VRF notes when using ipv6 and flushing tables.

VRF notes when using ipv6 and flushing tables.

[Ben Greear]

I recently spend a few days debugging what in the end was user error on my part.

Here are my notes in hope they help someone else.

First, 'ip -6 route show vrf vrfX' will not show some of the
routes (like local routes) that will show up with
'ip -6 route show table X', where X == vrfX's table-id

If you run 'ip -6 route flush table X', then you will loose all of the auto
generated routes, including anycast, ff00::/8, and local routes.

ff00::/8 is needed for neigh discovery to work (probably among other things)

local route is needed or packets won't actually be accepted up the stack
(I think that is the symptom at least)

Not sure exactly what anycast does, but I'm guessing it is required for
something useful.

You must manually re-add those to the table unless you for certain know that
you do not need them for whatever reason.

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: VRF notes when using ipv6 and flushing tables.

[David Ahern]

On 8/20/19 2:27 PM, Ben Greear wrote:
> I recently spend a few days debugging what in the end was user error on
> my part.
> 
> Here are my notes in hope they help someone else.
> 
> First, 'ip -6 route show vrf vrfX' will not show some of the
> routes (like local routes) that will show up with
> 'ip -6 route show table X', where X == vrfX's table-id
> 
> If you run 'ip -6 route flush table X', then you will loose all of the auto
> generated routes, including anycast, ff00::/8, and local routes.
> 
> ff00::/8 is needed for neigh discovery to work (probably among other
> things)
> 
> local route is needed or packets won't actually be accepted up the stack
> (I think that is the symptom at least)
> 
> Not sure exactly what anycast does, but I'm guessing it is required for
> something useful.
> 
> You must manually re-add those to the table unless you for certain know
> that
> you do not need them for whatever reason.
> 

sorry you went through such a long and painful debugging session.

yes, the kernel doc for VRF needs to be updated that 'ip route show vrf
X' and 'ip route show table X' are different ('show vrf' mimics the main
table in not showing local, broadcast, anycast; 'table vrf' shows all).

A suggestion for others: the documentation and selftests directory have
a lot of VRF examples now. If something basic is not working (e.g., arp
or neigh discovery), see if it works there and if so compare the outputs
of the route table along the way.

Re: VRF notes when using ipv6 and flushing tables.

[Ben Greear]

On 08/20/2019 08:02 PM, David Ahern wrote:
> On 8/20/19 2:27 PM, Ben Greear wrote:
>> I recently spend a few days debugging what in the end was user error on
>> my part.
>>
>> Here are my notes in hope they help someone else.
>>
>> First, 'ip -6 route show vrf vrfX' will not show some of the
>> routes (like local routes) that will show up with
>> 'ip -6 route show table X', where X == vrfX's table-id
>>
>> If you run 'ip -6 route flush table X', then you will loose all of the auto
>> generated routes, including anycast, ff00::/8, and local routes.
>>
>> ff00::/8 is needed for neigh discovery to work (probably among other
>> things)
>>
>> local route is needed or packets won't actually be accepted up the stack
>> (I think that is the symptom at least)
>>
>> Not sure exactly what anycast does, but I'm guessing it is required for
>> something useful.
>>
>> You must manually re-add those to the table unless you for certain know
>> that
>> you do not need them for whatever reason.
>>
>
> sorry you went through such a long and painful debugging session.

No problem.  I learned some details of IPv6 I never realized before,
sure to come in useful some day!

Thanks,
Ben

> yes, the kernel doc for VRF needs to be updated that 'ip route show vrf
> X' and 'ip route show table X' are different ('show vrf' mimics the main
> table in not showing local, broadcast, anycast; 'table vrf' shows all).
>
> A suggestion for others: the documentation and selftests directory have
> a lot of VRF examples now. If something basic is not working (e.g., arp
> or neigh discovery), see if it works there and if so compare the outputs
> of the route table along the way.



-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com