Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Segment Routing v6 Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

IPv6 L3VPN over SRv6

Updated: September 8, 2026

Want to summarize with AI?

Log in

Explains building on the messages and procedures defined in IETF draft "BGP/MPLS IP Virtual Private Networks (VPNs)", this feature provides IPv6 L3VPNs (VPNv6) over an SRv6 network.

A IPv6 L3VPN over SRv6 is an MPLS VPN solution that

  • leverages Segment Routing over IPv6 (SRv6) to transport VPNv6 traffic between Provider Edge (PE) routers,

  • uses BGP to signal and carry service-specific Segment Identifiers (SIDs) as part of the VPN overlay, and

  • enables flexible, scalable IPv6-based Layer 3 VPN deployments across supported Cisco platforms.

Table 1. Table 1. Feature History Table

Feature Name

Release Information

Feature Description

IPv6 L3VPN over SRv6

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

IPv6 L3VPN over SRv6

 Release 25.1.1

Introduced in this release on: Fixed Systems ( 8010 [ASIC: A100])(select variants only*)

This feature is now supported on Cisco 8011-4G24Y4H-I routers.

IPv6 L3VPN over SRv6

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 8712-MOD-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

IPv6 L3VPN over SRv6

Release 7.8.1

With this feature, the egress PE can signal an SRv6 Service SID with the BGP overlay service route. The ingress PE encapsulates the IPv4/IPv6 payload in an outer IPv6 header where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs as a means to interconnect PEs and form VPNs.

SRv6 Service SID allocation modes in IPv6 L3VPN

SRv6 Service SIDs in IPv6 L3VPN deployments can be allocated and signaled using BGP, following procedures defined by industry standards.

SRv6 service SID allocation and behaviors:

  • BGP allocates an SRv6 Service SID from the locator space, configured under SRv6 and VPNv6 address family. For more information, see SRv6 over IPv6 overview.

  • The SRv6 Service SID can be allocated in the following way:

    • Per-VRF mode that provides End.DT6 support. End.DT6 represents the Endpoint with decapsulation and IPv6 table lookup on the advertising VPNv6 PE router.

Key procedures and industry reference:

  • This feature builds on messages and procedures defined in IETF RFC 4364, BGP/MPLS IP Virtual Private Networks (VPNs) and the IETF draft SRv6 BGP based Overlay services.

  • In SRv6-based L3VPNs, the egress PE signals an SRv6 Service SID with the BGP overlay service route.

  • The ingress PE encapsulates the IPv4 or IPv6 payload in an outer IPv6 header, where the destination address is the SRv6 Service SID provided by the egress PE. BGP messages between PEs carry SRv6 Service SIDs to interconnect PEs and form VPNs.

  • BGP encodes the SRv6 Service SID in the prefix-SID attribute of the IPv6 L3VPN Network Layer Reachability Information (NLRI) and advertises it to IPv6 BGP peers.

IPv6 L3VPN guidelines and restrictions

The following features and restrictions apply to IPv6 L3VPN services using SRv6:

  • Equal-Cost Multi-path (ECMP) and Unequal Cost Multipath (UCMP) are supported.

  • BGP, OSPF, Static are supported as PE-CE protocol.

  • Dual-Stack L3VPN Services (IPv4, IPv6) are supported.

  • MPLS L3VPN and SRv6 L3VPN interworking gateway is supported.

Configure an IPv6 L3VPN over SRv6

Enable IPv6 L3VPN services over SRv6 transport for scalable and flexible VPN deployment.

IPv6 L3VPN over SRv6 allows service providers to transport customer traffic securely over an SRv6-enabled core using BGP VPNv6 with per-VRF label allocation.

Before you begin

  • Ensure that SRv6 is enabled and properly configured on all participating routers.

  • Confirm BGP is running and basic connectivity between PE routers exists.

  • Have the relevant VRF, RD, and locator details at hand.

Follow these steps to configure an IPv6 L3VPN over SRv6:

Procedure

  1. Configure the SRv6 locator name under BGP Global.

    To enable SRv6-based L3VPN, you need to configure SRv6 under BGP and configure the SID allocation mode.

    Example:

    RP/0/0/CPU0:Node1(config)# router bgp 100
RP/0/0/CPU0:Node1(config-bgp)# segment-routing srv6 
RP/0/0/CPU0:Node1(config-bgp-gbl-srv6)# locator Node1-locator 
RP/0/0/CPU0:Node1(config-bgp-gbl-srv6)# exit 
RP/0/0/CPU0:Node1(config-bgp)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-af)# exit 
RP/0/0/CPU0:Node1(config-bgp)# neighbor 3001::1:1:1:4 
RP/0/0/CPU0:Node1(config-bgp-nbr)# remote-as 100 
RP/0/0/CPU0:Node1(config-bgp-nbr)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-nbr-af)# exit 
RP/0/0/CPU0:Node1(config-bgp-nbr)# exit 
RP/0/0/CPU0:Node1(config-bgp)# vrf vrf_cust6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# rd 100:6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# address-family ipv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-vrf-af)# commit

    Running configuration

    Example:

    router bgp 100
 segment-routing srv6
  locator Node1-locator
 !
 address-family vpnv6 unicast
 !
 neighbor 3001::1:1:1:4
  remote-as 100
  address-family vpnv6 unicast
  !
 !
 vrf vrf_cust6
  rd 100:6
  address-family ipv6 unicast
  !
 !
!
end

  2. Configure the SRv6 locator for all VRFs under VPNv6 address family, with per-VRF label allocation mode.

    Example:

    RP/0/0/CPU0:Node1(config)# router bgp 100 
RP/0/0/CPU0:Node1(config-bgp)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-af)# vrf all 
RP/0/0/CPU0:Node1(config-bgp-af-vrfall)# segment-routing srv6 
RP/0/0/CPU0:Node1(config-bgp-af-vrfall-srv6)# locator Node1-locator 
RP/0/0/CPU0:Node1(config-bgp-af-vrfall-srv6)# alloc mode per-vrf 
RP/0/0/CPU0:Node1(config-bgp-af-vrfall-srv6)# exit 
RP/0/0/CPU0:Node1(config-bgp-af-vrfall)# exit 
RP/0/0/CPU0:Node1(config-bgp-af)# exit 
RP/0/0/CPU0:Node1(config-bgp)# neighbor 3001::1:1:1:4 
RP/0/0/CPU0:Node1(config-bgp-nbr)# remote-as 100 
RP/0/0/CPU0:Node1(config-bgp-nbr)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-nbr-af)# exit 
RP/0/0/CPU0:Node1(config-bgp-nbr)# exit 
RP/0/0/CPU0:Node1(config-bgp)# vrf vrf_cust6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# rd 100:6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# address-family ipv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-vrf-af)# commit

    Running configuration

    Example:

    router bgp 100
 address-family vpnv6 unicast
  vrf all
   segment-routing srv6
    locator Node1-locator
    alloc mode per-vrf
   !
  !
 !
 neighbor 3001::1:1:1:4
  remote-as 100
  address-family vpnv6 unicast
  !
 !
 vrf vrf_cust6
  rd 100:6
  address-family ipv6 unicast
  !
 !
!
end

  3. Configure the SRv6 locator for an individual VRF, with per-VRF label allocation mode.

    Example:

    RP/0/0/CPU0:Node1(config)# router bgp 100 
RP/0/0/CPU0:Node1(config-bgp)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-af)# exit 
RP/0/0/CPU0:Node1(config-bgp)# neighbor 3001::1:1:1:4 
RP/0/0/CPU0:Node1(config-bgp-nbr)# remote-as 100 
RP/0/0/CPU0:Node1(config-bgp-nbr)# address-family vpnv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-nbr-af)# exit 
RP/0/0/CPU0:Node1(config-bgp-nbr)# exit 
RP/0/0/CPU0:Node1(config-bgp)# vrf vrf_cust6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# rd 100:6 
RP/0/0/CPU0:Node1(config-bgp-vrf)# address-family ipv6 unicast 
RP/0/0/CPU0:Node1(config-bgp-vrf-af)# segment-routing srv6 
RP/0/0/CPU0:Node1(config-bgp-vrf-af-srv6)# locator Node1-locator 
RP/0/0/CPU0:Node1(config-bgp-vrf-af-srv6)# alloc mode per-vrf 
RP/0/0/CPU0:Node1(config-bgp-vrf-af-srv6)# commit

    Running Configuration

    Example:

    router bgp 100
 address-family vpnv6 unicast
 !
 neighbor 3001::1:1:1:4
  remote-as 100
  address-family vpnv6 unicast
  !
 !
 vrf vrf_cust6
  rd 100:6
  address-family ipv6 unicast
   segment-routing srv6
    locator Node1-locator
    alloc mode per-vrf
   !
  !
 !
!
end

The device is now configured for IPv6 L3VPN over SRv6, supporting multi-tenant VPNs with flexible SRv6-based transport. BGP exchanges VPNv6 prefixes and the SRv6 locator/SID assignments for VPN routes are active.

What to do next

Verify the L3VPN configuration for each VRF and validate per-VRF label allocation. For more information, see Verify an IPv6 L3VPN over SRv6.

Verify an IPv6 L3VPN over SRv6

Confirm that IPv6 Layer 3 VPNs are operational over Segment Routing IPv6 (SRv6) using relevant CLI verification.

Use this procedure after configuring SRv6-based L3VPN with per-VRF label allocation. Verifying ensures correct forwarding and route programming for the target VRF.

Before you begin

  • Complete all SRv6 L3VPN and BGP configurations on the relevant devices.

  • Know the VRF name (for example, vrf_cust6) and router identities.

Follow these steps to verify IPv6 L3VPN over SRv6:

Procedure

  1. Verify an IPv6 L3VPN over SRv6.

    In this example, End.X represents Endpoint function with Layer-3 cross-connect, and End.DT6 represents Endpoint with decapsulation and IPv6 table lookup.

    Example:

    P/0/RSP0/CPU0:Node1# show segment-routing srv6 sid
Fri Jan 15 18:58:04.911 UTC

*** Locator: 'Node1-locator' ***

SID                         Behavior          Context                           Owner               State  RW
--------------------------  ----------------  ------------------------------    ------------------  -----  --
cafe:0:0:1:1::              End (PSP)         'default':1                       sidmgr              InUse  Y
cafe:0:0:1:40::             End.X (PSP)       [Hu0/0/0/0, Link-Local]           isis-1              InUse  Y
cafe:0:0:1:41::             End.X (PSP)       [Hu0/0/0/1, Link-Local]           isis-1              InUse  Y
cafe:0:0:1:47::             End.X (PSP)       [Hu0/0/0/0, Link-Local]:P         isis-1              InUse  Y
cafe:0:0:1:48::             End.X (PSP)       [Hu0/0/0/1, Link-Local]:P         isis-1              InUse  Y
cafe:0:0:1:49::             End.DT6           'default'                         bgp-100             InUse  Y
cafe:0:0:1:4a::             End.DT6           'vrf_cust6'                       bgp-100             InUse  Y

  2. Verify the SRv6 based L3VPN configuration using the show bgp vpnv6 unicast commands on the ingress PE.

    Example:

    RP/0/RSP0/CPU0:Node1# show bgp vpnv6 unicast summary
Fri Jan 15 18:37:04.791 UTC
BGP router identifier 10.1.1.1, local AS number 100
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 21
BGP NSR Initial initsync version 4 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

BGP is operating in STANDALONE mode.


Process       RcvTblVer   bRIB/RIB   LabelVer  ImportVer  SendTblVer  StandbyVer
Speaker              21         21         21         21          21           0

Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
3001::1:1:1:4     0   100    1352    1352       21    0    0 01:46:26          1
3001::1:1:1:5     0   100    1351    1351       21    0    0 01:44:47          1

RP/0/RSP0/CPU0:Node1# show bgp vpnv6 unicast rd 100:6
Fri Jan 15 18:38:02.919 UTC
BGP router identifier 10.1.1.1, local AS number 100
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 21
BGP NSR Initial initsync version 4 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:6 (default for vrf vrf_cust6)
*> 3001::12:1:1:1/128 ::                       0         32768 ?
*>i3001::12:1:1:4/128 3001::1:1:1:4            0    100      0 ?
*>i3001::12:1:1:5/128 3001::1:1:1:5            0    100      0 ?

Processed 3 prefixes, 3 paths

RP/0/RSP0/CPU0:Node1# show bgp vpnv6 unicast rd 100:6 3001::12:1:1:4/128
Fri Jan 15 18:38:26.492 UTC
BGP routing table entry for 3001::12:1:1:4/128, Route Distinguisher: 100:6
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker                 17          17
Last Modified: Jan 15 16:50:44.032 for 01:47:43
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  Local, (received & used)
    3001::1:1:1:4 (metric 30) from 3001::1:1:1:4 (10.1.1.4)
      Received Label 0x4900
      Origin incomplete, metric 0, localpref 100, valid, internal, best, group-best, import-candidate, imported
      Received Path ID 0, Local Path ID 1, version 17
      Extended community: RT:100:6
      PSID-Type:L3, SubTLV Count:1
       SubTLV:
        T:1(Sid information), Sid:cafe:0:0:4::, Behavior:18, SS-TLV Count:1
         SubSubTLV:
          T:1(Sid structure):
      Source AFI: VPNv6 Unicast, Source VRF: vrf_cust6, Source Route Distinguisher: 100:6

  3. Verify the BGP prefix information for VRF instances.

    Example:

    RP/0/RSP0/CPU0:Node1# show bgp vrf vrf_cust6 ipv6 unicast
Fri Jan 15 18:38:49.705 UTC
BGP VRF vrf_cust6, state: Active
BGP Route Distinguisher: 100:6
VRF ID: 0x60000008
BGP router identifier 10.1.1.1, local AS number 100
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800017   RD version: 21
BGP main routing table version 21
BGP NSR Initial initsync version 4 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:6 (default for vrf vrf_cust6)
*> 3001::12:1:1:1/128 ::                       0         32768 ?
*>i3001::12:1:1:4/128 3001::1:1:1:4            0    100      0 ?
*>i3001::12:1:1:5/128 3001::1:1:1:5            0    100      0 ?

Processed 3 prefixes, 3 paths

RP/0/RSP0/CPU0:Node1# show bgp vrf vrf_cust6 ipv6 unicast 3001::12:1:1:4/128
Fri Jan 15 18:39:05.115 UTC
BGP routing table entry for 3001::12:1:1:4/128, Route Distinguisher: 100:6
Versions:
  Process           bRIB/RIB  SendTblVer
  Speaker                 17          17
Last Modified: Jan 15 16:50:44.032 for 01:48:21
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  Local, (received & used)
    3001::1:1:1:4 (metric 30) from 3001::1:1:1:4 (10.1.1.4)
      Received Label 0x4900
      Origin incomplete, metric 0, localpref 100, valid, internal, best, group-best, import-candidate, imported
      Received Path ID 0, Local Path ID 1, version 17
      Extended community: RT:100:6
      PSID-Type:L3, SubTLV Count:1
       SubTLV:
        T:1(Sid information), Sid:cafe:0:0:4::, Behavior:18, SS-TLV Count:1
         SubSubTLV:
          T:1(Sid structure):
      Source AFI: VPNv6 Unicast, Source VRF: vrf_cust6, Source Route Distinguisher: 100:6

  4. Verify the current routes in the RIB.

    Example:

    RP/0/RSP0/CPU0:Node1# show route vrf vrf_cust6 ipv6 unicast
Fri Jan 15 18:39:20.619 UTC

Codes: C - connected, S - static, R - RIP, B - BGP, (>) - Diversion path
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, su - IS-IS summary null, * - candidate default
       U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP
       A - access/subscriber, a - Application route
       M - mobile route, r - RPL, t - Traffic Engineering, (!) - FRR Backup path

Gateway of last resort is not set

L    3001::12:1:1:1/128 is directly connected,
      21:14:10, Loopback105
B    3001::12:1:1:4/128
      [200/0] via 3001::1:1:1:4 (nexthop in vrf default), 01:48:36
B    3001::12:1:1:5/128
      [200/0] via 3001::1:1:1:5 (nexthop in vrf default), 01:46:56

RP/0/RSP0/CPU0:Node1# show route vrf vrf_cust6 ipv6 unicast 3001::12:1:1:4/128
Fri Jan 15 18:39:39.689 UTC

Routing entry for 3001::12:1:1:4/128
  Known via "bgp 100", distance 200, metric 0, type internal
  Installed Jan 15 16:50:44.381 for 01:48:55
  Routing Descriptor Blocks
    3001::1:1:1:4, from 3001::1:1:1:4
      Nexthop in Vrf: "default", Table: "default", IPv6 Unicast, Table Id: 0xe0800000
      Route metric is 0
  No advertising protos.

RP/0/RSP0/CPU0:Node1# show route vrf vrf_cust6 ipv6 unicast 3001::12:1:1:4/128 detail
Fri Jan 15 18:39:51.573 UTC

Routing entry for 3001::12:1:1:4/128
  Known via "bgp 100", distance 200, metric 0, type internal
  Installed Jan 15 16:50:44.381 for 01:49:07
  Routing Descriptor Blocks
    3001::1:1:1:4, from 3001::1:1:1:4
      Nexthop in Vrf: "default", Table: "default", IPv6 Unicast, Table Id: 0xe0800000
      Route metric is 0
      Label: None
      Tunnel ID: None
      Binding Label: None
      Extended communities count: 0
      Source RD attributes: 0x0000:100:6
      NHID:0x0(Ref:0)
      SRv6 Headend: H.Encaps.Red [base], SID-list {cafe:0:0:4:49::}
  Route version is 0x1 (1)
  No local label
  IP Precedence: Not Set
  QoS Group ID: Not Set
  Flow-tag: Not Set
  Fwd-class: Not Set
  Route Priority: RIB_PRIORITY_RECURSIVE (12) SVD Type RIB_SVD_TYPE_REMOTE
  Download Priority 3, Download Version 3
  No advertising protos.

  5. Verify the current IPv6 Cisco Express Forwarding (CEF) table.

    Example:

    RP/0/RSP0/CPU0:Node1# show cef vrf vrf_cust6 ipv6
Fri Jan 15 18:40:15.833 UTC

::/0
  drop       default handler
3001::12:1:1:1/128
  receive    Loopback105
3001::12:1:1:4/128
  recursive    cafe:0:0:4::/128
3001::12:1:1:5/128
  recursive    cafe:0:0:5::/128
fe80::/10
  receive
ff02::/16
  receive
ff02::2/128
  receive
ff02::1:ff00:0/104
  receive
ff05::/16
  receive
ff12::/16
  receive

RP/0/RSP0/CPU0:Node1# show cef vrf vrf_cust6 ipv6 3001::12:1:1:4/128
Fri Jan 15 18:40:28.853 UTC
3001::12:1:1:4/128, version 3, SRv6 Headend, internal 0x5000001 0x30 (ptr 0x78f2e0e0) [1], 0x0 (0x0), 0x0 (0x8886b768)
 Updated Jan 15 16:50:44.385
 Prefix Len 128, traffic index 0, precedence n/a, priority 3
   via cafe:0:0:4::/128, 9 dependencies, recursive [flags 0x6000]
    path-idx 0 NHID 0x0 [0x78a0f504 0x0]
    next hop VRF - 'default', table - 0xe0800000
    next hop cafe:0:0:4::/128 via cafe:0:0:4::/64
    SRv6 H.Encaps.Red SID-list {cafe:0:0:4:49::}

RP/0/RSP0/CPU0:Node1# show cef vrf vrf_cust6 ipv6 3001::12:1:1:4/128 detail
Fri Jan 15 18:40:55.327 UTC
3001::12:1:1:4/128, version 3, SRv6 Headend, internal 0x5000001 0x30 (ptr 0x78f2e0e0) [1], 0x0 (0x0), 0x0 (0x8886b768)
 Updated Jan 15 16:50:44.385
 Prefix Len 128, traffic index 0, precedence n/a, priority 3
  gateway array (0x7883b320) reference count 1, flags 0x2010, source rib (7), 0 backups
                [1 type 3 flags 0x48441 (0x788e6ad8) ext 0x0 (0x0)]
  LW-LDI[type=0, refc=0, ptr=0x0, sh-ldi=0x0]
  gateway array update type-time 1 Jan 15 16:50:44.385
 LDI Update time Jan 15 16:50:44.385

  Level 1 - Load distribution: 0
  [0] via cafe:0:0:4::/128, recursive

   via cafe:0:0:4::/128, 9 dependencies, recursive [flags 0x6000]
    path-idx 0 NHID 0x0 [0x78a0f504 0x0]
    next hop VRF - 'default', table - 0xe0800000
    next hop cafe:0:0:4::/128 via cafe:0:0:4::/64
    SRv6 H.Encaps.Red SID-list {cafe:0:0:4:49::}

    Load distribution: 0 1 (refcount 1)

    Hash  OK  Interface                 Address
    0     Y   HundredGigE0/0/0/0        remote
    1     Y   HundredGigE0/0/0/1        remote

You have verified that the IPv6 L3VPN over SRv6 is correctly configured and operational, with all routes and forwarding entries as expected for the chosen VRF.