↓ Skip to main content
KAZULOG.INFO
  1. Network Articles/
  2. BGP Articles/

MP-BGP (Multiprotocol Extensions)

Table of Contents

What MP-BGP is

BGP was originally a protocol that carried IPv4 unicast routes only. MP-BGP (Multiprotocol Extensions for BGP-4, RFC 4760) is the extension that lets it carry reachability information for other address families such as IPv6, VPN, and L2VPN.

The mechanism is simple: two path attributes were added to the UPDATE message.

AttributeType codeRole
MP_REACH_NLRI14“For this address family, these destinations are reachable via this next hop”
MP_UNREACH_NLRI15“For this address family, withdraw these destinations”

Both are optional non-transitive. RFC 4760 says this classification was chosen deliberately so that a router that does not support them ignores the attributes and does not pass them on. The message formats, the state machine, and best-path selection are unchanged, so one TCP session (port 179) can carry several address families at once.

Address families (AFI / SAFI)

The kind of route being carried is identified by the pair AFI (Address Family Identifier, 2 bytes) and SAFI (Subsequent AFI, 1 byte). The AFI is the network-layer protocol; the SAFI is how it is used.

AFI / SAFIRoutesUsed for
1 / 1IPv4 unicastOrdinary IPv4
2 / 1IPv6 unicastOrdinary IPv6
1 / 2, 2 / 2IPv4 / IPv6 multicastRPF routes for multicast
1 / 4, 2 / 4IPv4 / IPv6 labeled unicastLabeled unicast (RFC 8277)
1 / 128, 2 / 128VPNv4 / VPNv6MPLS L3VPN (RFC 4364)
25 / 65, 25 / 70VPLS, EVPNL2VPN
16388 / 71BGP-LSIGP link-state information

AFI values come from the IANA Address Family Numbers registry. RFC 4760 defines SAFI 1 (unicast) and 2 (multicast); IANA manages the rest.

Each address family has its own BGP table and its own policy. On IOS XR you write network statements and route-policy per address-family block.

MP_REACH_NLRI and MP_UNREACH_NLRI

Format of the MP_REACH_NLRI attribute value

MP_REACH_NLRI puts the next hop and the destination prefixes into one attribute together with the AFI / SAFI. In the RFC 4271 base format the next hop is the NEXT_HOP attribute (NEXT_HOP) and the prefixes are the NLRI field of the UPDATE body. Those are moved inside the attribute, and because the next hop length is given by a one-byte field, the address type is not fixed (4 for IPv4, 16 or 32 for IPv6).

Format of the MP_UNREACH_NLRI attribute value

MP_UNREACH_NLRI is just the AFI / SAFI and the prefixes to withdraw. In both attributes the NLRI is encoded as <length in bits, prefix>, the same as in RFC 4271.

The rules RFC 4760 defines:

RuleRFC 4760
An UPDATE carrying MP_REACH_NLRI must also carry ORIGIN and AS_PATH; in iBGP also LOCAL_PREF3 (MUST)
An UPDATE with no NLRI other than MP_REACH_NLRI should not carry the NEXT_HOP attribute; if it does, the receiver should ignore it3 (SHOULD NOT / SHOULD)
An UPDATE with only MP_UNREACH_NLRI need not carry any other attribute4
One attribute carries exactly one <AFI, SAFI>11
If the attribute is malformed, delete all routes of that AFI / SAFI; the session may be terminated (Optional Attribute Error)7

IOS XR carries IPv4 unicast routes in MP_REACH_NLRI as well (BGP messages). IPv4 withdrawals, on the other hand, use the RFC 4271 base format (the Withdrawn Routes field of the UPDATE body). IPv6 withdrawals use MP_UNREACH_NLRI.

Address families are agreed with the OPEN capability

Which address families are exchanged is announced at session establishment with the Multiprotocol Extensions Capability (capability code 1, using the mechanism of RFC 5492) in the OPEN message.

Format of the Multiprotocol Extensions Capability value
RuleDetail
One capability per supported AFI / SAFI pairCarrying IPv4 and IPv6 means two capabilities
Only AFI / SAFI pairs advertised by both sides are exchanged (RFC 4760 8, MUST)An address family advertised by one side only does not flow. A capability the peer does not know is ignored (RFC 5492 3, MUST)
With no AFI / SAFI in common, peering cannot proceedRFC 5492 3 and 5 allow a speaker to send a NOTIFICATION (OPEN Message Error / Unsupported Capability, subcode 7) and terminate (MAY) when the peer did not advertise a required capability. IOS XR sends it and keeps retrying
IOS XR resets the session when an address family is added to or removed from a neighborThe capabilities must be exchanged again. Adding an address family to a running session drops it once (syslog Address family activated)

The IPv6 next hop (RFC 2545)

How IPv6 unicast (AFI 2 / SAFI 1) is carried is defined by RFC 2545. Because IPv6 has link-local addresses, the MP_REACH_NLRI next hop comes in two forms.

Next hop lengthContentCondition (RFC 2545 3)
16Global address onlyEvery other case. When advertising to iBGP the link-local address may be removed
32Global + link-local (fe80::/10)Only when the advertising speaker, the next hop, and the receiving peer share a subnet. Directly connected eBGP is the typical case

Also, whether the TCP session runs over IPv4 or IPv6 is independent of BGP, so IPv6 routes can be carried over an IPv4 session (RFC 2545 4). Since an IPv4 session does not determine the IPv6 next hop, RFC 2545 says that additional explicit configuration is required. IOS XR uses the global IPv6 address of the interface toward the peer (the update-source interface if one is configured) as the next hop. If that interface has no global IPv6 address, the session does not come up at all, IPv4 included (Idle (No global IPv6 address configured)).

In practice, IPv6 unicast is usually carried over an IPv6 session. The next hop follows naturally and the session itself confirms IPv6 reachability (RFC 2545 4). For the opposite direction (IPv4 routes over an IPv6 session) there is the Extended Next Hop Encoding Capability (code 5, RFC 8950), which gives IPv4 routes an IPv6 next hop; XRd advertises it by default.

Configuration on IOS XR

IPv4 and IPv6 over one IPv4 session
router bgp 65002
 address-family ipv4 unicast
  network 192.168.2.0/24
 !
 address-family ipv6 unicast
  network 2001:db8:2::/64
 !
 neighbor 10.1.2.1
  remote-as 65001
  address-family ipv4 unicast
   route-policy PASS-ALL in
   route-policy TO-R1-V4 out
  !
  address-family ipv6 unicast
   route-policy PASS-ALL in
   route-policy TO-R1-V6 out
A separate session for IPv6 unicast
router bgp 65002
 neighbor 2001:db8:12::1
  remote-as 65001
  address-family ipv6 unicast
   route-policy PASS-ALL in
   route-policy TO-R1-V6 out
ItemDetail
Global address-familyEnables the address family and holds the network statements
Neighbor address-familyThe address families exchanged with that neighbor. Only those written go into the capability
show bgp ipv6 unicast …The IPv6 table, neighbors, and summary are shown with ipv6 unicast (show bgp is IPv4)
show bgp neighborsNeighbor capabilities shows advertised / received per address family. In show bgp ipv6 unicast summary a neighbor that did not agree shows (NoNeg)

Verification on real devices

Verified with three XRd 26.1.1 routers.

MP-BGP verification topology
  • R1 in AS 65001 and R2 in AS 65002 run eBGP; R2 and R3 run iBGP (Loopback0 to Loopback0, next-hop-self). AS 65002 runs OSPF (IPv6 reachability to Loopback0 is by static routes)
  • Each router advertises 192.168.N.0/24 and 2001:db8:N::/64 on Loopback1 with network statements
  • STEP 0 has IPv4 sessions only; IPv6 is added step by step. The figure shows the final state (separate IPv4 and IPv6 sessions)
  • Outbound policies have a different name per neighbor (all just pass); every neighbor has soft-reconfiguration inbound always

STEP summary

STEPChangeWhat was checkedResultMain evidence
0IPv4 unicast onlyNumber of capabilities, how IPv4 routes are carriedOne capability, AFI 1 / SAFI 1. IPv4 routes arrive in MP_REACH_NLRIR2 show bgp neighbors, pcap No.17, No.23
1Add IPv6 unicast to the IPv4 sessionsSession reset, IPv6 next hopDropped with Address family activated and re-established. Two capabilities in the OPEN. IPv6 routes arrive on the same session with the link’s global IPv6 + link-local as next hopR1 syslog, pcap No.14, No.21
2Remove the IPv6 address from R1’s linkNo address available for the next hopIdle (No global IPv6 address configured). The session does not come up, IPv4 includedR1 show bgp neighbors
3Separate IPv6 sessions (recommended)Next hop length 16 vs 32Directly connected eBGP: 32 (global + link-local); iBGP: 16 plus LOCAL_PREFpcap No.47 (R1-R2), No.38 (R2-R3)
4Only R2 adds IPv6 to the IPv4 sessionA capability advertised by one sideEstablished with IPv4 only. R2 shows advertised only and (NoNeg) in the summaryR2 show bgp neighbors, pcap No.10, No.16
5R2’s IPv4 session becomes IPv6 onlyNo address family in commonBoth sides send NOTIFICATION (OPEN Message Error / Unsupported Capability) and retry about every 30 secondspcap No.17
6Remove and restore R1’s network statements (final state)Withdrawal encodingIPv6: an UPDATE with only MP_UNREACH_NLRI; IPv4: the Withdrawn Routes fieldpcap No.11, No.15

STEP 0: IPv4 unicast only

The session with R1 as seen from R2. Neighbor capabilities lists only Address family IPv4 Unicast, and the IPv6 BGP table does not exist yet.

R2 show bgp neighbors (STEP 0)
RP/0/RP0/CPU0:R2#show bgp neighbors
Wed Sep  9 23:06:27.258 UTC
<snip>
BGP neighbor is 10.1.2.1
 Remote AS 65001, local AS 65002, external link
 Description: eBGP to R1 (AS 65001) IPv4 session
 Remote router ID 10.0.0.1
  BGP state = Established, up for 00:01:28
<snip>
  Neighbor capabilities:
    Route refresh: advertised (old + new) and received (old + new)
    4-byte AS: advertised and received
    Address family IPv4 Unicast: advertised and received
R2 show bgp ipv6 unicast summary (STEP 0)
RP/0/RP0/CPU0:R2#show bgp ipv6 unicast summary
Wed Sep  9 23:06:26.652 UTC
% None of the requested address families are configured for instance 'default'(40600)

The OPEN sent by R1 (No.17 in the R1-R2 capture). There is one Multiprotocol Extensions Capability, AFI: IPv4 / SAFI: Unicast.

No.17 OPEN (R1 → R2) tshark -V
Border Gateway Protocol - OPEN Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 75
    Type: OPEN Message (1)
<snip>
    Optional Parameters Length: 46
    Optional Parameters
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv4 (1)
                Reserved: 00
                SAFI: Unicast (1)
Download the pcap of the packet in the tshark output above (No.17 OPEN)

In the following UPDATE (No.23), the IPv4 route 192.168.1.0/24 is inside MP_REACH_NLRI (AFI 1 / SAFI 1).

No.23 UPDATE (R1 → R2) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 60
    Type: UPDATE Message (2)
<snip>
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.1.2.1
                IPv4 Address: 10.1.2.1
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.1.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.1.0
Download the pcap of the packet in the tshark output above (No.23 UPDATE)

STEP 1: adding IPv6 unicast to the IPv4 sessions

address-family ipv6 unicast is enabled on all three routers and added to the neighbors of the existing IPv4 sessions (R1-R2 and R2-R3).

R1 (R2 and R3 likewise)
router bgp 65001
 address-family ipv6 unicast
  network 2001:db8:1::/64
 !
 neighbor 10.1.2.2
  address-family ipv6 unicast
   route-policy PASS-ALL in
   route-policy TO-R2-V6 out
   soft-reconfiguration inbound always

The session drops at the moment of the commit and comes back after about 30 seconds. The syslog gives the reason as Address family activated.

R1 syslog (STEP 1)
RP/0/RP0/CPU0:Sep  9 23:08:02.839 UTC: bgp[1084]: %ROUTING-BGP-5-ADJCHANGE : neighbor 10.1.2.2 Down - Address family activated (VRF: default) (AS: 65002) 
RP/0/RP0/CPU0:Sep  9 23:08:34.336 UTC: bgp[1084]: %ROUTING-BGP-5-ADJCHANGE : neighbor 10.1.2.2 Up (VRF: default) (AS: 65002)

The OPEN after re-establishment (No.14) carries two Multiprotocol Extensions Capabilities.

No.14 OPEN (R1 → R2) tshark -V
Border Gateway Protocol - OPEN Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 83
    Type: OPEN Message (1)
<snip>
    Optional Parameters Length: 54
    Optional Parameters
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv4 (1)
                Reserved: 00
                SAFI: Unicast (1)
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv6 (2)
                Reserved: 00
                SAFI: Unicast (1)
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 2
            Capability: Route Refresh Capability (Cisco)
Download the pcap of the packet in the tshark output above (No.14 OPEN)

R2’s show bgp neighbors shows both as advertised and received.

R2 show bgp neighbors (STEP 1)
RP/0/RP0/CPU0:R2#show bgp neighbors
Wed Sep  9 23:11:36.482 UTC
<snip>
BGP neighbor is 10.1.2.1
 Remote AS 65001, local AS 65002, external link
 Description: eBGP to R1 (AS 65001) IPv4 session
 Remote router ID 10.0.0.1
  BGP state = Established, up for 00:03:02
<snip>
  Neighbor capabilities:
    Route refresh: advertised (old + new) and received (old + new)
    4-byte AS: advertised and received
    Address family IPv4 Unicast: advertised and received
    Address family IPv6 Unicast: advertised and received

IPv6 routes flow inside the IPv4 TCP session, in an UPDATE separate from the IPv4 ones (No.21). The next hop is R1’s global IPv6 address on the link, 2001:db8:12::1, plus its link-local address (32 bytes). R1 and R2 share a subnet, so the link-local address is included as RFC 2545 3 requires.

No.21 UPDATE (R1 → R2, IPv6 route) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 93
    Type: UPDATE Message (2)
<snip>
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
            Type Code: MP_REACH_NLRI (14)
            Length: 46
            Address family identifier (AFI): IPv6 (2)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: IPv6=2001:db8:12::1 Link-local=fe80::5054:ff:fe10:5587
                IPv6 Address: 2001:db8:12::1
                Link-local Address: fe80::5054:ff:fe10:5587
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                2001:db8:1::/64
                    MP Reach NLRI prefix length: 64
                    MP Reach NLRI IPv6 prefix: 2001:db8:1::
Download the pcap of the packet in the tshark output above (No.21 UPDATE)

In R2’s IPv6 table the next hop is 2001:db8:12::1 and the route is the best path. R3 receives it with next-hop-self, so the next hop is R2’s Loopback0 IPv6 address 2001:db8::2.

R2 show bgp ipv6 unicast (STEP 1)
RP/0/RP0/CPU0:R2#show bgp ipv6 unicast
Wed Sep  9 23:11:36.283 UTC
BGP router identifier 10.0.0.2, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 4
BGP main routing table version 4
BGP NSR Initial initsync version 4 (Not Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 2001:db8:1::/64    2001:db8:12::1           0             0 65001 i
*> 2001:db8:2::/64    ::                       0         32768 i
*>i2001:db8:3::/64    2001:db8::3              0    100      0 i

Processed 3 prefixes, 3 paths
R3 show bgp ipv6 unicast (STEP 1)
RP/0/RP0/CPU0:R3#show bgp ipv6 unicast
Wed Sep  9 23:12:02.387 UTC
BGP router identifier 10.0.0.3, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 4
BGP main routing table version 4
BGP NSR Initial initsync version 2 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>i2001:db8:1::/64    2001:db8::2              0    100      0 65001 i
*>i2001:db8:2::/64    2001:db8::2              0    100      0 i
*> 2001:db8:3::/64    ::                       0         32768 i

Processed 3 prefixes, 3 paths

STEP 2: no IPv6 address for the next hop

The IPv6 address is removed from R1’s interface toward R2 (R2 keeps its address).

R1
interface GigabitEthernet0/0/0/0
 no ipv6 address 2001:db8:12::1/64

R1 drops the session (Neighbor local address configuration changed) and then stays Idle, IPv4 included. The reason shown is No global IPv6 address configured.

R1 syslog (STEP 2)
RP/0/RP0/CPU0:Sep  9 23:17:20.604 UTC: bgp[1084]: %ROUTING-BGP-5-ADJCHANGE : neighbor 10.1.2.2 Down - Neighbor local address configuration changed (VRF: default) (AS: 65002)
R1 show bgp neighbors (STEP 2)
RP/0/RP0/CPU0:R1#show bgp neighbors
Wed Sep  9 23:19:36.002 UTC
<snip>
BGP neighbor is 10.1.2.2
 Remote AS 65002, local AS 65001, external link
 Description: eBGP to R2 (AS 65002) IPv4 session
 Remote router ID 0.0.0.0
  BGP state = Idle (No global IPv6 address configured)

R1’s route is gone from R2’s IPv6 table.

R2 show bgp ipv6 unicast (STEP 2)
RP/0/RP0/CPU0:R2#show bgp ipv6 unicast
Wed Sep  9 23:27:35.391 UTC
BGP router identifier 10.0.0.2, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 8
BGP main routing table version 8
BGP NSR Initial initsync version 7 (Not Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 2001:db8:2::/64    ::                       0         32768 i
*>i2001:db8:3::/64    2001:db8::3              0    100      0 i

Processed 2 prefixes, 2 paths

STEP 3: separate IPv6 sessions

With R1’s IPv6 address restored, address-family ipv6 unicast is removed from the IPv4 sessions and separate IPv6 sessions are configured (link addresses for R1-R2, Loopback0 for R2-R3).

R2
router bgp 65002
 neighbor 10.1.2.1
  no address-family ipv6 unicast
 !
 neighbor 10.0.0.3
  no address-family ipv6 unicast
 !
 neighbor 2001:db8:12::1
  remote-as 65001
  address-family ipv6 unicast
   route-policy PASS-ALL in
   route-policy TO-R1-V6 out
   soft-reconfiguration inbound always
 !
 neighbor 2001:db8::3
  remote-as 65002
  update-source Loopback0
  address-family ipv6 unicast
   next-hop-self
   route-policy TO-R3-V6 out
   soft-reconfiguration inbound always

IPv4 and IPv6 now have separate neighbors.

R2 show bgp summary (STEP 3)
RP/0/RP0/CPU0:R2#show bgp summary
Wed Sep  9 23:39:30.239 UTC
<snip>
Neighbor        Spk    AS MsgRcvd MsgSent       TblVer  InQ OutQ  Up/Down  St/PfxRcd
10.0.0.3          0 65002      20      31           11    0    0 00:01:29          1
10.1.2.1          0 65001       9      36           11    0    0 00:01:21          1
R2 show bgp ipv6 unicast summary (STEP 3)
RP/0/RP0/CPU0:R2#show bgp ipv6 unicast summary
Wed Sep  9 23:39:30.554 UTC
<snip>
Neighbor        Spk    AS MsgRcvd MsgSent       TblVer  InQ OutQ  Up/Down  St/PfxRcd
2001:db8::3       0 65002       5       7           13    0    0 00:01:26          1
2001:db8:12::1    0 65001       4       6           13    0    0 00:01:23          1

The R1-R2 capture. The OPEN and UPDATE messages of the IPv4 session (10.1.2.x) and the IPv6 session (2001:db8:12::x) flow separately.

R1-R2 packet capture (STEP 3, tshark list)
    4   0.006420     10.1.2.2 → 10.1.2.1     BGP 137 OPEN Message
    9  35.336182     10.1.2.1 → 10.1.2.2     BGP 129 OPEN Message
   12  37.365285     10.1.2.2 → 10.1.2.1     BGP 137 OPEN Message
   15  37.404549     10.1.2.1 → 10.1.2.2     BGP 137 UPDATE Message, UPDATE Message
   17  39.397120     10.1.2.2 → 10.1.2.1     BGP 190 UPDATE Message, UPDATE Message, UPDATE Message
   19  42.888864     10.1.2.2 → 10.1.2.1     BGP 75 NOTIFICATION Message
   27  71.762945 2001:db8:12::1 → 2001:db8:12::2 BGP 149 OPEN Message
   32  73.548537     10.1.2.1 → 10.1.2.2     BGP 129 OPEN Message
   35  73.768992 2001:db8:12::2 → 2001:db8:12::1 BGP 168 OPEN Message, KEEPALIVE Message
   40  75.553940     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   43  75.595623     10.1.2.1 → 10.1.2.2     BGP 137 UPDATE Message, UPDATE Message
   44  75.598462     10.1.2.2 → 10.1.2.1     BGP 190 UPDATE Message, UPDATE Message, UPDATE Message
   45  75.800483 2001:db8:12::2 → 2001:db8:12::1 BGP 282 UPDATE Message, UPDATE Message, UPDATE Message
   47  75.802339 2001:db8:12::1 → 2001:db8:12::2 BGP 167 UPDATE Message

The UPDATE R1 sent on the IPv6 session (No.47) has a 32-byte next hop, global plus link-local, as in STEP 1.

No.47 UPDATE (R1 → R2, IPv6 session) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 93
    Type: UPDATE Message (2)
<snip>
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
            Type Code: MP_REACH_NLRI (14)
            Length: 46
            Address family identifier (AFI): IPv6 (2)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: IPv6=2001:db8:12::1 Link-local=fe80::5054:ff:fe10:5587
                IPv6 Address: 2001:db8:12::1
                Link-local Address: fe80::5054:ff:fe10:5587
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                2001:db8:1::/64
                    MP Reach NLRI prefix length: 64
                    MP Reach NLRI IPv6 prefix: 2001:db8:1::
Download the pcap of the packet in the tshark output above (No.47 UPDATE)

The UPDATE R2 sent to R3 (No.38 in the R2-R3 capture) has the next hop replaced by R2’s Loopback0 through next-hop-self, 16 bytes without a link-local address. Being iBGP, it carries LOCAL_PREF (the MUST of RFC 4760 3).

No.38 UPDATE (R2 → R3, IPv6 session) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 84
    Type: UPDATE Message (2)
<snip>
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
            Type Code: MP_REACH_NLRI (14)
            Length: 30
            Address family identifier (AFI): IPv6 (2)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 2001:db8::2
                IPv6 Address: 2001:db8::2
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                2001:db8:1::/64
                    MP Reach NLRI prefix length: 64
                    MP Reach NLRI IPv6 prefix: 2001:db8:1::
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65001 
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65001
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65001
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 100
            Flags: 0x40, Transitive, Well-known, Complete
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 100
Download the pcap of the packet in the tshark output above (No.38 UPDATE)

R3’s IPv6 table is the same as in STEP 1.

R3 show bgp ipv6 unicast (STEP 3)
RP/0/RP0/CPU0:R3#show bgp ipv6 unicast
Wed Sep  9 23:39:55.962 UTC
BGP router identifier 10.0.0.3, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 11
BGP main routing table version 11
BGP NSR Initial initsync version 6 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>i2001:db8:1::/64    2001:db8::2              0    100      0 65001 i
*>i2001:db8:2::/64    2001:db8::2              0    100      0 i
*> 2001:db8:3::/64    ::                       0         32768 i

Processed 3 prefixes, 3 paths

STEP 4: only one side advertises IPv6

Only R2 adds address-family ipv6 unicast to its IPv4 session with R1. R1 does not.

R2
router bgp 65002
 neighbor 10.1.2.1
  address-family ipv6 unicast
   route-policy PASS-ALL in
   route-policy TO-R1-V6 out
   soft-reconfiguration inbound always

R2’s OPEN (No.10) carries two capabilities; R1’s OPEN (No.16) carries one.

No.10 OPEN (R2 → R1) tshark -V
Border Gateway Protocol - OPEN Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 83
    Type: OPEN Message (1)
<snip>
    Optional Parameters Length: 54
    Optional Parameters
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv4 (1)
                Reserved: 00
                SAFI: Unicast (1)
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv6 (2)
                Reserved: 00
                SAFI: Unicast (1)
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 2
            Capability: Route Refresh Capability (Cisco)
Download the pcap of the packet in the tshark output above (No.10 OPEN)
No.16 OPEN (R1 → R2) tshark -V
Border Gateway Protocol - OPEN Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 75
    Type: OPEN Message (1)
<snip>
    Optional Parameters Length: 46
    Optional Parameters
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 6
            Capability: Multiprotocol extensions capability
                Type: Multiprotocol extensions capability (1)
                Length: 4
                AFI: IPv4 (1)
                Reserved: 00
                SAFI: Unicast (1)
        Optional Parameter: Capability
            Parameter Type: Capability (2)
            Parameter Length: 2
            Capability: Route Refresh Capability (Cisco)
Download the pcap of the packet in the tshark output above (No.16 OPEN)

The session becomes Established with IPv4 only. On R2, IPv6 shows advertised only (no received) and the summary shows (NoNeg). IPv6 routes keep flowing over the IPv6 session from STEP 3.

R2 show bgp neighbors (STEP 4)
RP/0/RP0/CPU0:R2#show bgp neighbors
Wed Sep  9 23:54:35.420 UTC
<snip>
BGP neighbor is 10.1.2.1
 Remote AS 65001, local AS 65002, external link
 Description: eBGP to R1 (AS 65001) IPv4 session
 Remote router ID 10.0.0.1
  BGP state = Established, up for 00:01:49
<snip>
  Neighbor capabilities:
    Route refresh: advertised (old + new) and received (old + new)
    4-byte AS: advertised and received
    Address family IPv4 Unicast: advertised and received
    Address family IPv6 Unicast: advertised
R2 show bgp ipv6 unicast summary (STEP 4)
RP/0/RP0/CPU0:R2#show bgp ipv6 unicast summary
Wed Sep  9 23:54:34.763 UTC
<snip>
Neighbor        Spk    AS MsgRcvd MsgSent       TblVer  InQ OutQ  Up/Down  St/PfxRcd
10.1.2.1          0 65001      11      13            0    0    0 00:01:48    (NoNeg)
2001:db8::3       0 65002       8       8           10    0    0 00:04:41          1
2001:db8:12::1    0 65001       7       8           10    0    0 00:04:41          1

STEP 5: no address family in common

From the STEP 4 state, address-family ipv4 unicast is also removed from R2’s IPv4 session. R2 now advertises IPv6 only and R1 IPv4 only.

R2
router bgp 65002
 neighbor 10.1.2.1
  no address-family ipv4 unicast

R2 drops the session with CEASE (Address family removed). After that, every OPEN exchange ends with a NOTIFICATION (OPEN Message Error / Unsupported Capability) and the session returns to Idle. It is the same whichever side connects, and repeats about every 30 seconds.

R2 syslog (STEP 5)
RP/0/RP0/CPU0:Sep 10 00:04:22.675 UTC: bgp[1084]: %ROUTING-BGP-5-ADJCHANGE : neighbor 10.1.2.1 Down - Address family removed (CEASE notification sent - configuration change) (VRF: default) (AS: 65001)
R1-R2 packet capture (STEP 5, tshark list, OPEN and NOTIFICATION only)
    1   0.000000     10.1.2.2 → 10.1.2.1     BGP 75 NOTIFICATION Message
   14  39.940555     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   17  41.946354     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
   25  71.616775     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   29  73.625902     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
   42 115.729900     10.1.2.1 → 10.1.2.2     BGP 129 OPEN Message
   45 117.736475     10.1.2.2 → 10.1.2.1     BGP 75 NOTIFICATION Message
   55 142.971931     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   58 144.977190     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
   70 186.209437     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   73 188.214263     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
   85 214.364693     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
   88 216.420766     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
   97 247.328135     10.1.2.1 → 10.1.2.2     BGP 129 OPEN Message
  100 249.388728     10.1.2.2 → 10.1.2.1     BGP 75 NOTIFICATION Message
  113 279.768969     10.1.2.2 → 10.1.2.1     BGP 129 OPEN Message
  116 281.775177     10.1.2.1 → 10.1.2.2     BGP 75 NOTIFICATION Message
No.17 NOTIFICATION (R1 → R2) tshark -V
Border Gateway Protocol - NOTIFICATION Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 21
    Type: NOTIFICATION Message (3)
    Major error Code: OPEN Message Error (2)
    Minor error Code (Open Message): Unsupported Capability (7)
Download the pcap of the packet in the tshark output above (No.17 NOTIFICATION)

It is 21 bytes long with an empty Data field (RFC 5492 5 requires the offending capabilities in Data with a MUST, but XRd does not include them). show bgp neighbors records it as unsupported/disjoint capability in both directions.

R2 show bgp neighbors (STEP 5, end of the 10.1.2.1 block)
RP/0/RP0/CPU0:R2#show bgp neighbors
Thu Sep 10 00:08:16.122 UTC
<snip>
  Connections established 2; dropped 2
  Local host: 10.1.2.2, Local port: 54254, IF Handle: 0x00000018
  Foreign host: 10.1.2.1, Foreign port: 179
  Last reset 00:00:17, due to BGP Notification received: unsupported/disjoint capability
  Time since last notification sent to neighbor: 00:01:55
  Error Code: unsupported/disjoint capability
  Notification data sent:
    None
  Time since last notification received from neighbor: 00:00:17
  Error Code: unsupported/disjoint capability
  Notification data received:

After this check, R2’s IPv4 session was returned to the STEP 3 state (IPv4 only).

STEP 6: withdrawing routes (final state)

Both network statements are removed on R1 and restored after convergence.

R1
router bgp 65001
 address-family ipv4 unicast
  no network 192.168.1.0/24
 !
 address-family ipv6 unicast
  no network 2001:db8:1::/64

The R1-R2 capture. The IPv6 withdrawal (No.11, IPv6 session) and the IPv4 withdrawal (No.15, IPv4 session) flow on separate sessions.

R1-R2 packet capture (STEP 6, tshark list, UPDATE only)
   11  61.041671 2001:db8:12::1 → 2001:db8:12::2 BGP 132 UPDATE Message, KEEPALIVE Message
   15  63.047004     10.1.2.1 → 10.1.2.2     BGP 100 UPDATE Message, KEEPALIVE Message

The IPv6 withdrawal is an UPDATE with only MP_UNREACH_NLRI. There are no other path attributes (RFC 4760 4).

No.11 UPDATE (R1 → R2, IPv6 session) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 39
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 16
    Path attributes
        Path Attribute - MP_UNREACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
            Type Code: MP_UNREACH_NLRI (15)
            Length: 12
            Address family identifier (AFI): IPv6 (2)
            Subsequent address family identifier (SAFI): Unicast (1)
            Withdrawn Routes
                2001:db8:1::/64
                    MP Unreach NLRI prefix length: 64
                    MP Unreach NLRI IPv6 prefix: 2001:db8:1::
Border Gateway Protocol - KEEPALIVE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 19
    Type: KEEPALIVE Message (4)
Download the pcap of the packet in the tshark output above (No.11 UPDATE)

The IPv4 withdrawal is not MP_UNREACH_NLRI but the Withdrawn Routes field of the UPDATE body. The advertisement used MP_REACH_NLRI, while the withdrawal uses the base format.

No.15 UPDATE (R1 → R2, IPv4 session) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 27
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 4
    Withdrawn Routes
        192.168.1.0/24
            Withdrawn route prefix length: 24
            Withdrawn prefix: 192.168.1.0
    Total Path Attribute Length: 0
Border Gateway Protocol - KEEPALIVE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 19
    Type: KEEPALIVE Message (4)
Download the pcap of the packet in the tshark output above (No.15 UPDATE)

R1’s routes disappear from R3 and return once the network statements are restored (final state).

R3 show bgp ipv6 unicast (STEP 6, after the withdrawal)
RP/0/RP0/CPU0:R3#show bgp ipv6 unicast
Thu Sep 10 00:54:29.226 UTC
BGP router identifier 10.0.0.3, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 11
BGP main routing table version 11
BGP NSR Initial initsync version 6 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>i2001:db8:2::/64    2001:db8::2              0    100      0 i
*> 2001:db8:3::/64    ::                       0         32768 i

Processed 2 prefixes, 2 paths
R3 show bgp ipv6 unicast (final state)
RP/0/RP0/CPU0:R3#show bgp ipv6 unicast
Thu Sep 10 01:08:27.849 UTC
BGP router identifier 10.0.0.3, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0800000   RD version: 12
BGP main routing table version 12
BGP NSR Initial initsync version 6 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*>i2001:db8:1::/64    2001:db8::2              0    100      0 65001 i
*>i2001:db8:2::/64    2001:db8::2              0    100      0 i
*> 2001:db8:3::/64    ::                       0         32768 i

Processed 3 prefixes, 3 paths

Summary of the verification

  • One TCP session carries several address families. Each address family has one capability in the OPEN and its own UPDATEs (STEP 0, 1)
  • Only address families advertised by both sides are exchanged. One-sided ones do not flow, and with nothing in common the session fails with NOTIFICATION (Unsupported Capability) (STEP 4, 5)
  • IOS XR resets the session when an address family is added or removed (STEP 1, 4, 5)
  • The IPv6 next hop is 32 bytes (global + link-local) on directly connected eBGP and 16 bytes (global only) on iBGP (STEP 1, 3)
  • When IPv6 routes are carried over an IPv4 session, IOS XR uses the global IPv6 address of the interface toward the peer as the next hop. Without one, the session does not come up at all (STEP 1, 2)
  • IPv6 withdrawals are MP_UNREACH_NLRI alone; IPv4 withdrawals use the Withdrawn Routes field (STEP 6)

Verification config and show output

Each STEP captures three kinds of file from all three routers. The verification config is the ..._run.txt (final state: the last STEP).

FileContent
..._show.txtshow version / show interface description / show route / show route ipv6 / show ospf neighbor / show ospfv3 neighbor / show bgp summary / show bgp ipv6 unicast summary / show bgp / show bgp ipv6 unicast / show bgp neighbors / show bgp ipv6 unicast neighbors / show bgp <prefix> (six) / show bgp update-group / show bgp ipv6 unicast update-group / show bgp nexthops / show bgp ipv6 unicast nexthops / per-peer advertised-routes, routes, received routes (IPv4 and IPv6) / show rpl route-policy
..._log.txtshow logging limited to that STEP (a logmsg marker at the start of each STEP, its time passed to show logging start)
..._run.txtshow running-config at that STEP (the verification config of that STEP)

The final state (STEP 7) has separate IPv4 sessions (link addresses for R1-R2, Loopback0 for R2-R3) and IPv6 sessions (likewise), with each router advertising 192.168.N.0/24 and 2001:db8:N::/64. show ospfv3 neighbor is a leftover from an initial OSPFv3 setup that was replaced by static routes; it returns nothing.

STEP 0: IPv4 unicast only

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 1: IPv6 unicast added to the IPv4 sessions

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 2: IPv6 address removed from R1’s link

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 3: separate IPv6 sessions

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 4: only R2 adds IPv6 to the IPv4 session

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 5: no address family in common

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 6: R1’s network statements removed

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

STEP 7: network statements restored (final state)

Routershow outputsyslogrunning-config
R1showlogrun
R2showlogrun
R3showlogrun

Packet captures were taken per STEP (STEP 2, 4, and 5 on the R1-R2 link only).

STEPR1-R2R2-R3
0pcappcap
1pcappcap
2pcap—
3pcappcap
4pcap—
5pcap—
6pcappcap

References

DocumentTitleSummary
RFC 4760Multiprotocol Extensions for BGP-4MP_REACH_NLRI (3) and MP_UNREACH_NLRI (4), SAFI (6, 9), the capability (8)
RFC 5492Capabilities Advertisement with BGP-4Capability exchange in the OPEN Optional Parameter and Unsupported Capability (5)
RFC 2545Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain RoutingThe IPv6 next hop (global + link-local, length 16 / 32) and transport independence
RFC 8950Advertising IPv4 Network Layer Reachability Information (NLRI) with an IPv6 Next HopThe Extended Next Hop Encoding Capability that gives IPv4 routes an IPv6 next hop
IANA Address Family NumbersAddress Family NumbersThe list of AFI values

Related articles