OSPFv3 with BGP — BGP carrying OSPFv3 routes, IPv6 NLRI, route-map filtering

OSPFv3 runs inside the autonomous system; BGP runs at the edge and between autonomous systems. The two protocols meet at the provider edge (PE), where OSPFv3-learned IPv6 routes are redistributed into BGP and BGP-learned IPv6 routes are redistributed into OSPFv3. The redistribution must be filtered carefully — a missing filter leaks internal prefixes externally or external prefixes internally.

This lesson covers the OSPFv3-BGP coexistence: BGP IPv6 NLRI configuration on VyOS 1.5 LTS, redistribution between the two protocols, route-map filtering at the boundary, and the production scenarios for service-provider IPv6 transit.

BGP IPv6 NLRI basics

BGP carries IPv6 routes via Multiprotocol Extensions (RFC 4760). The IPv6 address family is a separate BGP capability from the IPv4 address family. A BGP session can carry both.

The configuration on a VyOS 1.5 LTS BGP speaker with both IPv4 and IPv6:

set protocols bgp system-as 64500
set protocols bgp neighbor 192.0.2.1 remote-as 64501
set protocols bgp neighbor 192.0.2.1 address-family ipv4 unicast
set protocols bgp neighbor 2001:db8:pe::1 remote-as 64501
set protocols bgp neighbor 2001:db8:pe::1 address-family ipv6 unicast
commit
save

The IPv6 BGP session uses the global unicast IPv6 address of the peer. The session is over TCP/179; the address-family is ipv6 unicast.

sequenceDiagram
  participant R1 as PE router
  participant R2 as Upstream provider
  R1->>R2: TCP/179 OPEN<br/>AFI=1 (IPv4), AFI=2 (IPv6)
  R2->>R1: OPEN ACK<br/>AFI=1, AFI=2
  Note over R1,R2: Both IPv4 and IPv6 address families<br/>negotiated
  R1->>R2: UPDATE IPv4 NLRI<br/>10.99.0.0/16
  R1->>R2: UPDATE IPv6 NLRI<br/>2001:db8:99::/48
  R2->>R1: UPDATE IPv4 NLRI<br/>203.0.113.0/24
  R2->>R1: UPDATE IPv6 NLRI<br/>2001:db8:100::/48

The address-family ipv6 unicast block enables the IPv6 address family on the session. Without it, the session carries only IPv4.

Redistribution from OSPFv3 into BGP

A PE router redistributes internal OSPFv3-learned IPv6 routes into BGP so that the upstream provider can see them:

# IPv6 prefix-list for the prefixes to advertise
set policy prefix-list6 INTERNAL-IPV6 rule 10 action permit
set policy prefix-list6 INTERNAL-IPV6 rule 10 prefix 2001:db8:1::/48
set policy prefix-list6 INTERNAL-IPV6 rule 10 ge 48

# Route-map for the redistribution
set policy route-map OSPFv3-INTO-BGP rule 10 action permit
set policy route-map OSPFv3-INTO-BGP rule 10 match ipv6 address prefix-list INTERNAL-IPV6
set policy route-map OSPFv3-INTO-BGP rule 10 set metric 100

# Redistribute
set protocols bgp address-family ipv6 unicast redistribute ospfv3 route-map OSPFv3-INTO-BGP
commit
save

The route-map applies the metric and filters the prefixes that the BGP session will advertise. Without the route-map, the BGP session would advertise every OSPFv3-learned prefix.

flowchart LR
  subgraph "OSPFv3 RIB"
    A1["2001:db8:1::/48<br/>internal"]
    A2["2001:db8:99::/48<br/>DMZ"]
    A3["::/0<br/>default via upstream"]
  end
  subgraph "route-map OSPFv3-INTO-BGP"
    R1["rule 10: match INTERNAL-IPV6<br/>set metric 100"]
  end
  subgraph "BGP IPv6 RIB"
    B1["2001:db8:1::/48<br/>metric 100<br/>next-hop 2001:db8:pe::1"]
  end
  A1 --> R1
  A2 --> R1
  A3 --> R1
  R1 -- "permit" --> B1

The route-map must filter aggressively. The operator should never advertise internal infrastructure prefixes (loopbacks, point-to-point links, management networks) externally. The INTERNAL-IPV6 prefix-list is the audit surface for what is advertised.

Redistribution from BGP into OSPFv3

The reverse direction — BGP-learned IPv6 routes into OSPFv3 — is configured at the same PE router:

set policy prefix-list6 EXTERNAL-IPV6 rule 10 action permit
set policy prefix-list6 EXTERNAL-IPV6 rule 10 prefix 2001:db8:100::/48

set policy route-map BGP-INTO-OSPFv3 rule 10 action permit
set policy route-map BGP-INTO-OSPFv3 rule 10 match ipv6 address prefix-list EXTERNAL-IPV6
set policy route-map BGP-INTO-OSPFv3 rule 10 set metric 100

set protocols ospfv3 redistribute bgp route-map BGP-INTO-OSPFv3
commit
save

The redistribution takes BGP-learned IPv6 routes and redistributes them into OSPFv3 as Type 5 LSAs. The route-map filters the prefixes (typically only the upstream’s allocation) and sets the metric.

flowchart LR
  subgraph "BGP IPv6 RIB"
    A1["2001:db8:100::/48<br/>upstream provider"]
    A2["2001:db8:200::/48<br/>peer AS"]
  end
  subgraph "route-map BGP-INTO-OSPFv3"
    R1["rule 10: match EXTERNAL-IPV6<br/>set metric 100"]
  end
  subgraph "OSPFv3 LSDB"
    B1["Type 5 AS-External<br/>2001:db8:100::/48 metric 100"]
  end
  A1 --> R1
  A2 --> R1
  R1 -- "permit" --> B1

The OSPFv3 Type 5 LSA is flooded area-wide. Downstream OSPFv3 routers install the route in their IPv6 RIB.

Validation

The validation command set for OSPFv3-BGP coexistence:

# BGP
show ip bgp summary
show ipv6 bgp summary
show ipv6 bgp
show ipv6 bgp neighbors 2001:db8:pe::1
show ipv6 bgp neighbors 2001:db8:pe::1 advertised-routes
show ipv6 bgp neighbors 2001:db8:pe::1 received-routes
show ipv6 route bgp

# OSPFv3
show ipv6 ospf6 database external
show ipv6 ospf6 database external self-originate verbose
show ipv6 route ospf6

A working baseline shows:

• BGP session is Established (state code 6).
• IPv6 BGP RIB has the upstream’s prefixes with the correct next-hop and AS-path.
• OSPFv3 LSDB has Type 5 LSAs for the redistributed prefixes.
• OSPFv3 RIB has the external IPv6 routes via OSPFv3.

Production scenarios

Scenario 1 — Service provider IPv6 transit

A service provider offers IPv6 transit. The customer has internal OSPFv3. The PE router is the boundary:

flowchart TB
  subgraph "Customer AS 64500"
    C1["OSPFv3 internal<br/>2001:db8:1::/48"]
    C2["OSPFv3 internal<br/>2001:db8:2::/48"]
    PE["PE router<br/>OSPFv3 + BGP IPv6"]
  end
  subgraph "Provider AS 64501"
    UP["Upstream provider<br/>BGP IPv6"]
  end
  C1 -- "OSPFv3" --> PE
  C2 -- "OSPFv3" --> PE
  PE -- "BGP IPv6<br/>redistribute ospfv3" --> UP
  UP -- "BGP IPv6<br/>redistribute into ospfv3" --> PE

The PE redistributes the customer’s internal IPv6 prefixes into BGP (advertised to the provider) and the provider’s IPv6 prefixes into OSPFv3 (advertised to the internal routers).

The PE’s configuration:

# Internal OSPFv3
set protocols ospfv3 parameters router-id 10.255.0.1
set protocols ospfv3 area 0 interface eth0

# BGP to provider
set protocols bgp system-as 64500
set protocols bgp neighbor 2001:db8:pe::1 remote-as 64501
set protocols bgp neighbor 2001:db8:pe::1 address-family ipv6 unicast

# Redistribution
set policy prefix-list6 CUSTOMER-INTERNAL rule 10 action permit
set policy prefix-list6 CUSTOMER-INTERNAL rule 10 prefix 2001:db8::/32
set policy prefix-list6 CUSTOMER-INTERNAL rule 10 ge 32

set policy route-map OSPFv3-INTO-BGP rule 10 action permit
set policy route-map OSPFv3-INTO-BGP rule 10 match ipv6 address prefix-list CUSTOMER-INTERNAL

set protocols bgp address-family ipv6 unicast redistribute ospfv3 route-map OSPFv3-INTO-BGP
commit
save

The CUSTOMER-INTERNAL prefix-list is the audit surface: only the customer’s IPv6 allocation is advertised to the provider.

Scenario 2 — Multi-homed IPv6 transit

A multi-homed customer has two upstream providers (AS 64501 and AS 64502). The PE has two BGP sessions:

set protocols bgp system-as 64500
set protocols bgp neighbor 2001:db8:pe1::1 remote-as 64501
set protocols bgp neighbor 2001:db8:pe1::1 address-family ipv6 unicast
set protocols bgp neighbor 2001:db8:pe2::1 remote-as 64502
set protocols bgp neighbor 2001:db8:pe2::1 address-family ipv6 unicast

# Both sessions redistribute OSPFv3 with a route-map
set protocols bgp address-family ipv6 unicast redistribute ospfv3 route-map OSPFv3-INTO-BGP
commit
save

The customer has two upstreams; the upstream’s IPv6 routes are redistributed into OSPFv3 with the appropriate metric. The operator monitors the BGP sessions and the OSPFv3 LSDB for Type 5 LSAs from the redistribution.

Scenario 3 — IPv6-only edge with IPv4 islands

A customer has an IPv6-only edge (BGP IPv6 to the upstream) but IPv4-only internal islands. The PE redistributes in both directions:

# IPv4 internal
set protocols ospf area 0 network 10.0.0.0/24

# IPv6 internal
set protocols ospfv3 area 0 interface eth0

# BGP IPv6 to upstream
set protocols bgp system-as 64500
set protocols bgp neighbor 2001:db8:pe::1 remote-as 64501
set protocols bgp neighbor 2001:db8:pe::1 address-family ipv6 unicast

# Redistribution
set protocols ospfv3 redistribute bgp route-map BGP-INTO-OSPFv3
set protocols bgp address-family ipv6 unicast redistribute ospfv3 route-map OSPFv3-INTO-BGP
commit
save

The PE is the integration point: IPv4 inside, IPv6 outside, with the redistribution at the PE.

Scenario 4 — IPv6 route-filter with route-map

A common production scenario: the operator wants to advertise only the customer’s IPv6 allocation, not internal infrastructure prefixes:

set policy prefix-list6 ADVERTISE-IPV6 rule 10 action permit
set policy prefix-list6 ADVERTISE-IPV6 rule 10 prefix 2001:db8:1::/48

set policy route-map ADVERTISE rule 10 action permit
set policy route-map ADVERTISE rule 10 match ipv6 address prefix-list ADVERTISE-IPV6

set protocols bgp neighbor 2001:db8:pe::1 address-family ipv6 unicast route-map ADVERTISE out
commit
save

The route-map ADVERTISE out on the BGP neighbor applies the filter to the outbound UPDATE messages. The internal infrastructure prefixes (loopback, point-to-point links, management networks) are not advertised to the upstream.

sequenceDiagram
  participant PE
  participant UP as Upstream
  PE->>UP: UPDATE<br/>NLRI: 2001:db8:1::/48<br/>(advertised)
  PE-->>UP: (loopback 2001:db8:0:1::1/128 not advertised)
  PE-->>UP: (point-to-point 2001:db8:0:0::/64 not advertised)

Operational playbook

The OSPFv3-BGP operational playbook:

1. Configure OSPFv3 first. set protocols ospfv3 ... block, validate with show ipv6 ospf6 neighbor.
2. Configure BGP IPv6. set protocols bgp ... neighbor ... address-family ipv6 unicast.
3. Configure the redistribution. With route-maps and prefix-lists, applied at both ends.
4. Validate the BGP session. show ipv6 bgp summary shows the session state.
5. Validate the redistribution. show ipv6 bgp neighbors ... advertised-routes shows what is sent; show ipv6 ospf6 database external self-originate shows what is generated.
6. Validate the IPv6 RIBs. show ipv6 route ospf6, show ipv6 route bgp.

Production failure modes

• Redistribution without route-map. Internal prefixes are leaked externally. The fix is to apply a route-map with an explicit prefix-list.
• BGP IPv6 NLRI not enabled. The BGP session is Established but IPv6 routes are not exchanged. The fix is to enable address-family ipv6 unicast on the BGP neighbor.
• IPv6 firewall blocks BGP. The IPv6 firewall has rules that drop TCP/179 traffic. The fix is to add an explicit BGP rule.
• Route-map chain broken. The route-map references a prefix-list that does not exist. The redistribution does not generate any LSAs. The fix is to verify the prefix-list is configured.
• Next-hop unreachable. The BGP route’s next-hop (the upstream’s IPv6 address) is not reachable from the local router. The fix is to add an OSPFv3 route to the upstream.

Rollback

The OSPFv3-BGP rollback path:

# Remove the redistribution
delete protocols bgp address-family ipv6 unicast redistribute ospfv3
commit
save

# Remove the BGP neighbor
delete protocols bgp neighbor 2001:db8:pe::1
commit
save

# Full rollback
rollback N
commit

For redistribution changes, use commit-confirm because the change affects the upstream’s view of the local AS’s IPv6 prefixes.

Production discipline

Cross-course references

The OSPFv3 lessons vyos-xxi-01-ospfv3-concept (concept), vyos-xxi-02-ospfv3-config (configuration), vyos-xxi-05-dual-stack-ospf (dual-stack), and vyos-xxi-04-ospfv3-troubleshoot (troubleshooting) cover the OSPFv3 primitives. The BGP fundamentals lesson vyos-xxiii-04-bgp-rib covers the BGP RIB; the BGP attribute and route-map lessons (Parts XXVI / XXVIII) cover the BGP filtering primitives. The IPv6 lessons vyos-xi-01-ipv6-fundamentals through vyos-xi-06-ipv6-troubleshoot cover the IPv6 primitives.

Quiz