Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

IPv4 L3VPN over SRv6

Updated: September 8, 2026

Want to summarize with AI?

Log in

Explains the SRv6-based IPv4 L3VPN feature enables deployment of IPv4 L3VPN over a SRv6 data plane. Traditionally, it was done over an MPLS-based system. SRv6-based L3VPN uses SRv6 Segment IDs (SIDs) for service segments instead of labels. SRv6-based L3VPN.

An IPv4 L3VPN over SRv6 is a network virtualization mechanism that

  • enables service providers to deliver IPv4 Layer 3 VPNs using SRv6 as the data plane,

  • replaces traditional MPLS labels with SRv6 Segment IDs (SIDs) for service segmentation, and

  • allows flexible and scalable deployment of secure, private networks over public infrastructure.

Table 1. Table 1. Feature History Table

Feature Name

Release Information

Feature Description

IPv4 L3VPN over SRv6

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

IPv4 L3VPN over SRv6

 Release 25.1.1

Introduced in this release on: Fixed Systems ( 8010 [ASIC: A100])

This feature is now supported on the Cisco 8011-4G24Y4H-I routers.

IPv4 L3VPN over SRv6

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

You can deploy IPv4 L3VPN over an SRv6 data plane with the SRv6-based IPv4 L3VPN feature. This feature uses SRv6 Segment IDs (SIDs) for service segments. It allows for the interconnection of multiple sites, creating a private network service over public infrastructure.

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 8712-MOD-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

The SRv6-based IPv4 L3VPN feature enables deployment of IPv4 L3VPN over a SRv6 data plane. Traditionally, it was done over an MPLS-based system. SRv6-based L3VPN uses SRv6 Segment IDs (SIDs) for service segments instead of labels. SRv6-based L3VPN functionality interconnects multiple sites to resemble a private network service over public infrastructure. To use this feature, you must configure SRv6-base.

For this feature, BGP allocates an SRv6 SID from the locator space, configured under SRv6-base and VPNv4 address family. For more information on this, refer to SRv6 over IPv6 overview. The BGP SID can be allocated in the following ways:

  • Per-VRF mode that provides End.DT4 support. End.DT4 represents the Endpoint with decapsulation and IPv4 table lookup.

BGP encodes the SRv6 SID in the prefix-SID attribute of the IPv4 L3VPN Network Layer Reachability Information (NLRI) and advertises it to IPv6 peering over an SRv6 network. The Ingress PE (provider edge) router encapsulates the VRF IPv4 traffic with the SRv6 VPN SID and sends it over the SRv6 network.

IPv4 L3VPN guidelines and restrictions

Supported features:

  • Only IPv4 L3VPN is supported.

  • Equal-Cost Multi-Path (ECMP) and Unequal Cost MultiPath (UCMP) are supported.

  • BGP, OSPF, and Static routes are supported as PE-CE protocols.

Limitation and restrictions:

  • MPLS-based L3VPN interoperability is not supported on a router that is configured for SRv6-based L3VPN.

  • IPv6 L3VPN is not supported.

Configure an IPv4 L3VPN over SRv6

Configure an IPv4 L3VPN using SRv6 on Cisco IOS XR devices.

SRv6 enables scalable VPN deployments with flexible BGP-based configurations. This task provides step-by-step instructions for configuring an IPv4 L3VPN over SRv6, including locator, VRF setup, label allocation, and verification.

Before you begin

  • Ensure SRv6 is supported and enabled on your routers.

  • Know your BGP AS numbers, router IDs, and desired locator names.

  • Have at least two VRFs to use as L3VPN instances.

Follow these steps to configure an IPv4 L3VPN over SRv6:

Procedure

  1. Configure an IPv4 L3VPN over SRv6.

    Example:

    /*Configure SRv6 locator name under BGP Global*/ 
RP/0/0/CPU0:Router(config)# router bgp 100
RP/0/0/CPU0:Router(config-bgp)# bgp router-id 10.6.6.6
RP/0/0/CPU0:Router(config-bgp)# segment-routing srv6
RP/0/0/CPU0:Router(config-bgp-srv6)# locator my-locator
RP/0/0/CPU0:Router(config-bgp-srv6)# exit

  2. Configure SRv6 locator under VRF All under VPNv4 AFI.

    Example:

    /*Configure SRv6 locator under VRF All under VPNv4 AFI*/ 
RP/0/0/CPU0:Router(config)# router bgp 100
RP/0/0/CPU0:Router(config-bgp)# bgp router-id 10.6.6.6
RP/0/0/CPU0:Router(config-bgp)# address-family vpnv4 unicast 
RP/0/0/CPU0:Router(config-bgp-af)# verf all
RP/0/0/CPU0:Router(config-bgp-af-vrfall)# segment-routing srv6
RP/0/0/CPU0:Router(config-bgp-af-vrfall-srv6)# locator my-locator
RP/0/0/CPU0:Router(config-bgp-af-vrfall-srv6)# exit

  3. Configure a VRF with per-vrf label allocation mode.

    Example:

    /*Configure a VRF with per-vrf label allocation mode*/
  RP/0/0/CPU0:Router(config-bgp-af)# vrf vrf1 
  RP/0/0/CPU0:Router(config-bgp-vrf)# rd 106:1 
  RP/0/0/CPU0:Router(config-bgp-vrf)# address-family ipv4 unicast 
  RP/0/0/CPU0:Router(config-bgp-vrf-af)# segment-routing srv6 
  RP/0/0/CPU0:Router(config-bgp-vrf-af-srv6)# alloc mode per-vrf 
  RP/0/0/CPU0:Router(config-bgp-vrf-af-srv6)# exit 
  RP/0/0/CPU0:Router(config-bgp-vrf-af)# exit 
  RP/0/0/CPU0:Router(config-bgp-vrf)# neighbor 10.1.2.2 
  RP/0/0/CPU0:Router(config-bgp-vrf-nbr)# remote-as 100 
  RP/0/0/CPU0:Router(config-bgp-vrf-nbr)# address-family ipv4 unicast

  4. Configure a VRF with per-ce label allocation mode.

    Example:

    /*Configure a VRF with per-ce label allocation mode*/
  RP/0/0/CPU0:Router(config-bgp-af)# vrf vrf2 
  RP/0/0/CPU0:Router(config-bgp-vrf)# rd 106:2 
  RP/0/0/CPU0:Router(config-bgp-vrf)# address-family ipv4 unicast 
  RP/0/0/CPU0:Router(config-bgp-vrf-af)# segment-routing srv6 
  RP/0/0/CPU0:Router(config-bgp-vrf-af-srv6)# alloc mode per-ce 
  RP/0/0/CPU0:Router(config-bgp-vrf-af-srv6)# exit 
  RP/0/0/CPU0:Router(config-bgp-vrf-af)# exit 
  RP/0/0/CPU0:Router(config-bgp-vrf)# neighbor 10.1.2.2 
  RP/0/0/CPU0:Router(config-bgp-vrf-nbr)# remote-as 100 
  RP/0/0/CPU0:Router(config-bgp-vrf-nbr)# address-family ipv4 unicast

The IPv4 L3VPN over SRv6 is successfully configured on your device.

What to do next

Verify the segment routing and VPN functionalities using the CLI commands. For more information, see Verify an IPv4 L3VPN over SRv6.

Verify an IPv4 L3VPN over SRv6

Ensure that an IPv4 L3VPN instance is correctly established and forwarding traffic over an SRv6 dataplane.

Use these verification steps after configuring an IPv4 L3VPN with SRv6 to confirm that segment routing information, BGP VPN routing, forwarding, and next-hop assignments are correct.

Before you begin

Complete all mandatory configuration steps for IPv4 L3VPN over SRv6 on source and destination routers.

Follow these steps to verify IPv4 L3VPN over SRv6:

Procedure

  1. Verify the SRv6 based L3VPN configuration using the show segment-routing srv6 sid command.

    Example:

    RP/0/0/CPU0:Router# show segment-routing srv6 sid  
*** Locator: 'my_locator' *** 
SID                         Function     Context                           Owner               State  RW
--------------------------  -----------  ------------------------------    ------------------  -----  --
cafe:0:0:66:1::             End (PSP)    'my_locator':1                    sidmgr              InUse  Y 
cafe:0:0:66:40::            End.X (PSP)  [Te0/0/0/2, Link-Local]           isis-srv6           InUse  Y 
cafe:0:0:66:41::            End.X (PSP)  [BE6801, Link-Local]              isis-srv6           InUse  Y 
cafe:0:0:66:42::            End.X (PSP)  [BE5601, Link-Local]              isis-srv6           InUse  Y 
cafe:0:0:66:43::            End.X (PSP)  [BE5602, Link-Local]              isis-srv6           InUse  Y 
cafe:0:0:66:44::            End.DT4      'VRF1'                            bgp-100             InUse  Y 
cafe:0:0:66:45::            End.DT4      'VRF2'                            bgp-100             InUse  Y

  2. Verify the SRv6 based L3VPN configuration using the show segment-routing srv6 SID-prefix detail command.

    Example:

    RP/0/RP0/CPU0:Router#sh segment-routing srv6 sid cafe:0:0:66:43:: detail 
Sun Dec  9 16:52:54.015 EST
*** Locator: ‘my_locator' *** 
SID                         Function     Context                           Owner               State  RW
--------------------------  -----------  ------------------------------    ------------------  -----  --
cafe:0:0:66:44::            End.DT4      'VRF1'                            bgp-100             InUse  Y 
  SID context: { table-id=0xe0000001 ('VRF1':IPv4/Unicast) }
  Locator: ‘my_locator'
  Allocation type: Dynamic
  Created: Dec  8 16:34:32.506 (1d00h ago)
RP/0/RP0/CPU0:SRv6-HUB6#sh segment-routing srv6 sid cafe:0:0:66:47:: detail 
Sun Dec  9 16:54:26.073 EST
*** Locator: 'my_locator' ***

  3. Verify the SRv6 based L3VPN configuration using the show bgp vpnv4 un rd route-distinguisher prefix command on Egress PE.

    Example:

    RP/0/RP0/CPU0:SRv6-Hub6#sh bgp vpnv4 un rd 106:1 10.15.0.0/30 
Wed Nov 21 16:08:44.765 EST
BGP routing table entry for 10.15.0.0/30, Route Distinguisher: 106:1
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker            2282449     2282449
    SRv6-VPN SID: cafe:0:0:66:44::/128
Last Modified: Nov 21 15:50:34.235 for 00:18:10
Paths: (2 available, best #1)
  Advertised to peers (in unique update groups):
    2::2                                    
  Path #1: Received by speaker 0
  Advertised to peers (in unique update groups):
    2::2                                    
  200
    10.1.2.2 from 10.1.2.2  (10.7.0.1)
      Origin IGP, localpref 200, valid, internal, best, group-best, import-candidate
      Received Path ID 0, Local Path ID 1, version 2276228
      Extended community: RT:201:1 
  Path #2: Received by speaker 0
  Not advertised to any peer
  200
    10.2.2.2 from 10.2.2.2 (10.20.1.2)
      Origin IGP, localpref 100, valid, internal
      Received Path ID 0, Local Path ID 0, version 0
      Extended community: RT:201:1

  4. Verify the SRv6 based L3VPN configuration using the show bgp vpnv4 un rd route-distinguisher prefix command on Ingress PE.

    Example:

    RP/0/RP0/CPU0:SRv6-LF1#sh bgp vpnv4 un rd 106:1 10.15.0.0/30 
Wed Nov 21 16:11:45.538 EST
BGP routing table entry for 10.15.0.0/30, Route Distinguisher: 106:1
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker            2286222     2286222
Last Modified: Nov 21 15:47:26.288 for 00:24:19
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  200, (received & used)
    6::6 (metric 24) from 2::2 (6.6.6.6)
      Received Label 3 
      Origin IGP, localpref 200, valid, internal, best, group-best, import-candidate, not-in-vrf
      Received Path ID 1, Local Path ID 1, version 2286222
      Extended community: RT:201:1 
      Originator: 6.6.6.6, Cluster list: 2.2.2.2
      SRv6-VPN-SID: T1-cafe:0:0:66:44:: [total 1]

  5. Verify the SRv6 based L3VPN configuration using the show route vrf vrf-name prefix detail command.

    Example:

    RP/0/RP0/CPU0:Router#sh route vrf VRF1 10.15.0.0/30detail 
Wed Nov 21 16:35:17.775 EST
Routing entry for 10.15.0.0/30
  Known via "bgp 100", distance 200, metric 0
  Tag 200, type internal
  Installed Nov 21 16:35:14.107 for 00:00:03
  Routing Descriptor Blocks
    6::6, from 2::2
      Nexthop in Vrf: "default", Table: "default", IPv6 Unicast, Table Id: 0xe0800000
      Route metric is 0
      Label: None
      Tunnel ID: None
      Binding Label: None
      Extended communities count: 0
      Source RD attributes: 0x0000:106:1
      NHID:0x0(Ref:0)
      SRv6 Headend: H.Encaps.Red [base]
      SRv6 SID-list { cafe:0:0:66:44:: }
      MPLS eid:0x1380600000001
  Route version is 0xd (13)
  No local label
  IP Precedence: Not Set
  QoS Group ID: Not Set
  Flow-tag: Not Set
  Fwd-class: Not Set
  Route Priority: RIB_PRIORITY_RECURSIVE (12) SVD Type RIB_SVD_TYPE_REMOTE
  Download Priority 3, Download Version 3038384
  No advertising protos.

  6. Verify the SRv6 based L3VPN configuration for per-ce allocation mode using the show bgp vrf vrf nexthop-set command.

    Example:

    RP/0/RP0/CPU0:Router#show bgp vrf VRF2 nexthop-set 
Wed Nov 21 15:52:17.464 EST
 Resilient per-CE nexthop set, ID 3 
 Number of nexthops 1, Label 0, Flags 0x2200 
 SRv6-VPN SID: cafe:0:0:66:46::/128
 Nexthops:
10.1.2.2
 Reference count 1,
 Resilient per-CE nexthop set, ID 4 
 Number of nexthops 2, Label 0, Flags 0x2100 
 SRv6-VPN SID: cafe:0:0:66:47::/128
 Nexthops:
 10.1.2.2
 10.2.2.2
Reference count 2,

  7. Verify the SRv6 based L3VPN configuration using the show cef vrf vrf-name prefix detail location line-card command.

    Example:

    RP/0/RP0/CPU0:Router#sh cef vrf VRF1 10.15.0.0/30 detail location 0/0/cpu0
Wed Nov 21 16:37:06.894 EST
151.1.0.0/30, version 3038384, SRv6 Transit, internal 0x5000001 0x0 (ptr 0x9ae6474c) [1], 0x0 (0x0), 0x0 (0x8c11b238)
 Updated Nov 21 16:35:14.109
 Prefix Len 30, traffic index 0, precedence n/a, priority 3
  gateway array (0x8cd85190) reference count 1014, flags 0x2010, source rib (7), 0 backups
                [1 type 3 flags 0x40441 (0x8a529798) ext 0x0 (0x0)]
  LW-LDI[type=0, refc=0, ptr=0x0, sh-ldi=0x0]
  gateway array update type-time 1 Nov 21 14:47:26.816
 LDI Update time Nov 21 14:52:53.073
  Level 1 - Load distribution: 0
  [0] via cafe:0:0:66::/128, recursive
   via cafe:0:0:66::/128, 7 dependencies, recursive [flags 0x6000]
    path-idx 0 NHID 0x0 [0x8acb53cc 0x0]
    next hop VRF - 'default', table - 0xe0800000
    next hop cafe:0:0:66::/128 via cafe:0:0:66::/64
     SRv6 H.Encaps.Red SID-list {cafe:0:0:66:44::}
    Load distribution: 0 (refcount 1)
    Hash  OK  Interface                 Address
    0     Y   Bundle-Ether1201          fe80::2

Successful completion of all verifications confirms that the IPv4 L3VPN is operational over SRv6, with correct SID assignment, BGP route programming, forwarding table population, and per-CE resilience (if configured).