Core: Network Virtualization

Segment Routing

Miro Kosut

Miro Kosut

— 9 min read
Share

In one line

Source routing where the path is encoded as a stack of segments (SIDs) - removing per-LSP LDP/RSVP state from the core.

Two data planes

  • SR-MPLS - SIDs are MPLS labels (reuses the MPLS data plane).
  • SRv6 - SIDs are IPv6 addresses; "network programming" carries both transport and service semantics in the v6 header.

Building blocks

Prefix-SID (global, to a prefix), node-SID (a prefix-SID for a loopback), and adjacency-SID (local, a link) - advertised by IS-IS or OSPF (no separate label protocol).

SR-TE: policies, colors, and steering without midpoint state

Because the path rides in the packet, traffic engineering needs no signalling and no per-flow state at midpoints: the ingress imposes a SID list and every transit node simply executes its instruction - and a prefix segment stays ECMP-aware, fanning across every equal-cost path toward its node, so steering with node SIDs keeps the multipathing a pinned RSVP-TE circuit forfeits. The unit of intent is the SR policy - keyed by (color, endpoint) - holding candidate paths, each one or more segment lists. Getting traffic into a policy is a routing property, not PBR plumbing: the egress tags its service routes with a color extended community, and the ingress steers any route whose color and next hop match a policy into it (automated steering); with On-Demand Next-hop (ODN) the ingress does not even pre-provision the policy - the first colored route instantiates it from a template, so intent scales as one route-policy line instead of per-destination configuration. Two deployment shapes bound the design space. Dynamic policies let the head-end - or a controller fed by BGP-LS topology + PCEP for bandwidth-aware or disjointness computation - compute toward an objective (min-delay, affinity-constrained, disjoint from a peer policy). Circuit-style policies are the opposite pole: explicit, persistent, co-routed segment lists used as circuit replacements where capacity must be accountable - traffic spreads by WECMP (weighted ECMP across the policy's parallel segment lists), and per-segment-list validity turns failure into arithmetic: an SL whose SID becomes unreachable is withdrawn from the spread, the survivors carry on, and the remaining guaranteed capacity is computable rather than hash-dependent (Bandwidth and capacity planning applies exactly this to AI DCI floors).

Flex-Algo - slicing inside the IGP

Flex-Algo turns one physical network into several virtual topologies without tunnels or a controller: an algorithm is a network-wide definition - an optimisation metric (IGP cost, delay, TE, custom) plus constraints (include/exclude link affinities; nodes that do or do not participate) - and each participating node runs a separate SPF per algo and advertises a per-algo SID/locator for itself. One SID then expresses an intent that would otherwise need a long explicit path: forward to the destination's min-delay SID and every hop is delay-optimal; forward to its MACsec-only SID and the path never leaves encrypted links (MACsec and secure transport). The canonical slices: low-latency planes, sovereign or geography-avoiding planes, wholesale-backhaul planes, affinity-built disjoint plane-A/plane-B pairs. Two properties keep it operationally cheap: the slices are wholly IGP-managed (topology changes reconverge each algo like any SPF - self-healing, no controller in the repair loop), and TI-LFA is slice-aware - the backup is computed inside the same algo topology, so protection never violates the slice's constraint (Fast convergence techniques). Name the costs too: every algo is another SPF plus FIB state on every node, and constraint design is partition design - exclude too much and a slice disconnects while algo-0 stays healthy, so validate reachability per algo, not just for the default topology.

SRv6 and uSID - the IPv6-native pole

In SRv6 a SID is an IPv6 address with structure: a locator (the routed part naming the node) plus a function the node executes - uN (node, shortest path), uA (adjacency cross-connect), uDT4/uDT6 (decapsulate and look up in a per-VRF table: the L3VPN service), uDX2 (L2 cross-connect) and friends (RFC 8986 network programming). Classic SRv6 carries the SID list in the SRH, an IPv6 routing extension header (RFC 8754); uSID compresses the common case away: a shared block (allocated from ULA space) followed by a train of 16-bit micro-SIDs packed into the one 128-bit destination address, each hop consuming its own uSID and shifting the next up. That yields the load-bearing design fact: transit routers need only plain-IPv6 longest-prefix match. The IGP advertises each node's locator as an ordinary /48, and a multi-hop source-routed path plus the terminal VPN function travel in what looks like a normal IPv6 destination - only the SR edges understand SR at all.

That single fact re-opens the door MPLS closed: transport summarisation. Label switching binds labels to FECs, so every PE loopback must exist as a host route in every domain it transits - the reason multi-domain MPLS grew BGP-LU seamless-MPLS and the inter-AS Option A/B/C machinery (BGP in enterprise design, MPLS L3VPN and L2VPN). SRv6 locators are just prefixes: domain borders advertise summaries per domain - even per Flex-Algo plane (a low-cost /40 and a low-delay /40 per metro), removing thousands of IGP routes and the inter-AS option question with them (Route aggregation and summarization). The address arithmetic scales with it - one /16 block yields on the order of four billion global node locators plus a 32-bit local function space per node - and services need no label protocol at all: BGP announces "this VRF prefix via B:node:function

", the ingress performs plain IPv6-in-IPv6 encapsulation toward that SID, and the entire transport stack is the IPv6 RIB/FIB.

Two capabilities fall out almost for free. Service chaining becomes path programming: to pass a firewall that knows nothing of SR, steer by uN (its service leaf) + uA (the appliance-facing adjacency) - the appliance receives, inspects the inner packet, and forwards as a plain IPv6 router (no encap/decap, no PBR or per-hop VRF hand-offs); an SRv6-aware VNF later holds its own SID and can attach anywhere in the v6 network. The demand matrix becomes deterministic: SRv6 nodes keep hardware counters per locator - per destination and per algo - and per segment list for policies, streamed via gNMI/YANG-push (Network management - traditional vs model-driven); because every packet names its destination-intent in the address, the traffic matrix is a byproduct of forwarding state - automated, realtime, and exact (no sampling, no collector inference) - the missing input for capacity planning, bandwidth optimisation, and coordinated maintenance.

The reach extends to the host: a Linux node with FRR on the kernel data plane, VPP, or Cilium/eBPF can originate and terminate SRv6 itself - the compute node becomes the PE, holding a locator and speaking MP-BGP - which collapses the classic stitched architecture (EVPN-VXLAN inside the DC, L3VPN over SR-MPLS in the WAN, stitching gateways at the DCI) into one end-to-end domain: end-to-end VRFs to the workload, TE initiated at the source, no gateway tier to scale or troubleshoot (Overlays and BGP EVPN, Connectivity models and SDN in AI fabrics). Multivendor proof-of-concept honesty tempers the pitch: uSID interops across vendors and dual SR-MPLS + SRv6 P/PE coexistence works (dual-plane IS-IS - the v4 topology carrying SR-MPLS, the v6 topology SRv6 - so brownfield enables SRv6 only on new edge nodes), but the edges are real: RFC 8950-style v4-over-v6 next-hop compliance and locator attributes at redistribution points vary by vendor, stitching-gateway feature parity is uneven, host-side SR-TE in FRR is static steering only, and kernel forwarding tops out early (VPP-class data planes buy performance with in-house engineering). Production anchors exist at both ends of the network: a hyperscale AI back-end load-balances deterministically with uSID on SONiC (Load balancing in AI fabrics - flow, flowlet, packet spray), and circuit-style SR-TE DCI carries contracted AI-fabric bandwidth between countries (Bandwidth and capacity planning).

Comparison

sr-dataplane-matrix

Migrating from LDP (coexistence, SRMS, and the order of operations)

SR and LDP coexist ships-in-the-night: both control planes label the same routes, and forwarding simply prefers LDP until told otherwise - so migration is make-before-break in three phases: (1) enable SR everywhere it can run, LDP stays preferred; (2) flip the preference to SR, node by node, at your own pace; (3) retire LDP (and RSVP-TE last, if present). Where SR and LDP islands must interwork, border nodes stitch labels automatically - swapping an SR label for an LDP label and back - with one gap: LDP-only routers cannot advertise prefix-SIDs, so a Segment Routing Mapping Server (SRMS) advertises SIDs on their behalf via the IGP (deploy it redundantly; it is control-plane-critical for as long as any LDP island exists). Plan the SRGB once, network-wide, before step one - a shared, human-readable base keeps SIDs globally meaningful. Two design bonuses fall out of coexistence: TI-LFA can protect LDP-carried traffic before the migration finishes, and finishing it eliminates targeted-LDP session sprawl (MPLS fundamentals).

Multicast after LDP retirement

SR replicates nothing: there is no native P2MP in SR-MPLS, so "retire LDP" carries a multicast asterisk. Either mLDP stays alive for multicast alone - mLDP-only Session Advertisement Control (RFC 7473) negotiates the LDP session down to multicast label bindings only, so unicast keeps its SR-only simplicity - or the trees move to Tree-SID, where the SR-PCE controller computes P2MP trees from SR MPLS labels (static or BGP-mVPN-signalled), adding a controller dependency to the multicast plane (Multicast routing design - PIM, RP, MSDP).

Why it matters for design

SR is the modern replacement for LDP/RSVP-TE: a simpler, stateless core plus powerful services - TI-LFA (~100% fast-reroute coverage, see Fast convergence techniques), SR-TE explicit/optimized paths, Flex-Algo (custom IGP planes by metric/constraint), and on-demand steering. SRv6 additionally collapses underlay + services into IPv6.

IPv6 / dual-stack note

SRv6 is native IPv6; SR-MPLS carries v4 and v6 via the IGP/MP-BGP. SRv6 is a strong answer to a "v6-first" design requirement.

Spaced repetition

What state does Segment Routing remove from the core, and how is path state carried instead?

It removes LDP/RSVP per-LSP state; the path is carried in the packet as a stack of SIDs (source routing).

The two SR data planes are ==SR-MPLS (SIDs = labels)[...]SRv6 (SIDs = IPv6 addresses)==.

The two SR data planes are ==SR-MPLS (SIDs = labels) and SRv6 (SIDs = IPv6 addresses)==.

SR's fast-reroute mechanism giving ~100% coverage on the post-convergence path is [...].

SR's fast-reroute mechanism giving ~100% coverage on the post-convergence path is TI-LFA.

Custom IGP topologies/planes defined by metric or constraint in SR are called [...].

Custom IGP topologies/planes defined by metric or constraint in SR are called Flex-Algo.

How do you migrate an LDP core to Segment Routing without an outage?

Ships-in-the-night coexistence in three phases - enable SR with LDP still preferred, flip preference to SR per node, then retire LDP (RSVP-TE last). Borders stitch SR<->LDP labels automatically; an SRMS (deployed redundantly) advertises prefix-SIDs on behalf of LDP-only routers; plan one network-wide SRGB before starting.

How does traffic enter an SR-TE policy without PBR, and what does ODN add?

Automated steering - service routes carry a color extended community and the ingress steers any route whose color and next hop match a policy; ODN instantiates the policy on demand from a template when the first colored route arrives, so intent is a route-policy line, not per-destination config.

Why can SRv6 uSID traffic cross routers that know nothing about SR?

The micro-SID train is packed into one 128-bit IPv6 destination under a common block, and locators are advertised as ordinary /48s - transit does plain longest-prefix match; only the SR edges parse SR semantics.

What long-standing MPLS transport limitation does SRv6 remove at domain boundaries, and what workarounds disappear?

MPLS cannot summarise transport (label-per-FEC needs PE host routes in every domain), which forced BGP-LU seamless-MPLS and inter-AS Options A/B/C; SRv6 locators are plain IPv6 prefixes, so borders advertise per-domain (even per-Flex-Algo) summaries instead.

A [...] pins explicit persistent segment lists, spreads load with WECMP, and tracks per-SL validity - so guaranteed capacity stays computable under failure.

A circuit-style SR policy pins explicit persistent segment lists, spreads load with WECMP, and tracks per-SL validity - so guaranteed capacity stays computable under failure.

In Flex-Algo, TI-LFA computes the backup [...], so fast-reroute never violates the slice's constraint.

In Flex-Algo, TI-LFA computes the backup inside the same algo topology, so fast-reroute never violates the slice's constraint.

In an SR-MPLS core, multicast needs either [...] or [...] - SR itself has no native replication.

In an SR-MPLS core, multicast needs either mLDP kept alive via mLDP-only SAC (RFC 7473) or controller-computed Tree-SID P2MP trees - SR itself has no native replication.

Sources

  • Cisco Live BRKENT-2004 (CLUS 2022): mLDP-only SAC and the Tree-SID fork for multicast after LDP retirement.
  • Cisco Live BRKSP-2551 (2026), Introduction to Segment Routing - A foundation for Autonomous Networks (Donzelli, Cisco / Gorovoy, Nebius; incl. the Microsoft AI-fabric and Nebius DCI material)
  • Cisco Press, Segment Routing; Cisco SR documentation.

domain: Core · blueprint-ref: Core 5.1.d Segment routing · type: concept · status: complete · tags: [core, core/virtualization, tradeoff/scale, tradeoff/convergence]

Read more