Package: linux-image
Version: 6.6.15-2 and 6.7.12-1
Hello,
I'm facing for some time a strange behavior of the route-leak. It happen
on both IPv4 and IPv6.
Configuration used: Debian Trixie, Kernel 6.7.12 with FRRouting 10.1 - git
VRF: internet
Default: just local management
Route-Leak between internet <-> default:
FRR config:
ip route 0.0.0.0/0 internet nexthop-vrf internet
..
router bgp 43XXX
..
address-family ipv4 unicast
redistribute connected route-map VPN-export-GRT-connected
no neighbor MPLS-v4 activate
no neighbor MPLS-v6 activate
no neighbor SPOKES-v4 activate
no neighbor SPOKES-v6 activate
label vpn export auto
rd vpn export 43474:11002
rt vpn import 43XXX:11000 43XXX:11999
rt vpn export 43XXX:11000
export vpn
import vpn
exit-address-family
!
address-family ipv4 vpn
neighbor MPLS-v4 activate
neighbor MPLS-v4 soft-reconfiguration inbound
neighbor SPOKES-v4 activate
neighbor SPOKES-v4 soft-reconfiguration inbound
exit-address-family
router bgp 43XXX vrf internet
address-family ipv4 unicast
maximum-paths 4
label vpn export auto
rd vpn export 43XXX:10002
rt vpn import 43XXX:10000 43XXX:10100 43XXX:10200 43XXX:10500
43XXX:10700 43XXX:10800 43XXX:10999
rt vpn export 43XXX:10000
export vpn
import vpn
..
route-map VPN-export-GRT-connected permit 1000
match ip address prefix-list pl-EASYNET-subnets
set extcommunity rt 43XXX:10999
exit
!
route-map VPN-export-GRT-connected permit 1100
match ipv6 address prefix-list pl-EASYNET-subnets
set extcommunity rt 43XXX:10999
exit
!
route-map VPN-export-GRT-connected deny 65535
exit
ip prefix-list pl-EASYNET-subnets description EASYNET IPv4 subnets
ip prefix-list pl-EASYNET-subnets seq 5 permit 89.X.X.0/24 le 32
ipv6 prefix-list pl-EASYNET-subnets description description EASYNET IPv6
subnets
ipv6 prefix-list pl-EASYNET-subnets seq 5 permit 2a00:XXXX:Y::/48 le 128
To be able to export local connected routes from default I'm using the
communities to export them into internet VRF.
In default I'm using a default route to vrf internet.
Route table:
S>* 0.0.0.0/0 [1/0] is directly connected, internet (vrf internet),
weight 1, 00:06:49
..
R02(config-if)# do sh ip route | include lo
Codes: K - kernel route, C - connected, L - local, S - static,
t - trapped, o - offload failure
O 10.100.2.1/32 [110/0] is directly connected, lo, weight 1, 00:15:41
L * 10.100.2.1/32 is directly connected, lo, 1d14h54m
C>* 10.100.2.1/32 is directly connected, lo, 1d14h54m
O 89.X.X.2/32 [110/0] is directly connected, lo, weight 1, 00:00:07
L * 89.X.X.2/32 is directly connected, lo, 00:00:07
C>* 89.X.X.2/32 is directly connected, lo, 00:00:07
O 89.X.Y.118/32 [110/0] is directly connected, lo, weight 1, 00:15:41
L * 89.X.Y.118/32 is directly connected, lo, 1d14h54m
C>* 89.X.Y.118/32 is directly connected, lo, 1d14h54m
R02(config-if)# do sh ip route vrf internet 89.X.X.2/32
Routing entry for 89.X.X.2/32
Known via "bgp", distance 20, metric 0, vrf internet, best
Last update 00:00:56 ago
* directly connected, lo(vrf default), weight 1
But the TCPDUMP looks like this:
root@R02:/home/adrian# tcpdump -nvlei any host 178.X.X.18 and icmp
tcpdump: data link type LINUX_SLL2
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2),
snapshot length 262144 bytes
17:01:05.137546 eth4-0 In ifindex 4 78:19:f7:XX:XX:XX ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 56, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137546 wan0 In ifindex 8 78:19:f7:XX:XX:XX ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 56, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137546 wan0.650 In ifindex 12 78:19:f7:XX:XX:XX ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 56, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137600 lo In ifindex 1 00:00:00:00:00:00 ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 55, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137614 lo In ifindex 1 00:00:00:00:00:00 ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 54, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137622 lo In ifindex 1 00:00:00:00:00:00 ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 53, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
..
17:01:05.137989 lo In ifindex 1 00:00:00:00:00:00 ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 2, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.38.116.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.137996 lo In ifindex 1 00:00:00:00:00:00 ethertype IPv4
(0x0800), length 104: (tos 0x0, ttl 1, id 64325, offset 0, flags [DF],
proto ICMP (1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.138027 internet Out ifindex 11 36:7d:d1:XX:XX:XX ethertype IPv4
(0x0800), length 132: (tos 0xc0, ttl 64, id 21454, offset 0, flags
[none], proto ICMP (1), length 112)
89.X.X2 > 178.X.X.18: ICMP time exceeded in-transit, length 92
(tos 0x0, ttl 1, id 64325, offset 0, flags [DF], proto ICMP
(1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.138034 wan0.2320 Out ifindex 14 00:e0:ed:XX:XX:XX ethertype
IPv4 (0x0800), length 132: (tos 0xc0, ttl 64, id 21454, offset 0, flags
[none], proto ICMP (1), length 112)
89.X.X2 > 178.X.X.18: ICMP time exceeded in-transit, length 92
(tos 0x0, ttl 1, id 64325, offset 0, flags [DF], proto ICMP
(1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.138036 wan0 Out ifindex 8 00:e0:ed:XX:XX:XX ethertype IPv4
(0x0800), length 132: (tos 0xc0, ttl 64, id 21454, offset 0, flags
[none], proto ICMP (1), length 112)
89.X.X2 > 178.X.X.18: ICMP time exceeded in-transit, length 92
(tos 0x0, ttl 1, id 64325, offset 0, flags [DF], proto ICMP
(1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
17:01:05.138040 eth4-0 Out ifindex 4 00:e0:ed:XX:XX:XX ethertype IPv4
(0x0800), length 132: (tos 0xc0, ttl 64, id 21454, offset 0, flags
[none], proto ICMP (1), length 112)
89.X.X2 > 178.X.X.18: ICMP time exceeded in-transit, length 92
(tos 0x0, ttl 1, id 64325, offset 0, flags [DF], proto ICMP
(1), length 84)
178.X.X.18 > 89.X.X2: ICMP echo request, id 33972, seq 6, length 64
--
Development @EasyNet
Web: www.easynet.dev <https://www.easynet.dev>
