Flowspec Indirection-id Redirect for SRv6

BGP Flow Specification, originally defined in and and evolved under BGP Flow Specification Version 2 (FSv2) , allows network operators to distribute fine-grained flow matching rules and redirection actions across administrative domains. The "FlowSpec Redirect to indirection-id Extended Community" framework was introduced to decouple the Flowspec redirection policy from explicit next-hop or path-specific identifiers. By directing traffic to a logical "indirection-id", a network controller can update path state (such as SR-TE paths) locally in an indirection table on edge devices without re-issuing BGP Flowspec updates. This document extends the indirection-id framework to support SRv6 networks. It introduces a 128-bit Generalized Indirection-id encoding aligned with SRv6 SID structures, enabling seamless mapping to SRv6 Endpoint SIDs, SRv6 Binding SIDs (BSIDs), and SRv6 Policy path constructs under the FSv2 architecture.

FSv2: Flow Specification Version 2 SRv6: Segment Routing over IPv6 data plane

This document defines a new sub-type value for SRv6 within the "FlowSpec Redirect to indirection-id Extended Community" registry. The extended community is formatted using a 128-bit Generalized Indirection-id payload as shown below:

Where: Type (1 octet): Extended Community Type assigned for Flowspec Path Redirect actions. Sub-Type (1 octet): Assigned by IANA for SRv6 128-bit Indirection-id Redirect. Flags (1 octet): Defines control flags for path lookup behaviors, consistent with the indirection-id baseline specification. ID-Type (1 octet): Specifies the context and mapping interpretation of the 16-octet Generalized indirection_id. The following ID-Types are defined: 0: Localised ID - Looked up in a locally programmed indirection table. 1: Node ID with SID/index in MPLS Segment Routing. 2: Node ID with SID/label in MPLS Segment Routing. 3: Binding Segment ID with SID/index in MPLS Segment Routing. 4: Binding Segment ID with SID/label in MPLS Segment Routing. 5: Tunnel ID - Globally unique tunnel identifier within an domain. 6: Node ID with SID/index in SRv6 - The indirection-id maps to an SRv6 SID using the payload as an SRv6 SID or index offset. 7: Binding Segment ID with SID/index in SRv6 - Maps to an SRv6 Binding SID (BSID) via global index offset. 8: Binding Segment ID with SID/label in SRv6 - Maps directly to a 128-bit SRv6 Binding SID (BSID). Generalized indirection_id (16 octets / 128 bits): A 128-bit identifier representing the SRv6 SID, BSID, or logical path index.

When a BGP Flowspec client receives a Flowspec rule containing the SRv6 Indirection-id Redirect Action, it validates the rule according to FSv2 procedures defined in [draft-ietf-idr-fsv2-ip-basic]. Upon validation, the client extracts the 128-bit Generalized Indirection-id and queries its local SRv6 Indirection Table. This table maintains dynamic mappings between the Indirection-id and active forwarding states, such as: An active SRv6 Policy Segment List. An SRv6 End.X / End.DT4 / End.DT6 SID. An SRv6 Binding SID (BSID) triggering encapsulation into an SRv6 Outer IPv6 Header with an Segment Routing Header (SRH).

Matching data packets are steered into the target SRv6 path resolved by the indirection table: If mapped to an **SRv6 BSID or Policy**, the router encapsulates the packet in an IPv6 outer header with `Destination Address = SRv6 BSID/SID` and appends an SRH if required by the policy path length. If mapped to a **Localised ID**, traffic is cross-connected to the designated SRv6 service instance or VPN VRF table.

If a Flowspec client receives an SRv6 Indirection-id rule but cannot resolve the 128-bit Indirection-id in its local table (e.g., policy not yet programmed or underlying SRv6 path down): The router MUST NOT silently drop traffic unless explicitly configured by local fallback policy. The router SHOULD fall back to default IP/SRv6 routing for the packet's original destination address or apply an alternate default Flowspec action. Malformed Extended Community attributes MUST be handled per [RFC7606] and FSv2 error handling guidelines.

Indirection-based traffic redirection isolates control-plane Flowspec rules from underlying path state updates. However, incorrect or malicious Indirection-id updates could result in traffic blackholing or unauthorized traffic steering across domain boundaries. To mitigate these risks: SRv6 Indirection-id Flowspec rules MUST be restricted to a single administrative domain or strictly controlled peer boundaries. Standard BGP Flowspec validation mechanisms and BGP authentication (TCP-AO / MD5) MUST be deployed to ensure attribute integrity.

IANA is requested to allocate a new sub-type under the "FlowSpec Redirect to indirection-id Extended Community Sub-Type" registry:

The following people made significant contributions to this document:

This document received valuable comments and input from IDR working group including Adam Simpson, Mustapha Aissaoui, Jan Mertens, Robert Raszuk, Jeff Haas, Susan Hares and Lucy Yong.