Documentation
VyOS Documentation
VyOS Configuration Examples
BGP IPv6 Unnumbered with Extended Nexthop

BGP IPv6 Unnumbered with Extended Nexthop

BGP IPv6 unnumbered lets you use IPv6 link-local addresses for BGP peering, simplifying the configuration of datacenter fabric and spine-leaf topologies. The extended nexthop capability allows IPv4 routes to be advertised over an IPv6 next-hop.

Use case

Applicability

  • Datacenter Fabric: Spine-leaf architecture with minimal configuration
  • Cloud Datacenter: Yandex Cloud / VK Cloud multi-AZ networking
  • Campus Networks: L3 underlay for large-scale networks
  • Service Provider: Carrier-grade backbone with simplified addressing

Benefits

  1. Configuration simplicity: No need to assign IP addresses to every link
  2. Scalability: No IP address planning required for point-to-point links
  3. Dual-Stack: Simultaneous support for IPv4 and IPv6 routes over IPv6 peering
  4. ECMP: Automatic Equal-Cost Multipath across multiple links
  5. Flexibility: Easy to add new links without readdressing

Network topology

Basic topology (2 routers)

                    ┌─────────────────┐
                    │   Router A      │
                    │   AS 64496      │
                    │   RID: 192.168.0.1
                    │                 │
                    │ lo: 192.168.0.1 │
                    │ eth1: link-local│
                    │ eth2: link-local│
                    └────┬───────┬────┘
                         │       │
                    eth1 │       │ eth2
                         │       │
                    eth1 │       │ eth2
                    ┌────┴───────┴────┐
                    │   Router B      │
                    │   AS 64499      │
                    │   RID: 192.168.0.2
                    │                 │
                    │ lo: 192.168.0.2 │
                    │ eth1: link-local│
                    │ eth2: link-local│
                    └─────────────────┘

Datacenter Spine-Leaf

     ┌─────────┐           ┌─────────┐
     │ Spine 1 │           │ Spine 2 │
     │ AS 65000│           │ AS 65000│
     └───┬─┬─┬─┘           └─┬─┬─┬───┘
         │ │ │               │ │ │
    ┌────┘ │ └────┐     ┌────┘ │ └────┐
    │      │      │     │      │      │
 ┌──┴──┐ ┌─┴───┐ ┌┴────┐│ ┌───┴─┐ ┌──┴──┐
 │Leaf1│ │Leaf2│ │Leaf3│  │Leaf4│ │Leaf5│
 │AS   │ │AS   │ │AS   │  │AS   │ │AS   │
 │65001│ │65002│ │65003│  │65004│ │65005│
 └─────┘ └─────┘ └─────┘  └─────┘ └─────┘

Requirements

Minimum requirements

  • VyOS 1.4 (Sagitta) or newer
  • IPv6 support on all interfaces
  • BGP extended-nexthop capability
  • Loopback interfaces for the Router ID

Network parameters (example)

ParameterRouter ARouter B
AS Number6449664499
Router ID192.168.0.1192.168.0.2
Loopback192.168.0.1/32192.168.0.2/32
eth1link-local onlylink-local only
eth2link-local onlylink-local only

Router A configuration

Interfaces

configure

# Loopback for Router ID and announcements
set interfaces loopback lo address '192.168.0.1/32'
set interfaces loopback lo description 'Router ID + BGP announce'

# eth1 - IPv6 link-local only (auto-generated)
set interfaces ethernet eth1 description 'BGP peer to Router B eth1'
set interfaces ethernet eth1 ipv6 address autoconf

# eth2 - IPv6 link-local only (auto-generated)
set interfaces ethernet eth2 description 'BGP peer to Router B eth2'
set interfaces ethernet eth2 ipv6 address autoconf

commit

BGP Configuration

configure

# Basic BGP parameters
set protocols bgp system-as '64496'
set protocols bgp parameters router-id '192.168.0.1'
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid

# Peer Group for the fabric
set protocols bgp peer-group fabric remote-as 'external'
set protocols bgp peer-group fabric capability extended-nexthop
set protocols bgp peer-group fabric address-family ipv4-unicast
set protocols bgp peer-group fabric address-family ipv6-unicast

# Neighbors on interfaces (v6only = use IPv6 link-local)
set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'

# Announce connected networks
set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp address-family ipv6-unicast redistribute connected

commit
save

Explanation of key parameters

  • interface v6only: Use the interface’s IPv6 link-local address for BGP peering
  • capability extended-nexthop: Allows IPv4 routes to be advertised with an IPv6 next-hop
  • no-ipv4-unicast: Do not activate the IPv4 AFI by default (it is activated in the peer-group)
  • multipath-relax: Allows ECMP across paths with different AS-PATH lengths
  • compare-routerid: Uses the Router ID to select the best path when metrics are equal

Router B configuration

configure

# Loopback
set interfaces loopback lo address '192.168.0.2/32'
set interfaces loopback lo description 'Router ID + BGP announce'

# Interfaces
set interfaces ethernet eth1 description 'BGP peer to Router A eth1'
set interfaces ethernet eth1 ipv6 address autoconf

set interfaces ethernet eth2 description 'BGP peer to Router A eth2'
set interfaces ethernet eth2 ipv6 address autoconf

# BGP
set protocols bgp system-as '64499'
set protocols bgp parameters router-id '192.168.0.2'
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid

# Peer Group
set protocols bgp peer-group fabric remote-as 'external'
set protocols bgp peer-group fabric capability extended-nexthop
set protocols bgp peer-group fabric address-family ipv4-unicast
set protocols bgp peer-group fabric address-family ipv6-unicast

# Neighbors
set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'

# Redistribute
set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp address-family ipv6-unicast redistribute connected

commit
save

Yandex Cloud integration

Scenario: Multi-AZ datacenter in Yandex Cloud

┌─────────────────────────────────────────────┐
│         Yandex Cloud VPC                    │
│                                             │
│  ┌──────────────┐       ┌──────────────┐   │
│  │  Zone A      │       │  Zone B      │   │
│  │              │       │              │   │
│  │ ┌─────────┐  │       │ ┌─────────┐  │   │
│  │ │ Spine-A │  │       │ │ Spine-B │  │   │
│  │ │ VyOS    │◄─┼───────┼─┤ VyOS    │  │   │
│  │ └────┬────┘  │       │ └────┬────┘  │   │
│  │      │       │       │      │       │   │
│  │  ┌───┴───┐   │       │  ┌───┴───┐   │   │
│  │  │ Leaf  │   │       │  │ Leaf  │   │   │
│  │  │ VMs   │   │       │  │ VMs   │   │   │
│  │  └───────┘   │       │  └───────┘   │   │
│  └──────────────┘       └──────────────┘   │
└─────────────────────────────────────────────┘

Spine configuration (Yandex Cloud)

configure

# Interfaces (eth0 = management)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Yandex Cloud VPC network'

# Loopback
set interfaces loopback lo address '10.255.0.1/32'

# eth1-eth5: link-local for BGP peers to the Leaf routers
set interfaces ethernet eth1 ipv6 address autoconf
set interfaces ethernet eth2 ipv6 address autoconf
set interfaces ethernet eth3 ipv6 address autoconf
set interfaces ethernet eth4 ipv6 address autoconf
set interfaces ethernet eth5 ipv6 address autoconf

# BGP - Spine AS
set protocols bgp system-as '65000'
set protocols bgp parameters router-id '10.255.0.1'
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters bestpath as-path multipath-relax

# Peer Group for the Leaf routers
set protocols bgp peer-group leafs remote-as 'external'
set protocols bgp peer-group leafs capability extended-nexthop
set protocols bgp peer-group leafs address-family ipv4-unicast
set protocols bgp peer-group leafs address-family ipv6-unicast

# Neighbors (Leaf 1-5)
set protocols bgp neighbor eth1 interface v6only peer-group 'leafs'
set protocols bgp neighbor eth2 interface v6only peer-group 'leafs'
set protocols bgp neighbor eth3 interface v6only peer-group 'leafs'
set protocols bgp neighbor eth4 interface v6only peer-group 'leafs'
set protocols bgp neighbor eth5 interface v6only peer-group 'leafs'

# Announce Loopback
set protocols bgp address-family ipv4-unicast network '10.255.0.1/32'

commit
save

Leaf configuration (Yandex Cloud)

configure

# Loopback
set interfaces loopback lo address '10.255.1.1/32'

# eth1-2: link-local to the Spine routers (ECMP)
set interfaces ethernet eth1 ipv6 address autoconf
set interfaces ethernet eth2 ipv6 address autoconf

# BGP - Leaf AS (unique per leaf)
set protocols bgp system-as '65001'
set protocols bgp parameters router-id '10.255.1.1'
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid

# Peer Group for the Spines
set protocols bgp peer-group spines remote-as 'external'
set protocols bgp peer-group spines capability extended-nexthop
set protocols bgp peer-group spines address-family ipv4-unicast
set protocols bgp peer-group spines address-family ipv6-unicast

# Neighbors
set protocols bgp neighbor eth1 interface v6only peer-group 'spines'
set protocols bgp neighbor eth2 interface v6only peer-group 'spines'

# Announce Loopback + connected networks
set protocols bgp address-family ipv4-unicast redistribute connected

commit
save

Monitoring through Yandex Monitoring

# CPU / Memory
yc monitoring metric-list --folder-id <folder-id>

# BGP sessions (custom metrics)
show ip bgp summary | grep -c Established > /tmp/bgp_sessions_up.txt

VK Cloud integration

Configuration adapted to VK Cloud Networking

configure

# VK Cloud uses OpenStack Neutron
# eth0 = management (VK Cloud VPC)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'VK Cloud management'

# Floating IP for external access (assigned in the VK Cloud Console)
# Internal interfaces eth1-X for the BGP fabric

# The rest of the configuration is the same as the Yandex Cloud example

commit
save

VK Cloud specifics

  1. Security Groups: Allow BGP (TCP 179) and ICMPv6 between VMs
  2. Floating IP: Used only for management, not for BGP peering
  3. MTU: 1500 by default; overlays may require 1450

Verifying the configuration

Checking the interfaces

# Link-local addresses (automatically generated)
show interfaces ethernet eth1
show interfaces ethernet eth2

# There should be IPv6 link-local addresses (fe80::/10)
# Example: fe80::5054:ff:fe12:3456/64

Checking BGP sessions

# BGP summary
show ip bgp summary

# Expected output:
# IPv4 Unicast Summary (VRF default):
# BGP router identifier 192.168.0.1, local AS number 64496
# RIB entries 3, using 576 bytes of memory
# Peers 2, using 1433 KiB of memory
# Peer groups 1, using 64 bytes of memory
#
# Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
# eth1            4      64499        45        46        0    0    0 00:20:15            1        2 N/A
# eth2            4      64499        43        44        0    0    0 00:20:10            1        2 N/A

# BGP neighbor details
show ip bgp neighbors eth1

# Check the extended-nexthop capability
show ip bgp neighbors eth1 | grep "Extended nexthop"
# Should read: Extended nexthop: advertised and received

Checking IPv4 routes over an IPv6 nexthop

# Routing table
show ip route bgp

# Example output:
# B>* 192.168.0.2/32 [20/0] via fe80::5054:ff:fe12:5678, eth1, weight 1, 00:15:20
#                            via fe80::5054:ff:fe12:9abc, eth2, weight 1, 00:15:15

# Note: IPv4 route with an IPv6 link-local next-hop (extended nexthop)

Checking IPv6 routes

show ipv6 route bgp

# Example:
# B>* ::/0 [20/0] via fe80::5054:ff:fe12:5678, eth1, weight 1, 00:20:00

Connectivity test

# Ping the neighbor's loopback
ping 192.168.0.2 count 4

# Traceroute
traceroute 192.168.0.2

# MTU Path Discovery
ping 192.168.0.2 size 1400 do-not-fragment

Detailed debugging

# BGP updates
show ip bgp neighbors eth1 advertised-routes
show ip bgp neighbors eth1 received-routes

# BGP attributes
show ip bgp 192.168.0.2/32

# FRR vtysh for in-depth debugging
vtysh
show bgp ipv4 unicast summary
show bgp ipv6 unicast summary
show bgp neighbors eth1 capabilities
exit

Troubleshooting

Problem 1: BGP sessions do not come up

Symptoms:

show ip bgp summary
# State/PfxRcd = "Active" or "Connect"

Causes and solutions:

  1. No IPv6 link-local address:

    # Check
show interfaces ethernet eth1 | grep inet6

# Solution: enable autoconf
set interfaces ethernet eth1 ipv6 address autoconf
commit

  2. Firewall blocks BGP:

    # Check the firewall
show firewall

# Allow BGP
set firewall ipv6-name WAN_LOCAL rule 100 action 'accept'
set firewall ipv6-name WAN_LOCAL rule 100 protocol 'tcp'
set firewall ipv6-name WAN_LOCAL rule 100 destination port '179'
set firewall ipv6-name WAN_LOCAL rule 100 source port '179'
commit

  3. Wrong AS number:

    # Check the configuration
show configuration commands | grep "bgp system-as"
show configuration commands | grep "remote-as"

Problem 2: Extended nexthop does not work

Symptoms: IPv4 routes are not accepted over the IPv6 BGP session

Solution:

# Check the capability
show ip bgp neighbors eth1 | grep "Extended nexthop"

# If "advertised and received" is missing:
configure
set protocols bgp peer-group fabric capability extended-nexthop
commit

Problem 3: ECMP does not work

Symptoms:

show ip route 192.168.0.2/32
# Shows only one path when there should be two

Solution:

configure
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid
commit

# Check FRR maximum-paths
vtysh
conf t
router bgp 64496
address-family ipv4 unicast
maximum-paths 64
exit
exit
exit

Problem 4: Slow convergence

Solution: Reduce the BGP timers

configure
set protocols bgp peer-group fabric timers keepalive '3'
set protocols bgp peer-group fabric timers holdtime '9'
commit

Problem 5: MTU issues

Symptoms: Connectivity works, but large packets do not get through

Solution:

# Check the MTU
show interfaces ethernet eth1

# Set the MTU (if a smaller value is needed)
set interfaces ethernet eth1 mtu '1500'
set interfaces ethernet eth2 mtu '1500'
commit

# Path MTU Discovery test
ping 192.168.0.2 size 1400 do-not-fragment
ping 192.168.0.2 size 1450 do-not-fragment
ping 192.168.0.2 size 1500 do-not-fragment

Best Practices

1. Router ID Planning

  • Use RFC1918 addresses for the Router ID (10.x.x.x or 192.168.x.x)
  • Assign loopback addresses from a single /16 block for the entire fabric
  • The Router ID must be unique across all BGP routers

2. AS Number Design

Spine-Leaf:

  • Spine: the same AS for all spines (for example, 65000)
  • Leaf: a unique AS for each leaf (65001, 65002, 65003…)

Benefits:

  • Automatic loop prevention (AS-PATH)
  • Configuration simplicity (remote-as external)

3. Timers

Production:

set protocols bgp peer-group fabric timers keepalive '3'
set protocols bgp peer-group fabric timers holdtime '9'

Provides fast failure detection (~9 seconds).

4. Security

# TTL security (recommended for eBGP)
set protocols bgp peer-group fabric ebgp-multihop '2'
set protocols bgp peer-group fabric ttl-security hops '1'

Explanation:

  • ttl-security hops 1: Accept only packets with TTL=255 (directly connected)
  • Protection against BGP hijacking from remote hosts

5. Prefix Limits

# Limit the number of accepted prefixes
set protocols bgp neighbor eth1 address-family ipv4-unicast maximum-prefix '1000'
set protocols bgp neighbor eth1 address-family ipv6-unicast maximum-prefix '500'

6. Graceful Restart

# For maintenance without full loss of connectivity
set protocols bgp parameters graceful-restart stalepath-time '300'

7. BFD for fast failover

# Enable BFD on the interfaces
set interfaces ethernet eth1 ip enable-bfd
set interfaces ethernet eth2 ip enable-bfd

# BFD for BGP neighbors
set protocols bgp neighbor eth1 bfd
set protocols bgp neighbor eth2 bfd

# BFD parameters
set protocols bfd peer fe80::5054:ff:fe12:5678 multihop local-address 'fe80::5054:ff:fe12:1234'
set protocols bfd peer fe80::5054:ff:fe12:5678 interval transmit '300'
set protocols bfd peer fe80::5054:ff:fe12:5678 interval receive '300'
set protocols bfd peer fe80::5054:ff:fe12:5678 interval multiplier '3'

Benefit: Sub-second failover (300ms * 3 = 900ms)

8. Logging and monitoring

# BGP logging
set system syslog global facility protocols level 'info'

# Log BGP neighbor changes
vtysh
conf t
log syslog informational
log record-priority
router bgp 64496
bgp log-neighbor-changes
exit
exit
exit

# Monitoring
watch show ip bgp summary

Advanced Configuration

Route Reflectors for large fabrics

For fabrics with > 50 routers:

# Route Reflector (Spine)
configure
set protocols bgp neighbor eth1 address-family ipv4-unicast route-reflector-client
set protocols bgp neighbor eth1 address-family ipv6-unicast route-reflector-client
# Repeat for all leaf neighbors
commit

iBGP between Spines

# Spine-to-Spine iBGP (for redundancy)
set protocols bgp neighbor 10.255.0.2 remote-as '65000'
set protocols bgp neighbor 10.255.0.2 update-source 'lo'
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast next-hop-self
commit

Anycast Gateway

# The same loopback IP on all Leaf routers (for the Anycast GW)
set interfaces loopback lo address '10.255.255.1/32'

# Announce over BGP
set protocols bgp address-family ipv4-unicast network '10.255.255.1/32'
commit

References

Reviewed by OpenNix LLC · Last updated on
FlexVPN to Cisco IOS-XEOSPF Unnumbered with ECMP