Theoretical foundations and architecture

SRv6 moves the Segment Routing idea from MPLS labels to IPv6 addresses: a segment is a 128-bit SID and the function encoded in it defines what the node does with the packet. You will study the SID structure (locator, function, argument), the SRH header (RFC 8754) and the behaviors from RFC 8986: End, End.X and the service behaviors End.DT4, End.DT6, End.DX4. A separate block covers compression: uSID (RFC 9800) packs several segments into one IPv6 address and almost removes the SRH overhead. Then an L3VPN over SRv6 is built with BGP (RFC 9252): the PE sends the service SID instead of a VPN label, and transit nodes forward the packet as ordinary IPv6. The lesson compares SRv6 and SR-MPLS by overhead, MTU, hardware maturity, TI-LFA and the security model, and shows the difference between encapsulation and SRH insertion.

From MPLS labels to IPv6 addresses

SR-MPLS encodes a segment with a 20-bit label and needs an MPLS data plane. SRv6 (RFC 8402 gives the architecture, RFC 8754 the header, RFC 8986 network programming) uses IPv6 for the same purpose: a segment is a 128-bit address and its meaning is defined by the owner node. Because a SID looks like an ordinary IPv6 address, the locator prefix is advertised in the IGP (RFC 9352 for IS-IS) as an ordinary route, and nodes without SRv6 support forward such packets by longest match without knowing anything about SR. This is the key difference: a transit P does not need to understand SRv6 as long as it can forward IPv6. A separate consequence is aggregation: the locators of an area can be summarized by one prefix at the border, which cannot be done with SR-MPLS labels.

SID structure: Locator : Function : Argument

The 128 bits are split into locator, function and argument. The locator consists of a block (B) and a node identifier (N): in this lesson the block is fcbb:bb00::/32, PE2 is node 0002 and its locator is fcbb:bb00:2::/48. The function identifies the action on the node (for example End.DT4 for VRF A = e004), and the argument is optional data for the function (in classic SRv6 a value passed to the behavior; in L3VPN it is usually zero). The field lengths are not fixed by the standard, so a node reports the SID structure (Locator Block Length, Locator Node Length, Function Length, Argument Length) in the IGP and in BGP, and the operator chooses the format once for the whole network. The locator is routed by the IGP, while SIDs inside the locator are local entries of the node and are not advertised as separate routes in the IGP (Adjacency SIDs, like End.X, are advertised in sub-TLVs).

The SRH and packet processing

The SRH is a routing header of type 4 (RFC 8754): the fields Next Header, Hdr Ext Len, Routing Type = 4, Segments Left, Last Entry, Flags, Tag and the Segment List[0..n]. The list is stored in reverse order: the last segment is Segment List[0]. The packet Destination Address holds the active segment and Segments Left points to the index of the next one. An endpoint node that finds its SID in the DA executes the behavior: for End it decrements Segments Left by 1, copies Segment List[Segments Left] into the DA and forwards the packet. Only the source node of the domain adds an SRH, transit nodes do not insert it; an optional HMAC TLV protects the list from forgery. The handling of the last segment is described by flavors: PSP (the penultimate segment pops the SRH), USP (the last one pops the SRH) and USD (the last one removes the whole outer header). Nodes without their own SIDs forward by the DA and do not inspect the SRH.

Behaviours (RFC 8986)

End - go to the node. End.X - forward through a specific neighbour (like an Adjacency SID). End.T - lookup in a specified IPv6 table. End.DX4, End.DX6 - decapsulation and forwarding to a specific CE (per-CE). End.DT4, End.DT6, End.DT46 - decapsulation and a lookup in a VRF table (per-VRF; DT46 serves both families). End.B6.Encaps - binding to a policy with a new encapsulation (like a Binding SID). On the headend side H.Encaps (an outer IPv6 header with an SRH), H.Encaps.Red (reduced: the first SID goes into the DA, the SRH does not repeat it, and with a single SID no SRH is needed) and H.Insert (the SRH is inserted into the original packet without an outer header) are defined. Insertion keeps the original addressing and saves 40 bytes, but it is restricted (RFC 8754 allows only the source node to add an SRH) and is not used in L3VPN: the service needs encapsulation to deliver the inner packet unchanged.

uSID and compression (RFC 9800)

Full 128-bit SIDs inflate the SRH: every segment costs 16 bytes. The answer is segment compression. A micro-SID (uSID, the NEXT-CSID flavor of RFC 9800) takes 16 bits; a 128-bit container fits a block (for example 32 bits) and up to six uSIDs. The DA holds the block plus a sequence of uSIDs; a node with uN (End with a shift behavior) compares the first uSID after the block with its own, shifts the rest 16 bits to the left, pads with zeros and forwards the packet, so the active uSID is always right after the block. For 6 hops no SRH is needed at all: the outer IPv6 header weighs 40 bytes instead of 40 + 8 + 6x16. For longer paths containers are placed in an SRH. Services get their own uSIDs (uDT4, uDT6) at the end of the list. The block and the field lengths must match on all nodes, and multi-vendor compatibility depends on the implementation of the flavor and the locator format; consult the platform matrix. Other compression flavors exist and are not covered in this lesson.

L3VPN over SRv6 (RFC 9252)

PE2 allocates a SID for the VRF from its locator: a per-VRF End.DT4 (or DT6/DT46) or a per-CE End.DX4. The SID is carried in VPNv4/VPNv6 in the BGP Prefix-SID attribute (the SRv6 L3 Service TLV) together with the behavior and the SID structure; part of the SID bits may be encoded in the label field of the NLRI (transposition) to reduce the update size. RT, RD, import and export work as in MPLS L3VPN; only the transport and the service encapsulation change: instead of two labels there is an outer IPv6 header with DA = the service SID. The route next hop is the IPv6 address of PE2, which the IGP knows through the locator. A route reflector must preserve the Prefix-SID attribute; for TE the path segments are placed before the service SID (an SRH or uSIDs). When the DA matches End.DT4, the receiving PE removes the outer header and looks up the inner address in the VRF.