Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

SRv6 dual termination

Updated: September 8, 2026

Want to summarize with AI?

Log in

Describes how dual termination processes multiple SIDs through two forwarding passes and provides the restrictions and configuration needed to use it with Flex-Algo services.

SRv6 dual termination is an SRv6 feature that

  • enables an egress provider edge (PE) router to process and sequentially terminate two of its own segment IDs

  • supports ingress-driven Flex-Algo (FA) steering, and

  • achieves parity with SR-MPLS ingress-driven capabilities.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

SRv6 dual termination

Release 26.1.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200, P100])

You can now gain precise control over traffic flow and optimize network paths using ingress-driven Flex-Algo traffic engineering for SRv6 services. This capability is achieved by enabling the egress provider edge (PE) to process and terminate two of its own segment IDs in a sequence. This feature enhances traffic steering flexibility and ensures seamless functional alignment with existing SR-MPLS ingress-driven deployments.

SRv6 dual SID termination for enhanced traffic steering

Traditionally, SRv6 egress PE routers are designed to terminate only a single service Segment ID (SID). However, advanced traffic engineering scenarios, similar to those in SR-MPLS networks, require ingress PEs to explicitly select and steer traffic over specific FA paths. This feature allows the egress PE to process and terminate two of its own SIDs (a Flex-Algo SID and a VPN SID) sequentially, providing greater control and flexibility in traffic steering.

Key concepts of SRv6 dual termination

  • MySID: A segment identifier (SID) that an SRv6 node is configured to own and process itself. In a dual-termination scenario, the egress PE identifies two consecutive SIDs in the packet header as its own.

  • Ingress-driven Flex-Algo TE: A traffic engineering approach where the ingress router explicitly selects the network path (Flex-Algo) for a service. This allows different Ingress PEs to reach the same egress PE using different paths providing functional parity with SR-MPLS.

  • Egress-driven Flex-Algo TE: A traffic engineering approach where the egress router advertises its service SIDs coupled with a Flex-Algo locator, and ingress routers simply forward traffic based on this advertised information.

  • VPN SID: A SID used to identify and steer traffic for specific VPN services (for example, L3VPNv4, L3VPNv6).

  • Flex-Algo SID (FA SID): A SID specifically associated with a Flex-Algo path, used to steer traffic along that path.

  • Dual MySID termination: The core of the feature, where an egress PE processes and terminates two distinct SIDs it owns (e.g., an FA SID and a VPN SID) sequentially, rather than just one. This typically involves a "2-pass recycle" mechanism in the datapath.

  • L3VPN DT4, DT6, and DT46: Specific types of Layer 3 VPN services (DT4 for IPv4, DT6 for IPv6, DT46 for IPv4-in-IPv6) that are the initial target for this dual SID termination feature.

Benefits of SRv6 dual termination

The SRv6 dual termination feature offers several key benefits, primarily by extending the traffic engineering capabilities of SRv6 networks:

  • Enables ingress-driven Flex-Algo steering in SRv6: This feature allows ingress PE routers to explicitly select and dictate the Flex-Algo path for traffic, rather than relying solely on egress-driven advertisements.

  • Provides necessary datapath support: It introduces the required datapath capabilities for egress PEs to process and terminate multiple segment IDs (MySIDs) sequentially, overcoming the previous limitation of single-SID termination at the egress.

  • Achieves functional parity with SR-MPLS: The feature brings SRv6's ingress-driven traffic engineering capabilities in line with those traditionally available in segment routing over MPLS, which is vital for customers transitioning between these technologies.

  • Facilitates seamless migrations: By mirroring SR-MPLS ingress-driven behaviors, it enables a smoother and more consistent migration path for customers moving their services from SR-MPLS to SRv6.

  • Offers greater flexibility and control: Network operators gain enhanced flexibility in defining and implementing traffic paths for L3VPN services, allowing for more granular and optimized traffic engineering based on specific network requirements.

Restrictions for SRv6 dual termination

  • Supports L3VPNv4 and L3VPNv6 services, including per-VRF uDT4, uDT6, and uDT46. This support is limited to the uSID F3216 format.

  • Do not use SRv6 segment identifier (SID) OAM, such as ping and traceroute, for VPN SIDs when SRv6 dual termination is enabled. Packets recycle within the NPU until the time-to-live (TTL) expires. Configure Access Control List (ACL) to drop these packets.

How SRv6 dual SID termination works

This process describes how the Egress PE datapath performs dual SID termination to enable Ingress PEs to implement ingress-driven Flex-Algo Traffic Engineering (TE) in SRv6 networks.

Summary

The SRv6 dual termination process involves ingress PEs and egress PEs to enable advanced ingress-driven Flex-Algo traffic engineering for SRv6 services. This is achieved through a sequence where ingress PEs push both a Flex-Algo SID and a VPN SID onto packets, and the Egress PE's datapath then performs a two-pass termination of these SIDs, ultimately providing SRv6 with functional parity to SR-MPLS for flexible and granular traffic steering.

The key components involved in this process are:

  • Ingress PE: the router that selects the Flex-Algo path and pushes the required SIDs onto the packet.

  • Egress PE: the router that receives the packet and terminates the SIDs in two passes.

Workflow

These stages describe how SRv6 dual SID termination works.

  1. The ingress PE explicitly selects a Flex-Algo path and pushes an FA SID (transport) followed by a VPN SID (service) onto the packet.

  2. The egress PE receives the packet and performs a lookup of the FA SID in its MySID table. It terminates the FA SID and, because the feature is enabled, identifies that the packet requires a recycle.

  3. The packet is recycled through the datapath. The egress PE then performs a lookup of the VPN SID, terminates (decapsulates) it, and forwards the inner IP payload to the correct VRF.

Enable SRv6 dual termination

Enable SRv6 dual termination so an egress PE router can process two sequential segment IDs (MySIDs). This supports ingress-driven Flex-Algo Traffic Engineering for SRv6 services.

Procedure

  1. Configure the SRv6 settings for the required segment ID format and enable dual SID termination.

    Example:

    Router(config)# segment-routing
Router(config-sr)# srv6
Router(config-sr-srv6)# formats
Router(config-sr-srv6-formats)# format usid-f3216
Router(config-sr-srv6-formats-format)# endpoint allow-dual-sid combination overlay-preceded-by-node
Router(config-sr-srv6-formats-format)# exit
Router(config-sr-srv6-formats)# exit
Router(config-sr-srv6)# exit
Router(config-sr)# exit

  2. Verify that SRv6 Dual SID Termination is enabled.

    Example:

    Router#show segment-routing srv6 manager 
Parameters:
  SRv6 Enabled: Yes
  SRv6 Operational Mode: None
  Encapsulation:
    Source Address:
      Configured: ::
      Default: 22::22
    Hop-Limit: Default 
    Traffic-class: Default 
  SID Formats:
    f3216 <32B/16NFA> (2)
      uSID LIB Range:
        LIB Start   : 0xe000
        ELIB Start  : 0xfe00
      uSID WLIB Range:
        EWLIB Start : 0xfff7
      Endpoint Dual-SID Termination Enabled:
        Combinations: overlay-preceded-by-node
Summary:
  Number of Locators: 0 (0 operational)
  Number of SIDs: 0 (0 stale)
  Max SID resources: 28000