IPv6 routing — static routes, OSPFv3, BGP, MP-BGP, IPv6 in VRF

The routing protocols for IPv6 are deliberately similar to their IPv4 counterparts but with sharp differences at the wire level. Static routes use the same administrative distance model. OSPFv3 is a new protocol (not “OSPFv2 with IPv6”) with a different LSA format and different link-local semantics. BGP uses the same TCP/179 session model but carries IPv6 NLRI in the Multiprotocol Extensions (MP-BGP).

A production network engineer must operate all three. The lesson walks through the configuration on VyOS 1.5 LTS, the validation commands, and the failure modes that surface when the control plane and the data plane disagree.

IPv6 static routes

flowchart LR
  A[Router A<br/>2001:db8:1::1/64] -->|via 2001:db8:1::2| B[Router B<br/>2001:db8:1::2]
  B --> C[Router C<br/>2001:db8:2::1/64]
  A -.->|static route<br/>2001:db8:2::/64 next-hop 2001:db8:1::2| C

A static IPv6 route on VyOS:

configure
set protocols static route6 '2001:db8:2::/64' interface 'eth1'
set protocols static route6 '2001:db8:2::/64' next-hop '2001:db8:1::2'
set protocols static route6 '2001:db8:abcd::/48' interface 'eth0'
commit
save

Two configuration shapes:

• Interface-only — the route is reachable via the interface, regardless of next-hop. Used for point-to-point links.
• Next-hop — explicit next-hop. Used for Ethernet links where the next-hop IP is known.

The administrative distance for static IPv6 routes is 1 by default, identical to static IPv4. Floating static routes use a higher distance:

set protocols static route6 '2001:db8:2::/64' next-hop '2001:db8:1::2' distance '200'

Distance 200 is typical for a backup route that should lose to any dynamic protocol.

OSPFv3 — IPv6 successor to OSPFv2

sequenceDiagram
  autonumber
  participant R1 as Router A<br/>fe80::1
  participant R2 as Router B<br/>fe80::2

  R1->>R2: Hello (ff02::5)<br/>router-id 1.1.1.1
  R2-->>R1: Hello (ff02::5)<br/>router-id 2.2.2.2
  R1->>R2: Database Description
  R2-->>R1: Database Description
  R1->>R2: Link State Request
  R2-->>R1: Link State Update
  R1->>R2: Link State Ack
  Note over R1,R2: adjacency Full<br/>LSAs exchanged

OSPFv3 is not “OSPFv2 with IPv6 addresses”. It is a new protocol, defined in RFC 5340, with:

• A new LSA format (LSA type 1 carries router information; type 2 is for networks; type 3 and 4 are inter-area; type 5 is external; type 7 is NSSA; types 8 and 9 are link-local and intra-area-prefix LSAs specific to IPv6)
• Link-local addresses as the source of all OSPF packets
• IPv6 addresses carried as opaque data in the LSAs, not as protocol fields
• Authentication via IPsec AH/ESP, not the OSPFv2-style authentication key

The router-id is still a 32-bit value, usually configured explicitly:

configure
set protocols ospfv3 parameters router-id '1.1.1.1'
set interfaces ethernet eth0 ipv6 ospfv3 area '0'
set interfaces ethernet eth0 ipv6 ospfv3 instance-id '0'
set interfaces ethernet eth1 ipv6 ospfv3 area '0'
set interfaces ethernet eth1 ipv6 ospfv3 passive
commit
save

The router-id is the OSPFv3 router-id (still a 32-bit value). The instance-id lets the operator run multiple OSPFv3 instances on the same interface (a feature OSPFv2 did not have). The area '0' is the backbone area; area numbers follow the same conventions as OSPFv2.

The interface must be IPv6-enabled and have a link-local address. The passive directive tells OSPFv3 not to send Hello packets on that interface (the interface still participates in the OSPFv3 topology, just doesn’t establish adjacencies).

BGP for IPv6 and MP-BGP

flowchart LR
  A[Router A<br/>AS 65001] -->|TCP 179<br/>MP-BGP| B[Router B<br/>AS 65002]
  A -.->|carries IPv4 NLRI<br/>AFI 1 SAFI 1| B
  A -.->|carries IPv6 NLRI<br/>AFI 2 SAFI 1| B

BGP for IPv6 uses the Multiprotocol Extensions (RFC 4760). The same TCP/179 session that carries IPv4 NLRI can carry IPv6 NLRI simultaneously. The NLRI is tagged with an Address Family Identifier (AFI) and Subsequent AFI (SAFI):

• AFI 1, SAFI 1 — IPv4 unicast
• AFI 2, SAFI 1 — IPv6 unicast
• AFI 1, SAFI 128 — MPLS-labeled VPNv4
• AFI 2, SAFI 128 — MPLS-labeled VPNv6
• AFI 25, SAFI 70 — EVPN

The session is a regular BGP session; the Multiprotocol extensions just say “I also have these NLRI families to discuss”. A single TCP/179 session can carry all of them.

configure
set protocols bgp 65001 neighbor 2001:db8:ffff::2 remote-as '65002'
set protocols bgp 65001 address-family ipv6-unicast neighbor 2001:db8:ffff::2 activate
set protocols bgp 65001 address-family ipv6-unicast network '2001:db8:1::/48'
set protocols bgp 65001 address-family ipv6-unicast redistribute connected
commit
save

The configuration creates a BGP session to 2001:db8:ffff::2 in AS 65002, activates the IPv6-unicast address family on that neighbour, and originates 2001:db8:1::/48 plus redistributes connected IPv6 routes.

vyos@vyos:~$ show bgp ipv6 unicast summary
Neighbor        V    AS    MsgRcvd    MsgSent    Up/Down    State/PfxRcd
2001:db8:ffff::2 4 65002       152       187     02:14:32       4

The show bgp ipv6 unicast summary is the operator’s view of the IPv6 BGP table. The state is 4 (Established) and the prefix count is 4.

IPv6 inside a VRF

flowchart TB
  subgraph G[Global table]
    GE0[eth0<br/>2001:db8:1::1]
    GR[default route]
  end
  subgraph T[Tenant-A VRF]
    TE0[vrf-A eth0<br/>fd00:1234:1::1]
    TR[vrf-A route]
  end
  subgraph T2[Tenant-B VRF]
    T2E0[vrf-B eth0<br/>fd00:5678:1::1]
    T2R[vrf-B route]
  end
  GE0 -.-> T
  T -.-> G

IPv6 routing inside a VRF works the same way as IPv4 inside a VRF. The VyOS configuration creates a VRF, binds interfaces to it, and runs routing protocols inside the VRF:

configure
set vrf name TENANT-A table '1000'
set interfaces ethernet eth1 vrf 'TENANT-A'
set interfaces ethernet eth1 ipv6 address 'fd00:1234:1::1/64'
set vrf name TENANT-A protocols static route6 '::/0' next-hop 'fd00:1234:1::254'
commit
save

The interface eth1 is bound to the TENANT-A VRF. The VRF has its own routing table (table 1000). The static default route is installed only in the VRF table, not the global table. The lesson vyos-xv-02-vrf-config covers the VRF foundation.

How the routing configuration is validated

show ipv6 route
show ipv6 route summary
show ip ospfv3 neighbor
show ip ospfv3 database
show ip ospfv6 interface
show bgp ipv6 unicast summary
show bgp ipv6 unicast
show bgp ipv6 unicast neighbors 2001:db8:ffff::2
show vrf
ip -6 route show
ip -6 route show table 1000
vtysh -c 'show ipv6 ospf'

The first command is the VyOS view. The next two are the OSPFv3 view from FRR. The next four are the BGP IPv6 view. The show vrf lists the VRFs. The ip -6 route show is the Linux kernel view. The vtysh invocation opens the FRR shell where the operator can run any FRR command directly.

A working configuration has populated neighbour tables, adjacencies in the Full state, BGP sessions in the Established state, and routes installed in both the FRR RIB and the kernel FIB.

How it fails

The production failure modes the engineer must recognise:

• OSPFv3 router-id conflict. Two routers with the same router-id refuse to form an adjacency. FRR logs a duplicate router-id error.
• OSPFv3 instance-id mismatch. Two interfaces on the same link with different instance-ids do not peer. Adjacency stuck in ExStart.
• BGP IPv6 NLRI not activated. The neighbour is configured but address-family ipv6-unicast is not activated. The session establishes but no IPv6 prefixes are exchanged.
• BGP next-hop unreachable in iBGP. Link-local next-hop with no route from the peer to the link-local. Route received but not installed.
• IPv6 routes not redistributed into BGP. Connected IPv6 routes on the LAN are not in BGP. The upstream provider cannot reach them.
• VRF route-leak silent. A route leaked from VRF TENANT-A into the global table exposes tenant traffic. No log message by default; only the prefix-list audit catches it.
• MP-BGP with old BGP speaker. A neighbour that does not support MP-BGP silently drops the IPv6 NLRI.

Rollback

The recovery from a bad IPv6 routing configuration:

• Wrong static route: delete protocols static route6 ... and re-add with the correct next-hop before commit; save.
• OSPFv3 mismatch: delete protocols ospfv3 and reconfigure with matching router-id and instance-id.
• BGP not activating: set protocols bgp ... address-family ipv6-unicast neighbor ... activate and commit; save.
• VRF leak: delete vrf name TENANT-A protocols ... route-map that permitted the leak.
• Wrong next-hop: set protocols bgp ... neighbor ... next-hop-self to force a reachable next-hop.

Production discipline

Cross-course references

The Linux course’s XIX-Linux-NetFoundations covers the kernel FIB and the routing table model. The VyOS lessons vyos-xii-01-static-route-config, vyos-xix-01-router-id, and vyos-xxiii-01-as-numbers cover the IPv4 routing primitives this lesson assumes. The lessons vyos-xv-02-vrf-config, vyos-xxi-02-ospfv3-config, and vyos-xxiv-01-bgp-config cover the specific protocol extensions in more depth.

Quiz