IDR Working Group G. Van de Velde Internet-Draft Nokia Intended status: Standards Track K. Patel Expires: 16 April 2027 Arrcus Z. Li S. Zhuang Huawei Technologies H. Chen Futurewei 13 October 2026 Flowspec Indirection-id Redirect for SRv6 draft-chen-idr-srv6-flowspec-path-redirect-03 Abstract BGP Flow Specification Version 2 (FSv2) provides an extensible framework for disseminating traffic flow filtering rules and associated traffic redirection actions. This document specifies extensions to the FlowSpec Redirect to Indirection-id Extended Community specifically for SRv6 (Segment Routing over IPv6). When received by a Flowspec client, this extended community triggers an indirection-based lookup within a localized mapping table to retrieve the target SRv6 Segment Identifier (SID), SRv6 Policy, or Binding SID (BSID) forwarding state. This mechanism decouples control-plane BGP Flowspec redirection instructions from dynamic underlay path updates in SRv6 networks. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Van de Velde, et al. Expires 16 April 2027 [Page 1] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 16 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Definitions and Acronyms . . . . . . . . . . . . . . . . . . 3 3. Redirect to Indirection-id Extended Community for SRv6 . . . 3 4. Operational Mechanics & SRv6 Datapath Processing . . . . . . 5 4.1. Control-Plane Processing . . . . . . . . . . . . . . . . 5 4.2. Datapath Encapsulation . . . . . . . . . . . . . . . . . 5 5. Error Handling & Fallback . . . . . . . . . . . . . . . . . . 6 6. Security Considerations . . . . . . . . . . . . . . . . . . . 6 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 6 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 7 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7 10.1. Normative References . . . . . . . . . . . . . . . . . . 7 10.2. Informative References . . . . . . . . . . . . . . . . . 8 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8 1. Introduction BGP [RFC4271] Flow Specification, originally defined in [RFC8955] and [RFC8956] and evolved under BGP Flow Specification Version 2 (FSv2) [I-D.ietf-idr-fsv2-ip-basic], allows network operators to distribute fine-grained flow matching rules and redirection actions across administrative domains. Van de Velde, et al. Expires 16 April 2027 [Page 2] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 The "FlowSpec Redirect to indirection-id Extended Community" framework was introduced to decouple the Flowspec redirection policy from explicit next-hop or path-specific identifiers. By directing traffic to a logical "indirection-id", a network controller can update path state (such as SR-TE paths) locally in an indirection table on edge devices without re-issuing BGP Flowspec updates. This document extends the indirection-id framework to support SRv6 networks. It introduces a 128-bit Generalized Indirection-id encoding aligned with SRv6 SID structures, enabling seamless mapping to SRv6 Endpoint SIDs, SRv6 Binding SIDs (BSIDs), and SRv6 Policy path constructs under the FSv2 architecture. 2. Definitions and Acronyms * FSv2: Flow Specification Version 2 * SRv6: Segment Routing over IPv6 data plane [RFC8754] [RFC8986] 3. Redirect to Indirection-id Extended Community for SRv6 This document defines a new sub-type value for SRv6 within the "FlowSpec Redirect to indirection-id Extended Community" registry. The extended community is formatted using a 128-bit Generalized Indirection-id payload as shown below: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Sub-Type(TBD) | Flags (1B) | ID-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | + + | | + Generalized indirection_id (16 octets) + | | + + | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 1: Redirect to indirection-id Community Where: * Type (1 octet): Extended Community Type assigned for Flowspec Path Redirect actions. Van de Velde, et al. Expires 16 April 2027 [Page 3] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 * Sub-Type (1 octet): Assigned by IANA for SRv6 128-bit Indirection- id Redirect. * Flags (1 octet): Defines control flags for path lookup behaviors, consistent with the indirection-id baseline specification. * ID-Type (1 octet): Specifies the context and mapping interpretation of the 16-octet Generalized indirection_id. This namespace incorporates both baseline multi-protocol context types and the SRv6-specific context types defined in this document. The ID-Type field supports the following classifications: - A. Baseline / Multi-Protocol Context Types (as defined in [I-D.ietf-idr-flowspec-path-redirect]: o 0: Localised ID - The flowspec client uses the received indirection_id to lookup forwarding information within a localized indirection table. The allocation and programming of the localized indirection table are outside the scope of this document. o 1: Node ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS label using the index as a global offset in the SID/label space). o 2: Node ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS label using the indirection_id as a global label). o 3: Binding Segment ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as an index for global offset). o 4: Binding Segment ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as a global label). o 5: Tunnel ID - A globally unique tunnel identifier within a single administrative domain. - B. SRv6-Specific Context Types (defined in this document): o 6: Node ID with SID/index in SRv6 - The indirection_id maps to an SRv6 SID, where the payload represents either the full 128-bit SRv6 SID or an index offset within the SRv6 SID space. Van de Velde, et al. Expires 16 April 2027 [Page 4] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 o 7: Binding Segment ID with SID/index in SRv6 - The indirection_id maps to an SRv6 Binding SID (BSID) using the payload as an index for a global offset in the SID space. o 8: Binding Segment ID with SID/label in SRv6 - The indirection_id maps directly to a 128-bit SRv6 Binding SID (BSID) represented globally by the payload. * eneralized indirection_id (16 octets / 128 bits): A 128-bit identifier utilized as the indirection_id, carrying the corresponding SID, BSID, or logical path index data depending on the selected ID-Type. 4. Operational Mechanics & SRv6 Datapath Processing 4.1. Control-Plane Processing When a BGP Flowspec client receives a Flowspec rule containing the SRv6 Indirection-id Redirect Action, it validates the rule according to FSv2 procedures defined in [I-D.ietf-idr-fsv2-ip-basic]. Upon validation, the client extracts the 128-bit Generalized Indirection-id and queries its local SRv6 Indirection Table. This table maintains dynamic mappings between the Indirection-id and active forwarding states, such as: * An active SRv6 Policy Segment List. * An SRv6 End.X / End.DT4 / End.DT6 SID. * An SRv6 Binding SID (BSID) triggering encapsulation into an SRv6 Outer IPv6 Header with an Segment Routing Header (SRH). 4.2. Datapath Encapsulation Matching data packets are steered into the target SRv6 path resolved by the indirection table: * If mapped to an **SRv6 BSID or Policy**, the router encapsulates the packet in an IPv6 outer header with `Destination Address = SRv6 BSID/SID` and appends an SRH if required by the policy path length. * If mapped to a **Localised ID**, traffic is cross-connected to the designated SRv6 service instance or VPN VRF table. Van de Velde, et al. Expires 16 April 2027 [Page 5] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 5. Error Handling & Fallback If a Flowspec client receives an SRv6 Indirection-id rule but cannot resolve the 128-bit Indirection-id in its local table (e.g., policy not yet programmed or underlying SRv6 path down): * The router MUST NOT silently drop traffic unless explicitly configured by local fallback policy. * The router SHOULD fall back to default IP/SRv6 routing for the packet's original destination address or apply an alternate default Flowspec action. * Malformed Extended Community attributes MUST be handled per [RFC7606] and FSv2 error handling guidelines. 6. Security Considerations Indirection-based traffic redirection isolates control-plane Flowspec rules from underlying path state updates. However, incorrect or malicious Indirection-id updates could result in traffic blackholing or unauthorized traffic steering across domain boundaries. To mitigate these risks: * SRv6 Indirection-id Flowspec rules MUST be restricted to a single administrative domain or strictly controlled peer boundaries. * Standard BGP Flowspec validation mechanisms and BGP authentication (TCP-AO / MD5) MUST be deployed to ensure attribute integrity. 7. IANA Considerations IANA is requested to allocate a new sub-type under the "FlowSpec Redirect to indirection-id Extended Community Sub-Type" registry: Value Description Reference 0x01 Flowspec Redirect to 128-bit Path-id for SRv6 This-Document 8. Contributors The following people made significant contributions to this document: Van de Velde, et al. Expires 16 April 2027 [Page 6] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 Arjun Sreekantiah Cisco Systems Email: asreekan@cisco.com Nan Wu Huawei Technologies Email: eric.wu@huawei.com Wim Henderickx Nokia Email: wim.henderickx@nokia.com 9. Acknowledgments This document received valuable comments and input from IDR working group including Adam Simpson, Mustapha Aissaoui, Jan Mertens, Robert Raszuk, Jeff Haas, Susan Hares and Lucy Yong. 10. References 10.1. Normative References [I-D.ietf-idr-flowspec-path-redirect] Van de Velde, G., Patel, K., and Z. Li, "Flowspec Indirection-id Redirect", Work in Progress, Internet- Draft, draft-ietf-idr-flowspec-path-redirect-13, 22 April 2026, . [I-D.ietf-idr-fsv2-ip-basic] Hares, S., Eastlake, D. E., Dong, J., Yadlapalli, C., Maduschke, S., and J. Haas, "BGP Flow Specification Version 2 - for Basic IP", Work in Progress, Internet- Draft, draft-ietf-idr-fsv2-ip-basic-08, 28 September 2026, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, DOI 10.17487/RFC4271, January 2006, . Van de Velde, et al. Expires 16 April 2027 [Page 7] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 [RFC7606] Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. Patel, "Revised Error Handling for BGP UPDATE Messages", RFC 7606, DOI 10.17487/RFC7606, August 2015, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8754] Filsfils, C., Ed., Dukes, D., Ed., Previdi, S., Leddy, J., Matsushima, S., and D. Voyer, "IPv6 Segment Routing Header (SRH)", RFC 8754, DOI 10.17487/RFC8754, March 2020, . [RFC8955] Loibl, C., Hares, S., Raszuk, R., McPherson, D., and M. Bacher, "Dissemination of Flow Specification Rules", RFC 8955, DOI 10.17487/RFC8955, December 2020, . [RFC8956] Loibl, C., Ed., Raszuk, R., Ed., and S. Hares, Ed., "Dissemination of Flow Specification Rules for IPv6", RFC 8956, DOI 10.17487/RFC8956, December 2020, . [RFC8986] Filsfils, C., Ed., Camarillo, P., Ed., Leddy, J., Voyer, D., Matsushima, S., and Z. Li, "Segment Routing over IPv6 (SRv6) Network Programming", RFC 8986, DOI 10.17487/RFC8986, February 2021, . 10.2. Informative References Authors' Addresses Gunter Van de Velde Nokia Antwerp Belgium Email: gunter.van_de_velde@nokia.com Keyur Patel Arrcus United States of America Email: keyur@arrcus.com Van de Velde, et al. Expires 16 April 2027 [Page 8] Internet-Draft SRv6 Flowspec Indirection Redirect October 2026 Zhenbin Li Huawei Technologies 156 Beiqing Road Beijing 100095 P.R. China Email: robinli314@163.com Shunwan Zhuang Huawei Technologies 156 Beiqing Road Beijing 100095 P.R. China Email: zhuangshunwan@huawei.com Huaimo Chen Futurewei Boston, MA,, United States of America Email: hchen.ietf@gmail.com Van de Velde, et al. Expires 16 April 2027 [Page 9]