We are reopening this bug based on reproduction confirmed by the VyOS TAC team and multiple engineers in a lab environment running FRR 9.1.3 and 10.5.2.
The fix introduced in FRR PR#12545 (backported to FRR 8.4.1 and included in FRR 8.5) is no longer effective in FRR 9.1.3. The redistribute connected directive within a VRF BGP instance does not export connected prefixes into the VPNv4 table, even though the full VPN export policy is correctly configured.
Bug reproduction:
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast export vpn set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast import vpn set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast label vpn export 'auto' set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast rd vpn export '10.208.90.3:19' set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast route-target vpn both '65001:19' set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast redistribute connected metric '0' set interfaces ethernet eth2 vif 999 address '169.254.1.1/24' set interfaces ethernet eth2 vif 999 vrf 'CUST-DEMO1'
vyos@vyos:~$ show ip route vrf CUST-DEMO1 C>* 169.254.1.0/24 is directly connected, eth2.999 vyos@vyos:~$ show bgp ipv4 vpn neighbors 10.208.90.1 advertised-routes (empty)
Workaround:
Using the network command combined with "no bgp network import-check" allows the prefix to be exported. However, this workaround introduces a secondary issue: when no bgp network import-check is disabled, FRR does not withdraw the prefix from the BGP table when the interface is removed, resulting in a stale advertisement:
Deleting the interface:
show ip route vrf CUST-DEMO1
169.254.10.0/24 #is correctly away from the RIB
show ip bgp vrf CUST-DEMO1
*> 169.254.10.0/24 0.0.0.0 0 32768 i #still advertised
Environment:
VyOS version: 1.4 and 1.5.0 H1 FRR version: 9.1.3 and 10.5.2-0 Underlay: OSPF + MPLS + Segment Routing Overlay: iBGP VPNv4 (L3VPN) Reproduced by: VyOS TAC team + multiple engineers in lab Reproducible: 100% of the time
References:
T4846 — L3VPN network command does not install direct connected prefix
FRR Issue #12502
FRR PR #12545
FRR fix included in FRR 8.5 — regression confirmed in FRR 9.1.3{F114101832}