Today all mayor vendor provide support of 6VPE (VPNv6) on PE MPLS routers to garand the use of dual stack ipv4-v6. Now the market require the support of dual stack (ipv4,ipv6) under the same vrf.
On router OS we seen the mp-bgp doesn’t support VPNv6 (6VPE) and ipv6 address family.
Ok, so 7.15 is out, I tested it in LAB and it does not work. I getting curious and dumped the BGP traffic on links. I found that RouterOS sends incorrect SAFI NLRI for VPNv6:
As RFC4659 (3.2. VPN IPv6 NLRI Encoding) says: AFI must be 2 and SAFI must be 128, but ROS sends BGP open messages with 2/129 which is VPNv6 multicast.
@oreggin, you have done a thorough analysis. Have you reported your discovery to support?
Now I have the reasons why I have not even been able to establish a BGP session in VPNv6.
This is an automated message. Our bug tracker reports, that your issue has been fixed. This means that in the upcoming days, we plan to release a RouterOS update with this fix. Make sure to upgrade to the next release when it comes out soon.
The support engineer wrote that it was just a typo so it will be fixed in next stable-bugfix or in beta release…
It seems to me BGP routes exchanged between routers but it doesn’t appearing in RIB over here. BGP session table doesn’t shows AFI correctly for me too however it negtiated.
By default ipv4 mapped gateway is installed if the BGP session is also ipv4.
Either change gateway with routing filters or run vpnv6 on ipv6 BGP session.
1.: we have no LDPv6 nor SRv6 in our network so we can’t use VPNv6 over IPv6.
2.: I can’t figure out how to change GW address. I tried two ways of rules:
[admin@rtr2.CPE] > /routing/route/print where afi=vpn6
Flags: U - UNREACHABLE, A - ACTIVE; b - BGP, y - BGP-MPLS-VPN; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
DST-ADDRESS GATEWAY AFI DISTANCE SCOPE TARGET-SCOPE IMMEDIATE-GW
UbH b00b::10:11:11:0/112&65530:1 ::ffff:10.0.10.11 vpn6 200 40 30
Ay b00b::10:12:11:0/112&65530:1 Loopback_VRF_A@VRF_A_ vpn6 200 40 10 Loopback_VRF_A
UbH b00b::10:11:12:0/112&65530:2 ::ffff:10.0.10.11 vpn6 200 40 30
Ay b00b::10:12:12:0/112&65530:2 Loopback_VRF_B@VRF_B_ vpn6 200 40 10 Loopback_VRF_B
[admin@rtr2.CPE] > /routing/filter/rule/print
Flags: X - disabled, I - inactive
0 chain=BGP_out rule="set gw 10.0.10.12; accept"
1 chain=BGP_out rule="accept"
[admin@rtr2.CPE] >
[admin@rtr1.CPE] > /routing/route/print where afi=vpn6
Flags: U - UNREACHABLE, A - ACTIVE; b - BGP, y - BGP-MPLS-VPN; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
DST-ADDRESS GATEWAY AFI DISTANCE SCOPE TARGET-SCOPE IMMEDIATE-GW
Ay b00b::10:11:11:0/112&65530:1 Loopback_VRF_A@VRF_A_ vpn6 200 40 10 Loopback_VRF_A
UbH b00b::10:12:11:0/112&65530:1 ::ffff:10.0.10.12 vpn6 200 40 30
Ay b00b::10:11:12:0/112&65530:2 Loopback_VRF_B@VRF_B_ vpn6 200 40 10 Loopback_VRF_B
UbH b00b::10:12:12:0/112&65530:2 ::ffff:10.0.10.12 vpn6 200 40 30
[admin@rtr1.CPE] > /routing/filter/rule/print where chain=BGP_out
Flags: X - disabled, I - inactive
3 chain=BGP_out rule="if (afi vpnv6) { set gw 10.0.10.11; accept }"
4 chain=BGP_out rule="accept"
[admin@rtr1.CPE] >
In fact, the representation of the gateway for vpnv6 routes in Cisco is similar to what is shown in RouterOS:
# show bgp vpnv6 unicast vrf VRF1
BGP table version is 3427, local router ID is 10.1.1.10
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1000 (default for vrf VRF1)
*>i ::/0 ::FFFF:10.1.1.48
*>i 2001:db8::/32 ::FFFF:10.1.1.84