Inter-Domain SRv6¶

Large-scale networks span multiple IGP domains or autonomous systems. Inter-domain SRv6 provides mechanisms to extend segment routing across these boundaries while preserving domain abstraction and operational independence.

Why Inter-Domain Matters¶

Most production SRv6 deployments involve multiple domains:

• Multiple IGP areas/levels — IS-IS L1/L2, OSPF areas within a single AS
• Multiple autonomous systems — acquisitions, peering, wholesale/retail models
• Cloud interconnect — enterprise to cloud provider with distinct SRv6 domains
• Regulatory boundaries — geographic or jurisdictional separation requirements

The core challenge: how to provide end-to-end SRv6 services (VPN, TE, slicing) across domains without exposing internal topology.

Inter-Domain Design Patterns¶

Pattern 1: Single IGP Domain¶

All routers participate in one IS-IS instance. Simplest — no inter-domain complexity.

Pattern 2: Multi-Area / Multi-Level IGP¶

IS-IS Level-1/Level-2 or OSPF multi-area. SRv6 locators are redistributed or leaked between areas.

Pattern 3: Binding SID Stitching¶

Separate IGP domains with Binding SID (BSID) at boundaries. Each domain's ASBR advertises a BSID that abstracts the internal path. Remote domains reference the BSID without knowing the internal topology.

graph LR
    PE1[PE1] -->|Internal SIDs| ASBR1[ASBR1<br/>BSID-A]
    ASBR1 -->|Inter-domain link| ASBR2[ASBR2<br/>BSID-B]
    ASBR2 -->|Internal SIDs| PE2[PE2]

    subgraph AS 65001
        PE1
        ASBR1
    end

    subgraph AS 65002
        ASBR2
        PE2
    end

Segment list at PE1: [ASBR1::1, BSID-B, PE2::DT4]

At ASBR1, BSID-B is resolved to the internal segment list of AS 65002 — PE1 never knows AS 65002's topology.

For BSID mechanics, see SR Policy. For BSID in migration scenarios, see Interworking & Migration.

Pattern 4: BGP-LS + SDN Controller¶

Each domain exports its topology to a centralized controller via BGP-LS (RFC 9514). The controller computes end-to-end paths and installs them via PCEP or BGP SR Policy.

graph TB
    CTRL[SDN Controller / SR-PCE]
    CTRL <-->|BGP-LS| D1[Domain 1]
    CTRL <-->|BGP-LS| D2[Domain 2]
    CTRL <-->|BGP-LS| D3[Domain 3]
    CTRL -->|PCEP / BGP SR Policy| PE1[Headend PEs]

SID Allocation Across Domains¶

Block Planning¶

Each domain must own a unique locator block to prevent SID collisions:

Filtering at Domain Boundaries¶

• Inbound: only accept SRv6 packets with destination SID in the local domain's locator block or explicitly negotiated inter-domain SIDs
• Outbound: only advertise locators and BSIDs that remote domains need
• iACLs on ASBRs: drop packets with unexpected SRH or SIDs

For detailed security practices, see Security.

Domain Boundary Options¶

Three options for interconnecting SRv6 domains, analogous to MPLS inter-AS options:

Option A: Per-VRF Peering¶

Separate BGP session per VRF at the domain boundary. No SRv6 SIDs cross the boundary — traffic is decapsulated and re-encapsulated at each ASBR.

Option B: Binding SID Gateway¶

ASBRs exchange labeled (SID) routes via MP-BGP. Each ASBR allocates a BSID for reachability into its domain. This is the most common approach for SRv6.

Option C: End-to-End SRv6 (Seamless)¶

Remote SRv6 SIDs are installed directly in the local FIB via BGP. Traffic traverses domains without re-encapsulation. Best performance but requires trust between domains.

End-to-End TE Across Domains¶

Hierarchical SR Policies¶

BSIDs chain SR Policies across domains. The ingress PE's segment list references BSIDs that each domain expands independently:

Ingress segment list:  [BSID_Domain1, BSID_Domain2, PE-Remote::DT4]

Domain 1 ASBR expands BSID_Domain1 → [P1::1, P3::1, ASBR1::1]
Domain 2 ASBR expands BSID_Domain2 → [P5::1, PE-Remote::1]

This provides end-to-end TE without any domain knowing the others' topology.

Controller-Based End-to-End Path Computation¶

A multi-domain controller (SR-PCE hierarchy or single controller with BGP-LS from all domains):

1. Collects topology from each domain via BGP-LS
2. Computes a constrained end-to-end path (latency, bandwidth, disjointness)
3. Installs the path on the headend via PCEP, using BSIDs at domain boundaries
4. Reoptimizes when topology changes are detected

Configuration¶

!! ASBR Binding SID for inter-domain policy
segment-routing
 traffic-eng
  policy TO-DOMAIN2
   binding-sid srv6 dynamic behavior ub6-insert-reduced
   color 500 end-point ipv6 2001:db8:2::1
   candidate-paths
    preference 100
     explicit segment-list VIA-ASBR2
    !
   !
  !
 !
!

!! BGP-LS export to controller
router bgp 65001
 address-family link-state link-state
 !
 neighbor 2001:db8:ffff::1
  address-family link-state link-state
  !
 !
!

!! SID filtering at ASBR
ipv6 access-list SRV6-BOUNDARY-FILTER
 10 permit ipv6 any fc00:1::/32
 20 permit ipv6 any fc00:ff::/32
 30 deny ipv6 any any
!
interface GigabitEthernet0/0/0/0
 ipv6 access-group SRV6-BOUNDARY-FILTER ingress
!

# BGP-LS export
set protocols bgp group CONTROLLER family traffic-engineering
set protocols bgp group CONTROLLER neighbor 2001:db8:ffff::1

# BSID policy
set protocols source-packet-routing sr-policy TO-DOMAIN2 binding-sid fc00:ff:1::500
set protocols source-packet-routing sr-policy TO-DOMAIN2 color 500
set protocols source-packet-routing sr-policy TO-DOMAIN2 end-point 2001:db8:2::1

# SID filtering
set firewall family inet6 filter SRV6-BOUNDARY term ALLOW-LOCAL match destination-address fc00:1::/32
set firewall family inet6 filter SRV6-BOUNDARY term ALLOW-INTER-DOMAIN match destination-address fc00:ff::/32
set firewall family inet6 filter SRV6-BOUNDARY term DENY-REST then discard

Verification¶

!! Verify BSID allocation
show segment-routing traffic-eng binding-sid

!! Verify BGP-LS export
show bgp link-state link-state summary

!! Verify inter-domain policy
show segment-routing traffic-eng policy color 500

!! Verify SID filtering
show ipv6 access-list SRV6-BOUNDARY-FILTER

Security Considerations¶

Inter-domain SRv6 introduces unique security requirements:

For the full SRv6 security framework, see Security.

Further Reading¶

• SR Policy — Binding SID, color steering, PCE integration
• Interworking & Migration — BSID gateway for SR-MPLS/SRv6 migration
• Security — SRv6 security best practices including boundary filtering
• Flex-Algorithm — Per-domain Flex-Algo with inter-domain color steering
• RFC 9514 — BGP-LS Extensions for SRv6
• RFC 9723 — BGP Colored Prefix Routing: intent-aware inter-AS paths via colored locators

References¶

1. RFC 9256 - SR Policy Architecture - Defines Binding SID, candidate paths, and color steering used for inter-domain TE
2. RFC 9514 - BGP-LS Extensions for SRv6 - BGP-LS for exporting SRv6 topology to multi-domain controllers
3. RFC 8402 - Segment Routing Architecture - Foundational SR architecture including inter-domain considerations
4. RFC 9830 - Advertising Segment Routing Policies in BGP - BGP SR Policy SAFI for distributing policies across domains (formerly draft-ietf-idr-sr-policy-safi)
5. Cisco IOS-XR: Configure Inter-AS SR-TE - Configuration guide for inter-domain SR-TE with BSID and PCE
6. RFC 9723 - BGP Colored Prefix Routing (CPR) for SRv6 Services - Colored sub-locators in IPv6 unicast with Color Extended Community for inter-AS intent