[BUG] VRF IPv6 BGP does not work on VyOS

ipspace commented 2 months ago

I can't figure out what the problem is -- VyOS seems to accept VRF BGP sessions for IPv6 neighbors (there are messages exchanged) but it looks like it immediately terminates them (BGP session is idle). Have no idea what's going on, the template looks good.

Test topology: https://github.com/ipspace/netlab/blob/dev/tests/integration/vrf/22-multi-vrf-bgp-ipv6.yml
Validation results: https://tests.netlab.tools/vyos/clab/vrf/22-multi-vrf-bgp-ipv6.yml-validate.log

ssasso commented 2 months ago

Since VyOS is using FRR under the hood, will try to compare the frr config from a VyOS container and a FRR container as DUT.

ssasso commented 2 months ago

... :/

vrf22# netlab validate
[session]  Check EBGP sessions with DUT [ node(s): r1,r2,r3,r4 ]
[PASS]     r1: Neighbor 2001:db8:3::1 (dut) is in state Established
[PASS]     r2: Neighbor 2001:db8:3:1::1 (dut) is in state Established
[PASS]     r3: Neighbor 2001:db8:3:2::1 (dut) is in state Established
[PASS]     r4: Neighbor 2001:db8:3:3::1 (dut) is in state Established
[PASS]     Test succeeded

[pfx_red]  Check IPv6 BGP prefix on R1 [ node(s): r1 ]
[PASS]     r1: The prefix 2001:db8:1:3::/64 is in the BGP table
[PASS]     Test succeeded

[pfx_blue] Check IPv6 BGP prefix on R3 [ node(s): r3 ]
[PASS]     r3: The prefix 2001:db8:1:5::/64 is in the BGP table
[PASS]     Test succeeded

[lb_red]   Check DUT loopback IPv6 BGP prefix in red VRF [ node(s): r1 ]
[PASS]     r1: The prefix 2001:db8:c001:cafe::/64 is in the BGP table
[PASS]     Test succeeded

[lb_blue]  Check DUT loopback IPv6 BGP prefix in blue VRF [ node(s): r3 ]
[PASS]     r3: The prefix 2001:db8:c001:cafe::/64 is in the BGP table
[PASS]     Test succeeded

[red]      Ping-based reachability test in VRF red [ node(s): r1 ]
[PASS]     r1: Ping to ipv6 r2 succeeded
[PASS]     Test succeeded

[ping]     Ping-based reachability test in VRF blue [ node(s): r3 ]
[PASS]     r3: Ping to ipv6 r4 succeeded
[PASS]     Test succeeded

[red_lb]   Pinging red VRF loopback [ node(s): r1 ]
[PASS]     r1: Ping to ipv6 2001:db8:c001:cafe::1 succeeded
[PASS]     Test succeeded

[blue_lb]  Pinging blue VRF loopback [ node(s): r3 ]
[PASS]     r3: Ping to ipv6 2001:db8:c001:cafe::1 succeeded
[PASS]     Test succeeded

[SUCCESS]  Tests passed: 12

I have 2 hypothesis for this:

running both VyOS and FRR as containers, we have dependencies on the host kernel, and I guess we are running different versions with different behaviors (I am still running on ubuntu 20.04, I guess you are on 22.04).
There was something broken in VyOS which has been fixed in the meantime (since we are running on rolling releases, and the container is re-built every other day).

ssasso commented 2 months ago

With Ubuntu 22.04 and forced latest version of both frr and vyos containers:

[session]  Check EBGP sessions with DUT [ node(s): r1,r2,r3,r4 ]
[PASS]     r1: Neighbor 2001:db8:3::1 (dut) is in state Established
[PASS]     r2: Neighbor 2001:db8:3:1::1 (dut) is in state Established
[PASS]     r3: Neighbor 2001:db8:3:2::1 (dut) is in state Established
[PASS]     r4: Neighbor 2001:db8:3:3::1 (dut) is in state Established
[PASS]     Test succeeded

[pfx_red]  Check IPv6 BGP prefix on R1 [ node(s): r1 ]
[PASS]     r1: The prefix 2001:db8:1:3::/64 is in the BGP table
[PASS]     Test succeeded

[pfx_blue] Check IPv6 BGP prefix on R3 [ node(s): r3 ]
[PASS]     r3: The prefix 2001:db8:1:5::/64 is in the BGP table
[PASS]     Test succeeded

[lb_red]   Check DUT loopback IPv6 BGP prefix in red VRF [ node(s): r1 ]
[PASS]     r1: The prefix 2001:db8:c001:cafe::/64 is in the BGP table
[PASS]     Test succeeded

[lb_blue]  Check DUT loopback IPv6 BGP prefix in blue VRF [ node(s): r3 ]
[PASS]     r3: The prefix 2001:db8:c001:cafe::/64 is in the BGP table
[PASS]     Test succeeded

[red]      Ping-based reachability test in VRF red [ node(s): r1 ]
[PASS]     r1: Ping to ipv6 r2 succeeded
[PASS]     Test succeeded

[ping]     Ping-based reachability test in VRF blue [ node(s): r3 ]
[PASS]     r3: Ping to ipv6 r4 succeeded
[PASS]     Test succeeded

[red_lb]   Pinging red VRF loopback [ node(s): r1 ]
[PASS]     r1: Ping to ipv6 2001:db8:c001:cafe::1 succeeded
[PASS]     Test succeeded

[blue_lb]  Pinging blue VRF loopback [ node(s): r3 ]
[PASS]     r3: Ping to ipv6 2001:db8:c001:cafe::1 succeeded
[PASS]     Test succeeded

[SUCCESS]  Tests passed: 12

ipspace commented 2 months ago

Yeah, they broke something in the container and VM image I used. I managed to update the container image and the test now passes, the Vagrant box cannot be downloaded (they broke something on Vagrant Cloud). Will retry "eventually" ;)

ipspace commented 2 months ago

Managed to pull down the latest Vagrant box. It passes the test.

ipspace / netlab

[BUG] VRF IPv6 BGP does not work on VyOS #1160