BGP Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

BGP Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure BGP flowspec redirect from global VRF

Updated: June 9, 2026

Want to summarize with AI?

Log in

Provides instructions for configuring BGP flowspec redirect from global VRF, guiding users through command procedures to enable dynamic traffic redirection within multi-VRF architectures.

Enable BGP Flowspec redirect from the global VRF to customer VRFs by configuring class maps, policy maps, and applying service policies on the BGP Flowspec controller.

This task enables BGP Flowspec redirect from the global VRF to customer VRFs to prevent packet drops when destination IPs exist only in customer VRF routing tables. The BGP Flowspec server programs and distributes redirect rules to neighbors, which store and activate them. Matching packets are redirected to the correct VRF via the specified route target, ensuring accurate forwarding through L3VPN or Segment Routing Policy for precise traffic control in complex networks.

Before you begin

  • Ensure BGP Flowspec is supported and enabled on the router.

  • Confirm that the global VRF and customer VRFs are properly configured.

  • Verify that L3VPN or Segment Routing Policy (SR-Policy) mechanisms are in place for forwarding.

  • Have access to configure class maps, policy maps, and flowspec service policies on the BGP Flowspec controller.

  • Confirm that route targets for the customer VRFs are defined and reachable.

  • Ensure a policer action is configured to enable BGP Flowspec statistics.

Follow these steps to configure BGP flowspec redirect from global VRF.

Procedure

1.

Define traffic classes to match packets based on destination IP addresses.

Example:

Router# configure terminal
Router(config)# class-map type traffic match-all ipv4_CM1
Router(config-cmap)# match destination-address ipv4 10.0.0.1 255.255.255.0
Router(config-cmap)# end-class-map
Router(config)# class-map type traffic match-all ipv6_CM1
Router(config-cmap)# match destination-address ipv6 2000:0:0:1::/64
Router(config-cmap)# end-class-map
Router(config)# exit
2.

Create policy maps to specify redirect actions for the matched traffic classes.

Example:

Router(config)# policy-map type pbr ipv4_PM1
Router(config-pmap)# class type traffic ipv4_CM1
Router(config-pmap-c)# redirect nexthop route-target 1:1
Router(config-pmap-c)# exit
Router(config-pmap)# class type traffic class-default
Router(config-pmap)# end-policy-map
Router(config)# policy-map type pbr ipv6_PM1
Router(config-pmap)# class type traffic ipv6_CM1
Router(config-pmap-c)# redirect nexthop route-target 1:1
Router(config-pmap-c)# exit
Router(config-pmap)# class type traffic class-default
Router(config-pmap)# end-policy-map
Router(config)# exit
3.

Attach the policy maps to the respective address families under flowspec configuration.

Example:

Router(config)# flowspec
Router(config)# address-family ipv4
Router(config-af)# service-policy type pbr ipv4_PM1
Router(config-af)# exit
Router(config)# address-family ipv6
Router(config-af)# service-policy type pbr ipv6_PM1
Router(config-af)# exit
Router(config)# exit
4.

Install flowspec rules on all interfaces locally:

Example:

Router(config)# flowspec
Router(config)# local-install interface-all
Router(config)# exit
5.

Verify the running configuration.

Example:

Router# show running-config
class-map type traffic match-all ipv4_CM1
 match destination-address ipv4 10.0.0.1. 255.255.255.0
 end-class-map
! 
class-map type traffic match-all ipv6_CM1
 match destination-address ipv6 2000:0:0:1::/64
 end-class-map
! 

policy-map type pbr ipv4_PM1
 class type traffic ipv4_CM1 
  redirect nexthop route-target 1:1
   
  ! 
 ! 
 class type traffic class-default 
 ! 
 end-policy-map
! 
policy-map type pbr ipv6_PM1
 class type traffic ipv6_CM1 
  redirect nexthop route-target 1:1
   
  ! 
 ! 
 class type traffic class-default 
 ! 
 end-policy-map
! 

flowspec
 address-family ipv4
  service-policy type pbr ipv4_PM1
 address-family ipv6
  service-policy type pbr ipv6_PM1


flowspec config on PE1:

flowspec
 local-install interface-all
6.

Use the show ofa objects pbr object-count location 0/RP0/CPU0 command in privileged EXEC mode to verify the number of BGP Flowspec entries in the OFA object.

Example:

Router# show ofa objects pbr object-count location 0/RP0/CPU0

Table [PBR] has 4200 entries in DB
Table [PBR] had 4200 as highest count @ Tue Feb  6 20:08:04 2024

You will see the current count of BGP Flowspec entries in the OFA object and detailed statistics for each BGP Flowspec rule, including matched, transmitted, and dropped packets and bytes.
7.

Use the show flowspec ipv4 detail command in privileged EXEC mode to verify the BGP Flowspec rules and their statistics.

Example:

Router# show flowspec ipv4 detail
AFI: IPv4
  Flow           :Dest:10.0.0.1/8
    Actions      :Traffic-rate: 5000000 bps Redirect: VRF vpn1 Route-target: ASN2-1:1  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                 200/25600              
      Transmitted         :                 200/25600              
      Dropped             :                   0/0                  
  Flow           :Dest:10.0.0.2/8
    Actions      :Traffic-rate: 5000000 bps Redirect: VRF vpn1 Route-target: ASN2-1:1  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                 200/25600              
      Transmitted         :                 200/25600              
      Dropped             :                   0/0