6PE, 6VPE and inter-domain lab

Theoretical foundations and architecture

Laboratory: carrying IPv6 across an IPv4 MPLS core with 6PE and 6VPE, and checking the same solution at the boundary of two ASes. Dual-stack is needed only on the PEs; P routers do not know IPv6: 1. 6PE (RFC 4798) carries global IPv6. PEs exchange the IPv6 labeled unicast family (AFI 2 / SAFI 4) over iBGP between IPv4 loopbacks; the next hop is the IPv4-mapped address ::FFFF:IPv4_PE, and a label is bound to each prefix. P routers switch by the outer transport label. 2. 6VPE (RFC 4659) is the same for VRFs: the VPNv6 family (AFI 2 / SAFI 128), 192-bit prefixes (64-bit RD + 128-bit IPv6), stack [transport | VPN label]. 3. Inter-AS: options A, B and C work for IPv6 too; in Option B the ASBRs exchange VPNv6, in Option C IPv4 BGP-LU carries the loopbacks and VPNv6 runs between the RRs.

The task: IPv6 across a core that knows only IPv4

The AS 65000 operator has a core (P1 10.255.0.11, RR 10.255.0.100) set up for IPv4 MPLS: an IGP and LDP on IPv4 loopback addresses. IPv6 subscribers must be carried without enabling IPv6 on the P routers. The solution is two mechanisms in which an IPv6 packet travels inside an LSP to the IPv4 loopback of the remote PE; dual-stack is needed only on the PEs.

6PE (RFC 4798): global IPv6 over an IPv4 LSP

• Signaling: an iBGP session between the IPv4 loopback addresses (PE1 10.255.0.1 - RR 10.255.0.100) carries the IPv6 family with labels: AFI 2 / SAFI 4 (labeled unicast, RFC 8277). NLRI = an IPv6 prefix + a label. On Cisco it is address-family ipv6 + neighbor ... send-label, on Huawei ipv6-family unicast + label-route-capability, on Junos family inet6 labeled-unicast explicit-null.
• Next hop: a 16-byte IPv4-mapped address ::FFFF:10.255.0.2, i.e. the IPv4 loopback address of the remote PE embedded in IPv6. BGP builds it from the address used for the IPv4 session (update-source), so the session must use Loopback0: the next-hop address must match the /32 that has an LDP label.
• Forwarding: PE1 looks up 2001:db8:2::/64, finds the next hop ::FFFF:10.255.0.2, resolves it into the IPv4 LSP to 10.255.0.2/32 and pushes the stack [LDP transport | IPv6 label | IPv6]. The P routers switch by the top label and do not open the IPv6 header.
• Explicit null: if PE2 had advertised implicit-null for the IPv6 prefix, the penultimate node would remove the last label and hand PE2 a packet with the MPLS EtherType but without a label; therefore a real per-prefix label (Cisco) or the IPv6 explicit null (label 2; Junos explicit-null) is used - PE2 keeps a label by which it understands that IPv6 is inside.

6VPE (RFC 4659): IPv6 in a VRF

6VPE is an L3VPN for IPv6: the same VRFs, RD/RT and VPN labels, but the VPNv6 family (AFI 2 / SAFI 128). NLRI = RD (8 bytes) + an IPv6 prefix (16 bytes); the next hop is 24 bytes (RD 0 + ::FFFF:IPv4). The stack is [LDP transport | VPN label | IPv6]. On Cisco the VRF gets address-family ipv6 (vrf definition A-V6), on Huawei ipv6-family in ip vpn-instance, on Junos family inet6 on the interface and family inet6-vpn unicast in BGP. One VRF can carry both IPv4 and IPv6 with a common RD and different RTs per family.

Inter-AS for IPv6

The three variants from the previous lessons work for IPv6 as well:

• Option A: separate IPv6 subinterfaces on the ASBR and eBGP IPv6 inside the VRF (address-family ipv6 vrf); there are no labels on the boundary.
• Option B: ASBR1 10.1.0.1 (AS 65000) and ASBR2 10.1.0.2 (AS 65001) exchange VPNv6 over the same IPv4 eBGP session as VPNv4 (address-family vpnv6, neighbor ... activate); the ASBR applies next-hop-self (the IPv4-mapped address of its loopback), allocates a label and performs a swap. An ASBR without VRFs needs the same mechanism for retaining foreign RTs (no bgp default route-target filter, undo policy vpn-target, Junos keep all).
• Option C: the ASBRs exchange only the IPv4 loopbacks of PEs/RRs with labels (IPv4 BGP-LU), while VPNv6 runs over a multihop session between the RRs preserving the next hop. Since the next hop is the ::FFFF: address of the remote PE, it resolves into the same inter-operator IPv4 LSP: IPv6 needs no separate transport signaling.

IPv6-specific traps

• ICMPv6 and traceroute: a P router without IPv6 cannot send ICMPv6 Time Exceeded or Packet Too Big; the message travels along the LSP to the egress PE and returns from there. In practice an IPv6 traceroute across 6PE shows stars or a large delay on the P hops, and the core can be hidden by disabling TTL copying.
• Path MTU: because the P routers do not send ICMPv6 Packet Too Big, an MTU problem in the core turns into a black hole. The core MTU must be no smaller than the MTU on the PE plus 4 bytes of label per level (8 bytes in 6PE/6VPE), and the minimum IPv6 MTU of 1280 must pass without fragmentation.
• Next hop: if the session with the RR is not sourced from the loopback, the next hop becomes an interface address; there is no LDP label for it and 6PE breaks.
• The RR must support the families: the RR needs ipv6 labeled-unicast and vpnv6 with route-reflector-client; without them the PEs see each other over IPv4 but receive no IPv6 routes.
• PE-CE: IPv6 PE-CE needs separate adjacencies (eBGP over IPv6 link-local or global addresses, static routes); ipv6 enable on the interface and ipv6 unicast-routing are mandatory.

Architecture Diagram & Topology

+---------------------+      IPv4-Only MPLS Core Backbone      +---------------------+
|      6PE / 6VPE     | =====================================> |      6PE / 6VPE     |
| Ingress: IPv6 Native| [Outer: IPv4 LDP | Inner: IPv6 Label]  | Egress: IPv6 Native |
| Encapsulates to IPv4| (No IPv6 required on Core P routers!)  | Decapsulates to IPv6|
+---------------------+                                        +---------------------+

Traffic Flow & Label Stack Scheme

6PE / 6VPE Packet Processing:
1. Ingress PE receives native IPv6 packet (2001:db8:1::1 -> 2001:db8:2::1).
2. Look up BGP Next-Hop (IPv4-mapped IPv6 address ::FFFF:10.255.0.2).
3. Push Inner Label: Allocated by BGP for IPv6 prefix / VRF.
4. Push Outer Label: Standard IPv4 LDP / SR transport label toward 10.255.0.2.
5. Core P routers switch packet using standard IPv4 transport labels. Core knows NOTHING about IPv6!

State & Parameter Comparison Table

Architectural model and principles

In real service provider networks, MPLS unifies equipment from multiple vendors. Below are practical configuration and operational verification examples across four platforms: Cisco IOS-XE/XR, Huawei VRP, Juniper Junos, and MikroTik RouterOS v7. Pay close attention to syntax nuances and label distribution mechanisms.

Practical Configuration (Cisco, Huawei, Juniper, MikroTik)

Cisco (IOS-XE/XR)

ipv6 unicast-routing
interface GigabitEthernet2
 description CE-global-IPv6
 ipv6 address 2001:DB8:1::1/64
router bgp 65000
 neighbor 10.255.0.100 remote-as 65000
 neighbor 10.255.0.100 update-source Loopback0
 address-family ipv6
  network 2001:DB8:1::/64
  neighbor 10.255.0.100 activate
  neighbor 10.255.0.100 send-label
 exit-address-family

A minimal 6PE on PE1: ipv6 unicast-routing enables IPv6 routing, and the interface towards the CE gets a global IPv6 address. The iBGP session to the RR stays IPv4 and uses Loopback0 - the next hop ::FFFF:10.255.0.1 is built from this address. In address-family ipv6 the prefix is originated with network, and send-label enables IPv6 labeled unicast (AFI 2 / SAFI 4): a label is passed with every IPv6 prefix. The P routers need no IPv6.

Huawei (VRP)

ipv6
interface GigabitEthernet0/0/2
 ipv6 enable
 ipv6 address 2001:DB8:1::1/64
bgp 65000
 peer 10.255.0.100 as-number 65000
 peer 10.255.0.100 connect-interface LoopBack0
 ipv6-family unicast
  network 2001:DB8:1:: 64
  peer 10.255.0.100 enable
  peer 10.255.0.100 label-route-capability