hellt
commented
3 weeks ago Hi @spoignant-proton
Unfortunately I can't seem to reproduce this issue. I took your config examples and created a self-contained containerlab topology:
name: v6lla
topology:
nodes:
leaf1:
kind: nokia_srlinux
image: ghcr.io/nokia/srlinux:24.7.2
startup-config: |
interface ethernet-1/51 {
description "To SPINE:e1-1"
admin-state enable
subinterface 0 {
type routed
ipv6 {
admin-state enable
router-advertisement {
router-role {
admin-state enable
max-advertisement-interval 120
min-advertisement-interval 30
}
}
}
}
}
network-instance default {
admin-state enable
interface ethernet-1/51.0 {
}
protocols {
bgp {
autonomous-system 65001
router-id 100.65.32.4
dynamic-neighbors {
interface ethernet-1/51.0 {
peer-group underlay_fabric
allowed-peer-as [
65004
]
}
}
afi-safi ipv4-unicast {
admin-state enable
multipath {
allow-multiple-as true
maximum-paths 8
}
}
afi-safi ipv6-unicast {
admin-state disable
}
group underlay_fabric {
admin-state enable
}
}
}
}
spine1:
kind: nokia_srlinux
image: ghcr.io/nokia/srlinux:24.7.2
startup-config: |
interface ethernet-1/1 {
description "To Leaf:e1-51"
admin-state enable
subinterface 0 {
type routed
ipv6 {
admin-state enable
router-advertisement {
router-role {
admin-state enable
max-advertisement-interval 120
min-advertisement-interval 30
}
}
}
}
}
network-instance default {
admin-state enable
interface ethernet-1/1.0 {
}
protocols {
bgp {
admin-state enable
autonomous-system 65004
router-id 100.65.32.1
dynamic-neighbors {
interface ethernet-1/1.0 {
peer-group underlay_fabric
allowed-peer-as [
65001
]
}
}
afi-safi ipv4-unicast {
admin-state enable
multipath {
allow-multiple-as true
maximum-paths 8
}
}
afi-safi ipv6-unicast {
admin-state disable
}
group underlay_fabric {
admin-state enable
failure-detection {
enable-bfd true
fast-failover true
}
}
}
}
}
links:
- endpoints: [leaf1:e1-51, spine1:e1-1]This topology embeds the configs, so that you should have the nodes boot with the corresponding config bits applied. Once I deployed this topo I see the bgp established just fine:
--{ running }--[ ]--
A:leaf1# show network-instance default protocols bgp neighbor *
-------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "default"
Flags: S static, D dynamic, L discovered by LLDP, B BFD enabled, - disabled, * slow
-------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------
+----------------+-----------------------+----------------+------+---------+-------------+-------------+------------+-----------------------+
| Net-Inst | Peer | Group | Flag | Peer-AS | State | Uptime | AFI/SAFI | [Rx/Active/Tx] |
| | | | s | | | | | |
+================+=======================+================+======+=========+=============+=============+============+=======================+
| default | fe80::187d:1ff:feff:1 | underlay_fabri | D | 65004 | established | 0d:0h:0m:19 | ipv4- | [0/0/0] |
| | %ethernet-1/51.0 | c | | | | s | unicast | |
+----------------+-----------------------+----------------+------+---------+-------------+-------------+------------+-----------------------+
-------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
0 configured neighbors, 0 configured sessions are established, 0 disabled peers
1 dynamic peersfwiw, my v6 LLA are different in the two net nses:
--{ running }--[ ]--
A:spine1# bash
admin@spine1:~$ ip netns exec srbase ip a ls dev e1-1
10493: e1-1@if10494: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9232 qdisc noqueue state UP group default
link/ether 1a:05:01:ff:00:01 brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::a8c1:abff:fece:430c/64 scope link
valid_lft forever preferred_lft forever
admin@spine1:~$ ip netns exec srbase-default ip a ls dev e1-1.0
4: e1-1.0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 1a:05:01:ff:00:01 brd ff:ff:ff:ff:ff:ff link-netns srbase
inet6 fe80::1805:1ff:feff:1/64 scope link
valid_lft forever preferred_lft forever
spoignant-proton
protonjhow
I've hit this issue while trying to test an unnumbered bgp session (ipv6 link local addresses) between two srl containers running 24.7.2 or 23.10. It can be reproduced with the following minimal setup comprised of a leaf (srl/ixrd2l) and a spine (srl/ixrd3l). Port e1-51 of the leaf is connected to port e1-1 of the spine.
Configuration as in the attached files: spine.txt leaf.txt
The BGP session fails to establish, packet capture between the two containers shows that the ICMPv6 RA are correctly exchanged and one side attempt to establish the session. However, the other side replies with both SYN/ACK and RST before any OPEN has been sent which ends up the session prematurely.
Additionally, ping on the peer's link-local address reports duplicates:
After further investigation i believe this is because the parent interface inside the srbase container has a link-local address enabled, that happens to be the same than the child inside srbase-default. For example:
Therefore, the SYN is received inside both containers, srbase rejects it with RST (which causes the issue) and srbase-default accepts it.
To confirm, i ran the following commands, in order to get rid of the link-local address on the parent interface:
After this, the BGP session establishes successfully, and ping no longer shows duplicate packets, which confirm the aforementioned assumptions.
As another workaround, using vlan-tagging on the p2p interfaces prevent the issue from happening.