Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

BVI support for L3VPN over SRv6

Updated: September 8, 2026

Want to summarize with AI?

Log in

Explains the SRv6 L3VPN Edge BVI support is a core SRv6 network capability that.

The SRv6 L3VPN Edge BVI support is a core SRv6 network capability that

  • enhances network adaptability by seamlessly integrating BVI interfaces into SRv6 L3VPN networks, and

  • supports bridged customer networks and simplifies network design.

Table 1. Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Extend support for BVI in L3VPN over SRv6

Release 26.2.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature support is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

  • 8011-4G24Y4H-I

BVI support for L3VPN over SRv6

 Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100]); Centralized Systems (8400 [ASIC: K100])

The feature introduces support for Bridge Group Virtual Interfaces (BVIs) in Layer 3 VPN (L3VPN) services over Segment Routing over IPv6 (SRv6). This enhancement enables seamless integration of bridge-based access networks with SRv6 transport in the provider core. It does not require changes to existing access architectures.

BVI integration for L3VPN services over an SRv6 core

BVI support for L3VPN over SRv6 refers to the ability to use Bridge Group Virtual Interfaces (BVIs) in Layer 3 VPN services running over a Segment Routing IPv6 core. The capability allows you to extend L3VPN services across SRv6 networks without altering existing architecture, preserving current designs while adopting modern SRv6-based transport.

The feature allows you to extend VPN connectivity through BVIs without changing your existing access architecture. You can send and receive VPN traffic through BVI interfaces without changing your existing network setup. At the ingress, the PE router adds an IPv6 header with segment information to guide the traffic through the SRv6 core. At the egress, the PE router removes the SRv6 header and forwards the original packet. The packet can also pass through a BVI interface. This allows you to retain the existing access design while using an SRv6 core to scale your network.

Benefits of BVI support for L3VPN over SRv6

BVI support for L3VPN over SRv6 offers these benefits:

  • Design flexibility and seamless integration: enables BVI-based access connectivity in SRv6 L3VPN deployments.

  • Operational simplicity: avoids redesign of bridged access networks, reducing service activation time.

  • SRv6 enablement: removes key deployment blockers for broader SRv6 adoption in VPN services.

Supported and unsupported BVI use cases for L3VPN over SRv6

BVI for L3VPN over SRv6 supports the listed use cases:

  • Endpoint functions such as End.DT4 and End.DT6

  • T.Encap reduced function for IPv4 or IPv6 VRF packets.

BVI for L3VPN over SRv6 does not support the listed use cases:

  • SRv6 endpoint behaviors such as End.DX4, End.DX6, and End.DT46.

  • Netflow with SRv6 core.

  • Pseudowire Headend.

  • EVPN SRv6 access pseudowire.

  • Access Control List-Based Forwarding (ABF) next hop over SRv6.

  • Generic Routing Encapsulation (GRE) transport.

  • The remote PE does not import the route that VRF-A advertises with SID-A into VRF-B, limiting VRF-B from using that route.

BVI connectivity in SRv6 networks

The network diagram shows a scenario where CE devices such as CE1, CE2, and CEn connect to a PE router, PE1. These CE devices use IP addresses from the 10.0.0.0/24 subnet:

  • CE1: 10.0.0.1/24

  • CE2: 10.0.0.2/24

  • CEn: 10.0.0.3/24

Figure 1. BVI use case for L3VPN over SRv6 core
BVI use case for L3VPN over SRv6 core

PE1 connects CE devices using BVI1 with IP address 10.0.0.251/24. All CE devices use IP addresses from the same subnet (10.0.0.0/24), ensuring they stay on a common Layer 2 segment. PE1 maps BVI1 to bridge domain 1 (BD1), which allows it to bridge traffic at Layer 2 and route it at Layer 3 using the same subnet. This setup keeps IP planning simple and avoids the need for separate subnets for each CE.

PE1 receives the traffic on the BVI and sends it into the provider core. The core supports both MPLS and SRv6, allowing PE1 to encapsulate the packet with SRv6 headers and forward it to PE2. PE2 removes the SRv6 headers and sends the original IP packet to the destination CE.

This setup displays how BVI allows you to use a shared subnet for all CE devices while supporting L3VPN services over an SRv6 network.

How SRv6 handles packet flow with BVI in L3VPN services

Summary

The packet flow example demonstrates how traffic is encapsulated and transported across the SRv6-core using BVI interfaces at the ingress and egress PE routers.

Workflow

These stages describe the step-by-step packet flow through an SRv6 core network using BVI interfaces in an L3VPN scenario:

  1. Traffic entry at ingress PE: Traffic originates from CE3 (11.0.0.1) and is destined for CE2 (10.0.0.2). PE3, the ingress PE router, receives the packet through a BVI. This marks the entry of the packet into the SRv6-enabled provider network.
    Figure 2. Packet flow with BVI in L3VPN through SRv6 core
    Packet flow with BVI in L3VPN through SRv6 core
  2. SRv6 encapsulation at ingress PE: PE3 identifies the corresponding VPN route and encapsulates the packet with an IPv6 header. It sets the source IP to 3::3 and the destination IP to fccc:bb00:1:e000:: (uDT4 SID advertised by PE1). Optionally, PE3 includes a Segment Routing Header (SRH) that contains a list of SIDs to define the explicit path through the SRv6 domain.
  3. Transmission through SRv6 core: PE3 forwards the SRv6-encapsulated packet into the SRv6 core. Each transit router reads the active SID in the SRH and forwards the packet to the next segment. This steers the packet through the programmed path toward the destination.
  4. SRv6 decapsulation at egress PE: When the encapsulated packet arrives, PE1 removes the SRv6 header, exposes the original IP packet, and performs a further lookup in the corresponding VRF table for next hop forwarding.
  5. MPLS label imposition and forwarding: MPLS cloud between PE1 and PE2 is a pseudowire. PE1 attaches an appropriate MPLS label to the packet, and then forwards the MPLS-labeled packet toward PE2.

    Based on the destination, the packet takes one of two paths:

    • Case 1 – MPLS Layer 2 destination: If the destination is reachable through an MPLS Layer 2 network, PE1 imposes the appropriate MPLS label and forwards the packet over the MPLS pseudowire.

    • Case 2 – Local AC destination: If the destination is connected through a local Attachment Circuit (AC), PE1 forwards the packet directly through the AC interface without adding any label.

  6. Packet delivery to destination CE2: PE2 receives the MPLS-encapsulated packet, removes the MPLS label, and forwards the original packet to CE2 (10.0.0.2) through the forwarding interface.