@NikolayP The concern here is solely this: IBGP neighbors that do not have route-reflector-client set should not received learned routes. Currently, they do. If this in intentional, then the docs should be updated to clarify this.

Although a cluster ID might be helpful the real problem is that the routes are reflected to all peers – not just ones that are route reflector clients:

This creates routing loops on all BGP neighbors as they are all advertising the same routes

Neighbors that are not route-reflector-client should not receive learned routes, only routes that are explicitly set in the config. So in the example above, I would not expect to have multipath routes for 10.0.0.1 and 10.0.0.2, and I would not expect to see any route for 10.0.0.6

RR1 - BGP Peer / Route Reflector / 10.0.0.1
RR2 - BGP Peer / Route Reflector / 10.0.0.2
RR3 - BGP Peer / Route Reflector / 10.0.0.3

Also tested 1.4-rolling-202110020217 and it exhibits the same issue

Confirmed fixed and working in 1.3.0-rc6

I think NHRP Cisco Auth is still missing: https://github.com/FRRouting/frr/blob/master/nhrpd/nhrp_peer.c#L1212

@c-po with this merge on FRR https://github.com/FRRouting/frr/pull/8153#event-4589485067 is migration possible? Possibly related to https://phabricator.vyos.net/T2326

Related to the image here are sanitized configs (I've removed firewall entries since I've tested without a firewall config and the issue persists. I've replaced all IPs with dummy ones

I can try to sanitize my configs and post here – FWIW, this issue is not in 1.2.7 LTS (self built)

Any thoughts here @Viacheslav ? This issue persists in 1.3-rc4

I'm not really sure what the issue is. I can narrow it down to this:

This affects downstream clients as well

@Viacheslav The issue persists in vyos-1.3.0-rc2-amd64.iso

@zsdc Any chance on this in 1.2.6?

I ran into this issue as well and verified it's resolved on current rolling release. Will this also be fixed in 1.2.6?