Page MenuHomeVyOS Platform
Create Task
Maniphest T8426

EVPN Route Type 2 does not contain IP when Anycast IP/MAC GW is set on MACVLAN interface
Closed, ResolvedPublicBUG
Actions

Description

FRR suggests using macvlan interface in Anycast Gateway implementation.
https://docs.frrouting.org/en/latest/evpn.html#anycast-gateways-with-single-vxlan-device
But arp entry on macvlan interface does not transfer to BGP EVPN routes type 2 with IP.
Example
Topology:

EVPN-Topology.png (445×758 px, 37 KB)

HOST1:

IP/MASK     : 192.168.1.20/24
GATEWAY     : 192.168.1.1
MAC         : 00:50:79:66:68:0e

HOST3

IP/MASK     : 192.168.2.10/24
GATEWAY     : 192.168.2.1
MAC         : 00:50:79:66:68:11

Switch1 and Switch2

e0 - 802.1q trunk
e1- vlan 100
e2 - vlan 200

R1:

set interfaces bridge br0 enable-vlan
set interfaces bridge br0 ip enable-arp-accept
set interfaces bridge br0 member interface eth1 allowed-vlan '100'
set interfaces bridge br0 member interface eth1 allowed-vlan '200'
set interfaces bridge br0 member interface vxlan0
set interfaces bridge br0 vif 100 ip enable-arp-accept
set interfaces bridge br0 vif 100 vrf 'RED'
set interfaces bridge br0 vif 200 ip enable-arp-accept
set interfaces bridge br0 vif 200 vrf 'RED'
set interfaces bridge br0 vif 1000 vrf 'RED'
set interfaces ethernet eth0 address '10.0.0.1/30'
set interfaces loopback lo address '1.1.1.1/32'
set interfaces pseudo-ethernet peth100 address '192.168.1.1/24'
set interfaces pseudo-ethernet peth100 ip enable-arp-accept
set interfaces pseudo-ethernet peth100 mac '00:aa:aa:aa:aa:aa'
set interfaces pseudo-ethernet peth100 source-interface 'br0.100'
set interfaces pseudo-ethernet peth100 vrf 'RED'
set interfaces pseudo-ethernet peth200 address '192.168.2.1/24'
set interfaces pseudo-ethernet peth200 ip enable-arp-accept
set interfaces pseudo-ethernet peth200 mac '00:aa:aa:aa:aa:aa'
set interfaces pseudo-ethernet peth200 source-interface 'br0.200'
set interfaces pseudo-ethernet peth200 vrf 'RED'
set interfaces vxlan vxlan0 parameters external
set interfaces vxlan vxlan0 parameters neighbor-suppress
set interfaces vxlan vxlan0 parameters nolearning
set interfaces vxlan vxlan0 parameters vni-filter
set interfaces vxlan vxlan0 source-address '1.1.1.1'
set interfaces vxlan vxlan0 source-interface 'lo'
set interfaces vxlan vxlan0 vlan-to-vni 100 vni '100'
set interfaces vxlan vxlan0 vlan-to-vni 200 vni '200'
set interfaces vxlan vxlan0 vlan-to-vni 1000 vni '1000'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp address-family l2vpn-evpn vni 100 rd '1000:100'
set protocols bgp address-family l2vpn-evpn vni 100 route-target both '1000:100'
set protocols bgp address-family l2vpn-evpn vni 200 rd '1000:200'
set protocols bgp address-family l2vpn-evpn vni 200 route-target both '1000:200'
set protocols bgp neighbor 1.1.1.2 address-family l2vpn-evpn
set protocols bgp neighbor 1.1.1.2 ebgp-multihop '3'
set protocols bgp neighbor 1.1.1.2 remote-as '65002'
set protocols bgp neighbor 1.1.1.2 update-source 'lo'
set protocols bgp system-as '65001'
set protocols static route 1.1.1.2/32 next-hop 10.0.0.2
set vrf name RED protocols bgp address-family ipv4-unicast redistribute connected
set vrf name RED protocols bgp address-family ipv4-unicast redistribute static
set vrf name RED protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name RED protocols bgp address-family l2vpn-evpn rd '1000:1000'
set vrf name RED protocols bgp address-family l2vpn-evpn route-target both '1000:1000'
set vrf name RED protocols bgp system-as '65001'
set vrf name RED table '111'
set vrf name RED vni '1000'

R2:

set interfaces bridge br0 enable-vlan
set interfaces bridge br0 ip enable-arp-accept
set interfaces bridge br0 member interface eth1 allowed-vlan '100'
set interfaces bridge br0 member interface eth1 allowed-vlan '200'
set interfaces bridge br0 member interface vxlan0
set interfaces bridge br0 vif 100 ip enable-arp-accept
set interfaces bridge br0 vif 100 vrf 'RED'
set interfaces bridge br0 vif 200 ip enable-arp-accept
set interfaces bridge br0 vif 200 vrf 'RED'
set interfaces bridge br0 vif 1000 vrf 'RED'
set interfaces ethernet eth0 address '10.0.0.2/30'
set interfaces loopback lo address '1.1.1.2/32'
set interfaces pseudo-ethernet peth100 address '192.168.1.1/24'
set interfaces pseudo-ethernet peth100 ip enable-arp-accept
set interfaces pseudo-ethernet peth100 mac '00:aa:aa:aa:aa:aa'
set interfaces pseudo-ethernet peth100 source-interface 'br0.100'
set interfaces pseudo-ethernet peth100 vrf 'RED'
set interfaces pseudo-ethernet peth200 address '192.168.2.1/24'
set interfaces pseudo-ethernet peth200 ip enable-arp-accept
set interfaces pseudo-ethernet peth200 mac '00:aa:aa:aa:aa:aa'
set interfaces pseudo-ethernet peth200 source-interface 'br0.200'
set interfaces pseudo-ethernet peth200 vrf 'RED'
set interfaces vxlan vxlan0 parameters external
set interfaces vxlan vxlan0 parameters neighbor-suppress
set interfaces vxlan vxlan0 parameters nolearning
set interfaces vxlan vxlan0 parameters vni-filter
set interfaces vxlan vxlan0 source-address '1.1.1.2'
set interfaces vxlan vxlan0 source-interface 'lo'
set interfaces vxlan vxlan0 vlan-to-vni 100 vni '100'
set interfaces vxlan vxlan0 vlan-to-vni 200 vni '200'
set interfaces vxlan vxlan0 vlan-to-vni 1000 vni '1000'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp address-family l2vpn-evpn vni 100 rd '1000:100'
set protocols bgp address-family l2vpn-evpn vni 100 route-target both '1000:100'
set protocols bgp address-family l2vpn-evpn vni 200 rd '1000:200'
set protocols bgp address-family l2vpn-evpn vni 200 route-target both '1000:200'
set protocols bgp neighbor 1.1.1.1 address-family l2vpn-evpn
set protocols bgp neighbor 1.1.1.1 ebgp-multihop '3'
set protocols bgp neighbor 1.1.1.1 remote-as '65001'
set protocols bgp neighbor 1.1.1.1 update-source 'lo'
set protocols bgp system-as '65002'
set protocols static route 1.1.1.1/32 next-hop 10.0.0.1
set vrf name RED protocols bgp address-family ipv4-unicast redistribute connected
set vrf name RED protocols bgp address-family ipv4-unicast redistribute static
set vrf name RED protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name RED protocols bgp address-family l2vpn-evpn rd '1000:1000'
set vrf name RED protocols bgp address-family l2vpn-evpn route-target both '1000:1000'
set vrf name RED protocols bgp system-as '65002'
set vrf name RED table '111'
set vrf name RED vni '1000'

Need to add two Linux command manually, because VyOS does not have them in CLI

#stop forward arp request to this mac through vxlan
sudo bridge fdb add 00:aa:aa:aa:aa:aa dev br0 self local

#stop learning MAC via vxlan
sudo ip link set vxlan0 type bridge_slave learning off

How to reproduce the issue.
ping HOST3 from HOST1

HOST1> ping 192.168.2.10

192.168.2.10 icmp_seq=1 timeout
192.168.2.10 icmp_seq=2 timeout
192.168.2.10 icmp_seq=3 timeout
192.168.2.10 icmp_seq=4 timeout
192.168.2.10 icmp_seq=5 timeout

OUTPUT from R1:

vyos@vyos:~$ show bgp l2vpn evpn route type 2
BGP table version is 3, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id]
EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP]
EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP]
EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP]
EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP]

   Network          Next Hop            Metric LocPrf Weight Path
                    Extended Community
Route Distinguisher: 1000:100
 *>  [2]:[0]:[48]:[00:50:79:66:68:0e]
                    1.1.1.1                            32768 i
                    ET:8 RT:1000:100
Route Distinguisher: 1000:200
 *>  [2]:[0]:[48]:[00:50:79:66:68:11]
                    1.1.1.2                                0 65002 i
                    RT:1000:200 ET:8

Displayed 2 prefixes (2 paths) (of requested type)

As we see, there is a route type 2 with the MAC of HOST1 and HOST3, but there is no route type2 with MAC/IP of HOST1 and HOST2.
And arp cache of evpn is empty

vyos@vyos:~$ show evpn arp-cache vni all
VNI 200 #ARP (IPv4 and IPv6, local and remote) 0

VNI 100 #ARP (IPv4 and IPv6, local and remote) 0

But ARP entry of HOST1 is on R1

vyos@vyos:~$ show arp
Address       Interface    Link layer address    State
------------  -----------  --------------------  ---------
192.168.2.10  peth200                            FAILED
192.168.1.20  peth100      00:50:79:66:68:0e     REACHABLE
10.0.0.2      eth0         0c:63:75:a8:00:00     REACHABLE

The same situation is on R2

vyos@vyos:~$ show bgp l2vpn evpn route type 2
BGP table version is 3, local router ID is 1.1.1.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id]
EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP]
EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP]
EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP]
EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP]

   Network          Next Hop            Metric LocPrf Weight Path
                    Extended Community
Route Distinguisher: 1000:100
 *>  [2]:[0]:[48]:[00:50:79:66:68:0e]
                    1.1.1.1                                0 65001 i
                    RT:1000:100 ET:8
Route Distinguisher: 1000:200
 *>  [2]:[0]:[48]:[00:50:79:66:68:11]
                    1.1.1.2                            32768 i
                    ET:8 RT:1000:200

Displayed 2 prefixes (2 paths) (of requested type)
vyos@vyos:~$ show evpn arp-cache vni all
VNI 200 #ARP (IPv4 and IPv6, local and remote) 0

VNI 100 #ARP (IPv4 and IPv6, local and remote) 0
vyos@vyos:~$ show arp
Address       Interface    Link layer address    State
------------  -----------  --------------------  ---------
10.0.0.1      eth0         0c:65:63:c1:00:00     REACHABLE
192.168.2.10  peth200      00:50:79:66:68:11     REACHABLE

The problem looks like that FRR does not install Route Type 2 MAC/IP if interface of ARP entry is not a bridge.

Details

Version
VyOS 2026.03.24-0025-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

a.apostoliuk created this task.Mar 25 2026, 7:41 PM
a.apostoliuk triaged this task as High priority.
pasik subscribed.Mar 25 2026, 7:59 PM
fernando subscribed.Mar 25 2026, 8:10 PM
rchrist subscribed.EditedMar 26 2026, 9:36 PM

<Ignore what was here before, I completely misread your report>

So, after trying some stuff out:

  • If you start the ping before doing sudo bridge fdb add 00:aa:aa:aa:aa:aa dev br0 self local, it will work but show DUP responses
  • If the ARP is already in the cache and you add sudo bridge fdb add 00:aa:aa:aa:aa:aa dev br0 self local, it will continue to work
  • Once you flush the ARP cache, it will stop working

aa:c1:ab:29:33:cd is the sending device's MAC for the following dumps (with IP 192.168.2.20/24)

Zebra debug after flush without fdb rule:

2026/03/27 00:11:09.343 ZEBRA: netlink_parse_info: netlink-dp-in (NS 0) type RTM_NEWNEIGH(28), len=84, seq=0, pid=0
2026/03/27 00:11:09.343 ZEBRA: Rx RTM_NEWNEIGH AF_BRIDGE IF 100 VLAN 200 st 0x2 fl 0x0 MAC aa:c1:ab:29:33:cd nhg 0 vni 0
2026/03/27 00:11:09.343 ZEBRA: netlink_parse_info: netlink-dp-in (NS 0) type RTM_NEWNEIGH(28), len=76, seq=0, pid=0
2026/03/27 00:11:09.343 ZEBRA: Rx RTM_NEWNEIGH family ipv4 IF 10 NSID 0 IP 192.168.2.20 MAC aa:c1:ab:29:33:cd state 0x4 flags 0x0 ext_flags 0x0
2026/03/27 00:11:09.343 ZEBRA: netlink_parse_info: netlink-dp-in (NS 0) type RTM_NEWNEIGH(28), len=76, seq=0, pid=0
2026/03/27 00:11:09.343 ZEBRA: Rx RTM_NEWNEIGH family ipv4 IF 99 NSID 0 IP 10.0.0.2 MAC aa:c1:ab:2a:8b:2d state 0x2 flags 0x0 ext_flags 0x0
2026/03/27 00:11:09.344 ZEBRA: ADD MAC aa:c1:ab:29:33:cd intf eth2(100) VID 200 -> VNI 200
2026/03/27 00:11:09.344 ZEBRA: zebra_evpn_mac_add: MAC aa:c1:ab:29:33:cd flags None 
2026/03/27 00:11:09.344 ZEBRA: Send MACIP Add f None  state 1 MAC aa:c1:ab:29:33:cd IP (null) seq 0 L2-VNI 200 ESI - to bgp
2026/03/27 00:11:09.344 ZEBRA: zsend_neighbor_notify: Notifying Neighbor entry (128)
2026/03/27 00:11:09.344 ZEBRA:     Neighbor Entry received is not on a VLAN or a BRIDGE, ignoring
2026/03/27 00:11:09.344 ZEBRA: zebra neigh add if peth200/10 192.168.2.20 aa:c1:ab:29:33:cd
2026/03/27 00:11:09.344 ZEBRA: zebra neigh new if 10 192.168.2.20 aa:c1:ab:29:33:cd

Here you can see why you get so many dups.

Zebra debug after flush with fdb rule:

2026/03/27 00:14:25.698 ZEBRA: netlink_parse_info: netlink-dp-in (NS 0) type RTM_NEWNEIGH(28), len=76, seq=0, pid=0
2026/03/27 00:14:25.698 ZEBRA: Rx RTM_NEWNEIGH family ipv4 IF 10 NSID 0 IP 192.168.2.20 MAC aa:c1:ab:29:33:cd state 0x10 flags 0x0 ext_flags 0x0
2026/03/27 00:14:25.698 ZEBRA: netlink_parse_info: netlink-dp-in (NS 0) type RTM_NEWNEIGH(28), len=76, seq=0, pid=0
2026/03/27 00:14:25.698 ZEBRA: Rx RTM_NEWNEIGH family ipv4 IF 10 NSID 0 IP 192.168.2.20 MAC aa:c1:ab:29:33:cd state 0x2 flags 0x0 ext_flags 0x0
2026/03/27 00:14:25.698 ZEBRA: zsend_neighbor_notify: Notifying Neighbor entry (128)
2026/03/27 00:14:25.698 ZEBRA:     Neighbor Entry received is not on a VLAN or a BRIDGE, ignoring
2026/03/27 00:14:25.698 ZEBRA: zebra neigh add if peth200/10 192.168.2.20 aa:c1:ab:29:33:cd
2026/03/27 00:14:25.698 ZEBRA: zsend_neighbor_notify: Notifying Neighbor entry (128)
2026/03/27 00:14:25.698 ZEBRA:     Neighbor Entry received is not on a VLAN or a BRIDGE, ignoring
2026/03/27 00:14:25.698 ZEBRA: zebra neigh add if peth200/10 192.168.2.20 aa:c1:ab:29:33:cd

One important bit:
Linux in general isn't capable of performing ARP learning on (VXLAN-)bridged traffic out of the box.
Cumulus Linux solves this with a custom daemon (neighmgrd), as mentioned here https://github.com/FRRouting/frr/issues/12574#issuecomment-1458953110 and here https://github.com/FRRouting/frr/issues/16015

hedrok subscribed.May 27 2026, 5:50 PM

FRR PR: https://github.com/FRRouting/frr/pull/22030
vyos-build PR: https://github.com/vyos/vyos-build/pull/1199

Viacheslav closed this task as Resolved.Jun 30 2026, 10:19 AM
Viacheslav assigned this task to hedrok.
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.