| Internet-Draft | SRv6 Flowspec Indirection Redirect | October 2026 |
| Van de Velde, et al. | Expires 16 April 2027 | [Page] |
BGP Flow Specification Version 2 (FSv2) provides an extensible framework for disseminating traffic flow filtering rules and associated traffic redirection actions. This document specifies extensions to the FlowSpec Redirect to Indirection-id Extended Community specifically for SRv6 (Segment Routing over IPv6). When received by a Flowspec client, this extended community triggers an indirection-based lookup within a localized mapping table to retrieve the target SRv6 Segment Identifier (SID), SRv6 Policy, or Binding SID (BSID) forwarding state. This mechanism decouples control-plane BGP Flowspec redirection instructions from dynamic underlay path updates in SRv6 networks.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 16 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
BGP [RFC4271] Flow Specification, originally defined in [RFC8955] and [RFC8956] and evolved under BGP Flow Specification Version 2 (FSv2) [I-D.ietf-idr-fsv2-ip-basic], allows network operators to distribute fine-grained flow matching rules and redirection actions across administrative domains.¶
The "FlowSpec Redirect to indirection-id Extended Community" framework was introduced to decouple the Flowspec redirection policy from explicit next-hop or path-specific identifiers. By directing traffic to a logical "indirection-id", a network controller can update path state (such as SR-TE paths) locally in an indirection table on edge devices without re-issuing BGP Flowspec updates.¶
This document extends the indirection-id framework to support SRv6 networks. It introduces a 128-bit Generalized Indirection-id encoding aligned with SRv6 SID structures, enabling seamless mapping to SRv6 Endpoint SIDs, SRv6 Binding SIDs (BSIDs), and SRv6 Policy path constructs under the FSv2 architecture.¶
This document defines a new sub-type value for SRv6 within the "FlowSpec Redirect to indirection-id Extended Community" registry. The extended community is formatted using a 128-bit Generalized Indirection-id payload as shown below:¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Sub-Type(TBD) | Flags (1B) | ID-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | + + | | + Generalized indirection_id (16 octets) + | | + + | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Where:¶
Type (1 octet): Extended Community Type assigned for Flowspec Path Redirect actions.¶
Sub-Type (1 octet): Assigned by IANA for SRv6 128-bit Indirection-id Redirect.¶
Flags (1 octet): Defines control flags for path lookup behaviors, consistent with the indirection-id baseline specification.¶
ID-Type (1 octet): Specifies the context and mapping interpretation of the 16-octet Generalized indirection_id. This namespace incorporates both baseline multi-protocol context types and the SRv6-specific context types defined in this document. The ID-Type field supports the following classifications:¶
A. Baseline / Multi-Protocol Context Types (as defined in [I-D.ietf-idr-flowspec-path-redirect]:¶
0: Localised ID - The flowspec client uses the received indirection_id to lookup forwarding information within a localized indirection table. The allocation and programming of the localized indirection table are outside the scope of this document.¶
1: Node ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS label using the index as a global offset in the SID/label space).¶
2: Node ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS label using the indirection_id as a global label).¶
3: Binding Segment ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as an index for global offset).¶
4: Binding Segment ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as a global label).¶
5: Tunnel ID - A globally unique tunnel identifier within a single administrative domain.¶
B. SRv6-Specific Context Types (defined in this document):¶
6: Node ID with SID/index in SRv6 - The indirection_id maps to an SRv6 SID, where the payload represents either the full 128-bit SRv6 SID or an index offset within the SRv6 SID space.¶
7: Binding Segment ID with SID/index in SRv6 - The indirection_id maps to an SRv6 Binding SID (BSID) using the payload as an index for a global offset in the SID space.¶
8: Binding Segment ID with SID/label in SRv6 - The indirection_id maps directly to a 128-bit SRv6 Binding SID (BSID) represented globally by the payload.¶
eneralized indirection_id (16 octets / 128 bits): A 128-bit identifier utilized as the indirection_id, carrying the corresponding SID, BSID, or logical path index data depending on the selected ID-Type.¶
When a BGP Flowspec client receives a Flowspec rule containing the SRv6 Indirection-id Redirect Action, it validates the rule according to FSv2 procedures defined in [I-D.ietf-idr-fsv2-ip-basic].¶
Upon validation, the client extracts the 128-bit Generalized Indirection-id and queries its local SRv6 Indirection Table. This table maintains dynamic mappings between the Indirection-id and active forwarding states, such as:¶
Matching data packets are steered into the target SRv6 path resolved by the indirection table:¶
If mapped to an **SRv6 BSID or Policy**, the router encapsulates the packet in an IPv6 outer header with `Destination Address = SRv6 BSID/SID` and appends an SRH if required by the policy path length.¶
If mapped to a **Localised ID**, traffic is cross-connected to the designated SRv6 service instance or VPN VRF table.¶
If a Flowspec client receives an SRv6 Indirection-id rule but cannot resolve the 128-bit Indirection-id in its local table (e.g., policy not yet programmed or underlying SRv6 path down):¶
The router MUST NOT silently drop traffic unless explicitly configured by local fallback policy.¶
The router SHOULD fall back to default IP/SRv6 routing for the packet's original destination address or apply an alternate default Flowspec action.¶
Malformed Extended Community attributes MUST be handled per [RFC7606] and FSv2 error handling guidelines.¶
Indirection-based traffic redirection isolates control-plane Flowspec rules from underlying path state updates. However, incorrect or malicious Indirection-id updates could result in traffic blackholing or unauthorized traffic steering across domain boundaries.¶
To mitigate these risks:¶
IANA is requested to allocate a new sub-type under the "FlowSpec Redirect to indirection-id Extended Community Sub-Type" registry:¶
Value Description Reference 0x01 Flowspec Redirect to 128-bit Path-id for SRv6 This-Document¶
The following people made significant contributions to this document:¶
Arjun Sreekantiah Cisco Systems Email: asreekan@cisco.com Nan Wu Huawei Technologies Email: eric.wu@huawei.com Wim Henderickx Nokia Email: wim.henderickx@nokia.com¶
This document received valuable comments and input from IDR working group including Adam Simpson, Mustapha Aissaoui, Jan Mertens, Robert Raszuk, Jeff Haas, Susan Hares and Lucy Yong.¶