An issue with manually assigned srv6 vpn sid in BGP

[rakhmerov]

Description

A manually configured srv6 vpn sid does not work in bgp vrf configuration if we
clear the bgp vrf configuration and reconfigure the same vrf with the same sid number.
The problem is observed in FRR version 9.1... but previous versions are most likely also affected.

Version

9.1

How to reproduce

• create new VRF in linux
  ip link add dev VRF_A type vrf table 11 && ip link set dev VRF_A up

• run frr with the example config from below

• check that srv6 sid address has been assigned according to the sid from the config
  sh bgp segment-routing srv6

• remove bgp vrf configuration in vtysh
  conf t
  no router bgp 65100 vrf VRF_A

• check that srv6 sid address has been removed
  sh bgp segment-routing srv6

• configure the same vrf with the same sid number again
  conf t
  router bgp 65100 vrf VRF_A
  !
  address-family ipv4 unicast
  sid vpn export 11
  rd vpn export 10.10.10.1:11
  rt vpn both 65000:11
  export vpn
  import vpn
  exit-address-family
  exit

• check that srv6 sid address has NOT been assigned as expected
  sh bgp segment-routing srv6

NOTE: if you reconfigure sid vpn export with a different value
then srv6 sid address will be assigned as expected
if you return the first sid number that was configured at the begining it won't work

example frr config
#######################################################################
Building configuration...

Current configuration:
!
frr defaults traditional
hostname stack-frr1
log syslog informational
service integrated-vtysh-config
!
interface lo
ip address 10.10.10.1/32
exit
!
router bgp 65100
bgp router-id 10.10.10.1
no bgp ebgp-requires-policy
no bgp default ipv4-unicast
bgp disable-ebgp-connected-route-check
bgp graceful-restart
!
segment-routing srv6
locator SRlocator
exit
exit
!
router bgp 65100 vrf VRF_A
!
address-family ipv4 unicast
sid vpn export 11
rd vpn export 10.10.10.1:11
rt vpn both 65000:11
export vpn
import vpn
exit-address-family
exit
!
segment-routing
srv6
locators
locator SRlocator
prefix 2000:aaa1::/64 block-len 40 node-len 24 func-bits 16
exit
!
exit
!
exit
!
exit
!
end

Expected behavior

stack-frr1# sh bgp segment-routing srv6
locator_name: SRlocator
locator_chunks:

• 2000:aaa1::/64
  ...
• name: VRF_A
  vpn_policy[AFI_IP].tovpn_sid: 2000:aaa1:0:0:b::
  vpn_policy[AFI_IP6].tovpn_sid: (null)
  per-vrf tovpn_sid: (null)

Actual behavior

stack-frr1# sh bgp segment-routing srv6
locator_name: SRlocator
locator_chunks:

• 2000:aaa1::/64
  ...
• name: VRF_A
  vpn_policy[AFI_IP].tovpn_sid: (null)
  vpn_policy[AFI_IP6].tovpn_sid: (null)
  per-vrf tovpn_sid: (null)

Additional context

No response

Checklist

• I have searched the open issues for this bug.
• I have not included sensitive information in this report.

[ton31337]

Have you tried using per-vrf SID instead of per-af SID?

router bgp 65100 vrf VRF_A
 sid vpn per-vrf export 11

[rakhmerov]

Yes, we have the same issue with this option, srv6 sid is assigned only if you use a new sid number, if you reconfigure BGP VRF with the same sid as before it won't work. Thanks Renat

…

On 16 Apr 2024 at 17:12 +0700, Donatas Abraitis ***@***.***>, wrote: Have you tried using per-vrf SID instead of per-af SID? router bgp 65100 vrf VRF_A sid vpn per-vrf export 11 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[rakhmerov]

Any hints guys where we should be looking into?

[kogdenko]

Hi
To reuse already allocated SID you should flap segment routing in router bgp 65100, so step 4 "remove bgp vrf configuration in vtysh" should be:

conf t 
no router bgp 65100 vrf VRF_A
router bgp 65100
  no segment-routing srv6
  segment-routing srv6
    locator SRlocator
  exit
exit

[Sokolmish]

I found that after VRF router deletion (no router ... vrf) its SID is still listed as a function in the show bgp segment-routing srv6 output. When I manually remove SID (no sid vpn export), it gets removed from both bgps and functions lists and can be reused later.

So there's another workaround that seems to work and is supported by the topotest.

router bgp 65100 vrf VRF_A
  address-family ipv4 unicast
    no sid vpn export 1001
  exit
exit
no router bgp 65100 vrf VRF_A