Page MenuHomeVyOS Platform

IPv6 NDP not working everytime
Open, Requires assessmentPublicBUG

Description

If you have multiple vyos instances in the same network/vlan and you set ipv6 ip address you will discover that sometime you can't ping ipv6 ips between some instances, if you reboot it will start work from some but from other will fail even if before restart worked.

If you run:
show ipv6 neighbors
zzzz:yyy:xxxx:1 eth0 FAILED

You get FAILED instead of the mac address of the ipv6 ip.
If you set static ipv6 mac address with the command below in the both instances the ping will start to work:

sudo ip -6 neigh add zzzz:yyy:xxxx:1 lladdr xx:xx:xx:xx:xx:xx dev eth0

Also changing the system ipv6 neighbor table-size have no effect.

I think that something is wrong sith the ndp protocol. I had the same problem from vyos version 1.2 and the last version still have this issue.
Sometime you lost ipv6 connection between ips because fail to cache the mac address.

PS: All ipv6 ips set on the interfaces are on the same /48 ipv6 network, so it work using ndp and just need mac address to communicate. I can also mention that all the time ipv4 works, even if the ipv6 do not work.

Details

Difficulty level
Unknown (require assessment)
Version
1.4-rolling-202210280218
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

Could you provide config from several items?
How many nodes do we need to reproduce it?

Hi,

You can test with 3-5 servers, the config is basic for each server:

For example what I have for server 1:

set interfaces ethernet eth0 vif xx address '10.0.0.1/24'
set interfaces ethernet eth0 vif xx address 'fdfd:8888::5:8218:1/48'

For example what I have for server 2:

set interfaces ethernet eth0 vif xx address '10.0.0.2/24'
set interfaces ethernet eth0 vif xx address 'fdfd:8888::5:7050:1/48'

And the ping between fdfd:8888::5:8218:1 and fdfd:8888::5:8218:2 do not work, but after I set static mac address works and with the command: show ipv6 neighbors, I see that the ipv6 is set permanent.

On the older version sometime I loose ipv6 connection and I did not know why, and I see that if I enter in the configuration and I delete the ipv6 and set again and apply config it start working and works for some weeks and months and after this you have again the issue. In the last version seems that the issue is more frequent.

Hi,

I add here what I just found and I can reproduce the issue everytime.

S1 configuration:
set interfaces ethernet eth0 address '10.0.0.1/24'
set interfaces ethernet eth0 address 'fdfd:8888::5:8218:1/48'

S2 configuration:
set interfaces ethernet eth0 address '10.0.0.2/24'
set interfaces ethernet eth0 address 'fdfd:8888::5:7050:1/48'

If you connect directly everything works.

Now If we add vyos bridge between s1 and s2 ipv6 will stop working. I will put the new configuration here:

S1 configuration:
set interfaces ethernet eth0 address '10.0.0.1/24'
set interfaces ethernet eth0 address 'fdfd:8888::5:8218:1/48'

S2 configuration:
set interfaces ethernet eth0 address '10.0.0.2/24'
set interfaces ethernet eth0 address 'fdfd:8888::5:7050:1/48'

Note that

eth0 port for S1 is on vlan 22
eth0 port for S2 is on vlan 23

Bridge configuration:

set interfaces bridge br0 member interface eth0
set interfaces bridge br0 member interface eth1
set interfaces ethernet eth0 (this command is required to make the interface up)
set interfaces ethernet eth1 (this command is required to make the interface up)

Note that

eth0 port for bridge is on vlan 22
eth1 port for bridge is on vlan 23

After this setup the ipv4 works without any issue but the ipv6 works only If I set static ip on each server, for example:

sudo ip -6 neigh del fdfd:8888::5:8218:1 lladdr ce:4c:ae:49:4a:32 dev eth0
sudo ip -6 neigh del fdfd:8888::5:7050:1 lladdr be:db:40:c2:8d:16 dev eth0

sudo ip -6 neigh add fdfd:8888::5:8218:1 lladdr ce:4c:ae:49:4a:32 dev eth0
sudo ip -6 neigh add fdfd:8888::5:7050:1 lladdr be:db:40:c2:8d:16 dev eth0

If you need, I can give you access to test.