Theoretical foundations and architecture
The lab ties together the three lessons of the module. On the first topology you bring up an SR-MPLS core, tag the routes of the critical VRF A with color 200 and configure an ODN template that builds a path without the "red" links; the ordinary VRF B stays on the IGP shortest path. Then you shut a link, measure the loss, watch the policy become invalid while traffic falls back to the IGP, and check the return after restoration. On the second, independent topology you build an SRv6 L3VPN with uDT4 and compare it with SR-MPLS: the header, the overhead and the MTU test result. The goal is not to get nice numbers but to learn to predict the path and the SID list in advance, verify them in the outputs and explain the behavior at failure. Support for ODN, uSID and SRv6 depends on the platform and release, so some steps may require a different image.
The goal of the lab and what you prove
The lab combines three topics of the module into one verifiable scheme: ODN with a color for a critical VRF (lesson 1), two planes and failure protection (lesson 2) and a comparison with SRv6 L3VPN (lesson 3). The concrete statement you test: VRF A traffic with color 200 follows a path without RED links regardless of the IGP metric, VRF B traffic follows the shortest path, and when the only permitted path fails VRF A falls back to the IGP instead of disappearing. On the second topology you prove that an SRv6 L3VPN gives the same service without MPLS labels at the price of a longer header. Begin with a prediction: compute the path costs and the SID list by hand and only then compare with the output.
The topology and the expected paths
PE1 connects to P1 over a GREEN link with cost 10 and to P2 over a RED link with cost 5; P1-PE2 costs 10 and P2-PE2 costs 5. The shortest PE1-PE2 path goes through P2 and costs 10, the path through P1 costs 20. So a route without a color (VRF B) goes through P2. The ODN template for color 200 excludes links with the RED affinity, leaving only the path through P1 (cost 20). Because the Node-SID of PE2 sends traffic along the shortest path (through P2), forcing it through P1 requires a SID list with the Node-SID of P1 followed by the Node-SID of PE2: 16011, 16002. This is an important check: if you see a single SID 16002 in the policy, the RED constraint did not work (the affinity is not advertised or not assigned to the interface).
What happens at failure
When P1-PE2 is shut, three events occur. First: TI-LFA on P1 (the PLR) switches packets to a backup path within tens of milliseconds, which protects the traffic that is already going through P1 by the Node-SID. Second: the IGP converges, PE1 recomputes the policy path: without RED links there is no path to PE2 and the policy becomes invalid. Third: Automated Steering returns the VPN routes to the IGP, so VRF A takes the shortest path through P2, that is over the RED link. This is the expected behavior, but it violates the original intent "never use RED", so in production a fallback candidate path with a clear degradation is added, or drop-upon-invalid when an SLA violation is unacceptable. The lab records exactly this: what the operator sees and how long the loss window lasts. The values on your bench depend on the platform and the image; compare stages with each other, not with reference numbers.
Measurement method
Use a continuous ping with a 10-100 ms interval from CE-A1 to CE-A2 and from CE-B1 to CE-B2 at the same time. Count the loss as the number of lost replies multiplied by the interval. Cause the failure by disabling the link on the neighbouring node, not with shutdown on PE1, so that you do not get instant detection. Repeat each test several times and record the median and the maximum. Before the failure capture the state: the policy, the SID list, the trace, the label table and the BGP state; afterwards the same set. Write the difference into a table, not from memory. For virtual images account for CPU noise and feature limits: ODN, Flex-Algo, SRv6 and uSID are not supported on all images and releases, and a parser error or a down state without a reason indicates missing support.
The second topology: what to compare
The SRv6 topology is independent: it has no MPLS, locators are advertised in IS-IS, PE4 allocates End.DT4 (uDT4) for VRF A and PE3 receives it in VPNv4. Compare four things. The header: in a capture there is an outer IPv6 header with DA = the service SID and Next Header 4 (IPv4), there is no SRH with a single SID, and with traffic engineering an SRH or several uSIDs appear. Overhead: 40 bytes versus 8 bytes of labels (transport and service) in SR-MPLS. MTU: a ping of size 1500 with DF either passes or not depending on the core MTU; the result depends on the platform and release, so record it together with the MTU of every link. Protection: check that TI-LFA or a backup path works for SRv6 on the platform and that the locator did not disappear during the failure.
Acceptance criteria and rollback
The lab is passed when five conditions are met: the color 200 policy is up and uses a list without RED; VRF B goes through P2; at failure VRF A keeps connectivity through the IGP while the policy becomes down; after restoration the policy returned; and the SRv6 L3VPN works with an outer IPv6 header and no labels visible in a capture. Before starting, save the node configurations; afterwards clear the state: bring the links up and remove test policies and filters. If a policy does not come up, go top-down: the color in the route, the ODN template, the affinity, SID reachability, then MSD and platform limits.
Architecture Diagram & Topology
Topology 1: SR-MPLS core, SRGB 16000-23999 (Cisco default, not a standard)
10.0.0.0/30 metric 10 10.0.0.8/30
+----------- P1 10.255.0.11 -----------+
| GREEN GREEN |
CE-A1 -- PE1 10.255.0.1 PE2 10.255.0.2 -- CE-A2 192.168.20.0/24
CE-B1 -- (VRF A RT 65000:100, color 200) (export: color 200) -- CE-B2 172.16.20.0/24
| RED RED |
+----------- P2 10.255.0.12 -----------+
10.0.0.4/30 metric 5 10.0.0.12/30 metric 5
RR 10.255.0.100 (AS 65000); ODN template color 200 excludes RED
Topology 2: SRv6 L3VPN, block fcbb:bb01::/32 (second, separate network)
CE-A3 -- PE3 fcbb:bb01:3::/48 ----- P3 ----- PE4 fcbb:bb01:4::/48 -- CE-A4
RR fcbb:bb01:100::1, End.DT4 SID for VRF A on PE4: fcbb:bb01:4:e004::Traffic Flow & Label Stack Scheme
1. Build topology 1: IS-IS with SR, TI-LFA, VRF A and VRF B, PE2 colors VRF A routes 200.
2. VRF B (no color): PE1 reaches PE2 over the IGP shortest path via P2 (cost 10).
3. VRF A (color 200): PE1 creates the ODN policy; path excludes RED -> via P1 (cost 20).
4. Verify: policy up, SID list (16011, 16002), traceroute: VRF A hops via P1, VRF B via P2.
5. Fail the P1-PE2 link: TI-LFA repairs the IGP path; the policy has no path without RED.
6. The policy goes down; Automated Steering falls back to the IGP: VRF A now uses P2.
7. Restore the link: the policy is recomputed and VRF A returns to the P1 path.
8. Build topology 2 (SRv6): compare the encapsulation, SIDs, overhead and the MTU result.State & Parameter Comparison Table
| Stage | Action | Expected result |
|---|---|---|
| 1. Base network | IS-IS, SR, VRF A and B, color on the PE2 export | The VRF A route carries Color 200 |
| 2. Reference line | A trace in VRF B without a color | IGP path through P2 (lower cost) |
| 3. ODN | A color 200 template with exclude-any RED | The policy is up, VRF A goes through P1 |
| 4. P1-PE2 failure | Shut the link and measure the loss | The policy is down, VRF A falls back to the IGP through P2 |
| 5. Restoration | Bring the link back | The policy is recomputed and the path returns through P1 |
| 6. SRv6 | L3VPN on the second topology | An outer IPv6 header with the service SID, no labels |
Architectural model and principles
In real service provider networks, MPLS unifies equipment from multiple vendors. Below are practical configuration and operational verification examples across four platforms: Cisco IOS-XE/XR, Huawei VRP, Juniper Junos, and MikroTik RouterOS v7. Pay close attention to syntax nuances and label distribution mechanisms.
