Segment Routing over IPv6 (SRv6) Network Programming
Extracted elements (30)
An SR source node cannot infer the behavior by examining the FUNCT value of a SID; therefore, the SRv6 Endpoint Behavior codepoint is advertised in the control plane alongside the SID so that source nodes can map a received SID to its intended behavior.
PSP is introduced to streamline egress PE operation: the egress PE parses fewer bytes during decapsulation, and inner IP headers required for per-VRF VPN lookups are more likely to reside within the memory window accessible to the forwarding ASIC's lookup engine.
An egress PE may advertise a VPN SID using the Opaque SRv6 Endpoint Behavior codepoint (0xFFFF) to abstract the specific behavior bound to a SID from the ingress PE and other routers in the network.
End, End.X, and End.T SIDs (with flavors PSP/USP/USD) are signaled in the IGP and BGP-LS. Decapsulation SIDs (End.DX4, End.DX6, End.DT4, End.DT6, End.DT46, End.DX2, End.DX2V, End.DT2U, End.DT2M) are signaled in BGP-LS and BGP IP/VPN/EVPN. Binding SIDs (End.B6.Encaps, End.B6.Encaps.Red, End.BM) are signaled only in BGP-LS.
A node supporting this document SHOULD implement a pair of traffic counters (packets and bytes) per local SID entry for traffic that matched that SID and was processed successfully.
For H.Encaps.L2, the Next Header field of the SRH MUST be set to 143 (Ethernet). The encapsulating node MUST remove the preamble and FCS from the Ethernet frame upon encapsulation, and the decapsulating node MUST regenerate the preamble and FCS before forwarding.
The ARG value of a routed SID SHOULD remain constant among packets in a given flow; varying ARG values may result in different ECMP hashing and cause reordering.
The End.DX6, End.DX4, End.DT6, End.DT4, End.DT46, End.DX2, End.DX2V, End.DT2U, and End.DT2M SIDs MUST be the last segment in an SR Policy; if Segments Left != 0 upon receipt, the node sends an ICMP Parameter Problem and discards the packet.
When L+F+A is less than 128, the remaining bits of the SID MUST be zero.
When performing flow-based selection within a set (e.g., ECMP paths, End.X adjacency arrays, multi-SID-list SR Policies), the IPv6 Source Address, Destination Address, and Flow Label of the outer IPv6 header MUST be included in the flow-based hash.
When processing the End SID and IPv6 Hop Limit is <= 1, the node MUST send an ICMP Time Exceeded message (Code 0) to the Source Address, interrupt packet processing, and discard the packet.
When processing the Upper-Layer header of a packet matching a locally instantiated End SID, if the Upper-Layer header type is not allowed by local configuration, the node MUST send an ICMP Parameter Problem (Code 4, SR Upper-layer Header Error) and discard the packet. It is RECOMMENDED that only header types that do not result in forwarding (e.g., ICMPv6) be allowed.
An SRv6 SID is structured as LOC:FUNCT:ARG, where LOC is the locator encoded in the L most significant bits, followed by F bits of function (FUNCT) and A bits of arguments (ARG), with L+F+A <= 128.
End.B6.Encaps is the SRv6 instantiation of a Binding SID. It applies the End behavior's SRH processing and then pushes a new IPv6 header with its own SRH containing SR Policy B, setting the outer SA to A and outer DA to the first SID of B.
End.BM is the SRv6 instantiation of an SR-MPLS Binding SID. After SRH processing, it pushes the MPLS label stack for the associated SR-MPLS Policy B and submits the packet to the MPLS engine, enabling inter-domain TE across MPLS and SRv6 domains.
End.DT2M (Decapsulation and L2 Table Flooding) uses the argument Arg.FE2, which provides a local mapping to an ESI for split-horizon filtering. It floods the exposed Ethernet frame on all L2 OIFs in table T, excluding those associated with Arg.FE2, enabling EVPN BUM and E-Tree use cases.
End.DT6 and End.DT4 decapsulate the outer IPv6 header and perform a lookup in a specific IPv6 or IPv4 FIB table T, respectively. End.DT46 handles both IPv4 and IPv6 inner packets using separate FIB tables T4 and T6. These are the per-VRF VPN label equivalents in SRv6.
End.DX2 decapsulates the outer IPv6 header and forwards the exposed Ethernet frame (Next Header type 143) to the associated outgoing interface I, enabling L2VPN/EVPN VPWS use cases.
End.DX6 decapsulates the outer IPv6 header and forwards the exposed IPv6 packet to the associated L3 adjacency J. End.DX4 similarly decapsulates and forwards the exposed IPv4 packet. These are the per-CE VPN label equivalents in SRv6.
H.Encaps.Red is an optimization of H.Encaps that reduces the SRH length by one SID by placing the first SID only in the IPv6 Destination Address and excluding it from the SRH Segment List.
H.Encaps (SR Headend with Encapsulation) pushes a new IPv6 header with an SRH, sets the outer SA to T (a local IPv6 address) and outer DA to the first SID of the SR Policy, decrements the inner Hop Limit or TTL, and submits the packet for IPv6 FIB lookup.
PSP (Penultimate Segment Pop) is a flavor of End, End.X, and End.T that instructs the penultimate SR Segment Endpoint Node to remove the SRH after decrementing Segments Left to zero, avoiding SRH processing overhead at the egress PE.
The End (Endpoint) behavior is the SRv6 instantiation of a Prefix-SID. Upon receipt, the node decrements Hop Limit and Segments Left, updates the IPv6 DA with Segment List[Segments Left], and submits the packet to the egress IPv6 FIB lookup.
The End.X (Endpoint with L3 Cross-Connect) behavior is the SRv6 instantiation of an Adj-SID. It is associated with a set J of one or more L3 adjacencies; after SRH processing, the packet is submitted to the IPv6 module for transmission via a member of J selected by flow-based hash.
USD (Ultimate Segment Decapsulation) is a flavor of End, End.X, and End.T that decapsulates the outer IPv6 header when the Upper-Layer header is IPv4 or IPv6, enabling TI-LFA repair paths where the last SR endpoint strips the repair encapsulation and forwards the inner packet.
USP (Ultimate Segment Pop) is a flavor of End, End.X, and End.T that removes the consumed SRH (when Segments Left == 0) before passing the packet to the next header, useful for smartNIC hosts implementing SRv6.
IANA allocated value 143 for 'Ethernet' in the 'Assigned Internet Protocol Numbers' registry. This value in the Next Header field of an IPv6 header or extension header indicates the payload is an Ethernet frame per IEEE 802.3-2018.
IANA created the 'Segment Routing' top-level registry and the 'SRv6 Endpoint Behaviors' 16-bit subregistry (range 0–65535). Range 1–32767 is First Come First Served; 32768–34815 is Private Use; 34816–65534 is Reserved; 65535 (0xFFFF) is Opaque. Initial registrations include End (1), End.X (5), End.T (9), End.DX6 (16), End.DX4 (17), End.DT6 (18), End.DT4 (19), End.DT46 (20), End.DX2 (21), End.DT2M (24), End.B6.Encaps (14), End.B6.Encaps.Red (27), End.BM (15), and flavor combinations thereof.
RFC 8754's HMAC TLV permits SR Segment Endpoint Nodes to verify that the SRH was selected by an authorized party and that the segment list was not modified after generation. When enabled by local configuration, HMAC processing occurs at the beginning of SRH processing.
SRv6-based services require a well-defined SR Domain trust boundary to prevent external traffic from accessing or exploiting SRv6 behaviors. Careful IPv6 address allocation—keeping SRv6 SID and infrastructure addresses distinct from end-user addresses—provides the necessary separation between internal and external address space.