Multi-Domain ISIS-SR with BGP-LU and EVPN L2VPN/L3VPN Overlay on OcNOS

Scaling IS-IS Segment Routing to nationwide or global service provider networks requires partitioning the network into multiple IGP domains — each IS-IS domain operates independently with its own SRGB and topology. BGP Labeled Unicast (BGP-LU) stitches these SR domains together at the ASBR (Autonomous System Border Router) level, enabling end-to-end EVPN services without requiring a single flat IS-IS domain or full-mesh BGP between all PEs.

Multi-Domain Architecture

BGP-LU: Stitching SR Domains

BGP Labeled Unicast distributes MPLS-labeled IPv4/IPv6 prefixes (loopback addresses) between SR domains. The ASBR:

1. Receives the SR label for a PE loopback from Domain 1’s IS-IS
2. Re-originates it into Domain 2 with a new BGP-allocated label
3. Programs its forwarding table to swap the incoming label to the outgoing SR label

This allows PE1 in Domain 1 to reach PE2 in Domain 2 using a two-label stack: the BGP-LU label (outer) and the EVPN service label (inner).

ASBR Configuration: BGP-LU Label Stitching

! OcNOS -- ASBR: BGP-LU stitching between Domain 1 and Domain 2
!
! Step 1: IS-IS redistribution (redistribute D1 loopbacks into BGP-LU)
router isis DOMAIN1
  net 49.0001.0000.0000.0100.00
  segment-routing mpls
  address-family ipv4 unicast
    segment-routing mpls
    redistribute bgp 65001 metric 1000 route-map PERMIT-ALL
  exit-address-family
!
! Step 2: BGP-LU between ASBRs (or to Route Reflector)
router bgp 65001
  bgp router-id 10.0.0.100
  !
  ! iBGP to Domain 1 PEs (for EVPN)
  neighbor 10.0.0.1 remote-as 65001      ! PE1
  neighbor 10.0.0.1 update-source lo
  !
  ! eBGP to Domain 2 ASBR for BGP-LU
  neighbor 192.168.100.2 remote-as 65002
  !
  ! BGP Labeled Unicast address family
  address-family ipv4 labeled-unicast
    neighbor 10.0.0.1 activate           ! Receive D1 loopbacks with labels
    neighbor 192.168.100.2 activate      ! Advertise to D2 with new labels
    neighbor 192.168.100.2 send-label    ! Allocate and send BGP label
    neighbor 192.168.100.2 route-map EXPORT-LOOPBACKS out
  exit-address-family
  !
  ! EVPN sessions: PE-to-PE across domains (direct or via RR)
  address-family l2vpn evpn
    neighbor 10.0.0.1 activate
  exit-address-family
!
route-map EXPORT-LOOPBACKS permit 10
  match ip address prefix-list PE-LOOPBACKS
!
ip prefix-list PE-LOOPBACKS permit 10.0.0.0/8 le 32

PE Configuration: EVPN Services Across Domains

! OcNOS -- PE1: EVPN services extending to Domain 2
! PE1 uses BGP-LU label to reach PE2 across the ASBR
!
! Step 1: IS-IS SR in Domain 1
router isis DOMAIN1
  net 49.0001.0000.0000.0001.00
  segment-routing mpls
  fast-reroute per-prefix level-2 ti-lfa
  address-family ipv4 unicast
    segment-routing mpls
  exit-address-family
!
interface lo
  ip address 10.0.0.1/32
  ip router isis DOMAIN1
  isis segment-routing prefix-sid index 1
!
! Step 2: BGP EVPN to PE2 (cross-domain via RR or direct)
router bgp 65001
  neighbor 10.0.0.2 remote-as 65001     ! PE2 in Domain 2 (via RR)
  neighbor 10.0.0.2 update-source lo
  neighbor 10.0.0.2 ebgp-multihop 5     ! If eBGP cross-domain
  !
  address-family l2vpn evpn
    neighbor 10.0.0.2 activate
  exit-address-family
!
! Step 3: EVPN L3VPN service (same as single-domain config)
vrf TENANT-A
  rd 65001:1000
  route-target import 65001:1000
  route-target export 65001:1000
!
router bgp 65001
  vrf TENANT-A
    address-family ipv4 unicast
      redistribute connected
    exit-address-family
!
router bgp 65001
  address-family l2vpn evpn
    advertise ipv4 unicast
  exit-address-family

Verification Commands

! OcNOS -- Multi-domain verification
!
! Verify BGP-LU labels at ASBR:
show bgp ipv4 labeled-unicast
! Expected: PE loopbacks with both local and remote labels
!
! Verify MPLS forwarding at ASBR (label swap):
show mpls forwarding-table
! Expected: incoming D1 label -> swap -> outgoing D2/BGP-LU label
!
! Verify EVPN sessions cross-domain:
show bgp l2vpn evpn summary
!
! Verify VRF routes reach remote PE:
show ip route vrf TENANT-A
!
! Check TI-LFA within each domain:
show isis fast-reroute summary

• EVPN-L3VPN: Single Domain
• SR-MPLS Fundamentals
• LDP to SR Migration
• OcNOS-SP Product Page
• Contact IP Infusion

IP Infusion Engineering Team