bfbcc624730e640d22a717c6457766920196becc
howto/SRv6.md
| ... | ... | @@ -0,0 +1,435 @@ |
| 1 | +--- |
|
| 2 | +layout: post_dn42 |
|
| 3 | +title: "SRv6 for Default Routing Table" |
|
| 4 | +--- |
|
| 5 | +In previous [post](howto/DN42-Over-SRv6-L3VPN), I have wrote how did I deploy DN42 over SRv3 L3VPN on my infrastructure, but haven't mention a more popular scenario: SRv6 for traffic looking up default routing table, not everyone want to mess with VRF (it's a trouble for service deployment and eBGP peering either). |
|
| 6 | + |
|
| 7 | +This article is about how to configure SRv6 for default routing table, with help of Containerlab for demostration. |
|
| 8 | + |
|
| 9 | +The Containerlab lab can be found [here](https://github.com/Hawkins-Sherpherd/srv6-lab1). |
|
| 10 | + |
|
| 11 | +# Why SRv6 |
|
| 12 | +- With SRv6 as second dataplane, the transit traffic can forward on intermediate nodes without BGP running. Once BGP process failed, the node can still forward internal transit traffic, prevents BGP blackhole. |
|
| 13 | +- Multiservice support (L3VPN, traffic engineering, L2 transport, etc.). |
|
| 14 | +- Support on most Linux server you can buy (including LXC containers), no extra kernel modules required. |
|
| 15 | + |
|
| 16 | +# 1 Topology |
|
| 17 | +All router in this topology runs FRR. |
|
| 18 | + |
|
| 19 | + |
|
| 20 | + |
|
| 21 | +# 2 Create Network Interface |
|
| 22 | +A VRF interface is needed for END.DT4 action route install for default routing table, or the route will be rejected. Use a VRF bind to table 254 for workaround. |
|
| 23 | + |
|
| 24 | +IS-IS need a dummy interface for SRv6 Locator route, by default, it's sr0. |
|
| 25 | + |
|
| 26 | +All command followed are **NOT** persistent, the way to persist configuration is on yours. |
|
| 27 | +``` |
|
| 28 | +ip link add sr0 type dummy |
|
| 29 | +ip link set sr0 up mtu 65536 |
|
| 30 | +ip link add name vrf-main type vrf table 254 |
|
| 31 | +ip link set vrf-main up |
|
| 32 | +``` |
|
| 33 | + |
|
| 34 | +# 3 Kernel Parameter Adjustment |
|
| 35 | +All command followed are **NOT** persistent, the way to persist configuration is on yours. |
|
| 36 | + |
|
| 37 | +Don't forget to enable SRv6 for every interface transmits SRv6 traffic. |
|
| 38 | +``` |
|
| 39 | +sysctl -w net.ipv6.seg6_flowlabel=1 |
|
| 40 | +sysctl -w net.ipv6.conf.all.seg6_enabled=1 |
|
| 41 | +sysctl -w net.ipv6.conf.eth1.seg6_enabled=1 |
|
| 42 | +sysctl -w net.ipv6.conf.lo.seg6_enabled=1 |
|
| 43 | +sysctl -w net.ipv6.conf.all.forwarding=1 |
|
| 44 | +sysctl -w net.ipv4.ip_forward=1 |
|
| 45 | +sysctl -w net.vrf.strict_mode=1 |
|
| 46 | +``` |
|
| 47 | +**Caution: **net.vrf.strict_mode is a critical parameter, it determines whether different VRF can share one routing table or not, when its value equals 1, every VRF has to have dedicate routing table. If it's value not equal to 1, the SRv6 IPv4 L3VPN won't work, the related SID routes will be rejected. |
|
| 48 | + |
|
| 49 | +net.vrf.strict_mode resets 0 everytime a new VRF adds, to prevent network operation interrupt, please create all VRF could be used at most. |
|
| 50 | + |
|
| 51 | +# 4 BGP SRv6 for Default Routing Table |
|
| 52 | +No VRF configuration involved in FRR, all happens in default scope. |
|
| 53 | + |
|
| 54 | +Skip the deamons, SRv6 Locator and IS-IS configuration as they already shown in previous [post](howto/DN42-Over-SRv6-L3VPN). |
|
| 55 | + |
|
| 56 | +Send SRv6 encapsulation information in Unicast families, and use "sid export" instead "sid vpn export". |
|
| 57 | + |
|
| 58 | +This is BGP Unicast families configuration on R1: |
|
| 59 | +``` |
|
| 60 | + address-family ipv4 unicast |
|
| 61 | + network 203.0.113.0/24 |
|
| 62 | + neighbor 2001:db8::2 encapsulation-srv6 |
|
| 63 | + sid export auto |
|
| 64 | + exit-address-family |
|
| 65 | + ! |
|
| 66 | + address-family ipv6 unicast |
|
| 67 | + network 2001:db8:1::/64 |
|
| 68 | + neighbor 2001:db8::2 activate |
|
| 69 | + neighbor 2001:db8::2 encapsulation-srv6 |
|
| 70 | + sid export auto |
|
| 71 | + exit-address-family |
|
| 72 | +``` |
|
| 73 | + |
|
| 74 | +# 5 Complete Configurations |
|
| 75 | +R1: |
|
| 76 | +``` |
|
| 77 | +frr version 10.7.0_git |
|
| 78 | +frr defaults traditional |
|
| 79 | +hostname r1 |
|
| 80 | +! |
|
| 81 | +ip router-id 1.1.1.1 |
|
| 82 | +! |
|
| 83 | +interface eth1 |
|
| 84 | + ipv6 router isis 1 |
|
| 85 | + isis network point-to-point |
|
| 86 | +exit |
|
| 87 | +! |
|
| 88 | +interface eth2 |
|
| 89 | + ip address 203.0.113.1/24 |
|
| 90 | + ipv6 address 2001:db8:1::1/64 |
|
| 91 | +exit |
|
| 92 | +! |
|
| 93 | +interface lo |
|
| 94 | + ipv6 address 2001:db8::1/128 |
|
| 95 | + ipv6 address 5f00:1:1::1/64 |
|
| 96 | + ipv6 router isis 1 |
|
| 97 | +exit |
|
| 98 | +! |
|
| 99 | +router bgp 1 |
|
| 100 | + neighbor 2001:db8::2 remote-as 1 |
|
| 101 | + neighbor 2001:db8::2 update-source lo |
|
| 102 | + neighbor 2001:db8::2 capability extended-nexthop |
|
| 103 | + ! |
|
| 104 | + segment-routing srv6 |
|
| 105 | + locator MAIN |
|
| 106 | + exit |
|
| 107 | + ! |
|
| 108 | + address-family ipv4 unicast |
|
| 109 | + network 203.0.113.0/24 |
|
| 110 | + neighbor 2001:db8::2 encapsulation-srv6 |
|
| 111 | + sid export auto |
|
| 112 | + exit-address-family |
|
| 113 | + ! |
|
| 114 | + address-family ipv6 unicast |
|
| 115 | + network 2001:db8:1::/64 |
|
| 116 | + neighbor 2001:db8::2 activate |
|
| 117 | + neighbor 2001:db8::2 encapsulation-srv6 |
|
| 118 | + sid export auto |
|
| 119 | + exit-address-family |
|
| 120 | +exit |
|
| 121 | +! |
|
| 122 | +router isis 1 |
|
| 123 | + is-type level-1 |
|
| 124 | + net 00.0010.0100.1001.00 |
|
| 125 | + segment-routing srv6 |
|
| 126 | + locator MAIN |
|
| 127 | + exit |
|
| 128 | +exit |
|
| 129 | +! |
|
| 130 | +segment-routing |
|
| 131 | + srv6 |
|
| 132 | + encapsulation |
|
| 133 | + source-address 5f00:1:1::1 |
|
| 134 | + exit |
|
| 135 | + locators |
|
| 136 | + locator MAIN |
|
| 137 | + prefix 5f00:1:1::/48 |
|
| 138 | + behavior usid |
|
| 139 | + format usid-f3216 |
|
| 140 | + exit |
|
| 141 | + ! |
|
| 142 | + exit |
|
| 143 | + ! |
|
| 144 | + exit |
|
| 145 | + ! |
|
| 146 | +exit |
|
| 147 | +! |
|
| 148 | +``` |
|
| 149 | + |
|
| 150 | +R3: |
|
| 151 | +``` |
|
| 152 | +frr version 10.7.0_git |
|
| 153 | +frr defaults traditional |
|
| 154 | +hostname r3 |
|
| 155 | +! |
|
| 156 | +ip router-id 1.1.1.2 |
|
| 157 | +! |
|
| 158 | +interface eth1 |
|
| 159 | + ipv6 router isis 1 |
|
| 160 | + isis network point-to-point |
|
| 161 | +exit |
|
| 162 | +! |
|
| 163 | +interface eth2 |
|
| 164 | + ip address 192.0.2.1/24 |
|
| 165 | + ipv6 address 2001:db8:2::1/64 |
|
| 166 | +exit |
|
| 167 | +! |
|
| 168 | +interface lo |
|
| 169 | + ipv6 address 2001:db8::2/128 |
|
| 170 | + ipv6 address 5f00:1:2::1/128 |
|
| 171 | + ipv6 router isis 1 |
|
| 172 | +exit |
|
| 173 | +! |
|
| 174 | +router bgp 1 |
|
| 175 | + neighbor 2001:db8::1 remote-as 1 |
|
| 176 | + neighbor 2001:db8::1 update-source lo |
|
| 177 | + neighbor 2001:db8::1 capability extended-nexthop |
|
| 178 | + ! |
|
| 179 | + segment-routing srv6 |
|
| 180 | + locator MAIN |
|
| 181 | + exit |
|
| 182 | + ! |
|
| 183 | + address-family ipv4 unicast |
|
| 184 | + network 192.0.2.0/24 |
|
| 185 | + neighbor 2001:db8::1 encapsulation-srv6 |
|
| 186 | + sid export auto |
|
| 187 | + exit-address-family |
|
| 188 | + ! |
|
| 189 | + address-family ipv6 unicast |
|
| 190 | + network 2001:db8:2::/64 |
|
| 191 | + neighbor 2001:db8::1 activate |
|
| 192 | + neighbor 2001:db8::1 encapsulation-srv6 |
|
| 193 | + sid export auto |
|
| 194 | + exit-address-family |
|
| 195 | +exit |
|
| 196 | +! |
|
| 197 | +router isis 1 |
|
| 198 | + is-type level-1 |
|
| 199 | + net 00.0010.0100.2001.00 |
|
| 200 | + segment-routing srv6 |
|
| 201 | + locator MAIN |
|
| 202 | + exit |
|
| 203 | +exit |
|
| 204 | +! |
|
| 205 | +segment-routing |
|
| 206 | + srv6 |
|
| 207 | + encapsulation |
|
| 208 | + source-address 5f00:1:2::1 |
|
| 209 | + exit |
|
| 210 | + locators |
|
| 211 | + locator MAIN |
|
| 212 | + prefix 5f00:1:2::/48 |
|
| 213 | + behavior usid |
|
| 214 | + format usid-f3216 |
|
| 215 | + exit |
|
| 216 | + ! |
|
| 217 | + exit |
|
| 218 | + ! |
|
| 219 | + exit |
|
| 220 | + ! |
|
| 221 | +exit |
|
| 222 | +! |
|
| 223 | +``` |
|
| 224 | + |
|
| 225 | +# 6 Verfication |
|
| 226 | +# 6.1 Check routing table of R1, R2 and R3: |
|
| 227 | +R1: |
|
| 228 | +``` |
|
| 229 | +r1# show ip route |
|
| 230 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 231 | + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, |
|
| 232 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 233 | + f - OpenFabric, t - Table-Direct, |
|
| 234 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 235 | + t - trapped, o - offload failure |
|
| 236 | + |
|
| 237 | +IPv4 unicast VRF default: |
|
| 238 | +K>* 0.0.0.0/0 [0/0] via 172.20.20.1, eth0 (vrf default), weight 1, 01:34:55 |
|
| 239 | +C>* 172.20.20.0/24 is directly connected, eth0 (vrf default), weight 1, 01:34:55 |
|
| 240 | +L>* 172.20.20.3/32 is directly connected, eth0 (vrf default), weight 1, 01:34:55 |
|
| 241 | +B> 192.0.2.0/24 [200/0] via 2001:db8::2 (recursive), seg6 5f00:1:2:e000::, weight 1, 01:19:14 |
|
| 242 | + * via fe80::a8c1:abff:fecc:41b2, eth1, seg6 5f00:1:2:e000::, weight 1, 01:19:14 |
|
| 243 | +C>* 203.0.113.0/24 is directly connected, eth2, weight 1, 01:20:06 |
|
| 244 | +L>* 203.0.113.1/32 is directly connected, eth2, weight 1, 01:20:06 |
|
| 245 | +r1# show ipv6 route |
|
| 246 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 247 | + R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, |
|
| 248 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 249 | + f - OpenFabric, t - Table-Direct, |
|
| 250 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 251 | + t - trapped, o - offload failure |
|
| 252 | + |
|
| 253 | +IPv6 unicast VRF default: |
|
| 254 | +K>* ::/0 [0/1024] via 3fff:172:20:20::1, eth0 (vrf default), weight 1, 01:34:57 |
|
| 255 | +L * 2001:db8::1/128 is directly connected, lo (vrf default), weight 1, 01:34:56 |
|
| 256 | +C>* 2001:db8::1/128 is directly connected, lo (vrf default), weight 1, 01:34:56 |
|
| 257 | +I>* 2001:db8::2/128 [115/30] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:19:35 |
|
| 258 | +I>* 2001:db8::ffff/128 [115/20] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:34:25 |
|
| 259 | +C>* 2001:db8:1::/64 is directly connected, eth2, weight 1, 01:20:08 |
|
| 260 | +L>* 2001:db8:1::1/128 is directly connected, eth2, weight 1, 01:20:08 |
|
| 261 | +B> 2001:db8:2::/64 [200/0] via 2001:db8::2 (recursive), seg6 5f00:1:2:e001::, weight 1, 01:19:16 |
|
| 262 | + * via fe80::a8c1:abff:fecc:41b2, eth1, seg6 5f00:1:2:e001::, weight 1, 01:19:16 |
|
| 263 | +C>* 3fff:172:20:20::/64 is directly connected, eth0 (vrf default), weight 1, 01:34:57 |
|
| 264 | +L>* 3fff:172:20:20::3/128 is directly connected, eth0 (vrf default), weight 1, 01:34:57 |
|
| 265 | +I>* 5f00:1:1::/48 [115/0] is directly connected, sr0 (vrf default), seg6local uN, weight 1, 01:34:54 |
|
| 266 | +C>* 5f00:1:1::/64 is directly connected, lo (vrf default), weight 1, 01:34:56 |
|
| 267 | +L>* 5f00:1:1::1/128 is directly connected, lo (vrf default), weight 1, 01:34:56 |
|
| 268 | +I>* 5f00:1:1:e000::/64 [115/0] is directly connected, eth1, seg6local uA nh6 fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:34:53 |
|
| 269 | +B>* 5f00:1:1:e001::/128 [20/0] is directly connected, sr0, seg6local uDT4 table 254, weight 1, 01:34:48 |
|
| 270 | +B>* 5f00:1:1:e002::/128 [20/0] is directly connected, sr0, seg6local uDT6 table 254, weight 1, 01:34:48 |
|
| 271 | +I>* 5f00:1:2::/48 [115/20] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:19:35 |
|
| 272 | +I>* 5f00:1:2::1/128 [115/30] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:19:35 |
|
| 273 | +I>* 5f00:1:ffff::/48 [115/10] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:34:25 |
|
| 274 | +I>* 5f00:1:ffff::1/128 [115/20] via fe80::a8c1:abff:fecc:41b2, eth1, weight 1, 01:34:25 |
|
| 275 | +C * fe80::/64 is directly connected, eth2, weight 1, 01:20:08 |
|
| 276 | +C * fe80::/64 is directly connected, sr0 (vrf default), weight 1, 01:34:54 |
|
| 277 | +C * fe80::/64 is directly connected, eth1 (vrf default), weight 1, 01:34:54 |
|
| 278 | +C>* fe80::/64 is directly connected, eth0 (vrf default), weight 1, 01:34:56 |
|
| 279 | +``` |
|
| 280 | +R2: |
|
| 281 | +``` |
|
| 282 | +r2# show ip route |
|
| 283 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 284 | + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, |
|
| 285 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 286 | + f - OpenFabric, t - Table-Direct, |
|
| 287 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 288 | + t - trapped, o - offload failure |
|
| 289 | + |
|
| 290 | +IPv4 unicast VRF default: |
|
| 291 | +K>* 0.0.0.0/0 [0/0] via 172.20.20.1, eth0, weight 1, 00:24:32 |
|
| 292 | +C>* 172.20.20.0/24 is directly connected, eth0, weight 1, 00:24:32 |
|
| 293 | +L>* 172.20.20.4/32 is directly connected, eth0, weight 1, 00:24:32 |
|
| 294 | +r2# show ipv6 route |
|
| 295 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 296 | + R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, |
|
| 297 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 298 | + f - OpenFabric, t - Table-Direct, |
|
| 299 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 300 | + t - trapped, o - offload failure |
|
| 301 | + |
|
| 302 | +IPv6 unicast VRF default: |
|
| 303 | +K>* ::/0 [0/1024] via 3fff:172:20:20::1, eth0, weight 1, 00:24:34 |
|
| 304 | +I>* 2001:db8::1/128 [115/20] via fe80::a8c1:abff:fe3b:1520, eth1, weight 1, 00:24:02 |
|
| 305 | +I>* 2001:db8::2/128 [115/20] via fe80::a8c1:abff:fe4a:6b7b, eth2, weight 1, 00:09:12 |
|
| 306 | +L * 2001:db8::ffff/128 is directly connected, lo, weight 1, 00:24:33 |
|
| 307 | +C>* 2001:db8::ffff/128 is directly connected, lo, weight 1, 00:24:33 |
|
| 308 | +C>* 3fff:172:20:20::/64 is directly connected, eth0, weight 1, 00:24:34 |
|
| 309 | +L>* 3fff:172:20:20::4/128 is directly connected, eth0, weight 1, 00:24:34 |
|
| 310 | +I>* 5f00:1:1::/48 [115/10] via fe80::a8c1:abff:fe3b:1520, eth1, weight 1, 00:24:02 |
|
| 311 | +I>* 5f00:1:1::/64 [115/20] via fe80::a8c1:abff:fe3b:1520, eth1, weight 1, 00:24:02 |
|
| 312 | +I>* 5f00:1:2::/48 [115/10] via fe80::a8c1:abff:fe4a:6b7b, eth2, weight 1, 00:09:12 |
|
| 313 | +I>* 5f00:1:2::1/128 [115/20] via fe80::a8c1:abff:fe4a:6b7b, eth2, weight 1, 00:09:12 |
|
| 314 | +I>* 5f00:1:ffff::/48 [115/0] is directly connected, sr0, seg6local uN, weight 1, 00:24:32 |
|
| 315 | +L * 5f00:1:ffff::1/128 is directly connected, lo, weight 1, 00:24:33 |
|
| 316 | +C>* 5f00:1:ffff::1/128 is directly connected, lo, weight 1, 00:24:33 |
|
| 317 | +I>* 5f00:1:ffff:e000::/64 [115/0] is directly connected, eth1, seg6local uA nh6 fe80::a8c1:abff:fe3b:1520, eth1, weight 1, 00:24:30 |
|
| 318 | +I>* 5f00:1:ffff:e001::/64 [115/0] is directly connected, eth2, seg6local uA nh6 fe80::a8c1:abff:fe4a:6b7b, eth2, weight 1, 00:09:40 |
|
| 319 | +C * fe80::/64 is directly connected, eth2, weight 1, 00:09:43 |
|
| 320 | +C * fe80::/64 is directly connected, eth1, weight 1, 00:24:31 |
|
| 321 | +C * fe80::/64 is directly connected, sr0, weight 1, 00:24:32 |
|
| 322 | +C>* fe80::/64 is directly connected, eth0, weight 1, 00:24:33 |
|
| 323 | +``` |
|
| 324 | +Since R2 don't run BGP, it don't receive BGP route goes to Client1 and Client2, only thing it forward is encapsulated SRv6 packets. |
|
| 325 | + |
|
| 326 | +R3: |
|
| 327 | +``` |
|
| 328 | +r3# show ip route |
|
| 329 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 330 | + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, |
|
| 331 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 332 | + f - OpenFabric, t - Table-Direct, |
|
| 333 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 334 | + t - trapped, o - offload failure |
|
| 335 | + |
|
| 336 | +IPv4 unicast VRF default: |
|
| 337 | +K>* 0.0.0.0/0 [0/0] via 172.20.20.1, eth0 (vrf default), weight 1, 00:02:36 |
|
| 338 | +C>* 172.20.20.0/24 is directly connected, eth0 (vrf default), weight 1, 00:02:36 |
|
| 339 | +L>* 172.20.20.2/32 is directly connected, eth0 (vrf default), weight 1, 00:02:36 |
|
| 340 | +C>* 192.0.2.0/24 is directly connected, eth2 (vrf default), weight 1, 00:02:34 |
|
| 341 | +L>* 192.0.2.1/32 is directly connected, eth2 (vrf default), weight 1, 00:02:34 |
|
| 342 | +B> 203.0.113.0/24 [200/0] via 2001:db8::1 (recursive), seg6 5f00:1:1:e001::, weight 1, 00:01:56 |
|
| 343 | + * via fe80::a8c1:abff:fe28:ddd7, eth1, seg6 5f00:1:1:e001::, weight 1, 00:01:56 |
|
| 344 | +r3# show ipv6 route |
|
| 345 | +Codes: K - kernel route, C - connected, L - local, S - static, |
|
| 346 | + R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, |
|
| 347 | + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, |
|
| 348 | + f - OpenFabric, t - Table-Direct, |
|
| 349 | + > - selected route, * - FIB route, q - queued, r - rejected, b - backup |
|
| 350 | + t - trapped, o - offload failure |
|
| 351 | + |
|
| 352 | +IPv6 unicast VRF default: |
|
| 353 | +K>* ::/0 [0/1024] via 3fff:172:20:20::1, eth0 (vrf default), weight 1, 00:02:38 |
|
| 354 | +I>* 2001:db8::1/128 [115/30] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:05 |
|
| 355 | +L * 2001:db8::2/128 is directly connected, lo (vrf default), weight 1, 00:02:37 |
|
| 356 | +C>* 2001:db8::2/128 is directly connected, lo (vrf default), weight 1, 00:02:37 |
|
| 357 | +I>* 2001:db8::ffff/128 [115/20] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:08 |
|
| 358 | +B> 2001:db8:1::/64 [200/0] via 2001:db8::1 (recursive), seg6 5f00:1:1:e002::, weight 1, 00:01:58 |
|
| 359 | + * via fe80::a8c1:abff:fe28:ddd7, eth1, seg6 5f00:1:1:e002::, weight 1, 00:01:58 |
|
| 360 | +C>* 2001:db8:2::/64 is directly connected, eth2 (vrf default), weight 1, 00:02:36 |
|
| 361 | +L>* 2001:db8:2::1/128 is directly connected, eth2 (vrf default), weight 1, 00:02:36 |
|
| 362 | +C>* 3fff:172:20:20::/64 is directly connected, eth0 (vrf default), weight 1, 00:02:38 |
|
| 363 | +L>* 3fff:172:20:20::2/128 is directly connected, eth0 (vrf default), weight 1, 00:02:38 |
|
| 364 | +I>* 5f00:1:1::/48 [115/20] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:05 |
|
| 365 | +I>* 5f00:1:1::/64 [115/30] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:05 |
|
| 366 | +I>* 5f00:1:2::/48 [115/0] is directly connected, sr0 (vrf default), seg6local uN, weight 1, 00:02:37 |
|
| 367 | +L * 5f00:1:2::1/128 is directly connected, lo (vrf default), weight 1, 00:02:37 |
|
| 368 | +C>* 5f00:1:2::1/128 is directly connected, lo (vrf default), weight 1, 00:02:37 |
|
| 369 | +I>* 5f00:1:2:e000::/64 [115/0] is directly connected, eth1, seg6local uA nh6 fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:33 |
|
| 370 | +B>* 5f00:1:2:e001::/128 [20/0] is directly connected, sr0, seg6local uDT4 table 254, weight 1, 00:02:29 |
|
| 371 | +B>* 5f00:1:2:e002::/128 [20/0] is directly connected, sr0, seg6local uDT6 table 254, weight 1, 00:02:29 |
|
| 372 | +I>* 5f00:1:ffff::/48 [115/10] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:05 |
|
| 373 | +I>* 5f00:1:ffff::1/128 [115/20] via fe80::a8c1:abff:fe28:ddd7, eth1, weight 1, 00:02:08 |
|
| 374 | +C * fe80::/64 is directly connected, eth2, weight 1, 00:02:35 |
|
| 375 | +C * fe80::/64 is directly connected, eth1, weight 1, 00:02:35 |
|
| 376 | +C * fe80::/64 is directly connected, sr0 (vrf default), weight 1, 00:02:37 |
|
| 377 | +C>* fe80::/64 is directly connected, eth0 (vrf default), weight 1, 00:02:38 |
|
| 378 | +``` |
|
| 379 | + |
|
| 380 | +# 6.2 Ping from Client1 and Client2 |
|
| 381 | +Client1: |
|
| 382 | +``` |
|
| 383 | +/ # ping -c 4 192.0.2.2 |
|
| 384 | +PING 192.0.2.2 (192.0.2.2) 56(84) bytes of data. |
|
| 385 | +64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=0.299 ms |
|
| 386 | +64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=0.175 ms |
|
| 387 | +64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=0.158 ms |
|
| 388 | +64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=0.159 ms |
|
| 389 | + |
|
| 390 | +--- 192.0.2.2 ping statistics --- |
|
| 391 | +4 packets transmitted, 4 received, 0% packet loss, time 3087ms |
|
| 392 | +rtt min/avg/max/mdev = 0.158/0.197/0.299/0.058 ms |
|
| 393 | +/ # ping -c 4 2001:db8:2::2 |
|
| 394 | +PING 2001:db8:2::2(2001:db8:2::2) 56 data bytes |
|
| 395 | +64 bytes from 2001:db8:2::2: icmp_seq=1 ttl=63 time=0.235 ms |
|
| 396 | +64 bytes from 2001:db8:2::2: icmp_seq=2 ttl=63 time=0.130 ms |
|
| 397 | +64 bytes from 2001:db8:2::2: icmp_seq=3 ttl=63 time=0.127 ms |
|
| 398 | +64 bytes from 2001:db8:2::2: icmp_seq=4 ttl=63 time=0.124 ms |
|
| 399 | + |
|
| 400 | +--- 2001:db8:2::2 ping statistics --- |
|
| 401 | +4 packets transmitted, 4 received, 0% packet loss, time 3087ms |
|
| 402 | +rtt min/avg/max/mdev = 0.124/0.154/0.235/0.046 ms |
|
| 403 | +``` |
|
| 404 | +Client2: |
|
| 405 | +``` |
|
| 406 | +/ # ping -c 4 203.0.113.2 |
|
| 407 | +PING 203.0.113.2 (203.0.113.2) 56(84) bytes of data. |
|
| 408 | +64 bytes from 203.0.113.2: icmp_seq=1 ttl=63 time=0.172 ms |
|
| 409 | +64 bytes from 203.0.113.2: icmp_seq=2 ttl=63 time=0.207 ms |
|
| 410 | +64 bytes from 203.0.113.2: icmp_seq=3 ttl=63 time=0.163 ms |
|
| 411 | +64 bytes from 203.0.113.2: icmp_seq=4 ttl=63 time=0.153 ms |
|
| 412 | + |
|
| 413 | +--- 203.0.113.2 ping statistics --- |
|
| 414 | +4 packets transmitted, 4 received, 0% packet loss, time 3078ms |
|
| 415 | +rtt min/avg/max/mdev = 0.153/0.173/0.207/0.020 ms |
|
| 416 | +/ # ping -c 4 2001:db8:1::2 |
|
| 417 | +PING 2001:db8:1::2(2001:db8:1::2) 56 data bytes |
|
| 418 | +64 bytes from 2001:db8:1::2: icmp_seq=1 ttl=63 time=0.117 ms |
|
| 419 | +64 bytes from 2001:db8:1::2: icmp_seq=2 ttl=63 time=0.180 ms |
|
| 420 | +64 bytes from 2001:db8:1::2: icmp_seq=3 ttl=63 time=0.137 ms |
|
| 421 | +64 bytes from 2001:db8:1::2: icmp_seq=4 ttl=63 time=0.173 ms |
|
| 422 | + |
|
| 423 | +--- 2001:db8:1::2 ping statistics --- |
|
| 424 | +4 packets transmitted, 4 received, 0% packet loss, time 3086ms |
|
| 425 | +rtt min/avg/max/mdev = 0.117/0.151/0.180/0.025 ms |
|
| 426 | +``` |
|
| 427 | + |
|
| 428 | +# 7 Known Limits |
|
| 429 | +This section is copied from my previous [post](howto/DN42-Over-SRv6-L3VPN). |
|
| 430 | + |
|
| 431 | +## 7.1 NAT |
|
| 432 | +When destination route has SRv6 encapsulation, the traffic won't trigger SNAT rule in netfilter, instead, it encapsulates into SRv6 traffic directly then send out. |
|
| 433 | + |
|
| 434 | +## 7.2 Router IPv6 address inaccessible |
|
| 435 | +Due to unknown reason, the call path of SRv6 decapsulation is different for IPv4 and IPv6, the IPv4 return traffic can lookup destined VRF normally, while IPv6 don't. However, this don't affect transit traffic, only traffic sources or destined to the router is affected. |