Create the BGP IPv4 unicast address family and enter its view. address-family ipv4 [ unicast ]
4. Enable SR-MPLS. segment-routing mpls
By default, SR-MPLS is disabled.
Configuring BGP prefix SIDs
About this task
To configure a BGP prefix SID, use the following methods:
•
Instead of specifying a routing policy for route redistribution, use the SID advertised by the IGP as the BGP prefix SID.
•
Specify a routing policy for route redistribution. Set the index value for the prefix SID in the routing policy to define the binding between the SID and the prefix.
Restrictions and guidelines
To use BGP routes to exchange prefix SIDs, you must enable BGP peers to exchange labeled routes.
Configuring the device to use the SIDs advertised by the IGP
1. Configure the IGP to support SR-MPLS.
For more information, see " Configuring the IGP to support SR-MPLS ."
2. Configure prefix SIDs.
For more information, see " Configuring prefix SIDs ."
3. Enter system view. system-view
4. Enter BGP instance view.
bgp as-number [ instance instance-name ]
5. Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
6. Redistribute routes from IS-IS or OSPF. import-route { isis | ospf } process-id
Specifying a routing policy for route redistribution
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
26
4. Redistribute routes from IS-IS or OSPF and apply a routing policy to the redistributed routes. import-route { isis | ospf } process-id route-policy route-policy-name
5. Set the index value for the prefix SID: a. Return to BGP instance view. quit b. Return to system view. quit c. Enter the routing policy view. route-policy route-policy-name { deny | permit } node node-number d. Specify a label index value. apply label-index index-value
By default, a routing policy does not have a label index value.
Configuring BGP EPE
About BGP EPE
BGP EPE assigns BGP peering SIDs to segments across ASs. The device sends BGP peering SIDs to the controller through BGP-LS extensions. The controller orchestrates IGP SIDs and BGP peering
SIDs for inter-AS forwarding over optimal paths.
After you configure BGP EPE on a device, the device assigns SIDs to connected BGP peers or peer groups to identify the BGP neighbors or links.
Configuring BGP EPE-based SID allocation
Restrictions and guidelines
When you configure BGP EPE, follow these restrictions and guidelines:
•
By default, a BGP peering SID is node type.
•
If you do not specify a routing policy when enabling BGP EPE, the system will assign labels to
BGP peers randomly.
•
BGP EPE requires that the MPLS TE tunnel use a static SRLSP. The outgoing label of the static
SRLSP must be the same as the label specified during BGP EPE configuration.
When you use BGP EPE to apply a routing policy to a peer or peer group, follow these restrictions and guidelines:
•
You cannot specify a routing policy to assign the same label to multiple BGP peers or peer groups when you assign Peer-Node-SIDs, Peer-Adj-SIDs, Peer-Node-Adj-SIDs to the BGP peers or peer groups.
•
You can specify a routing policy to assign the same label to multiple peers or peer groups only when you assign a Peer-Set-SID to the BGP peers or peer groups.
•
You can use if-match interface as a filtering condition only if the EBGP session is established by using loopback interfaces.
Prerequisites
Before assigning BGP-EPE SIDs, execute the display mpls label command to display the usage status of the labels that you want to assign as BGP-EPE SIDs. Make sure the labels are in
Idle state. A label that is not in Idle state is being used by another protocol. If you assign it to a peer or peer group as a BGP-EPE SID, the BGP-EPE SID is not available even if the status of the label
27
changes to Idle later. To use the BGP-EPE SID, you must remove the BGP-EPE SID assignment and assign the BGP-EPE SID again.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enable BGP EPE and specify a routing policy for the peer or peer group. peer { group-name | ipv4-address [ mask-length ] } egress-engineering
[ adjacency | node-adjacency | set ] [ label label-value | route-policy policy-name ]
By default, BGP EPE is disabled.
4. (Optional.) Configure the label value in the routing policy. a. Return to system view. quit b. Enter the routing policy view. route-policy route-policy-name { deny | permit } node node-number c. Specify a label value.
apply label-value label-value
By default, no label value is specified.
Configuring a BGP EPE peer set
About this task
If a device has established BGP peer relationships with multiple devices, you can manually add the
BGP peers to a BGP EPE peer set and assign a Peer-Set-SID to the set. Then, the device can send traffic to the peers in the set for load sharing when it forwards the traffic based on the Peer-Set-SID.
Prerequisites
Before adding a peer or peer group to a BGP EPE peer set, you must enable BGP EPE for the peer or peer group.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Create a BGP EPE peer set.
egress-engineering peer-set peer-set-name [ label label-value ]
4. Add a peer or peer group to the BGP EPE peer set. peer { group-name | ipv4-address [ mask-length ] } peer-set peer-set-name
By default, a peer or peer group does not belong to a BGP EPE peer set.
28
Configuring the SRLSP establishment triggering policy
About this task
To save system resources, you can configure the SRLSP establishment triggering policy to allow only certain FECs to trigger SRLSP establishment.
Procedure
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Enable BGP EPE and specify a routing policy for the peer or peer group. segment-routing lsp-trigger { host | none | prefix-list prefix-name }
By default, the device allows all FECs to trigger SRLSP establishment.
Configuring the device to prefer SRLSPs in traffic forwarding
About this task
This feature enables the device to preferentially use SRLSPs to forward traffic when both SRLSPs and LDP LSPs are available for traffic forwarding. If you do not configure this feature, the device prefers to use LDP LSPs for traffic forwarding.
Restrictions and guidelines
This feature takes effect only when SR-MPLS is enabled and SRLSPs use prefix SIDs.
Configuring the device to prefer SRLSPs established by IS-IS in traffic forwarding
1. Enter system view. system-view
2. Enter IS-IS view. isis process-id
3. Configure the device to prefer SRLSPs in traffic forwarding. segment-routing sr-prefer [ prefix-list prefix-list-name ]
By default, the device prefers LDP LSPs to SRLSPs.
Configuring the device to prefer SRLSPs established by OSPF in traffic forwarding
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Configure the device to prefer SRLSPs in traffic forwarding. segment-routing sr-prefer [ prefix-list prefix-list-name ]
By default, the device prefers LDP LSPs to SRLSPs.
29
Configuring an MPLS TE tunnel over a static
SRLSP
Tasks at a glance
1. Enable MPLS TE.
Perform this task on all nodes that the MPLS TE tunnel traverses. For more information, see
MPLS TE configuration in MPLS Configuration Guide .
2.
Perform this task on the ingress node of the MPLS TE tunnel.
3. Create the tunnel interface and specify the destination address of the tunnel.
Perform this task on the ingress node of the MPLS TE tunnel. For more information, see MPLS
TE configuration in MPLS Configuration Guide .
4.
Binding a static SRLSP to an MPLS TE tunnel interface
Perform this task on the ingress node of the MPLS TE tunnel.
5.
(Optional.) Configuring the static SRLSP switchback delay time
When an MPLS TE tunnel uses a backup static SRLSP to protect the primary static SRLSP, you can perform this task on the ingress node of the MPLS TE tunnel.
6. Configure static routes or policy-based routing to direct traffic to the MPLS TE tunnel.
Perform this task on the ingress node of the MPLS TE tunnel. For more information, see MPLS
TE configuration in MPLS Configuration Guide .
Configuring a static SRLSP
1. Enter system view. system-view
2. Configure a static SRLSP.
static-sr-mpls lsp lsp-name out-label out-label-value &<1-n>
Binding a static SRLSP to an MPLS TE tunnel interface
1. Enter system view. system-view
2. Enter MPLS TE tunnel interface view. interface tunnel tunnel-number [ mode mpls-te ]
3. Set the MPLS TE tunnel establishment mode to static. mpls te signaling static
By default, MPLS TE uses RSVP-TE to establish a tunnel.
4. Bind a static SRLSP to the MPLS TE tunnel interface. mpls te static-sr-mpls lsp-name [ backup ]
By default, an MPLS TE tunnel does not use a static SRLSP.
The specified static SRLSP must have been created by using the static-sr-mpls lsp command. To specify a backup static SRLSP by using the backup keyword, make sure both the primary and backup static SRLSPs are established based on adjacency SIDs.
30
Configuring the static SRLSP switchback delay time
About this task
The switchback delay time refers to the period of time that a TE tunnel waits before it performs a backup-to-primary static SRLSP switchover when the primary static SRLSP recovers.
It might happen that the upstream primary static SRLSP becomes up before the downstream primary static CRLSP becomes up. In this case, if the upstream node switches traffic back to the primary
SRLSP, the traffic will be dropped until the primary SRLSP on the downstream node becomes up.
Setting a proper switchback delay can resolve this issue.
Procedure
1. Enter system view. system-view
2. Enter the view of an MPLS TE tunnel interface. interface tunnel tunnel-number [ mode mpls-te ]
3. Configure the static SRLSP switchback delay time.
mpls te static-sr-mpls wtr delay-time
By default, the static SRLSP switchback delay is 10 seconds.
Configuring an MPLS TE tunnel over an explicit-path SRLSP
Tasks at a glance
Perform the following tasks on the ingress node of the MPLS TE tunnel:
1.
Configuring an explicit path for the MPLS TE tunnel
2. Creating an MPLS TE tunnel interface and specifying the destination address.
For more information, see MPLS TE configuration in MPLS Configuration Guide .
3.
Configuring an MPLS TE tunnel over the explicit path
Prerequisites
Before you configure an MPLS TE tunnel over an explicit-path SRLSP, perform the following tasks:
•
Determine the ingress node of the SRLSP.
•
Determine the SIDs of the nodes along the SRLSP.
•
Enable MPLS on all nodes and interfaces that will participate in MPLS forwarding. For information about enabling MPLS, see basic MPLS configuration in MPLS Configuration Guide .
Configuring an explicit path for the MPLS TE tunnel
1. Enter system view. system-view
2. Create an explicit path and enter its view.
explicit-path path-name
3. Add or modify a node in the explicit path.
31
Specify a node by its label.
nextsid [ index index-number ] label label-value type { adjacency
| prefix }
For an adjacency or prefix SID node, specify the label assigned to the next hop for the label-value argument. For a node that uses a BSID, specify the BSID for the MPLS TE tunnel.
Specify a node by its IP address.
nexthop [ index index-number ] ip-address [ exclude | include [ loose | strict ] ]
By default, an explicit path does not include any node.
Configuring an MPLS TE tunnel over the explicit path
1. Enter system view. system-view
2. Enter MPLS TE tunnel interface view. interface tunnel tunnel-number mode mpls-te
3. Set the MPLS TE tunnel establishment mode to SR. mpls te signaling segment-routing
By default, MPLS TE uses RSVP-TE to establish a tunnel.
4. Configure the MPLS TE tunnel interface to use an explicit path.
mpls te path preference value explicit-path path-name [ no-cspf ]
By default, MPLS TE uses the calculated path to establish an SRLSP.
If the specified explicit path includes a BSID, the device uses the routing protocol to calculate the path instead of using CSPF, regardless of whether you specify the no-cspf keyword or not.
5. (Optional.) Configure the tunnel interface to perform CSPF calculation strictly based on adjacency SID information when establishing an SRLSP for an MPLS TE tunnel. mpls te path-selection adjacency-sid
By default, a tunnel interface does not perform CSPF calculation strictly based on adjacency
SID information when establishing an SRLSP for an MPLS TE tunnel.
Configuring an MPLS TE tunnel over a
PCE-calculated SRLSP
Tasks at a glance
1. Enabling MPLS TE
Perform this task on all nodes that the MPLS TE tunnel traverses. For more information, see
MPLS TE configuration in MPLS Configuration Guide .
2. Configuring PCE discovery
Perform this task on all nodes that the MPLS TE tunnel traverses. You can manually specify
PCEs or configure dynamic PCE discovery. For more information, see MPLS TE configuration in MPLS Configuration Guide .
3. Establishing a PCEP session that supports SR.
32
Perform this task on all nodes that the MPLS TE tunnel traverses. Set the PCEP device type to active stateful. For more information, see MPLS TE configuration in MPLS Configuration Guide .
4. Creating an MPLS TE tunnel interface and specifying the destination address.
Perform this task on the ingress node of the MPLS TE tunnel. For more information, see MPLS
TE configuration in MPLS Configuration Guide .
5.
Configuring an MPLS TE tunnel interface to use PCE to calculate the SRLSP
Perform this task on the ingress node of the MPLS TE tunnel.
Configuring an MPLS TE tunnel interface to use PCE to calculate the SRLSP
1. Enter system view. system-view
2. Enter MPLS TE tunnel interface view. interface tunnel tunnel-number mode mpls-te
3. Set the MPLS TE tunnel establishment mode to SR. mpls te signaling segment-routing
By default, MPLS TE uses RSVP-TE to establish a tunnel.
4. Configure the MPLS TE tunnel interface to use PCE to calculate the SRLSP.
Establish an SRLSP by using the path calculated by PCEs.
mpls te path preference value dynamic [ pce [ ip-address ]&<0-8> ]
By default, the automatically calculated path is used to establish an SRLSP.
Establish an SRLSP by using SRLSP delegation. mpls te delegation
By default, SRLSP delegation is disabled.
Configuring IGP SR and LDP interworking
Restrictions and guidelines for IGP SR and LDP interworking
To configure IGP SR and LDP interworking, make sure the SRLSP uses prefix SIDs.
SR to LDP tasks at a glance
SRMS tasks at a glance
Perform the following tasks on an SRMS:
1. Enabling SR-MPLS on the SRMS: a.
Configuring the IGP to support SR-MPLS
b.
c.
2.
Enabling advertisement of locally configured prefix-SID mappings
3.
Configuring prefix-SID mappings
SRMC tasks at a glance
Perform the following tasks on each SRMC:
33
1. Enabling SR-MPLS on the SRMC: a.
Configuring the IGP to support SR-MPLS
b.
c.
d.
Enabling reception of advertised prefix-SID mappings
LDP to SR tasks at a glance
1.
Configuring the IGP to support SR-MPLS
2.
3.
SR over LDP tasks at a glance
1.
Configuring the IGP to support SR-MPLS
2.
3.
Prerequisites for SR-MPLS and LDP internetworking
Before you configure SR-MPLS and LDP internetworking, perform the following tasks:
•
Determine the ingress node, transit nodes, and egress node of an SRLSP.
•
Determine the index value for the prefix SID of each node.
•
Enable MPLS on all nodes and interfaces that will participate in MPLS forwarding. For information about enabling MPLS, see basic MPLS configuration in MPLS Configuration Guide .
Enabling advertisement of locally configured prefix-SID mappings
Restrictions and guidelines
Configure this feature on the device that acts as the SRMS.
Configuring IS-IS to advertise locally configured prefix-SID mappings
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable advertisement of locally configured prefix-SID mappings. segment-routing mapping-server advertise-local
By default, advertisement is disabled for locally configured prefix-SID mappings.
Configuring OSPF to advertise locally configured prefix-SID mappings
1. Enter system view. system-view
34
2. Enter OSPF view.
ospf process-id
3. Enable advertisement of locally configured prefix-SID mappings. segment-routing mapping-server advertise-local
By default, advertisement is disabled for locally configured prefix-SID mappings.
Configuring prefix-SID mappings
Restrictions and guidelines
Configure this feature on the device that acts as the SRMS.
The specified prefixes must not belong to any existing prefix-SID mappings.
Prerequisites
Before you configure prefix-SID mappings in bulk, plan the number of mappings carefully.
Procedure
1. Enter system view. system-view
2. Enable SR and enter segment routing view. segment-routing
3. Configure a prefix-SID mapping.
mapping-server prefix-sid-map ip-address mask-length start-value
[ range range-value ] [ attached ]
By default, no prefix-SID mappings exist.
If you specify a value greater than 65535 for the range-value argument, the prefix-SID mappings cannot be advertised through IS-IS or OSPF.
Enabling reception of advertised prefix-SID mappings
Restrictions and guidelines
Configure this feature on the devices that act as the SRMCs.
Configuring IS-IS to receive advertised prefix-SID mappings
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable reception of prefix-SID mappings. segment-routing mapping-server receive
By default, reception of prefix-SID mappings is enabled.
Configuring OSPF to receive advertised prefix-SID mappings
1. Enter system view. system-view
2. Enter OSPF view.
35
ospf process-id
3. Enable reception of prefix-SID mappings. segment-routing mapping-server receive
By default, reception of prefix-SID mappings is enabled.
Configuring TI-LFA FRR
Restrictions and guidelines for TI-LFA FRR
TI-LFA FRR is not supported on static SR networks.
In SR-MPLS and LDP interworking scenarios, you must configure the device to prefer the IS-IS or
OSPF SRLSP to the LDP LSP. This rule ensures the effectiveness of the TI-LFA FRR backup next hop.
TI-LFA FRR tasks at a glance
1.
2.
(Optional.) Disabling an interface from participating in TI-LFA calculation
On the source node, disable TI-LFA on the route's output interface to the next hop on the primary path.
3.
(Optional.) Configuring microloop avoidance
Enabling TI-LFA FRR
Enabling TI-LFA FRR for IS-IS
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable LFA FRR for IS-IS. fast-reroute lfa [ level-1 | level-2 ]
By default, LFA FRR is disabled for IS-IS.
5. Enable TI-LFA FRR for IS-IS. fast-reroute ti-lfa [ per-prefix ] [ route-policy route-policy-name
| host ] [ level-1 | level-2 ]
By default, TI-LFA FRR is disabled for IS-IS.
Enabling TI-LFA FRR for OSPF
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Enable LFA FRR for OSPF. fast-reroute { lfa [ abr-only ] | route-policy route-policy-name }
36
By default, LFA FRR is disabled for OSPF.
4. Enable TI-LFA FRR for OSPF. fast-reroute ti-lfa [ per-prefix ] [ route-policy route-policy-name
| host ]
By default, TI-LFA FRR is disabled for OSPF.
Disabling an interface from participating in TI-LFA calculation
Disabling an IS-IS interface from participating in TI-LFA calculation
1. Enter system view. system-view
2. Enter the view of IS-IS interface. interface interface-type interface-number
3. Disable the interface from participating in TI-LFA calculation. isis fast-reroute ti-lfa disable [ level-1 | level-2 ]
By default, an IS-IS interface participates in TI-LFA calculation.
Disabling an OSPF interface from participating in TI-LFA calculation
1. Enter system view. system-view
2. Enter the view of OSPF interface. interface interface-type interface-number
3. Disable the interface from participating in TI-LFA calculation. ospf fast-reroute ti-lfa disable
By default, an OSPF interface participates in TI-LFA calculation.
Configuring microloop avoidance
About this task
The following microloop avoidance methods are available:
•
FRR microloop avoidance —Provides microloop avoidance after a network failure.
On a network deployed with TI-LFA FRR, when a node or link fails, traffic will be switched to the backup path calculated by TI-LFA. If devices on the backup path have not finished route convergence, a loop is formed between the source node (failed node or the previous node along the link) and a device on the backup path. The loop exists until the devices on the backup path finish route convergence.
To resolve this issue, FRR microloop avoidance first switches traffic to the backup path calculated by TI-LFA after the node or link failure. Then, the source node waits for the nodes on the backup path to finish route convergence before starting route convergence.
•
SR microloop avoidance —Provides microloop avoidance both after a network failure and after a failure recovery.
After a network failure occurs or recovers, route convergence occurs on relevant network devices. Because of non-simultaneous convergence on network devices, microloops might be formed. After you configure SR microloop avoidance, the devices will forward traffic along the specified path before route convergence is finished on all the relevant network devices.
Because the forwarding path is independent of route convergence, microloops are avoided.
To leave sufficient time for IGP to finish route convergence, set the SR microloop avoidance
RIB-update-delay timer. Before the timer expires, failure relevant devices will forward traffic
37
along the specified path. After the timer expires, IGP route convergence should have finished and traffic will traverse along the IGP-calculated path.
Restrictions and guidelines
If you configure both FRR microloop avoidance and SR microloop avoidance, SR microloop avoidance takes effect.
Configuring FRR microloop avoidance for IS-IS
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable FRR microloop avoidance for IS-IS. fast-reroute microloop-avoidance enable [ level-1 | level-2 ]
By default, FRR microloop avoidance is disabled for IS-IS.
5. (Optional.) Set the FRR microloop avoidance RIB-update-delay time. fast-reroute microloop-avoidance rib-update-delay delay-time
[ level-1 | level-2 ]
By default, the FRR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring FRR microloop avoidance for OSPF
1. Enter system view. system-view
2. Enter OSPF view.
ospf process-id
3. Enable FRR microloop avoidance for OSPF. fast-reroute microloop-avoidance enable
By default, FRR microloop avoidance is disabled for OSPF.
4. (Optional.) Set the FRR microloop avoidance RIB-update-delay time. fast-reroute microloop-avoidance rib-update-delay delay-time
By default, the FRR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring SR microloop avoidance for IS-IS
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv4 unicast address family view. address-family ipv4
4. Enable SR microloop avoidance for IS-IS. segment-routing microloop-avoidance enable [ level-1 | level-2 ]
By default, SR microloop avoidance is disabled for IS-IS.
5. (Optional.) Set the SR microloop avoidance RIB-update-delay time.
segment-routing microloop-avoidance rib-update-delay delay-time
[ level-1 | level-2 ]
38
By default, the SR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring SR microloop avoidance for OSPF
1. Enter system view. system-view
2. Enter OSPF view. ospf process-id
3. Enable SR microloop avoidance for OSPF. segment-routing microloop-avoidance enable
By default, SR microloop avoidance is disabled for OSPF.
4. (Optional.) Set the SR microloop avoidance RIB-update-delay time for OSPF.
segment-routing microloop-avoidance rib-update-delay delay-time
By default, the SR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring SR OAM
Configuring BFD for SRLSPs
About this task
This feature enables the device to create a BFD session for each primary SRLSP to verify the connectivity of the primary SRLSPs. When a primary SRLSP fails, BFD can quickly detect the failure and switches traffic to the backup SRLSP to reduce packet loss.
Restrictions and guidelines
Before you execute this command, enable MPLS BFD by using the mpls bfd enable command.
If you execute both the bfd enable command and the mpls bfd command for SRLSPs, the mpls bfd command takes effect on the SRLSPs.
Procedure
1. Enter system view. system-view
2. Enter segment routing view. segment-routing
3. Enable BFD to verify SRLSP connectivity. bfd enable [ prefix-list prefix-list-name ] [ echo | nil-fec ]
By default, BFD is not enabled to verify SRLSP connectivity.
4. Configure the BFD session parameters for verifying SRLSP connectivity:
Configure the BFD detection time multiplier.
bfd detect-multiplier value
By default, the BFD detection time multiplier is not set for SRLSPs. The BFD detection time multiplier set by the bfd multi-hop detect-multiplier command applies.
Configure the minimum interval for receiving BFD packets.
bfd min-receive-interval interval
By default, the minimum interval for receiving BFD packets is not set. The interval set by the bfd multi-hop min-receive-interval command applies.
Configure the minimum interval for transmitting BFD packets.
39
bfd min-transmit-interval interval
By default, the minimum interval for transmitting BFD packets is not set. The interval set by the bfd multi-hop min-transmit-interval command applies.
Configure the minimum interval for receiving BFD echo packets.
bfd min-echo-receive-interval interval
By default, the minimum interval for receiving BFD echo packets is not set. The interval set by the bfd multi-hop min-echo-receive-interval command applies.
See High Availability Command Reference for more information about the following BFD commands: bfd multi-hop detect-multiplier , bfd multi-hop min-receive-interval , bfd multi-hop min-transmit-interval , and bfd multi-hop min-echo-receive-interval .
Configuring SBFD for SRLSPs
About this task
This feature enables the device to create an SBFD session for each primary SRLSP to verify the connectivity of the primary SRLSPs. When a primary SRLSP fails, BFD can quickly detect the failure and switches traffic to the backup SRLSP to reduce packet loss.
Restrictions and guidelines
Before you configure this feature, enable MPLS BFD by using the mpls bfd enable command.
After you configure this feature, the local end uses the destination address of an SRLSP as the remote discriminator to establish an SBFD session for the SRLSP. Make sure you specify the local discriminator of the SBFD session on the remote end as the SRLSP's destination address by using the sbfd local-discriminator command.
If you execute both the sbfd enable command and the mpls sbfd command for SRLSPs, the mpls sbfd command takes effect on the SRLSPs.
Procedure
1. Enter system view. system-view
2. Enter segment routing view. segment-routing
3. Enable SBFD to verify SRLSP connectivity. sbfd enable [ prefix-list prefix-list-name ]
By default, SBFD is not enabled to verify SRLSP connectivity.
4. Configure the SBFD session parameters for verifying SRLSP connectivity:
Configure the SBFD detection time multiplier.
sbfd detect-multiplier value
By default, the SBFD detection time multiplier is not set for SRLSPs. The multiplier set by the bfd multi-hop detect-multiplier command applies.
Configure the minimum interval for receiving SBFD packets.
sbfd min-receive-interval interval
By default, the minimum interval for receiving SBFD packets is not set. The interval set by the bfd multi-hop min-receive-interval command applies.
Configure the minimum interval for transmitting SBFD packets.
sbfd min-transmit-interval interval
40
By default, the minimum interval for transmitting SBFD packets is not set. The interval set by the bfd multi-hop min-transmit-interval command applies.
See High Availability Command Reference for more information about the following BFD commands: bfd multi-hop detect-multiplier , bfd multi-hop min-receive-interval , and bfd multi-hop min-transmit-interval .
Configuring tunnel BFD for all SRLSPs
About this task
This task establishes tunnel BFD sessions to verify the connectivity of all SRLSPs.
A tunnel BFD session is established for primary and backup SRLSPs of a specific FEC (destination
IP/mask). The BFD session is up as long as an SRLSP is available for the FEC. If both the primary and backup SRLSPs for the FEC are unavailable, the BFD session goes down. BFD then quickly triggers a protection measure (such as MPLS L3VPN FRR) to switch traffic to other forwarding paths to reduce traffic loss.
Tunnel BFD verifies SRLSP connectivity as follows:
1. Establishes a BFD session between the ingress and egress of the tunnel to be verified.
2. Inserts labels for the SRLSPs into to the BFD control packets on the ingress.
3. Forwards the BFD control packets to the egress over the SRLSPs.
4. Determines the connectivity of the SRLSPs according to the BFD control packets returned by the egress.
Restrictions and guidelines
If you configure both the mpls tunnel-bfd command for an SRLSP and the tunnel-bfd enable command for all SRLSPs, the mpls tunnel-bfd command takes effect for that SRLSP.
Procedure
1. Enter system view. system-view
2. Enter segment routing view. segment-routing
3. Enable tunnel BFD to verify the connectivity of all SRLSPs. tunnel-bfd enable [ prefix-list prefix-list-name ] [ echo | nil-fec ]
By default, tunnel BFD is not enabled to verify SRLSP connectivity.
4. Configure the tunnel BFD session parameters for verifying SRLSP connectivity:
Configure the tunnel BFD detection time multiplier.
tunnel-bfd detect-multiplier value
By default, the tunnel BFD detection time multiplier is not set and the multiplier set by the bfd multi-hop detect-multiplier command applies.
Configure the minimum interval for receiving BFD packets.
tunnel-bfd min-receive-interval interval
By default, the minimum receive interval is not set, and the interval set by the bfd multi-hop min-receive-interval command applies.
Configure the minimum interval for transmitting BFD packets.
tunnel-bfd min-transmit-interval interval
By default, the minimum transmit interval is not set, and the interval set by the bfd multi-hop min-transmit-interval command applies.
41
Configure the minimum interval for receiving BFD echo packets.
tunnel-bfd min-echo-receive-interval interval
By default, the minimum interval for receiving BFD echo packets is not set, and the interval set by the bfd multi-hop min-echo-receive-interval command applies.
For more information about the bfd multi-hop detect-multiplier , bfd multi-hop min-receive-interval , bfd multi-hop min-transmit-interval , and bfd multi-hop min-echo-receive-interval commands, see BFD commands in High
Availability Command Reference .
Verifying and maintaining SR-MPLS
Displaying SR label block information
Perform display tasks in any view.
•
Display SR-MPLS label block information. display segment-routing label–block [ protocol { isis | ospf } ]
•
Display prefix-SID mappings. display segment-routing mapping-server prefix-sid-map [ ip-address mask-length | verbose ]
Displaying static segments
Perform display tasks in any view.
•
Display static SRLSP information. display mpls static-sr-mpls lsp [ lsp-name ]
•
Display static adjacency segment information. display mpls static-sr-mpls adjacency [ adjacency-path-name ]
•
Display static prefix segment information. display mpls static-sr-mpls prefix [ path prefix-path-name | destination ip-address [ mask | mask-length ] ]
Displaying BGP SR configuration and status information
Perform display tasks in any view.
•
Display BGP-EPE segment information. display bgp [ instance instance-name ] egress-engineering ipv4
[ ipv4-address ] [ verbose ]
•
Display BGP-EPE peer set information display bgp [ instance instance-name ] egress-engineering peer-set
[ peer-set-name ]
•
Display BGP SR label ranges. display bgp [ instance instance-name ] segment-routing label-range
Displaying IS-IS SR configuration and status information
Perform display tasks in any view.
42
•
Display IS-IS SRGB information. display isis segment-routing global-block [ level-1 | level-2 ]
[ process-id ]
•
Display IS-IS SR adjacency segment information. display isis [ process-id ] segment-routing adjacency [ sid sid-value
| vpn-instance vpn-instance-name ] *
•
Display IS-IS SR prefix-SID mappings. display isis segment-routing prefix-sid-map [ active-policy | backup-policy ] [ process-id ] [ verbose ]
•
Display IS-IS SR routing information. display isis segment-routing routing-table [ vpn-instance vpn-instance-name ] [ ip ip-address { mask-length | mask } ] [ flex-algo flex-algo-id ]
Displaying OSPF SR configuration and status information
Perform display tasks in any view.
•
Display OSPF SRGB information. display ospf [ process-id ] [ area area-id ] segment-routing global-block
•
Display OSPF SR adjacency segment information. display ospf [ process-id ] segment-routing adjacency [ sid sid-value ]
[ vpn-instance vpn-instance-name ]
•
Display OSPF SR prefix-SID mappings. display ospf segment-routing prefix-sid-map [ active-policy | backup-policy ] [ process-id ] [ verbose ]
•
Display OSPF SR routing information. display ospf segment-routing routing-table [ vpn-instance vpn-instance-name ] [ ip ip-address { mask-length | mask } ]
SR-MPLS configuration examples
Example: Configuring SR-MPLS based on static segments
Network configuration
As shown in Figure 18 , Router A, Router B, Router C, Router D, and Router E run IS-IS.
Establish an MPLS TE tunnel over a static SRLSP from Router A to Router D to transmit data between the IP networks. The static SRLSP traverses three adjacency segments: Router A—Router
B, Router B—Router C, and Router C—Router D.
Establish an MPLS TE tunnel over a static SRLSP from Router A to Router E to transmit data between the IP networks. The static SRLSP traverses three segments: Router A—Router B
(adjacency segment), Router B—Router C (prefix segment), and Router C—Router E (adjacency segment).
43
Figure 18 Network diagram
IP network
GE0/0/1
IP network
Loop0 Loop0
GE0/0/1
GE0/0/2 GE0/0/1
Router A Router B
GE0/0/2 GE0/0/2
GE0/0/3
GE0/0/1
GE0/0/4
Router C
GE0/0/3
GE0/0/2
Router D
GE0/0/2
Router E
GE0/0/1
IP network
Table 1 Interface and IP address assignment
Device
Router A
Interface IP address
Loop0 1.1.1.9/32
GE0/0/1
GE0/0/2
Router C Loop0
Router E
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/4
Loop0
GE0/0/1
100.1.1.1/24
10.1.1.1/24
3.3.3.9/32
30.1.1.1/24
20.1.1.2/24
50.1.1.1/24
60.1.1.2/24
5.5.5.9/32
200.1.2.1/24
Device Interface
Router B Loop0
GE0/0/1
GE0/0/2
GE0/0/3
Router D Loop0
GE0/0/1
GE0/0/2
IP address
2.2.2.9/32
10.1.1.2/24
20.1.1.1/24
60.1.1.1/24
4.4.4.9/32
100.1.2.1/24
30.1.1.2/24
GE0/0/2 50.1.1.2/24
Prerequisites
1. Configure IP addresses and masks for interfaces.
2. Configure IS-IS to advertise interface addresses, including the loopback interface address.
44
3. Execute the display ip routing-table command on each router to verify that the routers have learned the routes to one another, including the routes to the loopback interfaces.
Procedure
1. Configure LSR IDs, and enable MPLS and MPLS TE:
# Configure Router A.
<RouterA> system-view
[RouterA] mpls lsr-id 1.1.1.9
[RouterA] mpls te
[RouterA-te] quit
[RouterA] interface gigabitethernet 0/0/2
[RouterA-GigabitEthernet0/0/2] mpls enable
[RouterA-GigabitEthernet0/0/2] quit
# Configure Router B.
<RouterB> system-view
[RouterB] mpls lsr-id 2.2.2.9
[RouterB] mpls te
[RouterB-te] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] mpls enable
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface gigabitethernet 0/0/3
[RouterB-GigabitEthernet0/0/3] mpls enable
[RouterB-GigabitEthernet0/0/3] quit
# Configure Router C.
<RouterC> system-view
[RouterC] mpls lsr-id 3.3.3.9
[RouterC] mpls te
[RouterC-te] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface gigabitethernet 0/0/3
[RouterC-GigabitEthernet0/0/3] mpls enable
[RouterC-GigabitEthernet0/0/3] quit
[ RouterC ] interface gigabitethernet 0/0/4
[ RouterC-GigabitEthernet0/0/4 ] mpls enable
[ RouterC-GigabitEthernet0/0/4 ] quit
# Configure Router D.
<RouterD> system-view
[RouterD] mpls lsr-id 4.4.4.9
[RouterD] mpls te
[RouterD-te] quit
45
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] mpls enable
[RouterD-GigabitEthernet0/0/2] quit
# Configure Router E.
<RouterE> system-view
[RouterE] mpls lsr-id 5.5.5.9
[RouterE] mpls te
[RouterE-te] quit
[RouterE] interface gigabitethernet 0/0/2
[RouterE-GigabitEthernet0/0/2] mpls enable
[RouterE-GigabitEthernet0/0/2] quit
2. Configure adjacency and prefix segments on the nodes:
# On Router A, create adjacency segment adjacency-1 , and bind incoming label 16 to next hop address 10.1.1.2.
[RouterA] static-sr-mpls adjacency adjacency-1 in-label 16 nexthop 10.1.1.2
# On Router B, create adjacency segment adjacency-2 , and bind incoming label 21 to next hop address 20.1.1.2.
[RouterB] static-sr-mpls adjacency adjacency-2 in-label 21 nexthop 20.1.1.2
# On Router B, create prefix segments named prefix-1 to destination IP address 5.5.5.9, bind incoming label 16000 to next hop addresses 20.1.1.2 and 60.1.1.2, and specify the outgoing label as 16001.
[RouterB] static-sr-mpls prefix prefix-1 destination 5.5.5.9 32 in-label 16000 nexthop 20.1.1.2 out-label 16001
[RouterB] static-sr-mpls prefix prefix-1 destination 5.5.5.9 32 in-label 16000 nexthop 60.1.1.2 out-label 16001
# On Router C, create adjacency segment adjacency-1 , and bind incoming label 30 to next hop address 30.1.1.2. Create adjacency segment adjacency-2 , and bind incoming label 31 to next hop address 50.1.1.2.
[RouterC] static-sr-mpls adjacency adjacency-1 in-label 30 nexthop
30.1.1.2
[RouterC] static-sr-mpls adjacency adjacency-2 in-label 31 nexthop
50.1.1.2
# On Router C, create prefix segment named prefix-1 to destination IP address 5.5.5.9, and specify the incoming label as 16001.
[RouterC] static-sr-mpls prefix prefix-1 destination 5.5.5.9 32 in-label 16001
3. On Router A, establish static SRLSP static-sr-lsp-1 to Router D and static SRLSP static-sr-lsp-2 to Router E:
# Configure Router A as the ingress node of static SRLSP static-sr-lsp-1 and configure a label stack of [16, 21, 30].
[RouterA] static-sr-mpls lsp static-sr-lsp-1 out-label 16 21 30
# Configure Router A as the ingress node of static SRLSP static-sr-lsp-2 and configure a label stack of [16, 16000, 31].
[RouterA] static-sr-mpls lsp static-sr-lsp-2 out-label 16 16000 31
4. Configure MPLS TE tunnels over static SRLSPs on Router A:
# Establish static MPLS TE tunnel 0 to Router D and specify the tunnel destination address as the LSR ID of Router D. Bind static SRLSP static-sr-lsp-1 to MPLS TE tunnel interface 0.
[RouterA] interface tunnel 0 mode mpls-te
[RouterA-Tunnel0] ip address 6.1.1.1 255.255.255.0
[RouterA-Tunnel0] destination 4.4.4.9
46
[RouterA-Tunnel0] mpls te signaling static
[ RouterA-Tunnel0 ] mpls te static-sr-mpls static-sr-lsp-1
[RouterA-Tunnel0] quit
# Establish static MPLS TE tunnel 1 to Router E and specify the tunnel destination address as the LSR ID of Router E. Bind static SRLSP static-sr-lsp-2 to MPLS TE tunnel interface 1.
[ RouterA ] interface tunnel 1 mode mpls-te
[ RouterA-Tunnel1 ] ip address 7.1.1.1 255.255.255.0
[ RouterA-Tunnel1 ] destination 5.5.5.9
[ RouterA-Tunnel1 ] mpls te signaling static
[ RouterA-Tunnel1 ] mpls te static-sr-mpls static-sr-lsp-2
[ RouterA-Tunnel1 ] quit
5. On Router A, configure two static routes to direct traffic destined for 100.1.2.0/24 and
200.1.2.0/24 to MPLS TE tunnel 0 and tunnel 1, respectively.
[RouterA] ip route-static 100.1.2.0 24 tunnel 0 preference 1
[ RouterA ] ip route-static 200.1.2.0 24 tunnel 1 preference 1
Verifying the configuration
# Display static SRLSP establishment on each router by using the display mpls lsp or display mpls static-sr-lsp command.
[RouterA] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
1.1.1.9/0/1 StaticCR -/21 GE0/0/1
30
1.1.1.9/1/2 StaticCR -/16000 GE0/0/1
31
[RouterB] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
- StaticCR 21/- GE0/0/2
5.5.5.9/32 StaticCR 16000/16001 GE0/0/2
5.5.5.9/32 StaticCR 16000/16001 GE0/0/4
[RouterC] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
- StaticCR 30/- GE0/0/1
- StaticCR 31/- GE0/0/3
5.5.5.9/32 StaticCR 16001/- -
Example: Configuring SR-MPLS based on ISIS-advertised
SIDs
Network configuration
As shown in Figure 19 , Router A, Router B, Router C, and Router D are running IS-IS.
Configure dynamic SID allocation on loopback interfaces of the routers. Then, establish an SRLSP from Router A to Router D based on the allocated SIDs and configure an MPLS TE tunnel over the
SRLSP to transmit data.
47
Figure 19 Network diagram
Loop1 Loop1 Loop1 Loop1
GE0/0/1 GE0/0/2
GE0/0/1 GE0/0/1
Router A Router B
Table 2 Interface and IP address assignment
Router C
GE0/0/2
GE0/0/1
Router D
GE0/0/2
Device
Router A
Router C
Prerequisites
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1
Loop1
GE0/0/1
GE0/0/2
10.0.0.1/24
3.3.3.3/32
11.0.0.2/24
12.0.0.1/24
Configure IP addresses and masks for interfaces.
Procedure
Device
Router B
Router D
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
10.0.0.2/24
11.0.0.1/24
4.4.4.4/32
12.0.0.2/24
100.1.2.1/24
1. Configure IS-IS on the routers and set the IS-IS cost style to wide:
# Configure Router A.
<RouterA> system-view
[RouterA] isis 1
[RouterA-isis-1] network-entity 00.0000.0000.0001.00
[RouterA-isis-1] cost-style wide
[RouterA-isis-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] isis enable 1
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis enable 1
[RouterA-LoopBack1] quit
# Configure Router B.
<RouterB> system-view
[RouterB] isis 1
[RouterB-isis-1] network-entity 00.0000.0000.0002.00
[RouterB-isis-1] cost-style wide
[RouterB-isis-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] isis enable 1
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] isis enable 1
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
48
[RouterB-LoopBack1] isis enable 1
[RouterB-LoopBack1] quit
# Configure Router C.
<RouterC> system-view
[RouterC] isis 1
[RouterC-isis-1] network-entity 00.0000.0000.0003.00
[RouterC-isis-1] cost-style wide
[RouterC-isis-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] isis enable 1
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] isis enable 1
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis enable 1
[RouterC-LoopBack1] quit
# Configure Router D.
<RouterD> system-view
[RouterD] isis 1
[RouterD-isis-1] network-entity 00.0000.0000.0004.00
[RouterD-isis-1] cost-style wide
[RouterD-isis-1] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] isis enable 1
[RouterD-GigabitEthernet0/0/1] quit
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] isis enable 1
[RouterD-GigabitEthernet0/0/2] quit
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis enable 1
[RouterD-LoopBack1] quit
2. Configure LSR IDs, and enable MPLS and MPLS TE on the routers:
# Configure Router A.
[RouterA] mpls lsr-id 1.1.1.1
[RouterA] mpls te
[RouterA-te] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] mpls enable
[RouterA-GigabitEthernet0/0/1] quit
# Configure Router B.
[RouterB] mpls lsr-id 2.2.2.2
[RouterB] mpls te
[RouterB-te] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] mpls enable
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
49
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] quit
# Configure Router C.
[RouterC] mpls lsr-id 3.3.3.3
[RouterC] mpls te
[RouterC-te] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] quit
# Configure Router D.
[RouterD] mpls lsr-id 4.4.4.4
[RouterD] mpls te
[RouterD-te] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] mpls enable
[RouterD-GigabitEthernet0/0/1] quit
3. Enable SR-MPLS on the routers:
# Configure Router A.
[RouterA] isis 1
[RouterA-isis-1] address-family ipv4
[RouterA-isis-1-ipv4] segment-routing mpls
[RouterA-isis-1-ipv4] quit
[RouterA-isis-1] quit
# Configure Router B.
[RouterB] isis 1
[RouterB-isis-1] address-family ipv4
[RouterB-isis-1-ipv4] segment-routing mpls
[RouterB-isis-1-ipv4] quit
[RouterB-isis-1] quit
# Configure Router C.
[RouterC] isis 1
[RouterC-isis-1] address-family ipv4
[RouterC-isis-1-ipv4] segment-routing mpls
[RouterC-isis-1-ipv4] quit
[RouterC-isis-1] quit
# Configure Router D.
[RouterD] isis 1
[RouterD-isis-1] address-family ipv4
[RouterD-isis-1-ipv4] segment-routing mpls
[RouterD-isis-1-ipv4] quit
[RouterD-isis-1] quit
4. Configure IS-IS prefix SIDs for the routers:
# Configure Router A.
[RouterA] interface loopback 1
50
[RouterA-LoopBack1] isis prefix-sid index 10
# Configure Router B.
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis prefix-sid index 20
# Configure Router C.
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis prefix-sid index 30
# Configure Router D.
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis prefix-sid index 40
5. On Router A, establish static SRLSP static-sr-lsp-1 to Router D and configure an MPLS TE tunnel over the static SRLSP:
# Configure Router A as the ingress node of static SRLSP static-sr-lsp-1 and specify the prefix label that Router A allocated to Router D (16040) as the outgoing label.
[RouterA] static-sr-mpls lsp static-sr-lsp-1 out-label 16040
# Establish static MPLS TE tunnel 1 to Router D and specify the LSR ID of Router D as the tunnel destination address. Bind static SRLSP static-sr-lsp-1 to MPLS TE tunnel interface 1.
[RouterA] interface tunnel 1 mode mpls-te
[RouterA-Tunnel1] ip address 6.1.1.1 255.255.255.0
[RouterA-Tunnel1] destination 4.4.4.4
[RouterA-Tunnel1] mpls te signaling static
[RouterA-Tunnel1] mpls te static-sr-mpls static-sr-lsp-1
[RouterA-Tunnel1] quit
6. On Router A, configure a static route to direct traffic destined for 100.1.2.0/24 to MPLS TE tunnel 1.
[RouterA] ip route-static 100.1.2.0 24 tunnel 1 preference 1
Verifying the configuration
# Display detailed IS-IS interface information on Router A to view SID information for the loopback interface.
[RouterA] display isis interface verbose
Interface information for IS-IS(1)
----------------------------------
Interface: LoopBack1
Index IPv4 state IPv6 state Circuit ID MTU Type DIS
00002 Up Down 1 1536 L1/L2 --
SNPA address : 0000-0000-0000
IP address : 1.1.1.1
Secondary IP address(es) :
IPv6 link-local address :
Extended circuit ID : 2
CSNP timer value : L1 10 L2 10
Hello timer value : 10
Hello multiplier value : 3
LSP timer value : L12 33
LSP transmit-throttle count : L12 5
Cost : L1 0 L2 0
IPv6 cost : L1 0 L2 0
51
Priority : L1 64 L2 64
Retransmit timer value : L12 5
MPLS TE status : L1 Disabled L2 Disabled
IPv4 BFD : Disabled
IPv6 BFD : Disabled
IPv4 FRR LFA backup : Enabled
IPv6 FRR LFA backup : Enabled
IPv4 prefix suppression : Disabled
IPv6 prefix suppression : Disabled
IPv4 tag : 0
IPv6 tag : 0
Prefix-SID type : Index
Value : 10
Prefix-SID validity : Valid
# Display detailed IS-IS routing information on Router A to view information about routes bound with labels.
[RouterA] display isis route verbose
Route information for IS-IS(1)
------------------------------
Level-1 IPv4 Forwarding Table
-----------------------------
IPv4 Dest : 10.0.0.0/24 Int. Cost : 10 Ext. Cost : NULL
Admin Tag : - Src Count : 2 Flag : D/L/-
InLabel : 4294967295 InLabel Flag: -/-/-/-/-/-
NextHop : Interface : ExitIndex :
Direct GE0/0/1 0x00000102
Nib ID : 0x0 OutLabel : 4294967295 OutLabelFlag: -
IPv4 Dest : 11.0.0.0/24 Int. Cost : 20 Ext. Cost : NULL
Admin Tag : - Src Count : 2 Flag : R/-/-
InLabel : 4294967295 InLabel Flag: -/-/-/-/-/-
NextHop : Interface : ExitIndex :
10.0.0.2 GE0/0/1 0x00000102
Nib ID : 0x14000004 OutLabel : 4294967295 OutLabelFlag: -
IPv4 Dest : 12.0.0.0/24 Int. Cost : 30 Ext. Cost : NULL
Admin Tag : - Src Count : 2 Flag : R/-/-
InLabel : 4294967295 InLabel Flag: -/-/-/-/-/-
NextHop : Interface : ExitIndex :
10.0.0.2 GE0/0/1 0x00000102
Nib ID : 0x14000004 OutLabel : 4294967295 OutLabelFlag: -
IPv4 Dest : 1.1.1.1/32 Int. Cost : 0 Ext. Cost : NULL
Admin Tag : - Src Count : 1 Flag : D/L/-
InLabel : 16010 InLabel Flag: -/N/-/-/-/-
52
NextHop : Interface : ExitIndex :
Direct Loop1 0x00000584
Nib ID : 0x0 OutLabel : 4294967295 OutLabelFlag: -
IPv4 Dest : 2.2.2.2/32 Int. Cost : 10 Ext. Cost : NULL
Admin Tag : - Src Count : 1 Flag : R/-/-
InLabel : 16020 InLabel Flag: -/N/-/-/-/-
NextHop : Interface : ExitIndex :
10.0.0.2 GE0/0/1 0x00000102
Nib ID : 0x14000003 OutLabel : 16020 OutLabelFlag: I
IPv4 Dest : 3.3.3.3/32 Int. Cost : 20 Ext. Cost : NULL
Admin Tag : - Src Count : 1 Flag : R/-/-
InLabel : 16030 InLabel Flag: -/N/-/-/-/-
NextHop : Interface : ExitIndex :
10.0.0.2 GE0/0/1 0x00000102
Nib ID : 0x14000002 OutLabel : 16030 OutLabelFlag: -
IPv4 Dest : 4.4.4.4/32 Int. Cost : 20 Ext. Cost : NULL
Admin Tag : - Src Count : 1 Flag : R/-/-
InLabel : 16040 InLabel Flag: -/N/-/-/-/-
NextHop : Interface : ExitIndex :
10.0.0.2 GE0/0/1 0x00000102
Nib ID : 0x14000002 OutLabel : 16040 OutLabelFlag: -
Flags: D-Direct, R-Added to Rib, L-Advertised in LSPs, U-Up/Down Bit Set
InLabel flags: R-Readvertisement, N-Node SID, P-no PHP
E-Explicit null, V-Value, L-Local
OutLabelFlags: E-Explicit null, I-Implicit null, N-Normal
# Display MPLS LSP information on Router A.
[RouterA] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
10.0.0.2 Local -/- GE0/0/1
1.1.1.1/32 ISIS 16010/- -
2.2.2.2/32 ISIS 16020/3 GE0/0/1
2.2.2.2/32 ISIS -/3 GE0/0/1
3.3.3.3/32 ISIS 16030/16030 GE0/0/1
3.3.3.3/32 ISIS -/16030 GE0/0/1
4.4.4.4/32 ISIS 16040/16040 GE0/0/1
4.4.4.4/32 ISIS -/16040 GE0/0/1
53
Example: Configuring SR-MPLS based on OSPF-advertised
SIDs
Network configuration
As shown in Figure 20 , Router A, Router B, Router C, and Router D are running OSPF.
Configure dynamic SID allocation on loopback interfaces of the routers. Then, establish an SRLSP from Router A to Router D based on the allocated SIDs and configure an MPLS TE tunnel over the
SRLSP to transmit data.
Figure 20 Network diagram
Loop1 Loop1 Loop1 Loop1
GE0/0/1 GE0/0/2
GE0/0/1 GE0/0/1
Router A Router B
Table 3 Interface and IP address assignment
Router C
GE0/0/2
GE0/0/1
Router D
GE0/0/2
Device
Router A
Router C
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1
Loop1
GE0/0/1
GE0/0/2
10.0.0.1/24
3.3.3.3/32
11.0.0.2/24
12.0.0.1/24
Device
Router B
Router D
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
10.0.0.2/24
11.0.0.1/24
4.4.4.4/32
12.0.0.2/24
100.1.2.1/24
Procedure
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure Router A:
# Configure OSPF to achieve network level connectivity.
<RouterA> system-view
[RouterA] ospf 1 router-id 1.1.1.1
[RouterA-ospf-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] ospf 1 area 0
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] ospf 1 area 0
[RouterA-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterA] mpls lsr-id 1.1.1.1
[RouterA] mpls te
[RouterA-te] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] mpls enable
[RouterA-GigabitEthernet0/0/1] quit
# Enable SR-MPLS.
54
[RouterA] ospf 1
[RouterA-ospf-1] segment-routing mpls
[RouterA-ospf-1] quit
# Configure the OSPF prefix SID by specifying a relative value.
[RouterA] interface loopback 1
[RouterA-LoopBack1] ospf 1 prefix-sid index 10
[RouterA-LoopBack1] quit
# Configure a static SRLSP ( static-sr-lsp-1 ) to Router D, setting the outgoing label to the prefix label that Router A allocated to Router D (16040).
[RouterA] static-sr-mpls lsp static-sr-lsp-1 out-label 16040
# Establish static MPLS TE tunnel 1 to Router D. Specify the LSR ID of Router D as the tunnel destination address and bind static SRLSP static-sr-lsp-1 to MPLS TE tunnel interface 1.
[RouterA] interface tunnel 1 mode mpls-te
[RouterA-Tunnel1] ip address 6.1.1.1 255.255.255.0
[RouterA-Tunnel1] destination 4.4.4.4
[RouterA-Tunnel1] mpls te signaling static
[RouterA-Tunnel1] mpls te static-sr-mpls static-sr-lsp-1
[RouterA-Tunnel1] quit
# Configure a static route to direct traffic destined for 100.1.2.0/24 to MPLS TE tunnel 1.
[RouterA] ip route-static 100.1.2.0 24 tunnel 1 preference 1
3. Configure Router B:
# Configure OSPF to achieve network level connectivity.
<RouterB> system-view
[RouterB] ospf 1 router-id 2.2.2.2
[RouterB-ospf-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] ospf 1 area 0
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] ospf 1 area 0
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] ospf 1 area 0
[RouterB-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterB] mpls lsr-id 2.2.2.2
[RouterB] mpls te
[RouterB-te] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] mpls enable
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterB] ospf 1
[RouterB-ospf-1] segment-routing mpls
[RouterB-ospf-1] quit
55
# Configure the OSPF prefix SID by specifying a relative value.
[RouterB] interface loopback 1
[RouterB-LoopBack1] ospf 1 prefix-sid index 20
4. Configure Router C:
# Configure OSPF to achieve network level connectivity.
<RouterC> system-view
[RouterC] ospf 1 router-id 3.3.3.3
[RouterC-ospf-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] ospf 1 area 0
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] ospf 1 area 0
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] ospf 1 area 0
[RouterC-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterC] mpls lsr-id 3.3.3.3
[RouterC] mpls te
[RouterC-te] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterC] ospf 1
[RouterC-ospf-1] segment-routing mpls
[RouterC-ospf-1] quit
# Configure the OSPF prefix SID by specifying a relative value.
[RouterC] interface loopback 1
[RouterC-LoopBack1] ospf 1 prefix-sid index 30
5. Configure Router D:
# Configure OSPF to achieve network level connectivity.
<RouterD> system-view
[RouterD] ospf 1 router-id 4.4.4.4
[RouterD-ospf-1] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] ospf 1 area 0
[RouterD-GigabitEthernet0/0/1] quit
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] ospf 1 area 0
[RouterD-GigabitEthernet0/0/2] quit
[RouterD] interface loopback 1
[RouterD-LoopBack1] ospf 1 area 0
[RouterD-LoopBack1] quit
56
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterD] mpls lsr-id 4.4.4.4
[RouterD] mpls te
[RouterD-te] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] mpls enable
[RouterD-GigabitEthernet0/0/1] quit
# Enable SR-MPLS.
[RouterD] ospf 1
[RouterD-ospf-1] segment-routing mpls
[RouterD-ospf-1] quit
# Configure the OSPF prefix SID by specifying a relative value.
[RouterD] interface loopback 1
[RouterD-LoopBack1] ospf 1 prefix-sid index 40
Verifying the configuration
# Display detailed OSPF routing information on Router A to view information about routes bound with labels.
[RouterA] display ospf routing verbose
OSPF Process 1 with Router ID 1.1.1.1
Routing Table
Topology base (MTID 0)
Routing for network
Destination: 11.0.0.0/24
Priority: Low Type: Transit
AdvRouter: 3.3.3.3 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 10.0.0.2 BkNextHop: N/A
IfType: Broadcast BkIfType: N/A
Interface: GE0/0/1 BkInterface: N/A
NibID: 0x13000005 Status: Normal
Cost: 2
InLabel: 4294967295
OutLabel: 4294967295 OutLabel flag: N
Destination: 10.0.0.0/24
Priority: Low Type: Transit
AdvRouter: 1.1.1.1 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 0.0.0.0 BkNextHop: N/A
IfType: Broadcast BkIfType: N/A
Interface: GE0/0/1 BkInterface: N/A
NibID: 0x13000001 Status: Direct
Cost: 1
InLabel: 4294967295
57
OutLabel: 4294967295 OutLabel flag: N
Destination: 4.4.4.4/32
Priority: Medium Type: Stub
AdvRouter: 4.4.4.4 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 10.0.0.2 BkNextHop: N/A
IfType: Broadcast BkIfType: N/A
Interface: GE0/0/1 BkInterface: N/A
NibID: 0x13000005 Status: Normal
Cost: 2
InLabel: 16040
OutLabel: 16040 OutLabel flag: N
Destination: 3.3.3.3/32
Priority: Medium Type: Stub
AdvRouter: 3.3.3.3 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 10.0.0.2 BkNextHop: N/A
IfType: Broadcast BkIfType: N/A
Interface: GE0/0/1 BkInterface: N/A
NibID: 0x13000005 Status: Normal
Cost: 2
InLabel: 16030
OutLabel: 16030 OutLabel flag: N
Destination: 2.2.2.2/32
Priority: Medium Type: Stub
AdvRouter: 2.2.2.2 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 10.0.0.2 BkNextHop: N/A
IfType: Broadcast BkIfType: N/A
Interface: GE0/0/1 BkInterface: N/A
NibID: 0x13000005 Status: Normal
Cost: 1
InLabel: 16020
OutLabel: 16020 OutLabel flag: N
Destination: 1.1.1.1/32
Priority: Medium Type: Stub
AdvRouter: 1.1.1.1 Area: 0.0.0.0
SubProtoID: 0x1 Preference: 10
NextHop: 0.0.0.0 BkNextHop: N/A
IfType: PTP BkIfType: N/A
Interface: Loop1 BkInterface: N/A
NibID: 0x13000002 Status: Direct
Cost: 0
InLabel: 16010
58
OutLabel: 4294967295 OutLabel flag: N
Total nets: 6
Intra area: 6 Inter area: 0 ASE: 0 NSSA: 0
# Display MPLS LSP information on Router A.
[RouterA] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
10.0.0.2 Local -/- GE0/0/1
1.1.1.1/32 OSPF 16010/- -
2.2.2.2/32 OSPF 16020/3 GE0/0/1
2.2.2.2/32 OSPF -/3 GE0/0/1
3.3.3.3/32 OSPF 16030/16030 GE0/0/1
3.3.3.3/32 OSPF -/16030 GE0/0/1
4.4.4.4/32 OSPF 16040/16040 GE0/0/1
4.4.4.4/32 OSPF -/16040 GE0/0/1
Example: Configuring an SR-based MPLS TE tunnel over an explicit path
Network configuration
As shown in Figure 21 , Router A, Router B, Router C, and Router D are running IS-IS.
Configure dynamic SID allocation on loopback interfaces of the routers. Then, create an explicit path from Router A to Router D and configure the MPLS TE tunnel interface to use SR to establish an
MPLS TE tunnel over the explicit path.
Figure 21 Network diagram
Loop1 Loop1 Loop1 Loop1
GE0/0/1 GE0/0/2
GE0/0/1 GE0/0/1
Router A Router B
Table 4 Interface and IP address assignment
Router C
GE0/0/2
GE0/0/1
Router D
GE0/0/2
Device
Router A
Router C
Prerequisites
Interface IP address
Loop1
GE0/0/1
Loop1
1.1.1.1/32
10.0.0.1/24
3.3.3.3/32
GE0/0/1
GE0/0/2
11.0.0.2/24
12.0.0.1/24
Device
Router B
Router D
Interface IP address
Loop1
GE0/0/1
GE0/0/2
Loop1
2.2.2.2/32
10.0.0.2/24
11.0.0.1/24
4.4.4.4/32
GE0/0/1
GE0/0/2
12.0.0.2/24
100.1.2.1/24
Configure IP addresses and masks for interfaces.
Procedure
1. Configure IS-IS on the routers to achieve network level connectivity and set the IS-IS cost style to wide:
59
# Configure Router A.
<RouterA> system-view
[RouterA] isis 1
[RouterA-isis-1] network-entity 00.0000.0000.0001.00
[RouterA-isis-1] cost-style wide
[RouterA-isis-1] is-level level-1
[RouterA-isis-1] mpls te enable
[RouterA-isis-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] isis enable 1
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis enable 1
[RouterA-LoopBack1] quit
# Configure Router B.
<RouterB> system-view
[RouterB] isis 1
[RouterB-isis-1] network-entity 00.0000.0000.0002.00
[RouterB-isis-1] cost-style wide
[RouterB-isis-1] is-level level-1
[RouterB-isis-1] mpls te enable
[RouterB-isis-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] isis enable 1
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] isis enable 1
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis enable 1
[RouterB-LoopBack1] quit
# Configure Router C.
<RouterC> system-view
[RouterC] isis 1
[RouterC-isis-1] network-entity 00.0000.0000.0003.00
[RouterC-isis-1] cost-style wide
[RouterC-isis-1] is-level level-1
[RouterC-isis-1] mpls te enable
[RouterC-isis-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] isis enable 1
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] isis enable 1
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis enable 1
[RouterC-LoopBack1] quit
60
# Configure Router D.
<RouterD> system-view
[RouterD] isis 1
[RouterD-isis-1] network-entity 00.0000.0000.0004.00
[RouterD-isis-1] cost-style wide
[RouterD-isis-1] is-level level-1
[RouterD-isis-1] mpls te enable
[RouterD-isis-1] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] isis enable 1
[RouterD-GigabitEthernet0/0/1] quit
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] isis enable 1
[RouterD-GigabitEthernet0/0/2] quit
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis enable 1
[RouterD-LoopBack1] quit
2. Configure LSR IDs, and enable MPLS and MPLS TE:
# Configure Router A.
[RouterA] mpls lsr-id 1.1.1.1
[RouterA] mpls te
[RouterA-te] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] mpls enable
[RouterA-GigabitEthernet0/0/1] quit
# Configure Router B.
[RouterB] mpls lsr-id 2.2.2.2
[RouterB] mpls te
[RouterB-te] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] mpls enable
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] quit
# Configure Router C.
[RouterC] mpls lsr-id 3.3.3.3
[RouterC] mpls te
[RouterC-te] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] quit
# Configure Router D.
[RouterD] mpls lsr-id 4.4.4.4
[RouterD] mpls te
61
[RouterD-te] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] mpls enable
[RouterD-GigabitEthernet0/0/1] quit
3. Enable SR-MPLS on the routers:
# Configure Router A.
[RouterA] isis 1
[RouterA-isis-1] address-family ipv4
[RouterA-isis-1-ipv4] segment-routing mpls
[RouterA-isis-1-ipv4] quit
[RouterA-isis-1] quit
# Configure Router B.
[RouterB] isis 1
[RouterB-isis-1] address-family ipv4
[RouterB-isis-1-ipv4] segment-routing mpls
[RouterB-isis-1-ipv4] quit
[RouterB-isis-1] quit
# Configure Router C.
[RouterC] isis 1
[RouterC-isis-1] address-family ipv4
[RouterC-isis-1-ipv4] segment-routing mpls
[RouterC-isis-1-ipv4] quit
[RouterC-isis-1] quit
# Configure Router D.
[RouterD] isis 1
[RouterD-isis-1] address-family ipv4
[RouterD-isis-1-ipv4] segment-routing mpls
[RouterD-isis-1-ipv4] quit
[RouterD-isis-1] quit
4. Configure IS-IS prefix SIDs for the routers:
# Configure Router A.
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis prefix-sid index 10
[RouterA-LoopBack1] quit
# Configure Router B.
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis prefix-sid index 20
[RouterB-LoopBack1] quit
# Configure Router C.
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis prefix-sid index 30
[RouterC-LoopBack1] quit
# Configure Router D.
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis prefix-sid index 40
[RouterD-LoopBack1] quit
5. Configure an explicit path on Router A.
62
# Create an explicit path to Router D and specify the nodes by their prefix labels.
[RouterA] explicit-path 1
[RouterA-explicit-path-1] nextsid label 16020 type prefix
[RouterA-explicit-path-1] nextsid label 16030 type prefix
[RouterA-explicit-path-1] nextsid label 16040 type prefix
[RouterA-explicit-path-1] quit
6. Configure an MPLS TE tunnel on Router A:
# Configure MPLS TE tunnel interface Tunnel 1.
[RouterA] interface tunnel 1 mode mpls-te
[RouterA-Tunnel1] ip address unnumbered interface LoopBack 1
# Set the tunnel destination address to the IP address of the loopback interface on Router D.
[RouterA-Tunnel1] destination 4.4.4.4
# Configure the MPLS TE tunnel interface to use SR to establish a tunnel over the explicit path.
[RouterA-Tunnel1] mpls te signaling segment-routing
[RouterA-Tunnel1] mpls te path preference 1 explicit-path 1
[RouterA-Tunnel1] quit
Verifying the configuration
# Display MPLS LSP information on Router A.
[RouterA] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
10.0.0.2 Local -/- GE0/0/1
Tunnel1 Local -/- NHLFE6
1.1.1.1/32 ISIS 16010/- -
2.2.2.2/32 ISIS 16020/3 GE0/0/1
2.2.2.2/32 ISIS -/3 GE0/0/1
3.3.3.3/32 ISIS 16030/16030 GE0/0/1
3.3.3.3/32 ISIS -/16030 GE0/0/1
4.4.4.4/32 ISIS 16040/16040 GE0/0/1
4.4.4.4/32 ISIS -/16040 GE0/0/1
1.1.1.1/1/17700 SR-TE -/16030 GE0/0/1
16040
# Display the NHLFE entry information.
[RouterA] display mpls forwarding nhlfe
Total NHLFE entries: 3
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
B - Backup forwarding information
A - Active forwarding information
M - P2MP forwarding information
NID Tnl-Type Flag OutLabel Forwarding Info
--------------------------------------------------------------------------------
5 LOCAL NA - GE0/0/1 10.0.0.2
6 SRLSP NA 16030 GE0/0/1 10.0.0.2
16040
268435457 TE TA - 6
63
The output shows that there are two tiers of outgoing labels to the destination. The traffic is forwarded through the explicit path.
Example: Configuring an MPLS TE tunnel over a
PCE-calculated SRLSP
Network configuration
As shown in Figure 22 , Router A, Router B, Router C, and Router D are running IS-IS.
Configure Router B, Router C, and Router D as PCEs. Configure Router A as a PCC and specify the
PCEs for the PCC. Configure Router A to request the PCEs to calculate the path to Router D.
Figure 22 Network diagram
Loop1 Loop1 Loop1 Loop1
GE0/0/1 GE0/0/2
GE0/0/1 GE0/0/1
Router A Router B
Table 5 Interface and IP address assignment
Router C
GE0/0/2
GE0/0/1
Router D
GE0/0/2
Device
Router A
Router C
Procedure
Interface IP address
Loop1
GE0/0/1
Loop1
1.1.1.1/32
10.0.0.1/24
3.3.3.3/32
GE0/0/1
GE0/0/2
11.0.0.2/24
12.0.0.1/24
Device
Router B
Router D
Interface IP address
Loop1
GE0/0/1
GE0/0/2
Loop1
2.2.2.2/32
10.0.0.2/24
11.0.0.1/24
4.4.4.4/32
GE0/0/1
GE0/0/2
12.0.0.2/24
100.1.2.1/24
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure Router A:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterA> system-view
[RouterA] isis 1
[RouterA-isis-1] network-entity 00.0000.0000.0001.00
[RouterA-isis-1] cost-style wide
[RouterA-isis-1] mpls te enable
[RouterA-isis-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] isis enable 1
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis enable 1
[RouterA-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterA] mpls lsr-id 1.1.1.1
[RouterA] mpls te
64
[RouterA-te] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] mpls enable
[RouterA-GigabitEthernet0/0/1] mpls te enable
[RouterA-GigabitEthernet0/0/1] quit
# Enable SR-MPLS.
[RouterA] isis 1
[RouterA-isis-1] address-family ipv4
[RouterA-isis-1-ipv4] segment-routing mpls
[RouterA-isis-1-ipv4] quit
[RouterA-isis-1] quit
# Configure Router A as a PCC and specify the PCEs.
[RouterA] mpls te
[RouterA-te] pcep type active-stateful
[RouterA-te] pce static 2.2.2.2
[RouterA-te] pce static 3.3.3.3
[RouterA-te] pce static 4.4.4.4
[RouterA-te] quit
# Configure MPLS TE tunnel interface Tunnel 1.
[RouterA] interface tunnel 1 mode mpls-te
[RouterA-Tunnel1] ip address unnumbered interface LoopBack1
# Configure the MPLS TE tunnel interface to use SR and stateful PCE to establish the tunnel over the SRLSP calculated in PCE delegation mode.
[RouterA-Tunnel1] mpls te signaling segment-routing
[RouterA-Tunnel1] mpls te delegation
[RouterA-Tunnel1] destination 4.4.4.4
[RouterA-Tunnel1] quit
3. Configure Router B:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterB> system-view
[RouterB] isis 1
[RouterB-isis-1] network-entity 00.0000.0000.0002.00
[RouterB-isis-1] cost-style wide
[RouterB-isis-1] mpls te enable
[RouterB-isis-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] isis enable 1
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] isis enable 1
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis enable 1
[RouterB-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterB] mpls lsr-id 2.2.2.2
[RouterB] mpls te
[RouterB-te] quit
65
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] mpls enable
[RouterB-GigabitEthernet0/0/1] mpls te enable
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] mpls te enable
[RouterB-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterB] isis 1
[RouterB-isis-1] address-family ipv4
[RouterB-isis-1-ipv4] segment-routing mpls
[RouterB-isis-1-ipv4] quit
[RouterB-isis-1] quit
# Configure Router B as a PCE.
[ RouterB ] mpls te
[ RouterB-te ] pce address 2.2.2.2
4. Configure Router C:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterC> system-view
[RouterC] isis 1
[RouterC-isis-1] network-entity 00.0000.0000.0003.00
[RouterC-isis-1] cost-style wide
[RouterC-isis-1] mpls te enable
[RouterC-isis-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] isis enable 1
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] isis enable 1
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis enable 1
[RouterC-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterC] mpls lsr-id 3.3.3.3
[RouterC] mpls te
[RouterC-te] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] mpls te enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] mpls te enable
[RouterC-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterC] isis 1
66
[RouterC-isis-1] address-family ipv4
[RouterC-isis-1-ipv4] segment-routing mpls
[RouterC-isis-1-ipv4] quit
[RouterC-isis-1] quit
# Configure Router C as a PCE.
[ RouterC ] mpls te
[ RouterC-te ] pce address 3.3.3.3
5. Configure Router D:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterD> system-view
[RouterD] isis 1
[RouterD-isis-1] network-entity 00.0000.0000.0004.00
[RouterD-isis-1] cost-style wide
[RouterD-isis-1] mpls te enable
[RouterD-isis-1] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] isis enable 1
[RouterD-GigabitEthernet0/0/1] quit
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] isis enable 1
[RouterD-GigabitEthernet0/0/2] quit
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis enable 1
[RouterD-LoopBack1] quit
# Configure the LSR ID, and enable MPLS and MPLS TE.
[RouterD] mpls lsr-id 4.4.4.4
[RouterD] mpls te
[RouterD-te] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] mpls enable
[RouterD-GigabitEthernet0/0/1] mpls te enable
[RouterD-GigabitEthernet0/0/1] quit
# Enable SR-MPLS.
[RouterD] isis 1
[RouterD-isis-1] address-family ipv4
[RouterD-isis-1-ipv4] segment-routing mpls
[RouterD-isis-1-ipv4] quit
[RouterD-isis-1] quit
# Configure Router D as a PCE.
[ RouterD ] mpls te
[ RouterD-te ] pce address 4.4.4.4
Verifying the configuration
# Display discovered PCEs on each router. This example uses Router A.
[RouterA] display mpls te pce discovery verbose
PCE address: 2.2.2.2
Discovery methods: Static
Path scopes:
67
Path scope Preference
Compute intra-area paths 7
Act as PCE for inter-area TE LSP computation 6
Capabilities:
Bidirectional path computation
Support for request prioritization
Support for multiple requests per message
PCE address: 3.3.3.3
Discovery methods: Static
Path scopes:
Path scope Preference
Compute intra-area paths 7
Act as PCE for inter-area TE LSP computation 6
Capabilities:
Bidirectional path computation
Support for request prioritization
Support for multiple requests per message
PCE address: 4.4.4.4
Discovery methods: Static
Path scopes:
Path scope Preference
Compute intra-area paths 7
Act as PCE for inter-area TE LSP computation 6
Capabilities:
Bidirectional path computation
Support for request prioritization
Support for multiple requests per message
# Verify that PCEP sessions have been established on each router. This example uses Router A.
[RouterA] display mpls te pce peer verbose
Peer address: 2.2.2.2
TCP connection : 1.1.1.1:36818 -> 2.2.2.2:4189
Peer type : PCE
Session type : Stateless
Session state : UP
Mastership : Normal
Role : Active
Session up time : 0000 days 00 hours 15 minutes
Session ID : Local 0, Peer 0
Keepalive interval : Local 30 sec, Peer 30 sec
Recommended DeadTimer : Local 120 sec, Peer 120 sec
Tolerance:
Min keepalive interval : 10 sec
Max unknown messages : 5
Request timeout : 10 sec
Capability for Initiate : No
Capability for Segment-Routing: No
68
Peer address: 3.3.3.3
TCP connection : 1.1.1.1:36821 -> 3.3.3.3:4189
Peer type : PCE
Session type : Stateless
Session state : UP
Mastership : Normal
Role : Active
Session up time : 0000 days 00 hours 13 minutes
Session ID : Local 1, Peer 0
Keepalive interval : Local 30 sec, Peer 30 sec
Recommended DeadTimer : Local 120 sec, Peer 120 sec
Tolerance:
Min keepalive interval : 10 sec
Max unknown messages : 5
Request timeout : 10 sec
Capability for Initiate : No
Capability for Segment-Routing: No
Peer address: 4.4.4.4
TCP connection : 1.1.1.1:36822 -> 4.4.4.4:4189
Peer type : PCE
Session type : Stateless
Session state : UP
Mastership : Normal
Role : Active
Session up time : 0000 days 00 hours 13 minutes
Session ID : Local 2, Peer 0
Keepalive interval : Local 30 sec, Peer 30 sec
Recommended DeadTimer : Local 120 sec, Peer 120 sec
Tolerance:
Min keepalive interval : 10 sec
Max unknown messages : 5
Request timeout : 10 sec
Capability for Initiate : No
Capability for Segment-Routing: No
Example: Configuring SR-MPLS inter-AS option B
Network configuration
As shown in Figure 23 , complete the following tasks:
•
Start OSPF and enable OSPF-based SR-MPLS on the PEs in the same AS.
•
Establish an MPLS TE tunnel between ASBR-PEs in different ASs and enable BGP EPE.
•
Configure PE 1 and ASBR-PE 1 to exchange VPNv4 routes through MP IBGP.
•
Configure PE 2 and ASBR-PE 2 to exchange VPNv4 routes through MP IBGP.
•
Establish an MP-EBGP peer relationship between ASBR-PE 1 and ASBR-PE 2 to exchange
VPNv4 routes.
69
•
Disable route target-based filtering of received VPNv4 routes on ASBR-PE 1 and ASBR-PE 2.
•
Configure dynamic SID allocation on loopback interfaces of the devices. Then, establish an
SRLSP based on the allocated SIDs and configure an MPLS TE tunnel over the SRLSP to transmit data.
Figure 23 Network diagram
MPLS backbone
AS 100
Loop1
GE0/0/4
Loop1
GE0/0/5
ASBR-PE 1
Loop1 MPLS backbone
AS 600
GE0/0/4
ASBR-PE 2
GE0/0/5
Loop1
GE0/0/5 GE0/0/5
PE 1
PE 2
GE0/0/1 GE0/0/1
Site 1 Site 2
CE 1
AS 65001
Table 6 Interface and IP address assignment
AS 65002
CE 2
Device
PE 1
Interface IP address
Loop1 2.2.2.9/32
GE0/0/1
GE0/0/5
ASBR-PE 1 Loop1
GE0/0/5
GE0/0/4
30.0.0.1/24
1.1.1.2/8
3.3.3.9/32
1.1.1.1/8
11.0.0.2/8
Device
PE 2
Interface IP address
Loop1 5.5.5.9/32
GE0/0/1
GE0/0/5
ASBR-PE 2 Loop1
GE0/0/5
GE0/0/4
20.0.0.1/24
9.1.1.2/8
4.4.4.9/32
9.1.1.1/8
11.0.0.1/8
Procedure
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure PE 1:
# Start OSPF on PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<PE1> system-view
[PE1] ospf 1 router-id 2.2.2.9
[PE1-ospf-1] quit
[PE1] interface gigabitethernet 0/0/5
[PE1-GigabitEthernet0/0/5] ip address 1.1.1.2 255.0.0.0
[PE1-GigabitEthernet0/0/5] ospf 1 area 0
[PE1-GigabitEthernet0/0/5] mpls enable
[PE1-GigabitEthernet0/0/5] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ip address 2.2.2.9 32
[PE1-LoopBack1] ospf 1 area 0
70
[PE1-LoopBack1] quit
[PE1] mpls lsr-id 2.2.2.9
[PE1] mpls te
[PE1-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE1] ospf 1
[PE1-ospf-1] segment-routing mpls
[PE1-ospf-1] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ospf 1 prefix-sid index 20
[PE1-LoopBack1] quit
# Create VPN instance vpn1 , and configure the RD and route target attributes.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 11:11
[PE1-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE1-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE1-vpn-instance-vpn1] quit
# Associate GigabitEthernet 0/0/1 with VPN instance vpn1 , and assign an IP address to the interface.
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 30.0.0.1 24
[PE1-GigabitEthernet0/0/1] quit
# Start BGP on PE 1.
[PE1] bgp 100
# Configure peer 3.3.3.9 as a VPNv4 peer.
[PE1-bgp-default] peer 3.3.3.9 as-number 100
[PE1-bgp-default] peer 3.3.3.9 connect-interface loopback 1
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3.3.3.9 enable
[PE1-bgp-default-vpnv4] quit
# Redistribute direct routes to the VPN routing table of vpn1 .
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] import-route direct
3. Configure ASBR-PE 1:
# Start OSPF on ASBR-PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE1> system-view
[ASBR-PE1] ospf 1 router-id 3.3.3.9
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface gigabitethernet 0/0/4
[ASBR-PE1-GigabitEthernet0/0/4] mpls enable
[ASBR-PE1-GigabitEthernet0/0/4] quit
[ASBR-PE1] interface gigabitethernet 0/0/5
[ASBR-PE1-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE1-GigabitEthernet0/0/5] mpls enable
[ASBR-PE1-GigabitEthernet0/0/5] quit
[ASBR-PE1] interface loopback 1
71
[ASBR-PE1-LoopBack1] ip address 3.3.3.9 32
[ASBR-PE1-LoopBack1] ospf 1 area 0
[ASBR-PE1-LoopBack1] quit
[ASBR-PE1] mpls lsr-id 3.3.3.9
[ASBR-PE1] mpls te
[ASBR-PE1-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE1] ospf 1
[ASBR-PE1-ospf-1] segment-routing mpls
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ospf 1 prefix-sid index 30
[ASBR-PE1-LoopBack1] quit
# Create a routing policy to assign a label.
[ASBR-PE1] route-policy epe permit node 1
[ASBR-PE1-route-policy-epe-1] apply label-value 245555
[ASBR-PE1-route-policy-epe-1] quit
# Start BGP on ASBR-PE 1.
[ASBR-PE1] bgp 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 as-number 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 connect-interface loopback 1
[ASBR-PE1-bgp-default] peer 11.0.0.1 as-number 600
[ASBR-PE1-bgp-default] peer 11.0.0.1 connect-interface gigabitethernet 0/0/4
# Disable route target-based filtering of received VPNv4 routes.
[ASBR-PE1-bgp-default] address-family vpnv4
[ASBR-PE1-bgp-default-vpnv4] undo policy vpn-target
# Configure IBGP peer 2.2.2.9 and EBGP peer 11.0.0.1 as a VPNv4 peer.
[ASBR-PE1-bgp-default-vpnv4] peer 11.0.0.1 enable
[ASBR-PE1-bgp-default-vpnv4] peer 2.2.2.9 enable
[ASBR-PE1-bgp-default-vpnv4] quit
# Enable BGP EPE for EBGP neighbor 11.0.0.1 and specify a routing policy to assign a label to the neighbor.
[ASBR-PE1-bgp-default] peer 11.0.0.1 egress-engineering route-policy epe
[ASBR-PE1-bgp-default] quit
[ASBR-PE1-bgp] quit
4. Configure ASBR-PE 2:
# Start OSPF on ASBR-PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE2> system-view
[ASBR-PE2] ospf 1 router-id 4.4.4.9
[ASBR-PE2-ospf-1] quit
[ASBR-PE2] interface gigabitethernet 0/0/4
[ASBR-PE2-GigabitEthernet0/0/4] mpls enable
[ASBR-PE2-GigabitEthernet0/0/4] quit
[ASBR-PE2] interface gigabitethernet 0/0/5
[ASBR-PE2-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE2-GigabitEthernet0/0/5] mpls enable
[ASBR-PE2-GigabitEthernet0/0/5] quit
[ASBR-PE2] interface loopback 1
72
[ASBR-PE2-LoopBack1] ip address 4.4.4.9 32
[ASBR-PE2-LoopBack1] ospf 1 area 0
[ASBR-PE2-LoopBack1] quit
[ASBR-PE2] mpls lsr-id 4.4.4.9
[ASBR-PE2] mpls te
[ASBR-PE2-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE1] ospf 1
[ASBR-PE1-ospf-1] segment-routing mpls
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ospf 1 prefix-sid index 40
[ASBR-PE1-LoopBack1] quit
# Create a routing policy to assign a label.
[ASBR-PE2] route-policy epe permit node 1
[ASBR-PE2-route-policy-epe-1] apply label-value 6666
[ASBR-PE2-route-policy-epe-1] quit
# Start BGP on ASBR-PE 2.
[ASBR-PE2] bgp 600
[ASBR-PE2-bgp-default] peer 5.5.5.9 as-number 600
[ASBR-PE2-bgp-default] peer 5.5.5.9 connect-interface loopback 1
[ASBR-PE2-bgp-default] peer 11.0.0.2 as-number 100
[ASBR-PE2-bgp-default] peer 11.0.0.2 connect-interface gigabitethernet 0/0/4
# Disable route target-based filtering of received VPNv4 routes.
[ASBR-PE2-bgp-default] address-family vpnv4
[ASBR-PE2-bgp-default-vpnv4] undo policy vpn-target
# Configure IBGP peer 5.5.5.9 and EBGP peer 11.0.0.2 as a VPNv4 peer.
[ASBR-PE2-bgp-default-vpnv4] peer 11.0.0.2 enable
[ASBR-PE2-bgp-default-vpnv4] peer 5.5.5.9 enable
[ASBR-PE2-bgp-default-vpnv4] quit
# Enable BGP EPE for EBGP neighbor 11.0.0.2 and specify a routing policy to assign a label to the neighbor.
[ASBR-PE2-bgp-default] peer 11.0.0.2 egress-engineering route-policy epe
5. Configure PE 2:
# Start OSPF on PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<PE2> system-view
[PE2] ospf 1 router-id 5.5.5.9
[PE2-ospf-1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ospf 1 area 0
[PE2-GigabitEthernet0/0/1] mpls enable
[PE2-GigabitEthernet0/0/1] quit
[PE2] interface gigabitethernet 0/0/5
[PE2-GigabitEthernet0/0/5] ospf 1 area 0
[PE2-GigabitEthernet0/0/5] mpls enable
[PE2-GigabitEthernet0/0/5] quit
[PE2] interface loopback 1
[PE2-LoopBack1] ip address 5.5.5.9 32
73
[PE2-LoopBack1] ospf 1 area 0
[PE2-LoopBack1] quit
[PE2] mpls lsr-id 5.5.5.9
[PE2] mpls te
[PE2-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE2] ospf 1
[PE2-ospf-1] segment-routing mpls
[PE2] interface loopback 1
[PE2-LoopBack1] ospf 1 prefix-sid index 50
[PE2-LoopBack1] quit
# Create VPN instance vpn1 , and configure the RD and route target attributes.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 11:11
[PE2-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE2-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE2-vpn-instance-vpn1] quit
# Associate GigabitEthernet 0/0/1 with VPN instance vpn1 , and assign an IP address to the interface.
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 20.0.0.1 24
[PE2-GigabitEthernet0/0/1] quit
# Start BGP on PE 2.
[PE2] bgp 600
# Configure IBGP peer 4.4.4.9 as a VPNv4 peer.
[PE2-bgp-default] peer 4.4.4.9 as-number 600
[PE2-bgp-default] peer 4.4.4.9 connect-interface loopback 1
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 4.4.4.9 enable
[PE2-bgp-default-vpnv4] quit
# Redistribute direct routes to the VPN routing table of vpn1 .
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] import-route direct
6. Configuring an MPLS TE tunnel:
# Configure ASBR-PE 1 as the ingress node of static SRLSP static-sr-lsp-1 and specify the label that ASBR-PE 1 allocated to ASBR-PE 2 (245555) as the outgoing label.
<ASBR-PE1> system-view
[ASBR-PE1] static-sr-mpls lsp static-sr-lsp-1 out-label 245555
# On ASBR-PE 1, establish static MPLS TE tunnel 1 to ASBR-PE 2. Specify the IP address
(11.0.0.1) of the directly connected interface on ASBR-PE 2 as the tunnel destination address.
Bind static SRLSP static-sr-lsp-1 to MPLS TE tunnel interface 1.
[ASBR-PE1] interface tunnel 1 mode mpls-te
[ASBR-PE1-Tunnel1] ip address 6.1.1.1 255.255.255.0
[ASBR-PE1-Tunnel1] destination 11.0.0.1
[ASBR-PE1-Tunnel1] mpls te signaling static
[ASBR-PE1-Tunnel1] mpls te static-sr-mpls static-sr-lsp-1
74
[ASBR-PE1-Tunnel1] quit
# Configure ASBR-PE 2 as the ingress node of static SRLSP static-sr-lsp-2 and specify the label that ASBR-PE 2 allocated to ASBR-PE 1 (6666) as the outgoing label.
<ASBR-PE2> system-view
[ASBR-PE2] static-sr-mpls lsp static-sr-lsp-2 out-label 6666
# On ASBR-PE 2, establish static MPLS TE tunnel 1 to ASBR-PE 1. Specify the IP address
(11.0.0.2) of the directly connected interface on ASBR-PE 1 as the tunnel destination address.
Bind static SRLSP static-sr-lsp-2 to MPLS TE tunnel interface 1.
[ASBR-PE2] interface tunnel 1 mode mpls-te
[ASBR-PE2-Tunnel1] ip address 7.1.1.1 255.255.255.0
[ASBR-PE2-Tunnel1] destination 11.0.0.2
[ASBR-PE2-Tunnel1] mpls te signaling static
[ASBR-PE2-Tunnel1] mpls te static-sr-mpls static-sr-lsp-2
[ASBR-PE2-Tunnel1] quit
Verifying the configuration
# Execute the display ip routing-table command on CE 1 and CE 2 to verify that they have a route to each other. (Details not shown.)
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
# Display MPLS LSP information on ASBR-PE1.
[ASBR-PE1] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
3.3.3.9/1/53168 StaticCR -/- NHLFE1
11.0.0.1 BGP -/- GE0/0/4
2.2.2.9/1151 BGP 1151/1151 -
11.0.0.1/1149 BGP 1150/1149 -
11.0.0.1 BGP 245555/- NHLFE1
1.1.1.2 Local -/- GE0/0/5
11.0.0.1 Local -/- GE0/0/4
Tunnel1 Local -/- NHLFE4
2.2.2.9/32 OSPF 16020/3 GE0/0/5
2.2.2.9/32 OSPF -/3 GE0/0/5
3.3.3.9/32 OSPF 16030/- -
Example: Configuring SR-MPLS inter-AS option C (I)
Network configuration
As shown in Figure 24 , complete the following tasks:
•
Start OSPF and enable OSPF-based SR-MPLS on the PEs in the same AS.
•
Configure PE 1 and ASBR-PE 1 to exchange labeled IPv4 routes through IBGP.
•
Configure PE 2 and ASBR-PE 2 to exchange labeled IPv4 routes through IBGP.
•
Establish an MP-EBGP peer relationship between PE 1 and PE 2 to exchange VPNv4 routes.
•
Configure ASBR-PE 1 and ASBR-PE 2 to exchange labeled IPv4 routes through EBGP. Enable
BGP-based SR-MPLS.
•
Configure dynamic SID allocation on loopback interfaces of the devices. Then, establish an
SRLSP based on the allocated SIDs and configure an MPLS TE tunnel over the SRLSP to transmit data.
75
Figure 24 Network diagram
Loop1 MPLS backbone
AS 100
GE0/0/4
Loop1
GE0/0/5
ASBR-PE 1
Loop1 MPLS backbone
AS 600
GE0/0/4
ASBR-PE 2
GE0/0/5
Loop1
GE0/0/5
PE 1
GE0/0/1
MP-EBGP
GE0/0/1
Site 1
CE 1
Table 7 Interface and IP address assignment
GE0/0/5
PE 2
GE0/0/1
GE0/0/1
Site 2
CE 2
Device
PE 1
Interface IP address
Loop1
GE0/0/1
GE0/0/5
ASBR-PE 1 Loop1
GE0/0/5
GE0/0/4
CE 1 GE0/0/1
2.2.2.9/32
30.0.0.1/24
1.1.1.2/8
3.3.3.9/32
1.1.1.1/8
11.0.0.2/8
30.0.0.2/24
Procedure
Device
PE 2
Interface IP address
Loop1
GE0/0/1
GE0/0/5
ASBR-PE 2 Loop1
CE 2
GE0/0/5
GE0/0/4
GE0/0/1
5.5.5.9/32
20.0.0.1/24
9.1.1.2/8
4.4.4.9/32
9.1.1.1/8
11.0.0.1/8
20.0.0.2/24
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure CE 1:
# Assign an IP address to interface GigabitEthernet 0/0/1.
<CE1> system-view
[CE1] interface gigabitethernet 0/0/1
[CE1-GigabitEthernet0/0/1] ip address 30.0.0.2 24
[CE1-GigabitEthernet0/0/1] quit
# Configure PE 1 as an EBGP peer and redistribute the VPN route.
[CE1] bgp 65001
[CE1-bgp-default] peer 30.0.0.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 30.0.0.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
3. Configure PE 1:
# Start OSPF on PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<PE1> system-view
76
[PE1] ospf 1 router-id 2.2.2.9
[PE1-ospf-1] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] mpls enable
[PE1-GigabitEthernet0/0/1] quit
[PE1] interface gigabitethernet 0/0/5
[PE1-GigabitEthernet0/0/5] ospf 1 area 0
[PE1-GigabitEthernet0/0/5] mpls enable
[PE1-GigabitEthernet0/0/5] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ip address 2.2.2.9 32
[PE1-LoopBack1] ospf 1 area 0
[PE1-LoopBack1] quit
[PE1] mpls lsr-id 2.2.2.9
[PE1] mpls te
[PE1-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE1] ospf 1
[PE1-ospf-1] segment-routing mpls
[PE1-ospf-1] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ospf 1 prefix-sid index 20
[PE1-LoopBack1] quit
# Create VPN instance vpn1 . Configure an RD and both import and export route targets for the
VPN instance.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 11:11
[PE1-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE1-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE1-vpn-instance-vpn1] quit
# Bind VPN instance vpn1 to interface GigabitEthernet 0/0/1 and assign an IP address to the interface.
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 30.0.0.1 24
[PE1-GigabitEthernet0/0/1] quit
# Start BGP on PE 1.
[PE1] bgp 100
# Enable the capability to exchange labeled routes with IBGP peer 3.3.3.9.
[PE1-bgp-default] peer 3.3.3.9 as-number 100
[PE1-bgp-default] peer 3.3.3.9 connect-interface loopback 1
[PE1-bgp-default] address-family ipv4 unicast
[PE1-bgp-default-ipv4] peer 3.3.3.9 enable
[PE1-bgp-default-ipv4] peer 3.3.3.9 label-route-capability
# Enable SR-MPLS.
[PE1-bgp-default-ipv4] segment-routing mpls
[PE1-bgp-default-ipv4] quit
# Configure the maximum number of hops from PE 1 to EBGP peer 5.5.5.9 as 10.
77
[PE1-bgp-default] peer 5.5.5.9 as-number 600
[PE1-bgp-default] peer 5.5.5.9 connect-interface loopback 1
[PE1-bgp-default] peer 5.5.5.9 ebgp-max-hop 10
# Configure peer 5.5.5.9 as a VPNv4 peer.
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 5.5.5.9 enable
[PE1-bgp-default-vpnv4] quit
# Configure CE 1 as an EBGP peer of PE 1 and install the learned BGP routes in the routing table of the VPN instance.
[PE1-bgp-default] address-family vpnv4
4. Configure ASBR-PE 1:
# Start OSPF on ASBR-PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE1> system-view
[ASBR-PE1] ospf 1 router-id 3.3.3.9
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface gigabitethernet 0/0/4
[ASBR-PE1-GigabitEthernet0/0/4] mpls enable
[ASBR-PE1-GigabitEthernet0/0/4] quit
[ASBR-PE1] interface gigabitethernet 0/0/5
[ASBR-PE1-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE1-GigabitEthernet0/0/5] mpls enable
[ASBR-PE1-GigabitEthernet0/0/5] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ip address 3.3.3.9 32
[ASBR-PE1-LoopBack1] ospf 1 area 0
[ASBR-PE1-LoopBack1] quit
[ASBR-PE1] mpls lsr-id 3.3.3.9
[ASBR-PE1] mpls te
[ASBR-PE1-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE1] ospf 1
[ASBR-PE1-ospf-1] segment-routing mpls
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ospf 1 prefix-sid index 30
[ASBR-PE1-LoopBack1] quit
# Create a routing policy and specify a label index value.
[ASBR-PE1]ip prefix-list 1 permit 2.2.2.9 32
[ASBR-PE1]route-policy policy1 permit node 1
[ASBR-PE1-route-policy-policy1-1] if-match ip address prefix-list 1
[ASBR-PE1-route-policy-policy1-1] apply label-index 20
[ASBR-PE1-route-policy-policy1-1] quit
# Start BGP on ASBR-PE 1. Enable the capability to exchange labeled routes with IBGP peer
2.2.2.9.
[ASBR-PE1] bgp 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 as-number 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 connect-interface loopback 1
[ASBR-PE1-bgp-default] address-family ipv4 unicast
78
[ASBR-PE1-bgp-default-ipv4] peer 2.2.2.9 enable
[ASBR-PE1-bgp-default-ipv4] peer 2.2.2.9 label-route-capability
# Redistribute routes from OSPF process 1 to BGP and apply the routing policy.
[ASBR-PE1-bgp-default-ipv4] import-route ospf 1 route-policy policy1
# Enable SR-MPLS.
[ASBR-PE1-bgp-default-ipv4] segment-routing mpls
[ASBR-PE1-bgp-default-ipv4] quit
# Enable the capability to exchange labeled routes with EBGP peer 11.0.0.1.
[ASBR-PE1-bgp-default] peer 11.0.0.1 as-number 600
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] peer 11.0.0.1 enable
[ASBR-PE1-bgp-default-ipv4] peer 11.0.0.1 label-route-capability
5. Configure ASBR-PE 2:
# Start OSPF on ASBR-PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE2> system-view
[ASBR-PE2] ospf 1 router-id 4.4.4.9
[ASBR-PE2-ospf-1] quit
[ASBR-PE2] interface gigabitethernet 0/0/4
[ASBR-PE2-GigabitEthernet0/0/4] mpls enable
[ASBR-PE2-GigabitEthernet0/0/4] quit
[ASBR-PE2] interface gigabitethernet 0/0/5
[ASBR-PE2-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE2-GigabitEthernet0/0/5] mpls enable
[ASBR-PE2-GigabitEthernet0/0/5] quit
[ASBR-PE2] interface loopback 1
[ASBR-PE2-LoopBack1] ip address 4.4.4.9 32
[ASBR-PE2-LoopBack1] ospf 1 area 0
[ASBR-PE2-LoopBack1] quit
[ASBR-PE2] mpls lsr-id 4.4.4.9
[ASBR-PE2] mpls te
[ASBR-PE2-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE2] ospf 1
[ASBR-PE2-ospf-1] segment-routing mpls
[ASBR-PE2-ospf-1] quit
[ASBR-PE2] interface loopback 1
[ASBR-PE2-LoopBack1] ospf 1 prefix-sid index 40
[ASBR-PE2-LoopBack1] quit
# Create a routing policy and specify a label index value.
[ASBR-PE2]ip prefix-list 1 permit 5.5.5.9 32
[ASBR-PE2] route-policy policy1 permit node 1
[ASBR-PE2-route-policy-policy1-1] if-match ip address prefix-list 1
[ASBR-PE2-route-policy-policy1-1] apply label-index 50
[ASBR-PE2-route-policy-policy1-1] quit
# Start BGP on ASBR-PE 2. Enable the capability to exchange labeled routes with IBGP peer
5.5.5.9.
[ASBR-PE2] bgp 600
[ASBR-PE2-bgp-default] peer 5.5.5.9 as-number 600
79
[ASBR-PE2-bgp-default] peer 5.5.5.9 connect-interface loopback 1
[ASBR-PE2-bgp-default] address-family ipv4 unicast
[ASBR-PE2-bgp-default-ipv4] peer 5.5.5.9 enable
[ASBR-PE2-bgp-default-ipv4] peer 5.5.5.9 label-route-capability
# Redistribute routes from OSPF process 1 to BGP and apply the routing policy.
[ASBR-PE2-bgp-default-ipv4] import-route ospf 1 route-policy policy1
# Enable SR-MPLS.
[ASBR-PE2-bgp-default-ipv4] segment-routing mpls
[ASBR-PE2-bgp-default-ipv4] quit
# Enable the capability to exchange labeled routes with EBGP peer 11.0.0.2.
[ASBR-PE2-bgp-default] peer 11.0.0.2 as-number 100
[ASBR-PE2-bgp-default] address-family ipv4 unicast
[ASBR-PE2-bgp-default-ipv4] peer 11.0.0.2 enable
[ASBR-PE2-bgp-default-ipv4] peer 11.0.0.2 label-route-capability
6. Configure PE 2:
# Start OSPF on PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<PE2> system-view
[PE2] ospf 1 router-id 5.5.5.9
[PE2-ospf-1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] mpls enable
[PE2-GigabitEthernet0/0/1] quit
[PE2] interface gigabitethernet 0/0/5
[PE2-GigabitEthernet0/0/5] ospf 1 area 0
[PE2-GigabitEthernet0/0/5] mpls enable
[PE2-GigabitEthernet0/0/5] quit
[PE2] interface loopback 1
[PE2-LoopBack1] ip address 5.5.5.9 32
[PE2-LoopBack1] ospf 1 area 0
[PE2-LoopBack1] quit
[PE2] mpls lsr-id 5.5.5.9
[PE2] mpls te
[PE2-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE2] ospf 1
[PE2-ospf-1] segment-routing mpls
[PE2-ospf-1] quit
[PE2] interface loopback 1
[PE2-LoopBack1] ospf 1 prefix-sid index 50
[PE2-LoopBack1] quit
# Create VPN instance vpn1 , and configure the RD and route target attributes.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 11:11
[PE2-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE2-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE2-vpn-instance-vpn1] quit
# Associate GigabitEthernet 0/0/1 with VPN instance vpn1 , and assign an IP address to the interface.
80
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 20.0.0.1 24
[PE2-GigabitEthernet0/0/1] quit
# Start BGP on PE 2.
[PE2] bgp 600
# Enable the capability to exchange labeled routes with IBGP peer 4.4.4.9.
[PE2-bgp-default] peer 4.4.4.9 as-number 600
[PE2-bgp-default] peer 4.4.4.9 connect-interface loopback 1
[PE2-bgp-default] address-family ipv4 unicast
[PE2-bgp-default-ipv4] peer 4.4.4.9 enable
[PE2-bgp-default-ipv4] peer 4.4.4.9 label-route-capability
# Enable SR-MPLS.
[PE2-bgp-default-ipv4] segment-routing mpls
[PE2-bgp-default-ipv4] quit
# Configure the maximum number of hops from PE 2 to EBGP peer 2.2.2.9 as 10.
[PE2-bgp-default] peer 2.2.2.9 as-number 100
[PE2-bgp-default] peer 2.2.2.9 connect-interface loopback 1
[PE2-bgp-default] peer 2.2.2.9 ebgp-max-hop 10
# Configure peer 2.2.2.9 as a VPNv4 peer.
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 2.2.2.9 enable
[PE2-bgp-default-vpnv4] quit
# Configure CE 2 as an EBGP peer and install the learned BGP route in the routing table of the
VPN instance.
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] peer 20.0.0.2 as-number 65002
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] peer 20.0.0.2 enable
7. Configure CE 2:
# Assign an IP address to interface GigabitEthernet 0/0/1.
<CE2> system-view
[CE2] interface gigabitethernet 0/0/1
[CE2-GigabitEthernet0/0/1] ip address 20.0.0.2 24
[CE2-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with PE 2, and redistribute VPN routes.
[CE2] bgp 65002
[CE2-bgp-default] peer 20.0.0.1 as-number 600
[CE2-bgp-default] address-family ipv4 unicast
[CE2-bgp-default-ipv4] peer 20.0.0.1 enable
[CE2-bgp-default-ipv4] import-route direct
Verifying the configuration
# Execute the display ip routing-table command on CE 1 and CE 2 to verify that they have a route to each other. (Details not shown.)
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
# Display MPLS LSP information on PE 1.
[PE1] display mpls lsp
81
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
2.2.2.9/32 BGP -/16020 NHLFE1
5.5.5.9/32 BGP -/16050 NHLFE1
5.5.5.9 BGP -/- GE0/0/5
1.1.1.1 Local -/- GE0/0/5
2.2.2.9/32 OSPF 16020/- -
3.3.3.9/32 OSPF 16030/3 GE0/0/5
3.3.3.9/32 OSPF -/3 GE0/0/5
Example: Configuring SR-MPLS inter-AS option C (II)
Network configuration
As shown in Figure 25 , complete the following tasks:
•
Start OSPF and enable OSPF-based SR-MPLS on the PEs in the same AS.
•
Configure PE 1 and ASBR-PE 1 to exchange labeled IPv4 routes through IBGP. Enable
BGP-based SR-MPLS.
•
Configure PE 2 and ASBR-PE 2 to exchange labeled IPv4 routes through IBGP. Enable
BGP-based SR-MPLS.
•
Establish an MP-EBGP peer relationship between PE 1 and PE 2 to exchange VPNv4 routes.
•
Configure ASBR-PE 1 and ASBR-PE 2 to exchange labeled IPv4 routes through EBGP.
Enable BGP-based SR-MPLS.
•
Configure dynamic SID allocation on loopback interfaces of the devices. Then, establish an
SRLSP based on the allocated SIDs and configure an MPLS TE tunnel over the SRLSP to transmit data.
Figure 25 Network diagram
Loop1 Loop1 MPLS backbone
AS 100
MPLS backbone
AS 600
GE0/0/4 GE0/0/4
Loop1
GE0/0/5
ASBR-PE 1 ASBR-PE 2
GE0/0/5
Loop1
GE0/0/5 GE0/0/5
PE 1
GE0/0/1
PE 2
GE0/0/1
GE0/0/1
MP-EBGP
Site 1
CE 1
Table 8 Interface and IP address assignment
Device
PE 1
Interface IP address
Loop1
GE0/0/1
GE0/0/5
ASBR-PE 1 Loop1
2.2.2.9/32
30.0.0.1/24
1.1.1.2/8
3.3.3.9/32
CE 2
Site 2
Device
PE 2
Interface IP address
Loop1
GE0/0/1
GE0/0/5
ASBR-PE 2 Loop1
5.5.5.9/32
20.0.0.1/24
9.1.1.2/8
4.4.4.9/32
82
GE0/0/1
Device
CE 1
Procedure
Interface IP address
GE0/0/5
GE0/0/4
GE0/0/1
1.1.1.1/8
11.0.0.2/8
30.0.0.2/24
Device
CE 2
Interface IP address
GE0/0/5
GE0/0/4
GE0/0/1
9.1.1.1/8
11.0.0.1/8
20.0.0.2/24
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure CE 1:
# Assign an IP address to interface GigabitEthernet 0/0/1.
<CE1> system-view
[CE1] interface gigabitethernet 0/0/1
[CE1-GigabitEthernet0/0/1] ip address 30.0.0.2 24
[CE1-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with PE 1, and redistribute VPN routes.
[CE1] bgp 65001
[CE1-bgp-default] peer 30.0.0.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 30.0.0.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
3. Configure PE 1:
# Start OSPF on PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<PE1> system-view
[PE1] ospf 1 router-id 2.2.2.9
[PE1-ospf-1] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ospf 1 area 0
[PE1-GigabitEthernet0/0/1] mpls enable
[PE1-GigabitEthernet0/0/1] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ip address 2.2.2.9 32
[PE1-LoopBack1] ospf 1 area 0
[PE1-LoopBack1] quit
[PE1] mpls lsr-id 2.2.2.9
[PE1] mpls te
[PE1-te] quit
# Assign an IP address to GigabitEthernet 0/0/5. Start OSPF and enable MPLS on the interface.
[PE1] interface gigabitethernet 0/0/5
[PE1-GigabitEthernet0/0/5] ip address 1.1.1.2 255.0.0.0
[PE1-GigabitEthernet0/0/5] ospf 1 area 0
[PE1-GigabitEthernet0/0/5] mpls enable
[PE1-GigabitEthernet0/0/5] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE1] ospf 1
[PE1-ospf-1] segment-routing mpls
83
[PE1-ospf-1] quit
[PE1] interface loopback 1
[PE1-LoopBack1] ospf 1 prefix-sid index 20
[PE1-LoopBack1] quit
# Create VPN instance vpn1 , and configure the RD and route target attributes.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 11:11
[PE1-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE1-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE1-vpn-instance-vpn1] quit
# Associate GigabitEthernet 0/0/1 with VPN instance vpn1 , and assign an IP address to the interface.
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 30.0.0.1 24
[PE1-GigabitEthernet0/0/1] quit
# Create a routing policy and specify a label index value.
[PE1] route-policy policy1 permit node 1
[PE1-route-policy-policy1-1] apply label-index 20
[PE1-route-policy-policy1-1] quit
# Start BGP on PE 1.
[PE1] bgp 100
# Enable the capability to exchange labeled routes with IBGP peer 3.3.3.9.
[PE1-bgp-default] peer 3.3.3.9 as-number 100
[PE1-bgp-default] peer 3.3.3.9 connect-interface loopback 1
[PE1-bgp-default] address-family ipv4 unicast
[PE1-bgp-default-ipv4] peer 3.3.3.9 enable
[PE1-bgp-default-ipv4] peer 3.3.3.9 label-route-capability
# Enable SR-MPLS.
[PE1-bgp-default-ipv4] segment-routing mpls
# Redistribute the route of loopback interface 1 to BGP and apply the routing policy.
[PE1-bgp-default-ipv4] network 2.2.2.9 32 route-policy policy1
[PE1-bgp-default-ipv4] quit
# Configure the maximum number of hops from PE 1 to EBGP peer 5.5.5.9 as 10.
[PE1-bgp-default] peer 5.5.5.9 as-number 600
[PE1-bgp-default] peer 5.5.5.9 connect-interface loopback 1
[PE1-bgp-default] peer 5.5.5.9 ebgp-max-hop 10
# Configure peer 5.5.5.9 as a VPNv4 peer.
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 5.5.5.9 enable
[PE1-bgp-default-vpnv4] quit
# Configure CE 1 as an EBGP peer of PE 1 and install the learned BGP routes in the routing table of the VPN instance.
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] peer 30.0.0.2 as-number 65001
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] peer 30.0.0.2 enable
4. Configure ASBR-PE 1:
84
# Start OSPF on ASBR-PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE1> system-view
[ASBR-PE1] ospf 1 router-id 3.3.3.9
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface gigabitethernet 0/0/4
[ASBR-PE1-GigabitEthernet0/0/4] mpls enable
[ASBR-PE1-GigabitEthernet0/0/4] quit
[ASBR-PE1] interface gigabitethernet 0/0/5
[ASBR-PE1-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE1-GigabitEthernet0/0/5] mpls enable
[ASBR-PE1-GigabitEthernet0/0/5] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ip address 3.3.3.9 32
[ASBR-PE1-LoopBack1] ospf 1 area 0
[ASBR-PE1-LoopBack1] quit
[ASBR-PE1] mpls lsr-id 3.3.3.9
[ASBR-PE1] mpls te
[ASBR-PE1-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE1] ospf 1
[ASBR-PE1-ospf-1] segment-routing mpls
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface loopback 1
[ASBR-PE1-LoopBack1] ospf 1 prefix-sid index 30
[ASBR-PE1-LoopBack1] quit
# Start BGP on ASBR-PE 1. Enable the capability to exchange labeled routes with IBGP peer
2.2.2.9.
[ASBR-PE1] bgp 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 as-number 100
[ASBR-PE1-bgp-default] peer 2.2.2.9 connect-interface loopback 1
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] peer 2.2.2.9 enable
[ASBR-PE1-bgp-default-ipv4] peer 2.2.2.9 label-route-capability
# Enable SR-MPLS.
[ASBR-PE1-bgp-default-ipv4] segment-routing mpls
[ASBR-PE1-bgp-default-ipv4] quit
# Enable the capability to exchange labeled routes with EBGP peer 11.0.0.1.
[ASBR-PE1-bgp-default] peer 11.0.0.1 as-number 600
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] peer 11.0.0.1 enable
[ASBR-PE1-bgp-default-ipv4] peer 11.0.0.1 label-route-capability
5. Configure ASBR-PE 2:
# Start OSPF on ASBR-PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE2> system-view
[ASBR-PE2] ospf 1 router-id 4.4.4.9
[ASBR-PE2-ospf-1] quit
[ASBR-PE2] interface gigabitethernet 0/0/4
[ASBR-PE2-GigabitEthernet0/0/4] mpls enable
85
[ASBR-PE2-GigabitEthernet0/0/4] quit
[ASBR-PE2] interface gigabitethernet 0/0/5
[ASBR-PE2-GigabitEthernet0/0/5] ospf 1 area 0
[ASBR-PE2-GigabitEthernet0/0/5] mpls enable
[ASBR-PE2-GigabitEthernet0/0/5] quit
[ASBR-PE2] interface loopback 1
[ASBR-PE2-LoopBack1] ip address 4.4.4.9 32
[ASBR-PE2-LoopBack1] ospf 1 area 0
[ASBR-PE2-LoopBack1] quit
[ASBR-PE2] mpls lsr-id 4.4.4.9
[ASBR-PE2] mpls te
[ASBR-PE2-te] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE2] ospf 1
[ASBR-PE2-ospf-1] segment-routing mpls
[ASBR-PE2-ospf-1] quit
[ASBR-PE2] interface loopback 1
[ASBR-PE2-LoopBack1] ospf 1 prefix-sid index 40
[ASBR-PE2-LoopBack1] quit
# Start BGP on ASBR-PE 2. Enable the capability to exchange labeled routes with IBGP peer
5.5.5.9.
[ASBR-PE2] bgp 600
[ASBR-PE2-bgp-default] peer 5.5.5.9 as-number 600
[ASBR-PE2-bgp-default] peer 5.5.5.9 connect-interface loopback 1
[ASBR-PE2-bgp-default] address-family ipv4 unicast
[ASBR-PE2-bgp-default-ipv4] peer 5.5.5.9 enable
[ASBR-PE2-bgp-default-ipv4] peer 5.5.5.9 label-route-capability
# Enable SR-MPLS.
[ASBR-PE2-bgp-default-ipv4] segment-routing mpls
[ASBR-PE2-bgp-default-ipv4] quit
# Enable the capability to exchange labeled routes with EBGP peer 11.0.0.2.
[ASBR-PE2-bgp-default] peer 11.0.0.2 as-number 100
[ASBR-PE2-bgp-default] address-family ipv4 unicast
[ASBR-PE2-bgp-default-ipv4] peer 11.0.0.2 enable
[ASBR-PE2-bgp-default-ipv4] peer 11.0.0.2 label-route-capability
6. Configure PE 2:
# Start OSPF on PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<PE2> system-view
[PE2] ospf 1 router-id 5.5.5.9
[PE2-ospf-1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ospf 1 area 0
[PE2-GigabitEthernet0/0/1] mpls enable
[PE2-GigabitEthernet0/0/1] quit
[PE2] interface loopback 1
[PE2-LoopBack1] ip address 5.5.5.9 32
[PE2-LoopBack1] ospf 1 area 0
[PE2-LoopBack1] quit
86
[PE2] mpls lsr-id 5.5.5.9
[PE2] mpls te
[PE2-te] quit
# Assign an IP address to GigabitEthernet 0/0/5. Start OSPF and enable MPLS on the interface.
[PE2] interface gigabitethernet 0/0/5
[PE2-GigabitEthernet0/0/5] ip address 9.1.1.2 255.0.0.0
[PE2-GigabitEthernet0/0/5] ospf 1 area 0
[PE2-GigabitEthernet0/0/5] mpls enable
[PE2-GigabitEthernet0/0/5] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE2] ospf 1
[PE2-ospf-1] segment-routing mpls
[PE2-ospf-1] quit
[PE2] interface loopback 1
[PE2-LoopBack1] ospf 1 prefix-sid index 50
[PE2-LoopBack1] quit
# Create VPN instance vpn1 , and configure the RD and route target attributes.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 11:11
[PE2-vpn-instance-vpn1] vpn-target 1:1 2:2 3:3 import-extcommunity
[PE2-vpn-instance-vpn1] vpn-target 3:3 export-extcommunity
[PE2-vpn-instance-vpn1] quit
# Associate GigabitEthernet 0/0/1 with VPN instance vpn1 , and assign an IP address to the interface.
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 20.0.0.1 24
[PE2-GigabitEthernet0/0/1] quit
# Create a routing policy and specify a label index value.
[PE2] route-policy policy1 permit node 1
[PE2-route-policy-policy1-1] apply label-index 50
[PE2-route-policy-policy1-1] quit
# Start BGP on PE 2. Enable the capability to exchange labeled routes with IBGP peer 4.4.4.9.
[PE2] bgp 600
[PE2-bgp-default] peer 4.4.4.9 as-number 600
[PE2-bgp-default] peer 4.4.4.9 connect-interface loopback 1
[PE2-bgp-default] address-family ipv4 unicast
[PE2-bgp-default-ipv4] peer 4.4.4.9 enable
[PE2-bgp-default-ipv4] peer 4.4.4.9 label-route-capability
# Enable SR-MPLS.
[PE2-bgp-default-ipv4] segment-routing mpls
# Redistribute the route of loopback interface 1 to BGP and apply the routing policy.
[PE2-bgp-default-ipv4] network 5.5.5.9 32 route-policy policy1
[PE2-bgp-default-ipv4] quit
# Configure the maximum number of hops from PE 2 to EBGP peer 2.2.2.9 as 10.
[PE2-bgp-default] peer 2.2.2.9 as-number 100
[PE2-bgp-default] peer 2.2.2.9 connect-interface loopback 1
87
[PE2-bgp-default] peer 2.2.2.9 ebgp-max-hop 10
# Configure peer 2.2.2.9 as a VPNv4 peer.
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 2.2.2.9 enable
[PE2-bgp-default-vpnv4] quit
# Configure CE 2 as an EBGP peer of PE 2 and install the learned BGP routes in the routing table of the VPN instance.
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] peer 20.0.0.2 as-number 65001
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] peer 20.0.0.2 enable
7. Configure CE 2:
# Assign an IP address to interface GigabitEthernet 0/0/1.
<CE2> system-view
[CE2] interface gigabitethernet 0/0/1
[CE2-GigabitEthernet0/0/1] ip address 20.0.0.2 24
[CE2-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with PE 2, and redistribute VPN routes.
[CE2] bgp 65002
[CE2-bgp-default] peer 20.0.0.1 as-number 600
[CE2-bgp-default] address-family ipv4 unicast
[CE2-bgp-default-ipv4] peer 20.0.0.1 enable
[CE2-bgp-default-ipv4] import-route direct
[CE2-bgp-default-ipv4] quit
[CE2-bgp-default] quit
Verifying the configuration
# Execute the display ip routing-table command on CE 1 and CE 2 to verify that they have a route to each other. (Details not shown.)
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
# Display MPLS LSP information on PE1.
[PE1] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
2.2.2.9/32 BGP 3/- -
5.5.5.9/32 BGP -/16050 NHLFE1
5.5.5.9 BGP -/- GE0/0/5
1.1.1.1 Local -/- GE0/0/5
2.2.2.9/32 OSPF 16020/- -
3.3.3.9/32 OSPF 16030/3 GE0/0/5
3.3.3.9/32 OSPF -/3 GE0/0/5
Example: Configuring SR-MPLS inter-AS option C (III)
Network configuration
As shown in Figure 26 , complete the following tasks:
•
Start OSPF and enable OSPF-based SR-MPLS on the PEs in the same AS.
•
Configure PE 1, ASBR-PE 1, and ASBR-PE 2 to exchange labeled IPv4 routes through IBGP.
88
•
Configure PE 2, ASBR-PE 3, and ASBR-PE 4 to exchange labeled IPv4 routes through IBGP.
•
Configure ASBR-PE 1 and ASBR-PE 3 to use their loopback interfaces to establish an EBGP relationship to exchange labeled IPv4 routes. Enable BGP-based SR-MPLS.
•
Configure ASBR-PE 2 and ASBR-PE 4 to use their loopback interfaces to establish an EBGP relationship to exchange labeled IPv4 routes. Enable BGP-based SR-MPLS.
•
Configure dynamic SID allocation on loopback interfaces of the devices. Then, establish
SRLSPs based on the allocated SIDs and configure a multisegmented MPLS TE tunnel over the SRLSPs to transmit data.
Figure 26 Network diagram
MP-EBGP
Loop0 Loop0 MPLS backbone
AS 100
MPLS backbone
AS 600
GE0/0/4
Loop0
PE 1
GE0/0/1
GE0/0/4
GE0/0/1
GE0/0/3
ASBR-PE 1 ASBR-PE 3
GE0/0/1
GE0/0/3
Loop0
GE0/0/1
GE0/0/2
Loop0 Loop0 GE0/0/2
PE 2
GE0/0/3
GE0/0/2
GE0/0/3
GE0/0/2
GE0/0/4 GE0/0/4
ASBR-PE 2 ASBR-PE 4
MP-EBGP
Site 1
CE 1
Table 9 Interface and IP address assignment
CE 2
Site 2
Device
PE1
Interface IP address
Loop0 1.1.1.1/32
GE0/0/1
GE0/0/2
ASBR-PE1 Loop0
11.0.0.1/24
12.0.0.1/24
2.2.2.1/32
GE0/0/1
GE0/0/3
GE0/0/4
ASBR-PE2 Loop0
GE0/0/2
GE0/0/3
GE0/0/4
11.0.0.2/24
13.0.0.1/24
14.0.0.1/24
3.3.3.1/32
12.0.0.2/24
13.0.0.2/24
24.0.0.1/24
Procedure
Device
PE2
Interface IP address
Loop0 6.6.6.1/32
GE0/0/1
GE0/0/2
ASBR-PE3 Loop0
21.0.0.1/24
22.0.0.1/24
4.4.4.1/32
GE0/0/1
GE0/0/3
GE0/0/4
ASBR-PE4 Loop0
GE0/0/2
GE0/0/3
GE0/0/4
21.0.0.2/24
23.0.0.1/24
14.0.0.2/24
5.5.5.1/32
22.0.0.2/24
23.0.0.2/24
24.0.0.2/24
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure PE 1:
# Start OSPF on PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<PE1> system-view
89
[PE1] interface loopback 0
[PE1-LoopBack0] ip address 1.1.1.1 32
[PE1-LoopBack0] ospf 1 area 100
[PE1-LoopBack0] quit
[PE1] mpls lsr-id 1.1.1.1
[PE1] mpls te
[PE1-te] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ospf 1 area 100
[PE1-GigabitEthernet0/0/1] mpls enable
[PE1-GigabitEthernet0/0/1] mpls te enable
[PE1-GigabitEthernet0/0/1] quit
[PE1] interface gigabitethernet 0/0/2
[PE1-GigabitEthernet0/0/2] ospf 1 area 100
[PE1-GigabitEthernet0/0/2] mpls enable
[PE1-GigabitEthernet0/0/2] mpls te enable
[PE1-GigabitEthernet0/0/2] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE1] ospf 1
[PE1-ospf-1] segment-routing mpls
[PE1-ospf-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] ospf 1 prefix-sid index 10
[PE1-LoopBack0] quit
# Start BGP on PE 1.
[PE1] bgp 100
# Configure IBGP peer group 1, add peers 2.2.2.1 and 3.3.3.1 to the group, and enable the capability to exchange labeled routes for the group.
[PE1-bgp-default] group 1
[PE1-bgp-default] peer 1 connect-interface loopback 0
[PE1-bgp-default] peer 2.2.2.1 group 1
[PE1-bgp-default] peer 3.3.3.1 group 1
[PE1-bgp-default] address-family ipv4 unicast
[PE1-bgp-default-ipv4] peer 1 enable
[PE1-bgp-default-ipv4] peer 1 label-route-capability
3. Configure ASBR-PE 1:
# Start OSPF on ASBR-PE 1, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE1> system-view
[ASBR-PE1] interface loopback 0
[ASBR-PE1-LoopBack0] ip address 2.2.2.1 32
[ASBR-PE1-LoopBack0] ospf 1 area 100
[ASBR-PE1-LoopBack0] quit
[ASBR-PE1] mpls lsr-id 2.2.2.1
[ASBR-PE1] mpls te
[ASBR-PE1-te] quit
[ASBR-PE1] interface gigabitethernet 0/0/1
[ASBR-PE1-GigabitEthernet0/0/1] ospf 1 area 100
[ASBR-PE1-GigabitEthernet0/0/1] mpls enable
90
[ASBR-PE1-GigabitEthernet0/0/1] mpls te enable
[ASBR-PE1-GigabitEthernet0/0/1] quit
[ASBR-PE1] interface gigabitethernet 0/0/3
[ASBR-PE1-GigabitEthernet0/0/3] ospf 1 area 100
[ASBR-PE1-GigabitEthernet0/0/3] mpls enable
[ASBR-PE1-GigabitEthernet0/0/3] mpls te enable
[ASBR-PE1-GigabitEthernet0/0/3] quit
[ASBR-PE1] interface gigabitethernet 0/0/4
[ASBR-PE1-GigabitEthernet0/0/4] mpls enable
[ASBR-PE1-GigabitEthernet0/0/4] mpls te enable
[ASBR-PE1-GigabitEthernet0/0/4] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE1] ospf 1
[ASBR-PE1-ospf-1] segment-routing mpls
[ASBR-PE1-ospf-1] quit
[ASBR-PE1] interface loopback 0
[ASBR-PE1-LoopBack0] ospf 1 prefix-sid index 20
[ASBR-PE1-LoopBack0] quit
# Create a routing policy and specify a label index value.
[ASBR-PE1]ip prefix-list 1 permit 1.1.1.1 32
[ASBR-PE1] route-policy policy1 permit node 1
[ASBR-PE1-route-policy-policy1-1] if-match ip address prefix-list 1
[ASBR-PE1-route-policy-policy1-1] apply label-index 10
[ASBR-PE1-route-policy-policy1-1] quit
# Start BGP on ASBR-PE 1.
[ASBR-PE1] bgp 100
# Configure IBGP peer group 1, add peers 1.1.1.1 and 3.3.3.1 to the group, and enable the capability to exchange labeled routes for the group.
[ASBR-PE1-bgp-default] group 1
[ASBR-PE1-bgp-default] peer 1 connect-interface loopback 0
[ASBR-PE1-bgp-default] peer 1.1.1.1 group 1
[ASBR-PE1-bgp-default] peer 3.3.3.1 group 1
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] peer 1 enable
[ASBR-PE1-bgp-default-ipv4] peer 1 label-route-capability
# Redistribute routes from OSPF process 1 to BGP and apply the routing policy.
[ASBR-PE1-bgp-default-ipv4] import-route ospf 1 route-policy policy1
# Enable SR-MPLS.
[ASBR-PE1-bgp-default-ipv4] segment-routing mpls
[ASBR-PE1-bgp-default-ipv4] quit
# Configure directly connected peer 14.0.0.2 as an EBGP peer. Advertise only the route of local loopback interface 0 to the peer.
[ASBR-PE1-bgp-default] peer 14.0.0.2 as-number 600
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] network 2.2.2.1 32 route-policy policy2
[ASBR-PE1-bgp-default-ipv4] peer 14.0.0.2 enable
[ASBR-PE1-bgp-default-ipv4] peer 14.0.0.2 route-policy policy2 export
[ASBR-PE1-bgp-default-ipv4] quit
91
# Create a multihop EBGP neighbor relationship with ASBR-PE 3 by using the loopback interfaces. Enable the capability to exchange labeled routes with peer 4.4.4.1. Set the preferred value to 100 for routes received from peer 4.4.4.1.
[ASBR-PE1-bgp-default] peer 4.4.4.1 as-number 600
[ASBR-PE1-bgp-default] peer 4.4.4.1 connect-interface loopback 0
[ASBR-PE1-bgp-default] peer 4.4.4.1 ebgp-max-hop 10
[ASBR-PE1-bgp-default] address-family ipv4 unicast
[ASBR-PE1-bgp-default-ipv4] peer 4.4.4.1 enable
[ASBR-PE1-bgp-default-ipv4] peer 4.4.4.1 label-route-capability
[ASBR-PE1-bgp-default-ipv4] peer 4.4.4.1 preferred-value 100
[ASBR-PE1-bgp-default-ipv4] quit
# Enable BGP EPE for neighbor 4.4.4.1 and specify a routing policy to assign a label to the neighbor.
[ASBR-PE1-bgp-default] peer 4.4.4.1 egress-engineering route-policy epe
[ASBR-PE1-bgp-default] quit
[ASBR-PE1-bgp] quit
# Create routing policy policy2 and epe to assign label index 20 and label 245555.
[ASBR-PE1]ip prefix-list 2 permit 2.2.2.1 32
[ASBR-PE1] route-policy policy2 permit node 1
[ASBR-PE1-route-policy-policy2-1] if-match ip address prefix-list 2
[ASBR-PE1-route-policy-policy2-1] apply label-index 20
[ASBR-PE1-route-policy-policy2-1] quit
[ASBR-PE1] route-policy epe permit node 1
[ASBR-PE1-route-policy-epe-1] apply label-value 245555
[ASBR-PE1-route-policy-epe-1] quit
4. Configure ASBR-PE 2:
# Configure ASBR-PE 2 in the same way you configure ASBR-PE 1. (Details not shown.)
5. Configure ASBR-PE 3:
# Start OSPF on ASBR-PE 3, set the LSR ID, and enable MPLS and MPLS TE.
<ASBR-PE3> system-view
[ASBR-PE3] interface loopback 0
[ASBR-PE3-LoopBack0] ip address 4.4.4.1 32
[ASBR-PE3-LoopBack0] ospf 1 area 200
[ASBR-PE3-LoopBack0] quit
[ASBR-PE3] mpls lsr-id 4.4.4.1
[ASBR-PE3] mpls te
[ASBR-PE3-te] quit
[ASBR-PE3] interface gigabitethernet 0/0/1
[ASBR-PE3-GigabitEthernet0/0/1] ospf 1 area 200
[ASBR-PE3-GigabitEthernet0/0/1] mpls enable
[ASBR-PE3-GigabitEthernet0/0/1] mpls te enable
[ASBR-PE3-GigabitEthernet0/0/1] quit
[ASBR-PE3] interface gigabitethernet 0/0/3
[ASBR-PE3-GigabitEthernet0/0/3] ospf 1 area 200
[ASBR-PE3-GigabitEthernet0/0/3] mpls enable
[ASBR-PE3-GigabitEthernet0/0/3] mpls te enable
[ASBR-PE3-GigabitEthernet0/0/3] quit
[ASBR-PE3] interface gigabitethernet 0/0/4
92
[ASBR-PE3-GigabitEthernet0/0/4] mpls enable
[ASBR-PE3-GigabitEthernet0/0/4] mpls te enable
[ASBR-PE3-GigabitEthernet0/0/4] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[ASBR-PE3] ospf 1
[ASBR-PE3-ospf-1] segment-routing mpls
[ASBR-PE3-ospf-1] quit
[ASBR-PE3] interface loopback 0
[ASBR-PE3-LoopBack0] ospf 1 prefix-sid index 40
[ASBR-PE3-LoopBack0] quit
# Create a routing policy and specify a label index value.
[ASBR-PE3]ip prefix-list 1 permit 6.6.6.1 32
[ASBR-PE3] route-policy policy1 permit node 1
[ASBR-PE3-route-policy-policy1-1] if-match ip address prefix-list 1
[ASBR-PE3-route-policy-policy1-1] apply label-index 60
[ASBR-PE3-route-policy-policy1-1] quit
# Start BGP on ASBR-PE 3.
[ASBR-PE3] bgp 600
# Configure IBGP peer group 1, add peers 5.5.5.1 and 6.6.6.1 to the group, and enable the capability to exchange labeled routes for the group.
[ASBR-PE3-bgp-default] group 1
[ASBR-PE3-bgp-default] peer 1 connect-interface loopback 0
[ASBR-PE3-bgp-default] peer 5.5.5.1 group 1
[ASBR-PE3-bgp-default] peer 6.6.6.1 group 1
[ASBR-PE3-bgp-default] address-family ipv4 unicast
[ASBR-PE3-bgp-default-ipv4] peer 1 enable
[ASBR-PE3-bgp-default-ipv4] peer 1 label-route-capability
# Redistribute routes from OSPF process 1 to BGP and apply the routing policy.
[ASBR-PE3-bgp-default-ipv4] import-route ospf 1 route-policy policy1
# Enable SR-MPLS.
[ASBR-PE3-bgp-default-ipv4] segment-routing mpls
[ASBR-PE3-bgp-default-ipv4] quit
# Configure directly connected peer 14.0.0.1 as an EBGP peer. Advertise only the route of local loopback interface 0 to the peer.
[ASBR-PE3-bgp-default] peer 14.0.0.1 as-number 100
[ASBR-PE3-bgp-default] address-family ipv4 unicast
[ASBR-PE3-bgp-default-ipv4] network 4.4.4.1 32 route-policy policy2
[ASBR-PE3-bgp-default-ipv4] peer 14.0.0.1 enable
[ASBR-PE3-bgp-default-ipv4] peer 14.0.0.1 route-policy policy2 export
[ASBR-PE3-bgp-default-ipv4] quit
# Create a multihop EBGP neighbor relationship with ASBR-PE 1 by using the loopback interfaces. Enable the capability to exchange labeled routes with peer 2.2.2.1. Set the preferred value to 100 for routes received from peer 2.2.2.1.
[ASBR-PE3-bgp-default] peer 2.2.2.1 as-number 100
[ASBR-PE3-bgp-default] peer 2.2.2.1 connect-interface loopback 0
[ASBR-PE3-bgp-default] peer 2.2.2.1 ebgp-max-hop 10
[ASBR-PE3-bgp-default] address-family ipv4 unicast
[ASBR-PE3-bgp-default-ipv4] peer 2.2.2.1 enable
93
[ASBR-PE3-bgp-default-ipv4] peer 2.2.2.1 label-route-capability
[ASBR-PE3-bgp-default-ipv4] peer 2.2.2.1 preferred-value 100
[ASBR-PE3-bgp-default-ipv4] quit
# Enable BGP EPE for EBGP neighbor 2.2.2.1 and specify a routing policy to assign a label to the neighbor.
[ASBR-PE3-bgp-default] peer 2.2.2.1 egress-engineering route-policy epe
[ASBR-PE3-bgp-default] quit
[ASBR-PE3-bgp] quit
# Create routing policies policy2 and epe to assign label index 40 and label 6666, respectively.
[ASBR-PE3]ip prefix-list 2 permit 4.4.4.1 32
[ASBR-PE3] route-policy policy2 permit node 1
[ASBR-PE3-route-policy-policy2-1] if-match ip address prefix-list 2
[ASBR-PE3-route-policy-policy2-1] apply label-index 40
[ASBR-PE3-route-policy-policy2-1] quit
[ASBR-PE3] route-policy epe permit node 1
[ASBR-PE3-route-policy-epe-1] apply label-value 6666
[ASBR-PE3-route-policy-epe-1] quit
6. Configure ASBR-PE 4:
# Configure ASBR-PE 4 in the same way you configure ASBR-PE 3. (Details not shown.)
7. Configure PE 2:
# Start OSPF on PE 2, set the LSR ID, and enable MPLS and MPLS TE.
<PE2> system-view
[PE2] interface loopback 0
[PE2-LoopBack0] ip address 6.6.6.1 32
[PE2-LoopBack0] ospf 1 area 200
[PE2-LoopBack0] quit
[PE2] mpls lsr-id 6.6.6.1
[PE2] mpls te
[PE2-te] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ospf 1 area 200
[PE2-GigabitEthernet0/0/1] mpls enable
[PE2-GigabitEthernet0/0/1] mpls te enable
[PE2-GigabitEthernet0/0/1] quit
[PE2] interface gigabitethernet 0/0/2
[PE2-GigabitEthernet0/0/2] ospf 1 area 200
[PE2-GigabitEthernet0/0/2] mpls enable
[PE2-GigabitEthernet0/0/2] mpls te enable
[PE2-GigabitEthernet0/0/2] quit
# Enable SR-MPLS in OSPF view and configure an OSPF prefix SID.
[PE2] ospf 1
[PE2-ospf-1] segment-routing mpls
[PE2-ospf-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] ospf 1 prefix-sid index 60
[PE2-LoopBack0] quit
# Start BGP on PE 2.
[PE2] bgp 600
94
# Configure IBGP peer group 1, add peers 4.4.4.1 and 5.5.5.1 to the group, and enable the capability to exchange labeled routes for the group.
[PE2-bgp-default] group 1
[PE2-bgp-default] peer 1 connect-interface loopback 0
[PE2-bgp-default] peer 4.4.4.1 group 1
[PE2-bgp-default] peer 5.5.5.1 group 1
[PE2-bgp-default] address-family ipv4 unicast
[PE2-bgp-default-ipv4] peer 1 enable
[PE2-bgp-default-ipv4] peer 1 label-route-capability
8. Configuring a multisegmented MPLS TE tunnel:
# On PE 1, configure an MPLS TE tunnel to ASBR-PE 1 and an MPLS TE tunnel to ASBR-PE 2.
[PE1] static-sr-mpls lsp sr-lsp-20 out-label 16020
[PE1] static-sr-mpls lsp sr-lsp-30 out-label 16030
[PE1] interface tunnel 0 mode mpls-te
[PE1-Tunnel0] ip address unnumbered interface LoopBack0
[PE1-Tunnel0] destination 2.2.2.1
[PE1-Tunnel0] mpls te signaling static
[PE1-Tunnel0] mpls te static-sr-SR-MPLS-lsp-20
[PE1-Tunnel0] quit
[PE1] interface tunnel 1 mode mpls-te
[PE1-Tunnel1] ip address unnumbered interface LoopBack0
[PE1-Tunnel1] destination 3.3.3.1
[PE1-Tunnel1] mpls te signaling static
[PE1-Tunnel1] mpls te static-sr-SR-MPLS-lsp-30
[PE1-Tunnel1] quit
# On ASBR-PE 1, configure an MPLS TE tunnel to PE 1 and an MPLS TE tunnel to ASBR-PE 3.
[ASBR-PE1] static-sr-mpls lsp sr-lsp-10 out-label 16010
[ASBR-PE1] static-sr-mpls lsp sr-lsp-40 out-label 245555
[ASBR-PE1] interface tunnel 0 mode mpls-te
[ASBR-PE1-Tunnel0] ip address unnumbered interface LoopBack0
[ASBR-PE1-Tunnel0] destination 1.1.1.1
[ASBR-PE1-Tunnel0] mpls te signaling static
[ASBR-PE1-Tunnel0] mpls te static-sr-SR-MPLS-lsp-10
[ASBR-PE1-Tunnel0] quit
[ASBR-PE1] interface tunnel 1 mode mpls-te
[ASBR-PE1-Tunnel1] ip address unnumbered interface LoopBack0
[ASBR-PE1-Tunnel1] destination 4.4.4.1
[ASBR-PE1-Tunnel1] mpls te signaling static
[ASBR-PE1-Tunnel1] mpls te static-sr-SR-MPLS-lsp-40
[ASBR-PE1-Tunnel1] quit
# On ASBR-PE 3, configure an MPLS TE tunnel to PE 2 and an MPLS TE tunnel to ASBR-PE 1.
[ASBR-PE3] static-sr-mpls lsp sr-lsp-60 out-label 16060
[ASBR-PE3] static-sr-mpls lsp sr-lsp-40 out-label 6666
[ASBR-PE3] interface tunnel 0 mode mpls-te
[ASBR-PE3-Tunnel0] ip address unnumbered interface LoopBack0
[ASBR-PE3-Tunnel0] destination 6.6.6.1
[ASBR-PE3-Tunnel0] mpls te signaling static
[ASBR-PE3-Tunnel0] mpls te static-sr-SR-MPLS-lsp-60
95
[ASBR-PE3-Tunnel0] quit
[ASBR-PE3] interface tunnel 1 mode mpls-te
[ASBR-PE3-Tunnel1] ip address unnumbered interface LoopBack0
[ASBR-PE3-Tunnel1] destination 2.2.2.1
[ASBR-PE3-Tunnel1] mpls te signaling static
[ASBR-PE3-Tunnel1] mpls te static-sr-SR-MPLS-lsp-40
[ASBR-PE3-Tunnel1] quit
# Configure MPLS TE tunnels on PE 2, ASBR-PE 2, and ASBR-PE 4 in the same way you configure MPLS TE tunnels on PE 1, ASBR-PE 1, and ASBR-PE 3. (Details not shown.)
Verifying the configuration
# Execute the display ip routing-table command on PE 1 and PE 2 to verify that they have a route to each other. (Details not shown.)
# Verify that PE 1 and PE 2 can ping each other. (Details not shown.)
# Display MPLS LSP information on PE1.
[PE1] display mpls lsp
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
1.1.1.1/0/35940 StaticCR -/3 GE0/0/1
1.1.1.1/1/35940 StaticCR -/3 GE0/0/1
1.1.1.1/32 BGP -/16010 NHLFE4
4.4.4.1/32 BGP -/16040 NHLFE4
5.5.5.1/32 BGP -/16050 NHLFE4
6.6.6.1/32 BGP -/16060 NHLFE4
11.0.0.2 Local -/- GE0/0/1
12.0.0.3 Local -/- GE0/0/2
Tunnel0 Local -/- NHLFE4
Tunnel1 Local -/- NHLFE8
1.1.1.1/32 OSPF 16010/- -
2.2.2.1/32 OSPF 16020/3 GE0/0/1
2.2.2.1/32 OSPF -/3 GE0/0/1
3.3.3.1/32 OSPF 16030/3 GE0/0/2
3.3.3.1/32 OSPF -/3 GE0/0/2
Example: Configuring SR-MPLS to LDP (IS-IS)
Network configuration
As shown in Figure 27 , complete the following tasks so Router A and Router C can communicate
with each other:
•
Configure Router A, Router B, and Router C to run IS-IS.
•
Configure Router A and Router B to run SR-MPLS and establish an SRLSP between Router A and Router B.
•
Configure Router B and Router C to run LDP to establish a dynamic LDP LSP between them.
•
Configure Router B as the SRMS, map the prefix address of the LDP network to an SID, and advertise the mapping to Router A.
96
Figure 27 Network diagram
Loop1
SR
Loop1
Router A
GE0/0/1
GE0/0/1
Router B
GE0/0/2
LDP
Loop1
GE0/0/1
Router C
Table 10 Interface and IP address assignment
Device
Router A
Router C
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1 10.0.0.1/24
Loop1
GE0/0/1
3.3.3.3/32
11.0.0.2/24
Device
Router B
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1 10.0.0.2/24
GE0/0/2 11.0.0.1/24
Procedure
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure Router A:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterA> system-view
[RouterA] isis 1
[RouterA-isis-1] network-entity 00.0000.0000.0001.00
[RouterA-isis-1] cost-style wide
[RouterA-isis-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] isis enable 1
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis enable 1
[RouterA-LoopBack1] quit
# Configure the LSR ID.
[RouterA] mpls lsr-id 1.1.1.1
# Enable SR-MPLS.
[RouterA] isis 1
[RouterA-isis-1] address-family ipv4
[RouterA-isis-1-ipv4] segment-routing mpls
[RouterA-isis-1-ipv4] quit
[RouterA-isis-1] quit
3. Configure Router B:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterB> system-view
[RouterB] isis 1
[RouterB-isis-1] network-entity 00.0000.0000.0002.00
[RouterB-isis-1] cost-style wide
[RouterB-isis-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] isis enable 1
97
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] isis enable 1
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis enable 1
[RouterB-LoopBack1] quit
# Configure the LSR ID.
[RouterB] mpls lsr-id 2.2.2.2
# Configure LDP.
[RouterB] mpls ldp
[RouterB-ldp] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] mpls ldp enable
[RouterB-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterB] isis 1
[RouterB-isis-1] address-family ipv4
[RouterB-isis-1-ipv4] segment-routing mpls
# Configure the IGP to advertise locally configured prefix-SID mappings.
[RouterB-isis-1-ipv4] segment-routing mapping-server advertise-local
[RouterB-isis-1-ipv4] quit
[RouterB-isis-1] quit
# Configure a prefix-SID mapping.
[RouterB] segment-routing
[RouterB-segment-routing] mapping-server prefix-sid-map 3.3.3.3 32 100
[RouterB-segment-routing] quit
4. Configure Router C:
# Configure IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<RouterC> system-view
[RouterC] isis 1
[RouterC-isis-1] network-entity 00.0000.0000.0003.00
[RouterC-isis-1] cost-style wide
[RouterC-isis-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] isis enable 1
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis enable 1
[RouterC-LoopBack1] quit
# Configure the LSR ID.
[RouterC] mpls lsr-id 3.3.3.3
# Configure LDP.
[RouterC] mpls ldp
[RouterC-ldp] quit
[RouterC] interface gigabitethernet 0/0/1
98
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] mpls ldp enable
[RouterC-GigabitEthernet0/0/1] quit
Verifying the configuration
# Display IS-IS SRLSP information on Router A.
[RouterA] display mpls lsp protocol isis
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
3.3.3.3/32 ISIS 16100/16100 GE0/0/1
3.3.3.3/32 ISIS -/16100 GE0/0/1
The output shows that the outgoing label of the IS-IS SRLSP entry for Router C is using the SID assigned to Router C.
Example: Configuring SR-MPLS to LDP (OSPF)
Network configuration
As shown in Figure 28 , complete the following tasks so Router A and Router C can communicate
with each other:
•
Configure Router A, Router B, and Router C to run OSPF.
•
Configure Router A and Router B to run SR-MPLS and establish an SRLSP between Router A and Router B.
•
Configure Router B and Router C to run LDP to establish a dynamic LDP LSP between them.
•
Configure Router B as the SRMS, map the prefix address of the LDP network to an SID, and advertise the mapping to Router A.
Figure 28 Network diagram
Loop1 Loop1 Loop1
GE0/0/1
SR LDP
Router A
GE0/0/1
Router B
GE0/0/2
GE0/0/1
Router C
Table 11 Interface and IP address assignment
Device
Router A
Router C
Procedure
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1
Loop1
10.0.0.1/24
3.3.3.3/32
GE0/0/1 11.0.0.2/24
Device
Router B
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1
GE0/0/2
10.0.0.2/24
11.0.0.1/24
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure Router A:
# Configure OSPF to achieve network level connectivity.
<RouterA> system-view
[RouterA] ospf 1 router-id 1.1.1.1
[RouterA-ospf-1] quit
[RouterA] interface gigabitethernet 0/0/1
99
[RouterA-GigabitEthernet0/0/1] ospf 1 area 0
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] ospf 1 area 0
[RouterA-LoopBack1] quit
# Configure the LSR ID.
[RouterA] mpls lsr-id 1.1.1.1
# Enable SR-MPLS.
[RouterA] ospf 1
[RouterA-ospf-1] segment-routing mpls
[RouterA-ospf-1] quit
3. Configure Router B:
# Configure OSPF to achieve network level connectivity.
<RouterB> system-view
[RouterB] ospf 1 router-id 2.2.2.2
[RouterB-ospf-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] ospf 1 area 0
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] ospf 1 area 0
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] ospf 1 area 0
[RouterB-LoopBack1] quit
# Configure the LSR ID.
[RouterB] mpls lsr-id 2.2.2.2
# Configure LDP.
[RouterB] mpls ldp
[RouterB-ldp] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] mpls ldp enable
[RouterB-GigabitEthernet0/0/2] quit
# Enable SR-MPLS.
[RouterB] ospf 1
[RouterB-ospf-1] segment-routing mpls
# Configure the IGP to advertise locally configured prefix-SID mappings.
[RouterB-ospf-1] segment-routing mapping-server advertise-local
[RouterB-ospf-1] quit
# Configure a prefix-SID mapping.
[RouterB] segment-routing
[RouterB-segment-routing] mapping-server prefix-sid-map 3.3.3.3 32 100
[RouterB-segment-routing] quit
4. Configure Router C:
# Configure OSPF to achieve network level connectivity.
<RouterC> system-view
100
[RouterC] ospf 1 router-id 3.3.3.3
[RouterC-ospf-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] ospf 1 area 0
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] ospf 1 area 0
[RouterC-LoopBack1] quit
# Configure the LSR ID.
[RouterC] mpls lsr-id 3.3.3.3
# Configure LDP.
[RouterC] mpls ldp
[RouterC-ldp] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] mpls ldp enable
[RouterC-GigabitEthernet0/0/1] quit
Verifying the configuration
# Display OSPF SRLSP information on Router A.
[RouterA] display mpls lsp protocol ospf
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
3.3.3.3/32 OSPF 16100/16100 GE0/0/1
3.3.3.3/32 OSPF -/16100 GE0/0/1
The output shows that the outgoing label of the OSPF SRLSP entry for Router C is using the SID assigned to Router C.
Example: Configuring SR-MPLS over LDP
Network configuration
As shown in Figure 29 , complete the following tasks so the two SR networks can communicate
across the LDP network:
•
Configure Router A, Router B, Router C, Router D, and Router E to run IS-IS.
•
Configure Router B, Router C, and Router D to run LDP.
•
Configure Router A, Router B, Router D, and Router E to run SR-MPLS.
101
Figure 29 Network diagram
Loop1
Router B
SR
GE
0
/0
/1
GE
0
/0
/1
GE0/0/2
LDP Loop1
GE0/0/1
Router C
GE0/0/2
GE0/0/1
Loop1
GE
0
/0
/2
Router D
SR
GE
0
/0
/1
Router A Router E
Table 12 Interface and IP address assignment
Device
Router A
Router C
Router E
Prerequisites
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1 10.0.0.1/24
Loop1
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
3.3.3.3/32
11.0.0.2/24
12.0.0.1/24
5.5.5.5/32
13.0.0.2/24
Device
Router B
Router D
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1 10.0.0.2/24
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
11.0.0.1/24
4.4.4.4/32
12.0.0.2/24
13.0.0.1/24
Configure IP addresses and masks for interfaces.
Procedure
1. Configure IS-IS on the routers to achieve network level connectivity and set the IS-IS cost style to wide:
# Configure Router A.
<RouterA> system-view
[RouterA] isis 1
[RouterA-isis-1] network-entity 00.0000.0000.0001.00
[RouterA-isis-1] cost-style wide
[RouterA-isis-1] quit
[RouterA] interface gigabitethernet 0/0/1
[RouterA-GigabitEthernet0/0/1] isis enable 1
[RouterA-GigabitEthernet0/0/1] quit
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis enable 1
[RouterA-LoopBack1] quit
# Configure Router B.
<RouterB> system-view
[RouterB] isis 1
[RouterB-isis-1] network-entity 00.0000.0000.0002.00
102
[RouterB-isis-1] cost-style wide
[RouterB-isis-1] quit
[RouterB] interface gigabitethernet 0/0/1
[RouterB-GigabitEthernet0/0/1] isis enable 1
[RouterB-GigabitEthernet0/0/1] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] isis enable 1
[RouterB-GigabitEthernet0/0/2] quit
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis enable 1
[RouterB-LoopBack1] quit
# Configure Router C.
<RouterC> system-view
[RouterC] isis 1
[RouterC-isis-1] network-entity 00.0000.0000.0003.00
[RouterC-isis-1] cost-style wide
[RouterC-isis-1] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] isis enable 1
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] isis enable 1
[RouterC-GigabitEthernet0/0/2] quit
[RouterC] interface loopback 1
[RouterC-LoopBack1] isis enable 1
[RouterC-LoopBack1] quit
# Configure Router D.
<RouterD> system-view
[RouterD] isis 1
[RouterD-isis-1] network-entity 00.0000.0000.0004.00
[RouterD-isis-1] cost-style wide
[RouterD-isis-1] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] isis enable 1
[RouterD-GigabitEthernet0/0/1] quit
[RouterD] interface gigabitethernet 0/0/2
[RouterD-GigabitEthernet0/0/2] isis enable 1
[RouterD-GigabitEthernet0/0/2] quit
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis enable 1
[RouterD-LoopBack1] quit
# Configure Router E.
<RouterE> system-view
[RouterE] isis 1
[RouterE-isis-1] network-entity 00.0000.0000.0005.00
[RouterE-isis-1] cost-style wide
[RouterE-isis-1] quit
[RouterE] interface gigabitethernet 0/0/1
103
[RouterE-GigabitEthernet0/0/1] isis enable 1
[RouterE-GigabitEthernet0/0/1] quit
[RouterE] interface loopback 1
[RouterE-LoopBack1] isis enable 1
[RouterE-LoopBack1] quit
2. Configure LSR IDs on the routers:
# Configure Router A.
[RouterA] mpls lsr-id 1.1.1.1
# Configure Router B.
[RouterB] mpls lsr-id 2.2.2.2
# Configure Router C.
[RouterC] mpls lsr-id 3.3.3.3
# Configure Router D.
[RouterD] mpls lsr-id 4.4.4.4
# Configure Router E.
[RouterE] mpls lsr-id 5.5.5.5
3. Configure LDP on Router B, Router C, and Router D:
# Configure Router B.
[RouterB] mpls ldp
[RouterB-ldp] quit
[RouterB] interface gigabitethernet 0/0/2
[RouterB-GigabitEthernet0/0/2] mpls enable
[RouterB-GigabitEthernet0/0/2] mpls ldp enable
[RouterB-GigabitEthernet0/0/2] quit
# Configure Router C.
[RouterC] mpls ldp
[RouterC-ldp] quit
[RouterC] interface gigabitethernet 0/0/1
[RouterC-GigabitEthernet0/0/1] mpls enable
[RouterC-GigabitEthernet0/0/1] mpls ldp enable
[RouterC-GigabitEthernet0/0/1] quit
[RouterC] interface gigabitethernet 0/0/2
[RouterC-GigabitEthernet0/0/2] mpls enable
[RouterC-GigabitEthernet0/0/2] mpls ldp enable
[RouterC-GigabitEthernet0/0/2] quit
# Configure Router D.
[RouterD] mpls ldp
[RouterD-ldp] quit
[RouterD] interface gigabitethernet 0/0/1
[RouterD-GigabitEthernet0/0/1] mpls enable
[RouterD-GigabitEthernet0/0/1] mpls ldp enable
[RouterD-GigabitEthernet0/0/1] quit
4. Enable SR-MPLS on Router A, Router B, Router D, and Router E:
# Configure Router A.
[RouterA] isis 1
[RouterA-isis-1] address-family ipv4
[RouterA-isis-1-ipv4] segment-routing mpls
104
[RouterA-isis-1-ipv4] quit
[RouterA-isis-1] quit
# Configure Router B.
[RouterB] isis 1
[RouterB-isis-1] address-family ipv4
[RouterB-isis-1-ipv4] segment-routing mpls
[RouterB-isis-1-ipv4] quit
[RouterB-isis-1] quit
# Configure Router D.
[RouterD] isis 1
[RouterD-isis-1] address-family ipv4
[RouterD-isis-1-ipv4] segment-routing mpls
[RouterD-isis-1-ipv4] quit
[RouterD-isis-1] quit
# Configure Router E.
[RouterE] isis 1
[RouterE-isis-1] address-family ipv4
[RouterE-isis-1-ipv4] segment-routing mpls
[RouterE-isis-1-ipv4] quit
[RouterE-isis-1] quit
5. Configure IS-IS prefix SIDs for Router A, Router B, Router D, and Router E:
# Configure Router A.
[RouterA] interface loopback 1
[RouterA-LoopBack1] isis prefix-sid index 10
[RouterA-LoopBack1] quit
# Configure Router B.
[RouterB] interface loopback 1
[RouterB-LoopBack1] isis prefix-sid index 20
[RouterB-LoopBack1] quit
# Configure Router D.
[RouterD] interface loopback 1
[RouterD-LoopBack1] isis prefix-sid index 40
[RouterD-LoopBack1] quit
# Configure Router E.
[RouterE] interface loopback 1
[RouterE-LoopBack1] isis prefix-sid index 50
[RouterE-LoopBack1] quit
Verifying the configuration
# Display LDP LSP information on Router B.
[RouterB] display mpls ldp lsp
Status Flags: * - stale, L - liberal, B - backup, N/A - unavailable
FECs: 5 Ingress: 3 Transit: 3 Egress: 2
FEC In/Out Label Nexthop OutInterface/LSINDEX
1.1.1.1/32 2173/-
-/2173(L)
2.2.2.2/32 3/-
105
-/2175(L)
3.3.3.3/32 -/3 11.0.0.2 GE0/0/2
2175/3 11.0.0.2 GE0/0/2
4.4.4.4/32 -/2174 11.0.0.2 GE0/0/2
2174/2174 11.0.0.2 GE0/0/2
5.5.5.5/32 -/2172 11.0.0.2 GE0/0/2
2172/2172 11.0.0.2 GE0/0/2
# Display IS-IS SRLSP information on Router B.
[RouterB] display mpls lsp protocol isis
FEC Proto In/Out Label Out Inter/NHLFE/LSINDEX
1.1.1.1/32 ISIS 16010/3 GE0/0/1
1.1.1.1/32 ISIS -/3 GE0/0/1
2.2.2.2/32 ISIS 16020/- -
4.4.4.4/32 ISIS 16040/2174 GE0/0/2
4.4.4.4/32 ISIS -/2174 GE0/0/2
5.5.5.5/32 ISIS 16050/2172 GE0/0/2
5.5.5.5/32 ISIS -/2172 GE0/0/2
The output shows that the IS-IS SRLSP entries for Router D and Router E are using LDP outgoing labels.
Example: Configuring IS-IS TI-LFA FRR
Network configuration
As shown in Figure 30 , complete the following tasks to implement TI-LFA FRR:
•
Configure IS-IS on Device A, Device B, and Device C to achieve network level connectivity.
•
Configure SR-MPLS on Device A, Device B, and Device C.
•
Configure TI-LFA FRR to remove the loop that exists on Link B and to implement fast traffic switchover to Link B when Link A fails.
Figure 30 Network diagram
Loop1
3.3.3.3/32
Device C Link A
Link B
GE
0/2
Cost 10
GE
0/1
GE
0/1
Cost 20
GE
0/1
Device A
GE0/2 Cost 10 GE0/2
Device B
Table 13 Interface and IP address assignment
Device
Device A
Device C
Interface IP address
Loop1 1.1.1.1/32
GE0/0/1
GE0/0/2
12.12.12.1/24
13.13.13.1/24
Loop1 3.3.3.3/32
Device
Device B
Interface IP address
Loop1 2.2.2.2/32
GE0/0/1
GE0/0/2
24.24.24.1/24
13.13.13.2/24
106
Device
Prerequisites
Interface IP address
GE0/0/1
GE0/0/2
12.12.12.2/24
24.24.24.2/24
Device Interface IP address
Configure IP addresses and masks for interfaces.
Procedure
1. Configure IS-IS on the switches to achieve network level connectivity and set the IS-IS cost style to wide:
# Configure Device A.
<DeviceA> system-view
[DeviceA] isis 1
[DeviceA-isis-1] network-entity 00.0000.0000.0001.00
[DeviceA-isis-1] cost-style wide
[DeviceA-isis-1] quit
[DeviceA] interface gigabitethernet 0/0/1
[DeviceA-GigabitEthernet0/0/1] isis enable 1
[DeviceA-GigabitEthernet0/0/1] isis cost 10
[DeviceA-GigabitEthernet0/0/1] quit
[DeviceA] interface gigabitethernet 0/0/2
[DeviceA-GigabitEthernet0/0/2] isis enable 1
[DeviceA-GigabitEthernet0/0/2] isis cost 10
[DeviceA-GigabitEthernet0/0/2] quit
[DeviceA] interface loopback 1
[DeviceA-LoopBack1] isis enable 1
[DeviceA-LoopBack1] quit
# Configure Device B.
<DeviceB> system-view
[DeviceB] isis 1
[DeviceB-isis-1] network-entity 00.0000.0000.0002.00
[DeviceB-isis-1] cost-style wide
[DeviceB-isis-1] quit
[DeviceB] interface gigabitethernet 0/0/1
[DeviceB-GigabitEthernet0/0/1] isis enable 1
[DeviceB-GigabitEthernet0/0/1] isis cost 20
[DeviceB-GigabitEthernet0/0/1] quit
[DeviceB] interface gigabitethernet 0/0/2
[DeviceB-GigabitEthernet0/0/2] isis enable 1
[DeviceB-GigabitEthernet0/0/2] isis cost 10
[DeviceB-GigabitEthernet0/0/2] quit
[DeviceB] interface loopback 1
[DeviceB-LoopBack1] isis enable 1
[DeviceB-LoopBack1] quit
# Configure Device C.
<DeviceC> system-view
[DeviceC] isis 1
[DeviceC-isis-1] network-entity 00.0000.0000.0003.00
107
[DeviceC-isis-1] cost-style wide
[DeviceC-isis-1] quit
[DeviceC] interface gigabitethernet 0/0/1
[DeviceC-GigabitEthernet0/0/1] isis enable 1
[DeviceC-GigabitEthernet0/0/1] isis cost 10
[DeviceC-GigabitEthernet0/0/1] quit
[DeviceC] interface gigabitethernet 0/0/2
[DeviceC-GigabitEthernet0/0/2] isis enable 1
[DeviceC-GigabitEthernet0/0/2] isis cost 20
[DeviceC-GigabitEthernet0/0/2] quit
[DeviceC] interface loopback 1
[DeviceC-LoopBack1] isis enable 1
[DeviceC-LoopBack1] quit
2. Configure MPLS TE:
# Configure Device A.
[DeviceA] mpls lsr-id 1.1.1.1
[DeviceA] mpls te
[DeviceA-te] quit
[DeviceA] interface gigabitethernet 0/0/1
[DeviceA-GigabitEthernet0/0/1] mpls enable
[DeviceA-GigabitEthernet0/0/1] mpls te enable
[DeviceA-GigabitEthernet0/0/1] quit
[DeviceA] interface gigabitethernet 0/0/2
[DeviceA-GigabitEthernet0/0/2] mpls enable
[DeviceA-GigabitEthernet0/0/2] mpls te enable
[DeviceA-GigabitEthernet0/0/2] quit
# Configure Device B.
[DeviceB] mpls lsr-id 2.2.2.2
[DeviceB] mpls te
[DeviceB-te] quit
[DeviceB] interface gigabitethernet 0/0/1
[DeviceB-GigabitEthernet0/0/1] mpls enable
[DeviceB-GigabitEthernet0/0/1] mpls te enable
[DeviceB-GigabitEthernet0/0/1] quit
[DeviceB] interface gigabitethernet 0/0/2
[DeviceB-GigabitEthernet0/0/2] mpls enable
[DeviceB-GigabitEthernet0/0/2] mpls te enable
[DeviceB-GigabitEthernet0/0/2] quit
# Configure Device C.
[DeviceC] mpls lsr-id 3.3.3.3
[DeviceC] mpls te
[DeviceC-te] quit
[DeviceC] interface gigabitethernet 0/0/1
[DeviceC-GigabitEthernet0/0/1] mpls enable
[DeviceC-GigabitEthernet0/0/1] mpls te enable
[DeviceC-GigabitEthernet0/0/1] quit
[DeviceC] interface gigabitethernet 0/0/2
[DeviceC-GigabitEthernet0/0/2] mpls enable
108
[DeviceC-GigabitEthernet0/0/2] mpls te enable
[DeviceC-GigabitEthernet0/0/2] quit
3. Enable SR-MPLS and SR-MPLS adjacency label allocation:
# Configure Device A.
[DeviceA] isis 1
[DeviceA-isis-1] address-family ipv4
[DeviceA-isis-1-ipv4] segment-routing mpls
[DeviceA-isis-1-ipv4] segment-routing adjacency enable
[DeviceA-isis-1-ipv4] quit
[DeviceA-isis-1] quit
# Configure Device B.
[DeviceB] isis 1
[DeviceB-isis-1] address-family ipv4
[DeviceB-isis-1-ipv4] segment-routing mpls
[DeviceB-isis-1-ipv4] segment-routing adjacency enable
[DeviceB-isis-1-ipv4] quit
[DeviceB-isis-1] quit
# Configure Device C.
[DeviceC] isis 1
[DeviceC-isis-1] address-family ipv4
[DeviceC-isis-1-ipv4] segment-routing mpls
[DeviceC-isis-1-ipv4] segment-routing adjacency enable
[DeviceC-isis-1-ipv4] quit
[DeviceC-isis-1] quit
4. Configure IS-IS prefix SIDs for Device A, Device B, and Device C:
# Configure Device A.
[DeviceA] interface loopback 1
[DeviceA-LoopBack1] isis prefix-sid index 10
[DeviceA-LoopBack1] quit
# Configure Device B.
[DeviceB] interface loopback 1
[DeviceB-LoopBack1] isis prefix-sid index 20
[DeviceB-LoopBack1] quit
# Configure Device C.
[DeviceC] interface loopback 1
[DeviceC-LoopBack1] isis prefix-sid index 30
[DeviceC-LoopBack1] quit
5. Configure TI-LFA FRR:
# Configure Device A.
[DeviceA] isis 1
[DeviceA-isis-1] address-family ipv4
[DeviceA-isis-1-ipv4] fast-reroute lfa
[DeviceA-isis-1-ipv4] fast-reroute ti-lfa
[DeviceA-isis-1-ipv4] fast-reroute microloop-avoidance enable
[DeviceA-isis-1-ipv4] segment-routing microloop-avoidance enable
[DeviceA-isis-1-ipv4] quit
[DeviceA-isis-1] quit
109
# Configure Device B.
[DeviceB] isis 1
[DeviceB-isis-1] address-family ipv4
[DeviceB-isis-1-ipv4] fast-reroute lfa
[DeviceB-isis-1-ipv4] fast-reroute ti-lfa
[DeviceB-isis-1-ipv4] fast-reroute microloop-avoidance enable
[DeviceB-isis-1-ipv4] segment-routing microloop-avoidance enable
[DeviceB-isis-1-ipv4] quit
[DeviceB-isis-1] quit
# Configure Device C.
[DeviceC] isis 1
[DeviceC-isis-1] address-family ipv4
[DeviceC-isis-1-ipv4] fast-reroute lfa
[DeviceC-isis-1-ipv4] fast-reroute ti-lfa
[DeviceC-isis-1-ipv4] fast-reroute microloop-avoidance enable
[DeviceC-isis-1-ipv4] segment-routing microloop-avoidance enable
[DeviceC-isis-1-ipv4] quit
[DeviceC-isis-1] quit
Verifying the configuration
# Display IPv4 IS-IS routing information for 2.2.2.2/32.
[DeviceA] display isis route ipv4 2.2.2.2 32 verbose level-1 1
Route information for IS-IS(1)
-----------------------------
Level-1 IPv4 Forwarding Table
-----------------------------
IPv4 Dest : 2.2.2.2/32 Int. Cost : 10 Ext. Cost : NULL
Admin Tag : - Src Count : 1 Flag : R/L/-
InLabel : 16020 InLabel Flag: -/N/-/-/-/-
NextHop : Interface : ExitIndex :
13.13.13.2 GE0/0/2 0x00000103
Nib ID : 0x14000005 OutLabel : 16020 OutLabelFlag: I
LabelSrc : SR
TI-LFA:
Interface : GE0/0/1
BkNextHop : 12.12.12.2 LsIndex : 0x00000002
Backup label stack(top->bottom): {16030, 2175}
Route label: 16020
Flags: D-Direct, R-Added to Rib, L-Advertised in LSPs, U-Up/Down Bit Set
InLabel flags: R-Readvertisement, N-Node SID, P-no PHP
E-Explicit null, V-Value, L-Local
OutLabelFlags: E-Explicit null, I-Implicit null, N-Normal, P-SR label prefer
The output shows TI-LFA backup next hop information.
110
111
Configuring SRv6
About SRv6
Segment Routing (SR) is a source routing technology. The source node selects a path for packet forwarding, and then encodes the path in the packet header as an ordered list of segments. Each segment is identified by the Segment Identifier (SID). The SR nodes along the path forward the packets based on the SIDs in the packets. Only the source node needs to maintain the path status.
IPv6 Segment Routing (SRv6) uses IPv6 addresses as SIDs to forward packets.
Basic concepts
SR node
An SR node is a node that supports the SRv6 feature. The following SR nodes are available:
•
Ingress node (source node) —Selects a path for packet forwarding, encodes the path as an ordered SID list in the routing extension header.
•
Transit node —Forwards the packets based on the SID list.
•
Egress node (tail node) —Removes the routing extension header and forwards the packets to the destination.
SID
SRv6 supports SRv6 SIDs that have specific functions.
An SRv6 SID is in the format of IPv6 address, but the IPv6 address does not belong to any interface on any device.
As shown in Figure 31 , an SRv6 SID contains the Locator, Function, Arguments, and Must be zero
(MBZ) portions.
•
Locator —Identifies the network segment of the SID. The locator of an SRv6 SID must be unique in the SR domain.
•
Function —Contains an opcode that identifies the network function of an SID. An SR node will execute the function in the SRv6 SID Function field of an SRv6 packet after it receives that
SRv6 packet.
•
Arguments —Defines flow and service parameters for SRv6 packets.
•
MBZ —When the total number of bits in the Locator, Function, and Arguments portions is less than 128 bits, the remaining bits are padded with 0s.
Figure 31 SRv6 SID
128 bits
Locator Function Agruments MBZ
According to whether SRv6 SIDs are compressible, SRv6 SIDs are divided into the following categories for a locator:
•
Non-compressible SRv6 SIDs —Include static and dynamic SRv6 SIDs. The formats are as follows:
Static SRv6 SID = ipv6-prefix + 0s + opcode + 0s.
112
−
The ipv6-prefix portion is specified by using the ipv6-address and prefix-length arguments in the locator command. The number of bits occupied by the ipv6-prefix portion is determined by the prefix-length argument.
−
The number of bits occupied by 0s (following the ipv6-prefix portion) is determined by the dynamic-length argument.
−
The opcode portion is specified by using the opcode command. The number of bits occupied by the opcode portion is determined by the static-length argument.
−
The number of bits occupied by 0s (following the opcode portion) is determined by the args-length argument.
Dynamic SRv6 SID = ipv6-prefix + dynamic + 0s.
−
The ipv6-prefix portion is specified by using the ipv6-address and prefix-length arguments in the locator command. The number of bits occupied by the ipv6-prefix portion is determined by the prefix-length argument.
−
The dynamic portion is dynamically assigned by IGP or BGP. The number of bits occupied by the dynamic portion is determined by the dynamic-length argument.
−
The number of bits occupied by 0s is the sum of the values for the static-length and args-length arguments.
For example, use the locator test1 ipv6-prefix 100:200:DB8:ABCD:: 64 static 24 args 32 command.
The locator is 100:200:DB8:ABCD::. The prefix length is 64 bits.
The static portion length is 24 bits.
The Args portion length is 32 bits.
The dynamic portion length is 8 bits.
In this example, the following non-compressible static SRv6 SID range and dynamic SRv6 SID range are obtained on the locator:
The start value for static SRv6 SIDs is 100:200:DB8:ABCD:0:1::.
The end value for static SRv6 SIDs is 100:200:DB8:ABCD:FF:FFFF::.
The start value for dynamic SRv6 SIDs is 100:200:DB8:ABCD:100::.
The end value for dynamic SRv6 SIDs is 100:200:DB8:ABCD:FFFF:FFFF::.
Figure 32 Non-compressible SRv6 SIDs prefix-length staticlength
Static args-length
Locator Dynamic Args
Function
•
Compressible SRv6 SIDs —You can specify compressible SRv6 SIDs in a static segment or use IGP to automatically allocate compressible SRv6 SIDs in a dynamic segment. For example, use the locator test1 ipv6-prefix 100:200:DB8:ABCD:: 64 common-prefix
48 coc32 static 8 args 16 command.
The locator is 100:200:DB8:ABCD::. The prefix length is 64 bits.
The common prefix length is 48 bits. A compressed SRv6 SID does not contain this portion.
The static portion length is 8 bits.
The Args portion length is 16 bits.
The dynamic portion length is 8 bits.
In this example, the following compressible static SRv6 SID range and dynamic SRv6 SID range are obtained on the locator:
113
The start value for static SRv6 SIDs is 100:200:DB8:ABCD:1::.
The end value for static SRv6 SIDs is 100:200:DB8:ABCD:FF::.
The start value for dynamic SRv6 SIDs is 100:200:DB8:ABCD:100::.
The end value for dynamic SRv6 SIDs is 100:200:DB8:ABCD:FFFF::.
Figure 33 Compressible SRv6 SIDs
Locator prefix-length
Block Node ID
Common prefix
Dynamic
G-SID (32 bit) staticlength
Static argslength
Args
According to the functions of SRv6 SIDs, SRv6 SIDs are divided into the following categories:
•
End SID —Identifies the prefix of a destination address in the network.
•
End.X SID —Identifies a link in the network.
•
End.DT4 SID —Identifies an IPv4 VPN in the network. The function of an End.DT4 SID is decapsulating packets and searching the routing table of the corresponding IPv4 VPN instance to forward the packets. End.DT4 SIDs are applicable to MPLS L3VPN and EVPN L3VPN scenarios.
•
End.DT6 SID —Identifies an IPv6 VPN in the network. The function of an End.DT6 SID is decapsulating packets and searching the routing table of the corresponding IPv6 VPN instance to forward the packets. End.DT6 SIDs are applicable to IPv6 MPLS L3VPN and IPv6 EVPN
L3VPN scenarios.
•
End.DT46 SID —Identifies an IPv4 or IPv6 VPN in the network.
•
End.DX2 SID —Identifies one end of a Layer 2 cross-connect. The function of an End.DX2 SID is removing the outer IPv6 header and SRH of packets and forwarding the decapsulated packets to the output interface of the SID. End.DX2 SIDs are applicable to EVPN VPWS scenarios.
•
End.DX2L SID —Identifies packets that come from a bypass SRv6 PW. The packets will not be forwarded back to the bypass SRv6 PW for loop prevention. The function of an End.DX2L SID is removing the outer IPv6 header and SRH of packets and forwarding the decapsulated packets to the output interface of the SID. End.DX2L SIDs are applicable to EVPN VPWS over
SRv6 multihomed sites.
•
End.DT2M SID —Identifies one end of a Layer 2 cross-connect and floods traffic. The function of an End.DT2M SID is removing the outer IPv6 header and SRH of packets and flooding the decapsulated packets in the BD. End.DT2M SIDs are applicable to EVPN VPLS BUM traffic.
•
End.DT2U SID —Identifies one end of a Layer 2 cross-connect and performs unicast forwarding. The function of an End.DT2U SID is removing the outer IPv6 header and SRH of packets, looking up the MAC address table for the destination MAC address, and forwarding the packets to the output interface based on the MAC address entry. End.DT2U SIDs are applicable to EVPN VPLS unicast traffic.
•
End.DT2UL SID —Identifies packets that come from a bypass SRv6 PW. The packets will not be forwarded back to the bypass SRv6 PW for loop prevention. The function of an End.DT2UL
SID is removing the outer IPv6 header and SRH of packets and forwarding the packets to the output interface through destination MAC address lookup. End.DT2UL SIDs are applicable to
EVPN VPLS over SRv6 multihomed sites.
•
End.M SID —Applies to the SRv6 TE policy tailend protection scenario. For more information about End.M SIDs, see "Configuring SRv6 TE policies."
•
End.OP SID —Applies to the SRv6 OAM scenario. For more information about End.OP SIDs, see "Configuring SRv6 OAM."
•
End.AS SID —Applies to the SRv6 service chain static proxy scenario. For more information about End.AS SIDs, see "Configuring SRv6 service chains."
114
•
End.AM SID —Applies to the SRv6 service chain masquerading scenario. For more information about End.AM SIDs, see "Configuring SRv6 service chains."
Use IGP to advertise SRv6 SIDs for an SR node. The other SR nodes will generate route entries of that SR node based on the advertised information.
SRv6 SID flavors
Use SRv6 SID flavors to change the forwarding behaviors of SRv6 SIDs in order to meet multiple service requirements. The following SRv6 SID flavors are supported:
•
Penultimate Segment POP of the SRH (PSP) —The penultimate SRv6 node removes the
SRH to reduce the workload of the end SRv6 node and improve the forwarding efficiency. The end SRv6 node does not read the SRH, and it only looks up the local SID table for the destination IPv6 address of packets to forward the packets.
•
NO PSP —The penultimate SRv6 node does not remove the SRH.
Local SID forwarding table
An SRv6-enabled node maintains a local SID forwarding table that records the SRv6 SIDs generated on the local node. The local SID forwarding table has the following functions:
•
Stores local generated SRv6 SID forwarding information.
•
Stores SRv6 SID operation types.
Segment List
A Segment List is an ordered list of SIDs, which is also referred to as a Segment Identifier (SID) list in this document. The SR nodes forward packets based on the SIDs in the order that they are arranged in the SID list.
SRv6 tunnel
An SRv6 tunnel is a virtual point-to-point connection established between the SRv6 ingress node and egress node. IPv6 packets are encapsulated at the ingress node and de-encapsulated at the egress node.
SRv6 packet format
An outer IPv6 header and a Segment Routing Header (SRH) are added to the original Layer 3 data packet to form an SRv6 packet.
As shown in Figure 34 , the value for the
Next Header field is 43 in the outer IPv6 header, which indicates that the header next to the IPv6 header is a routing extension header. The value for the
Routing Type field in the routing extension header is 4, which indicates that the routing extension header is an SRH. The SRH header contains the following fields:
•
8-bit Next Header —Identifies the type of the header next to the SRH.
•
8-bit Hdr Ext Len —Length of the SRH header in 8-octet units, not including the first 8 octets.
•
8-bit Routing Type —The value for this field is 4, which represents SRH.
•
8-bit Segments Left —Contains the index of the next segment to inspect in the Segment List.
The Segments Left field is set to n -1 where n is the number of segments in the Segment List.
Segments Left is decremented at each segment.
•
8-bit Last Entry —Contains the index of the first SID in the path used to forward the packet.
•
8-bit Flags —Contains flags.
•
16-bit Tag —Tags a packet as part of a class or group of packets, for example, packets sharing the same set of properties.
•
Segment List —Contains 128-bit IPv6 addresses representing the ordered segments. The
Segment List is encoded starting from the last segment of the path. The first element of the segment list (Segment List [0]) contains the last segment of the path, the second element
115
(Segment List [1]) contains the penultimate segment of the path and so on. The number enclosed in a pair of brackets is the index of a segment.
Figure 34 SRv6 packet format
0
Ver
3
Traffic class
11 15 23
Payload length
Flow label
Next header
Source address (128 bits)
Hop limit
31
Destination address (128 bits)
Outer IPv6 header SRH Original packet
0
Next header
Last Entry
7
Hdr Ext
Len
15
Flags
Routing
23
Segments
31
Type Left
Tag
Segment List[0] (128 bits IPv6 address)
…
Segment List[n-1] (128 bits IPv6 address)
Optional Type Length Value objects (variable)
SRv6 packet forwarding
As shown in Figure 35 , an IPv6 packet is forwarded through an SRv6 tunnel as follows:
1. Upon receiving an IPv6 packet, Device A finds in the routing table that the outgoing interface is an SRv6 tunnel interface. The packet is delivered to the tunnel interface.
2. The SRv6 tunnel interface encapsulates the IPv6 packet as follows:
Adds an SRH header. The Segments Left (SL) value is the number of segments minus one.
The path from ingress to egress has three segments, so the SL value is set to 2. The encapsulated SID list is Segment List [0]=D, Segment List [1]=C, Segment List [2]=B. The
Segment List is encoded starting from the last segment of the path to the first segment of the path.
Adds an outer IPv6 header. The source address is the tunnel source, and the destination address is determined by the SL value. On Device A, the SL value is 2, which points to the
IPv6 address of Device B, so the destination address is the IPv6 address of Device B.
3. Device A searches the routing table for the destination address in the newly encapsulated IPv6 header, and forwards the packet to Device B.
4. Device B first checks the destination address and SID type in the outer IPv6 header.
If the SID type is End.X, the device obtains the output interface and next hop information based on the End.X SID.
If the SID is not End.X, the device does not perform any operation.
Then, the device checks the SL value in the SRH header and decreases the value by one. Then, the device searches for the IPv6 address pointed by Segment List [1] and uses the IPv6 address of Device C to replace the destination address of the outer IPv6 header.
5. Device B performs one of the following operations depending on the SID type:
116
For an End.X SID, the device forwards the encapsulated packet to Device C based on the obtained output interface and next hop information.
For an SID of the other type, the device searches the routing table for the destination address in the outer IPv6 header and forwards the packet to Device C.
6.
Device C performs the same operations as what Device B has done in steps 4 and 5 , and then
forwards the packet to Device D.
7. Device D checks the SL value in the SRH header and finds that the value has decreased to 0.
The device performs the following operations: a. De-encapsulates the packet by removing the outer IPv6 header and the SRH header. b. Forwards the original IP data packet to the destination based on the destination address.
Figure 35 SRv6 tunnel packet forwarding
IPv6 Hdr
SR Hdr
SA=A,DA=B
(D,C,B) SL=2
IP data
IPv6 Hdr
SR Hdr
SA=A,DA=D
(D,C,B) SL=0
IP data
Device A Device B Device C
IPv6 Hdr
SR Hdr
SA=A,DA=C
(D,C,B) SL=1
IP data
Device D
Directing traffic to an SRv6 tunnel
After an SRv6 tunnel is established, traffic is not forwarded on the tunnel automatically. You must direct the traffic to the tunnel by configuring a static route or automatic route advertisement.
Static routing
You can direct traffic to an SRv6 tunnel by creating a static route that reaches the destination through the tunnel interface on the source node. This is the easiest way to implement SRv6 tunnel forwarding.
When traffic to multiple networks is to be forwarded through the SRv6 tunnel, you must configure multiple static routes, resulting in increased configuration and maintenance workloads.
For more information about static routing, see Layer 3—IP Routing Configuration Guide .
Automatic route advertisement
Automatic route advertisement distributes the SRv6 tunnel to the IGP (OSPF or IS-IS), so the SRv6 tunnel can participate in IGP route calculation. Automatic route advertisement is easy to configure and maintain.
Automatic route advertisement can be implemented by using the following methods:
•
IGP shortcut —Also known as AutoRoute Announce. It considers the SRv6 tunnel as a link that directly connects the tunnel ingress node and the egress node. Only the ingress node uses the
SRv6 tunnel during IGP route calculation.
•
Forwarding adjacency —Considers the SRv6 tunnel as a link that directly connects the tunnel ingress node and the egress node, and advertises the link to the network through an IGP. Every node in the network uses the SRv6 tunnel during IGP route calculation.
117
IMPORTANT:
Only IGP shortcut is supported in the current software version.
As shown in Figure 36 , an SRv6 tunnel exists from Device D to Device C. IGP shortcut enables only
the ingress node Device D to use the SRv6 tunnel in IGP route calculation. Device A cannot use this tunnel to reach Device C. With forwarding adjacency enabled, Device A can learn this SRv6 tunnel and transfer traffic to Device C by forwarding the traffic to Device D.
Figure 36 IGP shortcut and forwarding adjacency diagram
Device B
20
Device C
10
Device A
10
10 20
10
Device D Device E
G-SRv6
Background
In an SRv6 TE policy scenario, the administrator needs to add the 128-bit SRv6 SIDs of SRv6 nodes on the packet forwarding path into the SID list of the SRv6 TE policy. If the packet forwarding path is long, a large number of SRv6 SIDs will be added to the SID list of the SRv6 TE policy. This greatly increases the size of the SRv6 packet header, resulting in low device forwarding efficiency and reduced chip processing speed. The situation might be worse in a scenario that spans across multiple ASs where a much greater number of end-to-end SRv6 SIDs exist.
Generalized SRv6 (G-SRv6) encapsulates shorter SRv6 SIDs (G-SIDs) in the segment list of SRH by compressing the 128-bit SRv6 SIDs. This reduces the size of the SRv6 packet header and improves the efficiency for forwarding SRv6 packets. In addition, G-SRv6 supports both 128-bit
SRv6 SIDs and G-SIDs in a segment list.
About G-SRv6
Typically, an address space is reserved for SRv6 SID allocation in an SRv6 subnet. This address space is called an SID space. In the SRv6 subnet, all SIDs are allocated from the SID space. The
SIDs have the same prefix (common prefix). The SID common prefix is redundant information in the
SRH.
G-SRv6 removes the common prefix and carries only the variable portion of SRv6 SIDs (G-SIDs) in the segment list, effectively reducing the SRv6 packet header size. To forward a packet according to routing table lookup, SRv6 replaces the destination IP address of the packet with the combination of the G-SID and common prefix in the segment list of the SRH.
With the compression efficiency and network scale taken into consideration, the ideal length of SRv6
SIDs is 32 bits after compression through G-SRv6.
118
G-SID format
As shown in Figure 37 , the locator portion of an SRv6 SID contains the Common Prefix and Node ID
portions. The Common Prefix portion represents the address of the common prefix. The Node ID portion identifies a node. G-SRv6 can compress all SIDs with the same common prefix into 32-bit
G-SIDs. A G-SID contains the Node ID and Function portions of a 128-bit SRv6 SID. A 128-bit SRv6
SID is formed by the Common Prefix portion, a 32-bit G-SID, and the 0 (Args&MBZ) portion.
Figure 37 Compressible SRv6 SID
Locator
Common Prefix Node ID Function Args&MBZ
G-SID
G-SRv6 packet
G-SRv6 packet format
As shown in Figure 38 , G-SRv6 can encapsulate both G-SIDs and 128-bit SRv6 SIDs in the segment
list of the SRH. It needs to encapsulate four G-SIDs in a group to the original location of a 128-bit
SRv6 SID. If the location contains fewer than four G-SIDs (less than 128 bits), G-SRv6 pads the remaining bits with 0s. Multiple consecutive G-SIDs form a compressed path, called a G-SID list. A
G-SID list can contain one or more groups of G-SIDs.
Figure 38 G-SRv6 packet format
Version
Next header
Last Entry
Traffic Class Flow Label
Payload Length Next Header=43
Source Address(128 bits)
Destination Address(128 bits)
Hdr Ext Len
Flags
Routing Type
Tag
Hop Limit
Segments Left
G-SID c0
128-bit SRv6 SID
G-SID c1 ( COC ) G-SID c2 ( COC ) G-SID c3 ( COC )
G-SID b0 ( COC ) G-SID b1 ( COC ) G-SID b2 ( COC ) G-SID b3 ( COC )
128-bit SRv6 SID
G-SID a0 G-SID a1 ( COC ) G-SID a2 ( COC ) G-SID a3 ( COC )
128-bit SRv6 SID ( COC )
128-bit SRv6 SID
NOTE:
If the SRv6 SID of the next node requires compression, the routing protocol adds the Continue of
Compression (COC) flag to the advertised SRv6 SID of the local node. The COC flag indicates that the next SRv6 SID is a G-SID. A COC flag only identifies the forwarding behavior of an SRv6 SID,
and is not actually carried in the packet. The COC flags in Figure 38
are for illustration purposes only.
The G-SIDs in the segment list are arranged as follows:
119
•
The SRv6 SID before the G-SID list is a 128-bit SRv6 SID with the COC flag, indicating that the next SID is a 32-bit G-SID.
•
Except the last G-SID, all G-SIDs in the G-SID list must carry the COC flag to indicate that the next SID is a 32-bit G-SID.
•
The last G-SID in the G-SID list must be a 32-bit G-SID without the COC flag, indicating that the next SID is a 128-bit SRv6 SID.
•
The next SRv6 SID after the G-SID list is a 128-bit SRv6 SID that can carry the COC flag or does not carry the COC flag.
Calculating the destination address with G-SID
As shown in Figure 39 , G-SRv6 combines the G-SID and Common Prefix in the segment list to form
a new destination address.
•
Common Prefix —Common prefix address manually configured by the administrator.
•
G-SID —Compressed 32-bit SID obtained from the SRH.
•
SID Index (SI) —Index that identifies a G-SID in a group of G-SIDs. This field is the least significant two bits of the destination IPv6 address. The value range is 0 to 3. The SI value decreases by 1 at each node that performs SID compression. If the SI value becomes 0, the SL value decreases by 1. In a group of G-SIDs in the segment list, the G-SIDs are arranged from left to right based on SI values. The SI value is 0 for the leftmost G-SID, and is 3 for the rightmost G-SID.
•
0 —If the total length of the Common Prefix, G-SID, and SI portions is less than 128 bits, the deficient bits are padded with 0s before the SI portion.
Figure 39 Destination address calculated with G-SID
Destination Address(128 bits)
Common Prefix G-SID 0 SI
A:0:0:0: 1:1 0 3
Suppose the following conditions exist:
•
The Common Prefix deployed on the SRv6 node is A:0:0:0::/64.
•
The G-SID in the SRv6 packet is 1:1.
•
The SI value associated with the G-SID is 3.
Based on the previous conditions, the device calculates the destination address as A:0:0:0:1:1::3.
Upon receiving the G-SRv6 packet, the SRv6 node calculates the destination address for the packet as follows:
•
If the destination address of the packet is a 128-bit SRv6 SID with the COC flag in the segment list, the next SID is a G-SID. The device decreases the SI value by 1 and searches for the
G-SID group corresponding to [SI-1]. Then, the device calculates the destination address based on the 32-bit G-SID identified by SI value 3.
•
If the destination address of the packet is a 32-bit SRv6 SID with the COC flag in the segment list, the next SID is a G-SID.
If the SI value is larger than 0, the device decreases the SI value by 1 and searches for the
G-SID group corresponding to SL value of the packet. Then, the device calculates the destination address based on the 32-bit G-SID identified by [SI-1].
120
If the SI value is equal to 0, the device decreases the SL value by 1, resets the SI value to 3, and searches for the G-SID group corresponding to the SL value of the packet. Then, the device calculates the destination address based on the 32-bit G-SID identified by SI value 3.
•
If the destination address of the packet is a 32-bit SRv6 SID without the COC flag in the segment list, the device decreases the SL value by 1 and searches for the 128-bit SRv6 SID corresponding to [SL-1]. Then, the device replaces the destination address in the IPv6 header with the SRv6 SID.
•
If the destination address of the packet is a 128-bit SRv6 SID without the COC flag in the segment list, the device decreases the SL value by 1 and searches for the 128-bit SRv6 SID corresponding to [SL-1]. Then, the device replaces the destination address in the IPv6 header with the SRv6 SID.
BGP-EPE
IGP for SRv6 cannot advertise SRv6 SIDs across ASs. To advertise SRv6 SIDs across ASs, use
BGP Egress Peer Engineering (BGP-EPE).
BGP-EPE can allocate BGP peer SIDs to inter-AS segments.
•
If the device has established BGP LS peer relationship with a network controller, it advertises the peer SIDs to the network controller through extended BGP LS messages. Then, the controller orchestrates the IGP SIDs and BGP peer SIDs to realize optimal inter-AS traffic forwarding.
•
If the device has not established BGP LS peer relationship with a network controller, it advertises the peer SIDs to a BGP peer through BGP LS messages. When a device that has established BGP LS peer relationship with a network controller receives the peer SIDs, it advertises the peer SIDs to the network controller through BGP LS messages.
BGP-EPE supports automatic peer SID allocation and static peer SID allocation. As shown in Figure
BGP-EPE can allocate the following peer SIDs:
•
PeerNode SID —Identifies a peer node. BGP-EPE allocates a PeerNode SID to each BGP session. If the device establishes EBGP peer relationship with a peer through a loopback interface, it might have multiple physical links to reach the peer. In this case, the PeerNode SID for this peer is associated with multiple output interfaces. Traffic destined for this peer based on the PeerNode SID will be distributed among these output interfaces.
•
PeerAdj SID —Identifies an adjacency link that can reach a peer node. If the device establishes
EBGP peer relationship with a peer through a loopback interface, it might have multiple physical links to reach the peer. Each link is allocated a PeerAdj SID. When the device forwards traffic based on a PeerAdj SID, the traffic is forwarded out of the interface that is attached to the link identified by the PeerAdj SID.
•
PeerNode-Adj SID —Identifies a peer node and identifies one or multiple adjacency links that can reach a peer node.
•
PeerSet SID —Identifies a group of peer nodes in a BGP-EPE SRv6 peer set. A PeerSet SID corresponds to multiple PeerNode SIDs and PeerAdj SIDs. When the device forwards traffic based on a PeerSet SID, it distributes the traffic among multiple peers.
121
Figure 40 BGP-EPE network diagram
BGP EPE
PE 1 Loop1
AS 100
ASBR 3
ASBR 1
PeerAdj SID
100:
AB:1
::2
PeerAdj SID
100:
AB:1
::3
PeerNode SID
100:
AB::1
PeerNode SID
100
:AB
::2
PeerNode SID
100:
AB::4
ASBR 4
PE 2
PeerNode SID
ASBR 2
100:AB
::5
PeerSet SID
100:AB::3 ASBR 5
Loop1
AS 200
AS 300
PE 3
PE 4
BGP EPE
As shown in Figure 40 , BGP-EPE allocates peer SIDs as follows:
•
ASBR 1 and ASBR 3 have two direct physical links. They establish EBGP peer relationship through loopback interfaces. On ASBR 1, BGP-EPE allocates PeerNode SID 100:AB::1 to
ASBR 3 and allocates PeerAdj SIDs 100:AB:1::2 and 100:AB:1::3 to the physical links. When
ASBR 1 forwards traffic to ASBR 3 based on the PeerNode SID, the two physical links load share the traffic.
•
EBGP peer relationship has been established between ASBR 1 and ASBR 5, between ARBR 2 and ASBR 4, and between ASBR 2 and ASBR 5 through directly connected physical interfaces.
On ASBR 1, BGP-EPE allocates PeerNode SID 100:AB::2 to ASBR 5. On ASBR 2, BGP-EPE allocates PeerNode SIDs 100:AB::4 and 100:AB::5 to ASBR 4 and ASBR 5, respectively.
•
ASBR 4 and ASBR 5 each has established EBGP peer relationship with ASBR 2. On ASBR 2, peers ASBR 4 and ASBR 5 are added to a peer set. BGP-EPE allocates PeerSet SID 100:AB::3 to the peer set. When ASBR 2 forwards traffic based on the PeerSet SID, the traffic is distributed to both ASBR 4 and ASBR 5 for load sharing.
The SIDs allocated to peers by BGP-EPE are not advertised to the peers. Route types used by the peers do not affect BGP-EPE.
TI-LFA FRR
Topology-Independent Loop-Free Alternate Fast Re-Route (TI-LFA FRR) provides link and node protection for SRv6 tunnels. When a link or node fails, TI-LFA FRR switches the traffic to the backup path to ensure continuous data forwarding.
TI-LFA FRR background
As shown in Figure 41 , node A sends data packets to node F. When the link between node B and
node E fails, node B forwards the data packets to node C. The cost of the link between node C and node D is 100 (which is greater than the cost of the link between node C and node D) and the routes on node C have not converged. As a result, node C determines that the next hop of the optimal path to reach node F is node B. Then, node C forwards the data packets back to node B, which causes a loop.
122
Figure 41 TI-LFA application scenario
A B
Cost 10
Cost 10
Cost 10
C
Cost 100
Cost 10 Cost 10
F E D
Failed link Path before a failure
Path after a failure
To resolve this issue, deploy TI-FLA on the SRv6 network. As shown in Figure 42 , when the link
between node B and node E fails, node B uses the backup path calculated by TI-LFA to forward the data packets along the B->C->D->E path.
Figure 42 TI-LFA forwarding network diagram
A
Cost 10
B
Cost 10
C
Cost 10
Cost 100
Cost 10
Cost 10
F E D
Failed link Path before a failure
Path after a failure
TI-LFA FRR concepts
•
P space —Use the source node of the protected link as the root to establish a shortest path tree.
All nodes that are reachable from the source node without passing the protected link form the P space. Nodes in the P space are called P nodes.
•
Extended P space —Use the source node of the protected link and its neighbors as the roots to establish shortest path trees. All nodes that are reachable from the source node or one of its neighbors without passing the protected link form the extended P space. The P space is a subset of the extended P space.
•
Q space —Use the destination node of the protected link as the root to establish a reverse shortest path tree. All nodes that are reachable from the root node without passing the protected link form the Q space. Nodes in the Q space are called Q nodes.
•
Repair list —A constraint path used to indicate how a P node reaches a Q node when the P space and Q space do not have common nodes. The repair list contains the following SRv6
SIDs:
SRv6 SIDs of P nodes.
SRv6 SIDs from P nodes to nearest Q nodes.
TI-LFA FRR protection types
The following TI-LFA traffic protection types are available:
123
•
Link protection —Protects traffic that traverses a specific link.
•
Node protection —Protects traffic that traverses a specific node.
Node protection takes precedence over link protection.
TI-LFA FRR path calculation
The numbers on links represent the link costs. A data flow traverses PE 1, P 1, and PE 2. To protect data against P 1 failure, TI-LFA FRR calculates the extended P space, Q space, shortest path tree converged after P 1 fails, repair list, and backup output interface, and creates the backup forwarding entry.
TI-LFA FRR calculates the backup path by using the following steps:
1. Calculates the extended P space: P 2.
2. Calculates the Q space: PE 2 and P 4.
3. Calculates the shortest path tree converged after P 1 fails: PE 1 --> P 2 --> P 4 --> PE 2.
4. Calculates the repair list: End.X SID C of the link between P 2 and P 3 and End.X SID D of the link between P 3 and P 4.
5. Calculates the backup output interface, that is, the output interface to the next hop after the link from PE 1 to P 1 fails.
Figure 43 TI-LFA FRR diagram
A
PE 1
B
P 1
E
PE 2
10 900
50 10 10 Q space
920
C
1000
P 2
Extended
P space
P 3
Repair List
SRH[(D, C) SL=1]
D
900
P 4
Backup output interface
Failed node
TI-LFA FRR forwarding process
After TI-LFA FRR finishes backup path calculation, traffic will be switched to the backup path in response to a primary path failure.
As shown in Figure 44 , P 2 is a P node and P 4 and PE 2 are Q nodes. When the next hop on the
primary path (P 1) fails, TI-LFA FRR switches the traffic to the backup path. The following are the detailed steps:
1. PE 1 looks up the IPv6 routing table for the destination IPv6 address of a packet and finds that the next hop is P 2. PE 1 encapsulates the packet according to the repair list.
Adds an SRH header. The SID list is Segment List [0]=D and Segment List [1]=C. The SIDs are arranged from the farthest node to the nearest node.
124
Adds an outer IPv6 header. The source address is address A on source node PE 1 and the destination address is the address pointed by SL. Because the SL is 1, the destination address is C as pointed by Segment List [1].
2. After P2 receives the packet, it performs the following operations: a. Checks the SL value in the SRH header and decreases the value by 1. b. Searches for the address pointed by Segment List [0] and finds that the address is End.X
SID D between P 3 and P 4. c. Replaces the destination address in the outer IPv6 header with End.X SID D. d. Obtains the output interface and next hop according to End.X SID C and forwards the encapsulated packet to P 3.
3. After P3 receives the packet, it performs the following operations: a. Checks the SL value in the SRH header and finds that the SL value is 0. b. Decapsulates the packet. c. Obtains the output interface and next hop according to End.X SID D and forwards the packet to P 4.
4. After P4 receives the packet, it searches the IP routing table for the destination IP address of the packet and forwards the packet to PE 2.
Figure 44 Data forwarding over the TI-LFA FRR backup path
E
PE 2
IPv6 SA=A, IPv6 DA=E
IP data
A
PE 1
B
P 1
IPv6 SA=A, IPv6 DA=C
SRH[(D, C) SL=1]
IP data
Extended
P space
C
P 2
IPv6 SA=A, IPv6 DA=D
SRH[(D, C) SL=0]
IP data
P 3
D
IPv6 SA=A, IPv6 DA=E
IP data
P 4
Q space
Primary path Backup path Failed node
SR microloop avoidance after a network failure
As shown in Figure 45 , when Device B fails, traffic to Device C will be switched to the backup path
calculated by TI-LFA. After Device A finishes route convergence, traffic will be switched to the post-convergence path. If Device D and Device F have not finished route convergence and still forward traffic along the pre-convergence path, a loop is formed between Device A and Device F.
The loop exists until Device D and Device F finish route convergence.
SR microloop avoidance can resolve this issue. After you configure TI-LFA, Device A first switches traffic to the backup path calculated by TI-LFA when Device B fails. Then, Device A waits for Device
D and Device F to finish route convergence before starting route convergence. After Device A also finishes route convergence, Device A switches the traffic to the converged route.
125
Figure 45 Diagram for SR microloop avoidance after a network failure
Device A Device B Device C
Device D Device E
Pre-convergence path
Post-convergence path
Backup path
Failed node
Device F Device G Device H
SR microloop avoidance after a failure recovery
As shown in Figure 46 , before the link between Device B and Device C recovers, traffic traverses
along the backup path. After the link recovers, Device A forwards the traffic to Device B if Device A finishes route convergence before Device B. With route convergence unfinished, Device B still forwards the traffic along the backup path. A loop is formed between Device A and Device B.
SR microloop avoidance can resolve this issue. After the link recovers, SR microloop avoidance automatically calculates the optimal path from Device A to Device C and forwards traffic along the path. To forward a packet along the newly calculated path, Device A adds, for example, the adjacency SID from Device B to Device C, to the packet and then sends the packet to Device B.
Then, Device B forwards the packet to Device C based on the path information.
Upon expiration of the microloop avoidance RIB-update-delay timer and completion of route convergence on Device B, Device A does not add path information to packets anymore. It will forward packets to Device C as usual.
126
Figure 46 Diagram for SR microloop avoidance after a failure recovery
IPv6 SA=a, IPv6 DA=b
SRH[(c, b) SL=1]
IP data a
Device A b
Device B
IPv6 SA=a, IPv6 DA=c
SRH[(c, b) SL=0]
IP data c
Device C
Backup path after a failure
Path after the failure is removed
Failed link
Device F Device E Device D
Protocols and standards
• draft-previdi-6man-segment-routing-header
• draft-ietf-6man-segment-routing-header
• draft-filsfils-spring-segment-routing
• draft-filsfils-spring-srv6-network-programming
SRv6 tasks at a glance
To configure SRv6, perform the following tasks:
1.
2.
This task is required if SRv6 compression is enabled.
3.
(Optional.) Configuring dynamic End.X SID deletion delay
4.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
5.
Using IGP to advertise SRv6 SIDs
6. Configuring BGP for SRv6
Enabling BGP to advertise routes for a locator
7.
Perform the following tasks on the source node of an SRv6 tunnel: a.
b.
Specifying an SID list for an SRv6 tunnel
c.
(Optional.) Configuring a service class for an SRv6 tunnel
d.
(Optional.) Enabling BFD echo-mode detection for an SRv6 tunnel
8.
(Optional.) Configuring traffic forwarding
9.
(Optional.) Configuring TI-LFA FRR
127
10.
(Optional.) Configuring the SRv6 MTU
11.
(Optional.) Configuring the SRv6 DiffServ mode
Prerequisites for SRv6
Before you configure an SRv6 tunnel, perform the following tasks:
•
Determine the ingress node, transit nodes, and egress node of the SRv6 tunnel.
•
Plan the IPv6 address of each SR node.
Configuring an SRv6 SID
Restrictions and guidelines
Each locator must have a unique name.
Do not configure the same IPv6 address prefix and prefix length for different locators. In addition, the
IPv6 address prefixes of different locators cannot overlap.
You cannot disable SRv6 or delete a locator in SRv6 view if the locator has dynamic SRv6 SIDs that are being used.
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. (Optional.) Enable anycast for the locator. anycast enable
By default, anycast is disabled for a locator.
A locator is an anycast locator if the A-bit is set in the Flags field of the Locator TLV in routing protocol packets. An anycast locator is shared by a group of SRv6 nodes.
5. Configure an opcode. Perform one of the following tasks:
Configure an End SID. opcode { opcode | hex hex-opcode } end [ no-psp ]
Configure an End.X SID. opcode { opcode | hex hex-opcode } end-x interface interface-type
interface-number nexthop nexthop-ipv6-address [ no-psp ]
Configure an End.DT4 SID. opcode { opcode | hex hex-opcode } end-dt4 [ vpn-instance vpn-instance-name [ evpn | l3vpn-evpn ] ]
The specified VPN instance must exist. An End.DT4 SID cannot be configured in different
VPN instances.
Configure an End.DT6 SID. opcode { opcode | hex hex-opcode } end-dt6 [ vpn-instance vpn-instance-name [ evpn | l3vpn-evpn ] ]
128
The specified VPN instance must exist. An End.DT6 SID cannot be configured in different
VPN instances.
Configure an End.DT46 SID. opcode { opcode | hex hex-opcode } end-dt46 [ vpn-instance vpn-instance-name [ evpn | l3vpn-evpn ] ]
The specified VPN instance must exist. An End.DT46 SID cannot be configured in different
VPN instances.
Configure an End.DX4 SID. opcode { opcode | hex hex-opcode } end-dx4 interface interface-type
interface-number nexthop nexthop-ipv4-address [ vpn-instance
vpn-instance-name [ evpn ] ]
The specified VPN instance must exist. An End.DX4 SID cannot be configured with different output interfaces or next hops.
Configure an End.DX6 SID. opcode { opcode | hex hex-opcode } end-dx6 interface interface-type
interface-number nexthop nexthop-ipv6-address [ vpn-instance
vpn-instance-name [ evpn ] ]
The specified VPN instance must exist. An End.DX6 SID cannot be configured with different output interfaces or next hops.
Configure an End.DX2 SID. opcode { opcode | hex hex-opcode } end-dx2 xconnect-group group-name connection connection-name
The specified cross-connect group and cross-connect must exist. opcode { opcode | hex hex-opcode } end-dx2 vsi vsi-name interface
interface-type interface-number
The specified VSI must exist.
Configure an End.DX2L SID. opcode { opcode | hex hex-opcode } end-dx2l xconnect-group group-name connection connection-name
The specified cross-connect group and cross-connect must exist. opcode { opcode | hex hex-opcode } end-dx2l vsi vsi-name interface
interface-type interface-number
The specified VSI must exist.
Configure an End.DT2M SID. opcode { opcode | hex hex-opcode } end-dt2m vsi vsi-name
The specified VSI must exist. An End.DT2M SID cannot be configured in different VSIs.
Configure an End.DT2U SID. opcode { opcode | hex hex-opcode } end-dt2u vsi vsi-name
The specified VSI must exist. An End.DT2U SID cannot be configured in different VSIs.
Configure an End.DT2UL SID. opcode { opcode | hex hex-opcode } end-dt2ul vsi vsi-name
The specified VSI must exist. An End.DT2UL SID cannot be configured in different VSIs.
Configure an End.M SID. opcode { opcode | hex hex-opcode } end-m mirror-locator
ipv6-address prefix-length
Configure an End.OP SID. opcode { opcode | hex hex-opcode } end-op
129
Configuring G-SIDs
Restrictions and guidelines
The IPv6 prefix length must be longer than the common prefix length.
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Enable SRv6 compression. srv6 compress enable
By default, SRv6 compression is disabled.
4. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length
common-prefix common-prefix-length coc32 [ static static-length ] ]
5. Configure an opcode. Perform one of the following tasks:
Configure an End SID.
opcode opcode end-coc32 [ no-psp ]
Configure an End.X SID. opcode opcode end-x-coc32 interface interface-type interface-number nexthop nexthop-address [ no-psp ]
Configuring dynamic End.X SID deletion delay
About this task
Packet loss occurs between OSPFv3 or IS-IS neighbors if the neighbors frequently delete and request dynamically allocated End.X SIDs for the links between them because of neighbor flapping.
To resolve this issue, set a delay timer for deleting dynamically allocated End.X SIDs when the neighbors are disconnected. If the neighbors are still disconnected when the delay timer expires, the device deletes the dynamically allocated End.X SIDs.
Restrictions and guidelines
The device always immediately deletes automatically allocated End.X SIDs without any delay in the following situations:
•
The reset ospfv3 process command is executed. For more information about this command, see OSPFv3 commands in Layer 3—IP Routing Command Reference .
•
The reset isis all command is executed. For more information about this command, see
IS-IS commands in Layer 3—IP Routing Command Reference .
•
Interfaces are deleted or removed. For example, an interface module is removed, or a subinterface or VLAN interface is deleted.
Procedure
1. Enter system view. system-view
2. Enter IS-IS IPv6 address family view or OSPFv3 process view.
Execute the following commands in sequence to enter IS-IS IPv6 address family view:
130
isis [ process-id ] [ vpn-instance vpn-instance-name ] address-family ipv6 [ unicast ]
Enter OSPFv3 process view. ospfv3 [ process-id | vpn-instance vpn-instance-name ] *
3. Enable dynamic End.X SID deletion delay and set the delay time. segment-routing ipv6 end-x delete-delay [ time-value ]
By default, dynamic End.X SID deletion delay is enabled and the delay time is 1800 seconds.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
Restrictions and guidelines
As a best practice to ensure correct traffic forwarding in an SRv6 network, specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated packets.
Using IGP to advertise SRv6 SIDs
About this task
Use an IGP protocol to advertise the SRv6 SID of a locator by applying the locator to the IGP protocol.
To use an IGP protocol to advertise G-SIDs to neighbors, enable SRv6 compression for that IGP protocol.
Prerequisites
If IS-IS is used to advertise SRv6 SIDs, make sure the cost style of IS-IS is wide , compatible , or wide-compatible . For more information about the cost styles of IS-IS, see Layer 3—IP Routing
Configuration Guide .
Using IS-IS to advertise SRv6 SIDs
1. Enter system view. system-view
2. Enter IS-IS process view. isis [ process-id ] [ vpn-instance vpn-instance-name ]
131
3. Enter IS-IS IPv6 address family view. address-family ipv6 [ unicast ]
4. Apply a locator to IS-IS IPv6 address family.
segment-routing ipv6 locator locator-name [ level-1 | level-2 ]
[ auto-sid-disable ]
By default, no locators are applied to IS-IS IPv6 address family.
Repeat this command to apply multiple locators to IS-IS IPv6 address family for the family to advertise multiple SRv6 SIDs.
5. Enable SRv6 compression for IPv6 IS-IS. srv6 compress enable [ level-1 | level-2 ]
By default, SRv6 compression is disabled for IPv6 IS-IS.
Use this command only when IPv6 IS-IS is used to advertise G-SIDs.
Using OSPFv3 to advertise SRv6 SIDs
1. Enter system view. system-view
2. Enter OSPFv3 process view. ospfv3 [ process-id | vpn-instance vpn-instance-name ] *
3. Apply a locator to the OSPFv3 process.
segment-routing ipv6 locator locator-name [ auto-sid-disable ]
By default, no locators are applied to an OSPFv3 process.
Repeat this command to apply multiple locators to the OSPFv3 process for the process to advertise multiple SRv6 SIDs.
Enabling BGP to advertise routes for a locator
About this task
Perform this task in an inter-AS BGP network. This task enables the device to generate routes for a locator in the BGP IPv6 unicast routing table and use BGP to advertise the routes to BGP peers.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
4. Configure the device to generate routes for the specified locator in the BGP IPv6 unicast routing table and advertise the routes to BGP peers.
advertise srv6 locator locator-name [ route-policy route-policy-name ]
By default, the device does not generate routes for a locator in the BGP IPv6 unicast routing table.
132
Configuring BGP-EPE
Enabling SRv6 BGP-EPE
About this task
BGP-EPE allocates BGP peer SIDs to inter-AS segments. The device advertises the peer SIDs to a network controller through BGP LS messages. The controller orchestrates the IGP SIDs and BGP peer SIDs to realize optimal inter-AS traffic forwarding.
With this feature, the device can allocate SRv6 SIDs to its connected BGP peers or peer groups to identify its connected BGP peers or links.
Restrictions and guidelines
If you do not specify any parameters for the peer egress-engineering srv6 command, the device will dynamically allocate SRv6 SIDs to peers. The SRv6 SIDs belong to the locator specified by using the segment-routing ipv6 egress-engineering locator command in BGP instance view.
When you use the peer egress-engineering srv6 command for a peer, follow these restrictions and guidelines:
•
If you use this command to specify multiple locators for that peer, only the most recent configuration takes effect.
•
If you use this command to specify multiple static SRv6 SIDs and the SIDs belong to different types, all types of SRv6 SIDs can take effect. For the same type of SRv6 SIDs, only the most recent configuration takes effect.
If you specify a static SRv6 SID for a peer, the specified static SRv6 SID must belong to the locator specified by using the segment-routing ipv6 egress-engineering locator command in BGP instance view.
The static SRv6 SIDs specified by using the following commands cannot be the same:
• peer egress-engineering srv6 .
• egress-engineering srv6 peer-set .
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enable SRv6 BGP-EPE.
peer group-name egress-engineering srv6
peer ipv6-address [ prefix-length ] egress-engineering srv6 [ locator
locator-name | static-sid { psp psp-sid | no-psp-usp no-psp-usp-sid }
* ]
By default, SRv6 BGP-EPE is disabled.
133
Applying a locator to BGP-EPE
About this task
Perform this task to restrict the range of End.X SIDs that can be allocated to BGP-EPE SRv6 peer sets and BGP-EPE-enabled peers in a BGP instance. All static SRv6 SIDs configured for the
BGP-EPE SRv6 peer sets and peers must belong to the locator specified by performing this task.
Restrictions and guidelines
To dynamically allocate End.X SIDs from the specified locator:
•
Do not configure a static SRv6 SID when you create a BGP-EPE SRv6 peer set by using the egress-engineering srv6 peer-set command.
•
Do not specify a locator or configure a static SRv6 SID when you enable SRv6 BGP-EPE for a peer by using the peer egress-engineering srv6 command.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Apply a locator to BGP-EPE.
segment-routing ipv6 egress-engineering locator locator-name
By default, no locator is applied to BGP-EPE.
Configuring a BGP-EPE SRv6 peer set
About this task
If the device establishes BGP peer relationship with multiple devices, perform this task to add the peer devices to a peer set and allocate a PeerSet SID to the peer set. When the device forwards traffic based on the PeerSet SID, it distributes the traffic among the peers for load sharing.
Prerequisites
Enable SRv6 BGP-EPE on all peers that will be added to the BGP-EPE SRv6 peer set.
Use the segment-routing ipv6 egress-engineering locator command in BGP instance view to apply a locator to BGP-EPE.
•
If automatic SID allocation is used, the device dynamically allocates an SRv6 SID to the
BGP-EPE SRv6 peer set from the specified locator.
•
If you specify a static SRv6 SID for the BGP-EPE SRv6 peer set, the specified static SRv6 SID must belong to the specified locator.
If you execute the egress-engineering srv6 peer-set command to specify multiple SRv6
SIDs for one peer set, the effective configuration depends on whether the SRv6 SIDs are the same type.
•
If all the SRv6 SIDs belong to the same type, only the most recent configuration takes effect.
•
If the SRv6 SIDs belong to different types, the configuration for all the SRv6 SID types takes effect. For the SRv6 SIDs that belong to the same type, only the most recent configuration takes effect. Make sure each SRv6 SID is unique among all the SRv6 SID types.
The static SRv6 SIDs configured by using the following commands cannot be the same:
• egress-engineering srv6 peer-set .
• peer egress-engineering srv6 .
134
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Create a BGP-EPE SRv6 peer set. egress-engineering srv6 peer-set peer-set-name [ static-sid { psp psp-sid | no-psp-usp no-psp-usp-sid } * ]
4. Add a peer to the BGP-EPE SRv6 peer set. peer { ipv6-address [ prefix-length ] } peer-set srv6-peer-set-name
By default, no peers are added to a BGP-EPE SRv6 peer set.
To change the BGP-EPE SRv6 peer set for a peer, you must first use undo peer peer-set command to remove that peer from the original BGP-EPE SRv6 peer set.
Configuring SRv6 tunneling
Configuring an SID list
About this task
An SR node is uniquely identified by an SID index in an SID list. The SID list forms a forwarding path.
The SR nodes in the list are arranged by SID index in ascending sort order. When the device encapsulates the Segment List, SRv6 automatically assigns a segment index to each SR node based on their SID indexes. The smallest SID index corresponds to the largest segment index, and the largest SID index corresponds to the smallest segment index.
Restrictions and guidelines
If you do not specify an SID index for an SR node, SRv6 automatically assigns an SID index to the node. The assigned SID index is the largest index that has been assigned plus an increment.
Make sure the node nearest to the source node is assigned the smallest SID index. The nearer a node is to the source node, the smaller the SID index value of the node must be.
After an SID list is applied to an up tunnel, changing the SID list of the tunnel will cause the tunnel to go down. The new SID list cannot take effect until the device finishes route convergence.
Procedure
1. Enter system view. system-view
2. Create an SID list and enter its view.
ipv6 segment-routing sid-list list-name
3. Configure an SR node in the SID list. sid [ index index-number ] ipv6-address
To make the node reachable by other nodes, configure IGP on the node to advertise the SRv6
SID of the node.
Specifying an SID list for an SRv6 tunnel
1. Enter system view. system-view
135
2. Create an SRv6 tunnel interface and enter its view. interface tunnel tunnel-number mode sr ipv6
3. Specify an SID list for the tunnel.
tunnel sid-list list-name [ backup ]
By default, no SID lists are specified for an SRv6 tunnel.
Configuring a service class for an SRv6 tunnel
About this task
Class Based Tunnel Selection (CBTS) compares the service class value of the traffic with the service class values of SRv6 tunnels. CBTS uses the following rules to select a tunnel to forward the traffic:
•
If the traffic matches an SRv6 tunnel, CBTS uses this tunnel.
•
If the traffic matches multiple SRv6 tunnels, CBTS selects a tunnel based on the flow forwarding mode set on the tunnel interface.
If flow-based forwarding is set, CBTS randomly selects a matching tunnel for packets of the same flow.
If packet-based forwarding is set, CBTS uses all matching tunnels to load share the packets.
•
If the traffic does not match any SRv6 tunnels, CBTS selects an SRv6 tunnel from all tunnels with a service class value smaller than the traffic. Among these tunnels, the one with the largest service class value is used. If all SRv6 tunnels have a service class value greater than the traffic,
CBTS uses the tunnel with the smallest service class value.
Procedure
1. Enter system view. system-view
2. Enter SRv6 tunnel interface view. interface tunnel tunnel-number [ mode sr ipv6 ]
3. Configure a service class for the tunnel.
service-class class-value
By default, no service class is configured for an SRv6 tunnel.
Enabling BFD echo-mode detection for an SRv6 tunnel
About this task
Perform this task on an SRv6 tunnel interface to use BFD sessions for quick link connectivity detection of the SRv6 tunnel. If a link failure is detected along the path, the device can quickly handle the issue, for example, it can direct the traffic to the backup path to ensure traffic forwarding continuity.
If the BFD session of a path is down, the path is unavailable. If the BFD session of a path is up, the path is available.
Procedure
1. Enter system view. system-view
2. Configure the source IPv6 address of BFD echo packets.
bfd echo-source-ipv6 ipv6-address
By default, no source IPv6 address is configured for BFD echo packets.
136
As a best practice, do not configure the source IPv6 address to be on the same network segment as any local interfaces. If you configure such a source IPv6 address, a large number of
ICMPv6 redirect packets might be sent from the peer, resulting in link congestion. For more information about this command, see BFD in High Availability Configuration Guide .
3. Enter SRv6 tunnel interface view. interface tunnel tunnel-number [ mode sr ipv6 ]
4. Enable BFD echo-mode detection. tunnel bfd enable echo
By default, BFD echo-mode detection is disabled for an SRv6 tunnel.
Configuring traffic forwarding
Configuring a static route to direct traffic to an SRv6 tunnel
For information about the command to configure a static route, see Layer 3—IP Routing Command
Reference . The interface specified in this command must be an SRv6 tunnel interface.
Configuring automatic static route advertisement to direct traffic to an SRv6 tunnel
About this task
Perform this task on an SRv6 tunnel interface to create a static route whose destination address and output interface are the tunnel destination address and the tunnel interface, respectively.
Procedure
1. Enter system view. system-view
2. Enter SRv6 tunnel interface view. interface tunnel tunnel-number [ mode sr ipv6 ]
3. Configure automatic static route advertisement. tunnel route-static [ preference preference-value ]
By default, automatic static route advertisement is not configured.
Configuring automatic IGP route advertisement to direct traffic to an SRv6 tunnel
About this task
To direct traffic to an SRv6 tunnel, you can distribute the SRv6 tunnel to the IGP and make the SRv6 tunnel participate in IGP route calculation. To achieve these purposes, deploy the following functionalities:
•
IPv6 router ID.
The IPv6 router ID determines the source and destination addresses of the SRv6 tunnel distributed to the IGP. The destination address of the SRv6 tunnel must be the same as the
IPv6 router ID of the destination node.
Configuring an IPv6 route ID on a router also enables the IPv6 TE feature on that router. After the SRv6 tunnel participates in IGP route calculation, traffic can be directed to the SRv6 tunnel.
137
•
Automatic route advertisement.
This functionality distributes the SRv6 tunnel to the IGP and makes the SRv6 tunnel participate in IGP route calculation.
Restrictions and guidelines for directing traffic to an SRv6 tunnel
The IPv6 router ID must be unique in the IPv6 network.
To avoid routing loops in a ring topology when a link on the SRv6 tunnel is down, set the SIDs in the
SID list of the SRv6 tunnel to have 128-bit prefixes. IGP does not set the output interface of a host route to the SRv6 tunnel interface.
Prerequisites for directing traffic to an SRv6 tunnel
Before you configure the IPv6 router ID for IS-IS, make sure the cost style of IS-IS is wide , compatible , or wide-compatible . For more information about the cost styles of IS-IS, see
Layer 3—IP Routing Configuration Guide .
Before you configure automatic route advertisement, you must enable IPv6 capability for the IGP protocol on the SRv6 tunnel interface.
Configuring the IPv6 router ID and enabling IPv6 TE
1. Enter system view. system-view
2. Enter IS-IS view. isis [ process-id ] [ vpn-instance vpn-instance-name ]
3. Enter IS-IS IPv6 address family view. address-family ipv6 [ unicast ]
4. Configure the IPv6 router ID for IS-IS and enable IPv6 TE.
router-id ipv6-address
By default, no IPv6 router ID is configured for IS-IS and IPv6 TE is disabled.
Configuring IGP shortcut
1. Enter system view. system-view
2. Enter SRv6 tunnel interface view. interface tunnel tunnel-number mode sr ipv6
3. Enable IGP shortcut. srv6 igp shortcut [ isis | ospf ]
By default, IGP shortcut is disabled.
Only IS-IS supports IGP shortcut in the current software version.
4. Assign a metric to the SRv6 tunnel. srv6 igp metric { absolute value | relative value }
By default, the metric of an SRv6 tunnel equals its IGP metric.
Configuring TI-LFA FRR
TI-LFA FRR tasks at a glance
To configure TI-LFA FRR, perform the following tasks:
1.
138
2.
(Optional.) Disabling an interface from participating in TI-LFA calculation
On the source node, disable TI-LFA on the route's output interface to the next hop on the primary path.
3.
(Optional.) Configuring FRR microloop avoidance
4.
(Optional.) Configuring SR microloop avoidance
Enabling TI-LFA FRR
Enabling IPv6 IS-IS TI-LFA FRR
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv6 unicast address family view. address-family ipv6
4. Enable LFA FRR for IPv6 IS-IS. fast-reroute lfa [ level-1 | level-2 ]
By default, LFA FRR is disabled for IPv6 IS-IS.
5. Enable TI-LFA FRR for IPv6 IS-IS. fast-reroute ti-lfa [ per-prefix ] [ route-policy route-policy-name
| host ] [ level-1 | level-2 ]
By default, TI-LFA FRR is disabled for IPv6 IS-IS.
Enabling OSPFv3 TI-LFA FRR
1. Enter system view. system-view
2. Enter OSPFv3 view. ospfv3 [ process-id | vpn-instance vpn-instance-name ] *
3. Enable LFA FRR for OSPFv3. fast-reroute { lfa [ abr-only ] | route-policy route-policy-name }
By default, LFA FRR is disabled for OSPFv3.
4. Enable TI-LFA FRR for OSPFv3. fast-reroute ti-lfa [ per-prefix ] [ route-policy route-policy-name
| host ]
By default, TI-LFA FRR is disabled for OSPFv3.
Disabling an interface from participating in TI-LFA calculation
Disabling an IPv6 IS-IS interface from participating in TI-LFA calculation
1. Enter system view. system-view
2. Enter the view of IPv6 IS-IS interface. interface interface-type interface-number
3. Disable the interface from participating in TI-LFA calculation. isis ipv6 fast-reroute ti-lfa disable [ level-1 | level-2 ]
139
By default, an IPv6 IS-IS interface participates in TI-LFA calculation.
Disabling an OSPFv3 interface from participating in TI-LFA calculation
1. Enter system view. system-view
2. Enter the view of OSPFv3 interface. interface interface-type interface-number
3. Disable the interface from participating in TI-LFA calculation. ospfv3 fast-reroute ti-lfa disable [ instance instance-id ]
By default, an OSPFv3 interface participates in TI-LFA calculation.
Configuring FRR microloop avoidance
About this task
FRR microloop avoidance provides microloop avoidance after a network failure.
On a network deployed with TI-LFA FRR, when a node or link fails, traffic will be switched to the backup path calculated by TI-LFA. If a device along the backup path has not finished route convergence, a traffic loop will occur. Traffic will be looped between the device and the source node
(the node prior to the node or link that failed) until the device finishes route convergence.
To resolve this issue, FRR microloop avoidance first switches traffic to the backup path calculated by
TI-LFA after the node or link failure. Then, the source node waits for the nodes on the backup path to finish route convergence before starting route convergence.
Restrictions and guidelines
If you configure both FRR microloop avoidance and SR microloop avoidance, SR microloop avoidance takes effect.
Procedure
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv6 unicast address family view. address-family ipv6
4. Enable FRR microloop avoidance for IS-IS. fast-reroute microloop-avoidance enable [ level-1 | level-2 ]
By default, FRR microloop avoidance is disabled for IS-IS.
5. (Optional.) Set the FRR microloop avoidance RIB-update-delay time. fast-reroute microloop-avoidance rib-update-delay delay-time
[ level-1 | level-2 ]
By default, the FRR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring SR microloop avoidance
About this task
SR microloop avoidance provides microloop avoidance after both a network failure and a failure recovery.
140
After a network failure occurs or recovers, route convergence occurs on relevant network devices.
Because of nonsimultaneous convergence on network devices, microloops might be formed. After you configure SR microloop avoidance, the devices will forward traffic along the specified path before route convergence is finished on all the relevant network devices. Because the forwarding path is independent of route convergence, microloops are avoided.
To ensure sufficient time for IGP to complete route convergence, set the SR microloop avoidance
RIB-update-delay time. Before the timer expires, faulty relevant devices will forward traffic along the specified path. Upon expiration of the timer and completion of IGP route convergence, traffic will traverse along the IGP-calculated path.
Configuring IPv6 IS-IS SR microloop avoidance
1. Enter system view. system-view
2. Enter IS-IS view.
isis process-id
3. Enter IS-IS IPv6 unicast address family view. address-family ipv6
4. Enable SR microloop avoidance for IPv6 IS-IS. segment-routing microloop-avoidance enable [ level-1 | level-2 ]
By default, SR microloop avoidance is disabled for IPv6 IS-IS.
5. (Optional.) Set the SR microloop avoidance RIB-update-delay time.
segment-routing microloop-avoidance rib-update-delay delay-time
[ level-1 | level-2 ]
By default, the SR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring OSPFv3 SR microloop avoidance
1. Enter system view. system-view
2. Enter OSPFv3 process view. ospfv3 [ process-id | vpn-instance vpn-instance-name ] *
3. Enable SR microloop avoidance for OSPFv3. segment-routing microloop-avoidance enable
By default, SR microloop avoidance is disabled for OSPFv3.
4. (Optional.) Set the SR microloop avoidance RIB-update-delay time.
segment-routing microloop-avoidance rib-update-delay delay-time
By default, the SR microloop avoidance RIB-update-delay time is 5000 ms.
Configuring the SRv6 MTU
About this task
Perform this task to configure one of the following MTUs:
•
Path MTU —The maximum IPv6 MTU along the path from the source node to the destination node. The transit nodes do not fragment SRv6 tunneled packets. If a packet is larger than the
MTU of the output interface, the packet will be discarded. If the MTU is too small, the bandwidth is not sufficiently used. To address these issues, configure an appropriate SRv6 path MTU.
•
Reserved MTU —Reserved MTU on the source node for TI-LFA. When packets are switched to the backup path after the primary path fails, the device reconstrcts an IPv6 header and SRH for the packets. As a result, packet drop might occur because the packet size has exceeded the
141
MTU. To resolve this issue, configure a reserved MTU on the source node to reserve bytes for adding a new SRH to SRv6 packets in case of primary path failure.
The SRv6 path MTU minus the reserved MTU is the active MTU. The effective MTU for SRv6 packets on the source node is the smaller value from the following values:
•
The active MTU.
•
The IPv6 MTU of the physical output interface.
Restrictions and guidelines
Make sure the active MTU is equal to or greater than 1280 bytes.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a reserved MTU for SRv6 path MTU. path-mtu reserved [ reserved-value ]
By default, no reserved MTU is specified for SRv6 path MTU.
4. Configure the SRv6 path MTU.
path-mtu mtu-value
The default setting is 1500 bytes.
Configuring the SRv6 DiffServ mode
About this task
SRv6 DiffServ mode determines how an SRv6 node processes the IP precedence and DSCP for packets forwarded between an IP network and an SRv6 network. The device supports the following
SRv6 DiffServ modes:
•
Pipe mode —When a packet enters the SRv6 network, the ingress node adds a new IPv6 header to the original packet. The ingress node ignores the IP precedence or DSCP value in the original packet and uses the value specified by using the service-class argument as the traffic class in the new IPv6 header. In the SRv6 network, SRv6 nodes perform QoS scheduling for the packet based on the specified traffic class. When the packet leaves the SRv6 network, the egress node removes the outer IPv6 header from the packet without modifying the IP precedence or DSCP value in the original packet.
•
Short-pipe mode —When a packet enters and leaves the SRv6 network, all SRv6 nodes process the packet in the same way as in pipe mode except for the egress node. After the egress node removes the outer IPv6 header from the packet, it performs QoS scheduling as follows:
If no priority trust mode is configured, the egress node performs QoS scheduling for the packet based on the IP precedence or DSCP value in the original packet.
If a priority trust mode is configured, the egress node performs QoS scheduling for the packet based on the trusted priority.
•
Uniform mode —When a packet enters the IPv6 network, the ingress node maps the IP precedence or DSCP value in the original IP header to the outer IPv6 header as the traffic class.
When the packet leaves the SRv6 network, the egress node maps the traffic class value in the outer IPv6 header to the original packet as the IP precedence or DSCP value.
142
Restrictions and guidelines
When you configure the SRv6 DiffServ mode on the source and destination nodes of an SRv6 tunnel, follow these restrictions and guidelines:
•
The outbound DiffServ mode on the local end must be the same as the inbound DiffServ mode on the peer end.
•
The inbound DiffServ mode on the local end must be the same as the outbound DiffServ mode on the peer end.
For more information about IP precedence and DSCP, see priority mapping configuration in QoS
Configuration Guide .
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Configure the SRv6 DiffServ mode. diffserv-mode { ingress { pipe service-class | short-pipe service-class
| uniform } egress { pipe | short-pipe | uniform } | { pipe service-class
| short-pipe service-class | uniform } }
By default, the SRv6 DiffServ mode is uniform.
Verifying and maintaining SRv6
Displaying basic SRv6 configuration information
Perform display tasks in any view.
•
Display SRv6 forwarding entries. display segment-routing ipv6 forwarding [ entry-id ] [ slot slot-number ]
•
Display information about the SRv6 local SID forwarding table. display segment-routing ipv6 local-sid { end | end-am | end-as | end-b6encaps | end-coc32 | end-dt2m | end-dt2u | end-dt2ul | end-dx2
| end-dx2l | end-m | end-op | end-t | end-x-coc32 } [ sid ] display segment-routing ipv6 local-sid { end-dt4 | end-dt46 | end-dt6
| end-dx4 | end-dx6 } [ sid | vpn-instance vpn-instance-name ] display segment-routing ipv6 local-sid end-x [ sid | interface interface-type interface-number [ nexthop nexthop-ipv6-address ] ]
•
Display SRv6 locator information. display segment-routing ipv6 locator [ locator-name ]
•
Display SID list information. display ipv6 segment-routing sid-list [ list-name ]
Displaying SRv6 BGP-EPE information
Perform display tasks in any view.
•
Display BGP-EPE information for IPv6 peers.
143
display bgp [ instance instance-name ] egress-engineering ipv6
[ ipv6-address ] [ verbose ]
•
Display information about BGP-EPE SRv6 peer sets. display bgp egress-engineering srv6 peer-set [ srv6-peer-set-name ]
Displaying IS-IS SRv6 information
Perform display tasks in any view.
•
Display IS-IS SRv6 capability information. display isis segment-routing ipv6 capability [ level-1 | level-2 ]
[ process-id ]
•
Display IS-IS SRv6 locator routing information. display isis segment-routing ipv6 locator [ ipv6-address prefix-length ] [ [ level-1 | level-2 ] | verbose ] * [ process-id ]
•
Display IS-IS SRv6 tunnel interface information. display isis srv6 tunnel [ level-1 | level-2 ] [ process-id ]
Displaying OSPFv3 SRv6 information
Perform display tasks in any view.
•
Display OSPFv3 SRv6 capability information. display ospfv3 [ process-id ] segment-routing ipv6 capability
•
Display OSPFv3 SRv6 locator information. display ospfv3 [ process-id ] segment-routing ipv6 locator
[ ipv6-address prefix-length ]
•
Display OSPFv3 SRv6 tunnel interface information. display ospfv3 [ process-id ] srv6 tunnel [ interface-number ]
SRv6 configuration examples
Example: Configuring SRv6 that uses End SIDs
Network configuration
As shown in Figure 47 , run OSPFv3 on Router A, Router B, and Router C. Set up an SRv6 tunnel
between Router A and Router C.
Figure 47 Network diagram
Loop0
1::9/128
Loop0
2::9/128
Loop0
5::9/128
GE0/0/1 GE0/0/2
Router A
GE0/0/2 GE0/0/2
Router C Router B
SRv6 Tunnel
144
Table 14 Interface and IP address assignment
Device
Router A
Router B
Interface
Loop0
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
1::9/128
1::1/64
2::9/128
1::2/64
2::1/64
Device Interface
Router C Loop0
GE0/0/2
IP address
5::9/128
2::2/64
Procedure
1. Configure IPv6 addresses and masks for the interfaces. (Details not shown.)
2. Configure OSPFv3 to advertise routes for the interfaces, including the loopback interfaces.
(Details not shown.)
Execute the display ipv6 routing-table command on each router to verify that they have obtained routes to reach one another, including the host routes of loopback interfaces.
3. Configure Router A:
# Configure SRv6 End SIDs.
[RouterA] segment-routing ipv6
[RouterA-segment-routing-ipv6] locator aa ipv6-prefix 100:1::1 96 static 8
[RouterA-segment-routing-ipv6-locator-aa] opcode 1 end
[RouterA-segment-routing-ipv6-locator-aa] quit
[RouterA-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterA] ospfv3 1
[RouterA-ospfv3-1] segment-routing ipv6 locator aa
[RouterA-ospfv3-1] quit
# Configure SID list a and specify Router B and Router C as nodes in the list.
[RouterA] ipv6 segment-routing sid-list a
[RouterA-srv6-sid-list-a] sid 200:1::1
[RouterA-srv6-sid-list-a] sid 300:1::1
[RouterA-srv6-sid-list-a] quit
# Create SRv6 tunnel interface Tunnel 1 on Router A. Specify Loopback 0 as the source interface, specify the IP address of Loopback 0 on Router C as the destination, configure an
IPv6 address for the tunnel interface, and apply SID list a to the SRv6 tunnel.
[RouterA] interface tunnel 0 mode sr ipv6
[RouterA-Tunnel0] source loopback 0
[RouterA-Tunnel0] destination 5::9
[RouterA-Tunnel0] ipv6 address 6::6 64
[RouterA-Tunnel0] tunnel sid-list a
[RouterA-Tunnel0] quit
# Configure a static route to direct traffic destined for Router C to the SRv6 tunnel.
[RouterA] ipv6 route-static 99::1 64 tunnel 0
4. Configure Router B:
# Configure SRv6 End SIDs.
[RouterB] segment-routing ipv6
[RouterB-segment-routing-ipv6] locator bb ipv6-prefix 200:1::1 96 static 8
[RouterB-segment-routing-ipv6-locator-bb] opcode 1 end
145
[RouterB-segment-routing-ipv6-locator-bb] quit
[RouterB-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterB] ospfv3 1
[RouterB-ospfv3-1] segment-routing ipv6 locator bb
[RouterB-ospfv3-1] quit
5. Configure Router C:
# Configure SRv6 End SIDs.
[RouterC] segment-routing ipv6
[RouterC-segment-routing-ipv6] locator cc ipv6-prefix 300:1::1 96 static 8
[RouterC-segment-routing-ipv6-locator-cc] opcode 1 end
[RouterC-segment-routing-ipv6-locator-cc] quit
[RouterC-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterC] ospfv3 1
[RouterC-ospfv3-1] segment-routing ipv6 locator cc
[RouterC-ospfv3-1] quit
# Configure an SID list, SRv6 tunnel, and static route on Router C in the same way as the settings are configured on Router A. The SID list, SRv6 tunnel, and static route on Router C are from Router C to Router A. (Details not shown.)
Verifying the configuration
# Verify the SID list information on Router A.
[RouterA] display ipv6 segment-routing sid-list
SID list name: a
SID information:
SID index Address
5 200:1::1
9 300:1::1
SID list usage on tunnels:
Tunnel number SID list role
0 Primary
Verify that the traffic destined for 99::1 is forwarded through the SRv6 tunnel.
[Router A] display ipv6 fib 99::1
FIB entry count: 1
Flag:
U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static
R:Relay F:FRR
Destination: 99:: Prefix length: 64
Nexthop : :: Flags: US
Time stamp : 0x10 Label: Null
Interface : Tun0 Token: Invalid
146
Example: Configuring SRv6 that uses End.X SIDs
Network configuration
As shown in Figure 48 , run OSPFv3 on Router A, Router B, and Router C. Set up an SRv6 tunnel
between Router A and Router C.
Figure 48 Network diagram
Loop0
1::9/128
Loop0
2::9/128
Loop0
5::9/128
GE0/0/1 GE0/0/2
GE0/0/2 GE0/0/2
Router A Router B
SRv6 Tunnel
Table 15 Interface and IP address assignment
Router C
Device
Router A
Router B
Procedure
Interface
Loop0
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
1::9/128
1::1/64
2::9/128
1::2/64
2::1/64
Device Interface
Router C Loop0
GE0/0/2
IP address
5::9/128
2::2/64
1. Configure IPv6 addresses and masks for the interfaces. (Details not shown.)
2. Configure OSPFv3 to advertise routes for the interfaces, including the loopback interfaces.
(Details not shown.)
Execute the display ipv6 routing-table command on each router to verify that they have obtained routes to reach one another, including the host routes of loopback interfaces.
3. Configure Router A:
# Configure SRv6 End.X SIDs.
[RouterA] segment-routing ipv6
[RouterA-segment-routing-ipv6] locator a1 ipv6-prefix 100:1::1:0 96 static 8
[RouterA-segment-routing-ipv6-locator-a1] opcode 1 end-x interface gigabitethernet
0/0/2 nexthop 1::2
[RouterA-segment-routing-ipv6-locator-a1] quit
[RouterA-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterA] ospfv3 1
[RouterA-ospfv3-1] segment-routing ipv6 locator a1
[RouterA-ospfv3-1] quit
# Configure SID list A and specify Router B and Router C as nodes in the list.
[RouterA] ipv6 segment-routing sid-list A
[RouterA-srv6-sid-list-A] sid 200:1::1:1
[RouterA-srv6-sid-list-A] sid 300:1::1:1
[RouterA-srv6-sid-list-A] quit
147
# Create SRv6 tunnel interface Tunnel 1 on Router A. Specify Loopback 0 as the source interface, specify the IP address of Loopback 0 on Router C as the destination, configure an
IPv6 address for the tunnel interface, and apply SID list A to the SRv6 tunnel.
[RouterA] interface tunnel 0 mode sr ipv6
[RouterA-Tunnel0] source loopback 0
[RouterA-Tunnel0] destination 5::9
[RouterA-Tunnel0] ipv6 address 7::7 64
[RouterA-Tunnel0] tunnel sid-list A
[RouterA-Tunnel0] quit
# Configure a static route to direct traffic destined for Router C to the SRv6 tunnel.
[RouterA] ipv6 route-static 199::1 64 tunnel 0
4. Configure Router B:
# Configure SRv6 End.X SIDs.
[RouterB] segment-routing ipv6
[RouterB-segment-routing-ipv6] locator b1 ipv6-prefix 200:1::1:0 96 static 8
[RouterB-segment-routing-ipv6-locator-b1] opcode 1 end-x interface gigabitethernet
0/0/2 nexthop 2::2
[RouterB-segment-routing-ipv6-locator-b1] quit
[RouterB-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterB] ospfv3 1
[RouterB-ospfv3-1] segment-routing ipv6 locator b1
[RouterB-ospfv3-1] quit
5. Configure Router C:
# Configure SRv6 End SIDs.
[RouterC] segment-routing ipv6
[RouterC-segment-routing-ipv6] locator c1 ipv6-prefix 300:1::1:0 96 static 8
[RouterC-segment-routing-ipv6-locator-c1] opcode 1 end
[RouterC-segment-routing-ipv6-locator-c1] quit
[RouterC-segment-routing-ipv6] quit
# Configure OSPFv3 to advertise the SRv6 SIDs.
[RouterC] ospfv3 1
[RouterC-ospfv3-1] segment-routing ipv6 locator c1
[RouterC-ospfv3-1] quit
# Configure an SID list, SRv6 tunnel, and static route on Router C in the same way as the settings are configured on Router A. The SID list, SRv6 tunnel, and static route on Router C are from Router C to Router A. (Details not shown.)
Verifying the configuration
# Verify the SID list information on Router A.
[RouterA] display ipv6 segment-routing sid-list
SID list name: A
SID information:
SID index Address
5 200:1::1:1
9 300:1::1:1
SID list usage on tunnels:
Tunnel number SID list role
148
0 Primary
Verify that the traffic destined for 199::1 is forwarded through the SRv6 tunnel.
[Router A] display ipv6 fib 199::1
FIB entry count: 1
Flag:
U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static
R:Relay F:FRR
Destination: 199:: Prefix length: 64
Nexthop : :: Flags: US
Time stamp : 0x17 Label: Null
Interface : Tun0 Token: Invalid
Example: Configuring IPv6 IS-IS TI-LFA FRR
Network configuration
As shown in Figure 49 , complete the following tasks to implement TI-LFA FRR:
•
Configure IPv6 IS-IS on Device A, Device B, Device C, and Device D to achieve network level connectivity.
•
Configure IS-IS SRv6 on Device A, Device B, Device C, and Device D.
•
Configure TI-LFA FRR to remove the loop on Link B and to implement fast traffic switchover to
Link B when Link A fails.
Figure 49 Network diagram
Loop1
Device A
Cost 10
Loop1
GE
0/0
/1
GE
0/0
/1
Device B
GE
0/0/2
Cost 10
GE
0/0/2
Loop1
GE
0/0/2
Cost 10 GE
0/0/2
Device D
GE
0/0
/1
GE
0/0
/1
Cost 100
Device C
Loop1
Link A
Table 16 Interface and IP address assignment
Link B
Device
Device A
Interface IP address
Loop1 1::1/128
GE0/0/1
GE0/0/2
2000:1::1/64
2000:4::1/64
Device
Device B
149
Interface IP address
Loop1 2::2/128
GE0/0/1
GE0/0/2
2000:1::2/64
2000:2::2/64
Device
Device C
Procedure
Interface IP address
Loop1
GE0/0/1
GE0/0/2
3::3/128
2000:3::3/64
2000:2::3/64
Device
Device D
Interface IP address
Loop1
GE0/0/1
GE0/0/2
4::4/128
2000:3::4/64
2000:4::4/64
1. Configure IPv6 addresses and prefixes for interfaces. (Details not shown.)
2. Configure Device A:
# Configure IPv6 IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<DeviceA> system-view
[DeviceA] isis 1
[DeviceA-isis-1] network-entity 00.0000.0000.0001.00
[DeviceA-isis-1] cost-style wide
[DeviceA-isis-1] address-family ipv6
[DeviceA-isis-1-ipv6] quit
[DeviceA-isis-1] quit
[DeviceA] interface gigabitethernet 0/0/1
[DeviceA-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceA-GigabitEthernet0/0/1] isis cost 10
[DeviceA-GigabitEthernet0/0/1] quit
[DeviceA] interface gigabitethernet 0/0/2
[DeviceA-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceA-GigabitEthernet0/0/2] isis cost 10
[DeviceA-GigabitEthernet0/0/2] quit
[DeviceA] interface loopback 1
[DeviceA-LoopBack1] isis ipv6 enable 1
[DeviceA-LoopBack1] quit
# Enable SRv6 and configure a locator.
[DeviceA] segment-routing ipv6
[DeviceA-segment-routing-ipv6] locator aaa ipv6-prefix 11:: 64 static 32
[DeviceA-segment-routing-ipv6-locator-aaa] quit
[DeviceA-segment-routing-ipv6] quit
# Configure IPv6 IS-IS TI-LFA FRR.
[DeviceA] isis 1
[DeviceA-isis-1] address-family ipv6
[DeviceA-isis-1-ipv6] fast-reroute lfa
[DeviceA-isis-1-ipv6] fast-reroute ti-lfa
[DeviceA-isis-1-ipv6] fast-reroute microloop-avoidance enable
[DeviceA-isis-1-ipv6] segment-routing microloop-avoidance enable
[DeviceA-isis-1-ipv6] quit
[DeviceA-isis-1] quit
# Apply the locator to the IPv6 IS-IS process.
[DeviceA] isis 1
[DeviceA-isis-1] address-family ipv6
[DeviceA-isis-1-ipv6] segment-routing ipv6 locator aaa
[DeviceA-isis-1-ipv6] quit
[DeviceA-isis-1] quit
150
3. Configure Device B:
# Configure IPv6 IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<DeviceB> system-view
[DeviceB] isis 1
[DeviceB-isis-1] network-entity 00.0000.0000.0002.00
[DeviceB-isis-1] cost-style wide
[DeviceB-isis-1] address-family ipv6
[DeviceB-isis-1-ipv6] quit
[DeviceB-isis-1] quit
[DeviceB] interface gigabitethernet 0/0/1
[DeviceB-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/1] isis cost 10
[DeviceB-GigabitEthernet0/0/1] quit
[DeviceB] interface gigabitethernet 0/0/2
[DeviceB-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/2] isis cost 10
[DeviceB-GigabitEthernet0/0/2] quit
[DeviceB] interface loopback 1
[DeviceB-LoopBack1] isis ipv6 enable 1
[DeviceB-LoopBack1] quit
# Enable SRv6 and configure a locator.
[DeviceB] segment-routing ipv6
[DeviceB-segment-routing-ipv6] locator bbb ipv6-prefix 22:: 64 static 32
[DeviceB-segment-routing-ipv6-locator-bbb] quit
[DeviceB-segment-routing-ipv6] quit
# Enable IPv6 IS-IS TI-LFA FRR.
[DeviceB] isis 1
[DeviceB-isis-1] address-family ipv6
[DeviceB-isis-1-ipv6] fast-reroute lfa
[DeviceB-isis-1-ipv6] fast-reroute ti-lfa
# Apply the locator to the IPv6 IS-IS process.
[DeviceB-isis-1-ipv6] segment-routing ipv6 locator bbb
[DeviceB-isis-1-ipv6] quit
[DeviceB-isis-1] quit
4. Configure Device C:
# Configure IPv6 IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<DeviceC> system-view
[DeviceC] isis 1
[DeviceC-isis-1] network-entity 00.0000.0000.0003.00
[DeviceC-isis-1] cost-style wide
[DeviceC-isis-1] address-family ipv6
[DeviceC-isis-1-ipv6] quit
[DeviceC-isis-1] quit
[DeviceC] interface gigabitethernet 0/0/1
[DeviceC-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/1] isis cost 10
[DeviceC-GigabitEthernet0/0/1] quit
[DeviceC] interface gigabitethernet 0/0/2
151
[DeviceC-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/2] isis cost 100
[DeviceC-GigabitEthernet0/0/2] quit
[DeviceC] interface loopback 1
[DeviceC-LoopBack1] isis ipv6 enable 1
[DeviceC-LoopBack1] quit
# Enable SRv6 and configure a locator.
[DeviceC] segment-routing ipv6
[DeviceC-segment-routing-ipv6] locator ccc ipv6-prefix 33:: 64 static 32
[DeviceC-segment-routing-ipv6-locator-ccc] quit
[DeviceC-segment-routing-ipv6] quit
# Enable IPv6 IS-IS TI-LFA FRR.
[DeviceC] isis 1
[DeviceC-isis-1] address-family ipv6
[DeviceC-isis-1-ipv6] fast-reroute lfa
[DeviceC-isis-1-ipv6] fast-reroute ti-lfa
# Apply the locator to the IPv6 IS-IS process.
[DeviceC-isis-1-ipv6] segment-routing ipv6 locator ccc
[DeviceC-isis-1-ipv6] quit
[DeviceC-isis-1] quit
5. Configure Device D:
# Configure IPv6 IS-IS to achieve network level connectivity and set the IS-IS cost style to wide.
<DeviceD> system-view
[DeviceD] isis 1
[DeviceD-isis-1] network-entity 00.0000.0000.0004.00
[DeviceD-isis-1] cost-style wide
[DeviceD-isis-1] address-family ipv6
[DeviceD-isis-1-ipv6] quit
[DeviceD-isis-1] quit
[DeviceD] interface gigabitethernet 0/0/1
[DeviceD-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceD-GigabitEthernet0/0/1] isis cost 100
[DeviceD-GigabitEthernet0/0/1] quit
[DeviceD] interface gigabitethernet 0/0/2
[DeviceD-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceD-GigabitEthernet0/0/2] isis cost 10
[DeviceD-GigabitEthernet0/0/2] quit
[DeviceD] interface loopback 1
[DeviceD-LoopBack1] isis ipv6 enable 1
[DeviceD-LoopBack1] quit
# Enable SRv6 and configure a locator.
[DeviceD] segment-routing ipv6
[DeviceD-segment-routing-ipv6] locator ddd ipv6-prefix 44:: 64 static 32
[DeviceD-segment-routing-ipv6-locator-ddd] quit
[DeviceD-segment-routing-ipv6] quit
# Enable IPv6 IS-IS TI-LFA FRR.
[DeviceD] isis 1
[DeviceD-isis-1] address-family ipv6
152
[DeviceD-isis-1-ipv6] fast-reroute lfa
[DeviceD-isis-1-ipv6] fast-reroute ti-lfa
# Apply the locator to the IPv6 IS-IS process.
[DeviceD-isis-1-ipv6] segment-routing ipv6 locator ddd
[DeviceD-isis-1-ipv6] quit
[DeviceD-isis-1] quit
Verifying the configuration
# Display IPv6 IS-IS routing information for 3::3/128.
[DeviceA] display isis route ipv6 3::3 128 verbose
Route information for IS-IS(1)
------------------------------
Level-1 IPv6 forwarding table
-----------------------------
IPv6 dest : 3::3/128
Flag : R/L/- Cost : 20
Admin tag : - Src count : 2
Nexthop : FE80::4449:7CFF:FEE0:206
Interface : GE0/0/1
TI-LFA:
Interface : GE0/0/2
BkNextHop : FE80::4449:91FF:FE42:407
LsIndex : 0x80000001
Backup label stack(top->bottom): {44::1:0:1}
Nib ID : 0x24000006
Flags: D-Direct, R-Added to Rib, L-Advertised in LSPs, U-Up/Down Bit Set
The output shows TI-LFA backup next hop information.
153
Configuring SRv6 TE policies
About SRv6 TE policies
IPv6 Segment Routing Traffic Engineering (SRv6 TE) policies apply to scenarios where multiple paths exist between a source node and a destination node on an SRv6 network. The device can use an SRv6 TE policy to flexibly steer traffic to a proper forwarding path.
SRv6 TE policy identification
An SRv6 TE policy is identified by the following items:
•
BSID —SID of the ingress node (source node).
•
Color —Color attribute for the forwarding path. You can use the color attribute to distinguish an
SRv6 TE policy from other SRv6 TE policies that are configured for the same source and destination nodes.
•
Endpoint —IPv6 address of the destination node.
SRv6 TE policy contents
As show in Figure 50 , an SRv6 TE policy consists of candidate paths with different preferences.
Each candidate path can have one or multiple subpaths identified by segment lists (also called SID lists).
•
Candidate path
An SRv6 TE policy can have multiple candidate paths. Candidate paths are uniquely identified by their preference values. An SRv6 TE policy chooses a candidate path from all its candidate paths based on the preference values to forward traffic.
Two SRv6 TE policies cannot share the same candidate path.
•
SID list
A SID list is a list of SIDs that indicates a packet forwarding path. Each SID is the IPv6 address of a node on the forwarding path.
A candidate path can have a single SID list or multiple SID lists that use different weight values.
After an SRv6 TE policy chooses a candidate path with multiple SID lists, the traffic will be load shared among the SID lists based on weight values.
154
Figure 50 SRv6 TE policy contents
SID List 1
<1::1, 2::2, 3::3>
Weight 20
Cpath 1
Preference: 10
SRv6 TE Policy
BSID: 5000::1
Color: 20
Endpoint: 4::4
SID List 2
<10::1, 20::2, 30::3>
Weight 80
Cpath 2
Preference: 20
SID List 1
<11::1, 22::2, 33::3>
Weight 20
SRv6 TE policy creation
An SRv6 TE policy can be created in the following modes:
•
Manual configuration from CLI
In this method, you need to manually configure the candidate settings for the SRv6 TE policy, such as candidate path preferences, SID lists and weights.
•
Learning from an SRv6 TE policy route
To support SRv6 TE policy, MP-BGP defines the BGP IPv6 SR address family and the SRv6
TE policy Network Layer Reachability Information (NLRI). The SRv6 TE policy NLRI is called the SRv6 TE policy route (or BGP IPv6 SR policy). An SRv6 TE policy route contains SRv6 TE policy settings, including the BSID, color, endpoint, candidate preferences, SID lists, and SID list weights.
The device can advertise its local SRv6 TE policy settings to its BGP IPv6 SR policy peer through an SRv6 TE policy route. The peer device can create an SRv6 TE policy according to the received SRv6 TE policy settings.
•
Automatic creation by ODN
When the device receives a BGP route, it compares the color extended attribute value of the
BGP route with the color value of the ODN template. If the color values match, the device automatically generates an SRv6 TE policy and two candidate paths for the policy.
The policy uses the BGP route's next hop address as the end-point address and the ODN template's color value as the color attribute value of the policy.
The candidate paths use preferences 100 and 200. You need to manually configure the SID lists for the candidate path with preference 200, and use PCE to compute the SID lists for the candidate path with preference 100. For more information about SID list computation
using PCE, see " SID list computation using PCE ."
You can also manually create candidate paths for an ODN-created SRv6 TE policy.
SID list computation using PCE
On an SRv6 TE policy network, an SRv6 node can act as a Path Computation Client (PCC) to use the paths computed by the Path Computation Element (PCE) to create SID lists for a candidate path.
155
Basic concepts
•
PCE —An entity that provides path computation for network devices. It can provide intra-area path computation as well as complete SID list computation on a complicated network. A PCE can be stateless or stateful.
Stateless PCE —Provides only path computation.
Stateful PCE —Knows all path information maintained by a PCC, and performs intra-area path recomputation and optimization. A stateful PCE can be active or passive.
−
Active stateful PCE —Accepts path delegation requests sent by a PCC and optimizes the paths.
−
Passive stateful PCE —Only maintains path information for SID lists of a PCC. A passive stateful PCE does not accept path delegation requests sent by a PCC or optimize the paths.
•
PCC —A PCC sends a request to a PCE for path computation and uses the path information returned by the PCE to establish forwarding paths. For a PCC to establish a PCEP session with a PCE, the PCC and PCE must be of the same type.
Stateless PCC —Sends path computation requests to a PCE.
Stateful PCC —Delegates SID list information to a stateful PCE. A stateful PCE can be active or passive.
−
Active stateful PCC —Reports its SID list information to a PCE, and uses the paths computed by the PCE to create and update the SID lists.
−
Passive stateful PCC —Only reports its SID list information to a PCE but does not use the PCE to compute or update path information for the SID lists.
•
PCEP —Path Computation Element Protocol. PCEP runs between a PCC and a PCE, or between PCEs. It is used to establish PCEP sessions to exchange PCEP messages over TCP connections.
PCE path computation
As shown in , the PCE path computation procedure is as follows:
1. The PCC sends a path computation request to the PCE.
2. The PCE computes paths after it receives the request.
3. The PCE replies the PCC with the computed path information.
4. The PCC creates SID lists for the SRv6 TE policy candidate path according to the path information computed by the PCE.
156
Figure 51 Path computation using PCE
PCE
B C D
PCC
A
E F G
Path computation request
Path computation reply
Computed path
SRv6 TE policy validity
An SRv6 TE policy must be valid in order to ensure successful traffic forwarding.
The following describes the rules for identifying the validity of an SRv6 TE policy:
1. An SRv6 TE policy is valid only if it has valid candidate paths.
2. A candidate path is valid only if it has a valid SID list.
3. A SID list is valid if none of the following situations exists:
The SID list is empty.
The weight of the SID list is 0.
An SR node and the first IPv6 address in the SID list cannot reach each other.
157
Figure 52 SRv6 TE policy validity determination
No
SID list valid?
Yes
Candidate path contains valid SID list?
Yes
No
SRv6 TE policy contains valid candidate path?
Yes
No
SRv6 TE policy valid SRv6 TE policy invalid
Traffic steering to an SRv6 TE policy
The following modes are available to steer traffic to an SRv6 TE policy:
•
BSID —If the destination IPv6 address of a received packet is the BSID of an SRv6 TE policy, the device uses the SRv6 TE policy to forward the packet.
•
Color —The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and nexthop address of a BGP route. If a matching SRv6 TE policy exists, the device recurse the BGP route to that SRv6 TE policy. Then, when the device receives packets that match the BGP route, it forwards the packets through the SRv6 TE policy.
•
Tunnel policy —In an MPLS L3VPN, EVPN L3VPN, EVPN VPLS, or EVPN VPWS network, use an SRv6 TE policy as the public tunnel to carry the packets of a VPN instance. For more information about the tunnel policy configuration, see MPLS Configuration Guide .
•
DSCP —Create color-to-DSCP mappings for an SRv6 TE policy group, and create a tunnel policy that binds a destination IP address to the SRv6 TE policy group. Upon receiving a packet with the specified destination address, the device searches for the SRv6 TE policy containing the color value mapped to the DSCP value of the packet. The device will use the SRv6 TE policy to forward the packet.
•
Static route —Directs traffic to an SRv6 TE policy through a static route. The device uses the
SRv6 TE policy to forward the packets that match the static route.
•
PBR —Directs traffic to an SRv6 TE policy through PBR. The device uses the SRv6 TE policy to forward the packets that match the PBR policy. For more information about PBR, see Layer
3—IP Routing Configuration Guide .
•
QoS policy —Redirects traffic to an SRv6 TE policy through a QoS policy. The device uses the
SRv6 TE policy to forward the packets that match the traffic classes of the QoS policy. For more information about QoS policies, see the QoS configuration in ACL and QoS Configuration
Guide .
•
Flowspec —Redirects traffic to an SRv6 TE policy through a Flowspec rule. The device uses the SRv6 TE policy to forward the packets that match the Flowspec rule. For more information about Flowspec, see ACL and QoS Configuration Guide .
158
•
Automatic route advertisement —Advertises an SRv6 TE policy to IGP (IPv6 IS-IS or
OSPFv3) for route computation, so as to forward the matching traffic through the SRv6 TE policy.
An SRv6 TE policy supports only automatic route advertisement in IGP shortcut mode, which is also called autoroute announce. Autoroute announce regards the SRv6 TE policy tunnel as a link that connects the tunnel ingress and egress. The tunnel ingress includes the SRv6 TE policy tunnel in IGP route computation. It does not advertise the SRv6 TE policy tunnel in the
IGP, so other devices do not include the SRv6 TE policy tunnel in route computation.
SRv6 TE policy path selection
After traffic is steered in to an SRv6 TE policy, the SRv6 TE policy selects a forwarding path for the traffic as follows:
1. Selects the valid candidate path that has the highest preference.
2. Performs Weighted ECMP (WECMP) load sharing among the SID lists of the selected candidate path. The load of SID list x is equal to Weight x /(Weight 1 + Weight 2 + … + Weight n ).
device selects a candidate path by preference. The candidate path has two valid SID lists: SID list 1 and SID list 2. The weight value of SID list 1 is 20 and the weight value of SID list 2 is 80. One fifth of the traffic will be forwarded through the subpath identified by SID list 1. Four fifth of the traffic will be forwarded through the subpath identified by SID list 2.
Figure 53 SRv6 TE policy path selection
1/5 Load sharing
SRv6 TE Policy
BSID 10::1
Cpath 1
Best Pre
SID List 1
<10::2, 20::2, 30::2>
Weight 20
Device A
10::2
Device B
20::2
Device C
30::2
60::2
Device D
SID List 2
<40::2, 50::2, 60::2>
Weight 80
40::2
Device E
50::2
Device F
4/5 Load sharing
SRv6 TE policy forwarding procedure
As shown in Figure 54 , the SRv6 TE policy forwarding procedure is as follows (BSID-based traffic
steering as an example):
1. After Device A receives a packet with destination address 100::1, it searches its IPv6 routing table and determines that the address is a BSID. Then, Device A encapsulates the packet with an SRH header according to the SRv6 TE policy of the BSID. The SRH header contains SID list
{10::2, 20::2, 30::2}, where 10::2 is the SID for Device B, 20::2 is the SID for Device C, and 30::2 is the SID for Device D.
2. Device A forward the packet to the next hop Device B.
3. After Device B receives the packet, it obtains the next hop Device C from the SRH, and then forwards the packet to Device C.
4. After Device C receives the packet, it obtains the next hop Device D from the SRH, and then forwards the packet to Device D.
159
5. After Device D receives the packet, it identifies that the SL value is 0 in the SRH. So Device D decapsulates the packet. Device D deletes the SRH header and forwards the packet according to the destination address of the packet.
Figure 54 SRv6 TE policy forwarding diagram
SA=10::1, DA=20::2
(30::2, 20::2, 10::2)
SL=1
Payload SA=10::1, DA=10::2
(30::2, 20::2, 10::2)
SL=2
Payload
SA=10::1, DA=30::2
(30::2, 20::2, 10::2)
SL=0
Payload
20::2
IPv6 packet
10::2
Device B
Device G Device A
Device C
30::2
60::2
Device D
IPv6 packet
Device H
40::2
50::2
Device F
SRv6 TE Policy
BSID 100::1
Device E
SRv6-TE Policy on Device A
Cpath 1
Best Pre
SID List 1
<10::2, 20::2, 30::2>
Forwarding Path
Dest
100::1
IPv6 routing table on Device A
Out SIDs
10::2, 20::2, 30::2
Nexthop
Device B
SRv6 TE policy CBTS
About SRv6 TE policy CBTS
SRv6 TE policy Class Based Tunnel Selection (CBTS) enables dynamic routing and forwarding of traffic with service class values over different SRv6 TE policy tunnels between the same tunnel headend and tailend. Unlike load sharing that selects multiple tunnels to forward the matching traffic,
CBTS uses a dedicated tunnel for a certain class of service.
How SRv6 TE policy CBTS works
SRv6 TE policy CBTS processes traffic mapped to a priority as follows:
1. Uses a traffic behavior to set a service class value for the traffic.
2. Configures a service class for an SRv6 TE policy.
3. Compares the service class value of the traffic with the service class values of the SRv6 TE policy tunnels and forwards the traffic to a matching tunnel.
SRv6 TE policy tunnel selection rules
SRv6 TE policy CBTS uses the following rules to select an SRv6 TE policy tunnel for the traffic to be forwarded:
•
If an SRv6 TE policy tunnel has the same service class value as the traffic, CBTS uses this tunnel.
•
If multiple SRv6 TE policy tunnels have the same service class value as the traffic, CBTS randomly selects a matching tunnel.
160
•
If the traffic does not match any SRv6 TE policy tunnels by service class value, CBTS randomly selects a tunnel from all SRv6 TE policy tunnels with the lowest forwarding priority. An SRv6 TE policy that has a smaller service class value has a lower forwarding priority. An SRv6 TE policy that is not configured with a service class value has the lowest priority.
SRv6 TE policy CBTS application scenario
As shown in Figure 55 , CBTS selects SRv6 TE policy tunnels for traffic from Device A to Device B as
follows:
•
Uses SRv6 TE policy B to forward traffic with service class value 3.
•
Uses SRv6 TE policy C to forward traffic with service class value 6.
•
Uses SRv6 TE policy A to forward traffic with service class value 4.
•
Uses SRv6 TE policy A to forward traffic with no service class value.
Figure 55 Uses SRv6 TE policy CBTS application scenario
SRv6 TE Policy A
SRv6 TE Policy B
Device A Device B
SRv6 TE Policy C
SRv6 TE Policy A service-class: null
SRv6 TE Policy B service-class: 3
SRv6 TE Policy C service-class: 6
SBFD for SRv6 TE policy
An SRv6 TE policy cannot maintain its status by exchanging messages between devices. You can configure seamless BFD (SBFD) to verify the connectivity of an SRv6 TE policy to implement fast failover in milliseconds.
As shown in Figure 56 , configure an SRv6 TE policy on Device A and use SBFD to detect the SRv6
TE policy. The detection process is as follows:
1. The source node (Device A, the initiator) and sends SBFD packets that encapsulate the SID lists of the primary and backup candidate paths of the SRv6 TE policy.
2. After the destination node (Device E, the reflector) receives an SBFD packets, it checks whether the remote discriminator carried the packet is the same as the local discriminator. If yes, the reflector sends the SBFD response packet to the initiator by using the IPv6 routing table. If no, the reflector drops the SBFD packet.
3. If the source node can receive the SBFD response within the detection timeout time, it determines the corresponding SID list (forwarding path) of the SRv6 TE policy is available. If no response is received, the device determines that the SID list is faulty. If all the SID lists for the primary path are faulty, SBFD triggers a primary-to-back path switchover.
161
Figure 56 SBFD for SRv6 TE policy procedure
IPv6 SA=a,
IPv6 DA=b
SRH[(d, c, b)
SL=2]
SBFD Packet
IPv6 SA=a,
IPv6 DA=c
SRH[(d, c, b)
SL=1]
SBFD Packet
IPv6 SA=a,
IPv6 DA=d
SRH[(d, c, b)
SL=0]
SBFD Packet
Device A
SRv6 SID=a
Device B
SRv6 SID=b
Device C
SRv6 SID=c
Device D
SRv6 SID=d
SBFD packet forwarding path of the Initiator
SBFD packet forwarding path of the Reflector
NOTE:
Because SBFD responses are forwarded according to the IPv6 routing table lookup, all SBFD sessions for the SRv6 TE policies that have the same source and destination nodes use the same path to send responses. A failure of the SBFD response path will cause all the SBFD sessions and consequentially all the associated SRv6 TE policies to be down.
SRv6 TE policy hot standby
If an SRv6 TE policy has multiple valid candidate paths, the device chooses the candidate path with the greatest preference value. If the chosen path fails, the SRv6 TE policy must select another candidate path. During path reselection, packet loss might occur and thus affect service continuity.
The SRv6-TE hot standby feature can address this issue. This feature takes the candidate path with the greatest preference value as the primary path and that with the second greatest preference value
as the backup path in hot standby state. As shown in Figure 57 , when the forwarding paths
corresponding to all SID lists of the primary path fails, the standby path immediately takes over to minimize service interruption.
Figure 57 SRv6 TE policy hot standby
C E G
103 305
1001 507
A B
1002 608
204 406
D F H
Primary Hot standby
You can configure both the hot standby and SBFD features for an SRv6 TE policy. Use SBFD to detect the availability of the primary and standby paths specified for hot standby. If all SID lists of the primary path become unavailable, the standby path takes over and a path recalculation is performed.
162
The standby path becomes the new primary path, and a new standby path is selected. If both the primary and standby paths fail, the SRv6 TE policy will calculate new primary and standby paths.
SRv6 TE policy egress protection
This feature provides egress node protection in MPLS L3VPN over SRv6, EVPN L3VPN over SRv6,
EVPN VPLS over SRv6, or EVPN VPWS over SRv6 networks where the public tunnel is an SRv6 TE policy tunnel.
SRv6 TE policy egress protection applies only to the dual homing scenario. To implement SRv6 TE policy egress protection, the egress node and the egress node's protection node must have the same forwarding entries.
As shown in Figure 58 , deploy an SRv6 TE policy between PE 1 and PE 3. PE 3 is the egress node
(endpoint node) of the SRv6 TE policy. To improve forwarding reliability, configure PE 4 to protect PE
3.
Figure 58 SRv6 TE policy egress protection
Dest
A100::/64
FIBv6
Nexthop
PE 3
PE 4
Action
-
Push A200::2 FRR route
PE 1 P 1
Locator=A100::/64
End.DT4=A100::1
PE 3
End
.M SID
VPN 1
CE 1
PE 2 P 2
IS
-ISv
6
VPNv4
CE 2
VPN 1
IS-ISv6
PE 4
Locator=A200::/64
End.M SID
Remote SRv6 SID and VPN mapping=< A100::1 , VPN 1>
End.M SID= A200::2
End.M SID
In SRv6 TE policy egress protection, an End.M SID is used to protect the SRv6 SIDs in a specific locator. If an SRv6 SID advertised by the remote device (PE 3 in this example) is within the locator, the protection node (PE 4) uses the End.M SID to protect that SRv6 SID (remote SRv6 SID).
PE 4 takes different actions as instructed by an End.M SID in different network scenarios:
•
MPLS/EVPN L3VPN over SRv6 TE policy scenario a. Removes the outer IPv6 header to obtain the remote SRv6 SID from the inner packet. b. Searches the remote SRv6 SID and VPN instance mapping table to find the VPN instance mapped to the remote SRv6 SID. c. Forwards the packet by looking up the routing table of the VPN instance.
•
EVPN VPWS over SRv6 TE policy scenario d. Removes the outer IPv6 header to obtain the remote SRv6 SID from the inner packet. e. Searches the remote SRv6 SID and cross-connect mapping table to find the cross-connect mapped to the remote SRv6 SID. f. Forwards the packet to the AC associated with the cross-connect.
•
EVPN VPLS over SRv6 TE policy scenario g. Removes the outer IPv6 header to obtain the remote SRv6 SID from the inner packet.
163
h. Searches the remote SRv6 SID and VSI mapping table to find the VSI mapped to the remote SRv6 SID. i. Forwards the packet according to the MAC address forwarding table of the VSI.
Remote SRv6 SID
As shown in Figure 58 , PE 4 receives a BGP route from PE 3. If the SRv6 SID in the BGP route is
within the locator protected by the End.M SID on PE 4, PE 4 regards the SRv6 SID as a remote SRv6
SID and generates a mapping between the remote SRv6 SID and the VPN instance, cross-connect, or VSI.
When the adjacency between PE 4 and PE 3 breaks, PE 4 deletes the BGP route received from PE
3. As a result, the remote SRv6 SID and VPN instance/cross-connect/VSI mapping will be deleted, resulting in packet loss. To avoid this issue, you can configure the mappings deletion delay time on
PE 4 to ensure that traffic is forwarded through PE 4 before PE 1 knows the PE 3 failure and computes a new forwarding path.
Route advertisement
The route advertisement procedure is similar in MPLS L3VPN, EVPN L3VPN, EVPN VPWS, or
EVPN VPLS over SRv6 TE policy egress protection scenarios. The following example describes the route advertisement in an MPLS L3VPN over SRv6 TE policy egress protection scenario.
As shown in Figure 58 , the FRR path is generated on P 1 as follows:
1. PE 4 advertises the End.M SID and the protected locator to P 1 through an IS-ISv6 route.
Meanwhile, PE 4 generates a local SID entry for the End.M SID.
2. Upon receiving the route that carries the End.M SID, P 1 generates an FRR route destined for the specified locator and the action for the route is pushing the End.M SID.
On PE 4, a <remote SRv6 SID, VPN instance > mapping entry is generated as follows:
3. Upon receiving the private route from CE 2, PE 3 encapsulates the route as a VPNv4 route and sends it to PE 4. The VPNv4 route carries the SRv6 SID, RT, and RD information.
4. After PE 4 receives the VPNv4 route, it obtains the SRv6 SID and the VPN instance. Then, PE
4 performs longest matching of the SRv6 SID against the locators protected by End.M SIDs. If a match is found, PE 4 uses the SRv6 SID as a remote SRv6 SID and generates a <remote SRv6
SID, VPN instance> mapping entry.
Packet forwarding
The packet forwarding procedure is similar in MPLS L3VPN, EVPN L3VPN, EVPN VPWS, or EVPN
VPLS over SRv6 TE policy egress protection scenarios. The following example describes the packet forwarding in an MPLS L3VPN over SRv6 TE policy egress protection scenario.
164
Figure 59 Data forwarding in SRv6 TE policy egress protection
PE 1
SA=300::1, DA=A200::2
SA=123::1, DA=A100::1
SRH
Data
P 1
Locator=A100::/64
End.DT4=A100::1
PE 3
VPN 1
CE 1 CE 2
VPN 1
Normal forwarding path
Mirror FRR forwarding path
PE 4
Remote SRv6 SID and VPN mapping=< A100::1 , VPN 1>
PE 2 P 2
Locator=A200::/64
End.M SID=A200::2
SA=300::1, DA=A200::2
SA=123::1, DA=A100::1
SRH
Data
As shown in Figure 59 , typically traffic is forwarded along the CE 1-PE 1-P 1-PE 3-CE 2 path. When
the egress node PE 3 fails, a packet is forwarded as follows:
1. P 1 detects that its next hop (PE 3) is unreachable and thus switches traffic to the FRR path. P
1 pushes the End.M SID into the IPv6 header of the packet and forwards the packet to PE 4.
2. PE 4 parses the packet and obtains the End.M SID. PE 4 queries the local SID table and takes actions as instructed by the End.M SID: a. Removes the outer IPv6 header to obtain the remote SRv6 SID from the inner packet. (The remote SRv6 SID is A100::1 in this example) b. Searches the remote SRv6 SID and VPN instance mapping table to find the VPN instance mapped to the remote SRv6 SID. (The VPN instance is VPN 1 in this example.) c. Looks up the routing table of the VPN instance and forwards the packet to CE 2 according to the matching route.
SRv6 TE policy tasks at a glance
To configure an SRv6 TE policy, perform the following tasks:
1. Configuring an SRv6 TE policy and configure basic settings for the policy: a.
b.
This task is required when you use PCE to compute SID lists. c.
Configuring a candidate path and the SID lists of the path
d.
(Optional.) Enabling the device to distribute SRv6 TE policy candidate path information to
e.
(Optional.) Shutting down an SRv6 TE policy
2.
(Optional.) Configuring BGP to advertise BGP IPv6 SR policy routes
a.
Enabling BGP to advertise BGP IPv6 SR policy routes
165
b.
Configuring BGP to redistribute BGP IPv6 SR policy routes
c.
(Optional.) Enabling advertising BGP IPv6 SR policy routes to EBGP peers
d. (Optional.)
e.
(Optional.) Configuring BGP to control BGP IPv6 SR policy route selection and advertisement
f.
(Optional.) Maintaining BGP sessions
3.
Configuring SRv6 TE policy traffic steering
4.
(Optional.) Configuring the SRv6 TE policy encapsulation mode
5. (Optional.) Configuring high availability features for SRv6 TE policy
Enabling SBFD for SRv6 TE policies
Configuring the BFD echo packet mode for SRv6 TE policies
Enabling hot standby for SRv6 TE policies
Configuring path switchover and deletion delays for SRv6 TE policies
Configuring SRv6 TE policy egress protection
6. (Optional.) Configuring advanced settings for SRv6 TE policies
Configuring the TTL processing mode of SRv6 TE policies
Configuring SRv6 TE policy CBTS
Enabling the device to drop traffic when an SRv6 TE policy becomes invalid
Specifying the packet encapsulation type preferred in optimal route selection
7. (Optional.) Maintaining an SRv6 TE policy
Configuring SRv6 TE policy resource usage alarm thresholds
Enabling SRv6 TE policy logging
Enabling SNMP notifications for SRv6 TE policies
Configuring traffic forwarding statistics for SRv6 TE policies
Creating an SRv6 TE policy
Manually creating an SRv6 TE policy and configuring its attributes
About this task
An SRv6 TE policy is identified by a BSID, color, and end-point.
You can bind a BSID to the policy manually, or set only the color and end-point attributes of the policy so the system automatically assigns a BSID to the policy. If you use both methods, the manually bound BSID takes effect.
Restrictions and guidelines
The configured BSID must be on the locator specified for SRv6 TE policies in SRv6 TE view.
Otherwise, the SRv6 TE policy cannot forward packets. For more information about the locator configuration, see "Configuring SRv6."
Different SRv6 TE policies cannot have the same color and end-point configuration.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view.
166
segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Specify a locator for SRv6 TE. srv6-policy locator locator-name
By default, no locator is specified for SRv6 TE.
5. Enter SRv6 TE policy view. policy policy-name
6. Configure a BSID for the policy.
binding-sid ipv6 ipv6-address
7. Set the color and endpoint attributes.
color color-value end-point ipv6 ipv6-address
By default, the color and endpoint attributes of an SRv6 TE policy are not configured.
Automatically creating SRv6 TE policies by using ODN
About this task
When the device receives a BGP route, if the color extended attribute value of the BGP route is the same as the color value of an ODN template, the device automatically creates an SRv6 TE policy and two candidate paths for the policy. The automatically created candidate paths use preferences
100 and 200.
You can specify an IPv6 prefix list to filter BGP routes. The BGP routes permitted by the specified
IPv6 prefix list can trigger ODN to create SRv6 TE policies. The BGP routes denied by the specified
IPv6 prefix list cannot trigger ODN to create SRv6 TE policies.
An ODN-created SRv6 TE policy is deleted immediately when the matching BGP route is deleted. To avoid packet loss before the new forwarding path is computed, you can configure a proper deletion delay time for the SRv6 TE policy.
Restrictions and guidelines
You need to configure candidate paths for an ODN-created SRv6 TE policy.
•
For the ODN-created candidate path preference 200, manually configure the SID lists for the candidate path.
•
For the ODN-created candidate path preference 100, use PCE to compute the SID lists for the candidate path.
•
Manually create candidate paths that use preferences other than 100 and 200, and then configure the SID lists for the candidate paths.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Specify a locator for SRv6 TE. srv6-policy locator locator-name
By default, no locator is specified for SRv6 TE.
167
5. Create an ODN template and enter SRv6 TE-ODN view.
on-demand color color-value
6. (Optional.) Configure the ODN SRv6 TE policy generation policy.
restrict prefix-list-name
By default, a BGP route can trigger ODN to create an SRv6 TE policy when the route's color attribute value is the same as the ODN color.
7. (Optional.) Configure the deletion delay time for ODN-created SRv6 TE policies.
delete-delay delay-time
By default, the deletion delay time for ODN-created SRv6 TE policies is 180000 milliseconds.
Configuring a PCEP session
Restrictions and guidelines
For more information about the PCEP commands, see MPLS commands in MPLS Command
Reference .
Discovering PCEs
About this task
You can manually specify a PCE by using the pce static command on a PCC. A PCC sends
PCEP connection requests to the discovered PCEs but does not accept requests from the PCEs.
Procedure
1. Enter system view. system-view
2. Enter PCC view. pce-client
3. Specify the IP address of the PCE.
pce static ip-address
Enabling the SRv6 capability for a PCC
About this task
To establish a PCEP session that supports SRv6, you need to enable the SRv6 capability on the devices at both sides of the PCEP session.
Procedure
1. Enter system view. system-view
2. Enter PCC view. pce-client
3. Enable the SRv6 capability for the PCC device. pce capability segment-routing ipv6
By default, a PCC device does not have the SRv6 capability.
168
Configuring PCEP session parameters
About this task
This task allows you to configure parameters for a PCC to establish PCEP sessions to manually specified PCEs.
Procedure
1. Enter system view. system-view
2. Enter PCC view. pce-client
3. Set the path computation request timeout time. pce request-timeout value
By default, the request timeout time is 10 seconds.
4. Set the PCEP session deadtimer. pce deadtimer value
By default, the PCEP session deadtimer is 120 seconds.
5. Set the keepalive interval for PCEP sessions.
pce keepalive interval
By default, the keepalive interval is 30 seconds.
6. Set the minimum acceptable keepalive interval and the maximum number of allowed unknown messages received from the PCE peer. pce tolerance { min-keepalive value | max-unknown-messages value }
By default, the minimum acceptable keepalive interval is 10 seconds, and the maximum number of allowed unknown messages in a minute is 5.
7. Configure PCEP session authentication for a peer. Choose one option as needed:
Configure the keychain authentication.
pce peer ip-address keychain keychain-name
Configure the MD5 authentication.
pce peer ip-address md5 { cipher | plain } string
By default, PCEP session authentication is not configured.
For two devices to establish a PCEP session, you must configure the same authentication mode and specify the same key string on both devices.
Configuring a candidate path and the SID lists of the path
Restrictions and guidelines
Do not configure an SRv6 TE policy candidate path to use both manually configured SID lists and
PCE-computed SID lists.
169
Configuring a candidate path to use manually configured SID lists
About this task
Before you specify a SID list for a candidate path, you need to create the SID list and add nodes to the SID list.
After you add nodes to a SID list, the system will sort the nodes in ascending order of node index.
The node with the smallest index represents the next hop of the source node on the forwarding path.
To reduce the SRH cost, you can use four 32-bit G-SIDs to represent one normal 128-bit SRv6 SID.
In a SID list, you can add a 128-bit SRv6 SID with a COC flavor, indicating that the next node of the current node is a 32-bit G-SID. For more information about G-SIDs, see "Configuring SRv6."
Restrictions and guidelines
When you add G-SIDs to a SID list, make sure the following conditions are met:
•
The SRv6 SID for the previous node of the G-SID must be End(COC32) SID or End.X(COC32)
SID.
•
The SRv6 SID for the last node does not contain the COC flavor. That is, you cannot use the
index index-number coc32 ipv6 command to specify the SRv6 SID for the penultimate node.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Create a SID list and enter SID list view. segment-list segment-list-name
5. Add a node to the SID list.
Add a normal 128-bit SRv6 SID. index index-number ipv6 ipv6-address
Add a 128-bit SRv6 SID with the COC flavor, and specify the common prefix length for the next G_SID.
index index-number coc32 ipv6 ipv6-address common-prefix-length
6. Return to SRv6 TE view. quit
7. Enter SRv6 TE policy view. policy policy-name
8. Create and enter SRv6 TE policy candidate path view. candidate-paths
9. Set the preference for a candidate path and enter SRv6 TE policy path preference view. preference preference-value
By default, no candidate path preferences are set.
Each preference represents a candidate path.
10. Specify an explicit path for the candidate path.
170
explicit segment-list segment-list-name [ path-mtu mtu-value | weight weight-value ]
A candidate path can have multiple SID lists.
Configuring a candidate path to use PCE-computed SID lists
Prerequisites
Before you perform this task, configure a PCEP session first.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE policy view. policy policy-name
5. Create and enter SRv6 TE policy candidate path view. candidate-paths
6. Set the preference for a candidate path and enter SRv6 TE policy path preference view. preference preference-value
By default, no candidate path preferences are set.
Each preference represents a candidate path.
7. Create and enter SRv6 TE policy path preference dynamic view. dynamic
8. Enable a candidate path to use PCE to compute the SID lists. pcep
By default, a candidate path does not use PCE to compute SID lists.
Configuring an ODN-created candidate path to use
PCE-computed SID lists
Prerequisites
Before you perform this task, configure a PCEP session first.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE-ODN view.
on-demand color color-value
171
5. Enter SRv6 TE-ODN dynamic view. dynamic
6. Enable a candidate path to use PCE to compute the SID lists. pcep
By default, a candidate path does not use PCE to compute SID lists..
Configuring PCE delegation to create candidate paths and
SID lists
About this task
After PCE delegation for an SRv6 TE policy is enabled, the PCC delegates the policy's candidate paths to a PCE. The PCC creates or updates candidate paths according to the creation or update requests received from the PCE.
When the device delegates only part of its SRv6 TE policies to a PCE, the PCE does not have complete SRv6 TE policy candidate path information to calculate global bandwidth information. You can enable the device to report information about the undelegated SRv6 TE policies to the PCE without using the PCE to compute candidate paths for the policies. This feature is referred to as the passive delegation report only feature.
Restrictions and guidelines
You can configure the PCE delegation and passive delegation report only features for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6 TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
In SRv6 TE view, if you execute both the srv6-policy pce delegation enable command and the srv6-policy pce passive-delegate report-only enable command, the srv6-policy pce passive-delegate report-only enable command takes effect.
In SRv6 TE policy view, if you execute both the pce delegation command and the pce passive-delegate report-only command, the pce passive-delegate report-only command takes effect.
Prerequisites
Before you perform this task, configure a PCEP session first.
Configuring PCE delegation parameters
1. Enter system view. system-view
2. Enter PCC view. pce-client
3. Set the delegation priority of a PCE.
pce peer ip-address delegation-priority priority
By default, the delegation priority of a PCE is 65535.
A smaller value represents a higher priority.
4. Set the redelegation timeout interval. pce redelegation-timeout value
By default, the redelegation timeout interval is 30 seconds.
5. Set the state timeout interval on the PCC. pce state-timeout value
172
By default, the state timeout interval is 60 seconds.
Enabling delegation
1. Enter system view. system-view
2. Enter PCC view. pce-client
3. Configure the PCEP device type as active stateful or passive stateful. pcep type { active-stateful | passive-stateful }
By default, the PCEP device type is stateless.
4. Return to system view. quit
5. Enter SRv6 view. segment-routing ipv6
6. Enter SRv6 TE view. traffic-engineering
7. Enable PCE delegation for SRv6 TE policies globally. srv6-policy pce delegation enable
By default, PCE delegation for SRv6 TE policies is disabled globally.
8. Globally enable the PCC to report candidate information of an SRv6 TE policy to the PCE without delegating the policy to the PCE. srv6-policy pce passive-delegate report-only enable
By default, this feature is disabled globally.
9. Enter SRv6 TE policy view. policy policy-name
10. Enable PCE delegation for the SRv6 TE policy. pce delegation { enable | disable }
By default, an SRv6 TE policy uses the PCE delegation setting configured in SRv6 TE view.
11. Enable the PCC to report candidate information of the SRv6 TE policy to the PCE without delegating the policy to the PCE. pce passive-delegate report-only { enable | disable }
By default, an SRv6 TE policy uses the passive delegation report only setting configured in
SRv6 TE view.
Enabling the device to distribute SRv6 TE policy candidate path information to BGP-LS
About this task
After this feature is enabled, the device distributes SRv6 TE policy candidate path information to
BGP-LS. BGP-LS advertises the SRv6 TE policy candidate path information in routes to meet application requirements.
Prerequisites
Before you configure this feature, enable the device to exchange LS information with the related peer or peer group. For more information about the LS exchange capability, see the BGP LS configuration in Layer 3—IP Routing Configuration Guide .
173
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enable the device to distribute SRv6 TE policy candidate path information to BGP-LS.
distribute bgp-ls
By default, the device cannot distribute SRv6 TE policy candidate path information to BGP-LS
Shutting down an SRv6 TE policy
About this task
This feature controls the administrative state of an SRv6 TE policy.
If multiple SRv6 TE policies exist on the device, you can shut down unnecessary SRv6 TE policies to prevent them from affecting traffic forwarding.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE policy view. policy policy-name
5. Shut down the SRv6 TE policy.
shutdown
By default, an SRv6 TE policy is not administratively shut down.
Configuring BGP to advertise BGP IPv6 SR policy routes
Restrictions and guidelines for BGP IPv6 SR policy routes advertisement
For more information about BGP commands, see Layer 3—IP Routing Commands .
Enabling BGP to advertise BGP IPv6 SR policy routes
1. Enter system view. system-view
174
2. Configure a global router ID.
router id router-id
By default, no global router ID is configured.
3. Enable a BGP instance and enter its view.
bgp as-number [ instance instance-name ]
By default, BGP is disabled and no BGP instances exist.
4. Configure a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
5. Create the BGP IPv6 SR policy address family and enter its view. address-family ipv6 sr-policy
6. Enable BGP to exchange BGP IPv6 SR policy routing information with the peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, the device cannot use BGP to exchange BGP IPv6 SR policy routing information with a peer or peer group.
Configuring BGP to redistribute BGP IPv6 SR policy routes
About this task
After you configure BGP to redistribute BGP IPv6 SR policy routes, the system will redistribute the local BGP IPv6 SR policy routes to the BGP routing table and advertise the routes to peers. Then, the peers can forward traffic based on the BGP IPv6 SR policy.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv6 SR policy address family view. address-family ipv6 sr-policy
4. Enable BGP to redistribute routes from BGP IPv6 SR policies. import-route sr-policy
By default, BGP does not redistribute BGP IPv6 SR policy routes.
Enabling advertising BGP IPv6 SR policy routes to EBGP peers
About this task
By default, BGP IPv6 SR policy routes are advertised among IBGP peers. To advertise BGP IPv6 SR policy routes to EBGP peers, you must perform this task to enable the advertisement capability.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
175
3. Enter BGP IPv6 SR policy address family view. address-family ipv6 sr-policy
4. Enable advertising BGP IPv6 SR policy routes to EBGP peers. advertise ebgp enable
By default, BGP IPv6 SR policy routes are not advertised to EBGP peers.
Enabling Router ID filtering
About this task
For the device to process only part of the received BGP IPv6 SR policy routes, you can perform this task to enable filtering the routes by Router ID.
This feature enables the device to check the Route Target attribute of a received BGP IPv6 SR policy route. The device accepts the route only if the Route Target attribute contains the Router ID of the local device.
Restrictions and guidelines
To use Router ID filtering, make sure you add Route Target attributes to BGP IPv6 SR policy routes properly by using routing policy or other methods. Otherwise, Router ID filtering might learn or drop
BGP IPv6 SR policy routes incorrectly.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv6 SR policy address family view. address-family ipv6 sr-policy
4. Enable Router ID filtering. router-id filter
By default, Router ID filtering is disabled.
Configuring BGP to control BGP IPv6 SR policy route selection and advertisement
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv6 SR policy address family view. address-family ipv6 sr-policy
4. Specify the local router as the next hop for routes sent to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } next-hop-local
By default, BGP sets the local router as the next hop for all routes sent to an EBGP peer or peer group. BGP does not set the local router as the next hop for routes sent to an IBGP peer or peer group.
5. Allow a local AS number to exist in the AS_PATH attribute of routes from a peer or peer group, and to set the number of times the local AS number can appear.
176
peer { group-name | ipv6-address [ prefix-length ] } allow-as-loop
[ number ]
By default, the local AS number is not allowed to exist in the AS_PATH attribute of routes from a peer or peer group.
6. Specify a preferred value for routes received from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } preferred-value value
By default, the preferred value is 0 for routes received from a peer or peer group.
7. Set the maximum number of routes that can be received from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-limit prefix-number [ { alert-only | discard | reconnect reconnect-time } | percentage-value ] *
By default, the number of routes that can be received from a peer or peer group is not limited.
8. Configure BGP route reflection. a. Configure the device as a route reflector and specify a peer or peer group as a client. peer { group-name | ipv6-address [ prefix-length ] } reflect-client
By default, neither the route reflector nor the client is configured. b. (Optional.) Enable BGP IPv6 SR policy route reflection between clients. reflect between-clients
By default, route reflection between clients is enabled. c. (Optional.) Configure the cluster ID for a route reflector. reflector cluster-id { cluster-id | ipv4-address }
By default, a route reflector uses its own router ID as the cluster ID.
9. Specify an IPv6 prefix list to filter routes received from or advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } prefix-list ipv6-prefix-list-name { export | import }
By default, no prefix list based filtering is configured.
10. Apply a routing policy to routes incoming from or outgoing to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-policy route-policy-name { export | import }
By default, no routing policy is applied to routes incoming from or outgoing to a peer or peer group.
11. Advertise the COMMUNITY attribute to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise-community
By default, no COMMUNITY attribute is advertised to any peers or peer groups.
12. Advertise the extended community attribute to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise-ext-community
By default, no extended community attribute is advertised to any peers or peer groups.
Maintaining BGP sessions
To maintain BGP sessions, execute the following commands in user view:
•
Reset BGP sessions for the BGP IPv6 SR policy address family.
177
reset bgp [ instance instance-name ] { as-number | ipv6-address
[ prefix-length ] | all | external | group group-name | internal } ipv6 sr-policy
•
Soft-reset BGP sessions for the BGP IPv6 SR policy address family. refresh bgp [ instance instance-name ] { ipv6-address [ prefix-length ]
| all | external | group group-name | internal } { export | import } ipv6 sr-policy
Configuring SRv6 TE policy traffic steering
Configuring the SRv6 TE policy traffic steering mode
Restrictions and guidelines
This feature does not take effect on L2VPN networks.
Prerequisites
To use color-based traffic steering, you need to add the color extended community to IPv6 unicast routes by using routing policy or other methods. For information about the routing policy configuration, see Layer 3—IP Routing Configuration Guide .
To use tunnel policy-based traffic steering, you need to configure a bound tunnel, preferred tunnel, or load sharing tunnel policy that uses an SRv6 TE policy. For more information about the tunnel policy configuration, see MPLS Configuration Guide .
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Configure the traffic steering mode for SRv6 TE policies.
sr-policy steering { disable | policy-based }
By default, the device steering data packets to SRv6 TE policies based on colors of the packets.
If you specify the policy-based keyword, the device steers traffic based on the bound policy, color, and tunnel load sharing policy in a descending order of priority.
Configuring color-based traffic steering
1. Enter system view. system-view
2. Enter routing policy node view. route-policy route-policy-name { deny | permit } node node-number
3. Set the color extended community attribute for BGP routes. apply extcommunity color color [ additive ]
By default, no color extended community attribute is set for BGP routes.
4. Return to system view. quit
5. Enter BGP instance view.
bgp as-number [ instance instance-name ]
178
6. Enter a BGP address family view as needed:
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view address-family ipv6 [ unicast ]
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
Enter BGP EVPN address family view. address-family l2vpn evpn
7. Apply the routing policy to filter routes advertised to or received from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-policy route-policy-name { export | import }
By default, no routing policy is applied to a peer or peer group.
Configuring tunnel policy-based traffic steering
Configuring a tunnel policy
1. Enter system view. system-view
2. Create a tunnel policy and enter tunnel policy view. tunnel-policy tunnel-policy-name [ default ]
3. Configure the tunnel policy. Choose the following tasks as needed:
Specify an SRv6 TE policy to be bound with the specified destination IPv6 address. binding-destination dest-ipv6-address srv6-policy { name policy-name | end-point ipv6 ipv6-address color color-value }
[ ignore-destination-check ] [ down-switch ]
By default, no SRv6 TE policy is specified for a tunnel policy.
Specify an SRv6 TE policy as a preferred tunnel of the tunnel policy.
preferred-path srv6-policy name sr-policy-name
By default, no preferred tunnel is specified for a tunnel policy.
Configuring SRv6 TE policy load sharing for the tunnel policy. select-seq srv6-policy load-balance-number number
By default, no load sharing tunnel policy is configured.
For more information about the tunnel policy commands, see MPLS Command Reference .
Specifying the tunnel policy for a VPN instance
1. Enter system view. system-view
2. Enter a VPN instance view as needed.
Enter VPN instance view. ip vpn-instance vpn-instance-name
Execute the following commands in sequence to enter VPN instance IPv4 address family view:
179
ip vpn-instance vpn-instance-name address-family ipv4
Execute the following commands in sequence to enter VPN instance IPv6 address family view: ip vpn-instance vpn-instance-name address-family ipv6
3. Specify a tunnel policy for the VPN instance.
tnl-policy tunnel-policy-name
By default, no tunnel policy is specified for a VPN instance.
For more information about this command, see MPLS L3VPN commands in MPLS Command
Reference .
Specifying the tunnel policy for a PW
1. Enter system view. system-view
2. Enter cross-connect group view. xconnect-group group-name
3. Enter cross-connect view. connection connection-name
4. Create an EVPN PW and specify a tunnel policy for this PW.
evpn local-service-id local-service-id remote-service-id
remote-service-id tunnel-policy tunnel-policy-name
Specifying the tunnel policy for an EVPN instance
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter EVPN instance view. evpn encapsulation srv6
4. Specify a tunnel policy for the EVPN instance. tunnel-policy tunnel-policy-name
By default, no tunnel policy is specified for an EVPN instance.
For more information about this command, see EVPN Command Reference .
Configuring DSCP-based traffic steering
About this task
Each SRv6 TE policy in an SRv6 TE policy group has a different color attribute value. By configuring color-to-DSCP mappings for an SRv6 TE policy group, you associate DSCP values to SRv6 TE policies. This allows IPv6 packets containing a specific DSCP value to be steered to the corresponding SRv6 TE policy for further forwarding.
Restrictions and guidelines
You can map the color values of only valid SRv6 TE policies to DSCP values.
You can configure color-to-DSCP mappings separately for the IPv4 address family and IPv6 address family. For a specific address family, a DSCP value can be mapped to only one color value.
180
Use the color match dscp default command to specify the default SRv6 TE policy for an address family. If no SRv6 TE policy in an SRv6 TE policy group matches a specific DSCP value, the default SRv6 TE policy is used to forward packets containing the DSCP value. Only one default
SRv6 TE policy can be specified for an address family.
When the device receives an IPv4 or IPv6 packet that does not match any color-to-DSCP mapping, the device selects a valid SRv6 TE policy for the packet in the following order:
1. The default SRv6 TE policy specified for the same address family as the packet.
2. The default SRv6 TE policy specified for the other address family.
3. The SRv6 TE policy mapped to the smallest DSCP value in the same address family as the packet.
4. The SRv6 TE policy mapped to the smallest DSCP value in the other address family.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Create an SRv6 TE policy group and enter its view. policy-group group-id
5. Configure the endpoint IPv6 address for the SRv6 TE policy group.
end-point ipv6 ipv6-address
By default, no endpoint IPv6 address is configured for the SRv6 TE policy group.
The SRv6 TE policies added to the SRv6 TE policy group must use the same endpoint IPv6 address as the SRv6 TE policy group.
6. Create color-to-DSCP mappings for the SRv6 TE policy group. color color-value match dscp { ipv4 | ipv6 } dscp-value-list color color-value match dscp { ipv4 | ipv6 } default
By default, no color-to-DSCP mappings are created for the SRv6 TE policy group.
DSCP-based traffic steering cannot function if no color-to-DSCP mappings are created.
7. Return to system view. quit
8. Create a tunnel policy and enter tunnel policy view.
tunnel-policy tunnel-policy-name [ default ]
9. Bind the SRv6 TE policy group to a destination IP address. binding-destination dest-ip-address sr-policy group sr-policy-group-id [ ignore-destination-check ] [ down-switch ]
By default, a tunnel policy does not bind any SRv6 TE policy group to a destination IP address.
For more information about the command, see tunnel policy commands in MPLS Command
Reference .
181
Configuring static route-based traffic steering
Restrictions and guidelines
After you configure this feature on a public IP over SRv6 network, execute the route-replicate command in public instance IPv4/IPv6 address family view to replicate the routes of the specified
VPN instance to the public network. The public network then can use the VPN routes to forward user traffic.
Procedure
1. Enter system view. system-view
2. Configure static route recursion to an SRv6 TE policy:
Configure IPv4 static route recursion to an SRv6 TE policy:
Public network: ip route-static dest-address { mask-length | mask } srv6-policy
{ color color-value end-point ipv6 ipv6-address | name policy-name }
[ sid sid ] [ preference preference ] [ tag tag-value ] [ description text ]
VPN: ip route-static vpn-instance s-vpn-instance-name dest-address
{ mask-length | mask } srv6-policy { color color-value end-point
ipv6 ipv6-address | name policy-name } [ sid sid ] [ preference preference ] [ tag tag-value ] [ description text ]
By default, no IPv4 static route is configured.
For more information, see static routing commands in Layer 3—IP Routing Command
Reference .
Configure IPv6 static route recursion to an SRv6 TE policy:
Public network: ipv6 route-static ipv6-address prefix-length srv6-policy { color color-value end-point ipv6 ipv6-address | name policy-name } [ sid sid ] [ preference preference ] [ tag tag-value ] [ description text ]
VPN:
ipv6 route-static vpn-instance s-vpn-instance-name ipv6-address
prefix-length srv6-policy { color color-value end-point ipv6 ipv6-address | name policy-name } [ sid sid ] [ preference
preference ] [ tag tag-value ] [ description text ]
By default, no IPv6 static route is configured.
For more information, see IPv6 static routing commands in Layer 3—IP Routing Command
Reference .
Configuring QoS policy-based traffic steering
About this task
When some public IPv6 flows are congested, you can configure traffic classification to identify the flows and redirect the traffic to SRv6 TE policies to resolve the congestion. Traffic redirection to SRv6
TE policies is based on endpoint and color. If traffic cannot match the redirect rule or the redirect
SRv6 TE policy fails, the traffic cannot be forwarded through an SRv6 TE policy but through normal
IPv6 forwarding.
182
Restrictions and guidelines
For more information about QoS policy commands, see ACL and QoS Command Reference .
Procedure
1. Define a traffic class: a. Enter system view. system-view b. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] c. Configure a match criterion. if-match [ not ] match-criteria
By default, no match criterion is configured.
For more information, see the if-match command in ACL and QoS Command
Reference .
2. Define a traffic behavior: a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Redirect the matching traffic to an SRv6 TE policy. redirect srv6-policy endpoint color [ { sid | vpnsid } sid ]
By default, no traffic behavior is configured.
3. Define and apply a QoS policy: a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate a traffic class with a traffic behavior to create a class-behavior association in the
QoS policy. classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit d. Apply the QoS policy.
For more information, see QoS policy configuration in ACL and QoS Configuration Guide .
By default, no QoS policy is applied.
Configuring Flowspec-based traffic steering
Creating and activating an IPv6 Flowspec rule
1. Enter system view. system-view
2. Create an IPv6 Flowspec rule and enter IPv6 Flowspec rule view.
flow-route flowroute-name ipv6
3. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
4. Redirect packets to an SRv6 TE policy.
apply redirect next-hop ipv6-address color color [ sid sid-value ]
183
By default, no action is configured.
5. Commit match criteria and actions. commit
By default, match criteria and actions are not committed.
Applying the IPv6 Flowspec rule to the public network
1. Enter system view. system-view
2. Enter Flowspec view. flowspec
3. Create a Flowspec IPv6 address family for the public network and enter its view. address-family ipv6
4. Apply the created IPv6 Flowspec rule to the public network.
flow-route flowroute-name
By default, no IPv6 Flowspec rule is applied to the public network.
Applying the IPv6 Flowspec rule to a VPN instance
1. Enter system view. system-view
2. Configure a VPN instance. a. Create a VPN instance and enter VPN instance view. ip vpn-instance vpn-instance-name b. Configure an RD for the VPN instance. route-distinguisher route-distinguisher
By default, no RD is configured for a VPN instance. c. Configure route targets for the VPN instance. vpn-target { vpn-target &<1-8> [ both | export-extcommunity | import-extcommunity ] }
By default, no route targets are configured.
For more information about the ip vpn-instance , route-distinguisher , and vpn-target commands, see MPLS L3VPN commands in MPLS Command Reference .
3. Enter the IPv6 Flowspec address family view of the VPN instance. address-family ipv6 flowspec
4. Configure an RD for the IPv6 Flowspec address family. route-distinguisher route-distinguisher
By default, no RD is configured for the IPv6 Flowspec address family.
5. Configure route targets for the IPv6 Flowspec address family.
vpn-target vpn-target &<1-8> [ both | export-extcommunity | import-extcommunity ]
By default, no route targets are configured for the IPv6 Flowspec address family.
The route targets configured must be the same as the route targets configured previously for the VPN instance.
6. Execute the quit command twice to return to system view.
7. Enter Flowspec view. flowspec
184
8. Create a Flowspec IPv6 address family and associate the address family with the VPN instance.
address-family ipv6 vpn-instance vpn-instance-name
9. Apply the created IPv6 Flowspec rule to the Flowspec IPv6 VPN instance address family.
flow-route flowroute-name
By default, no IPv6 Flowspec rule is applied to a Flowspec IPv6 VPN instance address family.
Enabling BGP to distribute IPv6 Flowspec rules
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv6 Flowspec address family view, BGP-VPN IPv6 Flowspec address family view, or BGP VPNv6 Flowspec address family view:
Enter BGP IPv6 Flowspec address family view to advertise public network IPv6 Flowspec rules. address-family ipv6 flowspec
Execute the following commands in sequence to enter BGP-VPN IPv6 Flowspec address family view to advertise private network IPv6 Flowspec rules:
ip vpn-instance vpn-instance-name address-family ipv6 flowspec
Enter BGP VPNv6 Flowspec address family view to advertise VPNv6 Flowspec rules. address-family vpnv6 flowspec
4. Enable BGP Flowspec peers to exchange routing information. peer { group-name | ipv6-address [ mask-length ] | ipv6-address
[ prefix-length ] } enable
By default, BGP Flowspec peers cannot exchange routing information.
Enabling automatic route advertisement for an SRv6 TE policy
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE policy view. policy policy-name
5. Enable automatic route advertisement for the SRv6 TE policy. autoroute enable [ isis | ospfv3 ]
By default, automatic route advertisement is disabled for an SRv6 TE policy.
6. Configure an autoroute metric for the SRv6 TE policy. autoroute metric { absolute value | relative value }
By default, the autoroute metric of an SRv6 TE policy equals its IGP metric.
185
7. Return to system view. quit quit quit
8. Include the SRv6 TE policy in IGP computation:
Execute the following commands in sequence to enable automatic route advertisement for
IS-IS SRv6 TE policies. isis [ process-id ] [ vpn-instance vpn-instance-name ] address-family ipv6 [ unicast ] srv6-policy autoroute enable [ level-1 | level-2 ]
Execute the following commands in sequence to enable automatic route advertisement for
OSPFv3 SRv6 TE policies. ospfv3 [ process-id | vpn-instance vpn-instance-name ] * srv6-policy autoroute enable
By default, automatic route advertisement for SRv6 TE policies is disabled for IPv6 IS-IS and
OSPFv3.
Configuring the SRv6 TE policy encapsulation mode
About this task
If the traffic steering mode is BSID, packets whose destination IPv6 address is the same as the BSID of an SRv6 TE policy will be forwarded by the SRv6 TE policy. In this case, the device needs to encapsulate the SID list of the SRv6 TE policy for the packets. The following encapsulation modes are available:
•
Encaps —Normal encapsulation mode. It adds an IPv6 header and SRH to the original packets.
All SIDs in the SID list of the SRv6 TE policy are encapsulated in the SRH.
•
Encaps.Red
—Reduced encapsulation mode. It adds an IPv6 header and SRH to the original packets. The first SID in the SID list of the SRv6 TE policy is not encapsulated in the SRH to reduce the SRH length. All other SIDs in the SID list are encapsulated in the SRH.
In Encaps or Encaps.Red encapsulation mode, the destination IPv6 address in the IPv6 header is the first SID in the SID list of the SRv6 TE policy. The source IPv6 address is the IPv6 address specified by using the encapsulation source-address command.
If the traffic steering mode is BSID and the SRv6 SID of the ingress node is an End.X SID, the device does not encapsulate the End.X SID into the SRH by default.
To obtain complete SRv6 forwarding path information from the SRH of packets, you can configure the device to encapsulate the local End.X SID in the SRH.
Restrictions and guidelines
You can configure the encapsulation mode for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6 TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view.
186
segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Configure the Encaps.Red encapsulation mode globally for all SRv6 TE policies. srv6-policy encapsulation-mode encaps reduced
By default, an SRv6 TE policy uses the Encaps encapsulation mode.
5. Enable the device to include the local End.X SID in the SRH of the packets forwarded by SRv6
TE policies. srv6-policy encapsulation-mode encaps include local-end.x
By default, the device does not include the local End.X SID in the SRH of the packets forwarded by SRv6 TE policies.
6. Enter SRv6 TE policy view. policy policy-name
7. Configure the encapsulation mode for the SRv6 TE policy. encapsulation-mode encaps reduced [ disable ]
By default, the encapsulation mode is not configured for an SRv6 TE policy, and the encapsulation mode configured in SRv6 TE view applies.
8. Configure local End.X SID encapsulation in the SRH of the packets forwarded by the SRv6 TE policy. encapsulation-mode encaps include local-end.x [ disable ]
By default, local End.X SID encapsulation is not configured for an SRv6 TE policy, and the local
End.X SID encapsulation setting configured in SRv6 TE view applies.
Enabling SBFD for SRv6 TE policies
Restrictions and guidelines
You can enable SBFD for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6 TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
The remote discriminator specified in this command must be the same as that specified in the sbfd local-discriminator command on the reflector. Otherwise, the reflector will not send responses to the initiator.
The device supports the echo packet mode BFD and the SBFD for an SRv6 TE policy. If both modes are configured for the same SRv6 TE policy, the SBFD takes effect.
Procedure
1. Enter system view. system-view
2. Configure the source IPv6 address used by the initiator to send SBFD packets. sbfd source-ipv6 ipv6-address
By default, no source IPv6 address is configured for SBFD packets.
3. Enter SRv6 view. segment-routing ipv6
4. Enter SRv6 TE view. traffic-engineering
187
5. Enable SBFD for all SRv6 TE policies and configure the SBFD session parameters.
srv6-policy sbfd remote remote-id [ template template-name ]
[ backup-template backup-template-name ]
By default, SBFD is disabled for all SRv6 TE policies.
6. Enter SRv6 TE policy view. policy policy-name
7. Configure SBFD for the SRv6 TE policy. sbfd { disable | enable [ remote remote-id ] [ template template-name ]
[ backup-template backup-template-name ] [ oam-sid sid ] }
By default, SBFD is not configured for an SRv6 TE policy.
8. (Optional.) Enable BFD session down events to trigger the SRv6 TE policy to go down. bfd trigger path-down enable
By default, a BFD session down event cannot trigger SRv6 TE policy down.
In some cases, an SRv6 TE policy is still up to forward packets even if SBFD detects that the
SID list of the policy is unreachable, resulting in packet forwarding failure.
After this command is enabled, when SBFD detects that the SID list is unreachable, it places the SRv6 TE policy to the down state, so packets are not forwarded through the policy any longer.
Configuring the BFD echo packet mode for SRv6
TE policies
Restrictions and guidelines
You can configure the echo packet mode BFD for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6 TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
If you do not specify the source-ipv6 ipv6-address option in the bfd echo command for an
SRv6 TE policy, you must enable the echo packet mode BFD globally in SRv6 TE view. Otherwise, the device cannot establish a BFD session for the SRv6 TE policy.
The device supports the echo packet mode BFD and the SBFD for an SRv6 TE policy. If both modes are configured for the same SRv6 TE policy, the SBFD takes effect.
Before you execute this command, execute the bfd echo-source-ipv6 command on the local device to specify the source IPv6 address for echo packets.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enable echo packet mode BFD for all SRv6 TE policies and configure the BFD session parameters.
srv6-policy bfd echo source-ipv6 ipv6-address [ template
template-name ] [ backup-template backup-template-name ]
By default, the echo packet mode BFD is disabled for all SRv6 TE policies.
188
5. Enter SRv6 TE policy view. policy policy-name
6. Configure the echo packet mode BFD for the SRv6 TE policy. bfd echo { disable | enable [ source-ipv6 ipv6-address ] [ template
template-name ] [ backup-template backup-template-name ] [ oam-sid
sid ] }
By default, the echo packet mode BFD is not configured for an SRv6 TE policy. An SRv6 TE policy uses the echo BFD settings configured in SRv6 TE view.
7. (Optional.) Enable BFD session down events to trigger the SRv6 TE policy to go down. bfd trigger path-down enable
By default, a BFD session down event cannot trigger SRv6 TE policy down.
In some cases, an SRv6 TE policy is still up to forward packets even if BFD detects that the SID list of the policy is unreachable, resulting in packet forwarding failure.
After this command is enabled, when BFD detects that the SID list is unreachable, it places the
SRv6 TE policy to the down state, so packets are not forwarded through the policy any longer.
Enabling hot standby for SRv6 TE policies
Restrictions and guidelines
You can enable hot standby for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6
TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enable hot standby for all SRv6 TE policies. srv6-policy backup hot-standby enable
By default, hot standby is disabled for all SRv6 TE policies.
5. Enter SRv6 TE policy view. policy policy-name
6. Configure hot standby for the SRv6 TE policy. backup hot-standby { disable | enable }
By default, hot standby is not configured for an SRv6 TE policy, and the hot standby configuration in SRv6 TE view applies.
189
Configuring path switchover and deletion delays for SRv6 TE policies
About this task
The switchover delay and deletion delay mechanism is used to avoid traffic forwarding failure during a forwarding path (SID list) switchover.
When updating an SRv6 TE policy forwarding path, the device first establishes the new forwarding path before it deletes the old one. During the new path setup process, the device uses the old path to forward traffic until the switchover delay timer expires. When the switchover delay timer expires, the device switches traffic to the new path. The old path is deleted when the deletion delay timer expires.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Configure the switchover delay time and deletion delay time for the SRv6 TE policy forwarding path.
srv6-policy switch-delay switch-delay-time delete-delay
delete-delay-time
By default, the switchover delay time and deletion delay time for the SRv6 TE policy forwarding path is 5000 milliseconds and 20000 milliseconds, respectively.
Configuring SRv6 TE policy egress protection
Restrictions and guidelines for SRv6 TE policy egress protection configuration
To configure SRv6 TE policy egress protection, all nodes that the packets will traverse must support
SRv6.
Configuring an End.M SID
Restrictions and guidelines
Perform this task on protection node for the egress node.
For more information about the commands used in this task, see SRv6 commands in Segment
Routing Command Reference .
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Create a locator and enter SRv6 locator view.
190
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an End.M SID and specify the locator to be protected by the End.M SID.
opcode opcode end-m mirror-locator ipv6-address prefix-length
Enabling egress protection
About this task
This task enables the SRv6 node to compute a backup path (mirror FRR path) for the egress node based on the End.M SID carried in a received IS-ISv6 or OSPFv3 route. When the egress node fails, the transit node can forward traffic to the node that protects the egress node according to the End.M
SID.
In an egress protection scenario, the transit node deletes the mirror FRR path after completing route convergence. If the deletion occurs before the ingress node switches traffic back from the mirror
FRR path, the traffic will be dropped because of no mirror FRR path.
To resolve this issue, you can configure a proper mirror FRR deletion delay time on the transit node to delay the deletion of the mirror FRR route. So, packets can be forwarded over the mirror FRR path before the ingress finishes the path switchover.
Enabling IS-IS egress protection
1. Enter system view. system-view
2. Enter IS-IS view. isis [ process-id ] [ vpn-instance vpn-instance-name ]
3. Enter IS-IS IPv6 address family view. address-family ipv6 [ unicast ]
4. Enable IS-IS egress protection.
fast-reroute mirror enable
By default, IS-IS egress protection is disabled.
5. (Optional.) Configure the mirror FRR deletion delay time.
fast-reroute mirror delete-delay delete-delay-time
By default, the mirror FRR deletion delay time is 60 seconds.
Enabling OSPFv3 egress protection
1. Enter system view. system-view
2. Enter OSPFv3 view. ospfv3 [ process-id | vpn-instance vpn-instance-name ] *
3. Enable OSPFv3 egress protection.
fast-reroute mirror enable
By default, OSPFv3 egress protection is disabled.
4. (Optional.) Configure the mirror FRR deletion delay time.
fast-reroute mirror delete-delay delete-delay-time
By default, the mirror FRR deletion delay time is 60 seconds.
191
Configuring the deletion delay time for remote SRv6 SID mappings with VPN instances/cross-connects/VSIs
About this task
In an egress protection scenario, if the egress node and the egress node's protection node are disconnected, the protection node will delete the BGP routes received from the egress node. The remote SRv6 SID and VPN instance/cross-connect/VSI mappings will then be deleted as a result. To avoid this issue, you can configure the mappings deletion delay time on the protection node. This ensures that traffic is forwarded through the protection node before the ingress detects the egress failure and computes a new forwarding path.
Restrictions and guidelines
Perform this task on the protection node for the egress node.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Configure the deletion delay time for remote SRv6 SID mappings with VPN instances/cross-connects/VSIs.
mirror remote-sid delete-delay delete-delay-time
By default, the deletion delay time for remote SRv6 SID and VPN instance/cross-connect/VSI mappings is 60 seconds.
Configuring the TTL processing mode of SRv6 TE policies
About this task
An SRv6 TE policy used as a public tunnel supports the following TTL processing modes:
•
Uniform —When the ingress node adds a new IPv6 header to an IP packet, it copies the TTL value of the original IP packet to the TTL field of the new IPv6 header. Each node on the SRv6
TE policy forwarding path decreases the TTL value in the new IPv6 header by 1. The node that de-encapsulates the packet copies the remaining TTL value back to the original IP packet when it removes the new IPv6 header. The TTL value can reflect how many hops the packet has traversed in the public network. The tracert facility can show the real path along which the packet has traveled.
•
Pipe —When the ingress node adds a new IPv6 header to an IP packet, it does not copy the
TTL value of the original IP packet to the TTL field of the new IPv6 header. It sets the TTL value in the new IPv6 header to 255. Each node on the SRv6 TE policy forwarding path decreases the
TTL value in the new IPv6 header by 1. The node that de-encapsulates the packet does not change the IPv6 TTL value according to the remaining TTL value in the new IPv6 header.
Therefore, the public network nodes are invisible to user networks, and the tracert facility cannot show the real path in the public network.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view.
192
segment-routing ipv6
3. Configure the TTL processing mode of SRv6 TE policies. ttl-mode { pipe | uniform }
By default, the TTL processing mode of SRv6 TE policies is pipe.
Configuring SRv6 TE policy CBTS
Prerequisites
Before configuring CBTS, you must create QoS traffic behaviors to mark the MPLS TE service class values for packets. For more information, see QoS configuration in ACL and QoS Configuration
Guide .
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE policy view. policy policy-name
5. Set a service class value for the SRv6 TE policy.
service-class service-class-value
By default, no service class value is set for an SRv6 TE policy.
Enabling the device to drop traffic when an SRv6
TE policy becomes invalid
About this task
Enable this feature for an SRv6 TE policy if you want to use only the SRv6 TE policy to forward traffic.
By default, if all forwarding paths of an SRv6 TE policy become invalid, the device forwards the packets through IPv6 routing table lookup based on the packet destination IPv6 addresses.
After you execute the drop-upon-invalid enable command, the device drops the packets if all forwarding paths of the SRv6 TE policy become invalid.
Restrictions and guidelines
The drop-upon-invalid enable command does not take effect in the following cases:
•
BSID request failed or BSID conflicted for the SRv6 TE policy. To view the BSID request state, see the Request state field in the display segment-routing ipv6 te policy command output.
•
The SRv6 TE policy is invalid. To check the SRv6 TE policy validity, see the Forwarding index field in the display segment-routing ipv6 te policy command output. If the value is 0, the SRv6 TE policy is invalid.
193
The drop-upon-invalid command configured on the remote device does not affect an SRv6 TE policy generated based on a BGP IPv6 SR-TE policy route. The SRv6 TE policy is controlled by only the drop-upon-invalid command configured on the local device.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enter SRv6 TE policy view. policy policy-name
5. Configure the device to drop traffic when an SRv6 TE policy becomes invalid. drop-upon-invalid enable
By default, the drop-upon-invalid feature is disabled for an SRv6-TE policy. The device does not drop traffic when the SRv6-TE policy becomes invalid.
Specifying the packet encapsulation type preferred in optimal route selection
About this task
As shown in Figure 60 , PE 4 is the RR, and it establishes an IBGP connection with PE 1, PE 2, and
PE 3, respectively. PE 1 and PE 3 support SRv6. PE 2 does not support SRv6. Both an MPLS
L3VPN connection and an EVPN L3VPN over SRv6 connection exist between PE 1 and PE 3.
In this case, you can perform this task to specify the preferred encapsulation type (SRv6 encapsulation or MPLS encapsulation) for BGP optimal route selection in the L3VPN. Then, BGP prefers the routes with the specified encapsulation type when routes have the same Preferred-value and LOCAL_PREF attributes. The subsequent route selection steps are the same as those in the original BGP route select procedure. For more information about BGP route selection, see BGP overview in Layer 3—IP Routing Configuration Guide .
194
Figure 60 MPLS L3VPN and EVPN L3VPN over SRv6 coexist
IP network
IP network
PE 1
MPLS L
3VPN
RR
EVPN+VPNv4
PE 4
EVPN L
VPNv
4
EVPN
+VPNv
4
PE 2
MPLS L3VPN
PE 3
3VPN
6
IP network
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Specify the packet encapsulation type preferred in optimal route selection. bestroute encap-type { mpls | srv6 }
By default, BGP does not select optimal routes according to the packet encapsulation type.
Configuring SRv6 TE policy resource usage alarm thresholds
About this task
After you configure this feature, when the number of SRv6 TE policy resources exceeds the upper threshold or drops below the lower threshold, the device generates log and alarm information. The administrator can then obtain the resource usage status of SRv6 TE policies.
SRv6 TE policy resources include the following:
•
Number of valid forwarding paths for all SRv6 TE policies.
•
Number of entries of the SRv6Policy type in the SRv6 forwarding table.
•
Number of entries of the SRv6PGROUP type in the SRv6 forwarding table.
•
Number of entries of the SRv6PSIDList type in the SRv6 forwarding table.
To view SRv6 forwarding table information, use the display segment-routing ipv6 forwarding command.
195
Restrictions and guidelines
To view resource usage for the current SRv6 TE policy, use the display segment-routing ipv6 te policy statistics command.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Configure the alarm thresholds for resource usage of SRv6 TE policies. srv6-policy { forwarding-path | policy | policy-group | segment-list } alarm-threshold upper-limit upper-limit-value lower-limit
lower-limit-value
By default, the upper and lower alarm thresholds are 80% and 75% for all resources of SRv6 TE policies.
Enabling SRv6 TE policy logging
About this task
This feature enables the device to generate logs for SRv6 TE policy state changes and resource usage anomalies. The administrator can use the logging information to audit SRv6 TE policies. The device delivers logs to its information center. The information center processes the logs according to user-defined output rules (whether to output logs and where to output). For more information about the information center, see the network management and monitoring configuration guide for the device.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enable SRv6 TE policy logging. srv6-policy log enable
By default, SRv6 TE policy logging is disabled.
Enabling SNMP notifications for SRv6 TE policies
About this task
This feature enables the device to send SNMP notifications about state changes and resource usage anomalies of SRv6 TE policies. For SNMP notifications to be sent correctly, you must also configure
SNMP on the device. For more information about SNMP configuration, see the network management and monitoring configuration guide for the device.
196
Procedure
1. Enter system view. system-view
2. Enable SNMP notifications for SRv6 TE policies. snmp-agent trap enable srv6-policy
By default, SNMP notifications for SRv6 TE policies are disabled.
Configuring traffic forwarding statistics for SRv6
TE policies
About this task
This feature collects statistics on the traffic forwarded by SRv6 TE policies.
Restrictions and guidelines
You can configure traffic forwarding statistics for all SRv6 TE policies globally in SRv6 TE view or for a specific SRv6 TE policy in SRv6 TE policy view. The policy-specific configuration takes precedence over the global configuration. An SRv6 TE policy uses the global configuration only when it has no policy-specific configuration.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 TE view. traffic-engineering
4. Enable traffic forwarding statistics for all SRv6 TE policies. srv6-policy forwarding statistics [ service-class ] enable
By default, traffic forwarding statistics is disabled for all SRv6 TE policies.
If you specify the service-class keyword, the device collects statistics on the total traffic as well as the traffic of each service class that are forwarded by SRv6 TE policies.
5. (Optional.) Set the traffic forwarding statistics interval for all SRv6 TE policies.
srv6-policy forwarding statistics interval interval
By default, the SRv6 TE policy forwarding statistics interval is 30 seconds.
6. Enter SRv6 TE policy view. policy policy-name
7. Configure traffic forwarding statistics for the SRv6 TE policy. forwarding statistics { disable | [ service-class ] enable }
By default, an SRv6 TE policy uses the traffic forwarding statistics configuration in SRv6 TE view.
If you specify the service-class keyword, the device collects statistics on the total traffic as well as the traffic of each service class that are forwarded by the SRv6 TE policy.
197
Verifying and maintaining SRv6 TE policies
Verifying the SRv6 TE policy operation status and configuration
Perform display tasks in any view:
•
Display SRv6 TE policy information. display segment-routing ipv6 te policy [ name policy-name | down | up | { color color-value | end-point ipv6 ip-address } * ]
•
Display status information about SRv6 TE policies. display segment-routing ipv6 te policy status [ policy-name
policy-name ]
•
Display SRv6 TE policy statistics. display segment-routing ipv6 te policy statistics
•
Display information about the most recent down event for SRv6 TE policies. display segment-routing ipv6 te policy last-down-reason [ binding-sid
bsid | color color-value endpoint ipv6 ipv6-address | policy-name
policy-name ]
•
Display SRv6-TE SID list information. display segment-routing ipv6 te segment-list [ name seglist-name | id id-value ]
•
Display SRv6 TE policy database information. display segment-routing ipv6 te database [ link | node | prefix | srv6-sid ]
•
Display information about SRv6 SIDs collected from the LS database. display segment-routing ipv6 te source-sid [ end | end-x | sid ]
Verifying the SRv6 TE policy group operation status and configuration
To display SRv6 TE policy group information, execute the following command in any view: display segment-routing ipv6 te policy-group [ group-id ] [ verbose ]
Verifying the BGP IPv6 SR policy routing configuration
Perform display tasks in any view:
•
Display BGP IPv6 SR policy routing information. display bgp [ instance instance-name ] routing-table ipv6 sr-policy
[ sr-policy-prefix [ advertise-info ] | peer ipv6-address
{ advertised-routes | received-routes } [ statistics ] | statistics ]
•
Display BGP peer or peer group information. display bgp [ instance instance-name ] peer ipv6 [ sr-policy ]
[ ipv6-address prefix-length | { ipv6-address | group-name group-name } log-info | [ ipv6-address ] verbose ]
•
Display BGP IPv6 SR policy peer group information.
198
display bgp [ instance instance-name ] group ipv6 sr-policy
[ group-name group-name ]
•
Display BGP update group information for the IPv6 SR policy address family. display bgp [ instance instance-name ] update-group ipv6 sr-policy
[ ipv6-address ]
Verifying the SRv6 TE policy BFD and SBFD operation status
Perform display tasks in any view:
•
Display BFD information for SRv6 TE policies. display segment-routing ipv6 te bfd [ down | policy { { color color-value | end-point ipv6 ipv6-address } * | name policy-name }
| up ]
•
Display SBFD information for SRv6 TE policies. display segment-routing ipv6 te sbfd [ down | policy { { color color-value | end-point ipv6 ipv6-address } * | name policy-name }
| up ]
Verifying the SRv6 TE policy egress protection configuration
Perform display tasks in any view:
•
Display remote SRv6 SIDs protected by mirror SIDs. display bgp [ instance instance-name ] mirror remote-sid [ end-dt4
| end-dt46 | end-dt6 ] [ sid ]
•
Display remote SRv6 SIDs protected by mirror SIDs on EVPN VPWS over SRv6 networks. display evpn srv6 mirror remote-sid [ sid | type { end-dt2u | end-dx2 } ]
Displaying and clearing SRv6 TE policy forwarding statistics
To display SRv6 TE forwarding information, execute the following command in any view: display segment-routing ipv6 te forwarding [ policy { name policy-name
| { color color-value | end-point ipv6 ipv6-address } * } ] [ verbose ]
To clear traffic forwarding statistics of SRv6 TE policies, execute the following command in user view: reset segment-routing ipv6 te forwarding statistics
SRv6 TE policy configuration examples
Example: Configuring SRv6 TE policy-based forwarding
Network configuration
As shown in Figure 61 , perform the following tasks on the devices to implement SRv6 TE
policy-based forwarding over a specific path:
•
Configure Device A through Device D to run IS-IS to implement Layer 3 connectivity.
•
Configure basic SRv6 on Device A through Device D.
199
•
Configure an SRv6 TE policy on Device A to forward user packets along path Device A > Device
B > Device C > Device D.
Figure 61 Network diagram
Loop1 Loop1
IP network
Device A
GE0/0/1
GE0/0/2 GE0/0/2
Device D
GE0/0/1
Forwarding Path
GE0/0/1
Device B
GE0/0/1
Device C
GE0/0/2
Loop1 Loop1
Device
Device A
Device C
Interface
Loop1
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
IP address
1::1/128
1000::1/64
4000::1/64
3::3/128
3000::3/64
2000::3/64
Device
Device B
Device D
Interface
Loop1
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
IP address
2::2/128
1000::2/64
2000::2/64
4::4/128
3000::4/64
4000::4/64
Procedure
1. Configure IP addresses and masks for interfaces. (Details not shown.)
2. Configure Device A:
# Configure an SRv6 SID list.
[DeviceA] segment-routing ipv6
[DeviceA-segment-routing-ipv6] locator a ipv6-prefix 5000:: 64 static 32
[DeviceA-segment-routing-ipv6-locator-a] opcode 1 end
[DeviceA-segment-routing-ipv6-locator-a] quit
[DeviceA-segment-routing-ipv6] traffic-engineering
[DeviceA-srv6-te] srv6-policy locator a
[DeviceA-srv6-te] segment-list s1
[DeviceA-srv6-te-sl-s1] index 10 ipv6 6000::1
[DeviceA-srv6-te-sl-s1] index 20 ipv6 7000::1
[DeviceA-srv6-te-sl-s1] index 30 ipv6 8000::1
[DeviceA-srv6-te-sl-s1] quit
# Create an SRv6 TE policy and set the attributes.
[DeviceA-srv6-te] policy p1
[DeviceA-srv6-te-policy-p1] binding-sid ipv6 5000::2
[DeviceA-srv6-te-policy-p1] color 10 end-point ipv6 4::4
[DeviceA-srv6-te-policy-p1] candidate-paths
200
GE0/0/2
[DeviceA-srv6-te-policy-p1-path] preference 10
[DeviceA-srv6-te-policy-p1-path-pref-10] explicit segment-list s1
[DeviceA-srv6-te-policy-p1-path-pref-10] quit
[DeviceA-srv6-te-policy-p1-path] quit
[DeviceA-srv6-te-policy-p1] quit
[DeviceA-srv6-te] quit
[DeviceA-segment-routing-ipv6] quit
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceA> system-view
[DeviceA] isis 1
[DeviceA-isis-1] network-entity 00.0000.0000.0001.00
[DeviceA-isis-1] cost-style wide
[DeviceA-isis-1] address-family ipv6 unicast
[DeviceA-isis-1-ipv6] segment-routing ipv6 locator a
[DeviceA-isis-1-ipv6] quit
[DeviceA-isis-1] quit
[DeviceA] interface gigabitethernet 0/0/1
[DeviceA-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceA-GigabitEthernet0/0/1] quit
[DeviceA] interface gigabitethernet 0/0/2
[DeviceA-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceA-GigabitEthernet0/0/2] quit
[DeviceA] interface loopback 1
[DeviceA-LoopBack1] isis ipv6 enable 1
[DeviceA-LoopBack1] quit
3. Configure Device B:
# Configure the SRv6 End.SID.
[DeviceB] segment-routing ipv6
[DeviceB-segment-routing-ipv6] locator b ipv6-prefix 6000:: 64 static 32
[DeviceB-segment-routing-ipv6-locator-b] opcode 1 end
[DeviceB-segment-routing-ipv6-locator-b] quit
[DeviceB-segment-routing-ipv6] quit
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceB> system-view
[DeviceB] isis 1
[DeviceB-isis-1] network-entity 00.0000.0000.0002.00
[DeviceB-isis-1] cost-style wide
[DeviceB-isis-1] address-family ipv6 unicast
[DeviceB-isis-1-ipv6] segment-routing ipv6 locator b
[DeviceB-isis-1-ipv6] quit
[DeviceB-isis-1] quit
[DeviceB] interface gigabitethernet 0/0/1
[DeviceB-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/1] quit
[DeviceB] interface gigabitethernet 0/0/2
[DeviceB-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/2] quit
[DeviceB] interface loopback 1
201
[DeviceB-LoopBack1] isis ipv6 enable 1
[DeviceB-LoopBack1] quit
4. Configure Device C:
# Configure the SRv6 End.SID.
[DeviceC] segment-routing ipv6
[DeviceC-segment-routing-ipv6] locator c ipv6-prefix 7000:: 64 static 32
[DeviceC-segment-routing-ipv6-locator-c] opcode 1 end
[DeviceC-segment-routing-ipv6-locator-c] quit
[DeviceC-segment-routing-ipv6] quit
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceC> system-view
[DeviceC] isis 1
[DeviceC-isis-1] network-entity 00.0000.0000.0003.00
[DeviceC-isis-1] cost-style wide
[DeviceC-isis-1] address-family ipv6 unicast
[DeviceC-isis-1-ipv6] segment-routing ipv6 locator c
[DeviceC-isis-1-ipv6] quit
[DeviceC-isis-1] quit
[DeviceC] interface gigabitethernet 0/0/1
[DeviceC-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/1] quit
[DeviceC] interface gigabitethernet 0/0/2
[DeviceC-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/2] quit
[DeviceC] interface loopback 1
[DeviceC-LoopBack1] isis ipv6 enable 1
[DeviceC-LoopBack1] quit
5. Configure Device D:
# Configure the SRv6 End.SID.
[DeviceD] segment-routing ipv6
[DeviceD-segment-routing-ipv6] locator d ipv6-prefix 8000:: 64 static 32
[DeviceD-segment-routing-ipv6-locator-d] opcode 1 end
[DeviceD-segment-routing-ipv6-locator-d] quit
[DeviceD-segment-routing-ipv6] quit
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceD> system-view
[DeviceD] isis 1
[DeviceD-isis-1] network-entity 00.0000.0000.0004.00
[DeviceD-isis-1] cost-style wide
[DeviceD-isis-1] address-family ipv6 unicast
[DeviceD-isis-1-ipv6] segment-routing ipv6 locator d
[DeviceD-isis-1-ipv6] quit
[DeviceD-isis-1] quit
[DeviceD] interface gigabitethernet 0/0/1
[DeviceD-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceD-GigabitEthernet0/0/1] quit
[DeviceD] interface gigabitethernet 0/0/2
[DeviceD-GigabitEthernet0/0/2] isis ipv6 enable 1
202
[DeviceD-GigabitEthernet0/0/2] quit
[DeviceD] interface loopback 1
[DeviceD-LoopBack1] isis ipv6 enable 1
[DeviceD-LoopBack1] quit
Verifying the configuration
# Display SRv6 TE policy information on Device A.
[DeviceA] display segment-routing ipv6 te policy
Name/ID: p1/0
Color: 10
Endpoint: 4::4
Name from BGP:
BSID:
Mode: Explicit Type: Type_2 Request state: Succeeded
Current BSID: 5000::2 Explicit BSID: 5000::1 Dynamic BSID: -
Reference counts: 4
Flags: A/BS/NC
Status: Up
AdminStatus: Not configured
Up time: 2020-04-02 16:08:03
Down time: 2020-04-02 16:03:48
Hot backup: Not configured
Statistics: Not configured
Statistics by service class: Enabled
Drop-upon-invalid: Enabled
BFD trigger path-down: Enabled
SBFD: Not configured
BFD Echo: Not configured
Forwarding index: 2150629377
Association ID: 1
Service-class: -
Rate-limit: 15000 kbps
PCE delegation: Not configured
PCE delegate report-only: Enabled
Encaps reduced: Not configured
Encaps include local End.X: Not configured
Candidate paths state: Configured
Candidate paths statistics:
CLI paths: 1 BGP paths: 0 PCEP paths: 0
Candidate paths:
Preference : 10
CPathName:
ProtoOrigin: CLI Discriminator: 30
Instance ID: 0 Node address: 0.0.0.0
Originator: 0, ::
Optimal: Y Flags: V/A
Dynamic: Not configured
PCEP: Not configured
203
Explicit SID list:
ID: 1 Name: s1
Weight: 1 Forwarding index: 2149580801
State: Up State(-): -
Active path MTU: 1280 bytes
The output shows that the SRv6 TE policy is in up state. The device can use the SRv6 TE policy to forward packets.
# Display SRv6 TE forwarding information on Device A.
[DeviceA] display segment-routing ipv6 te forwarding verbose
Total forwarding entries: 1
Policy name/ID: p1/0
Binding SID: 5000::2
Policy forwording index: 2150629377
Main path:
Seglist Name/ID: 1
Seglist forwording index: 2149580801
Weight: 1
Outgoing forwording index: 2148532225
Interface: GE1/0/1
Nexthop: FE80::54CB:70FF:FE86:316
Path ID: 0
SID list: {6000::1, 7000::1, 8000::1}
# Display SRv6 forwarding information on Device A.
[DeviceA] display segment-routing ipv6 forwarding
Total SRv6 forwarding entries: 3
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
A - Active forwarding information
B - Backup forwarding information
ID FWD-Type Flags Forwarding info
--------------------------------------------------------------------------------
2148532225 SRv6PSIDList NA GE0/0/1
FE80::54CB:70FF:FE86:316
{6000::1, 7000::1, 8000::1}
2149580801 SRv6PCPath TA 2148532225
2150629377 SRv6Policy TA 2149580801
Example: Configuring SRv6 TE policy egress protection
Network configuration
As shown in Figure 62 , deploy an SRv6 TE policy in both directions between PE 1 and PE 2 to carry
the L3VPN service. PE 2 is the egress node of the SRv6 TE policy. To improve the forwarding reliability, configure PE 3 to protect PE 2.
204
Figure 62 Network diagram
IPv6 backbone
CE 1
GE0/0/1
GE0/0/1
Loop0
PE 1
SRv6 TE Policy
Loop0
GE
0/
0/
2
GE0/0/2
GE0/0/1
P
GE
0/0
/3
PE 2
GE
0/
0/
2
GE
0/0
/2
PE 3
Loop0
GE
GE0/0/3
0/0/1
GE0/0/3
GE
0/0
/1
GE
0/0/1
GE
0/0
/2
CE 2
Loop0
Table 17 Interface and IP address
Device
CE 1
PE 1
P
Interface IP address
GE0/0/1 10.1.1.2/24
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
GE0/0/3
1::1/128
10.1.1.1/24
2001::1/96
2::2/128
2001::2/96
2002::2/64
2003::2/96
Prerequisites
Configure interface addresses as shown in Table 17 .
Device
PE 2
PE 3
CE 2
Interface IP address
Loop0 3::3/128
GE0/0/1
GE0/0/2
GE0/0/3
Loop0
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/1
GE0/0/2
10.2.1.1/24
2002::1/64
2004::2/96
4::4/128
10.3.1.1/24
2003::1/96
2004::1/96
10.2.1.2/24
10.3.1.2/24
Procedure
1. Configure CE 1:
# Establish an EBGP peer relationship with PE 1 and redistribute the VPN routes.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 10.1.1.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 10.1.1.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
2. Configure PE 1:
# Configure IPv6 IS-IS for backbone network connectivity.
<PE1> system-view
[PE1] isis 1
205
[PE1-isis-1] is-level level-1
[PE1-isis-1] cost-style wide
[PE1-isis-1] network-entity 10.1111.1111.1111.00
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] ipv6 address 1::1 128
[PE1-LoopBack0] isis ipv6 enable 1
[PE1-LoopBack0] quit
[PE1] interface gigabitethernet 0/0/2
[PE1-GigabitEthernet0/0/2] ipv6 address 2001::1 96
[PE1-GigabitEthernet0/0/2] isis ipv6 enable 1
[PE1-GigabitEthernet0/0/2] quit
# Configure a VPN instance and bind it to the CE-facing interface.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 100:1
[PE1-vpn-instance-vpn1] vpn-target 111:1
[PE1-vpn-instance-vpn1] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 10.1.1.1 24
[PE1-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with the connected CE to redistribute the VPN routes.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] peer 10.1.1.2 as-number 65410
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] peer 10.1.1.2 enable
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
# Establish MP-IBGP peer relationships with the peer PEs.
[PE1] bgp 100
[PE1-bgp-default] peer 3::3 as-number 100
[PE1-bgp-default] peer 4::4 as-number 100
[PE1-bgp-default] peer 3::3 connect-interface loopback 0
[PE1-bgp-default] peer 4::4 connect-interface loopback 0
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 enable
[PE1-bgp-default-vpnv4] peer 4::4 enable
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] quit
# Configure L3VPN over SRv6 TE policy.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 11::11
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:2::1:0 120 static 8
[PE1-segment-routing-ipv6-locator-aaa] opcode 1 end-dt4 vpn-instance vpn1
206
[PE1-segment-routing-ipv6-locator-aaa] quit
[PE1-segment-routing-ipv6] quit
[PE1] bgp 100
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 prefix-sid
[PE1-bgp-default-vpnv4] peer 4::4 prefix-sid
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
[PE1] isis 1
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] segment-routing ipv6 locator aaa
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
# Configure an SRv6 TE policy.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] traffic-engineering
[PE1-srv6-te] srv6-policy locator aaa
[PE1-srv6-te] segment-list s1
[PE1-srv6-te-s1-s1] index 10 ipv6 100:abc:1::1
[PE1-srv6-te-s1-s1] index 20 ipv6 6:5::1:2
[PE1-srv6-te-s1-s1] quit
[PE1-srv6-te] policy p1
[PE1-srv6-te-policy-p1] binding-sid ipv6 1:2::1:2
[PE1-srv6-te-policy-p1] color 10 end-point ipv6 3::3
[PE1-srv6-te-policy-p1] candidate-paths
[PE1-srv6-te-policy-p1-path] preference 10
[PE1-srv6-te-policy-p1-path-pref-10] explicit segment-list s1
[PE1-srv6-te-policy-p1-path-pref-10] quit
[PE1-srv6-te-policy-p1-path] quit
[PE1-srv6-te-policy-p1] quit
[PE1-srv6-te] quit
[PE1-segment-routing-ipv6] quit
3. Configure the P device:
# Configure IPv6 IS-IS for backbone network connectivity.
<P> system-view
[P] isis 1
[P-isis-1] is-level level-1
[P-isis-1] cost-style wide
[P-isis-1] network-entity 10.2222.2222.2222.00
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] quit
[P-isis-1] quit
207
[P] interface loopback 0
[P-LoopBack0] ipv6 address 2::2 128
[P-LoopBack0] isis ipv6 enable 1
[P-LoopBack0] quit
[P] interface gigabitethernet 0/0/1
[P-GigabitEthernet0/0/1] ipv6 address 2001::2 96
[P-GigabitEthernet0/0/1] isis ipv6 enable 1
[P-GigabitEthernet0/0/1] quit
[P] interface gigabitethernet 0/0/2
[P-GigabitEthernet0/0/2] ipv6 address 2002::2 96
[P-GigabitEthernet0/0/2] isis ipv6 enable 1
[P-GigabitEthernet0/0/2] quit
[P] interface gigabitethernet 0/0/3
[P-GigabitEthernet0/0/3] ipv6 address 2003::2 96
[P-GigabitEthernet0/0/3] isis ipv6 enable 1
[P-GigabitEthernet0/0/3] quit
# Configure SRv6.
[P] segment-routing ipv6
[P-segment-routing-ipv6] locator p ipv6-prefix 100:abc:1::0 120 static 8
[P-segment-routing-ipv6-locator-p] opcode 1 end
[P-segment-routing-ipv6-locator-p] quit
[P-segment-routing-ipv6] quit
[P] isis 1
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] segment-routing ipv6 locator p
# Configure the FRR backup nexthop information and enable egress protection.
[P-isis-1-ipv6] fast-reroute lfa level-1
[P-isis-1-ipv6] fast-reroute ti-lfa
[P-isis-1-ipv6] fast-reroute mirror enable
[P-isis-1-ipv6] quit
[P-isis-1] quit
4. Configure PE 2:
# Configure IPv6 IS-IS for backbone network connectivity.
<PE2> system-view
[PE2] isis 1
[PE2-isis-1] is-level level-1
[PE2-isis-1] cost-style wide
[PE2-isis-1] network-entity 10.3333.3333.3333.00
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] ipv6 address 3::3 128
[PE2-LoopBack0] isis ipv6 enable 1
[PE2-LoopBack0] quit
[PE2] interface gigabitethernet 0/0/2
[PE2-GigabitEthernet0/0/2] ipv6 address 2002::1 96
[PE2-GigabitEthernet0/0/2] isis ipv6 enable 1
208
[PE2-GigabitEthernet0/0/2] quit
[PE2] interface gigabitethernet 0/0/3
[PE2-GigabitEthernet0/0/3] ipv6 address 2004::2 96
[PE2-GigabitEthernet0/0/3] isis ipv6 enable 1
[PE2-GigabitEthernet0/0/3] quit
# Configure a VPN instance and bind it to the CE-facing interface.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 100:1
[PE2-vpn-instance-vpn1] vpn-target 111:1
[PE2-vpn-instance-vpn1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 10.2.1.1 24
[PE2-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with the connected CE to redistribute the VPN routes.
[PE2] bgp 100
[PE2-bgp-default] router-id 2.2.2.2
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] peer 10.2.1.2 as-number 65420
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] peer 10.2.1.2 enable
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
# Establish MP-IBGP peer relationships with the peer PEs.
[PE2] bgp 100
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 4::4 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
[PE2-bgp-default] peer 4::4 connect-interface loopback 0
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 enable
[PE2-bgp-default-vpnv4] peer 4::4 enable
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] quit
# Configure L3VPN over SRv6 TE policy.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 33::33
[PE2-segment-routing-ipv6] locator bbb ipv6-prefix 6:5::1:0 120 static 8
[PE2-segment-routing-ipv6-locator-bbb] opcode 1 end-dt4 vpn-instance vpn1
[PE2-segment-routing-ipv6-locator-bbb] quit
[PE2-segment-routing-ipv6] quit
[PE2] bgp 100
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 prefix-sid
[PE2-bgp-default-vpnv4] peer 4::4 prefix-sid
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
209
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 locator bbb
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
[PE2] isis 1
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] segment-routing ipv6 locator bbb
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
5. Configure PE 3:
# Configure IPv6 IS-IS for backbone network connectivity.
<PE3> system-view
[PE3] isis 1
[PE3-isis-1] is-level level-1
[PE3-isis-1] cost-style wide
[PE3-isis-1] network-entity 10.4444.4444.4444.00
[PE3-isis-1] address-family ipv6 unicast
[PE3-isis-1-ipv6] quit
[PE3-isis-1] quit
[PE3] interface loopback 0
[PE3-LoopBack0] ipv6 address 4::4 128
[PE3-LoopBack0] isis ipv6 enable 1
[PE3-LoopBack0] quit
[PE3] interface gigabitethernet 0/0/2
[PE3-GigabitEthernet0/0/2] ipv6 address 2003::1 96
[PE3-GigabitEthernet0/0/2] isis ipv6 enable 1
[PE3-GigabitEthernet0/0/2] quit
[PE3] interface gigabitethernet 0/0/3
[PE3-GigabitEthernet0/0/3] ipv6 address 2004::1 96
[PE3-GigabitEthernet0/0/3] isis ipv6 enable 1
[PE3-GigabitEthernet0/0/3] quit
# Configure a VPN instance and bind it to the CE-facing interface.
[PE3] ip vpn-instance vpn1
[PE3-vpn-instance-vpn1] route-distinguisher 100:1
[PE3-vpn-instance-vpn1] vpn-target 111:1
[PE3-vpn-instance-vpn1] quit
[PE3] interface gigabitethernet 0/0/1
[PE3-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE3-GigabitEthernet0/0/1] ip address 10.3.1.1 24
[PE3-GigabitEthernet0/0/1] quit
# Establish an EBGP peer relationship with the connected CE to redistribute the VPN routes.
[PE3] bgp 100
[PE3-bgp-default] router-id 3.3.3.3
[PE3-bgp-default] ip vpn-instance vpn1
[PE3-bgp-default-vpn1] peer 10.3.1.2 as-number 65420
[PE3-bgp-default-vpn1] address-family ipv4 unicast
[PE3-bgp-default-ipv4-vpn1] peer 10.3.1.2 enable
210
[PE3-bgp-default-ipv4-vpn1] quit
[PE3-bgp-default-vpn1] quit
# Establish MP-IBGP peer relationships with the peer PEs.
[PE3] bgp 100
[PE3-bgp-default] peer 1::1 as-number 100
[PE3-bgp-default] peer 3::3 as-number 100
[PE3-bgp-default] peer 1::1 connect-interface loopback 0
[PE3-bgp-default] peer 3::3 connect-interface loopback 0
[PE3-bgp-default] address-family vpnv4
[PE3-bgp-default-vpnv4] peer 1::1 enable
[PE3-bgp-default-vpnv4] peer 3::3 enable
[PE3-bgp-default-vpnv4] quit
[PE3-bgp-default] quit
# Configure the source address in the outer IPv6 header of SRv6 VPN packets.
[PE3] segment-routing ipv6
[PE3-segment-routing-ipv6] encapsulation source-address 44::44
# Configure an End.M SID to protect PE 2.
[PE3-segment-routing-ipv6] locator ccc ipv6-prefix 9:7::1:0 120 static 8
[PE3-segment-routing-ipv6-locator-ccc] opcode 1 end-m mirror-locator 6:5::1:0 120
[PE3-segment-routing-ipv6-locator-ccc] quit
[PE3-segment-routing-ipv6] quit
# Recurse the VPN routes to the End.M SID route.
[PE3] bgp 100
[PE3-bgp-default] address-family vpnv4
[PE3-bgp-default-vpnv4] peer 1::1 prefix-sid
[PE3-bgp-default-vpnv4] peer 3::3 prefix-sid
[PE3-bgp-default-vpnv4] quit
[PE3-bgp-default] ip vpn-instance vpn1
[PE3-bgp-default-vpn1] address-family ipv4 unicast
[PE3-bgp-default-ipv4-vpn1] segment-routing ipv6 locator ccc
[PE3-bgp-default-ipv4-vpn1] quit
[PE3-bgp-default-vpn1] quit
[PE3-bgp-default] quit
[PE3] isis 1
[PE3-isis-1] address-family ipv6 unicast
[PE3-isis-1-ipv6] segment-routing ipv6 locator ccc
[PE3-isis-1-ipv6] quit
[PE3-isis-1] quit
6. Configure CE 2:
# Establish an EBGP peer relationship with PEs and redistribute the VPN routes.
<CE2> system-view
[CE2] bgp 65420
[CE2-bgp-default] peer 10.2.1.1 as-number 100
[CE2-bgp-default] peer 10.3.1.1 as-number 100
[CE2-bgp-default] address-family ipv4 unicast
[CE2-bgp-default-ipv4] peer 10.2.1.1 enable
[CE2-bgp-default-ipv4] peer 10.3.1.1 enable
[CE2-bgp-default-ipv4] import-route direct
211
[CE2-bgp-default-ipv4] quit
[CE2-bgp-default] quit
Verifying the configuration
# Display the SRv6 TE policy configuration. The output shows that the SRv6 TE policy is up for traffic forwarding.
[PE1] display segment-routing ipv6 te policy
Name/ID: p1/0
Color: 10
End-point: 3::3
Name from BGP:
BSID:
Mode: Explicit Type: Type_2 Request state: Succeeded
Current BSID: 1:2::1:2 Explicit BSID: 1:2::1:2 Dynamic BSID: -
Reference counts: 4
Flags: A/BS/NC
Status: Up
AdminStatus: Not configured
Up time: 2020-10-28 09:10:33
Down time: 2020-10-28 09:09:32
Hot backup: Disabled
Statistics: Disabled
Statistics by service class: Disabled
Drop-upon-invalid: Disabled
BFD trigger path-down: Disabled
SBFD: Disabled
BFD Echo: Disabled
Forwarding index: 2150629377
Association ID: 1
Service-class: -
Rate-limit: -
PCE delegation: Not configured
PCE delegate report-only: Not configured
Encaps reduced: Not configured
Encaps include local End.X: Not configured
Candidate paths state: Configured
Candidate paths statistics:
CLI paths: 1 BGP paths: 0 PCEP paths: 0 ODN paths: 0
Candidate paths:
Preference : 10
CPathName:
ProtoOrigin: CLI Discriminator: 30
Instance ID: 0 Node address: 0.0.0.0
Originator: 0, ::
Optimal: Y Flags: V/A
Dynamic: Not configured
PCEP: Not configured
Explicit SID list:
212
ID: 1 Name: s1
Weight: 1 Forwarding index: 2149580801
State: Up State(-): -
Active path MTU: 1280 bytes
# Display SRv6 TE policy forwarding information on PE 1.
[PE1] display segment-routing ipv6 te forwarding verbose
Total forwarding entries: 1
Policy name/ID: p1/0
Binding SID: 1:2::1:2
Forwarding index: 2150629377
Main path:
Seglist Name/ID: 1
Seglist forwarding index: 2149580801
Weight: 1
Outgoing forwarding index: 2148532225
Interface: GE0/0/2
Nexthop: FE80::988A:B5FF:FED9:316
Path ID: 0
SID list: {100:ABC:1::1, 6:5::1:1}
# Display SRv6 TE policy forwarding path information on PE 1.
[PE1] display segment-routing ipv6 forwarding
Total SRv6 forwarding entries: 3
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
A - Active forwarding information
B - Backup forwarding information
ID FWD-Type Flags Forwarding info
Attri-Val Attri-Val
--------------------------------------------------------------------------------
2148532225 SRv6PSIDList NA GE0/0/2
FE80::988A:B5FF:FED9:316
{100:ABC:1::1, 6:5::1:1}
2149580801 SRv6PCPath TA 2148532225
2150629377 SRv6Policy TA 2149580801
p1
# Display remote SRv6 SIDs protected by End.M SIDs on PE 3.
[PE3] display bgp mirror remote-sid
Remote SID: 6:5::1:1
Remote SID type: End.DT4
Mirror locator: 6:5::1:0/120
Vpn instance name: vpn1
# Display the End.M SID carried in the IS-IS IPv6 route on the P device.
[P] display isis route ipv6 6:5::1:0 120 verbose
213
Route information for IS-IS(1)
------------------------------
Level-1 IPv6 forwarding table
-----------------------------
IPv6 dest : 6:5::1:0/120
Flag : R/-/- Cost : 10
Admin tag : - Src count : 3
Nexthop : FE80::988A:BDFF:FEB6:417
Interface : GE0/0/2
Mirror FRR:
Interface : GE0/0/3
BkNextHop : FE80::988A:C6FF:FE0D:517
LsIndex : 0x80000001
Backup label stack(top->bottom): {9:7::1:1}
Nib ID : 0x24000006
Flags: D-Direct, R-Added to Rib, L-Advertised in LSPs, U-Up/Down Bit Set
Typically, VPN traffic from CE 1 to CE 2 is forwarded over the CE 1-PE 1-P-PE 2-CE 2 path. When
PE 2 fails, the P device switches traffic to the mirror FRR path for the SRv6 TE policy when it detects that the next hop (PE 2) is unreachable.
# Shut down the interface that connects P to PE 2.
[P] interface gigabitethernet 0/0/2
[P-GigabitEthernet0/0/2] shut
[P-GigabitEthernet0/0/2] quit
# Display the IS-IS IPv6 route information. The output shows that the nexthop interface becomes the backup interface.
[P] display isis route ipv6 6:5::1:0 120 verbose
Route information for IS-IS(1)
------------------------------
Level-1 IPv6 forwarding table
-----------------------------
IPv6 dest : 6:5::1:0/120
Flag : R/-/- Cost : 20
Admin tag : - Src count : 3
Nexthop : FE80::988A:BDFF:FEB6:417
Interface : GE0/0/2
Mirror FRR:
Interface : GE0/0/3
BkNextHop : FE80::988A:C6FF:FE0D:517
LsIndex : 0x80000001
Backup label stack(top->bottom): {9:7::1:1}
Nib ID : 0x24000006
214
Flags: D-Direct, R-Added to Rib, L-Advertised in LSPs, U-Up/Down Bit Set
# Display SRv6 TE policy information on PE 1. The output shows that the SRv6 TE policy is still up.
[PE1] display segment-routing ipv6 te-policy
Name/ID: p1/0
Color: 10
End-point: 3::3
Name from BGP:
BSID:
Mode: Explicit Type: Type_2 Request state: Succeeded
Current BSID: 1:2::1:2 Explicit BSID: 1:2::1:2 Dynamic BSID: -
Reference counts: 4
Flags: A/BS/NC
Status: Up
AdminStatus: Not configured
Up time: 2020-10-28 09:10:33
Down time: 2020-10-28 09:09:32
Hot backup: Disabled
Statistics: Disabled
Statistics by service class: Disabled
Drop-upon-invalid: Disabled
BFD trigger path-down: Disabled
SBFD: Disabled
BFD Echo: Disabled
Forwarding index: 2150629377
Association ID: 1
Service-class: -
Rate-limit: -
PCE delegation: Not configured
PCE delegate report-only: Not configured
Encaps reduced: Not configured
Encaps include local End.X: Not configured
Candidate paths state: Configured
Candidate paths statistics:
CLI paths: 1 BGP paths: 0 PCEP paths: 0 ODN paths: 0
Candidate paths:
Preference : 10
CPathName:
ProtoOrigin: CLI Discriminator: 30
Instance ID: 0 Node address: 0.0.0.0
Originator: 0, ::
Optimal: Y Flags: V/A
Dynamic: Not configured
PCEP: Not configured
Explicit SID list:
ID: 1 Name: s1
Weight: 1 Forwarding index: 2149580801
215
State: Up State(-): -
Active path MTU: 1280 bytes
Example: Configuring SRv6 TE policy through ODN
Network configuration
configuring automatic creation of SRv6 TE policies between Device B and
Device E by using ODN to forward the traffic between Device A and Device F.
Figure 63 Network diagram
Device C
Device A
GE0/0/1
GE0/0/1
GE
0/0
/2
Loop0
GE
0/0
/2
Device B
GE
0/0
/3
GE
0/0
/2
GE
0/0
/1
GE
0/0
/2
Loop0
Device E
GE
0/0
/3
GE0/0/1
GE0/0/1
Device F
GE
0/0
/1
Device D
Table 18 Interface and IP address assignment
Device
Device A
Device B
Device C
Interface IP address
GE0/0/1 1000::2/64
Loop0
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/1
1::1/128
1000::2/64
2000::1/64
3000::1/64
4000::2/64
Device
Device F
Device E
Device D
Prerequisites
GE0/0/2 2002::2/64
Configure interface addresses as shown in Table 18 .
GE0/0/2
Procedure
1. Configure Device A:
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceA> system-view
[DeviceA] isis 1
[DeviceA-isis-1] cost-style wide
[DeviceA-isis-1] network-entity 00.0000.0000.0001.00
[DeviceA-isis-1] address-family ipv6 unicast
[DeviceA-isis-1-ipv6] quit
[DeviceA-isis-1] quit
Interface IP address
GE0/0/1 6000::2/64
Loop0
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/1
3::3/128
6000::1/64
4000::/64
5000::1/64
5000::2/64
3000::2/64
216
[DeviceA] interface gigabitethernet 0/0/1
[DeviceA-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceA-GigabitEthernet0/0/1] quit
2. Configure Device B:
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceB> system-view
[DeviceB] isis 1
[DeviceB-isis-1] cost-style wide
[DeviceB-isis-1] network-entity 00.0000.0000.0002.00
[DeviceB-isis-1] address-family ipv6 unicast
[DeviceB-isis-1-ipv6] quit
[DeviceB-isis-1] quit
[DeviceB] interface gigabitethernet 0/0/1
[DeviceB-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/1] quit
[DeviceB] interface gigabitethernet 0/0/2
[DeviceB-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/2] quit
[DeviceB] interface gigabitethernet 0/0/3
[DeviceB-GigabitEthernet0/0/3] isis ipv6 enable 1
[DeviceB-GigabitEthernet0/0/3] quit
[DeviceB] interface loopback 0
[DeviceB-LoopBack0] isis ipv6 enable 1
[DeviceB-LoopBack0] quit
# Establish a BGP peer relationship with Device E.
[DeviceB] bgp 100
[DeviceB-bgp-default] router-id 1.1.1.1
[DeviceB-bgp-default] peer 3::3 as-number 100
[DeviceB-bgp-default] peer 3::3 connect-interface loopback 0
[DeviceB-bgp-default] address-family ipv6
[DeviceB-bgp-default-ipv6] peer 3::3 enable
[DeviceB-bgp-default-ipv6] quit
[DeviceB-bgp-default] address-family ipv6 sr-policy
[DeviceB-bgp-default-srpolicy-ipv6] peer 3::3 enable
[DeviceB-bgp-default-srpolicy-ipv6] quit
[DeviceB-bgp-default] quit
# Configure an SRv6 locator.
[DeviceB] segment-routing ipv6
[DeviceB-segment-routing-ipv6] locator b ipv6-prefix 20:1:: 96 static 24
[DeviceB-segment-routing-ipv6-locator-b] opcode 1 end
[DeviceB-segment-routing-ipv6-locator-b] quit
[DeviceB-segment-routing-ipv6] quit
# Configure ODN to create an SRv6 TE policy automatically.
[DeviceB] segment-routing ipv6
[DeviceB-segment-routing-ipv6] traffic-engineering
[DeviceB-srv6-te] srv6-policy locator b
[DeviceB-srv6-te] on-demand color 1
# Enable path computation using PCE.
217
[DeviceB-srv6-te-odn-1] dynamic
[DeviceB-srv6-te-odn-1-dynamic] pcep
[DeviceB-srv6-te-odn-1] quit
[DeviceB-srv6-te] quit
[DeviceB-segment-routing-ipv6] quit
[DeviceB] isis 1
[DeviceB-isis-1] address-family ipv6 unicast
[DeviceB-isis-1-ipv6] segment-routing ipv6 locator b
[DeviceB-isis-1-ipv6] quit
[DeviceB-isis-1] quit
3. Configure Device C:
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceC> system-view
[DeviceC] isis 1
[DeviceC-isis-1] cost-style wide
[DeviceC-isis-1] network-entity 00.0000.0000.0003.00
[DeviceC-isis-1] address-family ipv6 unicast
[DeviceC-isis-1-ipv6] quit
[DeviceC-isis-1] quit
[DeviceC] interface gigabitethernet 0/0/1
[DeviceC-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/1] quit
[DeviceC] interface gigabitethernet 0/0/2
[DeviceC-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceC-GigabitEthernet0/0/2] quit
[DeviceC] interface loopback 0
[DeviceC-LoopBack1] isis ipv6 enable 1
[DeviceC-LoopBack1] quit
4. Configure Device D:
# Configure IS-IS and set the IS-IS cost style to wide.
<DeviceD> system-view
[DeviceD] isis 1
[DeviceD-isis-1] cost-style wide
[DeviceD-isis-1] network-entity 00.0000.0000.0004.00
[DeviceD-isis-1] address-family ipv6 unicast
[DeviceD-isis-1-ipv6] quit
[DeviceD-isis-1] quit
[DeviceD] interface gigabitethernet 0/0/1
[DeviceD-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceD-GigabitEthernet0/0/1] quit
[DeviceD] interface gigabitethernet 0/0/2
[DeviceD-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceD-GigabitEthernet0/0/2] quit
[DeviceD] interface loopback 0
[DeviceD-LoopBack0] isis ipv6 enable 1
[DeviceD-LoopBack0] quit
5. Configure Device E:
# Configure IS-IS and set the IS-IS cost style to wide.
218
<DeviceE> system-view
[DeviceE] isis 1
[DeviceE-isis-1] cost-style wide
[DeviceE-isis-1] network-entity 00.0000.0000.0005.00
[DeviceE-isis-1] address-family ipv6 unicast
[DeviceE-isis-1-ipv6] quit
[DeviceE-isis-1] quit
[DeviceE] interface gigabitethernet 0/0/1
[DeviceE-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceE-GigabitEthernet0/0/1] quit
[DeviceE] interface gigabitethernet 0/0/2
[DeviceE-GigabitEthernet0/0/2] isis ipv6 enable 1
[DeviceE-GigabitEthernet0/0/2] quit
[DeviceE] interface gigabitethernet 0/0/3
[DeviceE-GigabitEthernet0/0/3] isis ipv6 enable 1
[DeviceE-GigabitEthernet0/0/3] quit
[DeviceE] interface loopback 0
[DeviceE-LoopBack0] isis ipv6 enable 1
[DeviceE-LoopBack0] quit
[DeviceE] interface loopback 1
[DeviceE-LoopBack1] ipv6 address 2::2 128
[DeviceE-LoopBack1] quit
# Establish a BGP peer relationship with Device B.
[DeviceE] bgp 100
[DeviceE-bgp-default] router-id 3.3.3.3
[DeviceE-bgp-default] peer 1::1 as-number 100
[DeviceE-bgp-default] peer 1::1 connect-interface loopback 0
[DeviceE-bgp-default] address-family ipv6
[DeviceE-bgp-default-ipv6] peer 1::1 enable
[DeviceE-bgp-default-ipv6] network 2::2 128
[DeviceE-bgp-default-ipv6] quit
[DeviceE-bgp-default] address-family ipv6 sr-policy
[DeviceE-bgp-default-srpolicy-ipv6] peer 1::1 enable
[DeviceE-bgp-default-srpolicy-ipv6] quit
[DeviceE-bgp-default] quit
# Configure a route policy to add a color attribute to the export routes.
[DeviceE] route-policy 1 permit node 10
[DeviceE-route-policy-1-10] apply excommunity color 01:1
[DeviceE-route-policy-1-10] quit
[DeviceE] bgp 100
[DeviceE-bgp-default] address-family ipv6 unicast
[DeviceE-bgp-default-ipv6] peer 1::1 route-policy 1 export
[DeviceE-bgp-default-ipv6] peer 1::1 advertise-community
[DeviceE-bgp-default-ipv6] peer 1::1 advertise-ext-community
[DeviceE-bgp-default-ipv6] quit
[DeviceE-bgp-default] quit
6. Configure Device F:
# Configure IS-IS and set the IS-IS cost style to wide.
219
<DeviceF> system-view
[DeviceF] isis 1
[DeviceF-isis-1] network-entity 00.0000.0000.0006.00
[DeviceF-isis-1] cost-style wide
[DeviceF-isis-1] address-family ipv6 unicast
[DeviceF-isis-1-ipv6] quit
[DeviceF-isis-1] quit
[DeviceF] interface gigabitethernet 0/0/1
[DeviceF-GigabitEthernet0/0/1] isis ipv6 enable 1
[DeviceF-GigabitEthernet0/0/1] quit
Verifying the configuration
# Display information about the ODN-created SRv6 TE policy on Device B.
[DeviceB] display segment-routing ipv6 te policy
Name/ID: sr-1-3::3/0
Color: 1
End-point: 3::3
Name from BGP: sr-1-3::3
Name from PCE:
BSID:
Mode: Dynamic Type: Type_2 Request state: Succeeded
Current BSID: 20:1::100:0 Explicit BSID: - Dynamic BSID: 20:1::100:0
Reference counts: 4
Flags: A/BS/NC
Status: Up
AdminStatus: Not configured
Up time: 2020-12-01 15:58:12
Down time: 2020-12-01 15:58:12
Hot backup: Disabled
Statistics: Disabled
Statistics by service class: Disabled
Drop-upon-invalid: Disabled
BFD trigger path-down: Disabled
SBFD: Disabled
BFD Echo: Disabled
Forwarding index: 2150629377
Association ID: 1
Service-class: -
Rate-limit: -
PCE delegation: Not configured
PCE delegate report-only: Not configured
Encaps reduced: Not configured
Encaps include local End.X: Not configured
Candidate paths state: Not configured
Candidate paths statistics:
CLI paths: 0 BGP paths: 0 PCEP paths: 0 ODN paths: 2
Candidate paths:
Preference : 100
220
CPathName: sr-1-3::3
ProtoOrigin: BGP Discriminator: 100
Instance ID: 0 Node address: 0.0.0.0
Originator: 0, ::
Optimal: N Flags: None
Dynamic: Configured
PCEP: Configured
Candidate paths:
Preference : 200
CPathName: sr-1-3::3
ProtoOrigin: BGP Discriminator: 200
Instance ID: 0 Node address: 0.0.0.0
Originator: 0, ::
Optimal: N Flags: BN
Dynamic: Not configured
PCEP: Not configured
# Display the forwarding path information of the SRv6 TE policy.
[DeviceB] display segment-routing ipv6 forwarding
Total SRv6 forwarding entries: 1
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
A - Active forwarding information
B - Backup forwarding information
ID FWD-Type Flags Forwarding info
--------------------------------------------------------------------------------
2150630377 SRv6Policy TA 2149581800
# Display the forwarding information of the SRv6 TE policy.
[DeviceB] display segment-routing ipv6 te forwarding verbose
Total forwarding entries: 1
Policy name/ID: sr-1-3::3/1001
Binding SID: 20:1::100:0
Forwarding index: 2150630377
Main path:
Seglist Name/ID: 4369
Seglist forwarding index: 2149581800
Weight: 1
Outgoing forwarding index: 2148533223
Interface: GE1/0/3
Nexthop: FE80::7AAA:12FF:FED8:309
Path ID: 0
SID list: {6:5::1:5}
# Display BGP route information for the SRv6 TE policy.
[DeviceB] display bgp routing-table ipv6 3::3 128
BGP local router ID: 1.1.1.1
221
Local AS number: 100
Paths: 1 available, 1 best
BGP routing table information of 3::3/128:
From : 3::3 (2.2.2.2)
Rely nexthop : FE80::7AAA:12FF:FED8:309
Original nexthop: 3::3
Out interface : GigabitEthernet1/0/3
Route age : 00h17m00s
OutLabel : NULL
Ext-Community : <CO-Flag:Color(01:1)>
RxPathID : 0x0
TxPathID : 0xffffffff
AS-path : (null)
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, not preferred for igp-cost, not ECMP for igp-cost
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : gw
Rely tunnel IDs : 2150630377
222
Configuring IP L3VPN over SRv6
About IP L3VPN over SRv6
IP L3VPN over SRv6 uses SRv6 tunnels to carry IP L3VPN services. This technology establishes
SRv6 tunnels among geographically dispersed customer sites over an IPv6 network and transparently forwards Layer 3 customer traffic to remote sites over the IPv6 network through the tunnels. For more information about MPLS L3VPN configuration, see MPLS Configuration Guide .
Basic principle
Figure 64 shows a typical IP L3VPN over SRv6 network.
•
PE 1 and PE 2 use BGP to advertise IPv4 or IPv6 VPN routes to each other over the IPv6 backbone network. The VPN routes contain private network routing information and SID information.
•
The PEs have an SRv6 tunnel between them and they use the SRv6 tunnel to forward VPN traffic across sites.
•
The devices in the IPv6 backbone network forward the SRv6-encapsulated VPN traffic through the optimal path calculated by IGP.
IP L3VPN over SRv6 connects geographically dispersed sites that belong to the same VPN over the
IPv6 backbone network.
Figure 64 Network diagram
SRv6 VPN
P
PE 1 PE 2
VPN 1
CE 1
VPN 1
CE 2
MP-BGP
Route advertisement
The route advertisement process of IPv4 L3VPN over SRv6 is similar to that of IPv6 L3VPN over
SRv6. This section uses IPv4 L3VPN over SRv6 to illustrate the process.
As shown in Figure 64 , local routes of CE 1 are advertised to CE 2 by using the following process:
1. CE 1 uses static routing, RIP, OSPF, IS-IS, EBGP, or IBGP to advertise private network routes of the local site to PE 1.
2. After learning the route information of CE 1, PE 1 stores the private routes to the routing table of the VPN instance. In this example, VPN instance 1 is used. Then, PE 1 converts the routes to
BGP VPNv4 routes and advertises the BGP VPNv4 routes to PE 2 by using MP-BGP. The BGP
VPNv4 routes carry the RD, RT, and SID attributes (the SID attribute is used as the private network label). All private network routes of the VPN instance are allocated the same End.DT4 or End.DT46 SID.
3. When PE 2 receives the routes advertised by PE 1, it adds the routes to the routing table of
VPN 1, converts the routes to IPv4 routes, and advertises the IPv4 routes to CE 2.
4. By adding the received IPv4 routes to the routing table, CE 2 learns the private network routes of CE 1.
223
Packet forwarding
The packet forwarding process is similar for IPv4 L3VPN over SRv6 and IPv6 L3VPN over SRv6.
This section uses IPv4 L3VPN over SRv6 and VPN sites to illustrate the process.
As shown in Figure 64 , CE 2 forwards an IPv4 packet to CE 1 as follows:
1. CE 2 sends the IPv4 packet to PE 2.
2. PE 2 receives the packet on an interface associated with VPN 1. PE 2 searches for a route that matches the destination IPv4 address of the packet in the routing table of VPN 1. The corresponding End.DT4 or End.DT46 SID is found. Then, PE 2 encapsulates an outer IPv6 header for the packet. The End.DT4 or End.DT46 SID is encapsulated in the outer IPv6 header as the destination address.
3. PE 2 searches the IPv6 routing table based on the End.DT4 or End.DT46 SID for the optimal
IGP route and forwards the packet to P through the route.
4. P searches the IPv6 routing table based on the End.DT4 or End.DT46 SID for the optimal IGP route and forwards the packet to PE 1 through the route.
5. When PE 1 receives the packet, it processes the packet as follows: a. Searches the local SID forwarding table for the End.DT4 or End.DT46 SID. b. Removes the outer IPv6 header. c. Matches the packet to VPN 1 based on the SID, searches the routing table of VPN 1 for the optimal route, and forwards the packet to CE 1.
IP L3VPN over SRv6 FRR
IMPORTANT:
IP L3VPN over SRv6 FRR is supported only when the customer sites belong to VPNs.
IP L3VPN over SRv6 Fast Reroute (FRR) is applicable to a dualhomed scenario, as shown in Figure
primary link fails. The PE then selects a new optimal route, and uses the new optimal route to forward traffic.
IP L3VPN over SRv6 supports VPNv4 route backup for a VPNv4 route and VPNv6 route backup for a VPNv6 route.
Figure 65 Network diagram of VPNv4 route backup for a VPNv4 route
PE 2
VPN 1
CE 1
PE 1
IPv6 backbone
PE 3
VPN 1
CE 2
Primary link
Backup link
224
IPv4 L3VPN over SRv6 and IPv6 L3VPN over SRv6 use the same FRR mechanism. This section uses VPNv4 route backup for a VPNv4 route as an example to illustrate the mechanism.
As shown in Figure 65 , configure FRR on the ingress node PE 1, and specify the backup next hop for
VPN 1 as PE 3. When PE 1 receives a VPNv4 route to CE 2 from both PE 2 and PE 3, it uses the route from PE 2 as the primary link, and the route from PE 3 as the backup link.
Configure static BFD for public tunnels on PE 1 to detect the connectivity of the public tunnel from PE
1 to PE 2. When the tunnel PE 1
—
PE 2 operates correctly, traffic from CE 1 to CE 2 goes through the path CE 1—PE 1—PE 2—CE 2. When the tunnel fails, the traffic goes through the path CE 1—PE
1—PE 3—CE 2.
In this scenario, PE 1 is responsible for primary link detection and traffic switchover.
For more information about static BFD, see BFD configuration in High Availability Configuration
Guide .
IP L3VPN over SRv6 tasks at a glance
To configure IP L3VPN over SRv6, perform the following tasks:
1. Configuring a VPN instance and associating interfaces connected to CEs with the VPN instance
Perform this task on PEs. For more information, see MPLS L3VPN in MPLS Configuration
Guide .
2. Configuring route exchange between a PE and a CE
Configure an IPv4 routing protocol (static routing, RIP, OSPF, IS-IS, EBGP, or IBGP) or an IPv6 routing protocol (IPv6 static routing, RIPng, OSPFv3, IPv6 IS-IS, EBGP, or IBGP) to exchange routes between a PE and a CE
On the CE, configure an IPv4 or IPv6 routing protocol to advertise routes of the local site to the
PE. On the PE, associate the routing protocol with the VPN instance. For more information about routing protocol configurations, see Layer 3—IP Routing Configuration Guide .
3. Configuring route exchange between PEs a.
Perform this task to manually configure an End.DT4, End.DT6, End.DT46, End.DX4,
End.DX6 SID. b.
Applying a locator to a BGP VPN instance
BGP can advertise SRv6 SIDs through BGP routes only after you apply a locator to BGP. c. Configuring PEs to exchange BGP VPNv4 or VPNv6 routes d. Configuring IPv6 peers to exchange SRv6 SIDs
This feature enables PEs to exchange End.DT4, End.DT6, End.DT46, End.DX4, or
End.DX6 SIDs through BGP VPNv4 or VPNv6 routes. e.
This feature enables a PE to dynamically allocate End.DX4 or End.DX6 SIDs to BGP private network routes based on the route next hops. f.
(Optional.) Configuring BGP VPNv4 or VPNv6 routes
4.
Configuring the route recursion mode
5.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
This feature specifies the source address of the outer IPv6 header for SRv6 packets that are delivered between two private network sites over the backbone network.
6.
(Optional.) Configuring IP L3VPN over SRv6 FRR
7.
(Optional.) Configuring a TTL processing mode for tunnels associated with a VPN instance
225
Configuring an SRv6 SID
Restrictions and guidelines
If PEs advertise BGP VPNv4 or VPNv6 routes to each other, you must specify a VPN instance when configuring an opcode.
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an opcode. Perform one of the following tasks:
Configure an End.DT4 SID. opcode { opcode | hex hex-opcode } end-dt4 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. An End.DT4 SID cannot be configured in different
VPN instances.
Configure an End.DT6 SID. opcode { opcode | hex hex-opcode } end-dt6 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. An End.DT6 SID cannot be configured in different
VPN instances.
Configure an End.DT46 SID. opcode { opcode | hex hex-opcode } end-dt46 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. An End.DT46 SID cannot be configured in different
VPN instances.
Configure an End.DX4 SID. opcode { opcode | hex hex-opcode } end-dx4 interface interface-type
interface-number nexthop nexthop-ipv4-address [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. An End.DX4 SID cannot be configured with different output interfaces or next hops.
Configure an End.DX6 SID. opcode { opcode | hex hex-opcode } end-dx6 interface interface-type
interface-number nexthop nexthop-ipv6-address [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. An End.DX6 SID cannot be configured with different output interfaces or next hops.
226
Applying a locator to a BGP VPN instance
About this task
Use this feature in BGP-VPN IPv4 or IPv6 unicast address family view of a VPN instance to apply for
SRv6 SIDs for the private network routes of the VPN instance.
Use this feature if the device will use End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs to deliver VPN traffic across sites.
Restrictions and guidelines
The VPN instance of the specified locator must be the same as the VPN instance of the private network. To specify a VPN instance for a locator, use the opcode end-dt4 , opcode end-dt6 , opcode end-dt46 , opcode end-dx4 , or opcode end-dx6 command in SRv6 locator view.
Prerequisites
Before you perform this task, you must create the specified locator.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Apply a locator to the BGP VPN instance. segment-routing ipv6 locator locator-name [ auto-sid-disable ]
By default, no locator is applied to a BGP VPN instance.
Configuring PEs to exchange BGP VPNv4 or
VPNv6 routes
Restrictions and guidelines
For more information about the commands in this section, see BGP in Layer 3—IP Routing
Command Reference .
To ensure optimal route selection and SRv6 tunnel traffic forwarding, make sure a pair of PEs are not both IPv4 and IPv6 peers to each other.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
227
bgp as-number [ instance instance-name ]
3. Specify a remote PE as an IPv6 peer. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify a source interface (IPv6 address) for establishing TCP connections to an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the output interface in the optimal route destined for a BGP peer or peer group as the source interface for establishing TCP connections.
5. Create the BGP VPNv4 or VPNv6 address family and enter its view.
Create the BGP VPNv4 address family and enter its view. address-family vpnv4
Create the BGP VPNv6 address family and enter its view. address-family vpnv6
6. Enable BGP to exchange VPNv4 or VPNv6 routing information with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange VPNv4 or VPNv6 routing information with an IPv6 peer or peer group.
Configuring IPv6 peers to exchange SRv6 SIDs
About this task
Perform this task to configure IPv6 peers to exchange SRv6 SID information through BGP VPNv4 or
VPNv6 routes.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Enable BGP to exchange SRv6 SID information with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } prefix-sid
By default, BGP cannot exchange SRv6 SID information with an IPv6 peer or peer group.
Configuring next hop-based dynamic End.DX4 or
End.DX6 SID allocation for private network routes
About this task
Perform this task to forward an SRv6 decapsulated VPN packet to the next hop without looking up the routing table of the VPN instance.
228
By default, all BGP private network routes of a VPN instance are allocated the SID of the VPN instance. When a PE removes the SRv6 encapsulation from a received packet, it looks up the routing table of the VPN instance based on the SID for an optimal route. Then, the PE forwards the packet to a CE. To forward the packet to the next hop without looking up the routing table of the VPN instance, perform this task.
This task dynamically allocates End.DX4 or End.DX6 SIDs to all or specific next hops of the BGP private network routes in a VPN instance based on the next hop addresses. When forwarding a packet, the PE searches for the output interface and next hop based on the End.DX4 or End.DX6
SID of the packet. Then, the PE directly forwards the packet out of the output interface to the next hop.
Restrictions and guidelines
This feature does not allocate End.DX4 or End.DX6 SIDs to direct routes.
Prerequisites
Before you perform this task in BGP-VPN IPv4 or IPv6 unicast address family view, execute the segment-routing ipv6 locator command in the same view to apply a locator to the view.
This ensures successful dynamic End.DX4 or End.DX6 SID allocation.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Allocate End.DX4 or End.DX6 SIDs to the next hops of BGP private network routes.
Allocate End.DX4 or End.DX6 SIDs to all next hops of BGP private network routes. segment-routing ipv6 apply-sid all-nexthop
Execute the following commands in sequence to allocate an End.DX4 or End.DX6 SID to the specified next hop of BGP private network routes. segment-routing ipv6 apply-sid specify-nexthop nexthop nexthop-address interface interface-type interface-number
By default, VPN instance-based SID allocation is used for private network routes.
Configuring BGP VPNv4 or VPNv6 routes
Restrictions and guidelines for BGP VPNv4 or VPNv6 route configuration
For more information about the commands in this section, see BGP in Layer 3—IP Routing
Command Reference .
229
Controlling BGP VPNv4 or VPNv6 route advertisement and reception
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Set the maximum number of routes that BGP can receive from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-limit prefix-number [ { alert-only | discard | reconnect reconnect-time } | percentage-value ] *
By default, the number of routes that BGP can receive from a peer or peer group is not limited.
5. Save all route updates from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } keep-all-routes
By default, route updates from peers and peer groups are not saved.
Setting a preferred value for received BGP VPNv4 or VPNv6 routes
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Set a preferred value for routes received from a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } preferred-value value
By default, the preferred value is 0 for routes received from a peer or peer group.
Configuring BGP VPNv4 or VPNv6 route reflection
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
230
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Configure the router as a route reflector (RR) and specify a peer or peer group as its client. peer { group-name | ipv6-address [ prefix-length ] } reflect-client
By default, no RR or client is configured.
5. (Optional.) Enable route reflection between clients. reflect between-clients
By default, route reflection between clients is enabled.
6. (Optional.) Configure the cluster ID of the RR. reflector cluster-id { cluster-id | ip-address }
By default, an RR uses its own router ID as the cluster ID.
7. (Optional.) Create an RR reflection policy. rr-filter { ext-comm-list-number | ext-comm-list-name }
By default, an RR does not filter reflected routes.
8. (Optional.) Enable the RR to change the attributes of routes to be reflected. reflect change-path-attribute
By default, the RR cannot change the attributes of routes to be reflected.
Configuring BGP VPNv4 or VPNv6 route attributes
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Specify the router as the next hop for routes sent to a peer or peer group. peer { group-name | ipv4-address [ mask-length ] | ipv6-address
[ prefix-length ] } next-hop-local
By default, the router sets itself as the next hop for routes sent to a peer or peer group.
5. Configure the AS_PATH attribute.
Permit the local AS number to appear in routes from a peer or peer group and set the appearance times. peer { group-name | ipv6-address [ prefix-length ] } allow-as-loop
[ number ]
By default, the local AS number is not allowed in routes from a peer or peer group.
Remove private AS numbers from the AS_PATH attribute of updates sent to an EBGP peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } public-as-only
231
By default, BGP updates sent to an EBGP peer or peer group can carry both public and private AS numbers.
6. Advertise the COMMUNITY attribute to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise-community
By default, the COMMUNITY attribute is not advertised.
7. Configure the SoO attribute for a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } soo site-of-origin
By default, no SoO attribute is configured for a peer or peer group.
Configuring BGP VPNv4 or VPNv6 route distribution filtering policies
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Specify an ACL or IP prefix list to filter advertised BGP routes. filter-policy { ipv4-acl-number | name ipv4-acl-name | prefix-list prefix-list-name } export [ protocol process-id ]
By default, no ACL or IP prefix list is specified to filter advertised BGP routes.
5. Specify an ACL or IP prefix list to filter received BGP routes. filter-policy { ipv4-acl-number | name ipv4-acl-name | prefix-list prefix-list-name } import
By default, no ACL or IP prefix list is specified to filter received BGP routes.
6. Specify an IP prefix list to filter BGP routes for a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } prefix-list prefix-list-name { export | import }
By default, no IP prefix list is specified to filter BGP routes for a peer or peer group.
7. Apply a routing policy to routes received from or advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-policy route-policy-name { export | import }
By default, no routing policy is applied to routes received from or advertised to a peer or peer group.
8. Enable route target filtering of received VPNv4 or VPNv6 routes. policy vpn-target
By default, the route target filtering feature is enabled for received VPNv4 or VPNv6 routes.
BGP adds an VPNv4 or VPNv6 route to the routing table only when the export route targets of the route match the local import route targets.
232
Configuring the BGP Additional Paths feature
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
Enter BGP VPNv4 address family view. address-family vpnv4
Enter BGP VPNv6 address family view. address-family vpnv6
4. Configure the BGP Additional Paths capabilities. peer { group-name | ipv6-address [ prefix-length ] } additional-paths
{ receive | send } *
By default, no BGP Additional Paths capabilities are configured.
5. Set the maximum number of Add-Path optimal routes that can be advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise
additional-paths best number
By default, only one Add-Path optimal route can be advertised to a peer or peer group.
6. (Optional.) Set the optimal route selection delay timer.
route-select delay delay-value
By default, the optimal route selection delay timer is 0 seconds, which indicates that optimal route selection is not delayed.
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an SRv6 SID, it forwards the packet according to the route recursion mode.
•
SRv6 BE mode —This mode is also called SID-based forwarding mode. In this mode, the PE first encapsulates the End.DT4, End.DT6, or End.DT46 SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
•
SRv6 TE mode —This mode is also called SRv6 TE policy-based forwarding mode. In this mode, the PE first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the End.DT4, End.DT6, or
End.DT46 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy. For more information, see "Configuring SRv6 TE policies."
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Prerequisites
To use the SRv6 TE mode or the SRv6 TE and SRv6 BE hybrid mode, you must configure a tunnel policy and SRv6 TE policy. For more information, see tunnel policy configuration in MPLS
Configuration Guide and "Configuring SRv6 TE policies."
233
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Configure the route recursion mode. segment-routing ipv6 { best-effort | traffic-engineer | traffic-engineer best-effort }
By default, a PE searches the IPv6 routing table based on the next hop of a matching route to forward traffic.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
Restrictions and guidelines
To ensure correct traffic forwarding in an IP L3VPN over SRv6 network, you must specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated packets.
Configuring IP L3VPN over SRv6 FRR
About this task
IP L3VPN over SRv6 FRR enables the device to calculate backup routes for all routes of a VPN instance to reduce the traffic interruption caused by link or device failures on the backbone. If the device learns two unequal-cost routes destined for the same network from different peers, the
234
optimal route is backed up by the other route. When the optimal route becomes unavailable, the device uses the backup route to forward traffic. At the same time, the device calculates a new optimal route and then uses it to direct traffic forwarding.
Restrictions and guidelines
This feature might cause routing loops in certain conditions. Make sure you are fully aware of this feature when you use it on a live network.
Procedure
1. Enter system view. system-view
2. Configure static BFD.
bfd static session-name [ peer-ipv6 ipv6-address [ vpn-instance vpn-instance-name ] source-ipv6 ipv6-address [ discriminator local
local-value remote remote-value ] [ track-interface interface-type interface-number ] ]
3. Return to system view. quit
4. Enter BGP instance view.
bgp as-number [ instance instance-name ]
5. Configure BGP FRR to use BFD to detect next hop connectivity for the primary route. primary-path-detect bfd echo
By default, BGP FRR uses ARP to detect the connectivity to the next hop of the primary route.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
6. Enter BGP-VPN IPv4 unicast address family view, BGP VPNv4 address family view, BGP-VPN
IPv6 unicast address family view, or BGP VPNv6 address family view.
Execute the following commands in sequence to enter BGP-VPN IPv4 unicast address family view:
ip vpn-instance vpn-instance-name
address-family ipv4 [ unicast ]
Enter BGP VPNv4 address family view. address-family vpnv4
Execute the following commands in sequence to enter BGP-VPN IPv6 unicast address family view:
ip vpn-instance vpn-instance-name address-family ipv6 [ unicast ]
Enter BGP VPNv6 address family view. address-family vpnv6
7. Enable FRR for the address family. pic
By default, FRR is disabled for a BGP address family.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
235
Configuring a TTL processing mode for tunnels associated with a VPN instance
About this task
A tunnel associated with a VPN instance supports the following TTL processing modes:
•
Pipe —When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node sets the TTL value or hop limit in the new header to 255 or the value specified by using the encapsulation source-address ip-ttl command in SRv6 view. When the packet leaves the tunnel of the VPN instance, the egress node removes the new header from the packet.The TTL value or hop limit in the original packet does not change when the packet is forwarded in the tunnel. Therefore, the public network nodes are invisible to user networks, and the tracert facility cannot show the real path in the public network.
•
Uniform —When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node copies the TTL value or the hop limit of the original packet to the TTL or hop limit field of the new header. When the packet leaves the tunnel of the VPN instance, the egress node copies the remaining TTL value or hop limit in the new header back to the original packet. The TTL value or hop limit can reflect how many hops the packet has traversed in the public network. The tracert facility can show the real path along which the packet has traveled.
Restrictions and guidelines
In the current software version, you can configure a TTL processing mode only for SRv6 tunnels associated with VPN instances.
Procedure
1. Enter system view. system-view
2. Enter VPN instance view. ip vpn-instance vpn-instance-name [ index vpn-index ]
3. Configure a TTL processing mode for the tunnels associated with the VPN instance. ttl-mode { pipe | uniform }
By default, the TTL processing mode for the tunnels associated with a VPN instance is pipe.
For more information about this command, see MPLS L3VPN configuration in MPLS
Configuration Guide .
Verifying and maintaining IP L3VPN over SRv6
Displaying the configuration and running status of IP L3VPN over SRv6 VPN
For more information about the commands in this section, see basic BGP commands in Layer 3—IP
Routing Command Reference .
Perform display tasks in any view.
•
Display BGP VPNv4 peer or peer group information. display bgp [ instance instance-name ] peer vpnv4 { ipv6-address prefix-length | ipv6-address { log-info | verbose } }
236
•
Display BGP update group information for VPNv4 address family. display bgp [ instance instance-name ] update-group vpnv4 ipv6-address
•
Display BGP VPNv6 peer or peer group information. display bgp [ instance instance-name ] peer vpnv6 [ vpn-instance vpn-instance-name ] [ ipv6-address prefix-length | { ipv6-address |
group-name group-name } log-info | [ ipv6-address ] verbose ]
•
Display BGP update group information for VPNv6 address family. display bgp [ instance instance-name ] update-group vpnv6
[ vpn-instance vpn-instance-name ] [ ipv6-address ]
Resetting BGP sessions
About this task
For BGP setting changes to take effect, you must reset or soft-reset BGP sessions. Soft-resetting
BGP sessions updates BGP routing information without tearing down the BGP sessions. Resetting
BGP sessions updates BGP routing information by tearing down and re-establishing the BGP sessions. Soft-reset requires that both the local router and the peer support ROUTE-REFRESH messages.
Procedure
For more information about the commands, see basic BGP commands in Layer 3—IP Routing
Command Reference .
Perform the tasks in user view.
•
Soft-reset BGP sessions of the BGP VPNv4 address family. refresh bgp [ instance instance-name ] ipv6-address [ prefix-length ]
{ export | import } vpnv4
•
Reset BGP sessions of the BGP VPNv4 address family. reset bgp [ instance instance-name ] ipv6-address [ prefix-length ] vpnv4
Clearing flap statistics for BGP VPNv4 routes
To clear flap statistics for BGP VPNv4 routes, execute the following command in user view: reset bgp [ instance instance-name ] flap-info vpnv4 [ ipv4-address [ mask
| mask-length ] | as-path-acl as-path-acl-number | peer ipv6-address
[ prefix-length ] ]
IP L3VPN over SRv6 configuration examples
Example: Configuring IP L3VPN over SRv6 in SRv6 BE mode
Network configuration
As shown in Figure 66 , the backbone network is an IPv6 network, and VPN 1 is an IPv4 network.
Deploy IP L3VPN over SRv6 between PE 1 and PE 2 and use an SRv6 tunnel to transmit VPNv4 traffic between the PEs.
•
Configure EBGP to exchange VPN routing information between the CEs and PEs.
237
•
Configure IPv6 IS-IS on the PEs in the same AS to realize IPv6 network connectivity.
•
Configure MP-IBGP to exchange VPNv4 routing information between the PEs.
Figure 66 Network diagram
Loop0
PE 1 PE 2
Loop0
GE0/0/1
GE0/0/1
GE0/0/2
GE0/0/2
GE0/0/2
P
MPLS backbone
GE0/0/1
Loop0
GE0/0/1 GE0/0/1
CE 1 CE 2
VPN 1
AS 65410
Table 19 Interface and IP address assignment
VPN 1
AS 65420
P
Device
CE 1
PE 1
Procedure
Interface
GE0/0/1
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
10.1.1.2/24
1::1/128
10.1.1.1/24
2001::1/96
2::2/128
2001::2/96
2002::2/96
Device
PE 2
CE 2
Interface
Loop0
GE0/0/1
GE0/0/2
GE0/0/1
IP address
3::3/128
10.2.1.1/24
2002::1/96
10.2.1.2/24
1. Configure IPv6 IS-IS on the PEs and device P for network connectivity between the devices:
# Configure PE 1.
<PE1> system-view
[PE1] isis 1
[PE1-isis-1] is-level level-1
[PE1-isis-1] cost-style wide
[PE1-isis-1] network-entity 10.1111.1111.1111.00
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] ipv6 address 1::1 128
[PE1-LoopBack0] isis ipv6 enable 1
[PE1-LoopBack0] quit
[PE1] interface gigabitethernet 0/0/2
[PE1-GigabitEthernet0/0/2] ipv6 address 2001::1 96
[PE1-GigabitEthernet0/0/2] isis ipv6 enable
[PE1-GigabitEthernet0/0/2] quit
# Configure P.
<P> system-view
238
[P] isis
[P-isis-1] is-level level-1
[P-isis-1] cost-style wide
[P-isis-1] network-entity 10.2222.2222.2222.00
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] quit
[P-isis-1] quit
[P] interface loopback 0
[P-LoopBack0] ipv6 address 2::2 128
[P-LoopBack0] isis ipv6 enable
[P-LoopBack0] quit
[P] interface gigabitethernet 0/0/1
[P-GigabitEthernet0/0/1] ipv6 address 2001::2 96
[P-GigabitEthernet0/0/1] isis ipv6 enable
[P-GigabitEthernet0/0/1] quit
[P] interface gigabitethernet 0/0/2
[P-GigabitEthernet0/0/2] ipv6 address 2002::2 96
[P-GigabitEthernet0/0/2] isis ipv6 enable
[P-GigabitEthernet0/0/2] quit
# Configure PE 2.
<PE2> system-view
[PE2] isis
[PE2-isis-1] is-level level-1
[PE2-isis-1] cost-style wide
[PE2-isis-1] network-entity 10.3333.3333.3333.00
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] ipv6 address 3::3 128
[PE2-LoopBack0] isis ipv6 enable
[PE2-LoopBack0] quit
[PE2] interface gigabitethernet 0/0/2
[PE2-GigabitEthernet0/0/2] ipv6 address 2002::1 96
[PE2-GigabitEthernet0/0/2] isis ipv6 enable
[PE2-GigabitEthernet0/0/2] quit
# Verify that PE 1, P, and PE 2 have established IPv6 IS-IS neighbor relationships and the neighbor state is up.
[PE1] display isis peer
[P] display isis peer
[PE2] display isis peer
# Verify that PE 1 and PE 2 each learn a route destined for the loopback interface of each other.
[PE1] display isis route ipv6
[PE2] display isis route ipv6
2. Configure VPN instance settings on PE 1 and PE 2 and verify that each CE can access its local
PE:
# Configure PE 1.
[PE1] ip vpn-instance vpn1
239
[PE1-vpn-instance-vpn1] route-distinguisher 100:1
[PE1-vpn-instance-vpn1] vpn-target 111:1
[PE1-vpn-instance-vpn1] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 10.1.1.1 24
[PE1-GigabitEthernet0/0/1] quit
# Configure PE 2.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 100:1
[PE2-vpn-instance-vpn1] vpn-target 111:1
[PE2-vpn-instance-vpn1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 10.2.1.1 24
[PE2-GigabitEthernet0/0/1] quit
# Configure IP addresses for the interfaces on the CEs, as shown in Figure 66 . (Details not
shown.)
# Display VPN instance settings on each PE. This step uses PE 1 as an example.
[PE1] display ip vpn-instance
Total VPN-Instances configured : 1
Total IPv4 VPN-Instances configured : 1
Total IPv6 VPN-Instances configured : 1
VPN-Instance Name RD Address family Create time
vpn1 100:1 IPv4/IPv6 2019/08/12 13:59:39
# Verify that each PE can ping its local CE. This step uses PE 1 and CE 1 as an example.
[PE1] ping -vpn-instance vpn1 10.1.1.2
Ping 10.1.1.2 (10.1.1.2): 56 data bytes, press CTRL+C to break
56 bytes from 10.1.1.2: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 10.1.1.2: icmp_seq=1 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.1.1.2: icmp_seq=3 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=4 ttl=255 time=0.000 ms
--- Ping statistics for 10.1.1.2 in VPN instance vpn1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.000/0.600/2.000/0.800 ms
3. Set up an EBGP peer relationship between each PE and its local CE and distribute VPN routes to EBGP:
# Configure CE 1.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 10.1.1.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 10.1.1.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
240
# Configure CE 2 in the same way as CE 1 is configured. (Details not shown.)
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] peer 10.1.1.2 as-number 65410
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] peer 10.1.1.2 enable
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
# Configure PE 2 in the same way PE 1 is configured. (Details not shown.)
# Verify that the PEs have established BGP peer relationships with their local CEs and the peers are in established state.
[PE1] display bgp peer ipv4 vpn-instance
[PE2] display bgp peer ipv4 vpn-instance
4. Set up an MP-IBGP peer relationship between PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] peer 3::3 as-number 100
[PE1-bgp-default] peer 3::3 connect-interface loopback 0
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 enable
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 enable
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] quit
# Verify that the PEs have established a BGP peer relationship and the peers are in established state.
[PE1] display bgp peer vpnv4
[PE2] display bgp peer vpnv4
5. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets on PE 1 and
PE 2:
# Configure PE 1.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 11::11
# Configure PE 2.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 33::33
6. Configure the destination address (End.DT4 SID) of the outer IPv6 header for
SRv6-encapsulated packets:
# Configure PE 1.
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:2::1:0 96 static 8
241
[PE1-segment-routing-ipv6-locator-aaa] quit
[PE1-segment-routing-ipv6] quit
[PE1] isis 1
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] segment-routing ipv6 locator aaa
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
# Configure PE 2.
[PE2-segment-routing-ipv6] locator bbb ipv6-prefix 6:5::1:0 96 static 8
[PE2-segment-routing-ipv6-locator-bbb] quit
[PE2-segment-routing-ipv6] quit
[PE2] isis 1
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] segment-routing ipv6 locator bbb
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
# Verify that the PEs have distributed the End.DT4 SIDs to the routing table and generated
SRv6 routes. This step uses PE 1 as an example.
[PE1] display ipv6 routing-table protocol srv6
Summary count : 1
SRv6 Routing table status : <Active>
Summary count : 1
Destination: 1:2::101/128 Protocol : SRv6
NextHop : ::1 Preference: 4
Interface : InLoop0 Cost : 0
SRv6 Routing table status : <Inactive>
Summary count : 0
7. Add End.DT4 SIDs to private network routes on PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 locator bbb
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
242
8. Enable IPv6 peers on the PEs to exchange End.DT4 SIDs and enable the SID-route-recursion feature:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 prefix-sid
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 prefix-sid
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
# Display BGP VPNv4 routing information on each PE and verify that the routes advertised by the PEs have the SID attribute. This step uses PE 1 as an example.
[PE1] display bgp routing-table vpnv4 10.2.1.0
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of 10.2.1.0/24:
From : 3::3 (3.3.3.3)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 3::3
Out interface : GigabitEthernet0/0/2
Route age : 00h14m23s
OutLabel : 3
Ext-Community : <RT: 111:1>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <6:5::101>
AS-path : 65420
Origin : incomplete
243
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : N/A
Verifying the configuration
# Display IPv4 routing table information on the PEs and verify that each PE has a route destined for the remote CE and the next hop of the route is the End.DT4 SID of the route. This step uses PE 1 as an example.
[PE1] display ip routing-table vpn-instance vpn1
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.0/24 Direct 0 0 10.1.1.1 GE0/0/1
10.1.1.0/32 Direct 0 0 10.1.1.1 GE0/0/1
10.1.1.1/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.255/32 Direct 0 0 10.1.1.1 GE0/0/1
10.2.1.0/24 BGP 255 0 6:5::101 GE0/0/2
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
244
Configuring EVPN L3VPN over SRv6
About EVPN L3VPN over SRv6
EVPN L3VPN over SRv6 uses SRv6 tunnels to carry EVPN L3VPN services. This technology establishes SRv6 tunnels among geographically dispersed customer sites over the IPv6 backbone network and transparently forwards EVPN L3VPN customer traffic through the tunnels. For more information about EVPN L3VPN configuration, see EVPN Configuration Guide .
Basic principle
Figure 67 shows a typical EVPN L3VPN over SRv6 network.
•
PE 1 and PE 2 use MP-BGP to advertise EVPN IP advertisement routes to each other over the
IPv6 backbone network. The EVPN IP advertisement routes contain IPv4 or IPv6 VPN routing information and SID information.
•
The PEs have a single-hop SRv6 tunnel between them and they use the SRv6 tunnel to forward
EVPN L3VPN traffic across sites.
•
The devices in the IPv6 backbone network forward the SRv6-encapsulated EVPN L3VPN traffic through the optimal path calculated by IGP.
EVPN L3VPN over SRv6 connects geographically dispersed sites that belong to the same VPN over the IPv6 backbone network.
Figure 67 Network diagram
SRv6 VPN
P
PE 1 PE 2
VPN 1
CE 1
VPN 1
CE 2
MP-BGP
Route advertisement
The route advertisement process of IPv4 EVPN L3VPN over SRv6 is similar to that of IPv6 EVPN
L3VPN over SRv6. This section uses IPv4 EVPN L3VPN over SRv6 to illustrate the process.
As shown in Figure 67 , local routes of CE 1 are advertised to CE 2 by using the following process:
1. CE 1 uses static routing, RIP, OSPF, IS-IS, EBGP, or IBGP to advertise routes of the local site to PE 1.
2. PE 1 stores the routes advertised by CE 1 to the routing table of VPN 1. Then, PE 1 converts the routes to BGP EVPN IP advertisement routes and advertises the IP advertisement routes to
PE 2 by using MP-BGP. The IP advertisement routes carry RD, RT, and SID attributes (the SID attribute is used as the private network label).
If next hop-based dynamic SID allocation is not used, all private network routes of the VPN instance are allocated the same End.DT4 or End.DT46 SID.
If next hop-based dynamic SID allocation is used, private network routes with the same next hop are allocated the same End.DX4 SID in the VPN instance.
3. PE 2 adds the IP advertisement routes to the routing table of VPN 1, converts the IP advertisement routes to IPv4 routes, and advertises the IPv4 routes to CE 2.
245
4. By adding the received IPv4 routes to the routing table, CE 2 learns the private network routes of CE 1.
Packet forwarding
EVPN L3VPN over SRv6 supports the following route recursion modes:
•
SRv6 BE mode.
•
SRv6 TE mode.
•
SRv6 TE and SRv6 BE hybrid mode.
The packet forwarding process differs by the route recursion mode in use.
SRv6 BE mode
This mode is also called SID-based forwarding mode. In this mode, a PE forwards an SRv6 packet by searching the IPv6 routing table based on the SRv6 SID encapsulated in the packet.
The packet forwarding process of IPv4 EVPN L3VPN over SRv6 is similar to that of IPv6 EVPN
L3VPN over SRv6. This section uses IPv4 EVPN L3VPN over SRv6 to illustrate the process.
As shown in Figure 67 , CE 2 forwards an IPv4 packet to CE 1 as follows:
1. CE 2 sends the IPv4 packet to PE 2.
2. PE 2 receives the packet on an interface associated with VPN 1. PE 2 searches for a route that matches the destination IPv4 address of the packet in the routing table of VPN 1. The corresponding End.DT4, End.DT46, or End.DX4 SID is found. Then, PE 2 encapsulates an outer IPv6 header for the packet. The End.DT4, End.DT46, or End.DX4 SID is encapsulated in the outer IPv6 header as the destination address.
3. PE 2 searches the IPv6 routing table based on the End.DT4, End.DT46, or End.DX4 SID for the optimal IGP route and forwards the packet to P through the route.
4. P searches the IPv6 routing table based on the End.DT4, End.DT46, or End.DX4 SID for the optimal IGP route and forwards the packet to PE 1 through the route.
5. When PE 1 receives the packet, it processes the packet as follows:
If the packet header contains an End.DT4 or End.DT46 SID, PE 1 searches the local SID forwarding table for the SID and removes the outer IPv6 header. Then, PE 1 matches the packet to VPN 1 based on the SID, searches the routing table of VPN 1 for the optimal route and forwards the packet to CE 1.
If the packet header contains an End.DX4 SID, PE 1 searches the local SID forwarding table for the SID and removes the outer IPv6 header. Then, PE 1 forwards the packet to CE
1 according to the next hop and output interface bound to the SID.
SRv6 TE mode
This mode is also called SRv6 TE policy-based forwarding mode. In this mode, when a PE forwards a customer packet, it first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the destination SRv6 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet based on the SRv6 TE policy.
The following modes are available to steer traffic to an SRv6 TE policy:
•
Color —The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and nexthop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the BGP EVPN route to that SRv6 TE policy. When the device receives packets that match the BGP EVPN route, it forwards the packets through the SRv6 TE policy.
•
Tunnel policy —The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route. Configure a preferred tunnel or load sharing tunnel policy
246
that uses the SRv6 TE policy. In this way, the SRv6 TE policy will be used as the public tunnel to forward the packets of private network packets.
For more information about tunnel policies, see MPLS Configuration Guide . For more information about SRv6 TE policies, see "Configuring SRv6 TE policies."
SRv6 TE and SRv6 BE hybrid mode
In this mode, the PE preferentially uses the SRv6 TE mode to forward a packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
EVPN L3VPN over SRv6 FRR
EVPN L3VPN over SRv6 Fast Reroute (FRR) is applicable to a dualhomed scenario, as shown in
Figure 68 . By using static BFD to detect the primary link, FRR enables a PE to use the backup link
when the primary link fails. The PE then selects a new optimal route, and uses the new optimal route to forward traffic.
EVPN L3VPN over SRv6 uses EVPN route backup for an EVPN route.
Figure 68 Network diagram of EVPN route backup for an EVPN route
PE 2
PE 1
VPN 1
IPv6 backbone
VPN 1
CE 1 CE 2
Primary link
Backup link
PE 3
As shown in Figure 68 , configure FRR on the ingress node PE 1, and specify the backup next hop for
VPN 1 as PE 3. When PE 1 receives an EVPN route to CE 2 from both PE 2 and PE 3, it uses the route from PE 2 as the primary link, and the route from PE 3 as the backup link.
Configure static BFD for public tunnels on PE 1 to detect the connectivity of the public tunnel from PE
1 to PE 2. When the tunnel PE 1 — PE 2 operates correctly, traffic from CE 1 to CE 2 goes through the path CE 1—PE 1—PE 2—CE 2. When the tunnel fails, the traffic goes through the path CE 1—PE
1—PE 3—CE 2.
In this scenario, PE 1 is responsible for primary link detection and traffic switchover.
For more information about static BFD, see BFD configuration in High Availability Configuration
Guide .
EVPN L3VPN over SRv6 tasks at a glance
To configure EVPN L3VPN over SRv6, perform the following tasks:
1. Configuring a VPN instance and associating interfaces connected to CEs with the VPN instance
Perform this task on PEs. For more information, see MPLS L3VPN in MPLS Configuration
Guide .
247
2. Configuring route exchange between a PE and a CE
Configure an IPv4 routing protocol (static routing, RIP, OSPF, IS-IS, EBGP, or IBGP) or an IPv6 routing protocol (IPv6 static routing, RIPng, OSPFv3, IPv6 IS-IS, EBGP, or IBGP) to exchange routes between a PE and a CE
On the CE, configure an IPv4 or IPv6 routing protocol to advertise routes of the local site to the
PE. On the PE, associate the routing protocol with the VPN instance. For more information about routing protocol configurations, see Layer 3—IP Routing Configuration Guide .
3. Configuring route exchange between PEs a.
Perform this task to manually configure an End.DT4, End.DT6, End.DT46, End.DX4, or
End.DX6 SID. b.
Applying a locator to a BGP VPN instance
BGP can advertise SRv6 SIDs through BGP routes only after you apply a locator to BGP. c.
Configuring SRv6-encapsulated EVPN route advertisement
Perform this task to advertise VPN routes as EVPN routes to a peer or peer group in the
EVPN L3VPN over SRv6 network. d. Configuring PEs to exchange BGP EVPN routes e.
(Optional.) Configuring next hop-based dynamic End.DX4 or End.DX6 SID allocation for
This feature enables a PE to dynamically allocate End.DX4 or End.DX6 SIDs to BGP private network routes based on the route next hops. f.
(Optional.) Configuring BGP EVPN route settings
4.
Configuring the route recursion mode
5. Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN L3VPN packets
This feature specifies the source address of the outer IPv6 header for SRv6 packets forwarded between two private network sites over the backbone network.
6.
(Optional.) Configuring EVPN L3VPN over SRv6 FRR
7.
(Optional.) Configuring a TTL processing mode for tunnels associated with a VPN instance
Configuring an SRv6 SID
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an opcode. Perform one of the following tasks:
Configure an End.DT4 SID. opcode { opcode | hex hex-opcode } end-dt4 vpn-instance
vpn-instance-name evpn
The specified VPN instance must exist. An End.DT4 SID cannot be configured in different
VPN instances.
Configure an End.DT6 SID.
248
opcode { opcode | hex hex-opcode } end-dt6 vpn-instance
vpn-instance-name evpn
The specified VPN instance must exist. An End.DT6 SID cannot be configured in different
VPN instances.
Configure an End.DT46 SID. opcode { opcode | hex hex-opcode } end-dt46 vpn-instance
vpn-instance-name evpn
The specified VPN instance must exist. An End.DT46 SID cannot be configured in different
VPN instances.
Configure an End.DX4 SID. opcode { opcode | hex hex-opcode } end-dx4 interface interface-type
interface-number nexthop nexthop-ipv4-address vpn-instance
vpn-instance-name evpn
The specified VPN instance must exist. An End.DX4 SID cannot be configured with different output interfaces or next hops.
Configure an End.DX6 SID. opcode { opcode | hex hex-opcode } end-dx6 interface interface-type
interface-number nexthop nexthop-ipv6-address vpn-instance
vpn-instance-name evpn
The specified VPN instance must exist. An End.DX6 SID cannot be configured with different output interfaces or next hops.
Applying a locator to a BGP VPN instance
About this task
Use this feature in BGP-VPN IPv4 or IPv6 unicast address family view of a VPN instance to apply for
SRv6 SIDs for the private network routes of the VPN instance.
Use this feature if the device will use End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs to deliver EVPN traffic across sites.
Restrictions and guidelines
The VPN instance of the specified locator must be the same as the VPN instance of the private network. To specify a VPN instance for a locator, use the opcode end-dt4 , opcode end-dt6 , opcode end-dt46 , opcode end-dx4 , or opcode end-dx6 command in SRv6 locator view.
Prerequisites
Before you perform this task, you must create the specified locator.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
249
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Apply a locator to the BGP VPN instance. segment-routing ipv6 locator locator-name evpn [ auto-sid-disable ]
By default, no locator is applied to a BGP VPN instance.
Configuring SRv6-encapsulated EVPN route advertisement
About this task
Perform this task to ensure that a PE can advertise VPN routes as EVPN routes to a peer or peer group in an EVPN L3VPN over SRv6 network.
Restrictions and guidelines
Perform this task on the edge nodes of the EVPN L3VPN network and RRs.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view. address-family l2vpn evpn
4. Enable SRv6 encapsulation for the EVPN IP prefix advertisement routes advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise encap-type srv6
By default, IP prefix advertisement routes use VXLAN encapsulation.
Configuring PEs to exchange BGP EVPN routes
Restrictions and guidelines
To ensure optimal route selection and SRv6 tunnel traffic forwarding, make sure a pair of PEs are not both IPv4 and IPv6 peers to each other.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Configure an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify the source interface of TCP connections to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
250
By default, BGP uses the IPv6 address of the output interface in the optimal route to the BGP peer or peer group as the source address of TCP connections to the peer or peer group.
5. Enter BGP EVPN address family view. address-family l2vpn evpn
6. Enable BGP to exchange EVPN routes with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange EVPN routes with an IPv6 peer or peer group.
Configuring next hop-based dynamic End.DX4 or
End.DX6 SID allocation for BGP routes
About this task
Perform this task to forward an SRv6 decapsulated VPN packet to the next hop without looking up the routing table of the VPN instance.
If you assign an End.DT4 SID, End.DT6 SID, or End.DT46 SID to a BGP VPN instance, all BGP private network routes of the instance are allocated that SID. When a PE removes the SRv6 encapsulation from a received packet, it looks up the routing table of the VPN instance based on the
SID for an optimal route. Then, the PE forwards the packet to a CE. To forward the packet to the next hop without looking up the routing table of the VPN instance, perform this task.
This task dynamically allocates End.DX4 or End.DX6 SIDs to specific next hops or all next hops of the BGP private network routes in a VPN instance based on the next hop addresses. When forwarding a packet, the PE searches for the output interface and next hop based on the End.DX4 or
End.DX6 SID of the packet. Then, the PE directly forwards the packet out of the output interface to the next hop.
Restrictions and guidelines
Before you perform this task in BGP-VPN IPv4 or IPv6 unicast address family view, execute the segment-routing ipv6 locator command in the same view to apply a locator to the view.
This ensures successful dynamic End.DX4 or End.DX6 SID allocation.
This feature cannot allocate End.DX4 or End.DX6 SIDs to direct routes.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Configure next hop-based dynamic End.DX4 or End.DX6 SID allocation for BGP private network routes. Choose one of the following tasks:
Automatically allocate an End.DX4 or End.DX6 SID to each next hop of BGP private network routes.
251
segment-routing ipv6 apply-sid all-nexthop evpn
Execute the following commands in sequence to automatically allocate an End.DX4 or
End.DX6 SID to the specified next hop of BGP private network routes: segment-routing ipv6 apply-sid specify-nexthop evpn nexthop nexthop-address interface interface-type interface-number
By default, VPN instance-based SID allocation is used for private network routes.
Configuring BGP EVPN route settings
Restrictions and guidelines for BGP EVPN route configuration
For more information about the commands in this section, see BGP commands in Layer 3—IP
Routing Command Reference .
Configuring BGP route reflection
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view. address-family l2vpn evpn
4. Configure the device as an RR and specify a peer or peer group as its client. peer { group-name | ipv6-address [ prefix-length ] } reflect-client
By default, no RR or client is configured.
5. (Optional.) Enable BGP EVPN route reflection between clients. reflect between-clients
By default, BGP EVPN route reflection between clients is enabled.
6. (Optional.) Configure the cluster ID of the RR. reflector cluster-id { cluster-id | ip-address }
By default, an RR uses its own router ID as the cluster ID.
7. (Optional.) Create a reflection policy for the RR to filter reflected BGP EVPN routes. rr-filter { ext-comm-list-number | ext-comm-list-name }
By default, an RR does not filter reflected BGP EVPN routes.
8. (Optional.) Enable the RR to change the attributes of routes to be reflected. reflect change-path-attribute
By default, an RR cannot change the attributes of routes to be reflected.
Configuring attributes of BGP EVPN routes
1. Enter system view. system-view
2. Enter BGP instance view.
252
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view. address-family l2vpn evpn
4. Set the local router as the next hop for routes advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } next-hop-local
By default, BGP sets the local router as the next hop for all routes advertised to a peer or peer group.
5. Permit the local AS number to appear in routes from a peer or peer group and set the number of appearances. peer { group-name | ipv6-address [ prefix-length ] } allow-as-loop
[ number ]
By default, the local AS number is not allowed in routes from peers.
6. Advertise the COMMUNITY attribute to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise-community
By default, the device does not advertise the COMMUNITY attribute to peers or peer groups.
7. Advertise the Large community attribute to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise-large-community
By default, the Large community attribute is not advertised to a peer or peer group.
Filtering BGP EVPN routes
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view. address-family l2vpn evpn
4. Filter routes advertised to a peer or peer group. filter-policy { mac-acl-number | name mac-acl-name } export
By default, routes advertised to peers or peer groups are not filtered.
5. Filter routes received from a peer or peer group. filter-policy { mac-acl-number | name mac-acl-name } import
By default, routes received from peers or peer groups are not filtered.
6. Apply a routing policy to routes received from or advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } route-policy route-policy-name { export | import }
By default, no routing policies are applied to routes received from or advertised to peers or peer groups.
7. Enable route target filtering for BGP EVPN routes. policy vpn-target
By default, route target filtering is enabled for BGP EVPN routes.
253
Configuring the BGP Additional Paths feature
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view. address-family l2vpn evpn
4. Configure the BGP Additional Paths capabilities. peer { group-name | ipv6-address [ prefix-length ] } additional-paths
{ receive | send } *
By default, no BGP Additional Paths capabilities are configured.
5. Set the maximum number of Add-Path optimal routes that can be advertised to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise
additional-paths best number
By default, a maximum of one Add-Path optimal route can be advertised to a peer or peer group.
6. (Optional.) Set the optimal route selection delay timer.
route-select delay delay-value
By default, the optimal route selection delay timer is 0 seconds, which means optimal route selection is not delayed.
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an SRv6 SID, it forwards the packet according to the route recursion mode.
•
SRv6 BE mode —This mode is also called SID-based forwarding mode. In this mode, the PE first encapsulates the End.DT4, End.DT6, or End.DT46 SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
•
SRv6 TE mode —This mode is also called SRv6 TE policy-based forwarding mode. In this mode, the PE first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the End.DT4, End.DT6, or
End.DT46 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy. For more information, see "Configuring SRv6 TE policies."
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
254
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP-VPN IPv6 unicast address family view. address-family ipv6 [ unicast ]
5. Configure the route recursion mode. segment-routing ipv6 { best-effort | traffic-engineer | traffic-engineer best-effort } evpn
By default, a PE searches the IPv6 routing table based on the next hop of a matching route to forward traffic.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN L3VPN packets
Restrictions and guidelines
To ensure correct VPN traffic forwarding in an EVPN L3VPN over SRv6 network, you must specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN L3VPN packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN L3VPN packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated
EVPN L3VPN packets.
Configuring EVPN L3VPN over SRv6 FRR
About this task
EVPN L3VPN over SRv6 FRR enables the device to calculate backup routes for all routes of a VPN instance to reduce the traffic interruption caused by link or device failures on the backbone. If the device learns two unequal-cost routes destined for the same network from different peers, the optimal route is backed up by the other route. When the optimal route becomes unavailable, the device uses the backup route to forward traffic. At the same time, the device calculates a new optimal route and then uses it to direct traffic forwarding.
255
Restrictions and guidelines
This feature might cause routing loops in certain conditions. Make sure you are fully aware of this feature when you use it on a live network.
Procedure
1. Enter system view. system-view
2. Configure static BFD.
bfd static session-name [ peer-ipv6 ipv6-address [ vpn-instance vpn-instance-name ] source-ipv6 ipv6-address [ discriminator local
local-value remote remote-value ] [ track-interface interface-type interface-number ] ]
3. Return to system view. quit
4. Enter BGP instance view.
bgp as-number [ instance instance-name ]
5. Configure BGP FRR to use BFD to detect next hop connectivity for the primary route. primary-path-detect bfd echo
By default, BGP FRR uses ARP to detect the connectivity to the next hop of the primary route.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
6. Enter BGP EVPN address family view. address-family l2vpn evpn
7. Enable FRR for the address family. pic
By default, FRR is disabled.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
Configuring a TTL processing mode for tunnels associated with a VPN instance
About this task
A tunnel associated with a VPN instance supports the following TTL processing modes:
•
Pipe —When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node sets the TTL value or hop limit in the new header to 255 or the value specified by using the encapsulation source-address ip-ttl command in SRv6 view. When the packet leaves the tunnel of the VPN instance, the egress node removes the new header from the packet.The TTL value or hop limit in the original packet does not change when the packet is forwarded in the tunnel. Therefore, the public network nodes are invisible to user networks, and the tracert facility cannot show the real path in the public network.
•
Uniform —When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node copies the TTL value or the hop limit of the original packet to the TTL or hop limit field of the new header. When the packet leaves the tunnel of the VPN instance, the egress node copies the remaining TTL value or hop limit in the new header back to the original packet. The TTL value or hop limit can reflect how many hops
256
the packet has traversed in the public network. The tracert facility can show the real path along which the packet has traveled.
Restrictions and guidelines
In the current software version, you can configure a TTL processing mode only for SRv6 tunnels associated with VPN instances.
Procedure
1. Enter system view. system-view
2. Enter VPN instance view. ip vpn-instance vpn-instance-name [ index vpn-index ]
3. Configure a TTL processing mode for the tunnels associated with the VPN instance. ttl-mode { pipe | uniform }
By default, the TTL processing mode for the tunnels associated with a VPN instance is pipe.
For more information about this command, see MPLS L3VPN commands in MPLS Command
Reference .
Verifying and maintaining EVPN L3VPN over
SRv6
Displaying the running status and configuration of EVPN
L3VPN over SRv6
To display BGP EVPN route information, execute the following command in any view: display bgp [ instance instance-name ] l2vpn evpn [ peer ipv4-address
{ advertised-routes | received-routes } [ statistics ] | route-distinguisher route-distinguisher [ route-type ip-prefix ]
[ evpn-route route-length [ advertise-info ] ] | route-type { auto-discovery
| es | imet | ip-prefix | mac-ip } | statistics ]
For more information about this command, see EVPN Command Reference .
Resetting BGP sessions
About this task
For BGP setting changes to take effect, you must reset or soft-reset BGP sessions. Soft-resetting
BGP sessions updates BGP routing information without tearing down the BGP sessions. Resetting
BGP sessions updates BGP routing information by tearing down and re-establishing the BGP sessions. Soft-reset requires that both the local router and the peer support ROUTE-REFRESH messages.
Procedure
For more information about the commands in this task, see basic BGP commands in Layer 3—IP
Routing Command Reference .
Perform the tasks in user view.
•
Soft-reset BGP sessions of the BGP EVPN address family. refresh bgp [ instance instance-name ] ipv6-address [ prefix-length ]
{ export | import } l2vpn evpn
257
•
Reset BGP sessions of the BGP EVPN address family. reset bgp [ instance instance-name ] ipv6-address [ prefix-length ] l2vpn evpn
EVPN L3VPN over SRv6 configuration examples
Example: Configuring IPv4 EVPN L3VPN over SRv6 in SRv6
BE mode
Network configuration
As shown in Figure 69 , the backbone network is an IPv6 network, and VPN 1 is an IPv4 network.
Deploy EVPN L3VPN over SRv6 in SRv6 BE mode between PE 1 and PE 2 and use an SRv6 tunnel to transmit EVPN traffic between the PEs.
•
Configure EBGP to exchange VPN routing information between the CEs and PEs.
•
Configure IPv6 IS-IS on the PEs in the same AS to realize IPv6 network connectivity.
•
Configure MP-IBGP to exchange EVPN routing information between the PEs.
Figure 69 Network diagram
Loop0
PE 1 PE 2
Loop0
GE0/0/1
GE0/0/1
GE0/0/2
GE0/0/2
GE0/0/2
P
MPLS backbone
GE0/0/1
Loop0
GE0/0/1 GE0/0/1
CE 1
VPN 1
AS 65410
Table 20 Interface and IP address assignment
VPN 1
AS 65420
CE 2
P
Device
CE 1
PE 1
Procedure
Interface
GE0/0/1
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
10.1.1.2/24
1::1/128
10.1.1.1/24
2001::1/96
2::2/128
2001::2/96
2002::2/96
Device
PE 2
CE 2
Interface
Loop0
GE0/0/1
GE0/0/2
GE0/0/1
IP address
3::3/128
10.2.1.1/24
2002::1/96
10.2.1.2/24
1. Configure IPv6 IS-IS on the PEs and device P for network connectivity between the devices:
# Configure PE 1.
<PE1> system-view
[PE1] isis 1
[PE1-isis-1] is-level level-1
258
[PE1-isis-1] cost-style wide
[PE1-isis-1] network-entity 10.1111.1111.1111.00
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] ipv6 address 1::1 128
[PE1-LoopBack0] isis ipv6 enable 1
[PE1-LoopBack0] quit
[PE1] interface gigabitethernet 0/0/2
[PE1-GigabitEthernet0/0/2] ipv6 address 2001::1 96
[PE1-GigabitEthernet0/0/2] isis ipv6 enable
[PE1-GigabitEthernet0/0/2] quit
# Configure P.
<P> system-view
[P] isis
[P-isis-1] is-level level-1
[P-isis-1] cost-style wide
[P-isis-1] network-entity 10.2222.2222.2222.00
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] quit
[P-isis-1] quit
[P] interface loopback 0
[P-LoopBack0] ipv6 address 2::2 128
[P-LoopBack0] isis ipv6 enable
[P-LoopBack0] quit
[P] interface gigabitethernet 0/0/1
[P-GigabitEthernet0/0/1] ipv6 address 2001::2 96
[P-GigabitEthernet0/0/1] isis ipv6 enable
[P-GigabitEthernet0/0/1] quit
[P] interface gigabitethernet 0/0/2
[P-GigabitEthernet0/0/2] ipv6 address 2002::2 96
[P-GigabitEthernet0/0/2] isis ipv6 enable
[P-GigabitEthernet0/0/2] quit
# Configure PE 2.
<PE2> system-view
[PE2] isis
[PE2-isis-1] is-level level-1
[PE2-isis-1] cost-style wide
[PE2-isis-1] network-entity 10.3333.3333.3333.00
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] ipv6 address 3::3 128
[PE2-LoopBack0] isis ipv6 enable
[PE2-LoopBack0] quit
[PE2] interface gigabitethernet 0/0/2
259
[PE2-GigabitEthernet0/0/2] ipv6 address 2002::1 96
[PE2-GigabitEthernet0/0/2] isis ipv6 enable
[PE2-GigabitEthernet0/0/2] quit
# Verify that PE 1, P, and PE 2 have established IPv6 IS-IS neighbor relationships and the neighbor state is up.
[PE1] display isis peer
[P] display isis peer
[PE2] display isis peer
# Verify that PE 1 and PE 2 each learn a route destined for the loopback interface of each other.
[PE1] display isis route ipv6
[PE2] display isis route ipv6
2. Configure VPN instance settings on PE 1 and PE 2 and verify that each CE can access its local
PE:
# Configure PE 1.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 100:1
[PE1-vpn-instance-vpn1] vpn-target 111:1
[PE1-vpn-instance-vpn1] quit
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE1-GigabitEthernet0/0/1] ip address 10.1.1.1 24
[PE1-GigabitEthernet0/0/1] quit
# Configure PE 2.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 100:1
[PE2-vpn-instance-vpn1] vpn-target 111:1
[PE2-vpn-instance-vpn1] quit
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[PE2-GigabitEthernet0/0/1] ip address 10.2.1.1 24
[PE2-GigabitEthernet0/0/1] quit
# Configure IP addresses for the interfaces on the CEs, as shown in Figure 69 . (Details not
shown.)
# Display VPN instance settings on each PE. This step uses PE 1 as an example.
[PE1] display ip vpn-instance
Total VPN-Instances configured : 1
Total IPv4 VPN-Instances configured : 1
Total IPv6 VPN-Instances configured : 1
VPN-Instance Name RD Address family Create time
vpn1 100:1 IPv4/IPv6 2019/08/12 13:59:39
# Verify that each PE can ping its local CE. This step uses PE 1 and CE 1 as an example.
[PE1] ping -vpn-instance vpn1 10.1.1.2
Ping 10.1.1.2 (10.1.1.2): 56 data bytes, press CTRL+C to break
56 bytes from 10.1.1.2: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 10.1.1.2: icmp_seq=1 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.1.1.2: icmp_seq=3 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=4 ttl=255 time=0.000 ms
260
--- Ping statistics for 10.1.1.2 in VPN instance vpn1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.000/0.600/2.000/0.800 ms
3. Set up an EBGP peer relationship between each PE and its local CE and distribute VPN routes to EBGP:
# Configure CE 1.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 10.1.1.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 10.1.1.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
# Configure CE 2 in the same way as CE 1 is configured. (Details not shown.)
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] peer 10.1.1.2 as-number 65410
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] peer 10.1.1.2 enable
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
# Configure PE 2 in the same way PE 1 is configured. (Details not shown.)
# Verify that the PEs have established BGP peer relationships with their local CEs and the peers are in established state.
[PE1] display bgp peer ipv4 vpn-instance
[PE2] display bgp peer ipv4 vpn-instance
4. Set up an MP-IBGP peer relationship between PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] peer 3::3 as-number 100
[PE1-bgp-default] peer 3::3 connect-interface loopback 0
[PE1-bgp-default] address-family l2vpn evpn
[PE1-bgp-default-evpn] peer 3::3 enable
[PE1-bgp-default-evpn] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
[PE2-bgp-default] address-family l2vpn evpn
[PE2-bgp-default-evpn] peer 1::1 enable
[PE2-bgp-default-evpn] quit
[PE2-bgp-default] quit
261
# Verify that the PEs have established a BGP peer relationship and the peers are in established state.
[PE1] display bgp peer l2vpn evpn
[PE2] display bgp peer l2vpn evpn
5. Specify a source address for the outer IPv6 header of SRv6-encapsulated IPv4 EVPN L3VPN packets on PE 1 and PE 2:
# Configure PE 1.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 11::11
# Configure PE 2.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 33::33
6. Configure the destination address (End.DT4 SID) of the outer IPv6 header for
SRv6-encapsulated IPv4 EVPN L3VPN packets:
# Configure PE 1.
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:2::1:0 96 static 8
[PE1-segment-routing-ipv6-locator-aaa] quit
[PE1-segment-routing-ipv6] quit
[PE1] isis 1
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] segment-routing ipv6 locator aaa
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
# Configure PE 2.
[PE2-segment-routing-ipv6] locator bbb ipv6-prefix 6:5::1:0 96 static 8
[PE2-segment-routing-ipv6-locator-bbb] quit
[PE2-segment-routing-ipv6] quit
[PE2] isis 1
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] segment-routing ipv6 locator bbb
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
# Verify that the PEs have distributed the End.DT4 SIDs to the routing table and generated
SRv6 routes. This step uses PE 1 as an example.
[PE1] display ipv6 routing-table protocol srv6
Summary count : 1
SRv6 Routing table status : <Active>
Summary count : 1
Destination: 1:2::101/128 Protocol : SRv6
NextHop : ::1 Preference: 4
Interface : InLoop0 Cost : 0
SRv6 Routing table status : <Inactive>
Summary count : 0
7. Add End.DT4 SIDs to private network routes on PE 1 and PE 2:
262
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa evpn
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 locator bbb evpn
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
8. Enable IPv6 peers on the PEs to exchange End.DT4 SIDs and enable SRv6 BE mode:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] address-family l2vpn evpn
[PE1-bgp-default-evpn] peer 3::3 advertise encap-type srv6
[PE1-bgp-default-evpn] quit
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort evpn
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] address-family l2vpn evpn
[PE2-bgp-default-evpn] peer 1::1 advertise encap-type srv6
[PE2-bgp-default-evpn] quit
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort evpn
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
# Display BGP EVPN routing information on each PE and verify that the routes advertised by the PEs have the SID attribute. This step uses PE 1 as an example.
[PE1] display bgp l2vpn evpn [5][0][24][10.2.1.0]/80
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
263
Paths: 1 available, 1 best
BGP routing table information of [5][0][24][10.2.1.0]/80:
From : 3::3 (3.3.3.3)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 3::3
Out interface : GigabitEthernet0/0/2
Route age : 00h14m23s
OutLabel : NULL
Ext-Community : <RT: 111:1>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <6:5::101>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
EVPN route type : IP prefix advertisement route
ESI : 0000.0000.0000.0000.0000
Ethernet tag ID : 0
IP prefix : 10.2.1.0/24
Gateway address : 0.0.0.0
MPLS label : 16777215
Tunnel policy : NULL
Rely tunnel IDs : N/A
Verifying the configuration
# Display IPv4 routing table information on the PEs and verify that each PE has a route destined for the remote CE and the next hop of the route is the End.DT4 SID of the route. This step uses PE 1 as an example.
[PE1] display ip routing-table vpn-instance vpn1
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.0/24 Direct 0 0 10.1.1.1 GE0/0/1
10.1.1.0/32 Direct 0 0 10.1.1.1 GE0/0/1
10.1.1.1/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.255/32 Direct 0 0 10.1.1.1 GE0/0/1
10.2.1.0/24 BGP 255 0 6:5::1:0 GE0/0/2
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
264
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
265
Configuring EVPN VPWS over SRv6
About EVPN VPWS over SRv6
EVPN VPWS over SRv6 uses SRv6 tunnels to carry EVPN VPWS services. This technology establishes point-to-point connections between customer sites over the IPv6 backbone network and transparently forwards Layer 2 customer traffic over the IPv6 backbone network. For more information about EVPN VPWS configuration, see EVPN Configuration Guide .
Basic principle
As shown in Figure 70 , PEs set up an SRv6 tunnel by advertising End.DX2 SIDs to each other
through BGP EVPN routes. On a PE, this SRv6 tunnel is used as a PW to encapsulate and forward
Layer 2 data packets received from the local site and destined for a remote site. The devices on the
IPv6 backbone transport network forward the SRv6-encapsulated packets according to the optimal routes calculated by an IGP. As a result, Layer 2 data packets of one customer site can be transparently forwarded to another site over the IPv6 backbone transport network.
Figure 70 EVPN VPWS over SRv6 network diagram
EVPN routes
PE 1
P
PE 2
AC
AC
SRv6 tunnel
CE 1 CE 2
BGP EVPN route advertisement
A pair of PEs use BGP EVPN routes to establish PWs as follows:
1. A PE adds the local service ID and End.DX2 SID of a local cross-connect to Ethernet auto-discovery routes and advertises the routes to the remote PE.
2. After receiving the routes, the remote PE checks the service ID carried in the routes. If the service ID is the same as the remote service ID configured locally for a cross-connect, the PE establishes an SRv6 tunnel to the other PE. The SID flag of the SRv6 tunnel is the End.DX2 SID in the routes.
The two PEs both advertise End.DX2 SIDs to each other and establish two SRv6 tunnels at two directions. The two SRv6 tunnels form a PW to carry Layer 2 customer traffic. The PW is called an
SRv6 PW.
Traffic forwarding
EVPN VPWS over SRv6 supports the following route recursion modes:
•
SRv6 BE mode.
266
•
SRv6 TE mode.
•
SRv6 TE and SRv6 BE hybrid mode.
The packet forwarding process differs by the route recursion mode in use.
SRv6 BE mode
This mode is also called SID-based forwarding mode. In this mode, a PE forwards an SRv6 packet by searching the IPv6 routing table based on the End.DX2 SID encapsulated in the packet. A layer 2 packet is forwarded from CE 1 to CE 2 as follows:
1. CE 1 sends the Layer 2 packet to PE 1.
2. After PE 1 receives the packet on the AC connected to CE 1, it searches for the SRv6 PW
(SRv6 tunnel) associated with the AC and finds the End.DX2 SID to reach PE 2.
3. PE 1 encapsulates the outer IPv6 header and SRH header for the packet. The End.DX2 SID is encapsulated in the outer IPv6 header as the destination IPv6 address. The source IPv6 address is the source address specified for the outer IPv6 header of SRv6-encapsulated EVPN
VPWS packets.
4. PE 1 searches the IPv6 routing table based on the End.DX2 SID for the optimal IGP route and forwards the packet to P through the optimal IGP route.
5. P searches the IPv6 routing table based on the End.DX2 SID for the optimal IGP route and forwards the packet to PE 2 through the optimal IGP route.
6. PE 2 searches the local SID forwarding table for the End.DX2 SID and performs the following operations: a. Removes the outer IPv6 header. b. Matches the packet to an AC based on the End.DX2 SID. c. Forwards the packet to CE 2 through the AC.
SRv6 TE mode
This mode is also called SRv6 TE policy-based forwarding mode. In this mode, when a PE forwards a customer packet, it first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the destination End.DX2 SID and the
SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet based on the SRv6
TE policy.
The following modes are available to steer traffic to an SRv6 TE policy:
•
Color —The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and nexthop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the BGP EVPN route to that SRv6 TE policy. When the device receives packets that match the BGP EVPN route, it forwards the packets through the SRv6 TE policy.
•
Tunnel policy —The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route. Configure a preferred tunnel or load sharing tunnel policy that uses the SRv6 TE policy. In this way, the SRv6 TE policy will be used as the public tunnel to carry the SRv6 PW that forwards the packets of private network packets.
For more information about tunnel policies, see MPLS Configuration Guide . For more information about SRv6 TE policies, see "Configuring SRv6 TE policies."
SRv6 TE and SRv6 BE hybrid mode
In this mode, the PE preferentially uses the SRv6 TE mode to forward a packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
267
EVPN VPWS over SRv6 multihoming
About EVPN VPWS over SRv6 multihoming
As shown in Figure 71 , EVPN VPWS over SRv6 supports deploying multiple PEs at a site for
redundancy and high availability. On the redundant PEs, Ethernet links connected to the site form an
Ethernet segment (ES) that is uniquely identified by an ES identifier (ESI). EVPN VPWS over SRv6 supports only dualhoming.
Figure 71 EVPN VPWS over SRv6 multihoming
EVPN route:
SID: End.DX2 SID A
Customer network
CE 1
ES
PE 1
PE 2
IPv6 backbone
PE 3
CE 2
Customer network
EVPN route:
SID: End.DX2 SID B
Redundancy mode
The device supports single-active redundancy mode and all-active redundancy mode of EVPN
VPWS over SRv6 multihoming.
•
All-active mode —This mode allows all redundant PWs to a multihomed site to load share traffic.
•
Single-active mode —This mode allows one of the redundant PWs to forward traffic. When the main PW becomes unavailable because of device failure or link failure, traffic is switched to the secondary PW for forwarding. A designated forwarder (DF) is elected from the redundant PEs to determine the main PW. For more information about DF election, see EVPN VPWS configuration in EVPN Configuration Guide .
Route advertisement
The redundant PEs at a multihomed site both advertise End.DX2 SIDs to remote PEs. In addition, they advertise the redundancy mode of the multihomed site and their roles (primary or secondary) to remote PEs. A remote PE handles BGP EVPN routes advertised by the redundant PEs based on the redundancy mode.
•
In all-active mode, the remote PE treats the routes advertised by the redundant PEs as ECMP routes that can load share traffic.
•
In single-active mode, the remote PE treats the routes advertised by the primary PE as the optimal routes and only uses the optimal routes to forward traffic.
Bypass SRv6 PW
EVPN VPWS over SRv6 bypass PW helps reduce the traffic loss caused by AC or PW failure on an
EVPN VPWS over SRv6 network.
Local FRR enables two PEs at a multihomed EVPN VPWS over SRv6 network site to set up a bypass SRv6 PW between them.
As shown in Figure 72 , CE 2 is dualhomed to PE 2 and PE 3. When the AC on PE 2 fails, PE 2
advertises the local unreachable event to PE 1 and PE 3 for PE 1 to switch traffic to the PW to PE 3.
In this situation, PE 3 drops the packets that PE 1 sends before it is notified of the local unreachable
268
event. To resolve this issue, enable local FRR on PE 2 and PE 3. When receiving packets from PE 1 after PE 2's AC fails, PE 2 forwards the packets to PE 3 over the bypass SRv6 PW to prevent traffic loss.
Figure 72 Bypass SRv6 PW
IPv6 network
PE 2
PE 1
Customer network
CE 1
Bypass
SRv6 PW
CE 2
Customer network
PE 3
A loop might exist if PE 2 and PE 3 establish a bypass SRv6 PW between them through End.DX2
SIDs. When the AC on PE 2 or PE 3 fails, PE 2 or PE 3 forwards the packets received from its peer back to its peer through the bypass SRv6 PW. To resolve this issue, use End.DX2L SIDs to establish a bypass SRv6 PW between PE 2 and PE 3. The packets from a bypass SRv6 PW carry an
End.DX2L SID. A PE does not forward the packets back to the bypass SRv6 PW.
PEs preferentially use End.DX2L SIDs to establish a bypass SRv6 PW. If no End.DX2L SIDs are available, the PEs use End.DX2 SIDs to establish a bypass SRv6 PW.
EVPN VPWS over SRv6 tasks at a glance
To configure EVPN VPWS over SRv6, perform the following tasks:
1.
2.
Configuring a cross-connect group and its EVPN instance
3.
4.
Applying a locator to a cross-connect
5. Configuring packet forwarding methods
Configuring the route recursion mode
Configuring SRv6 TE policy traffic steering
This task is required if the route recursion mode is SRv6 TE mode or SRv6 TE and SRv6 BE hybrid mode.
6.
Mapping an AC to a cross-connect
7. Configuring PEs to exchange BGP EVPN routes
8. Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPWS packets
9.
(Optional.) Configuring EVPN VPWS over SRv6 multihoming
10.
(Optional.) Configuring bypass PW
11. (Optional.) Maintaining the EVPN VPWS over SRv6 network
Configuring SRv6 PW packet statistics
Test the connectivity of an SRv6 PW
269
Enabling L2VPN
1. Enter system view. system-view
2. Enable L2VPN. l2vpn enable
By default, L2VPN is disabled.
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
Configuring a cross-connect group and its EVPN instance
1. Enter system view. system-view
2. Create a cross-connect group and enter its view. xconnect-group group-name
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
3. (Optional.) Configure a description for the cross-connect group. description text
By default, no description is configured for a cross-connect group.
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
4. (Optional.) Bring p the cross-connect group. undo shutdown
By default, a cross-connect group is not administratively down.
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
5. Create an EVPN instance for the cross-connect group and enter its view. evpn encapsulation srv6
6. Configure an RD for the EVPN instance. route-distinguisher route-distinguisher
By default, no RD is configured for the EVPN instance of a cross-connect group.
For more information about this command, see EVPN commands in EVPN Command
Reference .
7. Configure route targets for the EVPN instance. vpn-targe t { vpn-target &<1-8> } [ both | export-extcommunity | import-extcommunity ]
By default, no route targets are configured for the EVPN instance of a cross-connect group.
For more information about this command, see EVPN commands in EVPN Command
Reference .
270
Parameter export-extcommunity
Description
Do not specify the same export targets for the EVPN instances of different cross-connect groups.
Do not specify the same export targets for the EVPN instances of a cross-connect group and a VSI.
As a best practice, the export targets of the EVPN instance of a cross-connect group do not match the import targets configured in
VPN instance view, VPN instance EVPN view, public instance view, public instance EVPN view, or VSI EVPN instance view. import-extcommunity
As a best practice, the import targets of the EVPN instance of a cross-connect group do not match the export targets configured in
VPN instance view, VPN instance EVPN view, public instance view, public instance EVPN view, or VSI EVPN instance view.
8. Return to cross-connect group view. quit
9. Create a cross-connect and enter its view. connection connection-name
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
Configuring SRv6 SIDs
Restrictions and guidelines
For more information about the commands in this task, see SRv6 commands in Segment Routing
Command Reference .
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an opcode for End.DX2 SIDs. opcode opcode end-dx2 xconnect-group group-name connection connection-name
5. (Optional.) Configure an opcode for End.DX2L SIDs. connection connection-name
This command applies only to bypass PW networks.
Applying a locator to a cross-connect
About this task
Perform this task to apply a locator to a cross-connect for the cross-connect to apply for End.DX2 and End.DX2L SIDs from the locator.
271
Procedure
1. Enter system view. system-view
2. Enter cross-connect group view. xconnect-group group-name
3. Enter cross-connect view. connection connection-name
4. Apply a locator to the cross-connect.
segment-routing ipv6 locator locator-name [ dx2l-locator dx2l-locator-name ] [ auto-sid-disable ]
By default, no locator is applied to a cross-connect.
5. Create an SRv6 PW and enter SRv6 PW view.
evpn local-service-id local-service-id remote-service-id remote-service-id [ tunnel-policy tunnel-policy-name ]
For more information about this command, see EVPN commands in EVPN Command
Reference .
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an End.DX2 SID or End.DX2L SID, it forwards the packet according to the route recursion mode.
•
SRv6 BE mode —This mode is also called SID-based forwarding mode. In this mode, the PE first encapsulates the End.DX2 SID or End.DX2L SID into the packet. Then, the PE searches the IPv6 routing table based on the End.DX2 SID or End.DX2L SID encapsulated in the packet to forward the packet.
•
SRv6 TE mode —This mode is also called SRv6 TE policy-based forwarding mode. In this mode, the PE first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the End.DX2 SID or End.DX2L SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy. For more information, see "Configuring SRv6 TE policies."
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Prerequisites
To use the SRv6 TE mode or the SRv6 TE and SRv6 BE hybrid mode, you must configure a tunnel policy and SRv6 TE policy. For more information, see tunnel policy configuration in MPLS
Configuration Guide and "Configuring SRv6 TE policies."
Procedure
1. Enter system view. system-view
2. Enter cross-connect group view. xconnect-group group-name
3. Enter cross-connect group EVPN instance view.
evpn encapsulation srv6
4. Configure the route recursion mode.
272
segment-routing ipv6 { best-effort | traffic-engineer | traffic-engineer best-effort }
By default, a PE searches the IPv6 routing table based on the next hop of a matching EVPN route to forward traffic.
Configuring SRv6 TE policy traffic steering
Restrictions and guidelines for SRv6 TE policy traffic steering
This task is required if the route recursion mode is SRv6 TE mode or SRv6 TE and SRv6 BE hybrid mode.
Color-based traffic steering takes precedence over tunnel policy-based traffic steering.
Configuring color-based traffic steering
About this task
The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and next hop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the route to that SRv6 TE policy. When the device receives packets that match the route, it forwards the packets through the SRv6 TE policy.
Prerequisites
To use color-based traffic steering, add the color extended community to BGP EVPN routes by using routing policy or other methods. For information about the routing policy configuration, see Layer
3—IP Routing Configuration Guide .
Restrictions and guidelines
Traffic steering is based on the greatest value among the color extended community attributes when the following conditions exist:
•
You specify the additive keyword for the apply extcommunity color clause in a routing policy, and specify the routing policy for the import route-policy command.
•
The received BGP EVPN routes carry the color extended community attribute.
Procedure
1. Enter system view. system-view
2. Enter routing policy node view. route-policy route-policy-name { deny | permit } node node-number
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
3. Set the color extended community attribute for BGP routes. apply extcommunity color color [ additive ]
By default, no color extended community attribute is set for BGP routes.
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
4. Return to system view. quit
5. Enter cross-connect group view. xconnect-group group-name
273
6. Enter EVPN instance view of the cross-connect group. evpn encapsulation srv6
7. Apply the routing policy as an import policy to the EVPN instance.
import route-policy route-policy
By default, no import routing policy is applied to an EVPN instance. The EVPN instance receives routes with the Route Target value identical to the local Import Target value.
For more information about this command, see EVPN commands in EVPN Command
Reference .
8. Apply the routing policy as an export policy to the EVPN instance.
export route-policy route-policy
By default, no export routing policy is applied to an EVPN instance. The EVPN instance does not filter advertised routes.
For more information about this command, see EVPN commands in EVPN Command
Reference .
Configuring tunnel policy-based traffic steering
About this task
The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route. In this way, the SRv6 TE policy will be used as the public tunnel to carry the SRv6
PW that forwards private network packets. For more information about tunnel policies, see MPLS
Configuration Guide .
Configuring a tunnel policy
1. Enter system view. system-view
2. Create a tunnel policy and enter tunnel policy view. tunnel-policy tunnel-policy-name [ default ]
3. Configure the tunnel policy. Choose a minimum of one option:
Bind tunnels to a destination IP address in a tunnel policy, so the tunnels can be used only for a specific VPN service. binding-destination dest-ipv6-address { srv6-policy group srv6-policy-group-id | srv6-policy { name policy-name | end-point ipv6 ipv6-address color color-value } } [ ignore-destination-check ]
[ down-switch ]
By default, a tunnel policy does not bind tunnels to a destination IP address.
Specify an SRv6 TE policy as a preferred tunnel of the tunnel policy. preferred-path srv6-policy { name srv6-policy-name | end-point ipv6 ipv6-address color color-value }
By default, no preferred tunnel is specified for a tunnel policy.
Configuring SRv6 TE policy load sharing for the tunnel policy. select-seq srv6-policy load-balance-number number
By default, no load sharing tunnel policy is configured.
For more information about the tunnel policy commands, see MPLS Command Reference .
Specifying the tunnel policy for a PW
1. Enter system view. system-view
274
2. Enter cross-connect group view. xconnect-group group-name
3. Enter cross-connect view. connection connection-name
4. Create an SRv6 PW and specify a tunnel policy for this PW.
evpn local-service-id local-service-id remote-service-id
remote-service-id tunnel-policy tunnel-policy-name
Mapping an AC to a cross-connect
Mapping a Layer 3 interface to a cross-connect
About this task
To interconnect an LDP PW in MPLS L2VPN and a PW in EVPN VPWS over SRv6, perform the following tasks:
1. Configure a VE-L2VPN interface and its VE-L2VPN subinterface 1 as ACs.
2. Specify the l2-splicing keyword when mapping the ACs to cross-connects.
3. Associate the VE-L2VPN interface with the LDP PW in MPLS L2VPN and associate VE-L2VPN subinterface 1 with the PW in EVPN VPWS over SRv6. Or, associate the VE-L2VPN interface with the PW in EVPN VPWS over SRv6 and associate VE-L2VPN subinterface 1 with the LDP
PW in MPLS L2VPN.
Procedure
1. Enter system view. system-view
2. Enter cross-connect group view.
xconnect-group group-name
3. Enter cross-connect view.
connection connection-name
4. Map a Layer 3 interface to the cross-connect.
ac interface interface-type interface-number [ access-mode { ethernet
| vlan } ]
By default, no Layer 3 interface is bound to the cross-connect.
For more information about this command, see MPLS L2VPN commands in MPLS Command
Reference .
Configuring PEs to exchange BGP EVPN routes
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Configure an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
275
4. Specify the source interface of TCP connections to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the IPv6 address of the output interface in the optimal route to the BGP peer or peer group as the source address of TCP connections to the peer or peer group.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
5. Enter BGP EVPN address family view. address-family l2vpn evpn
For more information about this command, see EVPN commands in EVPN Command
Reference .
6. Enable BGP to exchange EVPN routes with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange EVPN routes with an IPv6 peer or peer group.
For more information about this command, see BGP commands in Layer 3—IP Routing
Command Reference .
7. Enable BGP to advertise SRv6-encapsulated BGP EVPN routes to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise encap-type srv6
By default, BGP advertises VXLAN-encapsulated BGP EVPN routes to a peer or peer group.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPWS packets
Restrictions and guidelines
To ensure correct traffic forwarding in an EVPN VPWS over SRv6 network, you must specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPWS packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPWS packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated
EVPN VPWS packets.
276
Configuring EVPN VPWS over SRv6 multihoming
Restrictions and guidelines for EVPN VPWS over SRv6 multihoming
You must configure the same local and remote service IDs on the redundant PEs at a multihomed site.
As a best practice, set the same redundancy mode on the interfaces that act as ACs or are configured with ACs on the redundant PEs at a multihomed site.
You can assign ESIs to a main interface and its subinterfaces.
•
If you assign an ESI to a subinterface, the subinterface-specific ESI and redundancy mode take precedence over those configured on the main interface.
•
If you do not assign an ESI to a subinterface, it inherits the ESI and redundancy mode of the main interface. In this scenario, the redundancy mode on the subinterface does not take effect.
Assigning an ESI to an interface
About this task
An ESI uniquely identifies an ES. The links on interfaces with the same ESI belong to the same ES.
Traffic of the ES can be distributed among the links for load sharing.
Procedure
1. Enter system view. system-view
2. Enter interface view.
Enter Layer 2 Ethernet interface view.
interface interface-type interface-number
Enter Layer 2 aggregate interface view.
interface bridge-aggregation interface-number
Enter Layer 3 Ethernet interface view.
interface interface-type interface-number
Enter Layer 3 aggregate interface view.
interface route-aggregation interface-number
3. Assign an ESI to the interface.
esi esi-id
By default, no ESI is assigned to an interface.
For more information about this command, see EVPN commands in EVPN Command
Reference .
Setting the redundancy mode on an interface
About this task
EVPN VPWS over SRv6 multihoming provides the single-active redundancy mode and all-active redundancy mode.
277
The redundant PEs at a dualhomed site each establish a PW to a remote PE. To use one PW as a backup of the other PW, use the single-active mode. To distribute traffic across the PWs for load sharing, use the all-active mode.
Procedure
1. Enter system view. system-view
2. Enter interface view.
Enter Layer 2 Ethernet interface view.
interface interface-type interface-number
Enter Layer 2 aggregate interface view.
interface bridge-aggregation interface-number
Enter Layer 3 Ethernet interface view.
interface interface-type interface-number
Enter Layer 3 aggregate interface view.
interface route-aggregation interface-number
3. Set the redundancy mode. evpn redundancy-mode { all-active | single-active }
By default, the all-active redundancy mode is used.
For more information about this command, see EVPN commands in EVPN Command
Reference .
Configuring bypass PW
About this task
This task enables two PEs at a multihomed EVPN VPWS over SRv6 network site to set up a bypass
SRv6 PW between them. Perform this task to help reduce the traffic loss caused by AC failure.
Restrictions and guidelines
On an EVPN instance, EVPN instance-specific bypass PW configuration takes precedence over global bypass PW configuration.
If you have executed the evpn frr local enable command on an EVPN instance, the undo evpn multihoming vpws-frr local command does not delete the bypass SRv6 PW of the
EVPN instance.
Perform this task on the redundant PEs at a multihomed site.
Enabling bypass PW globally
1. Enter system view. system-view
2. Enable bypass PW globally for EVPN VPWS over SRv6. evpn multihoming vpws-frr local
By default, bypass PW is disabled globally for EVPN VPWS over SRv6.
For more information about this command, see EVPN Command Reference .
Configuring bypass PW on an EVPN instance
1. Enter system view. system-view
2. Enter cross-connect group view.
278
xconnect-group group-name
3. Enter EVPN instance view. evpn encapsulation srv6
4. Configure bypass PW for EVPN VPWS over SRv6. evpn frr local { disable | enable }
By default, an EVPN instance uses the global bypass PW configuration of EVPN VPWS over
SRv6.
For more information about this command, see EVPN Command Reference .
Configuring SRv6 PW packet statistics
About this task
When SRv6 PW packet statistics is enabled, you can use the display l2vpn peer srv6 verbose command to display SRv6 PW packet statistics. To clear SRv6 PW packet statistics, use the reset l2vpn statistics srv6-pw command.
Procedure
1. Enter system view. system-view
2. Enter cross-connect group view. xconnect-group group-name
3. Enter cross-connect view. connection connection-name
4. Enter SRv6 PW view.
evpn local-service-id local-service-id remote-service-id remote-service-id [ tunnel-policy tunnel-policy-name ]
5. Enable SRv6 PW packet statistics. statistics enable
By default, SRv6 PW packet statistics is disabled.
Test the connectivity of an SRv6 PW
Using ping to test the connectivity of an SRv6 PW
About this task
In an EVPN VPWS over SRv6 network, a PE transmits data packets to a remote PE over an SRv6
PW. Perform this task to test the connectivity of the SRv6 PW from the local PE to the remote PE when packet loss or traffic interruption occurs between the PEs.
The test process is as follows:
1. The local PE constructs an MPLS echo request packet and searches for the SRv6 tunnel that matches the specified cross-connect group name, local service ID, and remote service ID. After obtaining the End.DT2X SID of the SRv6 tunnel, the PE adds a UDP header and an IPv6 header to the packet and forwards the packet to the remote PE.
2. Upon receiving the MPLS echo request packet, the remote PE replies to the request.
279
3. The local PE identifies the connectivity of the SRv6 PW based on whether it has received MPLS echo replies from the remote PE and the reply response time. In addition, the local PE outputs statistics about the ping operation.
Procedure
To test the connectivity of an SRv6 PW from the local PE to the remote PE in an EVPN VPWS over
SRv6 network, execute the following command in any view:
ping evpn vpws srv6 xconnect-group group-name local-service-id remote-service-id [ -a source-ipv6 | -c count | -h hop-limit | -m interval
| -r reply-mode | -s packet-size | -t time-out | -tc tc ] *
Using tracert to test the connectivity of an SRv6 PW
About this task
In an EVPN VPWS over SRv6 network, a PE transmits data packets to a remote PE over an SRv6
PW. Perform this task to trace the path of the SRv6 PW from the local PE to the remote PE when packet loss or traffic interruption occurs between the PEs. This task helps you locate the failed nodes on the path.
The test process is as follows:
1. The local PE constructs an MPLS echo request packet and searches for the SRv6 tunnel that matches the specified cross-connect group name, local service ID, and remote service ID. After obtaining the End.DT2X SID of the SRv6 tunnel, the PE adds a UDP header and an IPv6 header to the packet and forwards the packet to the remote PE. In the IPv6 header, the value of the Hop limit field is set to 1.
2. When the next node receives the packet, the value of the Hop limit field changes to 0. Then, the node sends an ICMPv6 timeout packet to the first node (the local PE).
3. When the local PE receives the ICMPv6 timeout packet, it increases the value of the Hop limit field by one in the MPLS echo request packet. Then, the local PE forwards the request packet to the remote PE. The value of the Hop limit field is 2.
4. The value of the Hop limit field decreases by one each time the request packet reaches a node.
When the value of the Hop limit field decreases to 0, the node that receives the request packet responds to the first node with an ICMPv6 timeout packet. If the node that receives the request packet is the destination node, it sends an MPLS echo reply packet to the first node.
5. The local PE repeats the previous step until one of the following conditions exist:
The local PE has not received any reply packets before the reply timeout time expires for all request packets.
The local PE receives a reply packet from the remote PE.
6. The local PE identifies the connectivity of the SRv6 PW based on whether it has received MPLS echo reply packets from the remote PE and the reply response time. In addition, the local PE outputs statistics about the tracert operation.
Procedure
To trace the path of an SRv6 PW from the local PE to the remote PE in an EVPN VPWS over SRv6 network, execute the following command in any view:
tracert evpn vpws srv6 xconnect-group group-name local-service-id remote-service-id [ -a source-ip | -h hop-limit | -r reply-mode | -t time-out | -tc tc ] *
280
Verifying and maintaining EVPN VPWS over
SRv6
Displaying BGP EVPN route information
Perform display tasks in any view.
•
Display BGP peer group information. display bgp [ instance instance-name ] group l2vpn evpn [ group-name group-name ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
•
Display BGP peer or peer group information. display bgp [ instance instance-name ] peer l2vpn evpn [ ipv4-address mask-length | { ipv4-address | group-name group-name } log-info |
[ ipv4-address ] verbose ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
•
Display information about BGP update groups. display bgp [ instance instance-name ] update-group l2vpn evpn
[ ipv4-address ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
•
Display BGP EVPN routes. display bgp [ instance instance-name ] l2vpn evpn [ peer { ipv4-address
| ipv6-address } { advertised-routes | received-routes } [ statistics ]
| [ route-distinguisher route-distinguisher | route-type { es | imet } ]
* [ { evpn-route route-length | evpn-prefix } [ advertise-info ] | ipv4-address | ipv6-address | mac-address ] | statistics ]
For more information about this command, see EVPN Command Reference .
Displaying EVPN VPWS over SRv6 running status
Perform display tasks in any view.
•
Display information about peers that are automatically discovered through BGP. display evpn auto-discovery { mac-ip [ srv6 ] [ peer ip-address ] [ vsi vsi-name ] | macip-prefix [ nexthop next-hop ] [ count ] }
For more information about this command, see EVPN Command Reference .
•
Display EVPN ES information. display evpn es { local [ count | [ vsi vsi-name ] [ verbose ] ] | remote
[ vsi vsi-name ] [ nexthop next-hop ] [ verbose ]}
For more information about this command, see EVPN Command Reference .
•
Display EVPN information about cross-connects. display evpn route xconnect-group [ name group-name [ connection connection-name ] ] [ count ]
For more information about this command, see EVPN Command Reference .
•
Display information about cross-connect groups.
281
display l2vpn xconnect-group [ evpn-srv6 | name group-name [ connection connection-name ] ] [ count | verbose ]
•
Display L2VPN SRv6 information. display l2vpn peer srv6 [ xconnect-group group-name ] [ state-machine | verbose ]
Displaying EVPN VPWS over SRv6 forwarding information
To display SRv6 forwarding information, execute the following command in any view: display l2vpn forwarding srv6 [ xconnect-group group-name ] [ slot slot-number ] [ verbose ]
Clearing EVPN VPWS over SRv6 statistics
To clear SRv6 PW packet statistics, execute the following command in user view: reset l2vpn statistics srv6-pw [ vsi vsi-name [ peer ipv6-address ] ]
EVPN VPWS over SRv6 configuration examples
Example: Setting up an SRv6 tunnel between single-homed
EVPN VPWS sites
Network configuration
communicate through EVPN VPWS over the IPv6 backbone network.
Figure 73 Network diagram
IPv6 network
Loop0 Loop0
GE0/0/1
PE 1
GE0/0/2
GE0/0/1
P
Loop0
GE0/0/2
GE0/0/2
PE 2
GE0/0/1
GE0/0/1
Site 1
CE 1
Device
CE 1
PE 1
CE 2
Interface
GE0/0/1
Loop0
GE0/0/1
GE0/0/2
GE0/0/1
IP address
10::1/64
1::1/128
-
20::1/64
10::2/64
Device
P
PE 2
GE0/0/1
CE 2
Site 2
Interface
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
IP address
3::3/128
20::2/64
30::1/64
2::2/128
-
282
Device
Procedure
Interface IP address Device Interface
GE0/0/2
IP address
30::2/64
1. Configure CE 1.
<CE1> system-view
[ CE1 ] interface gigabitethernet 0/0/1
[ CE1-GigabitEthernet0/0/1 ] ipv6 address 10::1 64
[ CE1-GigabitEthernet0/0/1 ] quit
2. Configure PE 1:
# Run OSPFv3 on PE 1 and use OSPFv3 to advertise SIDs.
<PE1> system-view
[ PE1 ] ospfv3
[ PE1-ospfv3-1 ] router-id 1.1.1.1
[ PE1-ospfv3-1 ] segment-routing ipv6 locator aaa
[ PE1-ospfv3-1 ] area 0.0.0.0
[ PE1-ospfv3-1-area-0.0.0.0
] quit
[ PE1-ospfv3-1 ] quit
# Configure interface Loopback 0.
[ PE1 ] interface loopback 0
[ PE1-LoopBack0 ] ipv6 address 1::1 128
[ PE1-LoopBack0 ] ospfv3 1 area 0
[ PE1-LoopBack0 ] quit
# Enable L2VPN.
[ PE1 ] l2vpn enable
# Configure GigabitEthernet 0/0/2, the interface connected to P.
[ PE1 ] interface gigabitethernet 0/0/2
[ PE1-GigabitEthernet0/0/2 ] ipv6 address 20::1 64
[ PE1-GigabitEthernet0/0/2 ] ospfv3 1 area 0
[ PE1-GigabitEthernet0/0/2 ] undo shutdown
[ PE1-GigabitEthernet0/0/2 ] quit
# Configure PE 1 to establish IBGP neighbor relationship with PE 2 and enable BGP EVPN to advertise routes in SRv6 encapsulation to PE 2.
[ PE1 ] bgp 100
[ PE1-bgp-default ] router-id 1.1.1.1
[ PE1-bgp-default ] peer 2::2 as-number 100
[ PE1-bgp-default ] peer 2::2 connect-interface loopback 0
[ PE1-bgp-default ] address-family l2vpn evpn
[ PE1-bgp-default-evpn ] peer 2::2 enable
[ PE1-bgp-default-evpn ] peer 2::2 advertise encap-type srv6
[ PE1-bgp-default-evpn ] quit
[ PE1-bgp-default ] quit
# Create a cross-connect group named vpna , create an EVPN instance for it, and enable SRv6 encapsulation. Configure an RD and route targets for the EVPN instance and enable SRv6 BE route recursion mode.
[ PE1 ] xconnect-group vpna
[ PE1-xcg-vpna ] evpn encapsulation srv6
283
[ PE1-xcg-vpna-evpn-srv6 ] route-distinguisher 1:1
[ PE1-xcg-vpna-evpn-srv6 ] vpn-target 1:1 export-extcommunity
[ PE1-xcg-vpna-evpn-srv6 ] vpn-target 1:1 import-extcommunity
[ PE1-xcg-vpna-evpn-srv6 ] segment-routing ipv6 best-effort
[ PE1-xcg-vpna-evpn-srv6 ] quit
# Create cross-connect pw1 and map GigabitEthernet 0/0/1 to it. Create an SRv6 tunnel on the cross-connect.
[ PE1-xcg-vpna ] connection pw1
[ PE1-xcg-vpna-pw1 ] ac interface gigabitethernet 0/0/1
[ PE1-xcg-vpna-pw1-GigabitEthernet0/0/1 ] quit
[ PE1-xcg-vpna-pw1 ] evpn local-service-id 1 remote-service-id 2
[ PE1-xcg-vpna-pw1-1-2] quit
[ PE1-xcg-vpna-pw1 ] segment-routing ipv6 locator aaa
[ PE1-xcg-vpna-pw1 ] quit
[ PE1-xcg-vpna ] quit
# Specify a source IP address for the outer IPv6 header of SRv6-encapsulated packets, and configure a locator to apply for End.DX2 SIDs.
[ PE1 ] segment-routing ipv6
[ PE1-segment-routing-ipv6 ] encapsulation source-address 1::1
[ PE1-segment-routing-ipv6 ] locator aaa ipv6-prefix 100:: 64 static 32
[ PE1-segment-routing-ipv6-locator-aaa ] quit
[ PE1-segment-routing-ipv6 ] quit
3. Configure PE 2:
# Run OSPFv3 on PE 2 and use OSPFv3 to advertise SIDs.
<PE2> system-view
[ PE2 ] ospfv3
[ PE2-ospfv3-1] router-id 2.2.2.2
[ PE2-ospfv3-1 ] segment-routing ipv6 locator aaa
[ PE2-ospfv3-1 ] area 0.0.0.0
[ PE2-ospfv3-1-area-0.0.0.0
] quit
[ PE2-ospfv3-1 ] quit
# Configure interface Loopback 0.
[ PE2 ] interface loopback 0
[ PE2-LoopBack0 ] ipv6 address 2::2 128
[ PE2-LoopBack0 ] ospfv3 1 area 0
[ PE2-LoopBack0 ] quit
# Enable L2VPN.
[ PE2 ] l2vpn enable
# Configure GigabitEthernet 0/0/2, the interface connected to P.
[ PE2 ] interface gigabitethernet 0/0/2
[ PE2-GigabitEthernet0/0/2 ] ipv6 address 30::2 64
[ PE2-GigabitEthernet0/0/2 ] ospfv3 1 area 0.0.0.0
[ PE2-GigabitEthernet0/0/2 ] undo shutdown
[ PE2-GigabitEthernet0/0/2 ] quit
# Configure PE 2 to establish IBGP neighbor relationship with PE 1, and enable BGP EVPN to advertise routes in SRv6 encapsulation to PE 1.
[ PE2 ] bgp 100
[ PE2-bgp-default ] router-id 2.2.2.2
284
[ PE2-bgp-default ] peer 1::1 as-number 100
[ PE2-bgp-default ] peer 1::1 connect-interface loopback 0
[ PE2-bgp-default ] address-family l2vpn evpn
[ PE2-bgp-default-evpn ] peer 1::1 enable
[ PE2-bgp-default-evpn ] peer 1::1 advertise encap-type srv6
[ PE2-bgp-default-evpn ] quit
[ PE2-bgp-default ] quit
# Create a cross-connect group named vpna , create an EVPN instance for it, and enable SRv6 encapsulation. Configure an RD and route targets for the EVPN instance and enable SRv6 BE route recursion mode.
[ PE2 ] xconnect-group vpna
[ PE2-xcg-vpna ] evpn encapsulation srv6
[ PE2-xcg-vpna-evpn-srv6 ] route-distinguisher 1:1
[ PE2-xcg-vpna-evpn-srv6 ] vpn-target 1:1 export-extcommunity
[ PE2-xcg-vpna-evpn-srv6 ] vpn-target 1:1 import-extcommunity
[ PE2-xcg-vpna-evpn-srv6 ] segment-routing ipv6 best-effort
[ PE2-xcg-vpna-evpn-srv6 ] quit
# Create cross-connect pw1 and map GigabitEthernet 0/0/1 to it. Create an SRv6 tunnel on the cross-connect.
[ PE2-xcg-vpna ] connection pw1
[ PE2-xcg-vpna-pw1 ] ac interface gigabitethernet 0/0/1
[ PE2-xcg-vpna-pw1-GigabitEthernet0/0/1 ] quit
[ PE2-xcg-vpna-pw1 ] evpn local-service-id 2 remote-service-id 1
[ PE2-xcg-vpna-pw1-2-1] quit
[ PE2-xcg-vpna-pw1 ] segment-routing ipv6 locator aaa
[ PE2-xcg-vpna-pw1 ] quit
[ PE2-xcg-vpna ] quit
# Specify a source IP address for the outer IPv6 header of SRv6-encapsulated packets, and configure a locator to apply for End.DX2 SIDs.
[ PE2 ] segment-routing ipv6
[ PE2-segment-routing-ipv6 ] encapsulation source-address 2::2
[ PE2-segment-routing-ipv6 ] locator aaa ipv6-prefix 200:: 64 static 32
[ PE2-segment-routing-ipv6-locator-aaa ] quit
[ PE2-segment-routing-ipv6 ] quit
4. Configure P:
# Run OSPFv3 on P.
<P> system-view
[ P ] ospfv3
[ P-ospfv3-1 ] router-id 3.3.3.3
[ P-ospfv3-1 ] area 0.0.0.0
[ P-ospfv3-1-area-0.0.0.0
] quit
[ P-ospfv3-1 ] quit
# Configure IPv6 addresses for interfaces and run OSPFv3 on the interfaces.
[ P ] interface loopback 0
[ P-LoopBack0 ] ipv6 address 3::3 128
[ P-LoopBack0 ] ospfv3 1 area 0
[ P-LoopBack0 ] quit
[ P ] interface gigabitethernet 0/0/1
[ P-GigabitEthernet0/0/1 ] ipv6 address 20::2 64
285
[ P-GigabitEthernet0/0/1 ] ospfv3 1 area 0
[ P-GigabitEthernet0/0/1 ] quit
[ P ] interface gigabitethernet 0/0/2
[ P-GigabitEthernet0/0/2 ] ipv6 address 30::1 64
[ P-GigabitEthernet0/0/2 ] ospfv3 1 area 0
[ P-GigabitEthernet0/0/2] quit
5. Configure CE 2.
<CE2> system-view
[ CE2 ] interface gigabitethernet 0/0/1
[ CE2-GigabitEthernet0/0/1 ] ipv6 address 10::2 64
[ CE2-GigabitEthernet0/0/1 ] quit
Verifying the configuration
# Verify that an SRv6 tunnel has been established between PE 1 and PE 2.
[PE1] display l2vpn peer srv6
Total number of SRv6 Tunnels: 1
1 up, 0 blocked, 0 down
Xconnect-group Name: vpna
Peer : 2::2
Flag : Main
State : Up
Remote SrvID : 2
# Verify that the SRv6 forwarding information on PE 1 is correct. You can see input and output SID information about the SRv6 tunnel.
[PE1] display l2vpn forwarding srv6
Total number of cross-connections: 1
Total number of SRv6 tunnels: 1, 1 up, 0 blocked, 0 down
Xconnect-group Name : vpna
Connection Name : pw1
Link ID : 0x8000000 Type: BE State: Up
In SID : 100::1:0:2
Out SID : 200::1:0:2
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
286
Configuring EVPN VPLS over SRv6
About EVPN VPLS over SRv6
EVPN VPLS over SRv6 uses SRv6 tunnels to carry EVPN VPLS services. This technology establishes point-to-multipoint connections for customer sites over the IPv6 backbone network and transparently forwards Layer 2 customer traffic over the IPv6 backbone network. For more information about EVPN VPLS configuration, see EVPN Configuration Guide .
Basic principle
As shown in Figure 74 , PEs set up an SRv6 tunnel by advertising End.DT2M SIDs and End.DT2U
SIDs to each other through BGP EVPN routes. On a PE, this SRv6 tunnel is used as a PW to encapsulate and forward Layer 2 data packets received from the local site and destined for a remote site. The devices on the IPv6 backbone transport network forward the SRv6-encapsulated packets according to the optimal routes calculated by an IGP. As a result, Layer 2 data packets of one customer site can be transparently forwarded to another site over the IPv6 backbone transport network.
Figure 74 EVPN VPLS over SRv6 network diagram
EVPN routes
P
PE 1
PE 2
AC
AC
SRv6 tunnel
CE 1 CE 2
BGP EVPN route advertisement
A PE adds the End.DT2M SID and End.DT2U SID of a local VSI to BGP EVPN routes and advertises the routes to remote PEs. The routes help the PE establish an SRv6 tunnel to each remote PE.
•
The End.DT2M SID is carried in IMET routes and is used to deliver EVPN VPLS broadcast, unknown unicast, and multicast (BUM) traffic.
•
The End.DT2U SID is carried in MAC/IP advertisement routes and is used to deliver EVPN
VPLS known unicast traffic.
A pair of PEs both advertise End.DT2M SIDs and End.DT2U SIDs, and they establish two SRv6 tunnels at two directions. The two SRv6 tunnels form a PW to carry Layer 2 customer traffic.
Traffic forwarding
EVPN VPLS over SRv6 supports the following route recursion modes:
•
SRv6 BE mode.
•
SRv6 TE mode.
287
•
SRv6 TE and SRv6 BE hybrid mode.
The packet forwarding process differs by the route recursion mode in use.
SRv6 BE mode
This mode is also called SID-based forwarding mode. In this mode, a PE forwards an SRv6 packet by searching the IPv6 routing table based on the End.DT2U or End.DT2M SID encapsulated in the packet.
As shown in Figure 74 , a Layer 2 known unicast packet is forwarded from CE 1 to CE 2 as follows:
1. CE 1 sends the Layer 2 packet to PE 1.
2. After PE 1 receives the packet on the AC connected to CE 1, it searches the MAC address table of the VSI associated with that AC for the destination MAC address. PE 1 finds that the output interface is an SRv6 tunnel and obtains the End.DT2U SID of the SRv6 tunnel.
3. PE 1 encapsulates an outer IPv6 header for the packet. The End.DT2U SID is encapsulated in the outer IPv6 header as the destination IPv6 address. The source IPv6 address is the source address specified for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets.
4. PE 1 searches the IPv6 routing table based on the End.DT2U SID for the optimal IGP route and forwards the packet to P through the optimal IGP route.
5. P searches the IPv6 routing table based on the End.DT2U SID for the optimal IGP route and forwards the packet to PE 2 through the optimal IGP route.
6. PE 2 searches the local SID forwarding table for the End.DT2U SID. According to the SID type,
PE 2 removes the outer IPv6 header from the packet and performs the following operations: a. Matches the packet to a VSI and searches the MAC address table of the VSI for the destination MAC address. b. Forwards the packet to CE 2.
As shown in Figure 74 , a Layer 2 broadcast, multicast, or unknown unicast packet is forwarded as
follows:
7. CE 1 sends the Layer 2 packet to PE 1.
8. After PE 1 receives the packet on the AC connected to CE 1, it searches all End.DT2M SIDs received from remote PEs on the VSI associated with the AC.
9. PE 1 encapsulates an outer IPv6 header for the packet. An End.DT2M SID is encapsulated in the outer IPv6 header as the destination IPv6 address. The source IPv6 address is the source address specified for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets.
If PE 1 has received End.DT2M SIDs from multiple remote PEs, it encapsulates each
End.DT2M SID to the Layer 2 packet and floods the packet to all remote PEs.
10. PE 1 searches the IPv6 routing table based on the End.DT2M SID for the optimal IGP route and forwards the packet to P through the optimal IGP route.
11. P searches the IPv6 routing table based on the End.DT2M SID for the optimal IGP route and forwards the packet to PE 2 through the optimal IGP route.
12. PE 2 searches the local SID forwarding table for the End.DT2M SID and performs the following operations: a. Removes the outer IPv6 header. b. Matches the packet to a VSI based on the End.DT2M SID. c. Floods the packet in the VSI.
SRv6 TE mode
This mode is also called SRv6 TE policy-based forwarding mode. In this mode, when the PE forwards a customer packet, it first searches for a matching SRv6 TE policy based on the packet attributes. Then, the PE adds an SRH to the packet. The SRH includes the destination End.DT2M
SID or End.DT2U SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet based on the SRv6 TE policy.
288
The following modes are available to steer traffic to an SRv6 TE policy:
•
Color —The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and nexthop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the BGP EVPN route to that SRv6 TE policy. When the device receives packets that match the BGP EVPN route, it forwards the packets through the SRv6 TE policy.
•
Tunnel policy —The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route. Configure a preferred tunnel or load sharing tunnel policy that uses the SRv6 TE policy. In this way, the SRv6 TE policy will be used as the public tunnel to carry the SRv6 PW that forwards the packets of private network packets.
For more information about tunnel policies, see MPLS Configuration Guide . For more information about SRv6 TE policies, see "Configuring SRv6 TE policies."
SRv6 TE and SRv6 BE hybrid mode
In this mode, the PE preferentially uses the SRv6 TE mode to forward a customer packet. If no SRv6
TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
EVPN VPLS over SRv6 tasks at a glance
To configure EVPN VPLS over SRv6, perform the following tasks:
1. Creating and configuring an EVPN instance a.
b.
2. Applying for SRv6 SIDs from a locator a.
b.
Applying a locator to an EVPN instance
3. Configuring packet forwarding methods
Configuring the route recursion mode
Configuring SRv6 TE policy traffic steering
This task is required if the route recursion mode is SRv6 TE mode or SRv6 TE and SRv6 BE hybrid mode.
4.
5. Configuring PEs to exchange BGP EVPN routes
6. Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets
7.
(Optional.) Enabling ARP flood suppression
8. (Optional.) Maintaining the EVPN VPLS over SRv6 network
Configuring SRv6 PW packet statistics
Test the connectivity of an SRv6 PW
Creating a VSI
Restrictions and guidelines
For more information about the commands in this section, see VPLS commands in MPLS Command
Reference .
Procedure
1. Enter system view.
289
system-view
2. Enable L2VPN. l2vpn enable
By default, L2VPN is disabled.
3. Create a VSI and enter VSI view. vsi vsi-name
4. Bring up the VSI. undo shutdown
By default, a VSI is not administratively down.
Configuring an EVPN instance
About this task
The BGP EVPN routes advertised by a PE carry the RD and route targets configured for the EVPN instance of the routes.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
For more information about this command, see EVPN Command Reference .
3. Create an EVPN instance and enter VSI EVPN instance view. evpn encapsulation srv6
4. Configure an RD for the EVPN instance. route-distinguisher route-distinguisher
By default, no RD is configured for an EVPN instance.
For more information about this command, see EVPN Command Reference .
5. Configure route targets for the EVPN instance. vpn-target { vpn-target &<1-8> } [ both | export-extcommunity | import-extcommunity ]
By default, an EVPN instance does not have route targets.
For more information about this command, see EVPN Command Reference .
Parameter export-extcommunity
Description
Do not specify the same export targets for the EVPN instances of different VSIs.
Do not specify the same export targets for the EVPN instances created in different views (VSI view, VPN instance view, public instance view, and cross-connect group view).
As a best practice, the export targets configured for the following objects do not match the import targets configured for the EVPN instances created in cross-connect group view:
•
VPN instances.
•
The public instance.
•
EVPN instances created in VSI view, VPN instance view, and public instance view.
290
Parameter Description import-extcommunity
As a best practice, the import targets configured for the following objects do not match the export targets configured for the EVPN instances created in cross-connect group view:
•
VPN instances.
•
The public instance.
•
EVPN instances created in VSI view, VPN instance view, and public instance view.
6. (Optional.) Apply a tunnel policy to the EVPN instance. tunnel-policy tunnel-policy-name
By default, no tunnel policy is applied to an EVPN instance.
For more information about this command, see EVPN Command Reference .
Configuring SRv6 SIDs
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure the opcode portion.
Configure End.DT2U SIDs. opcode { opcode | hex hex-opcode } end-dt2u vsi vsi-name
Configure End.DT2UL SIDs. opcode { opcode | hex hex-opcode } end-dt2ul vsi vsi-name
Configure End.DT2M SIDs. opcode { opcode | hex hex-opcode } end-dt2m vsi vsi-name
Applying a locator to an EVPN instance
About this task
Perform this task to allocate SRv6 SIDs from a locator to the VSIs bound to an EVPN instance.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Apply a locator to the EVPN instance. segment-routing ipv6 locator locator-name [ dt2u-locator dt2u-locator-name ] [ dt2ul-locator dt2ul-locator-name ]
291
[ dx2-locator dx2-locator-name ] [ dx2l-locator dx2l-locator-name ]
[ auto-sid-disable ]
By default, no locator is applied to the EVPN instance on a VSI.
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an End.DT2M, End.DT2U, or End.DT2UL SID, it forwards the packet according to the route recursion mode.
•
SRv6 BE mode —In this mode, the PE first encapsulates the SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
•
SRv6 TE mode —In this mode, the PE first searches for a matching SRv6 TE policy based on the color attribute or next hop address of a matching route. Then, the PE adds an SRH to the packet. The SRH includes the End.DT2M, End.DT2U, or End.DT2UL SID and the SID list of the
SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy.
For more information, see "Configuring SRv6 TE policies."
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Prerequisites
To use the SRv6 TE mode or the SRv6 TE and SRv6 BE hybrid mode, you must configure SRv6 TE
policy traffic steering. For more information, see " Configuring SRv6 TE policy traffic steering ."
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Configure the route recursion mode. segment-routing ipv6 { best-effort | traffic-engineer
[ best-effort ] }
By default, a PE searches the IPv6 routing table based on the next hop of a matching EVPN route to forward traffic.
Configuring SRv6 TE policy traffic steering
Restrictions and guidelines for SRv6 TE policy traffic steering
This task is required if the route recursion mode is SRv6 TE mode or SRv6 TE and SRv6 BE hybrid mode.
Color-based traffic steering takes precedence over tunnel policy-based traffic steering.
292
Configuring color-based traffic steering
About this task
The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and next hop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the route to that SRv6 TE policy. When the device receives packets that match the route, it forwards the packets through the SRv6 TE policy.
Prerequisites
To use color-based traffic steering, you need to add the color extended community to BGP EVPN routes by using routing policy or other methods. For information about the routing policy configuration, see Layer 3—IP Routing Configuration Guide .
Restrictions and guidelines
Traffic steering is based on the greatest value among the color extended community attributes when the following conditions exist:
•
You specify the additive keyword for the apply extcommunity color clause in a routing policy, and specify the routing policy for the import route-policy command.
•
The received BGP EVPN routes carry the color extended community attribute.
Procedure
1. Enter system view. system-view
2. Enter routing policy node view. route-policy route-policy-name { deny | permit } node node-number
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
3. Set the color extended community attribute for BGP routes. apply extcommunity color color [ additive ]
By default, no color extended community attribute is set for BGP routes.
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
4. Return to system view. quit
5. Enter VSI view. vsi vsi-name
6. Enter VSI EVPN instance view. evpn encapsulation srv6
7. Apply the routing policy as an import policy to the EVPN instance.
import route-policy route-policy
By default, no import routing policy is applied to an EVPN instance. The EVPN instance does not filter received routes.
For more information about this command, see EVPN Command Reference .
8. Apply the routing policy as an export policy to the EVPN instance.
export route-policy route-policy
By default, no export routing policy is applied to an EVPN instance. The EVPN instance does not filter advertised routes.
For more information about this command, see EVPN Command Reference .
293
Configuring tunnel policy-based traffic steering
About this task
The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route and uses the paths in the SRv6 TE policy as public tunnels to forward private network packets. For more information about tunnel policies, see MPLS Configuration Guide .
Configuring a tunnel policy
1. Enter system view. system-view
2. Create a tunnel policy and enter tunnel policy view. tunnel-policy tunnel-policy-name [ default ]
3. Configure the tunnel policy. Choose a minimum of one option:
Bind tunnels to a destination IP address in a tunnel policy, so the tunnels can be used only for a specific VPN service. binding-destination dest-ipv6-address { srv6-policy group srv6-policy-group-id | srv6-policy { name policy-name | end-point ipv6 ipv6-address color color-value } } [ ignore-destination-check ]
[ down-switch ]
By default, a tunnel policy does not bind tunnels to a destination IP address.
Specify an SRv6 TE policy as a preferred tunnel of the tunnel policy. preferred-path srv6-policy { name srv6-policy-name | end-point ipv6 ipv6-address color color-value }
By default, no preferred tunnel is specified for a tunnel policy.
Configuring SRv6 TE policy load sharing for the tunnel policy. select-seq srv6-policy load-balance-number number
By default, no load sharing tunnel policy is configured.
For more information about the tunnel policy commands, see MPLS Command Reference .
Specifying the tunnel policy for an EVPN instance
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Specify a tunnel policy for the EVPN instance. tunnel-policy tunnel-policy-name
By default, no tunnel policy is specified for an EVPN instance.
For more information about this command, see EVPN Command Reference .
294
Mapping ACs to a VSI
Mapping a Layer 3 interface to a VSI
About this task
To assign the customer traffic on a Layer 3 interface to a VSI, map that interface to the VSI. The VSI uses its MAC address table to forward the customer traffic.
For more information about the command in this task, see VPLS commands in MPLS Command
Reference .
Procedure
1. Enter system view. system-view
2. Enter Layer 3 interface view.
interface interface-type interface-number
3. Map the Layer 3 interface to a VSI.
xconnect vsi vsi-name [ access-mode { ethernet | vlan } ]
By default, a Layer 3 interface is not mapped to a VSI.
Configuring PEs to exchange BGP EVPN routes
Restrictions and guidelines
For more information about BGP commands, see Layer 3—IP Routing Command Reference .
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Configure an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify the source interface of TCP connections to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the IPv6 address of the output interface in the optimal route to the BGP peer or peer group as the source address of TCP connections to the peer or peer group.
5. Enter BGP EVPN address family view. address-family l2vpn evpn
6. Enable BGP to exchange EVPN routes with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange EVPN routes with an IPv6 peer or peer group.
7. Enable BGP to advertise SRv6-encapsulated EVPN routes to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise encap-type srv6
By default, BGP advertises VXLAN-encapsulated EVPN routes to a peer or peer group.
295
Specifying a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets
Restrictions and guidelines
To ensure correct VPN traffic forwarding in an EVPN VPLS over SRv6 network, you must specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated EVPN VPLS packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated
EVPN VPLS packets.
Enabling ARP flood suppression
About this task
ARP flood suppression reduces ARP request broadcasts by enabling a PE to reply to ARP requests on behalf of VMs.
This feature snoops ARP requests, ARP responses, and BGP EVPN routes to populate the ARP flood suppression table with local and remote MAC addresses. If an ARP request has a matching entry, the PE replies to the request on behalf of the VM. If no match is found, the PE floods the request to both local and remote sites.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enable ARP flood suppression. arp suppression enable
By default, ARP flood suppression is disabled.
For more information about this command, see VXLAN Command Reference .
296
Configuring EVPN E-tree
About this task
Use EVPN E-tree to isolate traffic between ACs based on the AC roles. This feature can better control AC access and improve security.
Restrictions and guidelines
Inter-site EVPN E-tree controls communication between local ACs and remote ACs. You do not need to enable this feature if you want to control communication between local ACs.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Enable inter-site EVPN E-tree. e-tree enable
By default, inter-site EVPN E-tree is disabled.
For more information about this command, see EVPN Command Reference .
5. Return to system view. quit quit
6. Execute the following commands to configure a Layer 3 interface as a leaf AC: a. Enter Layer 3 interface view.
interface interface-type interface-number b. Configure the AC as a leaf AC.
xconnect vsi vsi-name leaf
If you do not specify the leaf keyword for an AC, the AC acts as a root AC.
For more information about this command, see VPLS commands in MPLS Command
Reference .
Configuring SRv6 PW packet statistics
About this task
This task enables the packet statistics feature for all SRv6 PWs in a VSI EVPN isntance.
To display inbound packet statistics for all SRv6 PWs, use the display l2vpn statistics srv6-pw inbound command.
To display outbound packet statistics for each SRv6 PW, use the display l2vpn peer srv6 verbose command.
To clear SRv6 PW packet statistics, use the reset l2vpn statistics srv6-pw command.
Procedure
1. Enter system view.
297
system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Enable SRv6 PW packet statistics. statistics enable
By default, SRv6 PW packet statistics is disabled.
Test the connectivity of an SRv6 PW
Using ping to test the connectivity of an SRv6 PW
About this task
In an EVPN VPLS over SRv6 network, a PE transmits data packets to a remote PE over an SRv6
PW. Perform this task to test the connectivity of the SRv6 PW from the local PE to the remote PE when packet loss or traffic interruption occurs between the PEs.
The test process is as follows:
1. The local PE constructs an MPLS echo request packet and searches for the SRv6 tunnel that matches the specified VSI. After obtaining the End.DT2U SID of the SRv6 tunnel, the PE adds a UDP header and an IPv6 header to the packet and forwards the packet to the remote PE.
2. Upon receiving the MPLS echo request packet, the remote PE replies to the request packet.
3. The local PE identifies the connectivity of the SRv6 PW based on whether it has received MPLS echo reply packets from the remote PE and the reply response time. In addition, the local PE outputs statistics about the ping operation.
Procedure
To test the connectivity of an SRv6 PW from the local PE to the remote PE in an EVPN VPLS over
SRv6 network, execute the following command in any view: ping evpn vpls srv6 vsi vsi-name mac mac-address [ -a source-ipv6 | -c count
| -h hop-limit | -m interval | -r reply-mode | -s packet-size | -t time-out |
-tc tc ] *
Using tracert to test the connectivity of an SRv6 PW
About this task
In an EVPN VPLS over SRv6 network, a PE transmits data packets to a remote PE over an SRv6
PW. Perform this task to trace the path of the SRv6 PW from the local PE to the remote PE when packet loss or traffic interruption occurs between the PEs. This task helps you locate the failed nodes on the path.
The test process is as follows:
1. The local PE constructs an MPLS echo request packet and searches for the SRv6 tunnel that matches the specified VSI. After obtaining the End.DT2U SID of the SRv6 tunnel, the PE adds a UDP header and an IPv6 header to the packet and forwards the packet to the remote PE. In the IPv6 header, the value of the Hop limit field is set to 1.
2. When the next node receives the packet, the value of the Hop limit field changes to 0. Then, the node sends an ICMPv6 timeout packet to the first node (the local PE).
298
3. When the local PE receives the ICMPv6 timeout packet, it increases the value of the Hop limit field by one in the MPLS echo request packet. Then, the local PE forwards the request packet to the remote PE. The value of the Hop limit field is 2.
4. The value of the Hop limit field decreases by one each time the request packet reaches a node.
When the value of the Hop limit field decreases to 0, the node that receives the request packet responds to the first node with an ICMPv6 timeout packet. If the node that receives the request packet is the destination node, it sends an MPLS echo reply packet to the first node.
5. The local PE repeats the previous step until one of the following conditions exist:
The local PE has not received any reply packets before the reply timeout time expires for all request packets.
The local PE receives a reply packet from the remote PE.
6. The local PE identifies the connectivity of the SRv6 PW based on whether it has received MPLS echo reply packets from the remote PE and the reply response time. In addition, the local PE outputs statistics about the tracert operation.
Procedure
To trace the path of an SRv6 PW from the local PE to the remote PE in an EVPN VPLS over SRv6 network, execute the following command in any view: tracert evpn vpls srv6 vsi vsi-name mac mac-address [ -a source-ip | -h hop-limit | -r reply-mode | -t time-out | -tc tc ] *
Verifying and maintaining EVPN VPLS over SRv6
Displaying BGP EVPN route information
Perform display tasks in any view.
•
Display BGP peer group information. display bgp [ instance instance-name ] group l2vpn evpn [ group-name group-name ]
For more information about this command, see Layer 3—IP Routing Command Reference .
•
Display BGP peer or peer group information. display bgp [ instance instance-name ] peer l2vpn evpn [ ipv4-address mask-length | { ipv4-address | group-name group-name } log-info |
[ ipv4-address ] verbose ]
For more information about this command, see Layer 3—IP Routing Command Reference .
•
Display information about BGP update groups. display bgp [ instance instance-name ] update-group l2vpn evpn
[ ipv4-address ]
For more information about this command, see Layer 3—IP Routing Command Reference .
•
Display BGP EVPN routes. display bgp [ instance instance-name ] l2vpn evpn [ peer { ipv4-address
| ipv6-address } { advertised-routes | received-routes } [ statistics ]
| [ route-distinguisher route-distinguisher | route-type
{ auto-discovery | es | imet | mac-ip } ] * [ { evpn-route route-length | evpn-prefix } [ advertise-info ] | ipv4-address | ipv6-address | mac-address ] | statistics ]
For more information about this command, see EVPN Command Reference .
299
Displaying EVPN VPLS over SRv6 running status
Perform display tasks in any view.
•
Display information about peers that are automatically discovered through BGP. display evpn auto-discovery { mac-ip [ srv6 ] [ peer ip-address ] [ vsi vsi-name ] | macip-prefix [ nexthop next-hop ] [ count ] }
For more information about this command, see EVPN Command Reference .
•
Display EVPN ES information. display evpn es { local [ count | [ vsi vsi-name ] [ verbose ] ] | remote
[ vsi vsi-name ] [ nexthop next-hop ] [ verbose ]}
For more information about this command, see EVPN Command Reference .
•
Display VSI information. display l2vpn vsi [ evpn-srv6 | name vsi-name ] [ count | verbose ]
•
Display L2VPN SRv6 information. display l2vpn peer srv6 [ vsi vsi-name ] [ state-machine | verbose ]
Displaying MAC address and ARP entries
Perform display tasks in any view.
•
Display IPv6 EVPN MAC address entries. display evpn ipv6 route mac [ srv6 ] [ local | remote ] [ vsi vsi-name ]
[ count ]
For more information about this command, see EVPN Command Reference .
•
Display EVPN MAC address entries. display evpn route mac [ srv6 ] [ local | remote ] [ vsi vsi-name ]
[ mac-address mac-address ] [ count ]
For more information about this command, see EVPN Command Reference .
•
Display information about L2VPN MAC address entries. display l2vpn mac-address [ vsi vsi-name ] [ dynamic ] [ count | verbose ]
For more information about this command, see VXLAN Command Reference .
•
Display EVPN ARP flood suppression entries. display evpn route arp suppression [ srv6 ] [ local | remote ] [ vsi vsi-name ] [ ip ip-address ] [ count ]
For more information about this command, see EVPN Command Reference .
Displaying EVPN VPLS over SRv6 forwarding entries
Perform display tasks in any view.
•
Display EVPN VSI forwarding entries. display l2vpn forwarding evpn [ vsi [ name vsi-name ] [ verbose ] ] [ slot slot-number ]
For more information about this command, see EVPN Command Reference .
•
Display site-facing interfaces excluded from traffic forwarding by split horizon. display l2vpn forwarding evpn split-horizon { ac interface interface-type interface-number | tunnel tunnel-number } [ slot slot-number ]
300
For more information about this command, see EVPN Command Reference .
•
Display L2VPN SRv6 forwarding entries. display l2vpn forwarding srv6 [ vsi vsi-name ] [ slot slot-number ]
[ verbose ]
Displaying and clearing EVPN VPLS over SRv6 statistics
To display inbound packet statistics for SRv6 PWs, execute the following command in any view: display l2vpn statistics srv6-pw inbound [ vsi vsi-name ]
To clear SRv6 PW packet statistics, execute the following command in user view: reset l2vpn statistics srv6-pw [ vsi vsi-name [ peer ipv6-address ] ]
EVPN VPLS over SRv6 configuration examples
Example: Setting up an SRv6 tunnel between single-homed
EVPN VPLS sites
Network configuration
communicate through EVPN VPLS over the IPv6 backbone network.
Figure 75 Network diagram
IPv6 network
Loop0 Loop0
GE0/0/1
PE 1
GE0/0/2
GE0/0/1
P
Loop0
GE0/0/2
GE0/0/2
PE 2
GE0/0/1
GE0/0/1
Site 1
CE 1
Device
CE 1
PE 1
CE 2
Interface
GE0/0/1
Loop0
GE0/0/1
GE0/0/2
GE0/0/1
Procedure
1. Configure CE 1.
<CE1> system-view
IP address
10::1/64
1::1/128
-
20::1/64
10::2/64
301
Device
P
PE 2
GE0/0/1
CE 2
Site 2
Interface
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
3::3/128
20::2/64
30::1/64
2::2/128
-
30::2/64
[ CE1 ] interface gigabitethernet 0/0/1
[ CE1-GigabitEthernet0/0/1 ] ipv6 address 10::1 64
[ CE1-GigabitEthernet0/0/1 ] quit
2. Configure PE 1:
# Run OSPFv3 on PE 1 and use OSPFv3 to advertise SIDs.
<PE1> system-view
[ PE1 ] ospfv3
[ PE1-ospfv3-1 ] router-id 1.1.1.1
[ PE1-ospfv3-1 ] segment-routing ipv6 locator aaa
[ PE1-ospfv3-1 ] area 0.0.0.0
[ PE1-ospfv3-1-area-0.0.0.0
] quit
[ PE1-ospfv3-1 ] quit
# Configure interface Loopback 0.
[ PE1 ] interface loopback 0
[ PE1-LoopBack0 ] ipv6 address 1::1 128
[ PE1-LoopBack0 ] ospfv3 1 area 0
[ PE1-LoopBack0 ] quit
# Enable L2VPN.
[ PE1 ] l2vpn enable
# Configure GigabitEthernet 0/0/2, the interface connected to P.
[ PE1 ] interface gigabitethernet 0/0/2
[ PE1-GigabitEthernet0/0/2 ] ipv6 address 20::1 64
[ PE1-GigabitEthernet0/0/2 ] ospfv3 1 area 0
[ PE1-GigabitEthernet0/0/2 ] undo shutdown
[ PE1-GigabitEthernet0/0/2 ] quit
# Configure PE 1 to establish IBGP neighbor relationship with PE 2 and enable BGP EVPN to advertise routes in SRv6 encapsulation to PE 2.
[ PE1 ] bgp 100
[ PE1-bgp-default ] peer 2::2 as-number 100
[ PE1-bgp-default ] peer 2::2 connect-interface loopback 0
[ PE1-bgp-default ] address-family l2vpn evpn
[ PE1-bgp-default-evpn ] peer 2::2 enable
[ PE1-bgp-default-evpn ] peer 2::2 advertise encap-type srv6
[ PE1-bgp-default-evpn ] quit
[ PE1-bgp-default ] quit
# Create VSI vpna , create an EVPN instance for it, and enable SRv6 encapsulation. Configure an RD and route targets for the EVPN instance, enable the SID-route-recursion feature, and apply a locator to the EVPN instance.
[ PE1 ] vsi vpna
[ PE1-vsi-vpna ] evpn encapsulation srv6
[ PE1-vsi-vpna-evpn-srv6 ] route-distinguisher 1:1
[ PE1-vsi-vpna-evpn-srv6 ] vpn-target 1:1 export-extcommunity
[ PE1-vsi-vpna-evpn-srv6 ] vpn-target 1:1 import-extcommunity
[ PE1-vsi-vpna-evpn-srv6 ] segment-routing ipv6 best-effort
[ PE1-vsi-vpna-evpn-srv6 ] segment-routing ipv6 locator aaa
[ PE1-vsi-vpna-evpn-srv6 ] quit
# Map GigabitEthernet 0/0/1 to the VSI.
[ PE1 ] interface gigabitethernet 0/0/1
302
[ PE1-GigabitEthernet0/0/1 ] xconnect vsi vpna
[ PE1-GigabitEthernet0/0/1 ] quit
# Specify a source IP address for the outer IPv6 header of SRv6-encapsulated packets, and configure a locator to apply for End.DT2U SIDs and End.DT2M SIDs.
[ PE1 ] segment-routing ipv6
[ PE1-segment-routing-ipv6 ] encapsulation source-address 1::1
[ PE1-segment-routing-ipv6 ] locator aaa ipv6-prefix 100:: 64 static 32
[ PE1-segment-routing-ipv6-locator-aaa ] quit
[ PE1-segment-routing-ipv6 ] quit
3. Configure PE 2:
# Run OSPFv3 on PE 2 and use OSPFv3 to advertise SIDs.
<PE2> system-view
[ PE2 ] ospfv3
[ PE2-ospfv3-1 ] router-id 2.2.2.2
[ PE2-ospfv3-1 ] segment-routing ipv6 locator aaa
[ PE2-ospfv3-1 ] area 0.0.0.0
[ PE2-ospfv3-1-area-0.0.0.0
] quit
[ PE2-ospfv3-1 ] quit
# Configure interface Loopback 0.
[ PE2 ] interface loopback 0
[ PE2-LoopBack0 ] ipv6 address 2::2 128
[ PE2-LoopBack0 ] ospfv3 1 area 0
[ PE2-LoopBack0 ] quit
# Enable L2VPN.
[ PE2 ] l2vpn enable
# Configure GigabitEthernet 0/0/2, the interface connected to P.
[ PE2 ] interface gigabitethernet 0/0/2
[ PE2-GigabitEthernet0/0/2 ] ipv6 address 30::2 64
[ PE2-GigabitEthernet0/0/2 ] ospfv3 1 area 0.0.0.0
[ PE2-GigabitEthernet0/0/2 ] undo shutdown
[ PE2-GigabitEthernet0/0/2 ] quit
# Configure PE 2 to establish IBGP neighbor relationship with PE 1, and enable BGP EVPN to advertise routes in SRv6 encapsulation to PE 1.
[ PE2 ] bgp 100
[ PE2-bgp-default ] peer 1::1 as-number 100
[ PE2-bgp-default ] peer 1::1 connect-interface loopback 0
[ PE2-bgp-default ] address-family l2vpn evpn
[ PE2-bgp-default-evpn ] peer 1::1 enable
[ PE2-bgp-default-evpn ] peer 1::1 advertise encap-type srv6
[ PE2-bgp-default-evpn ] quit
[ PE2-bgp-default ] quit
# Create VSI vpna , create an EVPN instance for it, and enable SRv6 encapsulation. Configure an RD and route targets for the EVPN instance, enable the SID-route-recursion feature, and apply a locator to the EVPN instance.
[ PE2 ] vsi vpna
[ PE2-vsi-vpna ] evpn encapsulation srv6
[ PE2-vsi-vpna-evpn-srv6 ] route-distinguisher 1:1
[ PE2-vsi-vpna-evpn-srv6 ] vpn-target 1:1 export-extcommunity
303
[ PE2-vsi-vpna-evpn-srv6 ] vpn-target 1:1 import-extcommunity
[ PE2-vsi-vpna-evpn-srv6 ] segment-routing ipv6 best-effort
[ PE2-vsi-vpna-evpn-srv6 ] segment-routing ipv6 locator aaa
[ PE2-vsi-vpna-evpn-srv6 ] quit
# Map GigabitEthernet 0/0/1 to the VSI.
[ PE2 ] interface gigabitethernet 0/0/1
[ PE2-GigabitEthernet0/0/1 ] xconnect vsi vpna
[ PE2-GigabitEthernet0/0/1 ] quit
# Specify a source IP address for the outer IPv6 header of SRv6-encapsulated packets, and configure a locator to apply for End.DT2U SIDs and End.DT2M SIDs.
[ PE2 ] segment-routing ipv6
[ PE2-segment-routing-ipv6 ] encapsulation source-address 2::2
[ PE2-segment-routing-ipv6 ] locator aaa ipv6-prefix 200:: 64 static 32
[ PE2-segment-routing-ipv6-locator-aaa ] quit
[ PE2-segment-routing-ipv6 ] quit
4. Configure P:
# Run OSPFv3 on P.
<P> system-view
[ P ] ospfv3
[ P-ospfv3-1 ] router-id 3.3.3.3
[ P-ospfv3-1 ] area 0.0.0.0
[ P-ospfv3-1-area-0.0.0.0
] quit
[ P-ospfv3-1 ] quit
# Configure IPv6 addresses for interfaces and run OSPFv3 on the interfaces.
[ P ] interface loopback 0
[ P-LoopBack0 ] ipv6 address 3::3 128
[ P-LoopBack0 ] ospfv3 1 area 0
[ P-LoopBack0 ] quit
[ P ] interface gigabitethernet 0/0/1
[ P-GigabitEthernet0/0/1 ] ipv6 address 20::2 64
[ P-GigabitEthernet0/0/1 ] ospfv3 1 area 0
[ P-GigabitEthernet0/0/1 ] quit
[ P ] interface gigabitethernet 0/0/2
[ P-GigabitEthernet0/0/2 ] ipv6 address 30::1 64
[ P-GigabitEthernet0/0/2 ] ospfv3 1 area 0
[ P-GigabitEthernet0/0/2 ] quit
5. Configure CE 2.
<CE2> system-view
[ CE2 ] interface gigabitethernet 0/0/1
[ CE2-GigabitEthernet0/0/1 ] ipv6 address 10::2 64
[ CE2-GigabitEthernet0/0/1 ] quit
Verifying the configuration
# Verify that an SRv6 tunnel has been established between PE 1 and PE 2.
[PE1] display l2vpn peer srv6
Total number of SRv6 Tunnels: 1
1 up, 0 blocked, 0 down
304
VSI Name: vpna
Peer : 2::2
Flag : Main
State : Up
# Verify that the SRv6 forwarding information on PE 1 is correct.
[PE1] display l2vpn forwarding srv6
Total number of VSIs: 1
Total number of SRv6 tunnels: 1, 1 up, 0 blocked, 0 down
VSI Name : vpna
Link ID : 0x9000000 Type: BE State: Up
In SID : 100::1:0:1
Out SID : 200::1:0:0
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
305
Configuring distributed SRv6 gateways
About distributed SRv6 gateways
Distributed SRv6 gateways provide Layer 3 forwarding for traffic in different subnets across sites and provide Layer 3 connectivity to the external network.
Distributed SRv6 gateway deployment
As shown in Figure 76 , each site's PE acts as a distributed SRv6 gateway to perform Layer 3
forwarding for the traffic of the local site. A PE acts as a border gateway to the external Layer 3 network. On all the SRv6 gateways and border gateway, you must create VSI interfaces as gateway interfaces. The same VSI interface on multiple SRv6 gateways must be assigned the same IP address. This IP address will be used as the gateway address for users in the EVPN VPLS over
SRv6 network.
Figure 76 Distributed SRv6 gateway deployment
PE
SRv6 GW
EVPN VPLS over SRv6
SRv
6 tunnel
SRv6 tunnel
L3 network
PE
Border
SRv
6 tunnel
PE
SRv6 GW
SRv6 tunnel
PE
SRv6 GW
VTEP
CE
CE CE CE CE CE
Site 1 Site 2 Site 3 Site 4
Site 5
Site 6
Control plane working mechanisms
A distributed SRv6 gateway allocates an End.DT4 or End.DT46 SID to a MAC/IP advertisement route to identify the VPN instance to which the packets that match the route belong.
As shown in Figure 77 , the ARP learning and BGP EVPN route advertisement process is as follows:
1. CE 2 sends an ARP request to obtain the MAC address of the gateway (a VSI interface on PE
2).
2. When PE 2 receives the ARP request from an AC, it identifies the VSI of the AC, and searches for the VSI interface associated with the VSI.
3. PE 2 relies to the ARP request with the MAC address of the VSI interface. At the same time, PE
2 learns the ARP information of CE 2 to the VPN instance bound to the VSI interface and generates a FIB entry for the ARP information.
306
4. PE 2 advertises the ARP information to PE 1 in a MAC/IP advertisement route. The route includes the End.DT4 or End.DT46 SID allocated by PE 2 to the VPN instance.
5. PE 1 matches the route targets in the route with the local import route targets for a matching
VPN instance. If a matching VPN instance is found, PE 1 learns the ARP information to the ARP table of the matching VPN instance and generates a FIB entry for the ARP information. The FIB entry includes the End.DT4 or End.DT46 SID allocated by PE 2.
In this process, both PE 1 and PE 2 have learned the ARP information of CE 2 and CE 2 has learned the MAC address of the gateway. In the same way, PE 1 and PE 2 can learn the ARP information of
CE 1 and CE 1 can learn the MAC address of the gateway.
Figure 77 Control plane working mechanisms
PE 1
P
AC
PE 2
ARP request
ARP response
AC
EVPN routes with
DT4/DT46 SID
CE 1 CE 2
Data plane traffic forwarding
A distributed SRv6 gateway supports SRv6 BE mode, SRv6 TE mode, and SRv6 TE and SRv6 BE hybrid mode.
The following information uses the SRv6 BE mode as an example to illustrate the forwarding process for traffic from CE 1 to CE 2:
1. CE 1 sends a packet destined for CE 2 to gateway PE 1. The destination MAC address of the packet is the MAC address of a VSI interface on PE 1.
2. When PE 1 receives the packet from an AC, it finds that the destination MAC address of the packet is the MAC address of a local VSI interface. Then, PE 1 performs the following operations: a. Removes the frame header of the packet. b. Searches for a matching entry in the FIB of the VPN instance bound to the VSI interface based on the destination IP address of the packet. The matching entry contains the
End.DT4 or End.DT46 SID allocated by PE 2 to the VPN instance.
3. PE 1 encapsulates an outer IPv6 header to the packet and forwards the packet to PE 2.
The destination IPv6 address of the outer IPv6 header is the End.DT4 or End.DT46 SID.
The source IPv6 address of the outer IPv6 header is manually configured.
4. When PE 2 receives the packet, it searches the FIB of the VPN instance identified by the
End.DT4 or End.DT46 SID for the output interface. The output interface is an AC. Then, PE 2 removes the outer IPv6 header from the packet andforwards the packet out of the AC to CE 2.
307
Restrictions and guidelines: Distributed SRv6 gateway configuration
Make sure a VSI interface uses the same MAC address to provide service on distributed SRv6 gateways connected to IPv4 sites.
If both ARP flood suppression and local proxy ARP are enabled on a distributed SRv6 gateway, only local proxy ARP takes effect. As a best practice, do not use these features together on distributed
SRv6 gateways.
Distributed SRv6 gateway tasks at a glance
To configure a distributed SRv6 gateway:
1.
2.
3.
4.
Configuring a VSI interface as a distributed SRv6 gateway
5. Configuring packet forwarding methods
Configuring the route recursion mode
Configuring SRv6 TE policy traffic steering
This task is required when the SRv6 TE or SRv6 TE and SRv6 BE hybrid mode is used.
6.
7. Configuring PEs to exchange BGP EVPN routes
8.
Specifying a source address for the IPv6 packets encapsulated by a distributed SRv6 gateway
9.
Configuring BGP EVPN route redistribution and advertisement
10.
Managing remote MAC address entries and remote ARP learning
Prerequisites for distributed SRv6 gateway configuration
For a VM that requires access to the external network at Layer 3, specify the VM's VSI interface on the border gateway as the next hop by using one of the following methods:
•
Configure a static route.
•
Configure a routing policy, and apply the policy by using the apply default-next-hop or apply next-hop command. For more information about configuring routing policies, see routing policy configuration in Layer 3—IP Routing Configuration Guide .
Creating a VSI
Restrictions and guidelines
For more information about the commands in this task, see VPLS commands in MPLS Command
Reference .
Procedure
1. Enter system view.
308
system-view
2. Enable L2VPN. l2vpn enable
By default, L2VPN is disabled.
3. Create a VSI and enter VSI view. vsi vsi-name
4. Bring up the VSI. undo shutdown
By default, a VSI is not administratively down.
Configuring an EVPN instance
About this task
The BGP EVPN routes advertised by a PE carry the RD and route targets configured for the EVPN instance of the routes.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Create an EVPN instance and enter EVPN instance view. evpn encapsulation srv6
4. Specify an RD for the EVPN instance. route-distinguisher route-distinguisher
By default, no RD is specified for an EVPN instance.
For more information about this command, see EVPN Command Reference .
5. Configure route targets for the EVPN instance. vpn-target { vpn-target &<1-8> } [ both | export-extcommunity | import-extcommunity ]
By default, an EVPN instance does not have route targets.
For more information about this command, see EVPN Command Reference .
Parameter export-extcommunity
Description
Do not specify the same export targets for different EVPN instances.
Do not specify the same export targets for the EVPN instances created in different views (VSI view, VPN instance view, public instance view, and cross-connect group view).
As a best practice, the export targets configured for the following objects do not match the import targets configured for the EVPN instances created in cross-connect group view:
•
VPN instances.
•
The public instance.
•
EVPN instances created in VSI view, VPN instance view, and public instance view. import-extcommunity
As a best practice, the import targets configured for the following objects do not match the export targets configured for the EVPN
309
Parameter Description instances created in cross-connect group view:
•
VPN instances.
•
The public instance.
•
EVPN instances created in VSI view, VPN instance view, and public instance view.
6. (Optional.) Apply a tunnel policy to the EVPN instance. tunnel-policy tunnel-policy-name
By default, no tunnel policy is applied to an EVPN instance.
For more information about this command, see EVPN Command Reference .
Configuring SRv6 SIDs
Restrictions and guidelines
For more information about the commands in this task, see SRv6 commands in Segment Routing
Command Reference .
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure the opcode portion.
Configure End.DT4 SIDs.
opcode opcode end-dt4 [ vpn-instance vpn-instance-name [ evpn ] ]
The specified VPN instance must exist. You cannot configure the same End.DT4 SID for different VPN instances.
Configure End.DT46 SIDs.
opcode opcode end-dt46 [ vpn-instance vpn-instance-name [ evpn ] ]
The specified VPN instance must exist. You cannot configure the same End.DT46 SID for different VPN instances.
Configuring a VSI interface as a distributed SRv6 gateway
About this task
To save Layer 3 interface resources on a distributed SRv6 gateway, multiple EVPN VPLS networks can share one VSI interface. You can assign multiple IPv4 addresses to the VSI interface for the
EVPN VPLS networks to use as gateway addresses.
When multiple EVPN VPLS networks share a VSI interface, you must specify the subnet of each VSI for the VSI interface to identify the VSI of a packet. The subnets must be unique.
310
Procedure
1. Enter system view. system-view
2. Create a VSI interface and enter VSI interface view.
interface vsi-interface vsi-interface-id
For more information about this command, see VXLAN Command Reference .
3. Assign an IP address to the VSI interface. ip address ip-address { mask | mask-length } [ sub ]
By default, no IP address is assigned to a VSI interface.
4. Assign a MAC address to the VSI interface. mac-address mac-address
By default, no MAC address is configured for a VSI interface.
To ensure correct forwarding after VM migration, you must assign the same MAC address to the VSI interfaces of an EVPN VPLS network on all distributed SRv6 gateways.
5. Specify the VSI interface as a distributed gateway. distributed-gateway local
By default, a VSI interface is not a distributed gateway.
For more information about this command, see VXLAN Command Reference .
6. (Optional.) Enable local proxy ARP. local-proxy-arp enable [ ip-range startIP to endIP ]
By default, local proxy ARP is disabled.
For more information about this command, see proxy ARP commands in Layer 3—IP Services
Command Reference .
7. Return to system view. quit
8. Enter VSI view. vsi vsi-name
9. Specify the VSI interface as the gateway interface for the VSI.
gateway vsi-interface vsi-interface-id
By default, no gateway interface is specified for a VSI.
For more information about this command, see VXLAN Command Reference .
10. Assign a subnet to the VSI.
gateway subnet ipv4-address wildcard-mask
By default, no subnet exists on a VSI.
For more information about this command, see VXLAN Command Reference .
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an End.DT4 or End.DT46 SID, it forwards the packet according to the route recursion mode.
•
SRv6 BE mode —In this mode, the PE first encapsulates the SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
311
•
SRv6 TE mode —In this mode, the PE first searches for a matching SRv6 TE policy based on the color attribute or next hop address of a matching route. Then, the PE adds an SRH to the packet. The SRH includes the End.DT4 or End.DT46 SID and the SID list of the SRv6 TE policy.
Finally, the PE forwards the encapsulated packet through the SRv6 TE policy.
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Prerequsites
To use the SRv6 TE mode or the SRv6 TE and SRv6 BE hybrid mode, you must configure SRv6 TE
policy traffic steering. For more information, see " Configuring SRv6 TE policy traffic steering ."
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter EVPN instance view. evpn encapsulation srv6
4. Configure the route recursion mode. segment-routing ipv6 { best-effort | traffic-engineer
[ best-effort ] }
By default, a PE searches the IPv6 routing table based on the next hop of a matching EVPN route to forward traffic.
Configuring SRv6 TE policy traffic steering
Restrictions and guidelines for SRv6 TE policy traffic steering
This task is required if the route recursion mode is SRv6 TE mode or SRv6 TE and SRv6 BE hybrid mode.
Color-based traffic steering takes precedence over tunnel policy-based traffic steering.
Configuring color-based traffic steering
About this task
The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and next hop address of a BGP EVPN route. If a matching SRv6 TE policy exists, the device recurses the route to that SRv6 TE policy. When the device receives packets that match the route, it forwards the packets through the SRv6 TE policy.
Prerequisites
To use color-based traffic steering, you need to add the color extended community to BGP EVPN routes by using routing policy or other methods. For information about the routing policy configuration, see Layer 3—IP Routing Configuration Guide .
Restrictions and guidelines
Traffic steering is based on the greatest value among the color extended community attributes when the following conditions exist:
312
•
You specify the additive keyword for the apply extcommunity color clause in a routing policy, and specify the routing policy for the import route-policy command.
•
The received BGP EVPN routes carry the color extended community attribute.
Procedure
1. Enter system view. system-view
2. Enter routing policy node view. route-policy route-policy-name { deny | permit } node node-number
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
3. Set the color extended community attribute for BGP routes. apply extcommunity color color [ additive ]
By default, no color extended community attribute is set for BGP routes.
For more information about this command, see routing policy commands in Layer 3—IP
Routing Command Reference .
4. Return to system view. quit
5. Enter VSI view. vsi vsi-name
6. Enter VSI EVPN instance view. evpn encapsulation srv6
7. Apply the routing policy as an import policy to the EVPN instance.
import route-policy route-policy
By default, no import routing policy is applied to an EVPN instance. The EVPN instance does not filter received routes.
8. Apply the routing policy as an export policy to the EVPN instance.
export route-policy route-policy
By default, no export routing policy is applied to an EVPN instance. The EVPN instance does not filter advertised routes.
Configuring tunnel policy-based traffic steering
About this task
The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route and uses the paths in the policy as public tunnels to forward private network packets.
For more information about tunnel policies, see MPLS Configuration Guide .
Creating a tunnel policy
1. Enter system view. system-view
2. Create a tunnel policy and enter tunnel policy view. tunnel-policy tunnel-policy-name [ default ]
3. Configure the tunnel policy. Choose a minimum of one option:
Bind tunnels to a destination IP address in a tunnel policy, so the tunnels can be used only for a specific VPN service.
313
binding-destination dest-ipv6-address { srv6-policy group srv6-policy-group-id | srv6-policy { name policy-name | end-point ipv6 ipv6-address color color-value } } [ ignore-destination-check ]
[ down-switch ]
By default, a tunnel policy does not bind tunnels to a destination IP address.
Specify an SRv6 TE policy as a preferred tunnel of the tunnel policy. preferred-path srv6-policy { name srv6-policy-name | end-point ipv6 ipv6-address color color-value }
By default, no preferred tunnel is specified for a tunnel policy.
Configuring SRv6 TE policy load sharing for the tunnel policy. select-seq srv6-policy load-balance-number number
By default, no load sharing tunnel policy is configured.
For more information about the tunnel policy commands, see MPLS Command Reference .
Specifying a tunnel policy for an EVPN instance
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Specify a tunnel policy for the EVPN instance. tunnel-policy tunnel-policy-name
By default, no tunnel policy is specified for an EVPN instance.
Mapping ACs to a VSI
Mapping a Layer 3 interface to a VSI
About this task
To assign the customer traffic on a Layer 3 interface to a VSI, map that interface to the VSI. The VSI uses its MAC address table to forward the customer traffic.
For more information about the command in this task, see VPLS commands in MPLS Command
Reference .
Procedure
1. Enter system view. system-view
2. Enter Layer 3 interface view.
interface interface-type interface-number
3. Map the Layer 3 interface to a VSI.
xconnect vsi vsi-name [ access-mode { ethernet | vlan } ] [ track track-entry-number &<1-3> ]
By default, a Layer 3 interface is not mapped to a VSI.
314
Configuring PEs to exchange BGP EVPN routes
Restrictions and guidelines
For more information about BGP commands, see Layer 3—IP Routing Command Reference .
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Configure an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify the source interface of TCP connections to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the IPv6 address of the output interface in the optimal route to a BGP peer or peer group as the source address of TCP connections to the peer or peer group.
5. Enter BGP EVPN address family view. address-family l2vpn evpn
6. Enable BGP to exchange EVPN routes with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange EVPN routes with an IPv6 peer or peer group.
7. Enable BGP to advertise SRv6-encapsulated EVPN routes to a peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } advertise encap-type srv6
By default, BGP advertises VXLAN-encapsulated EVPN routes to a peer or peer group.
Specifying a source address for the IPv6 packets encapsulated by a distributed SRv6 gateway
Restrictions and guidelines
To ensure that a distributed SRv6 gateway can forward data traffic, you must specify s source address for the outer IPv6 header encapsulated by the distributed SRv6 gateway.
You can specify any IPv6 address as the source address. As a best practice, specify an unused IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Specify a source address for the IPv6 packets encapsulated by the distributed SRv6 gateway.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the IPv6 packets encapsulated by a distributed
SRv6 gateway.
315
Configuring BGP EVPN route redistribution and advertisement
Redistributing MAC/IP advertisement routes into BGP unicast routing tables
About this task
This task enables the device to redistribute received MAC/IP advertisement routes that contain ARP information into a BGP unicast routing table.
•
If you perform this task for the BGP IPv4 unicast address family, the device will redistribute the routes into the BGP IPv4 unicast routing table. In addition, the device will advertise the routes to the local site.
•
If you perform this task for the BGP-VPN IPv4 unicast address family, the device will redistribute the routes into the BGP-VPN IPv4 unicast routing table of the corresponding VPN instance. To advertise the routes to the local site, you must configure the advertise l2vpn evpn command.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 unicast address family view or BGP-VPN IPv4 unicast address family view.
Enter BGP IPv4 unicast address family view.
address-family ipv4
Execute the following commands in sequence to enter BGP-VPN IPv4 unicast address family view.
ip vpn-instance vpn-instance-name address-family ipv4
4. Redistribute MAC/IP advertisement routes that contain ARP information into the BGP-VPN
IPv4 unicast routing table and allow advertisement of these routes. import evpn mac-ip
By default, MAC/IP advertisement routes that contain ARP information can be redistributed into the BGP IPv4 unicast routing table in an SRv6 network, but advertisement of these routes is not allowed.
Enabling BGP EVPN route advertisement to the local site
About this task
This feature enables the device to advertise BGP EVPN routes to the local site after the device adds the routes to the routing table of a VPN instance.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view.
316
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view. address-family ipv4 [ unicast ]
5. Enable BGP EVPN route advertisement to the local site. advertise l2vpn evpn
By default, BGP EVPN route advertisement to the local site is enabled.
Managing remote MAC address entries and remote ARP learning
Disabling MAC address advertisement
About this task
The MAC information and ARP information advertised by the PE overlap. To avoid duplication, disable MAC address advertisement and withdraw the MAC addresses advertised to remote PEs.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Disable MAC address advertisement and withdraw advertised MAC addresses. mac-advertising disable
By default, MAC address advertisement is enabled.
Disabling learning of MAC addresses from ARP information
About this task
The MAC information and ARP information advertised by a remote PE overlap. To avoid duplication, disable the learning of MAC addresses from ARP information. EVPN will learn remote MAC addresses only from the MAC information advertised from remote sites.
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name
3. Enter VSI EVPN instance view. evpn encapsulation srv6
4. Disable the EVPN instance from learning MAC addresses from ARP information. arp mac-learning disable
317
By default, an EVPN instance learns MAC addresses from ARP information.
Verifying and maintaining distributed SRv6 gateways
Perform display tasks in any view.
•
Display EVPN ARP information. display evpn route arp [ local | remote ] [ public-instance |
vpn-instance vpn-instance-name ] [ count ]
•
Display EVPN routing table information.
display evpn routing-table [ ipv6 ] { public-instance | vpn-instance vpn-instance-name } [ count ]
•
Display IPv4 routing table information. display ip routing-table [ all-vpn-instance | vpn-instance vpn-instance-name ] [ verbose ]
Distributed SRv6 gateway configuration examples
Example: Configuring distributed SRv6 gateways
Network configuration
As shown in Figure 78 , PE 1 and PE 2 are distributed SRv6 gateways in the EVPN VPLS over SRv6
network. They forward Layer 3 traffic in different subnets across sistes.
Figure 78 Network diagram
IPv6 network
Loop0 Loop0
GE0/0/1
PE 1
GE0/0/2
GE0/0/1
P
Loop0
GE0/0/2
GE0/0/2
PE 2
GE0/0/1
GE0/0/1
Site 1
P
Device
PE 1
CE 1
Interface
Loop0
VSI-int1
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
1::1/128
100.1.1.1/24
-
20::1/64
3::3/128
20::2/64
30::1/64
Device
PE 2
CE 1
CE 2
GE0/0/1
CE 2
Site 2
Interface
Loop0
GE0/0/1
GE0/0/2
VSI-int1
GE0/0/1
GE0/0/1
IP address
2::2/128
-
30::2/64
100.1.2.1/24
100.1.1.10/24
100.1.2.20/24
318
Procedure
1. Configure IP address and unicast routing settings:
# On CE 1, configure a default route and specify gateway address 100.1.1.1 for the route.
<CE1> system-view
[CE1] ip route-static 0.0.0.0 0 100.1.1.1
# On CE2, configure a default route and specify gateway address 10.1.2.1 for the route.
<CE2> system-view
[CE2] ip route-static 0.0.0.0 0 100.1.2.1
# Configure IP addresses and masks for the interfaces, as shown in Figure 78 . (Details not
shown.)
# In the IPv6 network, configure OSPFv3 to ensure that the devices can reach each other.
(Details not shown.)
2. Configure PE 1:
# Enable L2VPN.
<PE1> system-view
[PE1] l2vpn enable
# Configure RD and route target settings for VPN instance vpn1 .
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 1:1
[PE1-vpn-instance-vpn1] address-family ipv4
[PE1-vpn-ipv4-vpn1] vpn-target 1:1 import-extcommunity
[PE1-vpn-ipv4-vpn1] vpn-target 1:1 export-extcommunity
[PE1-vpn-ipv4-vpn1] quit
[PE1-vpn-instance-vpn1] address-family evpn
[PE1-vpn-evpn-vpn1] vpn-target 2:2 import-extcommunity
[PE1-vpn-evpn-vpn1] vpn-target 2:2 export-extcommunity
[PE1-vpn-evpn-vpn1] quit
[PE1-vpn-instance-vpn1] quit
# Configure VSI-interface 1.
[PE1] interface vsi-interface 1
[PE1-Vsi-interface1] ip binding vpn-instance vpn1
[PE1-Vsi-interface1] ip address 100.1.1.1 255.255.255.0
[PE1-Vsi-interface1] mac-address 0001-0001-0001
[PE1-Vsi-interface1] local-proxy-arp enable
[PE1-Vsi-interface1] distributed-gateway local
[PE1-Vsi-interface1] quit
# Configure VSI vpna .
[PE1] vsi vpna
[PE1-vsi-vpna] gateway vsi-interface 1
[PE1-vsi-vpna] evpn encapsulation srv6
[PE1-vsi-vpna-evpn-srv6] route-distinguisher 6:6
[PE1-vsi-vpna-evpn-srv6] vpn-target 6:6 import-extcommunity
[PE1-vsi-vpna-evpn-srv6] vpn-target 6:6 export-extcommunity
[PE1-vsi-vpna-evpn-srv6] segment-routing ipv6 locator aaa
[PE1-vsi-vpna-evpn-srv6] segment-routing ipv6 best-effort
[PE1-vsi-vpna-evpn-srv6] quit
[PE1-vsi-vpna] quit
319
# Configure a locator for SRv6 SID allocation.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 1::1
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:1:: 64 static 32
[PE1-segment-routing-ipv6-locator-aaa] quit
# Configure BGP peers.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] peer 2::2 as-number 100
[PE1-bgp-default] peer 2::2 connect-interface loopback 0
# Configure the BGP EVPN address family.
[PE1-bgp-default] address-family l2vpn evpn
[PE1-bgp-default-evpn] peer 2::2 enable
[PE1-bgp-default-evpn] peer 2::2 advertise encap-type srv6
[PE1-bgp-default-evpn] quit
# Configure the BGP IPv4 VPN instance.
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] import evpn mac-ip
[PE1-bgp-default-ipv4-vpn1] advertise l2vpn evpn
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort evpn
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa evpn
[PE1-bgp-default-ipv4-vpn1] quit
# Map GigabitEthernet 0/0/1 (the interface connected to CE 1) with VSI vpna .
[PE1] interface gigabitethernet 0/0/1
[PE1-GigabitEthernet0/0/1] xconnect vsi vpna
[PE1-GigabitEthernet0/0/1] quit
3. Configure PE 2:
# Enable L2VPN.
<PE2> system-view
[PE2] l2vpn enable
# Configure RD and route target settings for VPN instance vpn1 .
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 1:1
[PE2-vpn-instance-vpn1] address-family ipv4
[PE2-vpn-ipv4-vpn1] vpn-target 1:1 import-extcommunity
[PE2-vpn-ipv4-vpn1] vpn-target 1:1 export-extcommunity
[PE2-vpn-ipv4-vpn1] quit
[PE2-vpn-instance-vpn1] address-family evpn
[PE2-vpn-evpn-vpn1] vpn-target 2:2 import-extcommunity
[PE2-vpn-evpn-vpn1] vpn-target 2:2 export-extcommunity
[PE2-vpn-evpn-vpn1] quit
[PE2-vpn-instance-vpn1] quit
# Configure VSI-interface 1.
[PE2] interface vsi-interface 1
[PE2-Vsi-interface1] ip binding vpn-instance vpn1
[PE2-Vsi-interface1] ip address 100.1.1.1 255.255.255.0
[PE2-Vsi-interface1] mac-address 0001-0001-0001
320
[PE2-Vsi-interface1] local-proxy-arp enable
[PE2-Vsi-interface1] distributed-gateway local
[PE2-Vsi-interface1] quit
# Configure VSI vpna .
[PE2] vsi vpna
[PE2-vsi-vpna] gateway vsi-interface 1
[PE2-vsi-vpna] evpn encapsulation srv6
[PE2-vsi-vpna-evpn-srv6] route-distinguisher 6:6
[PE2-vsi-vpna-evpn-srv6] vpn-target 6:6 import-extcommunity
[PE2-vsi-vpna-evpn-srv6] vpn-target 6:6 export-extcommunity
[PE2-vsi-vpna-evpn-srv6] segment-routing ipv6 locator aaa
[PE2-vsi-vpna-evpn-srv6] segment-routing ipv6 best-effort
[PE2-vsi-vpna-evpn-srv6] quit
[PE2-vsi-vpna] quit
# Configure a locator for SRv6 SID allocation.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 2::2
[PE2-segment-routing-ipv6] locator aaa ipv6-prefix 2:2:: 64 static 32
[PE2-segment-routing-ipv6-locator-aaa] quit
# Configure BGP peers.
[PE2] bgp 100
[PE2-bgp-default] router-id 2.2.2.2
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
# Configure the BGP EVPN address family.
[PE2-bgp-default] address-family l2vpn evpn
[PE2-bgp-default-evpn] peer 1::1 enable
[PE2-bgp-default-evpn] peer 1::1 advertise encap-type srv6
[PE2-bgp-default-evpn] quit
# Configure the BGP IPv4 VPN instance.
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] import evpn mac-ip
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort evpn
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa evpn
[PE2-bgp-default-ipv4-vpn1] quit
# Map GigabitEthernet 0/0/1 (the interface connected to CE 2) with VSI vpna .
[PE2] interface gigabitethernet 0/0/1
[PE2-GigabitEthernet0/0/1] xconnect vsi vpna
[PE2-GigabitEthernet0/0/1] quit
Verifying the configuration
# On PE 1, display routing table information for VPN instance vpn1 and verify that PE 1 has learned the host route of CE 2.
[PE1] display ip routing-table vpn-instance vpn1
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost NextHop Interface
321
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
100.1.1.0/24 Direct 0 0 100.1.1.1 Vsi1
100.1.1.0/32 Direct 0 0 100.1.1.1 Vsi1
100.1.1.1/32 Direct 0 0 127.0.0.1 InLoop0
100.1.1.255/32 Direct 0 0 100.1.1.1 Vsi1
100.1.2.20/32 BGP 255 0 2:2:: GE0/0/2
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
# On PE 2, display routing table information for VPN instance vpn1 and verify that PE 2 has learned the host route of CE 1.
[PE2] display ip routing-table vpn-instance vpn1
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
100.1.2.0/24 Direct 0 0 100.1.1.1 Vsi1
100.1.2.0/32 Direct 0 0 100.1.1.1 Vsi1
100.1.2.1/32 Direct 0 0 127.0.0.1 InLoop0
100.1.1.10/32 BGP 255 0 1:1:: GE0/0/2
100.1.2.255/32 Direct 0 0 100.1.1.1 Vsi1
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
322
Configuring IP public network over SRv6
About IP public network over SRv6
IP public network over SRv6 uses SRv6 tunnels to carry IP public network services. This technology establishes SRv6 tunnels among geographically dispersed customer sites over an IPv6 network and transparently forwards Layer 3 customer traffic to remote sites over the IPv6 network through the tunnels.
Basic principle
Figure 79 shows a typical IP public network over SRv6 network. PE 1 and PE 2 use BGP to advertise
IPv6 public network routes to each other over the IPv6 backbone network. The PEs use an SRv6 tunnel between them to forward public network traffic across sites.
IP public network over SRv6 connects geographically dispersed sites that belong to the public network over the IPv6 backbone network.
Figure 79 Network diagram
BGP
SRv6
CE 1 PE 1 P PE 2 CE 2
Route advertisement
IPv4 public network over SRv6 and IPv6 public network over SRv6 use the same process to advertise routes. The following information uses IPv4 public network over SRv6 as an example to illustrate the process.
As shown in Figure 79 , local routes of CE 1 are advertised to CE 2 by using the following process:
1. CE 1 uses static routing, RIP, OSPF, IS-IS, EBGP, or IBGP to advertise routes of the local site to PE 1.
2. After learning the route information of CE 1, PE 1 stores the routes of the local site to the routing table of the public network. At the same time, PE 1 converts the routes to BGP IPv4 unicast routes and adds the same End.DT4 or End.DT46 SID to the routes. Then, PE 1 advertises the
BGP IPv4 unicast routes with the End.DT4 or End.DT46 SID to PE 2.
3. When PE 2 receives the IPv4 unicast routes advertised by PE 1, it adds the routes to the routing table of the public network. PE 2 removes the End.DT4 or End.DT46 SID information from the routes, records the End.DT4 or End.DT46 SID information, and then advertises the routes to
CE 2.
4. By adding the received IPv4 unicast routes to the routing table, CE 2 learns the routes of CE 1.
Packet forwarding
IP public network over SRv6 supports the following route recursion modes:
•
SRv6 BE mode.
323
•
SRv6 TE mode.
•
SRv6 TE and SRv6 BE hybrid mode.
The packet forwarding process differs by the route recursion mode in use.
SRv6 BE mode
This mode is also called SID-based forwarding mode. In this mode, a PE forwards an SRv6 packet by searching the IPv6 routing table based on the SRv6 SID encapsulated in the packet.
IPv4 public network over SRv6 and IPv6 public network over SRv6 use the same process to forward packets. The following information uses IPv4 public network over SRv6 as an example to illustrate the process.
As shown in Figure 79 , CE 2 forwards an IPv4 packet to CE 1 as follows:
1. CE 2 sends the IPv4 packet to PE 2.
2. After PE 2 receives the packet, it searches for a route that matches the destination IPv4 address of the packet in the routing table of the public network. The corresponding End.DT4,
End.DT46, or End.DX4 SID is found. Then, PE 2 encapsulates an outer IPv6 header for the packet. The End.DT4, End.DT46, or End.DX4 SID is encapsulated in the outer IPv6 header as the destination address.
3. PE 2 searches the IPv6 routing table based on the End.DT4, End.DT46, or End.DX4 SID for the optimal IGP route and forwards the packet to P through the route.
4. P searches the IPv6 routing table based on the End.DT4, End.DT46, or End.DX4 SID for the optimal IGP route and forwards the packet to PE 1 through the route.
5. When PE 1 receives the packet, it processes the packet as follows:
If the packet header contains an End.DT4 or End.DT46 SID, PE 1 searches the local SID forwarding table for the SID and removes the outer IPv6 header. Then, PE 1 matches the packet to the public instance based on the SID, looks up the public network routing table, and forwards the packet to CE 1.
If the packet header contains an End.DX4 SID, PE 1 searches the local SID forwarding table for the SID and removes the outer IPv6 header. Then, PE 1 forwards the packet to CE
1 according to the next hop and output interface bound to the SID.
SRv6 TE mode
This mode is also called SRv6 TE policy-based forwarding mode. In this mode, when a PE forwards a customer packet, it first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the destination SRv6 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet based on the SRv6 TE policy.
The following modes are available to steer traffic to an SRv6 TE policy:
•
Color —The device searches for an SRv6 TE policy that has the same color and endpoint address as the color and nexthop address of a BGP route. If a matching SRv6 TE policy exists, the device recurses the BGP route to that SRv6 TE policy. When the device receives packets that match the BGP route, it forwards the packets through the SRv6 TE policy.
•
Tunnel policy —The device searches the tunnel policies for a matching SRv6 TE policy based on the next hop of a matching route. Configure a preferred tunnel or load sharing tunnel policy that uses the SRv6 TE policy. In this way, the SRv6 TE policy will be used as the public tunnel to carry the SRv6 PW that forwards the packets of customer network packets.
For more information about tunnel policies, see MPLS Configuration Guide . For more information about SRv6 TE policies, see "Configuring SRv6 TE policies."
SRv6 TE and SRv6 BE hybrid mode
In this mode, the PE preferentially uses the SRv6 TE mode to forward a packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
324
IP public network over SRv6 tasks at a glance
To configure IP public network over SRv6, perform the following tasks:
1. Configuring route exchange between a PE and a CE
Configure an IPv4 routing protocol (static routing, RIP, OSPF, IS-IS, EBGP, or IBGP) or an IPv6 routing protocol (IPv6 static routing, RIPng, OSPFv3, IPv6 IS-IS, EBGP, or IBGP) to exchange routes between a PE and a CE
On the CE, configure an IPv4 or IPv6 routing protocol to advertise routes of the local site to the
PE. For more information about routing protocol configurations, see Layer 3—IP Routing
Configuration Guide .
2. Configuring route exchange between PEs a.
Perform this task to manually configure an End.DT4, End.DT6, End.DT46, End.DX4, or
End.DX6 SID. b.
Applying a locator to a BGP instance
Perform this task to use BGP IPv4 or IPv6 unicast routes to advertise SRv6 SIDs in the specified locator. c. Configuring PEs to exchange BGP IPv4 or IPv6 unicast routes d. Configuring IPv6 peers to exchange SRv6 SIDs
This feature enables PEs to exchange End.DT4, End.DT6, End.DT46, End.DX4, or
End.DX6 SIDs through BGP IPv4 or IPv6 unicast routes. e.
f. (Optional.) Configuring BGP IPv4 or IPv6 unicast routes
For more information about configuring BGP IPv4 or IPv6 unicast routes, see BGP configuration in Layer 3—IP Routing Configuration Guide .
3.
Configuring the route recursion mode
4.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
This feature specifies the source address of the outer IPv6 header for SRv6 packets that are delivered between two public network sites over the backbone network.
Configuring an SRv6 SID
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an opcode. Perform one of the following tasks:
Configure an End.DT4 SID. opcode { opcode | hex hex-opcode } end-dt4
Configure an End.DT6 SID. opcode { opcode | hex hex-opcode } end-dt6
Configure an End.DT46 SID.
325
opcode { opcode | hex hex-opcode } end-dt46
Configure an End.DX4 SID. opcode { opcode | hex hex-opcode } end-dx4 interface interface-type
interface-number nexthop nexthop-ipv4-address
An End.DX4 SID cannot be configured with different output interfaces or next hops.
Configure an End.DX6 SID. opcode { opcode | hex hex-opcode } end-dx6 interface interface-type
interface-number nexthop nexthop-ipv6-address
An End.DX6 SID cannot be configured with different output interfaces or next hops.
Applying a locator to a BGP instance
About this task
In the IP public network over SRv6 scenario, use this feature in BGP IPv4 or IPv6 unicast address family view to apply for SRv6 SIDs for IPv4 or IPv6 routes.
Use this feature if the device will use End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs to deliver public network traffic across sites.
Prerequisites
Before you perform this task, you must create the specified locator.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 or IPv6 unicast address family view.
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
4. Apply a locator to the BGP instance. segment-routing ipv6 locator locator-name [ auto-sid-disable ]
By default, no locator is applied to a BGP instance.
Configuring PEs to exchange BGP IPv4 or IPv6 unicast routes
Restrictions and guidelines
For more information about the commands in this task, see BGP in Layer 3—IP Routing Command
Reference .
To ensure optimal route selection and SRv6 tunnel traffic forwarding, make sure a pair of PEs are not both IPv4 and IPv6 peers to each other.
Procedure
1. Enter system view.
326
system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Specify a remote PE as an IPv6 peer. peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify a source interface (IPv6 address) for establishing TCP connections to an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the output interface in the optimal route destined for a BGP peer or peer group as the source interface for establishing TCP connections.
5. Enter BGP IPv4 or IPv6 unicast address family view.
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
6. Enable BGP to exchange IPv4 or IPv6 unicast routing information with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange IPv4 or IPv6 unicast routing information with an IPv6 peer or peer group.
Configuring IPv6 peers to exchange SRv6 SIDs
About this task
Perform this task to configure IPv6 peers to exchange SRv6 SID information through BGP IPv4 or
IPv6 unicast routes.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 or IPv6 unicast address family view.
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
4. Enable BGP to exchange SRv6 SID information with an IPv6 peer or peer group. peer { group-name | ipv6-address [ prefix-length ] } prefix-sid
By default, BGP cannot exchange SRv6 SID information with an IPv6 peer or peer group.
327
Configuring next hop-based dynamic End.DX4 or
End.DX6 SID allocation for public network routes
About this task
This feature is applicable to the IPv6 public network over SRv6 scenario.
By default, a PE allocates the same SID to all BGP public network routes. When the PE removes the
SRv6 encapsulation from a received packet, it looks up the routing table of the public network based on the SID for an optimal route. To forward the packet to the next hop without looking up the routing table, configure this feature.
This feature dynamically allocates End.DX4 or End.DX6 SIDs to all next hops for the BGP public network IPv4 or IPv6 routes. When forwarding a packet, the PE searches for the output interface and next hop based on the End.DX4 or End.DX6 SID of the packet. Then, the PE directly forwards the packet out of the output interface to the next hop.
Restrictions and guidelines
This feature does not allocate End.DX4 or End.DX6 SIDs to direct routes.
Prerequisites
Before you perform this task in BGP IPv4 or IPv6 unicast address family view, execute the segment-routing ipv6 locator command in the same view to apply a locator to the view.
This ensures successful dynamic End.DX4 or End.DX6 SID allocation.
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 unicast address family view or BGP IPv6 unicast address family view.
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
4. Allocate End.DX4 or End.DX6 SIDs to the next hops of BGP public network routes.
Allocate End.DX4 or End.DX6 SIDs to all next hops of BGP public network routes. segment-routing ipv6 apply-sid all-nexthop
Execute the following commands in sequence to allocate End.DX4 or End.DX6 SIDs to the specified next hop of BGP public network routes. segment-routing ipv6 apply-sid specify-nexthop nexthop nexthop-address interface interface-type interface-number
By default, public instance-based SID allocation is used for public network routes.
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an SRv6 SID, it forwards the packet according to the route recursion mode.
328
•
SRv6 BE mode —This mode is also called SID-based forwarding mode. In this mode, the PE first encapsulates the End.DT4, End.DT6, or End.DT46 SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
•
SRv6 TE mode —This mode is also called SRv6 TE policy-based forwarding mode. In this mode, the PE first searches for a matching SRv6 TE policy based on the packet attributes.
Then, the PE adds an SRH to the packet. The SRH includes the End.DT4, End.DT6, or
End.DT46 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy. For more information, see "Configuring SRv6 TE policies."
•
SRv6 TE and SRv6 BE hybrid mode —In this mode, the PE preferentially uses the SRv6 TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6 BE mode.
Prerequisites
To use the SRv6 TE mode or the SRv6 TE and SRv6 BE hybrid mode, you must configure a tunnel policy and SRv6 TE policy. For more information, see tunnel policy configuration in MPLS
Configuration Guide and "Configuring SRv6 TE policies."
Procedure
1. Enter system view. system-view
2. Enter BGP instance view. bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 or IPv6 unicast address family view.
Enter BGP IPv4 unicast address family view. address-family ipv4 [ unicast ]
Enter BGP IPv6 unicast address family view. address-family ipv6 [ unicast ]
4. Configure the route recursion mode. segment-routing ipv6 { best-effort | traffic-engineer | traffic-engineer best-effort }
By default, a PE searches the IPv6 routing table based on the next hop of a matching route to forward traffic.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
Restrictions and guidelines
To ensure correct traffic forwarding in the IPv6 public network over SRv6 scenario, you must specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view.
329
segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated packets.
Verifying and maintaining IP public network over
SRv6
Displaying the configuration and running status of IP public network over SRv6
To display BGP IPv6 unicast route information, execute the following command in any view:
display bgp [ instance instance-name ] routing-table ipv6 [ unicast ]
[ ipv6-address prefix-length [ advertise-info ] | as-path-acl as-path-acl-number | community-list { { basic-community-list-number | comm-list-name } [ whole-match ] | adv-community-list-number } | peer ipv6-address { advertised-routes | received-routes } [ ipv6-address prefix-length | statistics ] | statistics ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
Clearing flap statistics for BGP IPv6 unicast routes
To clear flap statistics for BGP IPv6 unicast routes, execute the following command in user view: reset bgp [ instance instance-name ] flap-info ipv6 [ unicast ]
[ ipv6-address prefix-length | as-path-acl as-path-acl-number | peer ipv6-address [ prefix-length ] ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
Resetting BGP sessions
About this task
For BGP setting changes to take effect, you must reset BGP sessions. Resetting BGP sessions updates BGP routing information by tearing down and re-establishing the BGP sessions.
Procedure
To reset BGP sessions of the BGP IPv6 unicast address family, execute the following command in user view: reset bgp [ instance instance-name ] { as-number | ipv6-address
[ prefix-length ] | all | external | group group-name | internal } ipv6
[ unicast ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing
Command Reference .
330
IP public network over SRv6 configuration examples
Example: Configuring IPv6 public network over SRv6 in
SRv6 BE mode
Network configuration
As shown in Figure 80 , the backbone network is an IPv6 network. Deploy IPv6 public network over
SRv6 between PE 1 and PE 2 and use an SRv6 tunnel to transmit IPv4 traffic between the PEs.
•
Configure EBGP to exchange customer site routing information between the CEs and PEs.
•
Configure IPv6 IS-IS on the PEs in the same AS to realize IPv6 network connectivity.
•
Configure IBGP to exchange IPv4 routing information between the PEs.
Figure 80 Network diagram
Loop0
PE 1 PE 2
Loop0
GE0/0/1
GE0/0/1
GE0/0/2
GE0/0/2
GE0/0/2
P
IPv6 backbone
GE0/0/1
Loop0
GE0/0/1 GE0/0/1
CE 1 CE 2
AS 65410 AS 65420
Table 21 Interface and IP address assignment
Device
CE 1
PE 1
P
Prerequisites
Interface
GE0/0/1
Loop0
GE0/0/1
GE0/0/2
Loop0
GE0/0/1
GE0/0/2
IP address
111::1/96
1::1/128
111::2/96
2001::1/96
2::2/128
2001::2/96
2002::2/96
Device
PE 2
CE 2
Interface
Loop0
GE0/0/1
GE0/0/2
GE0/0/1
IP address
3::3/128
222:2/96
2002::1/96
222::1/96
Procedure
1. Configure IPv6 IS-IS on the PEs and device P for network connectivity between the devices:
# Configure PE 1.
<PE1> system-view
[PE1] isis 1
[PE1-isis-1] is-level level-1
331
[PE1-isis-1] cost-style wide
[PE1-isis-1] network-entity 10.1111.1111.1111.00
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] isis ipv6 enable 1
[PE1-LoopBack0] quit
[PE1] interface gigabitethernet 0/0/2
[PE1-GigabitEthernet0/0/2] isis ipv6 enable
[PE1-GigabitEthernet0/0/2] quit
# Configure P.
<P> system-view
[P] isis
[P-isis-1] is-level level-1
[P-isis-1] cost-style wide
[P-isis-1] network-entity 10.2222.2222.2222.00
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] quit
[P-isis-1] quit
[P] interface loopback 0
[P-LoopBack0] isis ipv6 enable
[P-LoopBack0] quit
[P] interface gigabitethernet 0/0/1
[P-GigabitEthernet0/0/1] isis ipv6 enable
[P-GigabitEthernet0/0/1] quit
[P] interface gigabitethernet 0/0/2
[P-GigabitEthernet0/0/2] isis ipv6 enable
[P-GigabitEthernet0/0/2] quit
# Configure PE 2.
<PE2> system-view
[PE2] isis
[PE2-isis-1] is-level level-1
[PE2-isis-1] cost-style wide
[PE2-isis-1] network-entity 10.3333.3333.3333.00
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] isis ipv6 enable
[PE2-LoopBack0] quit
[PE2] interface gigabitethernet 0/0/2
[PE2-GigabitEthernet0/0/2] isis ipv6 enable
[PE2-GigabitEthernet0/0/2] quit
2. Set up an EBGP peer relationship between each PE and its local CE and distribute CE routes to
EBGP:
# Configure CE 1.
<CE1> system-view
332
[CE1] bgp 65410
[CE1-bgp-default] peer 111::2 as-number 100
[CE1-bgp-default] address-family ipv6 unicast
[CE1-bgp-default-ipv6] peer 111::2 enable
[CE1-bgp-default-ipv6] import-route direct
[CE1-bgp-default-ipv6] quit
[CE1-bgp-default] quit
# Configure CE 2 in the same way as CE 1 is configured. (Details not shown.)
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] peer 111::1 as-number 65410
[PE1-bgp-default] address-family ipv6 unicast
[PE1-bgp-default-ipv6] peer 111::1 enable
[PE1-bgp-default-ipv6] import-route direct
[PE1-bgp-default-ipv6] quit
[PE1-bgp-default] quit
# Configure PE 2 in the same way PE 1 is configured. (Details not shown.)
3. Set up an IBGP peer relationship between PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] peer 3::3 as-number 100
[PE1-bgp-default] peer 3::3 connect-interface loopback 0
[PE1-bgp-default] address-family ipv6 unicast
[PE1-bgp-default-ipv6] peer 3::3 enable
[PE1-bgp-default-ipv6] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
[PE2-bgp-default] address-family ipv6 unicast
[PE2-bgp-default-ipv6] peer 1::1 enable
[PE2-bgp-default-ipv6] quit
[PE2-bgp-default] quit
4. Specify a source address for the outer IPv6 header of SRv6-encapsulated IP public network packets on PE 1 and PE 2:
# Configure PE 1.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 11::11
# Configure PE 2.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 33::33
5. Configure the destination address (End.DT4 SID) of the outer IPv6 header for
SRv6-encapsulated IP public network packets:
# Configure PE 1.
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:2::1:0 96 static 8
[PE1-segment-routing-ipv6-locator-aaa] quit
333
[PE1-segment-routing-ipv6] quit
[PE1] isis 1
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] segment-routing ipv6 locator aaa
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
# Configure PE 2.
[PE2-segment-routing-ipv6] locator bbb ipv6-prefix 6:5::1:0 96 static 8
[PE2-segment-routing-ipv6-locator-bbb] quit
[PE2-segment-routing-ipv6] quit
[PE2] isis 1
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] segment-routing ipv6 locator bbb
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
6. Add End.DT4 SIDs to public network routes of the customer sites on PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] address-family ipv6 unicast
[PE1-bgp-default-ipv6] segment-routing ipv6 locator aaa
[PE1-bgp-default-ipv6] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] address-family ipv6 unicast
[PE2-bgp-default-ipv6] segment-routing ipv6 locator bbb
[PE2-bgp-default-ipv6] quit
[PE2-bgp-default] quit
7. Enable IPv6 peers on the PEs to exchange End.DT4 SIDs and enable SRv6 BE route recursion mode:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] address-family ipv6 unicast
[PE1-bgp-default-ipv6] peer 3::3 prefix-sid
[PE1-bgp-default-ipv6] segment-routing ipv6 best-effort
[PE1-bgp-default-ipv6] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] address-family ipv6 unicast
[PE2-bgp-default-ipv6] peer 1::1 prefix-sid
[PE2-bgp-default-ipv6] segment-routing ipv6 best-effort
[PE2-bgp-default-ipv6] quit
[PE2-bgp-default] quit
Verifying the configuration
# Display IPv6 routing table information on the PEs and verify that each PE has a route destined for the remote CE and the next hop of the route is the End.DT4 SID of the route. This step uses PE 1 as an example.
334
[PE1] display ipv6 routing-table 222::1 96
Summary count : 1
Destination: 222::/96 Protocol : BGP4+
NextHop : 6:5:: Preference: 255
Interface : GE0/0/2 Cost : 0
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
335
Configuring SRv6 OAM
About SRv6 OAM
SRv6 Operations, Administration, and Maintenance (OAM) detects SRv6 path connectivity and locates SRv6 path problems by using ping and tracert operations based on SRv6 SIDs and SRv6 TE policies.
•
SRv6 SID/SRv6 TE policy-based ping —Detects network connectivity and host reachability.
SRv6 SID-based ping and SRv6 TE policy-based ping are H3C proprietary protocols.
•
SRv6 SID/SRv6 TE policy-based tracert —Detects network connectivity and locates network problems.
SRv6 OAM protocol extensions
OAM O-flag
As shown in Figure 81 , the O-flag is in the SRH Flags field, indicating that the SRv6 nodes need to
perform OAM processing. The SRv6 nodes process the packets with O-flag set based on the SRH.
In SRv6 OAM, to request all SRv6 nodes on the path to respond to OAM packets, make sure the
O-flag is set for the OAM packets at the source node.
Figure 81 O-flag in SRH Flags field
0 1 2 3
O Reserved
7
End.OP SID
An End.OP SID is an SRv6 SID of OAM type used in SRv6 SID/SRv6 TE policy-based ping/tracert operations. When a device receives a request packet destined for the local End.OP SID, it further checks the SRv6 SID in the packet. If the SRv6 SID is the local SRv6 SID, the device sends a reply; if not, the device discards the packet.
Take SRv6 SID-based ping as an example. As shown in Figure 82 , in order to ping Device C, Device
A constructs an ICMPv6 echo request by adding the End.OP SID of Device C to the SRH header in the request. Upon receiving the request and finding that request is destined for the local End.OP SID,
Device C further checks whether SRv6 SID c is the local SRv6 SID. If it is the local SRv6 SID, Device
C sends an ICMPv6 echo reply; if not, Device C discards the ICMPv6 echo request.
336
Figure 82 End.OP SID used in an SRv6 SID-based ping
IPv6 SA=a, IPv6 DA=b
SRH[(c, op, b) SL=2]
ICMPv6 Echo Request
End.OP SID=op
Device A
SRv6 SID=a
Device B
SRv6 SID=b
Device C
SRv6 SID=c
IPv6 SA=b, IPv6 DA=op
SRH[(c, op, b) SL=1]
ICMPv6 Echo Request
SRv6 SID-based ping
SRv6 OAM supports segment-by-segment ping and end-to-end ping.
Segment-by-segment ping
Use segment-by-segment ping to detect connectivity of all SRv6 nodes in the SRv6 path. All SRv6 nodes will send an ICMPv6 echo reply to the source node.
In a segment-by-segment ping operation, do not specify the End.OP SID because some nodes might fail to send a reply.
Figure 83 Segment-by-segment ping
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
ICMPv6 Echo Request
A
SRv6 SID=a
B
SRv6 SID=b
C D
SRv6 SID=d
IPv6 SA=b, IPv6 DA=d
SRH[(d, b) SL=0]
ICMPv6 Echo Request
Figure 83 shows the segment-by-segment ping process as follows:
1. Device A initiates a ping to Device D, with the SRv6 SIDs of Device B and Device D specified. It constructs an ICMPv6 echo request encapsulated with an SRH and then forwards the request.
2. Upon receiving the ICMPv6 echo request, the intermediate node performs relevant operations depending on whether it is SRv6 capable:
On an SRv6 capable node (such as Device B):
The node sends an ICMPv6 echo reply to Device A, and forwards the ICMPv6 echo request based on the SRH if the following conditions exist:
337
−
The packet destination IPv6 address is the local SRv6 SID.
−
The O-flag is set in the packet SRH Flags field.
On an SRv6 incapable node (such as Device C):
The node forwards the ICMPv6 echo request according to routing table lookup without returning an ICMPv6 echo reply to Device A.
3. Upon receiving the ICMPv6 echo request with O-flag set and SL=0 in the SRH, Device D verifies the packet destination IPv6 address.
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 echo reply to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the ICMPv6 echo request.
4. Device A determines whether the destination node is reachable based on reception of the
ICMPv6 echo reply:
If the ICMPv6 echo reply is received before the specified timeout timer expires, the destination node is reachable.
If no ICMPv6 echo reply is received when the specified timeout timer expires, the destination node is unreachable.
End-to-end ping
Use end-to-end ping to detect connectivity of the destination node in the SRv6 path. Only the destination node sends an ICMPv6 echo reply to the source node.
Figure 84 End-to-end ping
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
ICMPv6 Echo Request
A
SRv6 SID=a
B
SRv6 SID=b
C D
SRv6 SID=d
IPv6 SA=b, IPv6 DA=d
SRH[(d, b) SL=0]
ICMPv6 Echo Request
Figure 84 shows the end-to-end ping process as follows:
1. Device A initiates a ping to Device D, with the SRv6 SIDs of Device B and Device D specified. It constructs an ICMPv6 echo request encapsulated with an SRH and then forwards the request.
2. Upon receiving the ICMPv6 echo request, the intermediate node performs relevant operations depending on whether it is SRv6 capable:
On an SRv6 capable node (such as Device B):
The node forwards the ICMPv6 echo request based on the SRH if the packet destination
IPv6 address is the local SRv6 SID.
On an SRv6 incapable node (such as Device C):
The node forwards the ICMPv6 echo request according to routing table lookup.
3. Upon receiving the ICMPv6 echo request with SL=0 in the SRH, Device D verifies the packet destination IPv6 address.
338
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 echo reply to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the ICMPv6 echo request.
4. Device A determines whether the destination node is reachable based on reception of the
ICMPv6 echo reply:
If the ICMPv6 echo reply is received before the specified timeout timer expires, the destination node is reachable.
If no ICMPv6 echo reply is received when the specified timeout timer expires, the destination node is unreachable.
SRv6 SID-based tracert
SRv6 OAM supports overlay tracert and hop-by-hop tracert.
Overlay tracert
Use overlay tracert to display information about only SRv6 nodes in the SRv6 path.
In an overlay tracert operation, do not specify the End.OP SID because some nodes might fail to send a reply.
Figure 85 Overlay tracert
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
UDP packet
IPv6 SA=b, IPv6 DA=d
SRH[(d, b) SL=0]
UDP packet
A
SRv6 SID=a
UDP packet
B
SRv6 SID=b
UDP port unreachable
UDP packet
C D
SRv6 SID=d
UDP packet
UDP port unreachable
Figure 85 shows the overlay tracert process as follows:
1. Device A initiates a tracert to Device D, with the SRv6 SIDs of Device B and Device D specified.
It constructs a UDP packet encapsulated with an SRH and then forwards the UDP packet (the
Hop Limit value is 64 in the IPv6 packet header).
Make sure you specify a destination UDP port that is not used by any applications on the destination node.
2. Upon receiving the UDP packet, the intermediate node performs relevant operations depending on whether it is SRv6 capable:
On an SRv6 capable node (such as Device B):
The node sends an ICMPv6 port unreachable message to Device A, and then forwards the
UDP packet based on the SRH if the following conditions exist:
−
The packet destination IPv6 address is the local SRv6 SID.
339
−
The O-flag is set in the packet SRH Flags field.
On an SRv6 incapable node (such as Device C):
The node forwards the UDP packet according to routing table lookup without returning an
ICMPv6 port unreachable message.
3. Upon receiving the UDP packet with O-flag set and SL=0 in the SRH, Device D verifies the packet destination IPv6 address.
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 port unreachable message to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the UDP packet.
4. Device A determines whether the destination node is reachable based on reception of the
ICMPv6 port unreachable message:
If the ICMPv6 port unreachable message is received before the specified timeout timer expires, the destination node is reachable. The tracert result displays the SRv6 path from the source node to the destination node.
If no ICMPv6 port unreachable message is received when the specified timeout timer expires, the destination node is unreachable. You can locate the faulty node based on the tracert result.
Hop-by-hop tracert
Use hop-by-hop tracert to display information about all nodes (whether they are SRv6 capable or not) in the SRv6 path.
Figure 86 Hop-by-hop tracert
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
UDP packet
IPv6 SA=b, IPv6 DA=op
SRH[(d, b) SL=0]
UDP packet
A
SRv6 SID=a
Hop Limit=1
B
SRv6 SID=b
TTL exceeded
Hop Limit=2
TTL exceeded
C D
SRv6 SID=d
Hop Limit=n
UDP port unreachable
Figure 86 shows the hop-by-hop tracert process as follows:
1. Device A initiates a tracert to Device D, with the SRv6 SIDs of Device B and Device D specified.
It constructs a UDP packet encapsulated with an SRH and then forwards the UDP packet (the
Hop Limit value is 1 in the IPv6 packet header).
Make sure you specify a destination UDP port that is not used by any applications on the destination node.
340
2. Upon receiving the UDP packet with the Hop Limit value in the IPv6 packet header being 0, the intermediate node sends an ICMPv6 timeout message to Device A.
3. Upon receiving the ICMPv6 timeout message, Device A sends another UDP packet by adding the Hop limit value by 1.
4. Upon receiving the UDP packet with the Hop Limit value in the IPv6 packet header not being 0, the intermediate node forwards the UDP packet as follows:
On an SRv6 capable node (such as Device B):
The node forwards the UDP packet based on the SRH if the packet destination IPv6 address is the local SRv6 SID.
On an SRv6 incapable node (such as Device C):
The node forwards the UDP packet according to routing table lookup.
5. Upon receiving the UDP packet (with Hop Limit 0 in the IPv6 packet header and SL=0 in the
SRH), Device D verifies the packet destination IPv6 address.
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 port unreachable message to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the UDP packet.
6. Device A determines whether the destination node is reachable based on reception of the
ICMPv6 port unreachable message:
If the ICMPv6 port unreachable message is received before the specified timeout timer expires, the destination node is reachable. The tracert result displays the SRv6 path from the source node to the destination node.
If no ICMPv6 port unreachable message is received when the specified timeout timer expires, the destination node is unreachable. You can locate the faulty node based on the tracert result.
SRv6 TE policy-based ping
Use SRv6 TE policy-based ping to detect reachability of each node in an SRv6 TE policy.
Figure 87 SRv6 TE policy-based ping
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
ICMPv6 Echo Request
A
SRv6 SID=a
B
SRv6 SID=b
C D
SRv6 SID=d
IPv6 SA=b, IPv6 DA=d
SRH[(d, b) SL=0]
ICMPv6 Echo Request
In Figure 87 , the SID list of the SRv6 TE policy contains {b, d}. The SRv6 TE policy-based ping
process is as follows:
1. Device A initiates a ping to Device D. It constructs an ICMPv6 echo request encapsulated with an SRH (that contains the SID list of the SRv6 TE policy) and then forwards the request.
341
2. Upon receiving the ICMPv6 echo request, the intermediate node performs relevant operations depending on whether it is SRv6 capable:
On an SRv6 capable node (such as Device B):
The node forwards the ICMPv6 echo request based on the SRH to Device C.
On an SRv6 incapable node (such as Device C):
The node forwards the ICMPv6 echo request according to routing table lookup.
3. Upon receiving the ICMPv6 echo request with O-flag set and SL=0 in the SRH, Device D verifies the packet destination IPv6 address.
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 echo reply to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the ICMPv6 echo request.
4. Device A determines node reachability in the SRv6 TE policy based on reception of the ICMPv6 echo reply:
If Device A receives the ICMPv6 echo reply from Device D before the specified timeout timer expires, all nodes in the SRv6 TE policy are reachable.
If Device A does not receive the ICMPv6 echo reply from Device D when the specified timeout timer expires, the SRv6 TE policy contains unreachable nodes.
SRv6 TE policy-based tracert
Use SRv6 TE policy-based tracert to detect node reachability in an SRv6 TE policy and locate the faulty node.
Figure 88 SRv6 TE policy-based tracert
IPv6 SA=a, IPv6 DA=b
SRH[(d, b) SL=1]
UDP
IPv6 SA=b, IPv6 DA=op
SRH[(d, b) SL=0]
UDP
A
SRv6 SID=a
Hop Limit=1
B
SRv6 SID=b
TTL exceeded
Hop Limit=2
TTL exceeded
C D
SRv6 SID=d
Hop Limit=n
UDP port unreachable
In Figure 88 , the SID list of the SRv6 TE policy contains {b, d}.
The SRv6 TE policy-based tracert process is as follows:
1. Device A initiates a tracert to Device C. It constructs a UDP packet encapsulated with an SRH
(that contains the SID list of the SRv6 TE policy) and then forwards the UDP packet (the Hop
Limit value is 1 in the IPv6 packet header).
342
Make sure you specify a destination UDP port that is not used by any applications on the destination node.
2. Upon receiving the UDP packet with the Hop Limit value in the IPv6 packet header being 0, the intermediate node sends an ICMPv6 timeout message to Device A.
3. Upon receiving the ICMPv6 timeout message, Device A sends another UDP packet by adding the Hop Limit value by 1.
4. Upon receiving the UDP packet with the Hop Limit value in the IPv6 packet header not being 0, the intermediate node forwards the UDP packet as follows:
On an SRv6 capable node (such as Device B):
The node forwards the UDP packet based on the SRH if the packet destination IPv6 address is the local SRv6 SID.
On an SRv6 incapable node (such as Device C):
The node forwards the UDP packet according to routing table lookup.
5. Upon receiving the UDP packet (with Hop Limit 0 in the IPv6 packet header and SL=0 in the
SRH), Device D verifies the packet destination IPv6 address.
If the IPv6 address is the local SRv6 SID, the verification succeeds, and Device D sends an
ICMPv6 port unreachable message to Device A.
If the IPv6 address is not the local SRv6 SID, the verification fails, and Device D discards the UDP packet.
6. Device A determines node reachability in the SRv6 TE policy based on reception of the ICMPv6 port unreachable message:
If Device A receives the ICMPv6 port unreachable message from the destination node before the specified timeout timer expires, all nodes in the SRv6 TE policy are reachable.
No faulty nodes exist.
If Device A does not receive the ICMPv6 port unreachable message from the destination node when the specified timeout timer expires, the SRv6 TE policy contains unreachable nodes. You can locate the faulty node based on the tracert result.
Restrictions and guidelines: SRv6 OAM configuration
Follow these restrictions and guidelines when you perform an SRv6 SID-based ping or tracert operation:
•
When End SID, End.X SID, End(COC32) SID, or End.X(COC32) SID is used as the SRv6 SID of the destination node, make sure the flavor type for the SRv6 SID is PSP.
•
The End.DT4 SID, End.DT6 SID, End.DT46 SID, End.DX4 SID, or End.DX6 SID can be used only as the SRv6 SID of the destination node.
Performing an SRv6 SID-based ping operation
Restrictions and guidelines
End-to-end ping requires configuring an End.OP SID on the destination node.
Procedure
To perform an SRv6 SID-based ping operation, execute the following command in any view: ping ipv6-sid [ -a source-ipv6 | -c count | -m interval | -q | -s packet-size
| -t timeout | -tc traffic-class | -v ] * [ segment-by-segment ]
{ sid }&<1-11>
343
Performing an SRv6 SID-based tracert operation
Restrictions and guidelines
Hop-by-hop tracert requires configuring an End.OP SID on the destination node.
Prerequisites
For hop-by-hop tracert, configure the following settings:
•
Enable sending of ICMPv6 timeout packets on the intermediate devices (devices between the source and destination nodes).
•
Enable sending of ICMPv6 timeout packets and ICMPv6 destination unreachable packets on the destination node.
For overlay tracert, enable sending of ICMPv6 destination unreachable packets on the intermediate devices (devices between the source and destination nodes) and destination node.
Procedure
To perform an SRv6 SID-based tracert operation, execute the following command in any view: tracert ipv6-sid [ -a source-ipv6 | -f first-hop | -i interface-type interface-number | -m max-hops | -p port | -q packet-number | -t traffic-class | -w timeout ] * [ overlay ] { sid }&<1-11>
Performing an SRv6 TE policy-based ping operation
Restrictions and guidelines
This task requires configuring an End.OP SID on the destination node.
Procedure
To perform an SRv6 TE policy-based ping operation, execute the following command in any view: ping srv6-te policy { policy-name policy-name | color color-value
end-point ipv6 ipv6-address | binding-sid bsid } [ end-op end-op ] [ -a source-ipv6 | -c count | -h hop-limit | -m interval | -s packet-size | -t timeout | -tc traffic-class ] *
Performing an SRv6 TE policy-based tracert operation
Restrictions and guidelines
This task requires configuring an End.OP SID on the destination node.
Prerequisites
Enable sending of ICMPv6 timeout packets on the intermediate devices (devices between the source and destination nodes) and destination node.
Enable sending of ICMPv6 destination unreachable packets on the destination node.
Procedure
To perform an SRv6 TE policy-based tracert operation, execute the following command in any view:
344
tracert srv6-te policy { policy-name policy-name | color color-value
end-point ipv6 ipv6-address | binding-sid bsid } [ end-op end-op ] [ -a
source-ipv6 | -f first-hop | -m max-hops | -p port | -q packet-number |
-s packet-size | -tc traffic-class | -w timeout ] *
345
Configuring SRv6 service chains
About SRv6 service chains
To meet service security and stability requirements, you can steer data packets to pass through various service nodes as orchestrated in the network. For example, steer data packets to pass through firewalls, IPSs, application accelerators, and NAT devices. SRv6 service function chaining
(SFC) is a technology that can meet the requirements. This technology adds SRv6 path information to the original packets to steer the packets to pass through application service devices as orchestrated. The path orchestrated by SRv6 SFC is called an SRv6 service chain.
SRv6 service chain basic concepts
As shown in Figure 89 , specific service packets from the user network are steered into the
application service nodes in the SRv6 service chain network. After the service nodes process the packets, the packets are forwarded to the destination.
Figure 89 SRv6 service chain network diagram
SF 1 SF 2
User network User network
SC SFF 1 SFF 2
SRv6-TE Policy
Tail node
SRv6 service chain network
An SRv6 service chain network contains the following components:
•
Service classifier (SC) —Source node of the SRv6 service chain, which is located at the edge of the SRv6 service chain network. The SC can use multiple methods to steer service data to an
SRv6 TE policy tunnel.
•
Service function (SF) —Node that provides specific application services for data traffic. An application service node that cannot recognize SRv6 packets is called an SRv6-unaware SF.
An application service node that can recognize SRv6 packets is called an SRv6-aware SF.
•
Service function forwarder (SFF) —Node that acts as a service chain proxy for SFs. Based on the SRv6 decapsulation information of received packets, the SFF forwards the packets to the
SFs associated with the SFF. The SFs process the packets, and then return the packets back to the SFF. The SFF determines whether to continue forwarding the packets.
346
Proxy modes
Static proxy mode
Use this mode if SRv6-unaware SFs are attached to SFFs. Because the SFs cannot recognize SRv6 packets, the SFFs must decapsulate SRv6 packets and deliver the original packets from the user network to the SFs. After the SFs process the original packets, they forward the packets back to the
SFFs. The SFFs determine whether to continue forwarding the packets in the SRv6 service chain network. If the SFFs continue forwarding the packets in the SRv6 service chain network, they reencapsulate the packets with SRv6 headers based on the manually configured SID list.
This mode supports only IPv4 inner packets and supports dualhoming protection and bypass protection.
End.AS SIDs are used by an SRv6 service chain to forward packets in static proxy mode. An End.AS
SID identifies an SF. The functions of an End.AS SID are as follows:
•
For packets delivered from an SFF to an SF, the SFF performs the following operations: a. Decapsulates the packets. b. Forwards the packets out of the interface associated with the End.AS SID.
•
For packets delivered from an SF to an SFF, the SFF reencapsulates the packets according to one of the following configurations:
The End.AS SID configuration associated with the input interface of the packets.
The End.AS SID configuration associated with the input interface and inbound VLANs of the packets.
Masquerading mode
Use this mode if SRv6-aware SFs are attached to SFFs. Because the SFs can recognize SRv6 packets, the SFFs directly deliver SRv6 packets to the SFs. The SFs process the SRv6 packets without modifying the SRH, and they forward the packets back to the SFFs. The, the SFFs process the packets according to the standard SRv6 traffic forwarding process.
This mode supports IPv4, IPv6, and Ethernet inner packets and does not support dualhoming protection or bypass protection.
End.AM SIDs are used by an SRv6 service chain to forward packets in masquerading mode. An
End.AM SID identifies an SF. The functions of an End.AM SID are as follows:
•
For packets delivered from an SFF to an SF, the SFF performs the following operations: a. Replaces the destination IP address of the packets with the first SID value in the SRH
(SRH[0]). b. Forwards the packets out of the interface associated with the End.AM SID.
•
For packets delivered from an SF to an SFF, the SFF performs the following operations: c. Restores the destination IP address of the packets to the SID pointed by the SL field in the
SRH. d. Forwards the packets according to the standard SRv6 traffic forwarding process.
347
SRv6 service chain traffic forwarding
In static proxy mode
As shown in Figure 90 , packets pass through an SRv6 service chain in static proxy mode as follows
in an IPv4 L3VPN over SRv6 TE network:
1. After the SC (source node) receives IPv4 packets from the user network, it steers the packets to an SRv6 TE policy. Then, the SC adds an SRH and outer IPv6 header to the packets according to the SRv6 TE policy. The destination address of the SRv6 packets is the End.AS SID of the
SFF. The SRH includes path information in the SRv6 TE policy and the End.DT4 SID of the tail node.
2. When the SFF receives the SRv6 packets, it looks up the local SID forwarding table and finds that the destination address of the packets is the local End.AS SID. Then, the SFF records the
SL value in the packets and performs the following operations: a. Removes the outer IPv6 header and SRH from the packets. b. Forwards the original packets to the SF through the specified output interface.
3. After the SF processes the packets, it forwards the packets back to the SFF.
4. The SFF searches for SID list configuration based on the input interface of the packets or the input interface and inbound VLANs of the packets. Then, the SFF performs the following operations: a. Reencapsulates the packets as SRv6 packets according to the configured SID list. The SID list in the SRH must be the same as the path in the SRv6 TE policy on the source node (SC).
In addition, the SL value in the SRH decreases by 1 based on the SL value recorded in step
2. The destination address of the SRv6 packets is the SID next to the local End.AS SID, which is the End SID of Device C. b. Looks up the IPv6 routing table for a route that can reach the destination IPv6 address in the packets and forwards the packets.
5. When Device C receives the packets, it looks up the local SID forwarding table and finds that the destination address is the local End SID. Then, Device C processes the packets as follows: a. Replaces the destination address with D1 (End SID of the tail node). b. Decreases the SL value by 1. c. Looks up the IPv6 routing table to forward the packets.
6. After the tail node receives the packets, it looks up the local SID forwarding table and finds that the destination address is D1 (the local End SID). Then, the tail node performs the following operations: a. Replaces the destination address with D2 (End.DT4 SID of the tail node) and decreases the
SL value by 1. The SL value changes to 0. b. Executes the function of the End.DT4 SID, which is decapsulating the SRv6 packets and forwards the original packets to the public network or the destination VPN instance.
348
Figure 90 SRv6 service chain traffic forwarding in static proxy mode
SF
User network
User network
Payload Payload Payload Payload
SC
End SID=A
IPv6 Hdr
SRH
DA=B
SL=3 (D2,D1,C,B)
Payload
SFF
End.AS SID=B
SID list (D2,D1,C,B)
IPv6 Hdr
SRH
DA=C
SL=2 (D2,D1,C,B)
Payload
Device C
End SID=C
IPv6 Hdr
Tail node
End SID=D1
End.DT4 SID=D2
DA=D1
SRH SL=1 (D2,D1,C,B)
Payload
In masquerading mode
As shown in Figure 91 , packets pass through an SRv6 service chain in masquerading mode as
follows in an IPv4 L3VPN over SRv6 TE network:
1. After the SC (source node) receives IPv4 packets from the user network, it steers the packets to an SRv6 TE policy. Then, the SC adds an SRH and outer IPv6 header to the packets according to the SRv6 TE policy. The destination address of the SRv6 packets is the End.AM SID of the
SFF. The SRH includes path information in the SRv6 TE policy and the End.DT4 SID of the tail node.
2. When the SFF receives the SRv6 packets, it looks up the local SID forwarding table and finds that the destination address of the packets is the local End.AM SID. Then, the SFF performs the following operations: a. Replaces the destination IP address of the SRv6 packets with the last SID in the SID list of the SRH. The last SID is the End.DT4 SID of the tail node. b. Decreases the SL value by 1. c. Forwards the packets from the output interface bound to the End.AM SID to the SF.
3. The SF processes the packets without modifying the SRv6 packet headers and forwards the packets back to the SFF.
4. The packets return back to the SFF. If an End.AM SID is bound to the input interface or both the input interface and VLAN of the packets, the SFF replaces the destination address of the SRv6 packets according to the SL value in the SRH. The SL value is 2, so the SFF replaces the destination address of the SRv6 packets with C (the next SID of the local End.AM SID, which is the End SID of Device C). The SFF looks up the IPv6 routing table to forward the packets according to the destination IPv6 address.
5. When Device C receives the packets, it looks up the local SID forwarding table and finds that the packet destination address is the local End SID. Then, Device C forwards the packets according to the standard SRv6 traffic forwarding process as follows: a. Replaces the packet destination address with D1 (the End SID of the tail node). b. Decreases the SL value by 1. c. Looks up the IPv6 routing table to forward the packets.
349
6. When the tail node receives the packets, it looks up the local SID forwarding table and finds that packet destination address D1 is the local End SID. Then, the tail node replaces the destination address with D2 (the End.DT4 SID of the tail node) and decreases the SL value by 1. The SL value changes to 0. Finally, the tail node executes the function of the End.DT4 SID as follows: a. Decapsulates the SRv6 packets. b. Forwards the original packets to the matching VPN instance or to the public network.
Figure 91 SRv6 service chain traffic forwarding in masquerading mode
SF
User network
Payload
DA=D2
SL=2
Payload
DA=D2
SL=2
Payload
User network
Payload
SC
End SID=A
IPv6 Hdr
SRH
DA=B
SL=3 (D2,D1,C,B)
Payload
SFF
End.AM SID=B
Device C
End SID=C
IPv6 Hdr
SRH
DA=C
SL=2 (D2,D1,C,B)
Payload
Tail node
End SID=D1
End.DT4 SID=D2
IPv6 Hdr
SRH
DA=D1
SL=1 (D2,D1,C,B)
Payload
High availability for SRv6 service chains in static proxy mode
IMPORTANT:
This feature is not supported by SRv6 service chains in masquerading mode.
About this feature
As shown in Figure 92 , when the SF is unreachable, the SFF discards the packets that should be
forwarded to the SF. These packets cannot bypass the SF to reach Device C.
For high availability, the SFF supports dualhoming protection and bypass protection.
•
Dualhoming protection —An SF is dualhomed to two SFFs, one SFF is the primary SFF and the other is the backup SFF. When the primary SFF cannot reach the SF, it forwards service traffic to the backup SFF.
•
Bypass protection —When an SF fails, packets can bypass the SF to reach the next hop.
350
Figure 92 Packet forwarding failure caused by unreachable SF
SF
User network
User network
SC
End SID=A
SFF
End.AS SID=B
Device C
End SID=C
Tail node
End SID=D1
End.DT4 SID=D2
SRv6 service chain traffic forwarding with dualhoming protection
As shown in Figure 93 , the SF is dualhomed to SFF 1 and SFF 2. Bypass protection is not
configured.
For high availability, perform the following tasks on both SFF 1 and SFF 2:
•
Specify the End SID of one SFF as the backup peer SID of the other SFF.
•
Use the same locator to allocate the primary and backup End.AS SIDs.
•
Configure the same primary and backup End.AS SIDs.
As shown in Figure 93 , dualhoming protection acts as follows in packet forwarding:
1. When SFF 1 detects that it cannot reach the SF, it removes the outer IPv6 header and SRH from packets.
2. SFF 1 searches the local configuration and reencapsulates an SRH and IPv6 header to the packets. In the SRH, the SID list includes the backup End.AS SID (X2) and the End SID of SFF
2 (C). In the IPv6 header, the destination address is C.
3. SFF 1 looks up the routing table to forward the packets to the backup SFF SFF 2.
4. When the packets reach SFF 2, SFF 2 detects whether it can reach the SF.
If SFF 2 can reach the SF, it forwards the packets to the SF as in a standard SRv6 service chain traffic forwarding process in static proxy mode.
If SFF 2 cannot reach the SF, it discards the packets.
351
Figure 93 SRv6 service chain traffic forwarding with dualhoming protection in static proxy mode
SF
User network
User network
Payload IPv6 Hdr
SRH
DA=D
SL=2 (E2,E1,D,X1)
Payload
SC
End SID=A
SFF 1
End SID=B
Primary End.AS SID=X1
Backup End.AS SID=X2
SID list (E2,E1,D,X1)
SFF 2
End SID=C
Primary End.AS SID=X1
Backup End.AS SID=X2
SID list (E2,E1,D,X1)
Device D
End SID=D
IPv6 Hdr
SRH
DA=X1
SL=3 (E2,E1,D,X1)
Payload
IPv6 Hdr
SRH
DA=C
SL=1 (X2,C)
Payload
Tail node
End SID=E1
End.DT4 SID=E2
IPv6 Hdr
SRH
DA=E1
SL=1 (E2,E1,D,X1)
Payload
SRv6 service chain traffic forwarding with bypass protection
As shown in Figure 94 , in the SRv6 service chain network, SF 1 has a bypass protection node, which
is SF 2. SF 1 is single-homed to SFF 1 and the bypass protection node SF 2 is single-homed to SFF
2.
To implement bypass protection, enable bypass protection and specify a bypass End.AS SID on SFF
1.
With a bypass End.AS SID specified, bypass protection acts as follows in packet forwarding:
1. When SFF 1 detects that it cannot reach SF 1, it removes the outer IPv6 header and SRH from packets.
2. SFF 1 searches the local configuration and reencapsulates an IPv6 header to the packets. In the IPv6 header, the destination address is C.
3. SFF 1 looks up the routing table to forward the packets to SFF 2.
4. After SFF 2 receives the packets, it forwards the packets as in a standard SRv6 service chain traffic forwarding process in static proxy mode.
Without a bypass End.AS SID specified, SFF 1 skips the End.AS SID of SF 1 when it cannot reach
SF 1. The SFF uses the End SID of Device D as the next hop destination address. The packets are forwarded to the tail node according to the SRH.
352
Figure 94 SRv6 service chain traffic forwarding with bypass protection in static proxy mode
SF 1 Bypass SF 2
User network
User network
Payload Payload
IPv6 Hdr
SRH
DA=E1
SL=1 (E2,E1,D,C)
Payload
SC
End SID=A
IPv6 Hdr
SFF 1
End.AS SID=B
Bypass End.AS SID=C
SID list (E2,E1,D,B)
SFF 2
Bypass End.AS SID=C
SID list (E2,E1,D,C)
DA=B IPv6 Hdr
Device D
End SID=D
DA=D
Tail node
End SID=E1
End.DT4 SID=E2
SRH SL=3 (E2,E1,D,B) IPv6 Hdr DA=C SRH SL=2 (E2,E1,D,C)
Payload Payload Payload
SRv6 service chain traffic forwarding with dualhoming and bypass protection
As shown in Figure 95 , in the SRv6 service chain network, SF 1 has a bypass protection node, which
is SF 2. SF 1 is dualhomed to SFF 1 and SFF 2 and the bypass protection node SF 2 is single-homed to SFF 3. Dualhoming protection takes precedence over bypass protection. When dualhoming protection is not available or fails, bypass protection applies.
To implement dualhoming protection and bypass protection, perform the following tasks on the
SFFs:
•
On SFF 1 and SFF 2, specify the End SID of one SFF as the backup peer SID of the other SFF.
•
On SFF 1 and SFF 2, use the same locator to allocate the primary and backup End.AS SIDs.
•
On SFF 1 and SFF 2, configure the same primary and backup End.AS SIDs.
•
On SFF 1 and SFF 2, enable bypass and specify a bypass End.AS SID.
As shown in Figure 95 , dualhoming protection and bypass protection act as follows in packet
forwarding:
1. SFF 1 forwards packets according to whether it can reach SF 1.
If SFF 1 can reach SF 1, it processes the packets as in a standard SRv6 service chain traffic forwarding process in static proxy mode.
If SFF 1 cannot reach SF 1, it removes the outer IPv6 header and SRH from the packets.
Then, SFF 1 reencapsulates an SRH and IPv6 header to the packets according to the local configuration. In the SRH, the SID list contains the backup End.AS SID (X2) and the End
SID of SFF 2 (C). In the IPv6 header, the destination address is C. Finally, SFF 1 looks up the routing table to forward the packets to SFF 2.
2. When SFF 2 receives the packets, it processes the packets according to whether it can reach
SF 1.
If SFF 2 can reach SF 1, it forwards the packets as in a standard SRv6 service chain traffic forwarding process in static proxy mode.
If SFF 2 cannot reach SF 1, it starts the bypass protection forwarding process. SFF 2 removes the outer IPv6 header and SRH from the packets. According to the local configuration, SFF 2 reencapsulates an SRH and IPv6 header to the packets. In the SRH, the SID list only contains the bypass End.AS SID (D). In the IPv6 header, the destination address is D. Then, SFF 2 looks up the routing table to forward the packets to SFF 3.
353
3. When SFF 3 receives the packets, it processes the packets according to whether it can reach the bypass protection node SF 2.
If SFF 3 can reach SF 2, it processes the packets as in a standard SRv6 service chain traffic forwarding process in static proxy mode.
If SFF 3 cannot reach SF 2, it discards the packets.
Figure 95 SRv6 service chain traffic forwarding with dualhoming and bypass protection in static proxy mode
SF 1 Bypass SF 2
User network
User network
Payload Payload
SC
End SID=A
SFF 1
End SID=B
Primary End.AS SID=X1
Backup End.AS SID=X2
Bypass End.AS SID=D
SID list (E2,E1,X1)
SFF 2
End SID=C
Primary End.AS SID=X1
Backup End.AS SID=X2
Bypass End.AS SID=D
SID list (E2,E1,X1)
SFF 3
End.AS SID=D
SID list (E2,E1,D)
IPv6 Hdr
SRH
DA=X1
SL=2 (E2,E1,X1)
Payload
IPv6 Hdr
SRH
DA=C
SL=1 (X2,C)
Payload
IPv6 Hdr DA=D
Payload
Tail node
End SID=E1
End.DT4 SID=E2
IPv6 Hdr
SRH
DA=E1
SL=1 (E2,E1,D)
Payload
Restrictions and guidelines: SRv6 service chain configuration
This feature is supported only in IP L3VPN over SRv6 networks and EVPN L3VPN over SRv6 networks.
An SRv6 service chain in static proxy mode can process only packets whose inner protocol is IPv4.
An SRv6 service chain in masquerading mode can process packets whose inner protocol is IPv4,
IPv6, or Ethernet.
An SRv6 service chain in masquerading mode does not support dualhoming protection and bypass protection.
To avoid SRv6 packet loops on an SFF in a masquerading-mode SRv6 service chain, execute the undo ipv6 fast-forwarding load-sharing command on the SFF if it is connected to multiple SFs.
SRv6 service chain tasks at a glance (static proxy mode)
To configure an SRv6 service chain in static proxy mode, perform the following tasks:
1. Configuring SRv6 TE policy traffic steering
354
Perform this task on the SC to steer traffic to an SRv6 TE policy tunnel according to service requirements. For more information about traffic steering, see "Configuring SRv6 TE policies."
2. Configure basic settings for an SRv6 service chain in static proxy mode on an SFF
Creating an SRv6 service chain in static proxy mode
Configuring the packet encapsulation method for an SRv6 service chain in static proxy mode
Configuring packet reencapsulation parameters for an SRv6 service chain in static proxy mode
(Optional.) Configuring the DiffServ mode for an SRv6 service chain in static proxy mode
(Optional.) Configuring the TTL mode for an SRv6 service chain in static proxy mode
3.
Configuring dualhoming protection for an SRv6 service chain in static proxy mode
4.
Configuring bypass protection for an SRv6 service chain in static proxy mode
5.
Using static BFD in echo packet mode to detect SF reachability
SRv6 service chain tasks at a glance
(masquerading mode)
To configure an SRv6 service chain in masquerading mode, perform the following tasks:
1. Configuring SRv6 TE policy traffic steering
Perform this task on the SC to steer traffic to an SRv6 TE policy tunnel according to service requirements. For more information about traffic steering, see "Configuring SRv6 TE policies."
2. Configure basic settings for an SRv6 service chain in masquerading mode on an SFF
Creating an SRv6 service chain in masquerading mode
Configuring the packet encapsulation method for an SRv6 service chain in masquerading mode
Prerequisites for SRv6 service chain configuration
Before you configure an SRv6 service chain, complete the following tasks:
•
Determine device roles in the service chain network. Configure IGP among the devices to realize IPv6 network connectivity and advertise SRv6 SIDs.
•
Plan the service chain explicit path and SRv6 TE policy path.
•
Configure VPN instances on the SC and tail node as needed and bind interfaces to the VPN instances.
Creating an SRv6 service chain
Creating an SRv6 service chain in static proxy mode
About this task
Perform this task on an SFF to configure an End.AS SID to associate an SF with the SFF, create an
SRv6 service chain in static proxy mode, and enter SRv6 service chain static proxy view.
In SRv6 service chain static proxy view, specify the protocol type of original packets supported by the
SFF. If you do not specify a protocol type, the SFF cannot forward the original packets to the SF associated with the SFF.
355
Restrictions and guidelines
In a dualhoming protection scenario, the End.AS SID and End SID on each SFF must belong to different locators.
An SFF can forward only original packets of the IPv4 protocol type to its associated SF.
Procedure
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Create an SRv6 locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an End.AS opcode and enter SRv6 service chain static proxy view.
opcode opcode end-as
5. Allow the SFF to send original packets of the IPv4 protocol type to the SF associated with it. inner-type ipv4
By default, the SFF cannot send original packets of any protocol type to an SF.
Creating an SRv6 service chain in masquerading mode
1. Enter system view. system-view
2. Enable SRv6 and enter SRv6 view. segment-routing ipv6
3. Configure an SRv6 locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an End.AM SID opcode and enter SRv6 service chain masquerading view.
opcode opcode end-am
Configuring the encapsulation method for packets between a pair of SFF and SF
Configuring the packet encapsulation method for an SRv6 service chain in static proxy mode
About this task
An SF can access an SFF through a Layer 2 or Layer 3 interface. According to the interface type, you can configure the encapsulation method for packets between the SFF and SF to ensure correct packet forwarding.
An SF might have multiple VMs to load share traffic for the same application service. You can configure the packet encapsulation method multiple times for the same SRv6 service chain in static proxy mode in order to distribute the application service traffic among the VMs.
356
Restrictions and guidelines
To ensure correct forwarding, do not bind other services such as VPN instances to an interface if that interface is specified as the input or output interface of an SRv6 service chain in static proxy mode.
An SRv6 service chain in static proxy mode supports only one packet encapsulation method. You cannot configure both Layer 2 and Layer 3 encapsulation methods for the service chain.
The same input interface cannot be shared by an SRv6 service chain in static proxy mode and an
SRv6 service chain in masquerading mode.
Layer 3 encapsulation supports only Layer 3 output interfaces and Layer 3 input interfaces. VLAN interfaces cannot be used as output interfaces or input interfaces for Layer 2 encapsulation.
When you configure Layer 2 encapsulation, follow these restrictions and guidelines:
•
Each SRv6 service chain in static proxy mode must have unique input interfaces, inner inbound
VLAN IDs, and outer inbound VLAN IDs.
•
In an SRv6 service chain in static proxy mode, the same output interface and inner and outer outbound VLAN IDs can be associated with only one input interface. If you associate different input interfaces with the same output interface and inner and outer outbound VLAN IDs for the
SRv6 service chain, the most recent configuration takes effect.
For Layer 3 encapsulation, each SRv6 service chain in static proxy mode must have unique input interfaces. In the same SRv6 service chain in static proxy mode, one output interface can be associated with only one input interface.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain static proxy view.
opcode opcode end-as
5. Configure the encapsulation method for packets forwarded between the SFF and SF. Choose one of the following tasks:
Configure Layer 2 encapsulation for packets forwarded between the SFF and SF.
encapsulation eth out-interface out-interface-type out-interface-number [ out-s-vlan out-svid [ out-c-vlan out-cvid ] ]
in-interface in-interface-type in-interface-number [ in-s-vlan
in-svid [ in-c-vlan in-cvid ] ] [ dest-mac dest-mac ]
By default, Layer 2 encapsulation is not configured for packets forwarded between the SFF and SF.
To load share traffic, execute this command multiple times to specify multiple interfaces or
VLANs.
Configure Layer 3 encapsulation for inner IPv4 packets forwarded between the SFF and SF.
encapsulation ipv4 nexthop nexthop-addr out-interface
out-interface-type out-interface-number in-interface
in-interface-type in-interface-number [ symmetric-index
index-value ]
By default, Layer 3 encapsulation is not configured for inner IPv4 packets forwarded between the SFF and SF.
To load share traffic, execute this command multiple times to specify multiple next hops.
357
Configuring the packet encapsulation method for an SRv6 service chain in masquerading mode
About this task
An SF can access an SFF through a Layer 2 or Layer 3 interface. According to the interface type, you can configure the encapsulation method for packets between the SFF and SF to ensure correct packet forwarding.
Restrictions and guidelines
To ensure correct forwarding, do not bind other services such as VPN instances to an interface if that interface is specified as the input or output interface of an SRv6 service chain.
An SRv6 service chain in masquerading mode supports only one packet encapsulation method. You cannot configure both the Layer 2 and Layer 3 encapsulation methods for the same SRv6 service chain in masquerading mode.
When you configure input interfaces, follow these restrictions and guidelines:
•
The same input interface cannot be shared by an SRv6 service chain in static proxy mode and an SRv6 service chain in masquerading mode.
•
Multiple SRv6 service chains in masquerading mode can share the same input interface.
•
Layer 3 encapsulation supports only Layer 3 input interfaces. VLAN interfaces cannot be used as input interfaces for Layer 2 encapsulation.
When you configure output interfaces and outer outbound VLAN IDs, follow these restrictions and guidelines:
•
Layer 3 encapsulation supports only Layer 3 output interfaces. VLAN interfaces cannot be used as output interfaces for Layer 2 encapsulation.
•
For Layer 2 encapsulation, the same output interface and inner and outer outbound VLAN IDs can be associated with only one input interface in an SRv6 service chain in masquerading mode. If you associate different input interfaces with the same output interface and inner and outer outbound VLAN IDs for the SRv6 service chain, the most recent configuration takes effect.
•
For Layer 3 encapsulation, one output interface can be associated with only one input interface in an SRv6 service chain in masquerading mode.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain masquerading view.
opcode opcode end-am
5. Configure the encapsulation method for packets forwarded between the SFF and SF. Choose one of the following tasks:
Configure Layer 2 encapsulation for packets forwarded between the SFF and SF.
encapsulation eth out-interface out-interface-type out-interface-number [ out-s-vlan out-svid [ out-c-vlan out-cvid ] ]
in-interface in-interface-type in-interface-number [ in-s-vlan
in-svid [ in-c-vlan in-cvid ] ]
358
By default, Layer 2 encapsulation is not configured for packets forwarded between an SFF and SF.
To load share traffic, execute this command multiple times to specify multiple interfaces or
VLANs.
Configure Layer 3 encapsulation for IPv6 packets forwarded between the SFF and SF.
encapsulation ipv6 nexthop nexthop-addr out-interface
out-interface-type out-interface-number in-interface in-interface-type in-interface-number
By default, Layer 3 encapsulation is not configured for IPv6 packets forwarded between an
SFF and SF.
To load share traffic, execute this command multiple times to specify multiple next hops.
Configuring packet reencapsulation parameters for an SRv6 service chain in static proxy mode
About this task
In static proxy mode, when packets return back to an SFF after they are processed by the SF associated with the SFF, they do not have an outer IPv6 header or SRH. To continue forwarding the packets in the SRv6 service chain network, the SFF must reencapsulate an SRH and outer IPv6 header to the packets. Perform this task to configure packet reencapsulation parameters on the SFF.
When the SFF receives packets forwarded from its associated SF, it searches for a matching service chain in static proxy mode based on the input interface of the packets. Then, the SFF adds an SRH and outer IPv6 header to the packets. The SRH contains the SID list configured for the service chain by using the cache list command. The destination address in the outer IPv6 header is the SID next to the local End.AS SID in the SID list. The source address in the outer IPv6 header is the source IPv6 address manually specified by using the cache source-address command.
Restrictions and guidelines
Specify the SID value of each node in the forwarding path according to the number of hops to the source node. The fewer the hops to the source node, the closer the SID position to the front of the
SID list.
To avoid loops, each SID in the specified SID list must be unique.
The SID list must contain a minimum of two SIDs and must contain End.AS SIDs. The last SID in the
SID list must be an End.DT4 SID.
The explicit path of the specified SID list must be consistent with the end-to-end path in the SRv6 TE policy on the SC.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain static proxy view.
opcode opcode end-as
359
5. Specify the source IPv6 address that will be reencapsulated to the packets received from the
SF associated with the SFF.
cache source-address ipv6-address
By default, no source IPv6 address is specified for the SFF to reencapsulate the packets received from its associated SF. The SFF discards the packets.
6. Specify the SID list that will be reencapsulated to the packets received from the SF associated with the SFF.
cache list sid-list
By default, no SID list is specified for the SFF to reencapsulate the packets received from its associated SF.
Configuring the DiffServ mode for an SRv6 service chain in static proxy mode
About this task
In static proxy mode, perform this task on an SFF to configure the DiffServ mode for packets forwarded between the SFF and its associated SF. By default, the DiffServ mode for an SRv6 service chain in static proxy mode is uniform. If you set the mode to pipe, you must also specify the service class and color.
•
Pipe mode —In this mode, packets are processed as follows:
In the inbound direction (from SF to SFF), the SFF ignores the IP precedence or DSCP value in the incoming packets. Instead, the SFF uses the specified service class as the priority and uses the specified color as the color flag when it reencapsulates the packets as
SRv6 packets. In the SRv6 network, devices perform QoS scheduling for the packets based on the specified service class and color.
In the outbound direction (from SFF to SF), the SFF removes the outer IPv6 header and
SRH without modifying the IP precedence, DSCP, or color in the original packets.
•
Uniform mode —In this mode, packets are processed as follows:
In the inbound direction (from SF to SFF), the SFF maps the IP precedence or DSCP value in the original packets to the outer IPv6 header when it reencapsulates the packets. The color of the original packets is not mapped to the outer IPv6 header.
In the outbound direction (from SFF to SF), the SFF removes the outer IPv6 header and
SRH from outgoing packets. Then, the SFF maps the priority value in the outer IPv6 header to the IP precedence or DSCP of the original packets. The color of the outer IPv6 header is not mapped to the original packets.
Restrictions and guidelines
For more information about IP precedence, DSCP, and color, see QoS configuration in ACL and QoS
Configuration Guide .
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain static proxy view.
360
opcode opcode end-as
5. Configure the DiffServ mode for the SRv6 service chain in static proxy mode.
sfc diffserv-mode pipe service-class color
By default, the DiffServ mode is uniform for an SRv6 service chain in static proxy mode.
Configuring the TTL mode for an SRv6 service chain in static proxy mode
About this task
In static proxy mode, perform this task on an SFF to configure the TTL mode for packets forwarded back to the SFF from its associated SF.
•
Uniform mode —When packets are forwarded back to the SFF, the SFF decreases the TTL value in the original packets by 1 and encapsulates the TTL to the reencapsulated outer IPv6 header.
•
Pipe mode —When packets are forwarded back to the SFF, the SFF decreases the specified
TTL value by 1 and encapsulates the TTL to the reencapsulated outer IPv6 header.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain static proxy view.
opcode opcode end-as
5. Configure the TTL mode for the SRv6 service chain in static proxy mode.
sfc ttl-mode pipe ttl-value
By default, the TTL mode is uniform for an SRv6 service chain in static proxy mode.
Configuring dualhoming protection for an SRv6 service chain in static proxy mode
Restrictions and guidelines
The End.AS SID and End SID on an SFF must belong to different locators.
Make sure the SFFs in a dualhoming protection scenario are configured with the same primary and backup End.AS opcodes.
Make sure the static SIDs on the SFFs do not conflict with each other.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
361
3. Specify the End SID of the peer SFF as the backup peer SID.
proxy peer-sid peer-sid
By default, no backup peer SID is specified for dualhoming protection.
In a dualhoming protection scenario, specify the End SID of the peer SFF as the backup peer
SID on each SFF.
4. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
5. Enter SRv6 service chain static proxy view.
opcode opcode end-as
6. Specify a backup End.AS SID opcode for SRv6 service chain dualhoming protection in static proxy mode.
backup-opcode func-opcode
By default, no backup End.AS SID opcode is specified for SRv6 service chain dualhoming protection in static proxy mode.
The primary and backup End.AS SIDs on both SFFs must belong to the same locator. Use different opcodes to distinguish the primary and backup End.AS SIDs on the SFFs.
Configuring bypass protection for an SRv6 service chain in static proxy mode
Restrictions and guidelines
Dualhoming protection takes precedence over bypass protection. If dualhoming protection is not available or fails, bypass protection applies.
Procedure
1. Enter system view. system-view
2. Enter SRv6 view. segment-routing ipv6
3. Enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Enter SRv6 service chain static proxy view.
opcode opcode end-as
5. Enable bypass and specify a bypass End.AS SID. bypass [ sid ipv6-address ]
By default, bypass is disabled.
To ensure correct packet forwarding when the SF associated with the SFF is unreachable and the network does not have a bypass SF, enable bypass without specifying a bypass End.AS
SID. In this case, the SFF skips the End.AS SID of the current SF and uses the next SID in the
SRH as the next hop destination address. The data traffic is forwarded to the tail node according to the SRH.
362
Using static BFD in echo packet mode to detect
SF reachability
About this task
Perform this task on an SFF to use a static BFD session in echo packet mode to detect the reachability of the SF associated with that SFF. When the SF is unreachable, the system can quickly trigger dualhoming protection or bypass protection for the SRv6 service chain in static proxy mode.
Restrictions and guidelines
Layer 2 encapsulation does not support this feature in the current software version.
You only need to create a static BFD session on the local SFF.
When creating a static BFD session on an SFF, you must specify the IPv4 address of the SF associated with that SFF as the peer address of the session. The system only checks the IPv4 address format and does not validate it. To ensure successful static BFD session establishment, make sure the peer IP address and source IP address are correct for the session.
The local discriminator of each static BFD session must be unique.
When creating a static BFD session, you can specify a source IPv4 address for echo packets or not.
•
If you do not specify a source IPv4 address, the system uses the IPv4 address specified by using the bfd echo-source-ip command as the source IPv4 address of echo packets.
•
If you specify a source IPv4 address, the system uses the specified IPv4 address as the source
IPv4 address of echo packets. As a best practice, specify a source IP address when creating a static BFD session in echo packet mode.
For more information about the commands in this section, see BFD commands in High Availability
Command Reference .
Procedure
1. Enter system view. system-view
2. Configure the source IPv4 address of echo packets.
bfd echo-source-ip ip-address
By default, no source IPv4 address is configured for echo packets.
The source IP address cannot be on the same network segment as any local interface's IP address. This avoids the peer from sending a large number of ICMP redirect packets to cause network congestion.
3. Create a static BFD session and enter static BFD session view.
bfd static session-name [ peer-ip ipv4-address interface interface-type interface-number destination-ip ipv4-address
[ source-ip ipv4-address ] one-arm-echo [ discriminator auto ] ]
4. (Optional.) Specify the local discriminator for the static BFD session. discriminator local local-value
By default, no local discriminator is specified for a static BFD session.
Use this command only if no local discriminator is specified for a static BFD session when the session is created.
363
Verifying and maintaining SRv6 service chains
Displaying SRv6 service chain information
To display forwarding entry information about SRv6 service chains in static proxy mode, execute the following command in any view: display segment-routing ipv6 sfc forwarding [ locator locator-name
[ opcode operation-code ] ] [ nid-value ]
SRv6 service chain configuration examples
Example: Configuring an SRv6 service chain in masquerading mode with Layer 3 encapsulation
Network configuration
As shown in Figure 96 , CE 1 and CE 2 belong to one VPN instance. In the network, deploy an SRv6
service chain in masquerading mode to orchestrate the service traffic from CE 1 to pass through the
SF to reach CE 2.
SFF 1 is connected to the SF through a Layer 3 Ethernet interface. Layer 3 encapsulation is used for packets forwarded between the SFF and SF.
To meet the requirements, perform the following tasks:
•
On the SC and tail node, configure the VPN instance settings and steer service traffic to an
SRv6 TE policy. The forwarding path in the policy is SC—> SFF 1 —> SF —> Tail.
•
On SFF 1, configure an SRv6 service chain in masquerading mode with Layer 3 encapsulation.
Figure 96 Network diagram
SF
SC
GE0/0/2
GE0/0/1
GE0/0/1
GE0/0/1
GE0/0/2
GE0/0/3
SFF 1
Device
SC
SF
CE 1
Interface
Loop1
GE0/0/1
GE0/0/2
-
IP address
1::1/128
16.0.0.2/30
100::1/96
10::2/96
364
Device
SFF 1
Tail
GE0/0/2
GE0/0/1
GE0/0/1
CE 2
Interface
Loop1
GE0/0/1
GE1/0/2
GE1/0/3
IP address
2::2/128
100::2/96
10::1/96
400::1/96
Tail Loop1
GE0/0/1
GE0/0/2
5::5/128
57.0.0.1/30
400::2/96
CE 1
CE 2
Loop1
GE0/0/1
Loop1
GE0/0/1
6.6.6.6/32
16.0.0.1/30
7.7.7.7/32
57.0.0.2/30
Prerequisites
•
Plan SRv6 SIDs on each device.
On the SC, the network of locator a is 1000::/64, the End SID is 1000::1, and the End.DT4
SID is 1000::2.
On SFF 1, the network of locator b is 2000::/64, the End SID is 2000::1, the network of locator am1 is 2001::/64, and the End.AM SID is 2001::1.
On the tail node, the network of locator e is 5000::/64, the End SID is 5000::1, and the
End.DT4 SID is 5000::2.
•
Plan the traffic forwarding tunnel and the explicit path of the tunnel. In this example, traffic on the SC is forwarded to the tail node through the explicit path of an SRv6 TE policy. In the forwarding path, SFF 1 forwards the traffic to the SF. The SF processes the traffic and forwards the traffic back to SFF 1. SFF 1 forwards the traffic to the tail node.
Procedure
1. On the SC, SFF 1, and the tail node, configure IPv6 IS-IS to ensure their reachability over the backbone network:
# Configure the SC.
<SC> system-view
[SC] isis 1
[SC-isis-1] is-level level-2
[SC-isis-1] cost-style wide
[SC-isis-1] network-entity 10.1111.1111.1111.00
[SC-isis-1] address-family ipv6 unicast
[SC-isis-1-ipv6] quit
[SC-isis-1] quit
[SC] interface loopback 1
[SC-LoopBack1] ipv6 address 1::1 128
[SC-LoopBack1] isis ipv6 enable 1
[SC-LoopBack1] quit
[SC] interface gigabitethernet 0/0/2
[SC-GigabitEthernet0/0/2] ipv6 address 100::1 96
[SC-GigabitEthernet0/0/2] isis ipv6 enable
[SC-GigabitEthernet0/0/2] quit
# Configure SFF 1.
<SFF1> system-view
[SFF1] isis
[SFF1-isis-1] is-level level-2
[SFF1-isis-1] cost-style wide
[SFF1-isis-1] network-entity 10.2222.2222.2222.00
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
[SFF1] interface loopback 1
[SFF1-LoopBack1] ipv6 address 2::2 128
365
[SFF1-LoopBack1] isis ipv6 enable
[SFF1-LoopBack1] quit
[SFF1] interface gigabitethernet 0/0/1
[SFF1-GigabitEthernet0/0/1] ipv6 address 100::2 96
[SFF1-GigabitEthernet0/0/1] isis ipv6 enable
[SFF1-GigabitEthernet0/0/1] quit
[SFF1] interface gigabitethernet 0/0/3
[SFF1-GigabitEthernet0/0/3] ipv6 address 400::1 96
[SFF1-GigabitEthernet0/0/3] isis ipv6 enable
[SFF1-GigabitEthernet0/0/3] quit
# Configure the tail node.
<Tail> system-view
[Tail] isis
[Tail-isis-1] is-level level-2
[Tail-isis-1] cost-style wide
[Tail-isis-1] network-entity 10.5555.5555.5555.00
[Tail-isis-1] address-family ipv6 unicast
[Tail-isis-1-ipv6] quit
[Tail-isis-1] quit
[Tail] interface loopback 1
[Tail-LoopBack1] ipv6 address 5::5 128
[Tail-LoopBack1] isis ipv6 enable
[Tail-LoopBack1] quit
[Tail] interface gigabitethernet 0/0/2
[Tail-GigabitEthernet0/0/2] ipv6 address 400::2 96
[Tail-GigabitEthernet0/0/2] isis ipv6 enable
[Tail-GigabitEthernet0/0/2] quit
# Verify that the SC, SFF 1, and the tail node can establish IPv6 IS-IS neighbor relationship with each other. Execute the display isis peer command on each device to verify that the neighbors are in up state. (Details not shown.)
# Execute the display isis route ipv6 command on the SC and tail node to verify that they have learned the routes of loopback interfaces to reach each other. (Details not shown.)
2. On the SC and tail node, configure VPN instance settings to allow CE 1 and CE 2 to access the
SC and tail node, respectively, in a VPN instance:
# Configure the SC.
[SC] ip vpn-instance vpn1
[SC-vpn-instance-vpn1] route-distinguisher 100:1
[SC-vpn-instance-vpn1] vpn-target 111:1
[SC-vpn-instance-vpn1] quit
[SC] interface gigabitethernet 0/0/1
[SC-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[SC-GigabitEthernet0/0/1] ip address 16.0.0.2 30
[SC-GigabitEthernet0/0/1] quit
# Configure the tail node.
[Tail] ip vpn-instance vpn1
[Tail-vpn-instance-vpn1] route-distinguisher 100:1
[Tail-vpn-instance-vpn1] vpn-target 111:1
[Tail-vpn-instance-vpn1] quit
366
[Tail] interface gigabitethernet 0/0/1
[Tail-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[Tail-GigabitEthernet0/0/1] ip address 57.0.0.1 24
[Tail-GigabitEthernet0/0/1] quit
# Configure IP addresses for interfaces on the CEs. (Details not shown.)
# On the SC and tail node, display VPN instance configuration to verify that the configuration is correct. Verify that the SC and tail node can ping their CEs. (This step uses the SC and CE 1 as an example.)
[SC] display ip vpn-instance
Total VPN-Instances configured : 1
Total IPv4 VPN-Instances configured : 1
Total IPv6 VPN-Instances configured : 1
VPN-Instance Name RD Address family Create time
vpn1 100:1 IPv4/IPv6 2020/10/29 13:59:39
[SC] ping -vpn-instance vpn1 16.0.0.1
Ping 16.0.0.1 (16.0.0.1): 56 data bytes, press CTRL+C to break
56 bytes from 16.0.0.1: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 16.0.0.1: icmp_seq=1 ttl=255 time=0.000 ms
56 bytes from 16.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 16.0.0.1: icmp_seq=3 ttl=255 time=0.000 ms
56 bytes from 16.0.0.1: icmp_seq=4 ttl=255 time=0.000 ms
--- Ping statistics for 16.0.0.1 in VPN instance vpn1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.000/0.600/2.000/0.800 ms
3. Configure the SC and tail node to establish EBGP peer relationship with their connected CEs and redistribute VPN routes:
# Configure CE 1.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 16.0.0.2 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 16.0.0.2 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
# Configure CE 2 in the same way CE 1 is configured. (Details not shown.)
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] router-id 1.1.1.1
[SC-bgp-default] ip vpn-instance vpn1
[SC-bgp-default-vpn1] peer 16.0.0.1 as-number 65410
[SC-bgp-default-vpn1] address-family ipv4 unicast
[SC-bgp-default-ipv4-vpn1] peer 16.0.0.1 enable
[SC-bgp-default-ipv4-vpn1] quit
[SC-bgp-default-vpn1] quit
# Configure the tail node in the same way the SC is configured. (Details not shown.)
367
# On the SC and tail node, execute the display bgp peer ipv4 vpn-instance command to verify that they have established BGP peer relationship with their connected CEs.
The peer relationship is in Established state. (Details not shown.)
4. Establish VPNv4 peer relationship between the SC and tail node:
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] peer 5::5 as-number 100
[SC-bgp-default] peer 5::5 connect-interface loopback 1
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 enable
[SC-bgp-default-vpnv4] quit
[SC-bgp-default] quit
# Configure the tail node.
[Tail] bgp 100
[Tail-bgp-default] peer 1::1 as-number 100
[Tail-bgp-default] peer 1::1 connect-interface loopback 1
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 enable
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] quit
# On the SC and tail node, execute the display bgp peer vpnv4 command to verify that they have established VPNv4 peer relationship with each other. The peer relationship is in
Established state. (Details not shown.)
5. Configure End SIDs and End.DT4 SIDs, and advertise the locators of the SIDs by using an IGP:
# Configure the SC.
[SC] segment-routing ipv6
[SC-segment-routing-ipv6] encapsulation source-address 11::11
[SC-segment-routing-ipv6] locator a ipv6-prefix 1000::1 64 static 32
[SC-segment-routing-ipv6-locator-a] opcode 1 end
[SC-segment-routing-ipv6-locator-a] opcode 2 end-dt4 vpn-instance vpn1
[SC-segment-routing-ipv6-locator-a] quit
[SC-segment-routing-ipv6] quit
[SC] isis 1
[SC-isis-1] address-family ipv6 unicast
[SC-isis-1-ipv6] segment-routing ipv6 locator a
[SC-isis-1-ipv6] quit
[SC-isis-1] quit
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] encapsulation source-address 22::22
[SFF1-segment-routing-ipv6] locator b ipv6-prefix 2000::1 64 static 32
[SFF1-segment-routing-ipv6-locator-b] opcode 1 end
[SFF1-segment-routing-ipv6-locator-b] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator b
[SFF1-isis-1-ipv6] quit
368
[SFF1-isis-1] quit
# Configure the tail node.
[Tail] segment-routing ipv6
[Tail-segment-routing-ipv6] encapsulation source-address 55::55
[Tail-segment-routing-ipv6] locator e ipv6-prefix 5000::1 64 static 32
[Tail-segment-routing-ipv6-locator-e] opcode 1 end
[Tail-segment-routing-ipv6-locator-e] opcode 2 end-dt4 vpn-instance vpn1
[Tail-segment-routing-ipv6-locator-e] quit
[Tail-segment-routing-ipv6] quit
[Tail] isis 1
[Tail-isis-1] address-family ipv6 unicast
[Tail-isis-1-ipv6] segment-routing ipv6 locator e
[Tail-isis-1-ipv6] quit
[Tail-isis-1] quit
# On the SC and tail node, verify that the End.DT4 SIDs have been redistributed to the routing table and SRv6 routes have been generated. This example only displays the routing table information on the SC.
[SC] display ipv6 routing-table protocol srv6
Summary count : 8
SRv6 Routing table status : <Active>
Summary count : 8
Destination: 1000::2/128 Protocol : SRv6
NextHop : ::1 Preference: 4
Interface : InLoop0 Cost : 0
SRv6 Routing table status : <Inactive>
Summary count : 0
6. On the SC and tail node, add End.DT4 SIDs to private network routes, exchange End.DT4 SIDs between peers, and allow the devices to recurse private network routes to End.DT4 SID routes:
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 prefix-sid
[SC-bgp-default-vpnv4] quit
[SC-bgp-default] ip vpn-instance vpn1
[SC-bgp-default-vpn1] address-family ipv4 unicast
[SC-bgp-default-ipv4-vpn1] segment-routing ipv6 locator a
[SC-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[SC-bgp-default-ipv4-vpn1] quit
[SC-bgp-default-vpn1] quit
[SC-bgp-default] quit
# Configure the tail node.
[Tail] bgp 100
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 prefix-sid
369
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] ip vpn-instance vpn1
[Tail-bgp-default-vpn1] address-family ipv4 unicast
[Tail-bgp-default-ipv4-vpn1] segment-routing ipv6 locator e
[Tail-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[Tail-bgp-default-ipv4-vpn1] quit
[Tail-bgp-default-vpn1] quit
[Tail-bgp-default] quit
# On the SC, display detailed information about the VPNv4 route advertised by the tail node to verify that the route has SRv6 SID attribute data. On the tail node, display detailed information about the VPNv4 route advertised by the SC to verify that the route has SRv6 SID attribute data.
If the SC and tail node have received the VPNv4 routes that carry SRv6 SID attribute data from each other, they have established an SRv6-BE tunnel. (This example only displays information on the SC.)
[SC] display bgp routing-table vpnv4 7.7.7.7
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of 7.7.7.7/32:
From : 5::5 (5.5.5.5)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 5::5
Out interface : GigabitEthernet0/0/2
Route age : 00h14m23s
OutLabel : 3
Ext-Community : <RT: 111:1>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <5000::2>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : N/A
7. On the SC and tail node, configure an SRv6 TE policy tunnel:
IMPORTANT:
Traffic from the SC to the tail node is forwarded to the SF for processing.
# Configure the SC.
370
[SC] segment-routing ipv6
[SC-segment-routing-ipv6] traffic-engineering
[SC-srv6-te] srv6-policy locator a
[SC-srv6-te] segment-list s1
[SC-srv6-te-sl-s1] index 10 ipv6 2001::1
[SC-srv6-te-sl-s1] index 20 ipv6 5000::1
[SC-srv6-te-sl-s1] quit
[SC-srv6-te] policy p1
[SC-srv6-te-policy-p1] color 10 end-point ipv6 5::5
[SC-srv6-te-policy-p1] candidate-paths
[SC-srv6-te-policy-p1-path] preference 10
[SC-srv6-te-policy-p1-path-pref-10] explicit segment-list s1
[SC-srv6-te-policy-p1-path-pref-10] quit
[SC-srv6-te-policy-p1-path] quit
[SC-srv6-te-policy-p1] quit
[SC-srv6-te] quit
[SC-segment-routing-ipv6] quit
# Configure the tail node.
[Tail] segment-routing ipv6
[Tail-segment-routing-ipv6] traffic-engineering
[Tail-srv6-te] srv6-policy locator e
[Tail-srv6-te] segment-list s2
[Tail-srv6-te-sl-s2] index 10 ipv6 2001::1
[Tail-srv6-te-sl-s2] index 10 ipv6 1000::1
[Tail-srv6-te-sl-s2] quit
[Tail-srv6-te] policy p1
[Tail-srv6-te-policy-p1] color 10 end-point ipv6 1::1
[Tail-srv6-te-policy-p1] candidate-paths
[Tail-srv6-te-policy-p1-path] preference 10
[Tail-srv6-te-policy-p1-path-pref-10] explicit segment-list s2
[Tail-srv6-te-policy-p1-path-pref-10] quit
[Tail-srv6-te-policy-p1-path] quit
[Tail-srv6-te-policy-p1] quit
[Tail-srv6-te] quit
[Tail-segment-routing-ipv6] quit
# On the SC and tail node, display detailed information about the SRv6 TE policy tunnel. (This example only displays information on the SC.)
[SC] display segment-routing ipv6 te policy
Name/ID: p1/0
Color: 10
Endpoint: 5::5
Name from BGP:
BSID:
Mode: Dynamic Type: Type_2 Request state: Succeeded
Current BSID: 1000::1:0:5 Explicit BSID: - Dynamic BSID: 1000::1:0:5
Reference counts: 4
Flags: A/BS/NC
Status: Up
371
Up time: 2020-10-30 16:08:03
Down time: 2020-10-30 16:03:48
Hot backup: Not configured
Statistics: Not configured
SBFD: Not configured
BFD Echo: Not configured
Forwarding index: 2150629377
Candidate paths state: Configured
Candidate paths statistics:
CLI paths: 1 BGP paths: 0 PCEP paths: 0
Candidate paths:
Preference : 10
CPathName:
Instance ID: 0 ASN: 0 Node address: 0.0.0.0
Peer address: ::
Optimal: Y Flags: V/A
Explicit SID list:
ID: 1 Name: s1
Weight: 1 Forwarding index: 2149580801
State: Up State(SBFD): -
8. On the SC and tail node, configure a routing policy to steer traffic that matches a color to the
SRv6 TE policy:
# Configure the SC.
[SC] route-policy p1 permit node 10
[SC-route-policy-p1-10] apply extcommunity color 00:10 additive
[SC-route-policy-p1-10] quit
[SC] bgp 100
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 route-policy p1 import
[SC-bgp-default-vpnv4] quit
[SC-bgp-default]quit
# Configure the tail node.
[Tail] route-policy p1 permit node 10
[Tail-route-policy-p1-10] apply extcommunity color 00:10 additive
[Tail-route-policy-p1-10] quit
[Tail] bgp 100
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 route-policy p1 import
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] quit
# On the SC, display detailed information about the VPNv4 route advertised by the tail node.
Verify that the VPNv4 route has the color extended community attribute and the route is recursed to the SRv6 TE policy tunnel.
[SC] display bgp routing-table vpnv4 7.7.7.7
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
372
BGP routing table information of 7.7.7.7/32:
From : 5::5 (5.5.5.5)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 5::5
Out interface : GigabitEthernet0/0/2
Route age : 00h52m23s
OutLabel : 3
Ext-Community : <RT: 111:1>, <CO-Flag:Color(00:10)>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <5000::2>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : 2150629377
9. On SFF 1, configure an SRv6 service chain in masquerading mode.
[SFF1] interface gigabitethernet 0/0/2
[SFF1-GigabitEthernet0/0/2] ipv6 address 10::1 96
[SFF1-GigabitEthernet0/0/2] quit
[SFF1-segment-routing-ipv6] locator am1 ipv6-prefix 2001:: 64 static 32
[SFF1-segment-routing-ipv6-locator-am1] opcode 1 end-am
[SFF1-segment-routing-ipv6-locator-am1-endam-1] encapsulation ipv6 nexthop 10::1 out-interface gigabitethernet 0/0/2 in-interface gigabitethernet 0/0/2
[SFF1-segment-routing-ipv6-locator-am1-endam-1] quit
[SFF1-segment-routing-ipv6-locator-am1] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator am1
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
Verifying the configuration
# On SFF 1, display End.AM SID forwarding information.
[SFF1] display segment-routing ipv6 local-sid end-am
Local SID forwarding table (End.AM)
Total SIDs: 1
SID : 2001::1/64
Function type : End.AM Allocation type: Static
Locator name : am1 Forward type : L3
Encapsulation count: 1
373
Next hop : 10::1 Out-interface : GE0/0/2
In-interface : GE0/0/2
Owner : SIDMGR State : Active
Create Time : May 19 17:21:15.687 2020
Example: Configuring an SRv6 service chain in masquerading mode with Layer 2 encapsulation
Network configuration
As shown in Figure 97 , CE 1 and CE 2 belong to one VPN instance. In the network, deploy an SRv6
service chain in masquerading mode to orchestrate the service traffic from CE 1 to pass through the
SF to reach CE 2.
SFF 1 is connected to the SF through a Layer 3 Ethernet subinterface. Layer 2 encapsulation is used for packets forwarded between the SFF and SF.
To meet the requirements, perform the following tasks:
•
On the SC and tail node, configure the VPN instance settings and steer service traffic to an
SRv6 TE policy. The forwarding path in the policy is SC—> SFF 1 —> SF —> Tail.
•
On SFF 1, configure an SRv6 service chain in masquerading mode with Layer 2 encapsulation.
Figure 97 Network diagram
SF
SC
GE0/0/2
GE0/0/1
GE0/0/1
GE0/0/1
GE0/0/2.1
GE0/0/3
SFF 1
CE 1
Device
SC
Tail
Interface
Loop1
GE0/0/1
GE0/0/2
Loop1
GE0/0/1
GE0/0/2
IP address
1::1/128
16.0.0.2/30
100::1/96
5::5/128
57.0.0.1/30
400::2/96
Prerequisites
•
Plan SRv6 SIDs on each device.
Device
SFF 1
CE 1
CE 2
374
Tail
GE0/0/2
GE0/0/1
GE0/0/1
CE 2
Interface
Loop1
GE0/0/1
GE1/0/3
Loop1
GE0/0/1
Loop1
GE0/0/1
IP address
2::2/128
100::2/96
400::1/96
6.6.6.6/32
16.0.0.1/30
7.7.7.7/32
57.0.0.2/30
On the SC, the network of locator a is 1000::/64, the End SID is 1000::1, and the End.DT4
SID is 1000::2.
On SFF 1, the network of locator b is 2000::/64, the End SID is 2000::1, the network of locator am1 is 2001::/64, and the End.AM SID is 2001::1.
On the tail node, the network of locator e is 5000::/64, the End SID is 5000::1, and the
End.DT4 SID is 5000::2.
•
Plan the traffic forwarding tunnel and the explicit path of the tunnel. In this example, traffic on the SC is forwarded to the tail node through the explicit path of an SRv6 TE policy. In the forwarding path, SFF 1 forwards the traffic to the SF. The SF processes the traffic and forwards the traffic back to SFF 1. SFF 1 forwards the traffic to the tail node.
Procedure
IMPORTANT:
L3VPN and SRv6 TE policy settings are the same for masquerading-mode SRv6 service chains that use Layer 2 encapsulation and Layer 3 encapsulation. This example only covers the configuration
that Layer 2 encapsulation differs from Layer 3 encapsulation. For more information, see " Example:
Configuring an SRv6 service chain in masquerading mode with Layer 3 encapsulation ."
# On SFF 1, configure basic settings for the SRv6 service chain in masquerading mode.
<SFF1> system-view
[SFF1] interface gigabitethernet 0/0/2.1
[SFF1-GigabitEthernet0/0/2.1] vlan-type dot1q vid 2
[SFF1-GigabitEthernet0/0/2.1] quit
[SFF1-segment-routing-ipv6] locator am1 ipv6-prefix 2001:: 64 static 32
[SFF1-segment-routing-ipv6-locator-am1] opcode 1 end-am
[SFF1-segment-routing-ipv6-locator-am1-endam-1] encapsulation eth out-interface gigabitethernet 0/0/2.1 out-s-vlan 2 in-interface gigabitethernet 0/0/2.1 in-s-vlan 2
[SFF1-segment-routing-ipv6-locator-am1-endam-1] quit
[SFF1-segment-routing-ipv6-locator-am1] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator am1
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
Verifying the configuration
# On SFF 1, display End.AM SID forwarding information.
[SFF1] display segment-routing ipv6 local-sid end-am
Local SID forwarding table (End.AM)
Total SIDs: 1
SID : 2001::1/64
Function type : End.AM Allocation type: Static
Locator name : am1 Forward type : L2
Encapsulation count: 1
Out-interface: GE0/0/2.1 In-interface : GE0/0/2.1
Out-S-VLAN : 2 Out-C-VLAN : -
375
In-S-VLAN : 2 In-C-VLAN : -
Owner : SIDMGR State : Active
Create Time : May 19 17:21:15.687 2020
Example: Configuring an SRv6 service chain in static proxy mode with Layer 3 encapsulation
Network configuration
As shown in Figure 98 , CE 1 and CE 2 belong to one VPN instance. In the network, deploy an SRv6
service chain in static proxy mode to orchestrate the service traffic from CE 1 to pass through SF 1 to reach CE 2. For high availability, SF 1 is dualhomed to SFF 1 and SFF 2 and SF 2 is the bypass protection node of SF 1.
The SFFs are connected to SFs through Layer 3 Ethernet interfaces. Layer 3 encapsulation is used for packets forwarded between a pair of SFF and SF.
To meet the requirements, perform the following tasks:
•
On the SC and tail node, configure the VPN instance settings and steer service traffic to an
SRv6 TE policy. The forwarding path in the policy is SC—> SFF 1 —> SF 1 —> Tail.
•
On SFF 1, SFF 2, and SFF 3, configure an SRv6 service chain in static proxy mode with Layer
3 encapsulation.
•
On SFF 1 and SFF 2, configure dualhoming protection settings. Make sure service chain traffic can be forwarded to SFF 2 when SFF 1 cannot reach SF 1.
•
On SFF 1 and SFF 2, configure bypass protection settings. Make sure SF 2 can provide bypass protection when SF 1 is not reachable.
376
Figure 98 Network diagram
Loop1
SFF 1
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/4
SF1
SC GE0/0/2
GE0/0/1
GE0/0/1
GE0/0/3
GE0/0/3
CE 1
GE0/0/1
GE0/0/4 GE0/0/2
SFF 2
Loop1
Device
SC
SFF 2
Interface
Loop1
GE0/0/1
GE0/0/2
GE0/0/3
Loop1
IP address
1::1/128
16.0.0.2/30
100::1/96
200::1/96
3::3/128
3.3.3.3/32
300::2/96 GE0/0/1
SF 1
SF 2
Tail
GE0/0/2
GE0/0/3
GE0/0/4
-
-
Loop1
GE0/0/1
GE0/0/2
500::1/96
10.1.1.3/24
200::2/96
10.1.1.1/24
10.2.1.1/24
5::5/128
57.0.0.1/30
600::2/96
Prerequisites
•
Plan SRv6 SIDs on each device.
GE0/0/4
GE0/0/1
Loop1
Tail
GE0/0/2
SFF 3
GE0/0/3
GE0/0/2
GE0/0/1
GE0/0/1
SF 2
Device
SFF 1
SFF 3
CE 1
CE 2
CE 2
Loop1
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/4
Loop1
GE0/0/1
Loop1
GE0/0/1
Interface
Loop1
GE0/0/1
GE0/0/2
GE0/0/3
GE0/0/4
IP address
2::2/128
2.2.2.2/32
100::2/96
300::1/96
10.1.1.2/24
400::1/96
4::4/128
4.4.4.4/32
500::2/96
600::1/96
10.2.1.2/24
400::2/96
6.6.6.6/32
16.0.0.1/30
7.7.7.7/32
57.0.0.2/30
377
On the SC, the network of locator a is 1000::/64, the End SID is 1000::1, and the End.DT4
SID is 1000::2.
On SFF 1, the network of locator b is 2000::/64, the End SID is 2000::1, the network of locator as1 is 2001::/64, and the End.AS SID is 2001::1.
On SFF 2, the network of locator c is 3000::/64, the End SID is 3000::1, the network of locator as1 is 2001::/64, and the End.AS SID is 2001::1.
On SFF 3, the network of locator d is 4000::/64, the End SID is 4000::1, the network of locator as2 is 4001::/64, and the End.AS SID is 4001::1.
On the tail node, the network of locator e is 5000::/64, the End SID is 5000::1, and the
End.DT4 SID is 5000::2.
•
Plan the traffic forwarding tunnel and the explicit path of the tunnel. In this example, traffic on the SC is forwarded to the tail node through the explicit path of an SRv6 TE policy. In the forwarding path, SFF 1 forwards the traffic to SF 1. SF 1 processes the traffic and forwards the traffic back to SFF 1. When the tail node sends traffic back to the SC, the traffic passes through
SFF 2 to reach the SC in the explicit path of the SRv6 TE policy. The traffic is not forwarded to any SF.
Procedure
1. On the SC, SFF 1, SFF 2, SFF 3, and the tail node, configure IPv6 IS-IS for their communication over the backbone network:
# Configure the SC.
<SC> system-view
[SC] isis 1
[SC-isis-1] is-level level-2
[SC-isis-1] cost-style wide
[SC-isis-1] network-entity 10.1111.1111.1111.00
[SC-isis-1] address-family ipv6 unicast
[SC-isis-1-ipv6] quit
[SC-isis-1] quit
[SC] interface loopback 1
[SC-LoopBack1] ipv6 address 1::1 128
[SC-LoopBack1] isis ipv6 enable 1
[SC-LoopBack1] quit
[SC] interface gigabitethernet 0/0/2
[SC-GigabitEthernet0/0/2] ipv6 address 100::1 96
[SC-GigabitEthernet0/0/2] isis ipv6 enable
[SC-GigabitEthernet0/0/2] quit
[SC] interface gigabitethernet 0/0/3
[SC-GigabitEthernet0/0/3] ipv6 address 200::1 96
[SC-GigabitEthernet0/0/3] isis ipv6 enable
[SC-GigabitEthernet0/0/3] quit
# Configure SFF 1.
<SFF1> system-view
[SFF1] isis
[SFF1-isis-1] is-level level-2
[SFF1-isis-1] cost-style wide
[SFF1-isis-1] network-entity 10.2222.2222.2222.00
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
378
[SFF1] interface loopback 1
[SFF1-LoopBack1] ipv6 address 2::2 128
[SFF1-LoopBack1] isis ipv6 enable
[SFF1-LoopBack1] quit
[SFF1] interface gigabitethernet 0/0/1
[SFF1-GigabitEthernet0/0/1] ipv6 address 100::2 96
[SFF1-GigabitEthernet0/0/1] isis ipv6 enable
[SFF1-GigabitEthernet0/0/1] quit
[SFF1] interface gigabitethernet 0/0/2
[SFF1-GigabitEthernet0/0/2] ipv6 address 300::1 96
[SFF1-GigabitEthernet0/0/2] isis ipv6 enable
[SFF1-GigabitEthernet0/0/2] quit
[SFF1] interface gigabitethernet 0/0/4
[SFF1-GigabitEthernet0/0/4] ipv6 address 400::1 96
[SFF1-GigabitEthernet0/0/4] isis ipv6 enable
[SFF1-GigabitEthernet0/0/4] quit
# Configure SFF 2.
<SFF2> system-view
[SFF2] isis
[SFF2-isis-1] is-level level-2
[SFF2-isis-1] cost-style wide
[SFF2-isis-1] network-entity 10.3333.3333.3333.00
[SFF2-isis-1] address-family ipv6 unicast
[SFF2-isis-1-ipv6] quit
[SFF2-isis-1] quit
[SFF2] interface loopback 1
[SFF2-LoopBack1] ipv6 address 3::3 128
[SFF2-LoopBack1] isis ipv6 enable
[SFF2-LoopBack1] quit
[SFF2] interface gigabitethernet 0/0/1
[SFF2-GigabitEthernet0/0/1] ipv6 address 300::2 96
[SFF2-GigabitEthernet0/0/1] isis ipv6 enable
[SFF2-GigabitEthernet0/0/1] quit
[SFF2] interface gigabitethernet 0/0/2
[SFF2-GigabitEthernet0/0/2] ipv6 address 500::1 96
[SFF2-GigabitEthernet0/0/2] isis ipv6 enable
[SFF2-GigabitEthernet0/0/2] quit
[SFF2] interface gigabitethernet 0/0/4
[SFF2-GigabitEthernet0/0/4] ipv6 address 200::2 96
[SFF2-GigabitEthernet0/0/4] isis ipv6 enable
[SFF2-GigabitEthernet0/0/4] quit
# Configure SFF 3.
<SFF3> system-view
[SFF3] isis
[SFF3-isis-1] is-level level-2
[SFF3-isis-1] cost-style wide
[SFF3-isis-1] network-entity 10.4444.4444.4444.00
[SFF3-isis-1] address-family ipv6 unicast
379
[SFF3-isis-1-ipv6] quit
[SFF3-isis-1] quit
[SFF3] interface loopback 1
[SFF3-LoopBack1] ipv6 address 4::4 128
[SFF3-LoopBack1] isis ipv6 enable
[SFF3-LoopBack1] quit
[SFF3] interface gigabitethernet 0/0/1
[SFF3-GigabitEthernet0/0/1] ipv6 address 500::2 96
[SFF3-GigabitEthernet0/0/1] isis ipv6 enable
[SFF3-GigabitEthernet0/0/1] quit
[SFF3] interface gigabitethernet 0/0/2
[SFF3-GigabitEthernet0/0/2] ipv6 address 600::1 96
[SFF3-GigabitEthernet0/0/2] isis ipv6 enable
[SFF3-GigabitEthernet0/0/2] quit
[SFF3] interface gigabitethernet 0/0/4
[SFF3-GigabitEthernet0/0/4] ipv6 address 400::2 96
[SFF3-GigabitEthernet0/0/4] isis ipv6 enable
[SFF3-GigabitEthernet0/0/4] quit
# Configure the tail node.
<Tail> system-view
[Tail] isis
[Tail-isis-1] is-level level-2
[Tail-isis-1] cost-style wide
[Tail-isis-1] network-entity 10.5555.5555.5555.00
[Tail-isis-1] address-family ipv6 unicast
[Tail-isis-1-ipv6] quit
[Tail-isis-1] quit
[Tail] interface loopback 1
[Tail-LoopBack1] ipv6 address 5::5 128
[Tail-LoopBack1] isis ipv6 enable
[Tail-LoopBack1] quit
[Tail] interface gigabitethernet 0/0/2
[Tail-GigabitEthernet0/0/2] ipv6 address 600::2 96
[Tail-GigabitEthernet0/0/2] isis ipv6 enable
[Tail-GigabitEthernet0/0/2] quit
# Verify that the SC, SFF 1, SFF 2, SFF 3, and the tail node can establish IPv6 IS-IS neighbor relationship with each other. Execute the display isis peer command on each device to verify that the neighbors are in up state. (Details not shown.)
# Execute the display isis route ipv6 command on the SC and tail node to verify that they have learned the routes of loopback interfaces to reach each other. (Details not shown.)
2. On the SC and tail node, configure VPN instance settings to allow CE 1 and CE 2 to access the
SC and tail node, respectively, in a VPN instance:
# Configure the SC.
[SC] ip vpn-instance vpn1
[SC-vpn-instance-vpn1] route-distinguisher 100:1
[SC-vpn-instance-vpn1] vpn-target 111:1
[SC-vpn-instance-vpn1] quit
[SC] interface gigabitethernet 0/0/1
380
[SC-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[SC-GigabitEthernet0/0/1] ip address 16.0.0.2 30
[SC-GigabitEthernet0/0/1] quit
# Configure the tail node.
[Tail] ip vpn-instance vpn1
[Tail-vpn-instance-vpn1] route-distinguisher 100:1
[Tail-vpn-instance-vpn1] vpn-target 111:1
[Tail-vpn-instance-vpn1] quit
[Tail] interface gigabitethernet 0/0/1
[Tail-GigabitEthernet0/0/1] ip binding vpn-instance vpn1
[Tail-GigabitEthernet0/0/1] ip address 57.0.0.1 24
[Tail-GigabitEthernet0/0/1] quit
# Configure IP addresses for interfaces on the CEs. (Details not shown.)
# On the SC and tail node (PEs), display VPN instance configuration to verify that the configuration is correct. Verify that the SC and tail node can ping their CEs.
This step uses the SC and CE 1 as an example.
[SC] display ip vpn-instance
Total VPN-Instances configured : 1
Total IPv4 VPN-Instances configured : 1
Total IPv6 VPN-Instances configured : 1
VPN-Instance Name RD Address family Create time
vpn1 100:1 IPv4/IPv6 2020/10/29 13:59:39
[SC] ping -vpn-instance vpn1 16.0.0.1
Ping 16.0.0.1 (16.0.0.1): 56 data bytes, press CTRL+C to break
56 bytes from 16.0.0.1: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 16.0.0.1: icmp_seq=1 ttl=255 time=0.000 ms
56 bytes from 16.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 16.0.0.1: icmp_seq=3 ttl=255 time=0.000 ms
56 bytes from 16.0.0.1: icmp_seq=4 ttl=255 time=0.000 ms
--- Ping statistics for 16.0.0.1 in VPN instance vpn1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.000/0.600/2.000/0.800 ms
3. Configure the SC and tail node to establish EBGP peer relationship with their connected CEs and redistribute VPN routes:
# Configure CE 1.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 16.0.0.2 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 16.0.0.2 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
# Configure CE 2 in the same way as CE 1 is configured. (Details not shown.)
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] router-id 1.1.1.1
381
[SC-bgp-default] ip vpn-instance vpn1
[SC-bgp-default-vpn1] peer 16.0.0.1 as-number 65410
[SC-bgp-default-vpn1] address-family ipv4 unicast
[SC-bgp-default-ipv4-vpn1] peer 16.0.0.1 enable
[SC-bgp-default-ipv4-vpn1] quit
[SC-bgp-default-vpn1] quit
# Configure the tail node in the same way as the SC is configured. (Details not shown.)
# On the SC and tail node, execute the display bgp peer ipv4 vpn-instance command to verify that they have established BGP peer relationship with their connected CEs.
The peer relationship is in Established state. (Details not shown.)
4. Establish VPNv4 peer relationship between the SC and tail node:
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] peer 5::5 as-number 100
[SC-bgp-default] peer 5::5 connect-interface loopback 1
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 enable
[SC-bgp-default-vpnv4] quit
[SC-bgp-default] quit
# Configure the tail node.
[Tail] bgp 100
[Tail-bgp-default] peer 1::1 as-number 100
[Tail-bgp-default] peer 1::1 connect-interface loopback 1
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 enable
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] quit
# On the SC and tail node, execute the display bgp peer vpnv4 command to verify that they have established VPNv4 peer relationship with each other. The peer relationship is in
Established state. (Details not shown.)
5. Configure End SIDs and End.DT4 SIDs, and advertise the locators of the SIDs by using an IGP:
# Configure the SC.
[SC] segment-routing ipv6
[SC-segment-routing-ipv6] encapsulation source-address 11::11
[SC-segment-routing-ipv6] locator a ipv6-prefix 1000::1 64 static 32
[SC-segment-routing-ipv6-locator-a] opcode 1 end
[SC-segment-routing-ipv6-locator-a] opcode 2 end-dt4 vpn-instance vpn1
[SC-segment-routing-ipv6-locator-a] quit
[SC-segment-routing-ipv6] quit
[SC] isis 1
[SC-isis-1] address-family ipv6 unicast
[SC-isis-1-ipv6] segment-routing ipv6 locator a
[SC-isis-1-ipv6] quit
[SC-isis-1] quit
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] encapsulation source-address 22::22
[SFF1-segment-routing-ipv6] locator b ipv6-prefix 2000::1 64 static 32
382
[SFF1-segment-routing-ipv6-locator-b] opcode 1 end
[SFF1-segment-routing-ipv6-locator-b] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator b
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
# Configure SFF 2.
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] encapsulation source-address 33::33
[SFF2-segment-routing-ipv6] locator c ipv6-prefix 3000::1 64 static 32
[SFF2-segment-routing-ipv6-locator-c] opcode 1 end
[SFF2-segment-routing-ipv6-locator-c] quit
[SFF2-segment-routing-ipv6] quit
[SFF2] isis 1
[SFF2-isis-1] address-family ipv6 unicast
[SFF2-isis-1-ipv6] segment-routing ipv6 locator c
[SFF2-isis-1-ipv6] quit
[SFF2-isis-1] quit
# Configure SFF 3.
[SFF3] segment-routing ipv6
[SFF3-segment-routing-ipv6] encapsulation source-address 44::44
[SFF3-segment-routing-ipv6] locator d ipv6-prefix 4000::1 64 static 32
[SFF3-segment-routing-ipv6-locator-d] opcode 1 end
[SFF3-segment-routing-ipv6-locator-d] quit
[SFF3-segment-routing-ipv6] quit
[SFF3] isis 1
[SFF3-isis-1] address-family ipv6 unicast
[SFF3-isis-1-ipv6] segment-routing ipv6 locator d
[SFF3-isis-1-ipv6] quit
[SFF3-isis-1] quit
# Configure the tail node.
[Tail] segment-routing ipv6
[Tail-segment-routing-ipv6] encapsulation source-address 55::55
[Tail-segment-routing-ipv6] locator e ipv6-prefix 5000::1 64 static 32
[Tail-segment-routing-ipv6-locator-e] opcode 1 end
[Tail-segment-routing-ipv6-locator-e] opcode 2 end-dt4 vpn-instance vpn1
[Tail-segment-routing-ipv6-locator-e] quit
[Tail-segment-routing-ipv6] quit
[Tail] isis 1
[Tail-isis-1] address-family ipv6 unicast
[Tail-isis-1-ipv6] segment-routing ipv6 locator e
[Tail-isis-1-ipv6] quit
[Tail-isis-1] quit
# On the SC and tail node, verify that the End.DT4 SIDs have been redistributed to the routing table and SRv6 routes have been generated. This example only displays the routing table information on the SC.
383
[SC] display ipv6 routing-table protocol srv6
Summary count : 8
SRv6 Routing table status : <Active>
Summary count : 8
Destination: 1000::2/128 Protocol : SRv6
NextHop : ::1 Preference: 4
Interface : InLoop0 Cost : 0
SRv6 Routing table status : <Inactive>
Summary count : 0
6. On the SC and tail node, add End.DT4 SIDs to private network routes, exchange End.DT4 SIDs between peers, and allow the devices to recurse private network routes to End.DT4 SID routes:
# Configure the SC.
[SC] bgp 100
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 prefix-sid
[SC-bgp-default-vpnv4] quit
[SC-bgp-default] ip vpn-instance vpn1
[SC-bgp-default-vpn1] address-family ipv4 unicast
[SC-bgp-default-ipv4-vpn1] segment-routing ipv6 locator a
[SC-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[SC-bgp-default-ipv4-vpn1] quit
[SC-bgp-default-vpn1] quit
[SC-bgp-default] quit
# Configure the tail node.
[Tail] bgp 100
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 prefix-sid
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] ip vpn-instance vpn1
[Tail-bgp-default-vpn1] address-family ipv4 unicast
[Tail-bgp-default-ipv4-vpn1] segment-routing ipv6 locator e
[Tail-bgp-default-ipv4-vpn1] segment-routing ipv6 traffic-engineering best-effort
[Tail-bgp-default-ipv4-vpn1] quit
[Tail-bgp-default-vpn1] quit
[Tail-bgp-default] quit
# On the SC, display detailed information about the VPNv4 route advertised by the tail node to verify that the route has SRv6 SID attribute data. On the tail node, display detailed information about the VPNv4 route advertised by the SC to verify that the route has SRv6 SID attribute data.
If the SC and tail node have received the VPNv4 routes that carry SRv6 SID attribute data from each other, they have established an SRv6-BE tunnel.
This example only displays information on the SC.
[SC] display bgp routing-table vpnv4 7.7.7.7
BGP local router ID: 1.1.1.1
Local AS number: 100
384
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of 7.7.7.7/32:
From : 5::5 (5.5.5.5)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 5::5
Out interface : GigabitEthernet0/0/2
Route age : 00h14m23s
OutLabel : 3
Ext-Community : <RT: 111:1>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <5000::2>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : N/A
7. On the SC and tail node, configure an SRv6 TE policy tunnel:
IMPORTANT:
Traffic from the SC to the tail node is forwarded to an SF for processing. Traffic from the tail node to the SC is not forwarded to any SF.
# Configure the SC.
[SC] segment-routing ipv6
[SC-segment-routing-ipv6] traffic-engineering
[SC-srv6-te] srv6-policy locator a
[SC-srv6-te] segment-list s1
[SC-srv6-te-sl-s1] index 10 ipv6 2001::1
[SC-srv6-te-sl-s1] index 20 ipv6 5000::1
[SC-srv6-te-sl-s1] quit
[SC-srv6-te] policy p1
[SC-srv6-te-policy-p1] color 10 end-point ipv6 5::5
[SC-srv6-te-policy-p1] candidate-paths
[SC-srv6-te-policy-p1-path] preference 10
[SC-srv6-te-policy-p1-path-pref-10] explicit segment-list s1
[SC-srv6-te-policy-p1-path-pref-10] quit
[SC-srv6-te-policy-p1-path] quit
[SC-srv6-te-policy-p1] quit
[SC-srv6-te] quit
385
[SC-segment-routing-ipv6] quit
# Configure the tail node.
[Tail] segment-routing ipv6
[Tail-segment-routing-ipv6] traffic-engineering
[Tail-srv6-te] srv6-policy locator e
[Tail-srv6-te] segment-list s2
[Tail-srv6-te-sl-s2] index 10 ipv6 3000::1
[Tail-srv6-te-sl-s2] index 20 ipv6 1000::1
[Tail-srv6-te-sl-s2] quit
[Tail-srv6-te] policy p1
[Tail-srv6-te-policy-p1] color 10 end-point ipv6 1::1
[Tail-srv6-te-policy-p1] candidate-paths
[Tail-srv6-te-policy-p1-path] preference 10
[Tail-srv6-te-policy-p1-path-pref-10] explicit segment-list s2
[Tail-srv6-te-policy-p1-path-pref-10] quit
[Tail-srv6-te-policy-p1-path] quit
[Tail-srv6-te-policy-p1] quit
[Tail-srv6-te] quit
[Tail-segment-routing-ipv6] quit
# On the SC and tail node, display detailed information about the SRv6 TE policy tunnel.
This example only displays information on the SC.
[SC] display segment-routing ipv6 te policy
Name/ID: p1/0
Color: 10
Endpoint: 5::5
Name from BGP:
BSID:
Mode: Dynamic Type: Type_2 Request state: Succeeded
Current BSID: 1000::1:0:5 Explicit BSID: - Dynamic BSID: 1000::1:0:5
Reference counts: 4
Flags: A/BS/NC
Status: Up
Up time: 2020-10-30 16:08:03
Down time: 2020-10-30 16:03:48
Hot backup: Not configured
Statistics: Not configured
SBFD: Not configured
BFD Echo: Not configured
Forwarding index: 2150629377
Candidate paths state: Configured
Candidate paths statistics:
CLI paths: 1 BGP paths: 0 PCEP paths: 0
Candidate paths:
Preference : 10
CPathName:
Instance ID: 0 ASN: 0 Node address: 0.0.0.0
Peer address: ::
Optimal: Y Flags: V/A
386
Explicit SID list:
ID: 1 Name: s1
Weight: 1 Forwarding index: 2149580801
State: Up State(SBFD): -
8. On the SC and tail node, configure a routing policy to steer traffic that matches a color to the
SRv6 TE policy:
# Configure the SC.
[SC] route-policy p1 permit node 10
[SC-route-policy-p1-10] apply extcommunity color 00:10 additive
[SC-route-policy-p1-10] quit
[SC] bgp 100
[SC-bgp-default] address-family vpnv4
[SC-bgp-default-vpnv4] peer 5::5 route-policy p1 import
[SC-bgp-default-vpnv4] quit
[SC-bgp-default]quit
# Configure the tail node.
[Tail] route-policy p1 permit node 10
[Tail-route-policy-p1-10] apply extcommunity color 00:10 additive
[Tail-route-policy-p1-10] quit
[Tail] bgp 100
[Tail-bgp-default] address-family vpnv4
[Tail-bgp-default-vpnv4] peer 1::1 route-policy p1 import
[Tail-bgp-default-vpnv4] quit
[Tail-bgp-default] quit
# On the SC, display detailed information about the VPNv4 route advertised by the tail node.
Verify that the VPNv4 route has the color extended community attribute and the route is recursed to the SRv6 TE policy tunnel.
[SC] display bgp routing-table vpnv4 7.7.7.7
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of 7.7.7.7/32:
From : 5::5 (5.5.5.5)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 5::5
Out interface : GigabitEthernet0/0/2
Route age : 00h52m23s
OutLabel : 3
Ext-Community : <RT: 111:1>, <CO-Flag:Color(00:10)>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <5000::2>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
387
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : 2150629377
9. On SFF 1, SFF 2, and SFF 3, configure basic SRv6 service chain settings:
# Configure SFF 1.
[SFF1] interface gigabitethernet 0/0/3
[SFF1-GigabitEthernet0/0/3] ip address 10.1.1.2 24
[SFF1-GigabitEthernet0/0/3] quit
[SFF1-segment-routing-ipv6] locator as1 ipv6-prefix 2001:: 64 static 32
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] inner-type ipv4
[SFF1-segment-routing-ipv6-locator-as1-endas-1] encapsulation ipv4 nexthop 10.1.1.1 out-interface gigabitethernet 0/0/3 in-interface gigabitethernet 0/0/3
[SFF1-segment-routing-ipv6-locator-as1-endas-1] cache source-address 1::1
[SFF1-segment-routing-ipv6-locator-as1-endas-1] cache list 2001::1 5000::1 5000::2
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator as1
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
# Configure SFF 2 as the backup of SFF 1 to access SF 1.
[SFF2] interface gigabitethernet 0/0/3
[SFF2-GigabitEthernet0/0/3] ip address 10.1.1.3 24
[SFF2-GigabitEthernet0/0/3] quit
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] locator as1 ipv6-prefix 2001:: 64 static 32
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] inner-type ipv4
[SFF2-segment-routing-ipv6-locator-as1-endas-1] encapsulation ipv4 nexthop 10.1.1.1 out-interface gigabitethernet 0/0/3 in-interface gigabitethernet 0/0/3
[SFF2-segment-routing-ipv6-locator-as1-endas-1] cache source-address 1::1
[SFF2-segment-routing-ipv6-locator-as1-endas-1] cache list 2001::1 5000::1 5000::2
[SFF2-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF2-segment-routing-ipv6-locator-as1] quit
[SFF2-segment-routing-ipv6] quit
[SFF2] isis 1
[SFF2-isis-1] address-family ipv6 unicast
[SFF2-isis-1-ipv6] segment-routing ipv6 locator as1
[SFF2-isis-1-ipv6] quit
[SFF2-isis-1] quit
# Configure SFF3 to access SF 2.
[SFF3] interface gigabitethernet 0/0/3
[SFF3-GigabitEthernet0/0/3] ip address 10.2.1.2 24
[SFF3-GigabitEthernet0/0/3] quit
388
[SFF3] segment-routing ipv6
[SFF3-segment-routing-ipv6] locator as2 ipv6-prefix 4001:: 64 static 32
[SFF3-segment-routing-ipv6-locator-as2] opcode 1 end-as
[SFF3-segment-routing-ipv6-locator-as2-endas-1] inner-type ipv4
[SFF3-segment-routing-ipv6-locator-as2-endas-1] encapsulation ipv4 nexthop 10.2.1.1 out-interface gigabitethernet 0/0/3 in-interface gigabitethernet 0/0/3
[SFF3-segment-routing-ipv6-locator-as2-endas-1] cache source-address 1::1
[SFF3-segment-routing-ipv6-locator-as2-endas-1] cache list 4001::1 5000::1 5000::2
[SFF3-segment-routing-ipv6-locator-as2-endas-1] quit
[SFF3-segment-routing-ipv6-locator-as2] quit
[SFF3-segment-routing-ipv6] quit
[SFF3] isis 1
[SFF3-isis-1] address-family ipv6 unicast
[SFF3-isis-1-ipv6] segment-routing ipv6 locator as2
[SFF3-isis-1-ipv6] quit
[SFF3-isis-1] quit
10. On SFF 1 and SFF 2, configure dualhoming protection and configure static BFD in echo packet mode on Layer 3 interfaces that connect the SFFs to SF 1:
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] proxy peer-sid 3000::1
[SFF1-segment-routing-ipv6] locator as1
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] backup-opcode 2
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] interface loopback 1
[SFF1-LoopBack1] ip address 2.2.2.2 32
[SFF1-LoopBack1] quit
[SFF1] bfd echo-source-ip 2.2.2.2
[SFF1] bfd static sf peer-ip 10.1.1.1 interface gigabitethernet 0/0/3 destination-ip
10.1.1.2 one-arm-echo
[SFF1-bfd-static-session-sf] discriminator local 100
[SFF1-bfd-static-session-sf] quit
# Configure SFF 2.
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] proxy peer-sid 2000::1
[SFF2-segment-routing-ipv6] locator as1
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] backup-opcode 2
[SFF2-segment-routing-ipv6] quit
[SFF2] interface loopback 1
[SFF2-LoopBack1] ip address 3.3.3.3 32
[SFF2-LoopBack1] quit
[SFF2] bfd echo-source-ip 3.3.3.3
[SFF2] bfd static sf peer-ip 10.1.1.1 interface gigabitethernet 0/0/3 destination-ip
10.1.1.3 one-arm-echo
[SFF2-bfd-static-session-sf] discriminator local 200
389
[SFF2-bfd-static-session-sf] quit
11. On SFF 1 and SFF 2, configure SRv6 service chain bypass protection and configure SF 2 as the bypass protection node of SF 1:
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] locator as1
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] bypass sid 4001::1
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
# Configure SFF 2.
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] locator as1
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] bypass sid 4001::1
[SFF2-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF2-segment-routing-ipv6-locator-as1] quit
[SFF2-segment-routing-ipv6] quit
Verifying the configuration
1. On SFF 1, display SRv6 service chain forwarding entry information. Verify that the forwarding entries include the primary service chain forwarding entry, the dualhoming backup service chain forwarding entry, and the bypass protection service chain forwarding entry.
[SFF1] display segment-routing ipv6 sfc forwarding
Total forwarding entries: 3
NID : 2153775105
Locator name/Opcode : as1/1
Type : Cache list
Path Count : 1
Interface : GE0/0/4
NextHop : FE80::424:B0FF:FEF7:AD02
NID : 2153775106
Locator name/Opcode : as1/1
Type : Backup opcode
Path Count : 1
Interface : GE0/0/2
NextHop : ::1
NID : 2153775107
Locator name/Opcode : as2/1
Type : Bypass
Path Count : 1
Interface : GE0/0/4
NextHop : FE80::424:B0FF:FEF7:AD02
2. On SFF 1, display SRv6 forwarding entry information.
[SFF1] display segment-routing ipv6 forwarding
Total SRv6 forwarding entries: 3
390
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
A - Active forwarding information
B - Backup forwarding information
ID FWD-Type Flags Forwarding info
--------------------------------------------------------------------------------
2153775105 SRv6SFC NA GE0/0/4
FE80::424:B0FF:FEF7:AD02
{2001::1, 5000::1, 5000::2}
2153775106 SRv6SFC N GE0/0/2
::1
{3000::1}
2153775107 SRv6SFC NA GE0/0/4
FE80::424:B0FF:FEF7:AD02
{4001::1}
Example: Configuring an SRv6 service chain in static proxy mode with Layer 2 encapsulation
Network configuration
As shown in Figure 99 , CE 1 and CE 2 belong to one VPN instance. In the network, deploy an SRv6
service chain in static proxy mode to orchestrate the service traffic from CE 1 to pass through SF 1 to reach CE 2. For high availability, SF 1 is dualhomed to SFF 1 and SFF 2 and SF 2 is the bypass protection node of SF 1.
The SFFs are connected to SFs through Layer 3 Ethernet subinterfaces. Layer 2 encapsulation is used for packets forwarded between a pair of SFF and SF.
To meet the requirements, perform the following tasks:
•
On the SC and tail node, configure the VPN instance settings and steer service traffic to an
SRv6 TE policy. The forwarding path in the policy is SC—> SFF 1 —> SF 1 —> Tail.
•
On SFF 1, SFF 2, and SFF 3, configure an SRv6 service chain in static proxy mode with Layer
2 encapsulation.
•
On SFF 1 and SFF 2, configure dualhoming protection settings. Make sure service chain traffic can be forwarded to SFF 2 when SFF 1 cannot reach SF 1.
•
On SFF 1 and SFF 2, configure bypass protection settings. Make sure SF 2 can provide bypass protection when SF 1 is not reachable.
391
Figure 99 Network diagram
Loop1
SFF 1
GE0/0/1
GE0/0/2
GE0/0/3.1
GE0/0/4
SF1
SC GE0/0/2
GE0/0/1
GE0/0/1
GE0/0/3
GE0/0/3.1
GE0/0/4
GE0/0/1
Loop1
Tail
GE0/0/2
SFF 3
GE0/0/3
GE0/0/2
GE0/0/1
GE0/0/1
CE 1
GE0/0/1
GE0/0/4 GE0/0/2
CE 2
SFF 2
SF 2
Loop1
Device
SC
SFF 2
Tail
Interface
Loop1
GE0/0/1
GE0/0/2
GE0/0/3
Loop1
GE0/0/1
GE0/0/2
GE0/0/4
Loop1
GE0/0/1
GE0/0/2
IP address
1::1/128
16.0.0.2/30
100::1/96
200::1/96
3::3/128
300::2/96
500::1/96
200::2/96
5::5/128
57.0.0.1/30
600::2/96
Device
SFF 1
SFF 3
CE 1
CE 2
Interface IP address
Loop1 2::2/128
GE0/0/1
GE0/0/2
GE0/0/4
Loop1
GE0/0/1
GE0/0/2
GE0/0/4
Loop1
GE0/0/1
Loop1
GE0/0/1
100::2/96
300::1/96
400::1/96
4::4/128
500::2/96
600::1/96
400::2/96
6.6.6.6/32
16.0.0.1/30
7.7.7.7/32
57.0.0.2/30
Prerequisites
•
Plan SRv6 SIDs on each device.
On the SC, the network of locator a is 1000::/64, the End SID is 1000::1, and the End.DT4
SID is 1000::2.
On SFF 1, the network of locator b is 2000::/64, the End SID is 2000::1, the network of locator as1 is 2001::/64, and the End.AS SID is 2001::1.
On SFF 2, the network of locator c is 3000::/64, the End SID is 3000::1, the network of locator as1 is 2001::/64, and the End.AS SID is 2001::1.
392
On SFF 3, the network of locator d is 4000::/64, the End SID is 4000::1, the network of locator as2 is 4001::/64, and the End.AS SID is 4001::1.
On the tail node, the network of locator e is 5000::/64, the End SID is 5000::1, and the
End.DT4 SID is 5000::2.
•
Plan the traffic forwarding tunnel and the explicit path of the tunnel. In this example, traffic on the SC is forwarded to the tail node through the explicit path of an SRv6 TE policy. In the forwarding path, SFF 1 forwards the traffic to SF 1. SF 1 processes the traffic and forwards the traffic back to SFF 1. When the tail node sends traffic back to the SC, the traffic passes through
SFF 2 to reach the SC in the explicit path of the SRv6 TE policy. The traffic is not forwarded to any SF.
Procedure
IMPORTANT:
In a dualhoming and bypass protection scenario, L3VPN and SRv6 TE policy settings are the same for SRv6 service chains that use Layer 2 encapsulation and Layer 3 encapsulation. This example only covers the configuration that Layer 2 encapsulation differs from Layer 3 encapsulation. For
more information, see " Example: Configuring an SRv6 service chain in static proxy mode with Layer
1. On SFF 1, SFF 2, and SFF 3, configure basic SRv6 service chain settings:
# Configure SFF 1.
<SFF1> system-view
[SFF1] interface gigabitethernet 0/0/3.1
[SFF1-GigabitEthernet0/0/3.1] vlan-type dot1q vid 2
[SFF1-GigabitEthernet0/0/3.1] quit
[SFF1-segment-routing-ipv6] locator as1 ipv6-prefix 2001:: 64 static 32
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] inner-type ipv4
[SFF1-segment-routing-ipv6-locator-as1-endas-1] encapsulation eth out-interface gigabitethernet 0/0/3.1 out-s-vlan 2 in-interface gigabitethernet 0/0/3.1 in-s-vlan
2
[SFF1-segment-routing-ipv6-locator-as1-endas-1] cache source-address 1::1
[SFF1-segment-routing-ipv6-locator-as1-endas-1] cache list 2001::1 5000::1 5000::2
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
[SFF1-segment-routing-ipv6] quit
[SFF1] isis 1
[SFF1-isis-1] address-family ipv6 unicast
[SFF1-isis-1-ipv6] segment-routing ipv6 locator as1
[SFF1-isis-1-ipv6] quit
[SFF1-isis-1] quit
# Configure SFF 2 as the backup of SFF 1 to access SF 1.
<SFF2> system-view
[SFF2] interface gigabitethernet 0/0/3.1
[SFF2-GigabitEthernet0/0/3.1] vlan-type dot1q vid 2
[SFF2-GigabitEthernet0/0/3.1] quit
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] locator as1 ipv6-prefix 2001:: 64 static 32
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] inner-type ipv4
393
[SFF2-segment-routing-ipv6-locator-as1-endas-1] encapsulation eth out-interface gigabitethernet 0/0/3.1 out-s-vlan 2 in-interface gigabitethernet 0/0/3.1 in-s-vlan
2
[SFF2-segment-routing-ipv6-locator-as1-endas-1] cache source-address 1::1
[SFF2-segment-routing-ipv6-locator-as1-endas-1] cache list 2001::1 5000::1 5000::2
[SFF2-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF2-segment-routing-ipv6-locator-as1] quit
[SFF2-segment-routing-ipv6] quit
[SFF2] isis 1
[SFF2-isis-1] address-family ipv6 unicast
[SFF2-isis-1-ipv6] segment-routing ipv6 locator as1
[SFF2-isis-1-ipv6] quit
[SFF2-isis-1] quit
# Configure SFF3 to access SF 2.
<SFF3> system-view
[SFF3] interface gigabitethernet 0/0/3.1
[SFF3-GigabitEthernet0/0/3.1] vlan-type dot1q vid 2
[SFF3-GigabitEthernet0/0/3.1] quit
[SFF3] segment-routing ipv6
[SFF3-segment-routing-ipv6] locator as2 ipv6-prefix 4001:: 64 static 32
[SFF3-segment-routing-ipv6-locator-as2] opcode 1 end-as
[SFF3-segment-routing-ipv6-locator-as2-endas-1] inner-type ipv4
[SFF3-segment-routing-ipv6-locator-as2-endas-1] encapsulation eth out-interface gigabitethernet 0/0/3.1 out-s-vlan 2 in-interface gigabitethernet 0/0/3.1 in-s-vlan
2
[SFF3-segment-routing-ipv6-locator-as2-endas-1] cache source-address 1::1
[SFF3-segment-routing-ipv6-locator-as2-endas-1] cache list 4001::1 5000::1 5000::2
[SFF3-segment-routing-ipv6-locator-as2-endas-1] quit
[SFF3-segment-routing-ipv6-locator-as2] quit
[SFF3-segment-routing-ipv6] quit
[SFF3] isis 1
[SFF3-isis-1] address-family ipv6 unicast
[SFF3-isis-1-ipv6] segment-routing ipv6 locator as2
[SFF3-isis-1-ipv6] quit
[SFF3-isis-1] quit
2. On SFF 1 and SFF 2, configure SRv6 service chain dualhoming protection:
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] proxy peer-sid 3000::1
[SFF1-segment-routing-ipv6] locator as1
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] backup-opcode 2
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
[SFF1-segment-routing-ipv6] quit
# Configure SFF 2.
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] proxy peer-sid 2000::1
[SFF2-segment-routing-ipv6] locator as1
394
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] backup-opcode 2
[SFF2-segment-routing-ipv6] quit
3. On SFF 1 and SFF 2, configure SRv6 service chain bypass protection and configure SF 2 as the bypass protection node of SF 1:
# Configure SFF 1.
[SFF1] segment-routing ipv6
[SFF1-segment-routing-ipv6] locator as1
[SFF1-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF1-segment-routing-ipv6-locator-as1-endas-1] bypass sid 4001::1
[SFF1-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF1-segment-routing-ipv6-locator-as1] quit
# Configure SFF 2.
[SFF2] segment-routing ipv6
[SFF2-segment-routing-ipv6] locator as1
[SFF2-segment-routing-ipv6-locator-as1] opcode 1 end-as
[SFF2-segment-routing-ipv6-locator-as1-endas-1] bypass sid 4001::1
[SFF2-segment-routing-ipv6-locator-as1-endas-1] quit
[SFF2-segment-routing-ipv6-locator-as1] quit
[SFF2-segment-routing-ipv6] quit
Verifying the configuration
1. On SFF 1, display SRv6 service chain forwarding entry information. Verify that the forwarding entries include the primary service chain forwarding entry, the dualhoming backup service chain forwarding entry, and the bypass protection service chain forwarding entry.
[SFF1] display segment-routing ipv6 sfc forwarding
Total forwarding entries: 3
NID : 2153775105
Locator name/Opcode : as1/1
Type : Cache list
Path Count : 1
Interface : GE0/0/4
NextHop : FE80::424:B0FF:FEF7:AD02
NID : 2153775106
Locator name/Opcode : as1/1
Type : Backup opcode
Path Count : 1
Interface : GE0/0/2
NextHop : ::1
NID : 2153775107
Locator name/Opcode : as2/1
Type : Bypass
Path Count : 1
Interface : GE0/0/4
NextHop : FE80::424:B0FF:FEF7:AD02
2. On SFF 1, display SRv6 forwarding entry information.
395
[SFF1] display segment-routing ipv6 forwarding
Total SRv6 forwarding entries: 3
Flags: T - Forwarded through a tunnel
N - Forwarded through the outgoing interface to the nexthop IP address
A - Active forwarding information
B - Backup forwarding information
ID FWD-Type Flags Forwarding info
--------------------------------------------------------------------------------
2153775105 SRv6SFC NA GE0/0/4
FE80::424:B0FF:FEF7:AD02
{2001::1, 5000::1, 5000::2}
2153775106 SRv6SFC N GE0/0/2
::1
{3000::1}
2153775107 SRv6SFC NA GE0/0/4
FE80::424:B0FF:FEF7:AD02
{4001::1}
396
Document conventions and icons
Conventions
This section describes the conventions used in the documentation.
Command conventions
Convention
Boldface
Italic
[ ]
{ x | y | ... }
[ x | y | ... ]
{ x | y | ... } *
[ x | y | ... ] *
Description
Bold text represents commands and keywords that you enter literally as shown.
Italic text represents arguments that you replace with actual values.
Square brackets enclose syntax choices (keywords or arguments) that are optional.
Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.
The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
A line that starts with a pound (#) sign is comments.
&<1-n>
#
GUI conventions
Convention
Boldface
Description
Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK .
Multi-level menus are separated by angle brackets. For example, File > Create >
Folder .
Symbols
>
Convention
WARNING!
CAUTION:
IMPORTANT:
NOTE:
TIP:
Description
An alert that calls attention to important information that if not understood or followed can result in personal injury.
An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.
An alert that calls attention to essential information.
An alert that contains additional or supplementary information.
An alert that provides helpful information.
397
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model, configuration, or software version. It is normal that the port numbers, sample output, screenshots, and other information in the examples differ from what you have on your device.
398
Support and other resources
Accessing Hewlett Packard Enterprise Support
•
For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance
•
To access documentation and support services, go to the Hewlett Packard Enterprise Support
Center website: www.hpe.com/support/hpesc
Information to collect
•
Technical support registration number (if applicable)
•
Product name, model or version, and serial number
•
Operating system name and version
•
Firmware version
•
Error messages
•
Product-specific reports and logs
•
Add-on products or components
•
Third-party products or components
Accessing updates
•
Some software products provide a mechanism for accessing software updates through the product interface. Review your product documentation to identify the recommended software update method.
•
To download product updates, go to either of the following:
Hewlett Packard Enterprise Support Center Get connected with updates page: www.hpe.com/support/e-updates
Software Depot website: www.hpe.com/support/softwaredepot
•
To view and update your entitlements, and to link your contracts, Care Packs, and warranties with your profile, go to the Hewlett Packard Enterprise Support Center More Information on
Access to Support Materials page: www.hpe.com/support/AccessToSupportMaterials
IMPORTANT:
Access to some updates might require product entitlement when accessed through the Hewlett
Packard Enterprise Support Center. You must have an HP Passport set up with relevant entitlements.
399
Websites
Website
Networking websites
Hewlett Packard Enterprise Information Library for
Networking
Hewlett Packard Enterprise Networking website
Hewlett Packard Enterprise My Networking website
Hewlett Packard Enterprise My Networking Portal
Hewlett Packard Enterprise Networking Warranty
General websites
Hewlett Packard Enterprise Information Library
Hewlett Packard Enterprise Support Center
Hewlett Packard Enterprise Support Services Central
Contact Hewlett Packard Enterprise Worldwide
Subscription Service/Support Alerts
Software Depot
Customer Self Repair (not applicable to all devices)
Insight Remote Support (not applicable to all devices)
Link www.hpe.com/networking/resourcefinder www.hpe.com/info/networking www.hpe.com/networking/support www.hpe.com/networking/mynetworking www.hpe.com/networking/warranty www.hpe.com/info/enterprise/docs www.hpe.com/support/hpesc ssc.hpe.com/portal/site/ssc/ www.hpe.com/assistance www.hpe.com/support/e-updates www.hpe.com/support/softwaredepot www.hpe.com/support/selfrepair www.hpe.com/info/insightremotesupport/docs
Customer self repair
Hewlett Packard Enterprise customer self repair (CSR) programs allow you to repair your product. If a CSR part needs to be replaced, it will be shipped directly to you so that you can install it at your convenience. Some parts do not qualify for CSR. Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR.
For more information about CSR, contact your local service provider or go to the CSR website: www.hpe.com/support/selfrepair
Remote support
Remote support is available with supported devices as part of your warranty, Care Pack Service, or contractual support agreement. It provides intelligent event diagnosis, and automatic, secure submission of hardware event notifications to Hewlett Packard Enterprise, which will initiate a fast and accurate resolution based on your product’s service level. Hewlett Packard Enterprise strongly recommends that you register your device for remote support.
For more information and device support details, go to the following website: www.hpe.com/info/insightremotesupport/docs
Documentation feedback
Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation
Feedback ( [email protected]
). When submitting your feedback, include the document title,
400
part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.
401
Index
A
AC
EVPN VPLS over SRv6 AC > VSI mapping,
adjacency
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS static segment configuration, 2
SRv6 traffic forwarding automatic route
advertisement (forwarding adjacency), 117
static SRLSP adjacency segment
advertisement
BGP EVPN route advertisement, 316
EVPN VPWS over SRv6 multihoming
advertising
BGP EVPN route advertisement (local site),
EVPN MAC address advertisement, 317
SR-MPLS configuration (IS-IS-advertised
SR-MPLS IGP-based SID advertisement
SRv6 locator route advertisement through
SRv6 SID advertisement through IGP, 131
SRv6 traffic forwarding automatic route
advertisement (forwarding adjacency), 117
SRv6 traffic forwarding automatic route
advertisement (IGP shortcut), 117
alarm threhold
SRv6 TE policy resource usage alarm
allocating
MPLS SR dynamic SID allocation, 3
SR-MPLS dynamic SID allocation,
SR-MPLS IGP adjacency label allocation, 24
applying
EVPN L3VPN over SRv6 BGP VPN instance
EVPN VPLS over SRv6 EVPN instance
EVPN VPWS over SRv6 cross-connect
IP L3VPN over SRv6 BGP VPN instance
IP public network over SRv6 BGP instance
ARP
EVPN VPLS over SRv6 ARP flood suppression,
attachment circuit (AC)
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
auto
SRv6 traffic forwarding automatic route
advertisement (forwarding adjacency), 117
SRv6 traffic forwarding automatic route
advertisement (IGP shortcut), 117
autoroute announce
enabling for SRv6 TE policy, 185
B
BFD
configuring BFD echo packet mode for SRv6 TE
SRv6 tunnel BFD echo-mode detection, 136
BGP
EVPN L3VPN over SRv6 BGP session reset, 257
EVPN route advertisement (local site), 316
EVPN VPWS over SRv6 multihoming redundancy
IP L3VPN over SRv6 BGP session reset, 237
IP public network over SRv6 BGP IPv6 unicast
route flap statistics clear, 330
IP public network over SRv6 BGP session reset,
SRv6 locator route advertisement through BGP,
SRv6 TE policy path info distribution to BGP-LS,
BGP IPv6 SR policy
route advertisement configuration, 174
BGP-LS
SRv6 TE policy path info distribution to BGP-LS,
binding
static SRLSP to MPLS TE tunnel interface, 30
C
CBTS
configuring CBTS for SRv6 TE policy, 193
how SRv6 TE policy CBTS works, 160
SRv6 TE policy CBTS overview, 160
SRv6 TE policy tunnel selection, 160
402
clearing
IP public network over SRv6 BGP IPv6 unicast
color configuring SRv6 TE policy color-based traffic
configuring automatic static route advertisement for SRv6
tunnel traffic direction, 137, 137
BFD echo packet mode for SRv6 TE policies,
BGP EVPN route redistribution and
BGP IPv6 SR policy route advertisement, 174
deletion delay time for remote SRv6 SID mappings with VPN
instances/cross-connects/VSIs, 192
egress protection for SRv6 TE policy, 190
End.M SID for SRv6 TE policy egress
EVPN L3VPN over SRv6 BGP Additional
EVPN L3VPN over SRv6 BGP EVPN route,
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN VPLS over SRv6 (single-homed), 301
EVPN VPLS over SRv6 E-tree configuration,
EVPN VPLS over SRv6 EVPN instance, 290
EVPN VPWS over SRv6 (single-homed), 282
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 cross-connect
403
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
EVPN VPWS over SRv6 multihoming, 277
EVPN VPWS over SRv6 redundancy mode, 277
Flowspec-based traffic steering, 183
IP L3VPN over SRv6 (SRv6 BE mode), 237
IP L3VPN over SRv6 BGP Additional Paths
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
distribution filtering policy, 232
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 BGP VPNv4/VPNv6 routes,
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP public network over SRv6 (on router), 331
IP public network over SRv6 IPv6 peer SRv6 SID
IP public network over SRv6 PE BGP IPv4/IPv6
IP public network over SRv6 SID, 325
IPv6 public network over SRv6 (SRv6 BE
Layer 2 encapsulation SRv6 service chain
(masquerading mode)(on router), 374
Layer 2 encapsulation SRv6 service chain (static
Layer 3 encapsulation SRv6 service chain
(masquerading mode)(on router), 364
Layer 3 encapsulation SRv6 service chain (static
MAC/IP advertisement route redistribution, 316
MPLS TE tunnel loose explicit path, 31
MPLS TE tunnel static SRLSP, 30
MPLS TE tunnel strict explicit path, 31
ODN SRv6 TE policy candidate path and
QoS policy-based traffic steering, 182
SR-MPLS (IS-IS-advertised SID-based)(on
SR-MPLS (static segment-based)(on router),
SR-MPLS based on OSPF-advertised SIDs
SR-MPLS device preference for SRLSP traffic
SR-MPLS IGP-based SID advertisement, 21
SR-MPLS IP traffic forwarding over SRLSPs,
SR-MPLS MPLS TE traffic forwarding over
SR-MPLS+LDP interworking (on router), 96,
SRv6 BE mode IPv4 EVPN L3VPN over SRv6,
SRv6 dynamic End.X SID deletion delay, 130
SRv6 End.X SID (on router), 147
SRv6 service chain (masquerading mode),
SRv6 service chain (on router), 364
SRv6 service chain (static proxy mode), 354
SRv6 service chain bypass protection (static
SRv6 service chain DiffServ mode (static
SRv6 service chain dualhoming protection
SRv6 service chain echo packet mode static
SRv6 service chain packet reencapsulation
parameters (static proxy mode), 359
SRv6 service chain SFF-SF packet
SRv6 service chain SFF-SF packet encapsulation
method (masquerading mode), 358
SRv6 service chain SFF-SF packet encapsulation
method (static proxy mode), 356
SRv6 service chain TTL mode (static proxy mode),
SRv6 SID advertisement through IGP, 131
SRv6 TE policy candidate path and manual SID
SRv6 TE policy candidate path and
SRv6 TE policy candidate path and SID lists, 169
SRv6 TE policy color-based traffic steering, 178,
SRv6 TE policy DSCP-based traffic steering, 180
SRv6 TE policy encapsulation mode, 186
SRv6 TE policy path info distribution to BGP-LS,
SRv6 TE policy path switchover and deletion
SRv6 TE policy resource usage alarm thresholds,
SRv6 TE policy traffic steering,
SRv6 TE policy traffic steering mode, 178
SRv6 TE policy tunnel policy-based traffic
SRv6 TI-LFA FRR microloop avoidance, 140
SRv6 TI-LFA FRR SR microloop avoidance, 140
SRv6 TI-LFA FRR SR microloop avoidance (IPv6
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 tunnel service class, 136
static route for SRv6 tunnel traffic direction, 137
static SRLSP adjacency segment, 20
static SRLSP prefix segment, 21
static SRLSP switchback delay, 31
traffic forwarding statistics for SRv6 TE policies,
TTL processing mode for SRv6 TE policies, 192
TTL processing mode for tunnels associated with
404
connecting
EVPN VPWS over SRv6 cross-connect
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC)
EVPN VPWS over SRv6 cross-connect+Layer 3 interface mapping,
controlling
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route advertisement+reception, 230
creating
SRv6 service chain (masquerading mode),
SRv6 service chain (static proxy mode), 355
cross-connecting
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC)
EVPN VPWS over SRv6 cross-connect+Layer 3 interface mapping,
D delay configuring SRv6 TE policy path switchover
delaying
SRv6 dynamic End.X SID deletion delay
device
SR-MPLS device preference for SRLSP traffic
disabling
EVPN MAC address advertisement, 317
EVPN MAC address learning, 317
SRv6 interface TI-LFA FRR calculation, 139
SRv6 interface TI-LFA FRR calculation (IPv6
SRv6 interface TI-LFA FRR calculation
discovering
displaying
EVPN L3VPN over SRv6 configuration and
IP L3VPN over SRv6 configuration and running
IP public network over SRv6 configuration and
SRv6 service chain information, 364
DSCP configuring SRv6 TE policy DSCP-based traffic
dynamic
E egress protection
configuring for SRv6 TE policy, 190
deletion delay configuration for remote SRv6 SID mappings with VPN
instances/cross-connects/VSIs, 192
enabling for SRv6 TE policy, 191
End.M SID configuration for SRv6 TE policy, 190
enabling
autoroute announce for SRv6 TE policy, 185
BGP EVPN route advertisement (local site), 316
EVPN L3VPN over SRv6 route recursion mode,
EVPN VPLS over SRv6 ARP flood suppression,
EVPN VPLS over SRv6 route recursion mode,
EVPN VPWS over SRv6 L2VPN, 270
EVPN VPWS over SRv6 route recursion mode,
hot standby for SRv6 TE policies, 189
IP L3VPN over SRv6 route recursion mode, 233
IP public network over SRv6 route recursion
SBFD for SRv6 TE policies, 187
SR-MPLS IGP adjacency label allocation, 24
SRv6 locator route advertisement through BGP,
SRv6 TE policy egress protection, 191
405
SRv6 TE policy SNMP notifications, 196
SRv6 TI-LFA FRR (IPv6 IS-IS), 139
SRv6 tunnel BFD echo-mode detection, 136
encapsulation mode
SRv6 TE policy encapsulation mode, 186
End.M SID configuration for SRv6 TE policy egress
end-to-end
E-tree
EVPN VPLS over SRv6 E-tree configuration,
EVPN
BGP EVPN route advertisement (local site),
distributed SRv6 gateway-encapsulated
EVPN VPLS packet outer IPv6 header source
EVPN L3VPN over SRv6 basic principle, 245
EVPN L3VPN over SRv6 BGP Additional
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
configuration restrictions, 252
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP session reset,
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 configuration and
EVPN L3VPN over SRv6 maintain, 257
EVPN L3VPN over SRv6 packet forwarding,
EVPN L3VPN over SRv6 route advertisement,
EVPN L3VPN over SRv6 route recursion
406
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN L3VPN over SRv6 verify, 257
EVPN VPLS over SRv6 AC > VSI mapping, 295,
EVPN VPLS over SRv6 ARP flood suppression
EVPN VPLS over SRv6 configuration,
EVPN VPLS over SRv6 configuration
EVPN VPLS over SRv6 E-tree configuration, 297
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 EVPN instance locator,
EVPN VPLS over SRv6 Layer 3 interface > VSI
EVPN VPLS over SRv6 maintain, 299
EVPN VPLS over SRv6 PW connectivity test, 298
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 route recursion mode,
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPLS over SRv6 verify, 299
EVPN VPLS over SRv6 VSI creation, 289
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 configuration,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect locator,
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
EVPN VPWS over SRv6 cross-connect+Layer 3
EVPN VPWS over SRv6 ESI configuration, 277
EVPN VPWS over SRv6 L2VPN enable, 270
EVPN VPWS over SRv6 maintain, 281
EVPN VPWS over SRv6 multihoming, 268
EVPN VPWS over SRv6 multihoming
EVPN VPWS over SRv6 multihoming redundancy
EVPN VPWS over SRv6 PW connectivity test,
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 redundancy mode
EVPN VPWS over SRv6 route recursion
EVPN VPWS over SRv6 SID configuration,
EVPN VPWS over SRv6 verify, 281
MAC address advertisement, 317
MAC address learning disable, 317
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 TE policy color-based traffic steering,
SRv6 TE policy traffic steering,
SRv6 TE policy tunnel policy-based traffic
SRv6-encapsulated EVPN L3VPN packet
outer IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet
outer IPv6 header source address, 276
F filtering
EVPN L3VPN over SRv6 BGP EVPN route,
flooding
EVPN VPLS over SRv6 ARP flood
Flowspec
SRv6 TE policy traffic steering configuration,
format
forwarding
SR-MPLS device preference for SRLSP traffic
G
G-SRv6
H high availability configuring BFD echo packet mode for SRv6
configuring SRv6 TE policy path switchover
enabling SBFD for SR-TE policies, 187
hot standby for SRv6 TE policies, 189
hop-by-hop
I
IGP
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS IGP adjacency label allocation enable
SR-MPLS IGP support configuration, 22
SR-MPLS IGP-based SID advertisement
SRv6 SID advertisement through IGP, 131
SRv6 traffic forwarding automatic route
advertisement (IGP shortcut), 117
installing
SR-MPLS label forwarding entry installation, 4
interface
EVPN VPWS over SRv6 redundancy mode, 277
interworking
SR-MPLS+LDP interworking configuration (on
IP
IP public network over SRv6, 323
IP public network over SRv6 BGP IPv6 unicast
route flap statistics clear, 330
IP public network over SRv6 BGP session reset,
IP public network over SRv6 configuration (on
IP public network over SRv6 configuration and
IP public network over SRv6 verify, 330
IP forwarding
SR-MPLS IP traffic forwarding over SRLSPs, 17
IP routing
IPv6
EVPN VPWS over SRv6 multihoming redundancy
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
SRv6-encapsulated packet outer IPv6 header
IPv6 Segment Routing.
IPv6 segment routing (SRv6)
autoroute announce for SRv6 TE policy, 185
BFD echo packet mode for SRv6 TE policies, 188
BGP IPv6 SR policy route advertisement
407
CBTS configuration for SRv6 TE policy, 193
deletion delay configuration for remote SRv6
SID mappings with VPN
instances/cross-connects/VSIs, 192
egress protection configuration for SRv6 TE
enabling SRv6 TE policy egress protection,
End.M SID configuration for SRv6 TE policy
Flowspec-based traffic steering configuration,
hot standby for SR-TE policies, 189
ODN SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
QoS policy-based traffic steering configuration,
SBFD for SRv6 TE policies, 187
SRv6 TE policy candidate path and manual
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate path and SID list
SRv6 TE policy color-based traffic steering,
SRv6 TE policy DSCP-based traffic steering,
SRv6 TE policy encapsulation mode, 186
SRv6 TE policy path info distribution to
SRv6 TE policy path switchover and deletion
SRv6 TE policy resource usage alarm
SRv6 TE policy SNMP notifications, 196
SRv6 TE policy traffic steering,
SRv6 TE policy traffic steering mode, 178
SRv6 TE policy tunnel policy-based traffic
traffic forwarding statistics for SRv6 TE
TTL processing mode for SRv6 TE policies,
IPv6 Segment Routing OAM
SRv6 OAM.
IS-IS
enabling SRv6 TE policy egress protection, 191
SR-MPLS configuration (ISIS-advertised
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS IGP support configuration, 22
SR-MPLS prefix SID configuration, 23
SRv6 interface TI-LFA FRR calculation disable,
SRv6 TI-LFA FRR SR microloop avoidance
L label
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS label forwarding entry installation, 4
Layer 2
EVPN VPLS over SRv6 configuration,
EVPN VPWS over SRv6 configuration,
EVPN VPWS over SRv6 configuration
Layer 3
EVPN VPLS over SRv6 Layer 3 interface > VSI
EVPN VPWS over SRv6 cross-connect+Layer 3
LDP
LDP > SR-MPLS interworking, 10
SR-MPLS > LDP interworking, 10
SR-MPLS+LDP interworking configuration (on
learning
EVPN MAC address learning disable, 317
local
BGP EVPN route advertisement (local site), 316
locator
EVPN VPLS over SRv6 EVPN instance locator,
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPWS over SRv6 cross-connect, 271
EVPN VPWS over SRv6 SID configuration, 271
loose explicit path
LSP
408
static SRLSP adjacency segment
static SRLSP bind to MPLS TE tunnel
interface, 30 static SRLSP configuration, 30
static SRLSP prefix segment configuration, 21
static SRLSP switchback delay configuration,
M
MAC addressing
EVPN MAC address advertisement, 317
EVPN MAC address learning disable, 317
maintaining
IP public network over SRv6, 330
manual
mapping deletion delay configuration for remote SRv6
SID mappings with VPN
instances/cross-connects/VSIs, 192
EVPN VPLS over SRv6 Layer 3 interface >
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC)
EVPN VPWS over SRv6 cross-connect+Layer 3 interface mapping,
MPLS
BGP-based SID advertisement configuration,
configuring BGP EPE peer set, 28
IP L3VPN over SRv6 basic principle, 223
IP L3VPN over SRv6 BGP Additional Paths
IP L3VPN over SRv6 BGP session reset, 237
IP L3VPN over SRv6 BGP VPN instance locator,
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
configuration restrictions, 229
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
distribution filtering policy, 232
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 configuration and running
IP L3VPN over SRv6 display, 236
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 maintain, 236
IP L3VPN over SRv6 packet forwarding, 224
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 received BGP
VPNv4/VPNv6 route preferred value, 230
IP L3VPN over SRv6 route advertisement, 223
IP L3VPN over SRv6 route recursion mode, 233
SR based on OSPF-advertised SIDs
SRv6-encapsulated IP L3VPN packet outer IPv6
static SR protocols and standards, 17
static SRLSP adjacency segment configuration,
static SRLSP bind to MPLS TE tunnel interface,
30 static SRLSP configuration, 30
static SRLSP prefix segment configuration, 21
static SRLSP switchback delay configuration, 31
MPLS SR
409
SRGB configuration restrictions, 19
SRLB configuration restrictions, 20
MPLS TE
SR-MPLS traffic forwarding over SRLSPs, 18
tunnel static SRLSP configuration, 30
MTU
N network
BGP EVPN route advertisement (local site),
BGP-based SID advertisement configuration,
configuring BGP EPE peer set, 28
EVPN VPLS over SRv6 AC > VSI mapping,
EVPN VPLS over SRv6 ARP flood
EVPN VPLS over SRv6 E-tree configuration,
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 Layer 3 interface >
EVPN VPLS over SRv6 PW connectivity test,
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 SID configuration,
EVPN VPLS over SRv6 VSI creation, 289
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC)
EVPN VPWS over SRv6 cross-connect+Layer 3 interface mapping,
EVPN VPWS over SRv6 L2VPN enable, 270
EVPN VPWS over SRv6 multihoming
EVPN VPWS over SRv6 PW connectivity test,
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 redundancy mode, 277
EVPN VPWS over SRv6 SID configuration, 271
MPLS TE tunnel static SRLSP configuration, 30
SR-MPLS configuration (IS-IS-advertised
SR-MPLS configuration (static
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS IGP support configuration, 22
SR-MPLS IGP-based SID advertisement
SR-MPLS prefix SID configuration, 23
SR-MPLS static segment configuration, 20
SR-MPLS+LDP interworking configuration (on
SRv6 interface TI-LFA FRR calculation disable,
SRv6 interface TI-LFA FRR calculation disable
SRv6 interface TI-LFA FRR calculation disable
SRv6 TI-LFA FRR configuration,
SRv6 TI-LFA FRR enable (IPv6 IS-IS), 139
SRv6 TI-LFA FRR enable (OSPFv3), 139
SRv6 TI-LFA FRR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
configuration (IPv6 IS-IS), 141
SRv6 TI-LFA FRR SR microloop avoidance
static SRLSP adjacency segment configuration,
static SRLSP bind to MPLS TE tunnel interface,
30 static SRLSP configuration, 30
static SRLSP prefix segment configuration, 21
static SRLSP switchback delay configuration, 31
network management
autoroute announce for SRv6 TE policy, 185
BFD echo packet mode for SRv6 TE policies, 188
410
BGP IPv6 SR policy route advertisement
CBTS configuration for SRv6 TE policy, 193
deletion delay configuration for remote SRv6
SID mappings with VPN
instances/cross-connects/VSIs, 192
distributed SRv6 gateway-encapsulated
EVPN VPLS packet outer IPv6 header source
egress protection configuration for SRv6 TE
enabling SRv6 TE policy egress protection,
End.M SID configuration for SRv6 TE policy
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 FRR configuration,
EVPN L3VPN over SRv6 route recursion
EVPN L3VPN over SRv6 SID configuration,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN VPLS over SRv6 configuration, 287,
EVPN VPLS over SRv6 configuration
EVPN VPLS over SRv6 route recursion mode,
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 configuration, 266,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 multihoming, 268
EVPN VPWS over SRv6 route recursion
hot standby for SRv6 TE policies, 189
IP L3VPN over SRv6 BGP VPN instance
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 configuration,
411
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 FRR configuration, 234
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 route recursion mode, 233
IP L3VPN over SRv6 SID configuration, 226
IP public network over SRv6 BGP instance locator,
IP public network over SRv6 configuration, 323,
IP public network over SRv6 configuration (on
IP public network over SRv6 IPv6 peer SRv6 SID
IP public network over SRv6 PE BGP IPv4/IPv6
IP public network over SRv6 route recursion
IP public network over SRv6 SID configuration,
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
Layer 2 encapsulation SRv6 service chain configuration (masquerading mode)(on router),
Layer 2 encapsulation SRv6 service chain
configuration (static proxy mode)(on router), 391
Layer 3 encapsulation SRv6 service chain configuration (masquerading mode)(on router),
Layer 3 encapsulation SRv6 service chain
configuration (static proxy mode)(on router), 376
ODN SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SBFD for SRv6 TE policies, 187
SR-MPLS based on OSPF-advertised SIDs
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 configuration (on router), 144
SRv6 dynamic End.X SID deletion delay
SRv6 End SID configuration (on router), 144
SRv6 End.X SID configuration (on router), 147
SRv6 locator route advertisement through
SRv6 service chain bypass protection
configuration (static proxy mode), 362
SRv6 service chain configuration, 346
SRv6 service chain configuration
SRv6 service chain configuration (on router),
SRv6 service chain configuration (static proxy
SRv6 service chain creation, 355
SRv6 service chain creation (masquerading
SRv6 service chain creation (static proxy
SRv6 service chain DiffServ mode
configuration (static proxy mode), 360
SRv6 service chain dualhoming protection
configuration (static proxy mode), 361
SRv6 service chain echo packet mode static
SRv6 service chain packet reencapsulation parameter configuration (static proxy mode),
SRv6 service chain SFF-SF packet
encapsulation method configuration, 356
SRv6 service chain SFF-SF packet encapsulation method configuration
SRv6 service chain SFF-SF packet encapsulation method configuration (static
SRv6 service chain TTL mode configuration
SRv6 SID advertisement through IGP, 131
SRv6 SID list configuration, 135
SRv6 TE policy candidate path and manual
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate path and SID list
SRv6 TE policy color-based traffic steering,
SRv6 TE policy DSCP-based traffic steering,
SRv6 TE policy encapsulation mode, 186
SRv6 TE policy Flowspec-based traffic steering
SRv6 TE policy path info distribution to BGP-LS,
SRv6 TE policy path switchover and deletion
SRv6 TE policy QoS policy-based traffic steering
SRv6 TE policy traffic steering,
SRv6 TE policy traffic steering mode
SRv6 TE policy tunnel policy-based traffic
SRv6 tunnel BFD echo-mode detection, 136
SRv6 tunnel service class configuration, 136
SRv6 tunnel SID list specification, 135
SRv6 tunneling configuration, 135
SRv6-encapsulated EVPN L3VPN packet outer
IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet outer
IPv6 header source address, 276
SRv6-encapsulated packet outer IPv6 header
TTL processing mode for SRv6 TE policies, 192
TTL processing mode for tunnels associated with
networking
node
BGP IPv6 SR policy route advertisement
ODN SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate path and manual SID
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate path and SID list
412
O
OAM
ODN
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
operation, administration and maintenance.
Use
OSPFv3
SRv6 interface TI-LFA FRR calculation
SRv6 TI-LFA FRR SR microloop avoidance
overlay
P packet
BGP IPv6 SR policy route advertisement
configuring traffic forwarding statistics for
packet forwarding
parameter path
MPLS TE tunnel loose explicit path, 31
MPLS TE tunnel strict explicit path, 31
PCC
TE PCEP session parameters, 169
PCE
SRv6 TE policy PCE discovery, 168
PCEP
performing
SRv6 SID-based ping operation, 343, 343
SRv6 SID-based tracert operation, 344
SRv6-TE policy-based ping operation, 344
ping
SRv6-TE policy-based tracert operation, 344
performing an SRv6 SID-based ping operation,
performing an SRv6-TE policy-based ping
prefix
SR-MPLS static segment configuration, 2
static SRLSP prefix segment configuration, 21
prerequisite
SRv6 service chain configuration, 355
procedure applying EVPN VPLS over SRv6 EVPN instance
applying locator to EVPN L3VPN over SRv6 BGP
applying locator to EVPN VPWS over SRv6
applying locator to IP L3VPN over SRv6 BGP
applying locator to IP public network over SRv6
binding static SRLSP to MPLS TE tunnel interface,
clearing IP public network over SRv6 BGP IPv6
unicast route flap statistics, 330
configuring automatic static route advertisement
for SRv6 tunnel traffic direction, 137, 137
configuring BFD echo packet mode for SRv6 TE
configuring BGP EPE peer set, 28
configuring BGP EVPN route redistribution and
configuring BGP-based SID advertisement, 25,
configuring CBTS for SRv6 TE policy, 193
configuring deletion delay for remote SRv6 SID mappings with VPN
instances/cross-connects/VSIs, 192
configuring End.M SID for SRv6 TE policy egress
configuring EVPN L3VPN over SRv6 BGP
413
configuring EVPN L3VPN over SRv6 BGP
configuring EVPN L3VPN over SRv6 BGP
configuring EVPN L3VPN over SRv6 BGP
configuring EVPN L3VPN over SRv6 BGP
configuring EVPN L3VPN over SRv6
configuring EVPN L3VPN over SRv6 FRR,
configuring EVPN L3VPN over SRv6 SID, 248
configuring EVPN L3VPN over SRv6
SRv6-encapsulated EVPN route
configuring EVPN VPLS over SRv6,
configuring EVPN VPLS over SRv6
configuring EVPN VPLS over SRv6 E-tree,
configuring EVPN VPLS over SRv6 EVPN
configuring EVPN VPLS over SRv6 SID, 291
configuring EVPN VPWS over SRv6,
configuring EVPN VPWS over SRv6
configuring EVPN VPWS over SRv6 BGP
configuring EVPN VPWS over SRv6
cross-connect group+EVPN instance, 270
configuring EVPN VPWS over SRv6 cross-connect+attachment circuit (AC)
configuring EVPN VPWS over SRv6 ESI, 277
configuring EVPN VPWS over SRv6
configuring EVPN VPWS over SRv6
configuring EVPN VPWS over SRv6 SID, 271
configuring IGP SR and LDP interworking, 33
configuring IP L3VPN over SRv6, 225
configuring IP L3VPN over SRv6 BGP
configuring IP L3VPN over SRv6 BGP
VPNv4/VPNv6 route attribute, 231
configuring IP L3VPN over SRv6 BGP
VPNv4/VPNv6 route distribution filtering policy,
configuring IP L3VPN over SRv6 BGP
VPNv4/VPNv6 route reflection, 230
configuring IP L3VPN over SRv6 BGP
414 configuring IP L3VPN over SRv6 configuration
configuring IP L3VPN over SRv6 FRR, 234
configuring IP L3VPN over SRv6 IPv6 peer SRv6
configuring IP L3VPN over SRv6 PE BGP
VPNv4/VPNv6 route exchange, 227
configuring IP L3VPN over SRv6 SID, 226
configuring IP public network over SRv6, 325
configuring IP public network over SRv6 IPv6
configuring IP public network over SRv6 PE BGP
IPv4/IPv6 unicast route exchange, 326
configuring IP public network over SRv6 SID, 325
configuring IPv6 public network over SRv6
configuration (SRv6 BE mode)(on router), 331
configuring MAC/IP advertisement route
configuring MPLS SRGB, 19 configuring MPLS SRLB, 19
configuring MPLS TE tunnel loose explicit path,
configuring MPLS TE tunnel static SRLSP, 30
configuring MPLS TE tunnel strict explicit path, 31
configuring MPLS TE tunnel to use static SRLSPs,
configuring PCEP session parameters, 169
configuring SBFD for SRLSP, 40
configuring SR-MPLS (IS-IS-advertised
configuring SR-MPLS (on router), 43
configuring SR-MPLS (static segment-based)(on
configuring SR-MPLS based on OSPF-advertised
configuring SR-MPLS device preference for
configuring SR-MPLS IGP support, 22
configuring SR-MPLS IGP-based SID
configuring SR-MPLS IP traffic forwarding over
configuring SR-MPLS MPLS TE traffic forwarding
configuring SR-MPLS prefix SID, 23
configuring SR-MPLS static segment, 20
configuring SRv6 BE mode IPv4 EVPN L3VPN
configuring SRv6 BGP EVPN route exchange,
configuring SRv6 dynamic End.X SID deletion
delay, 130 configuring SRv6 G-SID, 130
configuring SRv6 service chain
configuring SRv6 service chain (on router),
configuring SRv6 service chain (static proxy
configuring SRv6 service chain bypass
protection (static proxy mode), 362
configuring SRv6 service chain DiffServ mode
configuring SRv6 service chain dualhoming
protection (static proxy mode), 361
configuring SRv6 service chain echo packet
configuring SRv6 service chain packet reencapsulation parameters (static proxy
configuring SRv6 service chain SFF-SF
packet encapsulation method, 356
configuring SRv6 service chain SFF-SF packet encapsulation method (masquerading
configuring SRv6 service chain SFF-SF packet encapsulation method (static proxy
configuring SRv6 service chain TTL mode
configuring SRv6 service chain with Layer 2 encapsulation (masquerading mode)(on
configuring SRv6 service chain with Layer 2 encapsulation (static proxy mode)(on router),
configuring SRv6 service chain with Layer 3 encapsulation (masquerading mode)(on
configuring SRv6 service chain with Layer 3 encapsulation (static proxy mode)(on router),
configuring SRv6 SID advertisement through
configuring SRv6 SID list, 135
configuring SRv6 TE policy, 165
configuring SRv6 TE policy color-based traffic
configuring SRv6 TE policy DSCP-based
415 configuring SRv6 TE policy egress protection,
configuring SRv6 TE policy encapsulation mode,
configuring SRv6 TE policy path switchover and
configuring SRv6 TE policy resource usage alarm
configuring SRv6 TE policy traffic steering, 178,
configuring SRv6 TE policy traffic steering mode,
configuring SRv6 TE policy tunnel policy-based
configuring SRv6 that uses End SIDs (on router),
configuring SRv6 that uses End.X SIDs (on
configuring SRv6 TI-LFA FRR microloop
configuring SRv6 TI-LFA FRR SR microloop
configuring SRv6 TI-LFA FRR SR microloop
configuring SRv6 TI-LFA FRR SR microloop
configuring SRv6 traffic forwarding, 137
configuring SRv6 tunnel service class, 136
configuring SRv6 tunneling, 135
configuring static route for SRv6 tunnel traffic
configuring static SRLSP adjacency segment, 20
configuring static SRLSP configuration, 30
configuring static SRLSP prefix segment, 21
configuring static SRLSP switchback delay
configuring traffic forwarding statistics for SRv6
configuring TTL processing mode for SRv6 TE
configuring TTL processing mode for tunnels
associated with a VPN instance,
configuring tunnel BFD for SRLSP, 41
controlling IP L3VPN over SRv6 BGP
VPNv4/VPNv6 route advertisement+reception,
creating EVPN VPLS over SRv6 VSI, 289
creating SRv6 service chain, 355
creating SRv6 service chain (masquerading
creating SRv6 service chain (static proxy mode),
disabling EVPN MAC address advertisement, 317
disabling EVPN MAC address learning, 317
disabling SRv6 interface TI-LFA FRR
disabling SRv6 interface TI-LFA FRR
disabling SRv6 interface TI-LFA FRR
discovering SRv6 TE policy PCE, 168
displaying BGP SR configuration, 42, 42 displaying BGP SR status, 42, 42
displaying EVPN L3VPN over SRv6
configuration and running status, 257
displaying IP L3VPN over SRv6, 236
displaying IP L3VPN over SRv6 configuration
displaying IP public network over SRv6
configuration and running status, 330
displaying IS-IS SR configuration, 42, 42 displaying IS-IS SR status, 42, 42
displaying OSPF SR configuration, 43, 43 displaying OSPF SR status, 43, 43
displaying SR-MPLS label block, 42, 42 displaying SR-MPLS static segment, 42, 42
displaying SRv6 service chain information,
enabling autoroute announce for SRv6 TE
enabling BGP EVPN route advertisement
enabling EVPN L3VPN over SRv6 route
enabling EVPN VPLS over SRv6 ARP flood
enabling EVPN VPLS over SRv6 route
enabling EVPN VPWS over SRv6 L2VPN,
enabling EVPN VPWS over SRv6 route
enabling hot standby for SRv6 TE policies,
enabling IP L3VPN over SRv6 route recursion
enabling IP public network over SRv6 route
enabling SBFD for SR-TE policies, 187
enabling SR-MPLS IGP adjacency label
enabling SRv6 locator route advertisement
enabling SRv6 TE policy egress protection,
enabling SRv6 TE policy logging, 196
416 enabling SRv6 TE policy path info distribution to
enabling SRv6 TE policy SNMP notifications, 196
enabling SRv6 tunnel BFD echo-mode detection,
filtering EVPN L3VPN over SRv6 BGP EVPN
maintaining EVPN L3VPN over SRv6, 257
maintaining EVPN VPLS over SRv6, 299
maintaining EVPN VPWS over SRv6, 281
maintaining IP L3VPN over SRv6, 236
maintaining IP public network over SRv6, 330
maintaining SRv6 service chain, 364
maintaining SRv6 TE policy, 198
mapping EVPN VPLS over SRv6 AC > VSI, 295,
mapping EVPN VPLS over SRv6 Layer 3
mapping EVPN VPWS over SRv6
cross-connect+Layer 3 interface mapping, 275
resetting EVPN L3VPN over SRv6 BGP session,
resetting IP L3VPN over SRv6 BGP session, 237
resetting IP public network over SRv6 BGP
shutting down SRv6 TE policy, 174
specifying distributed SRv6 gateway-encapsulated EVPN VPLS packet outer
IPv6 header source address, 315
specifying IP L3VPN over SRv6 received BGP
VPNv4/VPNv6 route preferred value, 230
specifying SRv6 tunnel SID list, 135
specifying SRv6-encapsulated EVPN L3VPN
packet outer IPv6 header source address, 255
specifying SRv6-encapsulated EVPN VPLS
packet outer IPv6 header source address, 296
specifying SRv6-encapsulated EVPN VPWS
packet outer IPv6 header source address, 276
specifying SRv6-encapsulated packet outer IPv6
SRv6 TE policy Flowspec-based traffic steering
SRv6 TE policy QoS policy-based traffic steering
testing EVPN VPLS over SRv6 PW connectivity,
testing EVPN VPLS over SRv6 PW connectivity
testing EVPN VPLS over SRv6 PW
testing EVPN VPWS over SRv6 PW
testing EVPN VPWS over SRv6 PW
testing EVPN VPWS over SRv6 PW
verifying EVPN L3VPN over SRv6, 257
verifying EVPN VPLS over SRv6, 299
verifying EVPN VPWS over SRv6, 281
verifying IP public network over SRv6, 330
verifying SRv6 service chain, 364
protocols and standards
public
SRv6-encapsulated public network packet
outer IPv6 header source address, 234
public network
IP public network over SRv6, 323
IP public network over SRv6 basic principle,
IP public network over SRv6 BGP instance
IP public network over SRv6 BGP IPv6 unicast
route flap statistics clear, 330
IP public network over SRv6 BGP session
IP public network over SRv6 configuration,
IP public network over SRv6 configuration (on
IP public network over SRv6 configuration and
IP public network over SRv6 IPv6 peer SRv6
IP public network over SRv6 maintain, 330
IP public network over SRv6 packet
IP public network over SRv6 PE BGP
IPv4/IPv6 unicast route exchange, 326
IP public network over SRv6 route
IP public network over SRv6 route recursion
IP public network over SRv6 verify, 330
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
SRv6-encapsulated IP public network packet
outer IPv6 header source address, 329
PW
EVPN VPLS over SRv6 PW connectivity test, 298
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test,
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test
Q
QoS
SRv6 TE policy traffic steering configuration, 182
R redistribution
BGP EVPN route redistribution, 316
MAC/IP advertisement route redistribution, 316
resetting
EVPN L3VPN over SRv6 BGP session, 257
IP L3VPN over SRv6 BGP session, 237
IP public network over SRv6 BGP session, 330
resource usage
SRv6 TE policy resource usage alarm thresholds,
restrictions
MPLS SR SRGB configuration, 19
MPLS SR SRLB configuration, 20
SR-MPLS device preference for SRLSP traffic
SR-MPLS IGP adjacency label allocation enable,
SR-MPLS prefix SID configuration, 23
SR-MPLS static segment configuration
SR-MPLS static segment configuration (prefix),
SRv6 service chain configuration, 354
SRv6 SID list configuration, 135
restrictions and guidelines
SRv6 TE policy egress protection configuration,
route
BGP EVPN route advertisement (local site), 316
BGP EVPN route redistribution and
EVPN VPWS over SRv6 multihoming redundancy
IP public network over SRv6 BGP IPv6 unicast
route flap statistics clear, 330
417
MAC/IP advertisement route redistribution,
routing
BGP IPv6 SR policy route advertisement
distributed SRv6 gateway-encapsulated
EVPN VPLS packet outer IPv6 header source
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 route recursion
EVPN L3VPN over SRv6 SID configuration,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN VPLS over SRv6 route recursion mode,
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 route recursion
IP L3VPN over SRv6 BGP VPN instance
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 route recursion mode,
IP L3VPN over SRv6 SID configuration, 226
IP public network over SRv6 BGP instance
IP public network over SRv6 configuration,
IP public network over SRv6 configuration (on
IP public network over SRv6 IPv6 peer SRv6
IP public network over SRv6 PE BGP IPv4/IPv6
IP public network over SRv6 route recursion
IP public network over SRv6 SID configuration,
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
ODN SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 configuration (on router), 144
SRv6 dynamic End.X SID deletion delay
SRv6 End SID configuration (on router), 144
SRv6 End.X SID configuration (on router), 147
SRv6 interface TI-LFA FRR calculation disable,
SRv6 interface TI-LFA FRR calculation disable
SRv6 interface TI-LFA FRR calculation disable
SRv6 locator route advertisement through BGP,
SRv6 SID advertisement through IGP, 131
SRv6 SID list configuration, 135
SRv6 TE policy candidate path and manual SID
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate path and SID list
SRv6 TE policy Flowspec-based traffic steering
SRv6 TE policy QoS policy-based traffic steering
SRv6 TI-LFA FRR configuration,
SRv6 TI-LFA FRR enable (IPv6 IS-IS), 139
SRv6 TI-LFA FRR enable (OSPFv3), 139
SRv6 TI-LFA FRR microloop avoidance
418
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
configuration (IPv6 IS-IS), 141
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 tunnel BFD echo-mode detection, 136
SRv6 tunnel service class configuration, 136
SRv6 tunnel SID list specification, 135
SRv6 tunneling configuration, 135
SRv6-encapsulated EVPN L3VPN packet
outer IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet
outer IPv6 header source address, 276
SRv6-encapsulated packet outer IPv6 header
S
SBFD
enabling SBFD for SR-TE policies, 187
segment
segment routing global block.
Use SRGB segment routing local block.
Use SRLB
segment ID.
segment routing distributed SRv6 gateway-encapsulated
EVPN VPLS packet outer IPv6 header source
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 maintain, 257
EVPN L3VPN over SRv6 route recursion
EVPN L3VPN over SRv6 SID configuration,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN L3VPN over SRv6 verify, 257
419
EVPN VPLS over SRv6 AC > VSI mapping, 295,
EVPN VPLS over SRv6 configuration,
EVPN VPLS over SRv6 configuration
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 EVPN instance locator,
EVPN VPLS over SRv6 route recursion mode,
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 configuration,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect locator,
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
EVPN VPWS over SRv6 cross-connect+Layer 3
EVPN VPWS over SRv6 L2VPN enable, 270
EVPN VPWS over SRv6 multihoming, 268
EVPN VPWS over SRv6 route recursion mode,
EVPN VPWS over SRv6 SID configuration, 271
IP L3VPN over SRv6 BGP VPN instance locator,
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 display, 236
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 maintain, 236
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 route recursion mode, 233
IP L3VPN over SRv6 SID configuration, 226
IP public network over SRv6 BGP instance locator,
IP public network over SRv6 configuration, 323,
IP public network over SRv6 configuration (on
IP public network over SRv6 IPv6 peer SRv6
IP public network over SRv6 maintain, 330
IP public network over SRv6 PE BGP
IPv4/IPv6 unicast route exchange, 326
IP public network over SRv6 route recursion
IP public network over SRv6 SID configuration,
IP public network over SRv6 verify, 330
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
Layer 2 encapsulation SRv6 service chain configuration (masquerading mode)(on
Layer 2 encapsulation SRv6 service chain configuration (static proxy mode)(on router),
Layer 3 encapsulation SRv6 service chain configuration (masquerading mode)(on
Layer 3 encapsulation SRv6 service chain configuration (static proxy mode)(on router),
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 configuration (on router), 144
SRv6 dynamic End.X SID deletion delay
SRv6 End SID configuration (on router), 144
SRv6 End.X SID configuration (on router), 147
SRv6 interface TI-LFA FRR calculation
SRv6 interface TI-LFA FRR calculation
SRv6 interface TI-LFA FRR calculation
SRv6 locator route advertisement through
SRv6 service chain bypass protection
configuration (static proxy mode), 362
SRv6 service chain configuration, 346
SRv6 service chain configuration
SRv6 service chain configuration (on router),
SRv6 service chain configuration (static proxy
SRv6 service chain creation, 355
SRv6 service chain creation (masquerading
SRv6 service chain creation (static proxy mode),
SRv6 service chain DiffServ mode configuration
SRv6 service chain dualhoming protection
configuration (static proxy mode), 361
SRv6 service chain echo packet mode static BFD
SRv6 service chain packet reencapsulation
parameter configuration (static proxy mode), 359
SRv6 service chain SFF-SF packet encapsulation
SRv6 service chain SFF-SF packet encapsulation
method configuration (masquerading mode), 358
SRv6 service chain SFF-SF packet encapsulation
method configuration (static proxy mode), 356
SRv6 service chain TTL mode configuration
SRv6 SID advertisement through IGP, 131
SRv6 SID list configuration, 135
SRv6 TI-LFA FRR configuration,
SRv6 TI-LFA FRR enable (IPv6 IS-IS), 139
SRv6 TI-LFA FRR enable (OSPFv3), 139
SRv6 TI-LFA FRR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
configuration (IPv6 IS-IS), 141
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 tunnel BFD echo-mode detection, 136
SRv6 tunnel service class configuration, 136
SRv6 tunnel SID list specification, 135
SRv6 tunneling configuration, 135
SRv6-encapsulated EVPN L3VPN packet outer
IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet outer
IPv6 header source address, 276
SRv6-encapsulated packet outer IPv6 header
segment routing (SR)
420
MPLS TE tunnel static SRLSP, 30
SR-MPLS (IS-IS-advertised SID-based)(on
SR-MPLS (static segment-based)(on router),
SR-MPLS based on OSPF-advertised SIDs
SR-MPLS IGP adjacency label allocation, 24
SR-MPLS+LDP interworking configuration (on
static SR protocols and standards, 17
static SRLSP adjacency segment
static SRLSP bind to MPLS TE tunnel
interface, 30 static SRLSP configuration, 30
static SRLSP prefix segment configuration, 21
static SRLSP switchback delay configuration,
segment-by-segment
service class
configuring CBTS for SRv6 TE policy, 193
session
EVPN L3VPN over SRv6 BGP session reset,
IP L3VPN over SRv6 BGP session reset, 237
IP public network over SRv6 BGP session
setting up
SEv6-TE policy
SFC
PCEP session parameter configuration, 169
Layer 2 encapsulation SRv6 service chain configuration (masquerading mode)(on
Layer 2 encapsulation SRv6 service chain configuration (static proxy mode)(on router),
Layer 3 encapsulation SRv6 service chain configuration (masquerading mode)(on
Layer 3 encapsulation SRv6 service chain configuration (static proxy mode)(on router),
SRv6 service chain basic concept, 346
SRv6 service chain bypass protection (static
SRv6 service chain bypass protection
configuration (static proxy mode), 362
SRv6 service chain configuration, 346
SRv6 service chain configuration (masquerading
SRv6 service chain configuration (on router), 364
SRv6 service chain configuration (static proxy
SRv6 service chain configuration restrictions, 354
SRv6 service chain creation, 355
SRv6 service chain creation (masquerading
SRv6 service chain creation (static proxy mode),
SRv6 service chain DiffServ mode configuration
SRv6 service chain dualhoming protection (static
SRv6 service chain dualhoming protection
configuration (static proxy mode), 361
SRv6 service chain echo packet mode static BFD
SRv6 service chain high availability (static proxy
SRv6 service chain packet reencapsulation
parameter configuration (static proxy mode), 359
SRv6 service chain SFF-SF packet encapsulation
SRv6 service chain SFF-SF packet encapsulation
method configuration (masquerading mode), 358
SRv6 service chain SFF-SF packet encapsulation
method configuration (static proxy mode), 356
SRv6 service chain traffic forwarding, 348
SRv6 service chain TTL mode configuration
SID
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPWS over SRv6 SID configuration, 271
MPLS SR dynamic SID allocation, 3
SR-MPLS configuration (IS-IS-advertised
SR-MPLS dynamic SID allocation,
SR-MPLS IGP-based SID advertisement
SR-MPLS label forwarding entry installation, 4
SR-MPLS prefix SID configuration, 23
421
SRv6 dynamic End.X SID deletion delay
SRv6 End SID configuration (on router), 144
SRv6 End.X SID configuration (on router), 147
SRv6 SID advertisement through IGP, 131
SID list
ODN SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
SRv6 TE policy candidate and SID list path
SRv6 TE policy candidate path and manual
SRv6 TE policy candidate path and
PCE-computed SID list configuration, 171
specifying distributed SRv6 gateway-encapsulated
EVPN VPLS packet outer IPv6 header source
IP L3VPN over SRv6 received BGP
VPNv4/VPNv6 route preferred value, 230
SRv6-encapsulated EVPN L3VPN packet
outer IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet
outer IPv6 header source address, 276
SRv6-encapsulated packet outer IPv6 header
SRLSP
MPLS MPLS TE SR traffic forwarding over
MPLS TE tunnel static SRLSP configuration,
SR-MPLS device preference for SRLSP traffic
SR-MPLS IP traffic forwarding over SRLSPs,
SR-MPLS
BGP-based SID advertisement configuration,
configuration (IS-IS-advertised SID-based)(on
configuration (static segment-based)(on router),
configuring BGP EPE peer set, 28
device preference for SRLSP traffic forwarding
device preference for SRLSP traffic forwarding
configuration restrictions, 29
IGP adjacency label allocation enable, 24
IGP adjacency label allocation enable restrictions,
IGP-based SID advertisement configuration, 21
IP traffic forwarding over SRLSPs, 17
label forwarding entry installation, 4
LDP > SR-MPLS interworking, 10
MPLS TE traffic forwarding over SRLSPs, 18
MPLS TE tunnel static SRLSP configuration, 30
prefix SID configuration, 23 prefix SID configuration restrictions, 23
SR-MPLS > LDP interworking, 10
SR-MPLS+LDP interworking configuration (on
static segment configuration restrictions
static segment configuration restrictions (prefix),
SRv6
configuration (on router), 144
distributed SRv6 gateway-encapsulated EVPN
VPLS packet outer IPv6 header source address,
dynamic End.X SID deletion delay configuration,
End SID configuration (on router), 144
End.X SID configuration (on router), 147
422
EVPN L3VPN over SRv6 basic principle, 245
EVPN L3VPN over SRv6 BGP Additional
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
configuration restrictions, 252
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP session reset,
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 configuration and
EVPN L3VPN over SRv6 FRR configuration,
EVPN L3VPN over SRv6 maintain, 257
EVPN L3VPN over SRv6 packet forwarding,
EVPN L3VPN over SRv6 route advertisement,
EVPN L3VPN over SRv6 route recursion
EVPN L3VPN over SRv6 SID configuration,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN L3VPN over SRv6 verify, 257
EVPN VPLS over SRv6 AC > VSI mapping,
EVPN VPLS over SRv6 ARP flood
EVPN VPLS over SRv6 configuration, 287,
EVPN VPLS over SRv6 configuration
EVPN VPLS over SRv6 E-tree configuration,
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 Layer 3 interface >
423
EVPN VPLS over SRv6 maintain, 299
EVPN VPLS over SRv6 PW connectivity test, 298
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 route recursion mode,
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPLS over SRv6 verify, 299
EVPN VPLS over SRv6 VSI creation, 289
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 configuration,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect locator,
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
EVPN VPWS over SRv6 cross-connect+Layer 3
EVPN VPWS over SRv6 ESI configuration, 277
EVPN VPWS over SRv6 L2VPN enable, 270
EVPN VPWS over SRv6 maintain, 281
EVPN VPWS over SRv6 multihoming, 268
EVPN VPWS over SRv6 multihoming
EVPN VPWS over SRv6 multihoming redundancy
EVPN VPWS over SRv6 PW connectivity test,
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 redundancy mode
EVPN VPWS over SRv6 route recursion mode,
EVPN VPWS over SRv6 SID configuration, 271
EVPN VPWS over SRv6 verify, 281
interface TI-LFA FRR calculation disable, 139
interface TI-LFA FRR calculation disable (IPv6
interface TI-LFA FRR calculation disable
IP L3VPN over SRv6 basic principle, 223
IP L3VPN over SRv6 BGP Additional Paths
IP L3VPN over SRv6 BGP session reset, 237
IP L3VPN over SRv6 BGP VPN instance
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route advertisement+reception, 230
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route configuration restrictions, 229
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route distribution filtering policy, 232
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 configuration and
IP L3VPN over SRv6 display, 236
IP L3VPN over SRv6 FRR configuration, 234
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 maintain, 236
IP L3VPN over SRv6 packet forwarding, 224
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 received BGP
VPNv4/VPNv6 route preferred value, 230
IP L3VPN over SRv6 route advertisement,
IP L3VPN over SRv6 route recursion mode,
IP L3VPN over SRv6 SID configuration, 226
IP public network over SRv6, 323
IP public network over SRv6 basic principle,
IP public network over SRv6 BGP instance
IP public network over SRv6 BGP IPv6 unicast
route flap statistics clear, 330
IP public network over SRv6 BGP session
IP public network over SRv6 configuration,
IP public network over SRv6 configuration (on
424
IP public network over SRv6 configuration and
IP public network over SRv6 IPv6 peer SRv6 SID
IP public network over SRv6 maintain, 330
IP public network over SRv6 packet forwarding,
IP public network over SRv6 PE BGP IPv4/IPv6
IP public network over SRv6 route advertisement,
IP public network over SRv6 route recursion
IP public network over SRv6 SID configuration,
IP public network over SRv6 verify, 330
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
IPv6 Segment Routing configuration, 112
Layer 2 encapsulation SRv6 service chain configuration (masquerading mode)(on router),
Layer 2 encapsulation SRv6 service chain
configuration (static proxy mode)(on router), 391
Layer 3 encapsulation SRv6 service chain configuration (masquerading mode)(on router),
Layer 3 encapsulation SRv6 service chain
configuration (static proxy mode)(on router), 376
locator route advertisement through BGP, 132
OAM.
service chain basic concept, 346
service chain bypass protection (static proxy
service chain bypass protection configuration
service chain configuration, 346
service chain configuration (masquerading mode),
service chain configuration (on router), 364
service chain configuration (static proxy mode),
354 service chain configuration restrictions, 354
service chain creation (masquerading mode), 356
service chain creation (static proxy mode), 355
service chain DiffServ mode configuration
service chain dualhoming protection (static
service chain dualhoming protection
configuration (static proxy mode), 361
service chain echo packet mode static BFD
service chain high availability (static proxy
service chain packet reencapsulation parameter configuration (static proxy mode),
service chain SFF-SF packet encapsulation
service chain SFF-SF packet encapsulation method configuration (masquerading mode),
service chain SFF-SF packet encapsulation
method configuration (static proxy mode), 356
service chain traffic forwarding, 348
service chain TTL mode configuration (static
SID advertisement through IGP, 131
SID list configuration restrictions, 135
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 VPN traffic direction to SRv6 tunnel, 117
SRv6-encapsulated EVPN L3VPN packet
outer IPv6 header source address, 255
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
SRv6-encapsulated EVPN VPWS packet
outer IPv6 header source address, 276
SRv6-encapsulated packet outer IPv6 header
TI-LFA FRR enable (IPv6 IS-IS), 139
TI-LFA FRR enable (OSPFv3), 139
TI-LFA FRR microloop avoidance
TI-LFA FRR SR microloop avoidance
TI-LFA FRR SR microloop avoidance
configuration (IPv6 IS-IS), 141
TI-LFA FRR SR microloop avoidance
traffic forwarding automatic route
traffic forwarding configuration, 137
traffic forwarding static routing, 117
tunnel BFD echo-mode detection, 136 tunnel service class configuration, 136
tunnel SID list specification, 135 tunneling configuration, 135
SRv6 OAM
performing an SRv6 SID-based ping operation,
performing an SRv6 SID-based tracert operation,
performing an SRv6-TE policy-based ping
performing an SRv6-TE policy-based tracert
SRv6 service chain
bypass protection (static proxy mode), 350
bypass protection configuration (static proxy
configuration (masquerading mode), 355
configuration (on router), 364
configuration (static proxy mode), 354 configuration restrictions, 354
creation (masquerading mode), 356
creation (static proxy mode), 355
DiffServ mode configuration (static proxy mode),
dualhoming protection (static proxy mode), 350
dualhoming protection configuration (static proxy
echo packet mode static BFD configuration, 363
high availability (static proxy mode), 350
Layer 2 encapsulation configuration
(masquerading mode)(on router), 374
Layer 2 encapsulation configuration (static proxy
Layer 3 encapsulation configuration
(masquerading mode)(on router), 364
Layer 3 encapsulation configuration (static proxy
packet reencapsulation parameter configuration
SFF-SF packet encapsulation method
425
SFF-SF packet encapsulation method
configuration (masquerading mode), 358
SFF-SF packet encapsulation method
configuration (static proxy mode), 356
TTL mode configuration (static proxy mode),
SRv6 SID performing an SRv6 SID-based ping operation,
performing an SRv6 SID-based tracert
performing an SRv6-TE policy-based tracert
SRv6 TE policy
BFD echo packet mode for SRv6 TE policies,
candidate path and manual SID list
candidate path and PCE-computed SID list
candidate path and SID list configuration, 169
deletion delay configuration for remote SRv6
SID mappings with VPN
instances/cross-connects/VSIs, 192
egress protection configuration, 190
egress protection configuration restrictions
enabling egress protection, 191
encapsulation mode configuration, 186
End.M SID configuration for egress protection,
Flowspec-based traffic steering configuration,
hot standby for SRv6 TE policies, 189
how SRv6 TE policy CBTS works, 160
learning from BGP SRv6 TE policy route, 155
ODN candidate path and PCE-computed SID list
path info distribution to BGP-LS, 173
path switchover and deletion delays, 190
PCEP session configuration, 168
QoS policy-based traffic steering configuration,
SBFD for SRv6 TE policies, 187
SRv6 TE policy CBTS overview, 160
SRv6 TE policy resource usage alarm thresholds,
SRv6 TE policy SNMP notifications, 196
traffic forwarding statistics for SRv6 TE policies,
traffic steering mode configuration, 178
TTL processing mode for SRv6 TE policies, 192
tunnel policy-based traffic steering,
SRv6-TE policy performing an SRv6-TE policy-based ping
static
SRLSP adjacency segment configuration, 20
SRLSP bind to MPLS TE tunnel interface, 30
SRLSP prefix segment configuration, 21
SRLSP switchback delay configuration, 31
SR-MPLS configuration (static
SR-MPLS static segment configuration,
SRv6 traffic forwarding static routing, 117
statistics traffic forwarding statistics for SRv6 TE policies,
strict explicit path
suppressing
EVPN VPLS over SRv6 ARP flood suppression,
426
switchback static SRLSP switchback delay configuration,
T testing
EVPN VPLS over SRv6 PW connectivity, 298
EVPN VPLS over SRv6 PW connectivity
EVPN VPLS over SRv6 PW connectivity
EVPN VPWS over SRv6 PW connectivity, 279
EVPN VPWS over SRv6 PW connectivity
EVPN VPWS over SRv6 PW connectivity
tracert
performing an SRv6 SID-based tracert
performing an SRv6-TE policy-based tracert
traffic
SR-MPLS device preference for SRLSP traffic
SR-MPLS IP traffic forwarding over SRLSPs,
SR-MPLS MPLS TE traffic forwarding over
traffic forwarding
SRv6 automatic route advertisement
SRv6 automatic route advertisement (IGP
traffic steering configuring SRv6 TE policy color-based traffic
configuring SRv6 TE policy DSCP-based
configuring SRv6 TE policy traffic steering,
configuring SRv6 TE policy traffic steering
TTL configuring SRv6 TE policy tunnel
policy-based traffic steering,
configuring TTL processing mode for SRv6 TE
configuring TTL processing mode for tunnels
associated with a VPN instance,
tunnel BFD
tunnel policy configuring SRv6 TE policy tunnel policy-based
tunneling
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration,
EVPN L3VPN over SRv6 route recursion mode,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN VPLS over SRv6 route recursion mode,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 route recursion mode,
IP L3VPN over SRv6 BGP VPN instance locator,
IP L3VPN over SRv6 BGP VPNv4/VPNv6 route
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 route recursion mode, 233
IP public network over SRv6 BGP instance locator,
IP public network over SRv6 configuration, 323,
IP public network over SRv6 configuration (on
IP public network over SRv6 IPv6 peer SRv6 SID
IP public network over SRv6 PE BGP IPv4/IPv6
427
IP public network over SRv6 route recursion
IPv6 public network over SRv6 configuration
(SRv6 BE mode)(on router), 331
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 configuration (on router), 144
SRv6 End SID configuration (on router), 144
SRv6 End.X SID configuration (on router), 147
SRv6 interface TI-LFA FRR calculation
SRv6 interface TI-LFA FRR calculation
SRv6 interface TI-LFA FRR calculation
SRv6 SID list configuration, 135
SRv6 TI-LFA FRR configuration,
SRv6 TI-LFA FRR enable (IPv6 IS-IS), 139
SRv6 TI-LFA FRR enable (OSPFv3), 139
SRv6 TI-LFA FRR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 TI-LFA FRR SR microloop avoidance
configuration (IPv6 IS-IS), 141
SRv6 TI-LFA FRR SR microloop avoidance
SRv6 tunnel BFD echo-mode detection, 136
SRv6 tunnel service class configuration, 136
SRv6 tunnel SID list specification, 135
SRv6-encapsulated EVPN L3VPN packet
outer IPv6 header source address, 255
SRv6-encapsulated packet outer IPv6 header
static SRLSP bind to MPLS TE tunnel
V verifying
IP public network over SRv6, 330
VPLS distributed SRv6 gateway-encapsulated EVPN
VPLS packet outer IPv6 header source address,
EVPN VPLS over SRv6 AC > VSI mapping, 295,
EVPN VPLS over SRv6 ARP flood suppression
EVPN VPLS over SRv6 configuration,
EVPN VPLS over SRv6 configuration
EVPN VPLS over SRv6 E-tree configuration, 297
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 EVPN instance locator,
EVPN VPLS over SRv6 Layer 3 interface > VSI
EVPN VPLS over SRv6 maintain, 299
EVPN VPLS over SRv6 PW connectivity test, 298
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 PW connectivity test
EVPN VPLS over SRv6 SID configuration, 291
EVPN VPLS over SRv6 verify, 299
EVPN VPLS over SRv6 VSI creation, 289
SRv6 TE policy color-based traffic steering, 293,
SRv6 TE policy traffic steering,
SRv6 TE policy tunnel policy-based traffic
SRv6-encapsulated EVPN VPLS packet outer
IPv6 header source address, 296
VPN
EVPN L3VPN over SRv6 basic principle, 245
EVPN L3VPN over SRv6 BGP Additional Paths
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route
configuration restrictions, 252
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP EVPN route filter,
EVPN L3VPN over SRv6 BGP EVPN route
EVPN L3VPN over SRv6 BGP session reset, 257
428
EVPN L3VPN over SRv6 BGP VPN instance
EVPN L3VPN over SRv6 configuration, 245,
EVPN L3VPN over SRv6 configuration and
EVPN L3VPN over SRv6 maintain, 257
EVPN L3VPN over SRv6 packet forwarding,
EVPN L3VPN over SRv6 route advertisement,
EVPN L3VPN over SRv6 SRv6-encapsulated
EVPN L3VPN over SRv6 verify, 257
EVPN VPWS over SRv6 L2VPN enable, 270
IP L3VPN over SRv6 basic principle, 223
IP L3VPN over SRv6 BGP Additional Paths
IP L3VPN over SRv6 BGP session reset, 237
IP L3VPN over SRv6 BGP VPN instance
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route advertisement+reception, 230
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route configuration restrictions, 229
IP L3VPN over SRv6 BGP VPNv4/VPNv6
route distribution filtering policy, 232
IP L3VPN over SRv6 BGP VPNv4/VPNv6
IP L3VPN over SRv6 configuration,
IP L3VPN over SRv6 configuration (SRv6 BE
IP L3VPN over SRv6 configuration and
IP L3VPN over SRv6 display, 236
IP L3VPN over SRv6 IPv6 peer SRv6 SID
IP L3VPN over SRv6 maintain, 236
IP L3VPN over SRv6 packet forwarding, 224
IP L3VPN over SRv6 PE BGP VPNv4/VPNv6
IP L3VPN over SRv6 received BGP
VPNv4/VPNv6 route preferred value, 230
IP L3VPN over SRv6 route advertisement,
SRv6 BE mode IPv4 EVPN L3VPN over SRv6
SRv6 VPN traffic direction to SRv6 tunnel, 117
SRv6-encapsulated EVPN L3VPN packet outer
IPv6 header source address, 255
SRv6-encapsulated IP L3VPN packet outer IPv6
VPWS
EVPN VPWS over SRv6 BGP EVPN route
EVPN VPWS over SRv6 configuration,
EVPN VPWS over SRv6 configuration
EVPN VPWS over SRv6 cross-connect
group+EVPN instance configuration, 270
EVPN VPWS over SRv6 cross-connect locator,
EVPN VPWS over SRv6 cross-connect+attachment circuit (AC) mapping,
EVPN VPWS over SRv6 cross-connect+Layer 3
EVPN VPWS over SRv6 L2VPN enable, 270
EVPN VPWS over SRv6 maintain, 281
EVPN VPWS over SRv6 multihoming, 268
EVPN VPWS over SRv6 multihoming
EVPN VPWS over SRv6 multihoming redundancy
EVPN VPWS over SRv6 PW connectivity test,
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 PW connectivity test
EVPN VPWS over SRv6 redundancy mode, 277
EVPN VPWS over SRv6 SID configuration, 271
EVPN VPWS over SRv6 verify, 281
SRv6 TE policy color-based traffic steering, 273
SRv6 TE policy traffic steering, 273
SRv6 TE policy tunnel policy-based traffic
SRv6-encapsulated EVPN VPWS packet outer
IPv6 header source address, 276
VSI
EVPN VPLS over SRv6 AC > VSI mapping, 295,
EVPN VPLS over SRv6 EVPN instance
429
EVPN VPLS over SRv6 EVPN instance
EVPN VPLS over SRv6 Layer 3 interface >
EVPN VPLS over SRv6 VSI creation, 289
430
ডাউনলোড
পাবলিক লিঙ্ক আপডেট করা হয়েছে
আপনার চ্যাটের পাবলিক লিঙ্ক আপডেট করা হয়েছে। You may view and manage your chat links after registration here.
নথির পাবলিক লিঙ্ক
বিজ্ঞাপন