Flowspec Indirection-id Redirect for SRv6

BGP Flow Specification, originally defined in and and evolved under BGP Flow Specification Version 2 (FSv2) , allows network operators to distribute fine-grained flow matching rules and redirection actions across administrative domains. The "FlowSpec Redirect to indirection-id Extended Community" framework was introduced to decouple the Flowspec redirection policy from explicit next-hop or path-specific identifiers. By directing traffic to a logical "indirection-id", a network controller can update path state (such as SR-TE paths) locally in an indirection table on edge devices without re-issuing BGP Flowspec updates. This document extends the indirection-id framework to support SRv6 networks. It introduces a 128-bit Generalized Indirection-id encoding aligned with SRv6 SID structures, enabling seamless mapping to SRv6 Endpoint SIDs, SRv6 Binding SIDs (BSIDs), and SRv6 Policy path constructs under the FSv2 architecture.

FSv2: Flow Specification Version 2 SRv6: Segment Routing over IPv6 data plane

This document defines a new sub-type value for SRv6 within the "FlowSpec Redirect to indirection-id Extended Community" registry. The extended community is formatted using a 128-bit Generalized Indirection-id payload as shown below:

Where: Type (1 octet): Extended Community Type assigned for Flowspec Path Redirect actions. Sub-Type (1 octet): Assigned by IANA for SRv6 128-bit Indirection-id Redirect. Flags (1 octet): Defines control flags for path lookup behaviors, consistent with the indirection-id baseline specification. ID-Type (1 octet): Specifies the context and mapping interpretation of the 16-octet Generalized indirection_id. This namespace incorporates both baseline multi-protocol context types and the SRv6-specific context types defined in this document. The ID-Type field supports the following classifications: A. Baseline / Multi-Protocol Context Types (as defined in : 0: Localised ID - The flowspec client uses the received indirection_id to lookup forwarding information within a localized indirection table. The allocation and programming of the localized indirection table are outside the scope of this document. 1: Node ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS label using the index as a global offset in the SID/label space). 2: Node ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS label using the indirection_id as a global label). 3: Binding Segment ID with SID/index in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as an index for global offset). 4: Binding Segment ID with SID/label in MPLS-based Segment Routing (mapped to an MPLS binding label using the indirection_id as a global label). 5: Tunnel ID - A globally unique tunnel identifier within a single administrative domain. B. SRv6-Specific Context Types (defined in this document): 6: Node ID with SID/index in SRv6 - The indirection_id maps to an SRv6 SID, where the payload represents either the full 128-bit SRv6 SID or an index offset within the SRv6 SID space. 7: Binding Segment ID with SID/index in SRv6 - The indirection_id maps to an SRv6 Binding SID (BSID) using the payload as an index for a global offset in the SID space. 8: Binding Segment ID with SID/label in SRv6 - The indirection_id maps directly to a 128-bit SRv6 Binding SID (BSID) represented globally by the payload. eneralized indirection_id (16 octets / 128 bits): A 128-bit identifier utilized as the indirection_id, carrying the corresponding SID, BSID, or logical path index data depending on the selected ID-Type.

When a BGP Flowspec client receives a Flowspec rule containing the SRv6 Indirection-id Redirect Action, it validates the rule according to FSv2 procedures defined in . Upon validation, the client extracts the 128-bit Generalized Indirection-id and queries its local SRv6 Indirection Table. This table maintains dynamic mappings between the Indirection-id and active forwarding states, such as: An active SRv6 Policy Segment List. An SRv6 End.X / End.DT4 / End.DT6 SID. An SRv6 Binding SID (BSID) triggering encapsulation into an SRv6 Outer IPv6 Header with an Segment Routing Header (SRH).

Matching data packets are steered into the target SRv6 path resolved by the indirection table: If mapped to an **SRv6 BSID or Policy**, the router encapsulates the packet in an IPv6 outer header with `Destination Address = SRv6 BSID/SID` and appends an SRH if required by the policy path length. If mapped to a **Localised ID**, traffic is cross-connected to the designated SRv6 service instance or VPN VRF table.

If a Flowspec client receives an SRv6 Indirection-id rule but cannot resolve the 128-bit Indirection-id in its local table (e.g., policy not yet programmed or underlying SRv6 path down): The router MUST NOT silently drop traffic unless explicitly configured by local fallback policy. The router SHOULD fall back to default IP/SRv6 routing for the packet's original destination address or apply an alternate default Flowspec action. Malformed Extended Community attributes MUST be handled per and FSv2 error handling guidelines.

Indirection-based traffic redirection isolates control-plane Flowspec rules from underlying path state updates. However, incorrect or malicious Indirection-id updates could result in traffic blackholing or unauthorized traffic steering across domain boundaries. To mitigate these risks: SRv6 Indirection-id Flowspec rules MUST be restricted to a single administrative domain or strictly controlled peer boundaries. Standard BGP Flowspec validation mechanisms and BGP authentication (TCP-AO / MD5) MUST be deployed to ensure attribute integrity.

IANA is requested to allocate a new sub-type under the "FlowSpec Redirect to indirection-id Extended Community Sub-Type" registry:

The following people made significant contributions to this document:

This document received valuable comments and input from IDR working group including Adam Simpson, Mustapha Aissaoui, Jan Mertens, Robert Raszuk, Jeff Haas, Susan Hares and Lucy Yong.