Feature Request: 6VPE (VPNv6) - ipv6 address family

Today all mayor vendor provide support of 6VPE (VPNv6) on PE MPLS routers to garand the use of dual stack ipv4-v6. Now the market require the support of dual stack (ipv4,ipv6) under the same vrf.

On router OS we seen the mp-bgp doesn’t support VPNv6 (6VPE) and ipv6 address family.

When it will be supported ?

Thanks

Isacco
CCIE SP #44988

Most likely you will see this implemented in ROS v7.

Any update on this issue?

Normis says ROS v7 doesnt exist :stuck_out_tongue:

Sorry i kid i kid.

+1.

Hi mrz, are the plans to implement VPNv6 in ROS v7 maintained?

Is available since 7.15

Have you tested it?

Glad to seeing it!
I testing it in the lab with CHR mesh network topology. I can set vpnv6 under bgp connections but nothing really happens:

[admin@rtr1.CPE] > /routing/bgp/connection/export                            
# 2024-04-25 04:18:12 by RouterOS 7.15rc1
# software id = 
#
/routing bgp connection
add address-families=ip,l2vpn,l2vpn-cisco,vpnv4,vpnv6 as=65530 connect=no disabled=no listen=yes local.address=10.0.10.11 .role=ibgp-rr name=rrcl4 nexthop-choice=force-self \
    output.default-originate=if-installed .redistribute=connected remote.address=10.0.10.0/24 .as=65530 router-id=10.0.10.11 routing-table=main
[admin@rtr1.CPE] > /routing/bgp/session/print where remote.address=10.0.10.14
Flags: E - established 
 1 E name="rrcl4-1" 
     remote.address=10.0.10.14 .as=65530 .id=10.0.10.14 .capabilities=mp,rr,gr,as4 .afi=ip,l2vpn,l2vpn-cisco,vpnv4 .messages=18 .bytes=933 .eor="" 
     local.role=ibgp-rr .address=10.0.10.11 .as=65530 .id=10.0.10.11 .capabilities=mp,rr,gr,as4 .afi=ip,l2vpn,l2vpn-cisco,vpnv4 .messages=27 .bytes=4307 .eor="" 
     output.procid=20 .default-originate=if-installed 
     input.procid=20 ibgp 
     nexthop-choice=force-self multihop=yes hold-time=3m keepalive-time=1m uptime=6m15s130ms last-started=2024-04-25 04:12:08 prefix-count=11

There is no bgp activity under vpnv6. RoS7 Routing Protocol Status page indicating it is supported in 7.15 but 7.15 not yet released :wink: So I waiting.

Ok, so 7.15 is out, I tested it in LAB and it does not work. I getting curious and dumped the BGP traffic on links. I found that RouterOS sends incorrect SAFI NLRI for VPNv6:
Screenshot_2024-06-01_15-55-20.png
As RFC4659 (3.2. VPN IPv6 NLRI Encoding) says: AFI must be 2 and SAFI must be 128, but ROS sends BGP open messages with 2/129 which is VPNv6 multicast.

@oreggin, you have done a thorough analysis. Have you reported your discovery to support?
Now I have the reasons why I have not even been able to establish a BGP session in VPNv6.

Yes I have reported it in e-mail. I hope they can fix this easily in 7.15.1…

This is an automated message. Our bug tracker reports, that your issue has been fixed. This means that in the upcoming days, we plan to release a RouterOS update with this fix. Make sure to upgrade to the next release when it comes out soon.

The support engineer wrote that it was just a typo so it will be fixed in next stable-bugfix or in beta release…

Great news!

I replicate here the post I made in the 7.16beta release thread:

*) bgp - fixed vpnv6 safi;

Now I manage to establish the BGP session against the route reflector. However, there are some issues:

  • Although the VPNv6 session is established, it does not appear in the remote.afi parameter:
 1 E name="NP_REAL_2921_RR-2" 
     remote.address=10.1.1.36 .as=65000 .id=10.1.1.36 .capabilities=mp,rr,as4,err .afi=vpnv4 .messages=875 .bytes=73924 .eor="" 
     local.role=ibgp .address=10.1.1.11 .as=65000 .id=10.1.1.11 .capabilities=mp,rr,gr,as4 .afi=vpnv4 .messages=291 .bytes=5624 .eor="" 
     output.procid=21 
     input.procid=21 ibgp 
     multihop=yes hold-time=3m keepalive-time=1m uptime=4h48m17s690ms last-started=2024-06-06 10:01:47 last-stopped=2024-06-06 10:01:47 prefix-count=1053
  • The way the default route is represented is strange:
routing/route/print where afi=vpn6          
Flags: U - UNREACHABLE; b - BGP; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE
    DST-ADDRESS                          GATEWAY                 AFI   DISTANCE  SCOPE  TARGET-SCOPE
UbH 65000:111                           ::ffff:10.1.1.48         vpn6       200     40            30
UbH 2001:db8::/32&65000:111             ::ffff:10.1.1.84         vpn6       200     40            30

It seems to me BGP routes exchanged between routers but it doesn’t appearing in RIB over here. BGP session table doesn’t shows AFI correctly for me too however it negtiated.

Ok, so my routing is like this:

[admin@rtr1.CPE] > /routing/route/print where afi=vpn6
Flags: U - UNREACHABLE, A - ACTIVE; b - BGP, y - BGP-MPLS-VPN; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
    DST-ADDRESS                   GATEWAY                AFI   DISTANCE  SCOPE  TARGET-SCOPE  IMMEDIATE-GW  
Ay  b00b::10:11:11:0/112&65530:1  Loopback_VRF_A@VRF_A_  vpn6       200     40            10  Loopback_VRF_A
UbH b00b::10:12:11:0/112&65530:1  ::ffff:10.0.10.12      vpn6       200     40            30                
Ay  b00b::10:11:12:0/112&65530:2  Loopback_VRF_B@VRF_B_  vpn6       200     40            10  Loopback_VRF_B
UbH b00b::10:12:12:0/112&65530:2  ::ffff:10.0.10.12      vpn6       200     40            30

It is correct that VPNv6 routes gets IPv6 mapped IPv4 addresses as nexthop?
In cisco a VPNv6 route looks like this:

ASR1000#show ipv6 route vrf VRF_A 2001:xxxx:yyyy:zzzz::/56
Routing entry for 2001:xxxx:yyyy:zzzz::/56
  Known via "bgp 65001", distance 20, metric 0
  Tag 65000, type external
  Route count is 1/1, share count 0
  Routing paths:
    10.0.7.74%default indirectly connected
      Route metric is 0, traffic share count is 1
      MPLS label: 20
      MPLS Flags: NSF
      From A00:74A::FFFF:FFFF
      opaque_ptr 0x7F4F320D0F00
      Last updated 2w0d ago

This routes exchanged over an IPv4 BGP peer so the nexthop is IPv4 too. Am I right?

By default ipv4 mapped gateway is installed if the BGP session is also ipv4.
Either change gateway with routing filters or run vpnv6 on ipv6 BGP session.

1.: we have no LDPv6 nor SRv6 in our network so we can’t use VPNv6 over IPv6.
2.: I can’t figure out how to change GW address. I tried two ways of rules:

[admin@rtr2.CPE] > /routing/route/print where afi=vpn6
Flags: U - UNREACHABLE, A - ACTIVE; b - BGP, y - BGP-MPLS-VPN; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
    DST-ADDRESS                   GATEWAY                AFI   DISTANCE  SCOPE  TARGET-SCOPE  IMMEDIATE-GW  
UbH b00b::10:11:11:0/112&65530:1  ::ffff:10.0.10.11      vpn6       200     40            30                
Ay  b00b::10:12:11:0/112&65530:1  Loopback_VRF_A@VRF_A_  vpn6       200     40            10  Loopback_VRF_A
UbH b00b::10:11:12:0/112&65530:2  ::ffff:10.0.10.11      vpn6       200     40            30                
Ay  b00b::10:12:12:0/112&65530:2  Loopback_VRF_B@VRF_B_  vpn6       200     40            10  Loopback_VRF_B
[admin@rtr2.CPE] > /routing/filter/rule/print 
Flags: X - disabled, I - inactive 
 0   chain=BGP_out rule="set gw 10.0.10.12; accept" 

 1   chain=BGP_out rule="accept" 
[admin@rtr2.CPE] > 

[admin@rtr1.CPE] > /routing/route/print where afi=vpn6
Flags: U - UNREACHABLE, A - ACTIVE; b - BGP, y - BGP-MPLS-VPN; H - HW-OFFLOADED
Columns: DST-ADDRESS, GATEWAY, AFI, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
    DST-ADDRESS                   GATEWAY                AFI   DISTANCE  SCOPE  TARGET-SCOPE  IMMEDIATE-GW  
Ay  b00b::10:11:11:0/112&65530:1  Loopback_VRF_A@VRF_A_  vpn6       200     40            10  Loopback_VRF_A
UbH b00b::10:12:11:0/112&65530:1  ::ffff:10.0.10.12      vpn6       200     40            30                
Ay  b00b::10:11:12:0/112&65530:2  Loopback_VRF_B@VRF_B_  vpn6       200     40            10  Loopback_VRF_B
UbH b00b::10:12:12:0/112&65530:2  ::ffff:10.0.10.12      vpn6       200     40            30                
[admin@rtr1.CPE] > /routing/filter/rule/print where chain=BGP_out
Flags: X - disabled, I - inactive 
 3   chain=BGP_out rule="if (afi vpnv6) { set gw 10.0.10.11; accept }" 

 4   chain=BGP_out rule="accept" 
[admin@rtr1.CPE] >

unfortunately neither way works

In fact, the representation of the gateway for vpnv6 routes in Cisco is similar to what is shown in RouterOS:

# show bgp vpnv6 unicast vrf VRF1 
BGP table version is 3427, local router ID is 10.1.1.10
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, 
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, 
              x best-external, a additional-path, c RIB-compressed, 
              t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 65000:1000 (default for vrf VRF1)
 *>i  ::/0             ::FFFF:10.1.1.48
 *>i  2001:db8::/32    ::FFFF:10.1.1.84