EVPN ELAN services over SRv6 TE policies | SRv6-Based Layer 2 and Integrated VPN Services | Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Explains how colored EVPN route types select explicit SRv6-TE policies for unicast and BUM traffic between PEs in a multipoint Layer 2 service.

A EVPN ELAN service is a multipoint Layer 2 VPN service that

uses colored routes to select explicit Segment Routing over IPv6 (SRv6) Traffic Engineering (TE) paths
connects Provider Edge (PE) routers, and
supports both unicast and broadcast, unknown-unicast, and multicast (BUM) traffic.

An EVPN ELAN service over an SRv6 TE policy is a multipoint Layer 2 service that uses colored routes to select explicit SRv6 paths. These paths connect PE routers.

EVPN Ethernet Auto-Discovery route type 1: Advertises multihoming reachability.
Inclusive Multicast Ethernet Tag route type 3: Supports BUM forwarding.
Segment Routing color extended communities: Steer both route types to matching SRv6 TE policies.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
EVPN ELAN Services over SRv6 TE Policies	Release 26.3.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: P100]) You can now maintain consistent path selection and efficient traffic delivery across your IPv6 networks. This is achieved by deploying a multipoint Layer 2 VPN service that uses colored routes to select specific SRv6 Traffic Engineering (TE) paths between your Provider Edge (PE) routers. You will use Route Type 1 (Ethernet Auto-Discovery) to advertise multihoming reachability and Route Type 3 (Inclusive Multicast Ethernet Tag) to support the forwarding of broadcast, unknown-unicast, and multicast (BUM) traffic. By applying an export route policy that adds a Segment Routing color extended community, you can steer both route types to matching SRv6 TE policies.

Required components

These components support the service.


Component	Purpose
SRv6 locators	Provide segment identifier space for forwarding and dynamic binding SIDs.
Route policy and color extended community	Attach an SR color to exported EVPN routes.
SRv6 TE policy	Matches a color and endpoint and selects an explicit segment list.
EVPN EVI	Applies the export route policy to the Ethernet VPN instance.
IS-IS and BGP	Advertise SRv6 reachability and EVPN routes.
Path Computation Element	Optionally provides initiated or delegated SRv6 TE policies.

SRv6 TE and standard EVI behavior

An SRv6 TE EVI applies a BGP export route policy that adds the color community.
A standard locator-based EVI assigns a locator directly.
The receiving PE uses the route color and remote endpoint to find the matching SRv6 TE policy.

How EVPN ELAN routes select SRv6 TE paths

The selection process functions the same way with any consistently configured color. EVPN route type 1 provides Ethernet Auto-Discovery information for multihoming, while route type 3 supplies Inclusive Multicast Ethernet Tag details for BUM traffic.

Summary

The path-selection process uses several features to steer EVPN ELAN traffic over SRv6 TE paths, ensuring that network traffic utilizes traffic-engineered paths instead of standard locator-based routes.

The key components involved in the process are:

Export route policy: Adds the Segment Routing color extended community to EVPN routes, tagging them for traffic engineering.
EVPN EVI: Applies the export route policy when advertising service routes, enabling consistent signaling.
SRv6 TE policy: Matches the route color and BGP next-hop endpoint.
Binding SID and segment list: Encapsulate traffic and define the explicit path through provider nodes.

Route type 1 provides Ethernet Auto-Discovery information for multihoming, and route type 3 provides Inclusive Multicast Ethernet Tag information for BUM (Broadcast, Unknown unicast, and Multicast) traffic. BUM traffic.

Workflow

These stages describe how EVPN ELAN routes select SRv6 TE paths.

The originating PE applies the EVI export route policy, adding the configured color extended community to route type 1 and route type 3 advertisements.
BGP distributes the colored EVPN routes to remote PEs. Each receiving PE uses the route color and BGP next-hop as the SRv6 TE policy lookup key.
The matching SRv6 TE policy selects its preferred candidate path and explicit micro-segment list. A dynamic binding SID from the traffic-engineering locator represents the selected policy in the forwarding table.
The ingress PE encapsulates matching EVPN traffic using the selected SRv6 TE policy. The segment list directs traffic through designated provider nodes to the remote PE.

Result

Unicast and BUM traffic for the colored EVPN ELAN service follows the selected SRv6 TE path rather than the standard locator-based path, allowing for more granular and efficient traffic engineering.

Configure SRv6 transport for EVPN ELAN traffic engineering

Build the SRv6 underlay and traffic-engineering policies before attaching an EVPN ELAN service.

These steps configure a PE with color 20 and creates both single-hop and multihop segment lists and policies.

Before you begin

Assign IPv4 and IPv6 loopback addresses to the provider edge and provider routers.
Confirm the dynamic binding SID behavior supported on each target router.
Plan unique SRv6 locator prefixes and explicit paths through the provider network.

Procedure

Define the segment routing color extended community and the export route policy on each PE.

Example:


Router# configure terminal
Router(config)# extcommunity-set opaque 20
Router(config-ext)# 20 co-flag 01
Router(config-ext)# end-set
Router(config)# route-policy set-xc-color
Router(config-rpl)# set extcommunity color 20
Router(config-rpl)# end-policy
Router(config)# commit

Configure the SRv6 encapsulation source and locators on each PE.

Example:


Router# configure terminal
Router(config)# segment-routing srv6
Router(config-srv6)# encapsulation
Router(config-srv6)# source-address 11::11
Router(config-srv6)# traffic-class propagate
Router(config-srv6)# locators
Router(config-srv6-locators)# locator te
Router(config-srv6-locator)# micro-segment behavior unode psp-usd
Router(config-srv6-locator)# prefix 2001:DB8:20::/48
Router(config-srv6-locator)# exit
Router(config-srv6-locators)# locator locator0
Router(config-srv6-locator)# micro-segment behavior unode psp-usd
Router(config-srv6-locator)# prefix 2001:DB8:120::/48
Router(config-srv6-locator)# exit
Router(config-srv6-locators)# locator locator1
Router(config-srv6-locator)# micro-segment behavior unode psp-usd
Router(config-srv6-locator)# prefix 2001:DB8:220::/48
Router(config-srv6-locator)# exit
Router(config-srv6-locators)# locator locator2
Router(config-srv6-locator)# micro-segment behavior unode psp-usd
Router(config-srv6-locator)# prefix 2001:DB8:320::/48
Router(config-srv6-locator)# commit

Enable SRv6 locator advertisement and fast reroute in IS-IS.

Example:

Router# configure terminal
Router(config)# router isis 100
Router(config-isis)# net 49.0100.0000.0000.0001.00
Router(config-isis)# nsr
Router(config-isis)# nsf ietf
Router(config-isis)# log adjacency changes
Router(config-isis)# address-family ipv6 unicast
Router(config-isis-af)# metric-style wide
Router(config-isis-af)# microloop avoidance segment-routing maximum-paths 63
Router(config-isis-af)# router-id 11::11
Router(config-isis-af)# segment-routing srv6
Router(config-isis-srv6)# locator locator0
Router(config-isis-srv6-loc)# exit
Router(config-isis-srv6)# locator locator1
Router(config-isis-srv6-loc)# exit
Router(config-isis-srv6)# locator locator2
Router(config-isis-srv6-loc)# exit
Router(config-isis-srv6)# locator te
Router(config-isis-srv6-loc)# exit
Router(config-isis-srv6)# exit
Router(config-isis-af)# exit
Router(config-isis)# interface Bundle-Ether1201
Router(config-isis-if)# point-to-point
Router(config-isis-if)# retransmit-interval 2
Router(config-isis-if)# address-family ipv6 unicast
Router(config-isis-if-af)# fast-reroute per-prefix
Router(config-isis-if-af)# fast-reroute per-prefix tiebreaker node-protecting index 100
Router(config-isis-if-af)# fast-reroute per-prefix ti-lfa
Router(config-isis-if-af)# metric 100
Router(config-isis-if-af)# exit
Router(config-isis-if)# exit
Router(config-isis)# interface Loopback0
Router(config-isis-if)# passive
Router(config-isis-if)# address-family ipv6 unicast
Router(config-isis-if-af)# commit

Configure BGP to advertise IPv4, IPv6, and L2VPN EVPN reachability.

Example:

Router# configure terminal
Router(config)# router bgp 100
Router(config-bgp)# nsr
Router(config-bgp)# bgp router-id 11.11.11.11
Router(config-bgp)# bgp graceful-restart
Router(config-bgp)# segment-routing srv6
Router(config-bgp-srv6)# locator locator0
Router(config-bgp-srv6)# exit
Router(config-bgp)# address-family ipv4 unicast
Router(config-bgp-af)# nexthop trigger-delay critical 0
Router(config-bgp-af)# exit
Router(config-bgp)# address-family ipv6 unicast
Router(config-bgp-af)# nexthop trigger-delay critical 0
Router(config-bgp-af)# exit
Router(config-bgp)# address-family l2vpn evpn
Router(config-bgp-af)# nexthop trigger-delay critical 0
Router(config-bgp-af)# exit
Router(config-bgp)# neighbor 33::33
Router(config-bgp-nbr)# remote-as 100
Router(config-bgp-nbr)# update-source Loopback0
Router(config-bgp-nbr)# address-family l2vpn evpn
Router(config-bgp-nbr-af)# exit
Router(config-bgp-nbr)# address-family ipv6 unicast
Router(config-bgp-nbr-af)# commit

Configure explicit micro-segment lists and the SRv6 TE policies on the service head-end PE.

Example:


Router# configure terminal
Router(config)# segment-routing
Router(config-sr)# traffic-eng

Router(config-sr-te)# candidate-paths
Router(config-sr-te-candidate-path)# all
Router(config-sr-te-candidate-path-type)# source-address ipv6 11::11
Router(config-sr-te-candidate-path-type)# exit
Router(config-sr-te-candidate-path)# exit

Router(config-sr-te)# segment-lists
Router(config-sr-te-segment-lists)# srv6
Router(config-sr-te-sl-global-srv6)# sid-format usid-f3216
Router(config-sr-te-sl-global-srv6)# exit

Router(config-sr-te-segment-lists)# segment-list explicit-list1
Router(config-sr-te-sl)# srv6
Router(config-sr-te-sl-srv6)# index 1 sid 2001:DB8:40::
Router(config-sr-te-sl-srv6)# exit
Router(config-sr-te-sl)# exit

Router(config-sr-te-segment-lists)# segment-list explicit-list2
Router(config-sr-te-sl)# srv6
Router(config-sr-te-sl-srv6)# index 1 sid 2001:DB8:40::
Router(config-sr-te-sl-srv6)# index 2 sid 2001:DB8:50::
Router(config-sr-te-sl-srv6)# exit
Router(config-sr-te-sl)# exit
Router(config-sr-te-segment-lists)# exit

Router(config-sr-te)# policy srte_c_pe11_pe2
Router(config-sr-te-policy)# srv6
Router(config-sr-te-policy-srv6)# locator te binding-sid dynamic behavior ub6-encaps-reduced
Router(config-sr-te-policy-srv6)# exit
Router(config-sr-te-policy)# source-address ipv6 11::11
Router(config-sr-te-policy)# color 20 end-point ipv6 22::22
Router(config-sr-te-policy)# candidate-paths
Router(config-sr-te-policy-path)# preference 100
Router(config-sr-te-policy-path-pref)# explicit segment-list explicit-list1
Router(config-sr-te-pp-info)# exit
Router(config-sr-te-policy-path-pref)# exit
Router(config-sr-te-policy-path)# exit
Router(config-sr-te-policy)# exit

Router(config-sr-te)# policy srte_c_pe11_pe12
Router(config-sr-te-policy)# srv6
Router(config-sr-te-policy-srv6)# locator te binding-sid dynamic behavior ub6-encaps-reduced
Router(config-sr-te-policy-srv6)# exit
Router(config-sr-te-policy)# source-address ipv6 11::11
Router(config-sr-te-policy)# color 20 end-point ipv6 22::22
Router(config-sr-te-policy)# candidate-paths
Router(config-sr-te-policy-path)# preference 100
Router(config-sr-te-policy-path-pref)# explicit segment-list explicit-list1
Router(config-sr-te-pp-info)# exit
Router(config-sr-te-policy-path-pref)# exit
Router(config-sr-te-policy-path)# exit
Router(config-sr-te-policy)# exit

Router(config-sr-te)# commit

Use the binding SID behavior supported by your router. The source automation prefers ub6-encaps-reduced when available.

Configure the Path Computation Client on the PE and the Path Computation Element on the provider router.

Example:

Router# configure terminal
Router(config)# segment-routing
Router(config-sr)# traffic-eng
Router(config-sr-te)# pcc

Router(config-sr-te-pcc)# source-address ipv6 11::11
Router(config-sr-te-pcc)# pce address ipv6 33::33
Router(config-pcc-pce)# precedence 100
Router(config-pcc-pce)# exit

Router(config-sr-te-pcc)# exit
Router(config-sr-te)# exit
Router(config-sr)# exit

Router(config)# pce
Router(config-pce)# address ipv6 33::33
Router(config-pce)# state-sync ipv6 33::33
Router(config-pce)# commit

This configuration enables initiated or delegated policies from the PCE.

The provider network advertises the SRv6 locators, and the service head-end PEs have color-and-endpoint policies that use explicit micro-segment paths.

What to do next

Attach the EVPN ELAN service to the SRv6 TE transport.

Configure an EVPN ELAN service for SRv6 TE steering

Apply the export route policy to an EVPN EVI so that remote PEs steer matching service traffic over SRv6 TE policies.

The example uses EVI 2002, bridge domain bd2, and access interface Bundle-Ether1.2. Apply equivalent configuration on each PE participating in the EVPN service.

Before you begin

Configure SRv6 reachability and a locator for EVPN.
Configure an SRv6 TE policy whose color matches the export route policy.
Configure BGP L2VPN EVPN neighbors between the participating PEs.

Follow these steps to configure SRv6 TE steering for an EVPN ELAN service.

Procedure

Create the SRv6 EVPN EVI and apply the BGP export route policy.

Example:


Router# configure terminal
Router(config)# evpn
Router(config-evpn)# evi 2002 segment-routing srv6
Router(config-evpn-instance)# advertise-mac
Router(config-evpn-instance)# bgp
Router(config-evpn-evi-bgp)# route-policy export set-xc-color
Router(config-evpn-evi-bgp-rpl)# exit
Router(config-evpn-instance)# locator locator0
Router(config-evpn-instance)# commit

The EVI adds color 20 to exported EVPN routes through the set-xc-color policy.

Associate the EVI with the L2VPN bridge domain and attachment circuit.

Example:


Router# configure terminal
Router(config)# l2vpn
Router(config-l2vpn)# bridge group bg
Router(config-l2vpn-bg)# bridge-domain bd2
Router(config-l2vpn-bg-bd)# interface Bundle-Ether1.2
Router(config-l2vpn-bg-bd-ac)# exit
Router(config-l2vpn-bg-bd)# evi 2002 segment-routing srv6
Router(config-l2vpn-bg-bd-evi-srv6)# commit

Configure the Layer 2 transport encapsulation on the access interface.

Example:


Router# configure terminal
Router(config)# interface Bundle-Ether1.2 l2transport
Router(config-subif-l2)# encapsulation dot1q 2
Router(config-subif-l2)# commit

The EVPN ELAN service exports colored routes and uses the matching SRv6 TE policies to steer service traffic to remote PEs.

Configure a replacement segment list for an SRv6 TE policy

Move an EVPN ELAN service from a single-hop explicit path to a multihop explicit path.

The example replaces explicit-list1 with explicit-list2 for the SRv6 TE policy srte_c_pe11_pe2.

Before you begin

Configure both explicit segment lists.
Confirm that every segment in the replacement list is reachable.

Procedure

Remove the current explicit segment list and apply the replacement list under the same candidate-path preference.

Example:


Router# configure terminal
Router(config)# segment-routing traffic-eng
Router(config-sr-te)# policy srte_c_pell_pe2
Router(config-sr-te-policy)# candidate-paths
Router(config-sr-te-policy-path)# preference 100
Router(config-sr-te-policy-path-pref)# no explicit segment-list explicit-list1
Router(config-sr-te-policy-path-pref)# no explicit segment-list explicit-list2
Router(config-sr-te-policy-path-pref)# explicit segment-list replacement-list
Router(config-sr-te-pp-info)# commit

The SRv6 TE policy uses explicit-list2, directing EVPN ELAN traffic through the multihop path.

Verify EVPN ELAN services over SRv6 TE policies

Ensure that remote EVPN Inclusive Multicast Ethernet Tag (IMET) routes carrying the color extended community are resolved through the corresponding Segment Routing over IPv6 traffic engineering (SRv6-TE) policies.

Use this task to confirm that the Layer 2 Forwarding Information Base (L2FIB) programs resolved SRv6-TE Binding Segment Identifiers (BSIDs) instead of native next-hop addresses for the EVPN ELAN services.

Before you begin

Ensure that EVPN bridge domains and SRv6-TE policies are configured.
Identify the route distinguisher for the EVPN instance you want to verify.

Follow these steps to verify EVPN ELAN services over SRv6 TE policies:

Procedure

Display the EVPN IMET routes for the route distinguisher.

show bgp l2vpn evpn rd route_distinguisher route-type 3
Example:
```
Router# show bgp l2vpn evpn rd 44.44.44.44:1001 route-type 3

Route Distinguisher: 44.44.44.44:1001

*>i[3][0][32][11.11.11.11]/80
    11::11 C:70001
*>i[3][0][32][33.33.33.33]/80
    33::33 C:70001
*> [3][0][32][44.44.44.44]/80
    0.0.0.0
*>i[3][0][32][66.66.66.66]/80
    66::66 C:70001
```
Verify that each remote PE IMET route is present and carries the expected color extended community, such as C:70001. The locally originated IMET route can display 0.0.0.0 without the color extended community.

Display the inclusive multicast entries programmed in L2FIB for the EVPN bridge domains.

Example:

Router# show l2vpn forwarding bridge-domain evpn inclusive-multicast location 0/RP0/CPU0

## Bridge-Domain Name      BD-ID  XCID           TEP-id        Next Hop
bg1:elan-1001              0      0x80000001     0x05000001    SRv6TE BSID cafe:ff08:4:e0b8::
                                                 0x05000002    SRv6TE BSID cafe:ff08:4:e0c4::
                                                 0x05000003    SRv6TE BSID cafe:ff08:4:e0be::

bg1:elan-1002              1      0x80000002     0x05000001    SRv6TE BSID cafe:ff08:4:e0b9::
                                                 0x05000002    SRv6TE BSID cafe:ff08:4:e0c5::
                                                 0x05000003    SRv6TE BSID cafe:ff08:4:e0bf::

Verify that these conditions are met:

Each remote PE has an inclusive multicast entry.
The Next Hop column displays an SRv6TE BSID entry instead of a native next-hop address.
Each entry contains the BSID of the SRv6-TE policy that corresponds to the color of the remote PE IMET route.

Successful verification confirms that EVPN ELAN services are properly resolved through SRv6 TE policies, and L2FIB is programmed with SRv6-TE BSIDs instead of native next-hop addresses.