Routes EBGP advertised to IBGP neighbors but not reachable (pingable) via non border routers

[matdubuisson]

Hello everyone,

I do a project for school and I'm learning Route Reflectors but I'm stuck for a while on a issue that I haven't found solutions for it so I come to you.

I have created a virtual network where for now there are two AS one principal AS 1 and an other AS 10, I have connected the router R0 GOOGLE (fc00:2142:2::0) of AS 10 to the router R0 (fc00:2142::0) of the AS 1 in EBGP session. The R0 GOOGLE advertises the subnet fc00:2142:2:1::/64 and R0 receives it well and can reach the host behind RO GOOGLE at ipv6 fc00:2142:2:1::2. R0 announces the route to its route reflector R1 (fc00:2142::1) and R3 (fc00:2142::3) but here I focus on R1. R1 chooses the route passing by R0 as it a closest next hop and doing a show bgp I can see the route from the AS 10.

My question is why R1 can't ping the host fc00:2142:2:1::2, when doing a traceroute6 I see the connection being stuck when reaching a border routers. So my problem is that all routers border or not receive the route but only the border ones can reach it (ping) ? I'm practically sure that the problem is from R0.

I put some logs if it can help and my configs below.

Thank you very much for you help,
If I finally find I'll report my answer,

FROM R0 GOOGLE :

usa-google-r0# show bgp 
BGP table version is 1, local router ID is 0.0.10.0, vrf id 0
Default local pref 100, local AS 10
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  fc00:2142:2:1::/64
                    ::                       0         32768 i

Displayed 1 routes and 1 total paths
usa-google-r0# show bgp summary 

IPv4 Unicast Summary:
BGP router identifier 0.0.10.0, local AS number 10 VRF default vrf-id 0
BGP table version 0
RIB entries 0, using 0 bytes of memory
Peers 2, using 34 KiB of memory

Neighbor           V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
fc00:2142:2:0:1::1 4          1        18        16        0    0    0 00:05:57        NoNeg    NoNeg N/A
fc00:2142:2:0:2::1 4          1        19        16        0    0    0 00:05:57        NoNeg    NoNeg N/A

Total number of neighbors 2
usa-google-r0# exit
usa-google-r0:/# ping6 fc00:2142:2:1::2
PING fc00:2142:2:1::2(fc00:2142:2:1::2) 56 data bytes
64 bytes from fc00:2142:2:1::2: icmp_seq=1 ttl=64 time=0.030 ms
64 bytes from fc00:2142:2:1::2: icmp_seq=2 ttl=64 time=0.037 ms
^C
--- fc00:2142:2:1::2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1012ms
rtt min/avg/max/mdev = 0.030/0.033/0.037/0.003 ms

FROM R0 :

usa-r0# show bgp summary 

IPv6 Unicast Summary:
BGP router identifier 0.0.1.0, local AS number 1 VRF default vrf-id 0
BGP table version 2
RIB entries 1, using 128 bytes of memory
Peers 3, using 50 KiB of memory

Neighbor           V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
fc00:2142::1       4          1        12        14        2    0    0 00:07:00            0        1 FRRouting/10.1.1_git
fc00:2142::3       4          1        13        14        2    0    0 00:07:01            1        1 FRRouting/10.1.1_git
fc00:2142:2:0:1::2 4         10        18        20        2    0    0 00:07:27            1        1 N/A

Total number of neighbors 3
usa-r0# show bgp 
BGP table version is 2, local router ID is 0.0.1.0, vrf id 0
Default local pref 100, local AS 1
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  fc00:2142:2:1::/64
                    fe80::a8c1:abff:feff:4bc3
                                             0    150      0 10 i
 * i                  fc00:2142::3             0    150      0 10 i

Displayed 1 routes and 2 total paths
usa-r0# exit
usa-r0:/# ping6 fc00:2142:2:1::2
PING fc00:2142:2:1::2(fc00:2142:2:1::2) 56 data bytes
64 bytes from fc00:2142:2:1::2: icmp_seq=1 ttl=63 time=0.029 ms

FROM R1 :

usa-r1# show bgp         
BGP table version is 4, local router ID is 0.0.1.1, vrf id 0
Default local pref 100, local AS 1
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>i fc00:2142:2:1::/64
                    fc00:2142::              0    150      0 10 i
 *=i                  fc00:2142::3             0    150      0 10 i
 * i                  fc00:2142::3             0    150      0 10 i
 * i                  fc00:2142::3             0    150      0 10 i

Displayed 1 routes and 4 total paths
usa-r1# exit
usa-r1:/# ping6 fc00:2142:2:1::2
PING fc00:2142:2:1::2(fc00:2142:2:1::2) 56 data bytes
^C
--- fc00:2142:2:1::2 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3050ms

usa-r1:/# traceroute6 fc00:2142:2:1::2
traceroute to fc00:2142:2:1::2 (fc00:2142:2:1::2), 30 hops max, 72 byte packets
 1  fc00:2142:: (fc00:2142::)  0.005 ms  0.005 ms  0.004 ms
 2  *  *^C

CONFIG R0 GOOGLE :

usa-google-r0# show running-config 
Building configuration...

Current configuration:
!
frr version 10.1.1_git
frr defaults traditional
hostname usa-google-r0
service integrated-vtysh-config
!
ipv6 prefix-list ETH-H0 seq 5 permit fc00:2142:2:1::/64
!
interface eth-h0
 ipv6 address fc00:2142:2:1::1/64
 ipv6 nd prefix fc00:2142:2:1::/64 infinite infinite no-autoconfig
 ipv6 router isis USA-GOOGLE-R0
 isis passive
 no ipv6 nd suppress-ra
exit
!
interface eth-usa-r0
 ipv6 address fc00:2142:2:0:1::2/126
exit
!
interface eth-usa-r3
 ipv6 address fc00:2142:2:0:2::2/126
exit
!
interface lo
 ipv6 address fc00:2142:2::/128
 ipv6 router isis USA-GOOGLE-R0
 isis passive
exit
!
router bgp 10
 bgp router-id 0.0.10.0
 no bgp ebgp-requires-policy
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 neighbor fc00:2142:2:0:1::1 remote-as 1
 neighbor fc00:2142:2:0:1::1 update-source eth-usa-r0
 neighbor fc00:2142:2:0:2::1 remote-as 1
 neighbor fc00:2142:2:0:2::1 update-source eth-usa-r3
 !
 address-family ipv4 unicast
  neighbor fc00:2142:2:0:1::1 activate
  neighbor fc00:2142:2:0:2::1 activate
 exit-address-family
 !
 address-family ipv6 unicast
  network fc00:2142:2:1::/64
  neighbor fc00:2142:2:0:1::1 route-map IMPORT_FILTER in
  neighbor fc00:2142:2:0:1::1 route-map EXPORT_FILTER out
  neighbor fc00:2142:2:0:2::1 route-map IMPORT_FILTER in
  neighbor fc00:2142:2:0:2::1 route-map EXPORT_FILTER out
 exit-address-family
exit
!
router isis USA-GOOGLE-R0
 is-type level-1
 net 47.0023.0000.0000.0000.0000.0000.0000.1300.1000.00
exit
!
route-map IMPORT_FILTER permit 10
exit
!
route-map EXPORT_FILTER permit 10
 match ipv6 address prefix-list ETH-H0
 set local-preference 150
exit
!
route-map EXPORT_FILTER deny 20
exit
!
end

CONFIG R0 :

usa-r0# show running-config 
Building configuration...

Current configuration:
!
frr version 10.1.1_git
frr defaults traditional
hostname usa-r0
service integrated-vtysh-config
!
ipv6 prefix-list USA-GOOGLE-H0 seq 5 permit fc00:2142:2:1::/64
!
interface eth-google-r0
 ipv6 address fc00:2142:2:0:1::1/126
exit
!
interface eth-r1
 ipv6 router isis USA-R0
 isis circuit-type level-1
 isis network point-to-point
exit
!
interface eth-r2
 ipv6 router isis USA-R0
 isis circuit-type level-1
 isis network point-to-point
exit
!
interface lo
 ipv6 address fc00:2142::/128
 ipv6 router isis USA-R0
 isis passive
exit
!
router bgp 1
 bgp router-id 0.0.1.0
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 no bgp network import-check
 neighbor fc00:2142::1 remote-as 1
 neighbor fc00:2142::1 update-source lo
 neighbor fc00:2142::3 remote-as 1
 neighbor fc00:2142::3 update-source lo
 neighbor fc00:2142:2:0:1::2 remote-as 10
 neighbor fc00:2142:2:0:1::2 update-source eth-google-r0
 !
 address-family ipv6 unicast
  neighbor fc00:2142::1 next-hop-self
  neighbor fc00:2142::3 next-hop-self
  neighbor fc00:2142:2:0:1::2 route-map IMPORT_FILTER in
  neighbor fc00:2142:2:0:1::2 route-map EXPORT_FILTER out
 exit-address-family
exit
!
router isis USA-R0
 is-type level-1
 net 47.0023.0000.0000.0000.0000.0000.0000.1300.0000.00
exit
!
route-map IMPORT_FILTER permit 10
 set local-preference 150
exit
!
route-map EXPORT_FILTER permit 10
exit
!
end

CONFIG R1 :

usa-r1# show running-config 
Building configuration...

Current configuration:
!
frr version 10.1.1_git
frr defaults traditional
hostname usa-r1
service integrated-vtysh-config
!
interface eth-r0
 ipv6 router isis USA-R1
 isis circuit-type level-1
 isis network point-to-point
exit
!
interface eth-r3
 ipv6 router isis USA-R1
 isis circuit-type level-1
 isis network point-to-point
exit
!
interface eth-r4
 ipv6 router isis USA-R1
 isis circuit-type level-1
 isis network point-to-point
exit
!
interface lo
 ipv6 address fc00:2142::1/128
 ipv6 router isis USA-R1
 isis passive
exit
!
router bgp 1
 bgp router-id 0.0.1.1
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 neighbor fc00:2142:: remote-as 1
 neighbor fc00:2142:: update-source lo
 neighbor fc00:2142::2 remote-as 1
 neighbor fc00:2142::2 update-source lo
 neighbor fc00:2142::3 remote-as 1
 neighbor fc00:2142::3 update-source lo
 neighbor fc00:2142::4 remote-as 1
 neighbor fc00:2142::4 update-source lo
 neighbor fc00:2142::5 remote-as 1
 neighbor fc00:2142::5 update-source lo
 neighbor fc00:2142::6 remote-as 1
 neighbor fc00:2142::6 update-source lo
 !
 address-family ipv6 unicast
  neighbor fc00:2142:: route-reflector-client
  neighbor fc00:2142:: next-hop-self
  neighbor fc00:2142::2 route-reflector-client
  neighbor fc00:2142::2 next-hop-self
  neighbor fc00:2142::3 next-hop-self
  neighbor fc00:2142::4 route-reflector-client
  neighbor fc00:2142::4 next-hop-self
  neighbor fc00:2142::5 next-hop-self
  neighbor fc00:2142::6 next-hop-self
 exit-address-family
exit
!
router isis USA-R1
 is-type level-1
 net 47.0023.0000.0000.0000.0000.0000.0000.1300.0001.00
exit
!
end

[matdubuisson]

Hello I have solved the problem in fact visible routes aren't always reachable (via ping for example). My problem was that AS X knows the routes of AS Y but not AS Y of AS X. So the message was delivered to AS Y but AS Y could not send back response to AS X due to a miss of routes.

I have discovered two common practices in bgp to do it :

• Use blackhole routes : in your config frr set your announced network as a blackhole ipv6 route fc00:2142::/96 Null0 and then your subnet will be announced.
• Use prefix list : in your neighbor policy use to allow the prefix list representing an announced network (or a subnet).

I'm a visual people so I prefer examples than explanations so example for the blackholes :

frr version 10.1.1_git
frr defaults traditional
hostname usa-r0
service integrated-vtysh-config
!
ipv6 route fc00:2142::/96 Null0
!
....
!
router bgp 1
 bgp router-id 0.0.1.0
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 bgp default local-preference 200
 neighbor fc00:2142::1 remote-as 1
 neighbor fc00:2142::1 update-source lo
 neighbor fc00:2142::3 remote-as 1
 neighbor fc00:2142::3 update-source lo
 neighbor fc00:2142:10:0:1::2 remote-as 10
 neighbor fc00:2142:10:0:1::2 update-source eth-google-r0
 !
 address-family ipv6 unicast
  network fc00:2142::/96 route-map SET_LOCAL_PREF_TO_200
  neighbor fc00:2142::1 next-hop-self
  neighbor fc00:2142::3 next-hop-self
  neighbor fc00:2142:10:0:1::2 route-map IMPORT_FILTER in
  neighbor fc00:2142:10:0:1::2 route-map EXPORT_FILTER out
 exit-address-family
exit
!
....
!
route-map IMPORT_FILTER permit 10
 set local-preference 150
exit
!
route-map EXPORT_FILTER permit 10
exit
!
route-map SET_LOCAL_PREF_TO_200 permit 10
 set local-preference 200
exit
!

And an example for prefix lists :

frr version 10.1.1_git
frr defaults traditional
hostname eu-google-r0
service integrated-vtysh-config
!
ipv6 prefix-list ETH-H0 seq 5 permit fc01:2142:20:1::/64
ipv6 prefix-list LO seq 10 permit fc01:2142:20::/128
!
ipv6 route fc01:2142:20::/80 Null0
!
....
!
router bgp 20
 bgp router-id 0.0.20.0
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 neighbor fc01:2142:20:0:1::1 remote-as 2
 neighbor fc01:2142:20:0:1::1 update-source eth-eu-r0
 neighbor fc01:2142:20:0:2::1 remote-as 2
 neighbor fc01:2142:20:0:2::1 update-source eth-eu-r2
 !
 address-family ipv6 unicast
  network fc01:2142:20::/128
  network fc01:2142:20:1::/64
  neighbor fc01:2142:20:0:1::1 route-map IMPORT_FILTER in
  neighbor fc01:2142:20:0:1::1 route-map EXPORT_FILTER out
  neighbor fc01:2142:20:0:2::1 route-map IMPORT_FILTER in
  neighbor fc01:2142:20:0:2::1 route-map EXPORT_FILTER out
 exit-address-family
exit
!
....
!
route-map EXPORT_FILTER permit 10
 match ipv6 address prefix-list ETH-H0
 set local-preference 150
exit
!
route-map EXPORT_FILTER permit 20
 match ipv6 address prefix-list LO
 set local-preference 150
exit
!
route-map IMPORT_FILTER permit 10
 set local-preference 50
exitfrr version 10.1.1_git
frr defaults traditional
hostname eu-google-r0
service integrated-vtysh-config
!
ipv6 prefix-list ETH-H0 seq 5 permit fc01:2142:20:1::/64
ipv6 prefix-list LO seq 10 permit fc01:2142:20::/128
!
ipv6 route fc01:2142:20::/80 Null0
!
....
!
router bgp 20
 bgp router-id 0.0.20.0
 no bgp default ipv4-unicast
 bgp default ipv6-unicast
 neighbor fc01:2142:20:0:1::1 remote-as 2
 neighbor fc01:2142:20:0:1::1 update-source eth-eu-r0
 neighbor fc01:2142:20:0:2::1 remote-as 2
 neighbor fc01:2142:20:0:2::1 update-source eth-eu-r2
 !
 address-family ipv6 unicast
  network fc01:2142:20::/128
  network fc01:2142:20:1::/64
  neighbor fc01:2142:20:0:1::1 route-map IMPORT_FILTER in
  neighbor fc01:2142:20:0:1::1 route-map EXPORT_FILTER out
  neighbor fc01:2142:20:0:2::1 route-map IMPORT_FILTER in
  neighbor fc01:2142:20:0:2::1 route-map EXPORT_FILTER out
 exit-address-family
exit
!
....
!
route-map EXPORT_FILTER permit 10
 match ipv6 address prefix-list ETH-H0
 set local-preference 150
exit
!
route-map EXPORT_FILTER permit 20
 match ipv6 address prefix-list LO
 set local-preference 150
exit
!
route-map IMPORT_FILTER permit 10
 set local-preference 50
exit
!

!

Sorry I can't post the whole config now just a subset of the project because it's a school project and I want to avoid any issues but I wanted to post the solution. When it'll be finished if it interests someone I can post the whole config.