I picked this up again and migrating my dozens of static route leaks and now I am facing this exact issue again.
I am 100% confident that traffic doesn't pass because the route target is vrf@vrf instead of interface@vrf.
Anyone else facing this?
This is really absolutely the same as described in the documentation!
PS: It's not a firewall issue, I have temporarily enabled all INPUT and FORWARD for testing. Here is a packet sniffer shot from (a) the working case with static route leak (b) the dynamic case. In this test, a host in vrf-main (on interface vlan3, 10.227.79.104) is pinging www.kernel.org, reachable via vrf-wwan. It's evident that the issue is that the return packet is sent via vrf-main device instead of vlan3. That seems to be a black hole. Why the heck does documentation say this could possibly work?
Routing table for case 1 (working):
/routing/route/print detail where dst-address=10.227.79.0/24 and routing-table=vrf-fiber
Flags: X - DISABLED, F - FILTERED, U - UNREACHABLE, A - ACTIVE;
c - CONNECT, s - STATIC, r - RIP, b - BGP, n - BGP-NET, o - OSPF, i - ISIS, d - DHCP, v - VPN, m - MODEM, a - LDP-ADDRESS, l - LDP-MAPPING>
H - HW-OFFLOADED; + - ECMP, B - BLACKHOLE
y afi=ip contribution=best-candidate dst-address=10.227.79.0/24 routing-table=vrf-fiber gateway=vrf-main@vrf-main
immediate-gw=vrf-main distance=200 scope=20 target-scope=10 belongs-to="bgp-mpls-vpn-2-vrf-main-connected-export-import"
bgp.ext-communities=rt:64512:100 .origin=incomplete
route-distinguisher="64512:1"
debug.fwp-ptr=0x203045A0
As afi=ip contribution=active dst-address=10.227.79.0/24 routing-table=vrf-fiber gateway=vlan3@vrf-main immediate-gw=vlan3 distance=1
scope=30 target-scope=10 belongs-to="static"
debug.fwp-ptr=0x203020C0
Routing table for case 2 (not working):
/routing/route/print detail where dst-address=10.227.79.0/24 and routing-table=vrf-fiber
Flags: X - DISABLED, F - FILTERED, U - UNREACHABLE, A - ACTIVE;
c - CONNECT, s - STATIC, r - RIP, b - BGP, n - BGP-NET, o - OSPF, i - ISIS, d - DHCP, v - VPN, m - MODEM, a - LDP-ADDRESS, l - LDP-MAPPING>
H - HW-OFFLOADED; + - ECMP, B - BLACKHOLE
Xs contribution=(unknown) dst-address=10.227.79.0/24 routing-table=vrf-fiber gateway=vlan3@vrf-main distance=1 scope=30
target-scope=10
Ay afi=ip contribution=active dst-address=10.227.79.0/24 routing-table=vrf-fiber gateway=vrf-main@vrf-main immediate-gw=vrf-main
distance=200 scope=20 target-scope=10 belongs-to="bgp-mpls-vpn-2-vrf-main-connected-export-import"
bgp.ext-communities=rt:64512:100 .origin=incomplete
route-distinguisher="64512:1"
debug.fwp-ptr=0x203045A0