This document provides a comprehensive analysis, review, and architectural breakdown of the srv6-l3vpn-multi Containerlab topology and its associated configuration files.

The lab represents a highly advanced, carrier-grade SRv6 L3VPN implementation crossing multiple network operating systems. It enables overlapping customer VRFs (clienta and clientb) to route over an IPv6-only transport core using SRv6 Locators.

The environment utilizes a variety of specialized control plane, core, and provider edge (PE) devices:

The design separates customers into two distinct Virtual Routing and Forwarding (VRF) instances:

—

The backbone transport network relies on Single-Area IS-IS (Intermediate System to Intermediate System) to distribute loopbacks and locator prefixes, which is a textbook design for SRv6 deployments.

• Metric Style: Wide metric formatting is explicitly enabled (metric-style wide). This is a mandatory prerequisite for carrying Segment Routing TLVs.
• MTU Core: The backbone interfaces (e.g., links connecting p1 to PEs) are set to 9216 bytes (Jumbo Frames) to handle the SRv6 outer headers without fragmentation.

The PEs use uSID (Micro-Segment) format usid-f3216.

—

To exchange VPNv4 and VPNv6 customer routes across the SRv6 core, an MP-BGP control plane is implemented. All nodes reside in Autonomous System 65577 (iBGP structure) with rr1 acting as the central Route Reflector. SIDs are allocated per-VRF (alloc-mode per-vrf).

—

The inconsistencies previously noted have been successfully corrected:

• ✅ Inventory Alignment: Both enable-interfaces.yml and disable-interfaces.yml now correctly target the clab-srv6-l3vpn-multi-pe1, pe2, pe3 hosts.
• ✅ Interface Alignment: Both playbooks now accurately loop through GigabitEthernet interfaces 2, 3, and 4.

—

• 🚧 Dynamic Client RA/Loop In clienta-1:
  • Issue: clienta-1 runs a background infinite bash loop that downs and ups eth1 every 60 seconds to refresh its default route.
  • Fix: Check if PE1 is reliably sending IPv6 Router Advertisements (RAs) to the clients.
• 🚧 VyOS PE6 Static Route Fallback:
  • Issue: VyOS has a static IPv6 route forcing traffic to the locator namespace back to default (route6 fd00:cafe::/32 { next-hop 2001:db8:107::1 }).
  • Fix: Ensure MP-BGP is distributing this natively so that the network remains resilient during a path failure.

— —

name: srv6-l3vpn-multi
mgmt:
  network: clab-mgmt-net
  ipv4-subnet: 172.99.20.0/24
  ipv6-subnet: ""
topology:
  nodes:
    rr1:
      kind: linux
      image: quay.io/frrouting/frr:10.7.0
      cmd: bash -c "/usr/lib/frr/frrinit.sh start && tail -f /dev/null"
      sysctls:
        net.ipv4.ip_forward: 1
        net.ipv4.conf.all.forwarding: 1
        net.ipv6.conf.all.forwarding: 1
        net.ipv6.conf.default.forwarding: 1
        net.ipv6.seg6_flowlabel: 1
        net.ipv6.conf.default.seg6_enabled: 1
        net.ipv6.conf.all.seg6_enabled: 1
        net.vrf.strict_mode: 1
      binds:
        - rr1/daemons:/etc/frr/daemons
        - rr1/frr.conf:/etc/frr/frr.conf
        - rr1/vtysh.conf:/etc/frr/vtysh.conf
      exec:
        - ip link add dummy0 type dummy
        - ip link set dummy0 up
    p1:
      kind: linux
      image: quay.io/frrouting/frr:10.7.0
      cmd: >-
        bash -c "
        apk update && apk add kea &&
        rm -f /tmp/kea*.lock /run/kea/*.lock /run/kea/*.pid &&
        mkdir -p /run/kea &&
        chmod 640 -R /run/kea &&
        sleep 2 &&
        (/usr/sbin/kea-dhcp6 -c /etc/kea/kea-dhcp6.conf > /var/log/kea-dhcp6.log 2>&1 &) &&
        /usr/lib/frr/frrinit.sh start &&
        tail -f /dev/null
        "
      sysctls:
        net.ipv4.ip_forward: 1
        net.ipv4.conf.all.forwarding: 1
        net.ipv6.conf.all.forwarding: 1
        net.ipv6.conf.default.forwarding: 1
        net.ipv6.seg6_flowlabel: 1
        net.ipv6.conf.default.seg6_enabled: 1
        net.ipv6.conf.all.seg6_enabled: 1
        net.vrf.strict_mode: 1
      binds:
        - p1/daemons:/etc/frr/daemons
        - p1/frr.conf:/etc/frr/frr.conf
        - p1/vtysh.conf:/etc/frr/vtysh.conf
        - p1/kea-dhcp6.conf:/etc/kea/kea-dhcp6.conf
      exec:
        - ip link add dummy0 type dummy
        - ip link set dummy0 up
    pe1:
      kind: cisco_c8000v
      type: autonomous
      image: vrnetlab/cisco_c8000v:26.01.01
      env:
        QEMU_SMP: "4"
        QEMU_MEMORY: "8196"
      startup-config: configs/pe1-startup-config.cfg
    pe2:
      kind: cisco_c8000v
      type: autonomous
      image: vrnetlab/cisco_c8000v:26.01.01
      env:
        QEMU_SMP: "4"
        QEMU_MEMORY: "8196"
      startup-config: configs/pe2-startup-config.cfg
    pe3:
      kind: cisco_c8000v
      type: autonomous
      image: vrnetlab/cisco_c8000v:26.01.01
      env:
        QEMU_SMP: "4"
        QEMU_MEMORY: "8196"
      startup-config: configs/pe3-startup-config.cfg
    pe4:
      kind: 6wind_vsr
      image: download.6wind.com/vsr/x86_64-ce/3.12:3.12.2.2
      startup-config: configs/pe4-startup-config.cfg
      cpu: 4
      memory: 8GB
      binds:
        - /dev/hugepages:/dev/hugepages
        - /dev/shm:/dev/shm:rw
    pe5:
      kind: linux
      image: quay.io/frrouting/frr:10.7.0
      cmd: bash -c "/usr/lib/frr/frrinit.sh start && tail -f /dev/null"
      sysctls:
        net.ipv4.ip_forward: 1
        net.ipv4.conf.all.forwarding: 1
        net.ipv6.conf.all.forwarding: 1
        net.ipv6.conf.default.forwarding: 1
        net.ipv6.seg6_flowlabel: 1
        net.ipv6.conf.default.seg6_enabled: 1
        net.ipv6.conf.all.seg6_enabled: 1
        net.vrf.strict_mode: 1
      binds:
        - pe5/daemons:/etc/frr/daemons
        - pe5/frr.conf:/etc/frr/frr.conf
        - pe5/vtysh.conf:/etc/frr/vtysh.conf
      exec:
        - ip link add dummy0 type dummy
        - ip link set dummy0 up
        - ip link add clienta type vrf table 10
        - ip link set eth2 master clienta
        - ip link set clienta up
    pe6:
      kind: vyosnetworks_vyos
      image: vyos:2026.06.30-0048
      startup-config: configs/pe6-startup-config.cfg
    clienta-1:
      kind: linux
      image: clab-nginx:latest
      sysctls:
        net.ipv6.conf.all.disable_ipv6: 0
        net.ipv6.conf.all.accept_ra: 2
      exec:
        - sysctl -w net.ipv6.conf.eth1.accept_ra=2
        - dd if=/dev/zero of=/usr/share/nginx/html/bigfile.bin bs=1M count=10240
        - sysctl -w net.ipv6.conf.eth1.accept_ra=2
        - apt update -y
        - apt install -y procps psmisc wget curl avahi-daemon avahi-utils
        - ip -4 addr add 142.134.7.82/30 dev eth1
        - ip link set dev eth1 up
        - ip -4 route del default || true
        - ip -4 route add 224.0.0.0/4 dev eth1
        - ip -4 route add 0.0.0.0/0 via 142.134.7.81
        - sed -i 's/#enable-dbus=yes/enable-dbus=no/g' /etc/avahi/avahi-daemon.conf
        - killall -q avahi-daemon || true
        - rm -rf /var/run/avahi-daemon/
        - mkdir -p /var/run/avahi-daemon/
        - chown avahi:avahi /var/run/avahi-daemon/
        - avahi-daemon -D
        - bash -c "while true; do sleep 60; ip link set dev eth1 down; sleep 1; ip link set dev eth1 up; ip -4 route del default || true; ip -4 route add 0.0.0.0/0 via 142.134.7.81; killall -q avahi-daemon || true; rm -rf /var/run/avahi-daemon/*; avahi-daemon -D; done &"
    br1001:
      kind: bridge
  links:
    - endpoints: ["rr1:eth1", "p1:eth1"]
      mtu: 9216
    - endpoints: ["p1:eth2", "pe1:Gi2"]
      mtu: 9216
    - endpoints: ["p1:eth3", "pe2:Gi2"]
      mtu: 9216
    - endpoints: ["p1:eth4", "pe3:Gi2"]
      mtu: 9216
    - endpoints: ["p1:eth5", "pe4:eth1"]
      mtu: 9216
    - endpoints: ["p1:eth6", "pe5:eth1"]
      mtu: 9216
    - endpoints: ["p1:eth7", "pe6:eth1"]
      mtu: 9216
    - endpoints: ["pe1:Gi3", "clienta-1:eth1"]
      mtu: 1500
    - endpoints: ["pe1:Gi5", "br1001:eth1"]
      mtu: 1500

---
- name: Bring up interfaces on PE routers
  # Targets the specific PE routers you mentioned
  hosts: clab-srv6-l3vpn-multi-pe1, clab-srv6-l3vpn-multi-pe2, clab-srv6-l3vpn-multi-pe3
 
  # Network CLI connection is required for Cisco devices
  connection: network_cli
  gather_facts: false
  
  vars:
    # Explicitly tell Ansible the OS type for these nodes
    ansible_network_os: cisco.ios.ios
  tasks:
    - name: Enable GigabitEthernet interfaces 2 through 4
      cisco.ios.ios_config:
        lines:
          - no shutdown
        parents: "interface GigabitEthernet{{ item }}"
      # Loop through the interface numbers
      loop:
        - 2
        - 3
        - 4
    - name: Save running-config to startup-config (write mem)
      cisco.ios.ios_config:
        save_when: modified

---
- name: Bring down interfaces on PE routers
  # Targets the specific PE routers you mentioned
  hosts: clab-srv6-l3vpn-multi-pe1, clab-srv6-l3vpn-multi-pe2, clab-srv6-l3vpn-multi-pe3
 
  # Network CLI connection is required for Cisco devices
  connection: network_cli
  gather_facts: false
  
  vars:
    # Explicitly tell Ansible the OS type for these nodes
    ansible_network_os: cisco.ios.ios
  tasks:
    - name: Enable GigabitEthernet interfaces 2 through 4
      cisco.ios.ios_config:
        lines:
          - shutdown
        parents: "interface GigabitEthernet{{ item }}"
      # Loop through the interface numbers
      loop:
        - 2
        - 3
        - 4
    - name: Save running-config to startup-config (write mem)
      cisco.ios.ios_config:
        save_when: modified

---
pe4:
    username: admin
    password: admin
    platform: 6wind_vsr
    hostname: 172.99.20.19
br1001:
    username: 
    password: 
    platform: bridge
    hostname: 
pe1:
    username: admin
    password: admin
    platform: cisco_c8000v
    hostname: 172.99.20.2
pe2:
    username: admin
    password: admin
    platform: cisco_c8000v
    hostname: 172.99.20.13
pe3:
    username: admin
    password: admin
    platform: cisco_c8000v
    hostname: 172.99.20.7
clienta-1:
    username: 
    password: 
    platform: linux
    hostname: 172.99.20.14
pe6:
    username: admin
    password: admin
    platform: vyosnetworks_vyos
    hostname: 172.99.20.18

Building configuration...
Current configuration : 9632 bytes
!
version 26.1
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
platform sslvpn use-pd
platform console serial
!
hostname pe1
!
vrf definition clab-mgmt
 description Containerlab management VRF (DO NOT DELETE)
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
vrf definition clienta
 rd 65000:101
 !
 address-family ipv4
  route-target export 65000:101
  route-target import 65000:101
 exit-address-family
 !
 address-family ipv6
  route-target export 65000:101
  route-target import 65000:101
 exit-address-family
!
vrf definition clientb
 rd 65000:102
 !
 address-family ipv4
  route-target export 65000:102
  route-target import 65000:102
 exit-address-family
 !
 address-family ipv6
  route-target export 65000:102
  route-target import 65000:102
 exit-address-family
!
crypto pki trustpoint SLA-TrustPoint
 revocation-check crl
 hash sha512
!
crypto pki trustpoint TP-self-signed-2270412557
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2270412557
 revocation-check none
 rsakeypair TP-self-signed-2270412557
 hash sha512
!
! [ PKI CERTIFICATE CHAINS TRUNCATED FOR BREVITY ]
!
interface Loopback0
 no ip address
 no ip proxy-arp
 ipv6 address prefix-from-provider ::1/128
 ipv6 enable
 ipv6 router isis SR
!
interface GigabitEthernet1
 vrf forwarding clab-mgmt
 ip address 10.0.0.15 255.255.255.0
 no ip proxy-arp
 negotiation auto
 ipv6 address 2001:DB8::2/64
!
interface GigabitEthernet2
 description "to p1 - eth2"
 mtu 9216
 no ip address
 ip proxy-arp
 negotiation auto
 ipv6 dhcp client request vendor
 ipv6 dhcp client pd prefix-from-provider
 ipv6 address autoconfig default
 ipv6 enable
 ipv6 router isis SR
 isis network point-to-point
!
interface GigabitEthernet3
 vrf forwarding clienta
 ip address 142.134.7.81 255.255.255.252
 no ip proxy-arp
 negotiation auto
 ipv6 address prefix-from-provider ::1/64
 mdns-sd gateway
  service-policy CLIENTA-POLICY
!
interface GigabitEthernet4
 vrf forwarding clientb
 ip address 192.168.41.1 255.255.255.0
 no ip proxy-arp
 negotiation auto
!
segment-routing srv6
 locators
  locator locator0
   prefix FD00:CAFE:1111::/48
   format usid-f3216
!
router isis SR
 net 49.0000.0000.0000.0003.00
 metric-style wide
 log-adjacency-changes all
 !
 address-family ipv6
  segment-routing srv6
   locator locator0
 exit-address-family
!
router bgp 65577
 bgp router-id 172.16.0.3
 bgp log-neighbor-changes
 bgp listen range ::/0 peer-group RR
 no bgp default ipv4-unicast
 neighbor 2001:DB8:101::1 remote-as 65577
 neighbor 2001:DB8:101::1 description "RR1"
 neighbor 2001:DB8:101::1 log-neighbor-changes
 neighbor 2001:DB8:101::1 password cisco123
 neighbor 2001:DB8:101::1 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
  neighbor 2001:DB8:101::1 activate
  neighbor 2001:DB8:101::1 send-community extended
  neighbor 2001:DB8:101::1 next-hop-self
 exit-address-family
 !
 address-family vpnv6
  neighbor 2001:DB8:101::1 activate
  neighbor 2001:DB8:101::1 send-community extended
  neighbor 2001:DB8:101::1 next-hop-self
 exit-address-family
 !
 address-family ipv4 vrf clienta
  bgp router-id 172.16.0.3
  redistribute connected
  !
  segment-routing srv6
   locator locator0
   alloc-mode per-vrf
  exit-srv6
  !
 exit-address-family
 !
 address-family ipv6 vrf clienta
  redistribute connected
  bgp router-id 172.16.0.3
  !
  segment-routing srv6
   locator locator0
   alloc-mode per-vrf
  exit-srv6
  !
 exit-address-family
 !
 address-family ipv4 vrf clientb
  bgp router-id 172.16.0.3
  redistribute connected
  !
  segment-routing srv6
   locator locator0
   alloc-mode per-vrf
  exit-srv6
  !
 exit-address-family
 !
 address-family ipv6 vrf clientb
  redistribute connected
  bgp router-id 172.16.0.3
  !
  segment-routing srv6
   locator locator0
   alloc-mode per-vrf
  exit-srv6
  !
 exit-address-family
!
ip default-gateway 10.0.0.2
ip rcmd domain-lookup
ip forward-protocol nd
ip forward-protocol udp tftp
ip telnet comport enable
!
no ip http server
ip route vrf clab-mgmt 0.0.0.0 0.0.0.0 10.0.0.2
ipv6 route vrf clab-mgmt ::/0 2001:DB8::1
!
line con 0
 activation-character 13
 stopbits 1
line vty 0 4
 activation-character 13
 login local
 transport input ssh
!
end

/ vrf main l3vrf clienta table-id 10
/ vrf main l3vrf clienta interface infrastructure eth2 ipv4 address 142.134.7.73/30
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 enabled true
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 autoconfiguration true
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 address-generation-mode random-secret
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 accept-router-advert always
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 accept-segment-routing true
/ vrf main l3vrf clienta interface infrastructure eth2 network-stack ipv6 router-solicitations 3
/ vrf main l3vrf clienta interface infrastructure eth2 port infra-eth2
/ vrf main l3vrf clienta routing bgp ebgp-requires-policy false
/ vrf main l3vrf clienta routing bgp segment-routing ipv6 locator locator0
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn export vpn true
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn export label auto
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn export route-target 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn export ipv6-sid auto
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn import vpn true
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast l3vpn import route-target 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv4-unicast redistribute connected
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn export vpn true
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn export label auto
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn export route-target 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn export route-distinguisher 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn export ipv6-sid auto
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn import vpn true
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast l3vpn import route-target 65000:101
/ vrf main l3vrf clienta routing bgp address-family ipv6-unicast redistribute connected
/ vrf main interface infrastructure eth1 ipv4 enabled false
/ vrf main interface infrastructure eth1 mtu 9216
/ vrf main interface infrastructure eth1 ipv6 address 2001:db8:105::2/64
/ vrf main interface infrastructure eth1 network-stack ipv6 accept-segment-routing true
/ vrf main interface infrastructure eth1 port infra-eth1
/ vrf main interface loopback lo0 ipv6 address fd00:cafe:4444:1000::1/128
/ vrf main routing interface eth1 isis area-tag SR
/ vrf main routing interface eth1 isis ipv6-routing true
/ vrf main routing interface eth1 isis network-point-to-point true
/ vrf main routing interface lo0 isis area-tag SR
/ vrf main routing interface lo0 isis ipv4-routing true
/ vrf main routing interface lo0 isis ipv6-routing true
/ vrf main routing bgp as 65577
/ vrf main routing bgp router-id 172.16.0.6
/ vrf main routing bgp segment-routing ipv6 locator locator0
/ vrf main routing bgp address-family ipv6-unicast
/ vrf main routing bgp neighbor-group RR remote-as 65577
/ vrf main routing bgp neighbor-group RR capabilities extended-nexthop true
/ vrf main routing bgp neighbor-group RR password cisco123
/ vrf main routing bgp neighbor-group RR update-source fd00:cafe:4444:1000::1
/ vrf main routing bgp neighbor-group RR address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing bgp neighbor-group RR address-family ipv6-vpn soft-reconfiguration-inbound true
/ vrf main routing bgp neighbor 2001:db8:101::1 neighbor-group RR
/ vrf main routing bgp neighbor 2001:db8:101::1 neighbor-description RR1
/ vrf main routing isis instance SR area-address 49.0000.0000.0000.0006.00
/ vrf main routing isis instance SR log-adjacency-changes true
/ vrf main routing isis instance SR segment-routing enabled true
/ vrf main routing isis instance SR segment-routing ipv6 locator locator0
/ vrf main routing segment-routing enabled true
/ vrf main routing segment-routing ipv6 locator locator0 prefix fd00:cafe:4444::/48
/ vrf main routing segment-routing ipv6 locator locator0 block-length 32
/ vrf main routing segment-routing ipv6 locator locator0 node-length 16
/ vrf main routing segment-routing ipv6 locator locator0 mode-micro-sid-f3216
/ vrf main ssh-server
/ system fast-path virtual-port infrastructure infra-eth1
/ system fast-path virtual-port infrastructure infra-eth2

interfaces {
    ethernet eth1 {
        address "2001:db8:107::2/64"
        mtu "9216"
    }
    ethernet eth2 {
        address "142.134.7.89/30"
        vrf "clienta"
    }
    loopback lo {
        address "fd00:cafe:6666::1/128"
    }
}
protocols {
    bgp {
        neighbor 2001:db8:101::1 {
            description "RR1"
            peer-group "RR"
        }
        parameters {
            log-neighbor-changes
            router-id "172.16.0.8"
        }
        peer-group RR {
            address-family {
                ipv4-vpn {
                    nexthop-self { }
                    soft-reconfiguration { inbound }
                }
                ipv6-vpn {
                    nexthop-self { }
                    soft-reconfiguration { inbound }
                }
            }
            capability { extended-nexthop }
            password "cisco123"
            remote-as "65577"
            update-source "fd00:cafe:6666::1"
        }
        srv6 {
            locator "locator0"
        }
        system-as "65577"
    }
    isis {
        interface eth1 {
            network { point-to-point }
        }
        interface lo { passive }
        log-adjacency-changes
        net "49.0000.0000.0000.0008.00"
        segment-routing {
            prefix fd00:cafe:6666::/48 { }
            srv6 {
                interface "lo"
                locator "locator0"
            }
        }
    }
    segment-routing {
        interface eth1 { srv6 { } }
        srv6 {
            encapsulation { source-address "fd00:cafe:6666::1" }
            locator locator0 {
                block-len "32"
                format "usid-f3216"
                func-bits "16"
                node-len "16"
                prefix "fd00:cafe:6666::/48"
            }
        }
    }
}
vrf {
    name clienta {
        protocols {
            bgp {
                address-family {
                    ipv4-unicast {
                        export { vpn }
                        import { vpn }
                        rd { vpn { export "65000:101" } }
                        redistribute { connected { } }
                        route-target { vpn { export "65000:101" import "65000:101" } }
                    }
                }
                parameters { router-id "172.16.0.8" }
                sid { vpn { per-vrf { export "auto" } } }
                system-as "65577"
            }
            static {
                route6 fd00:cafe::/32 {
                    next-hop 2001:db8:107::1 { vrf "default" }
                }
            }
        }
        table "100"
    }
}