We are reopening this bug based on reproduction confirmed by the VyOS TAC team and multiple engineers in a lab environment running FRR 9.1.3 and 10.5.2.
The fix introduced in FRR PR#12545 (backported to FRR 8.4.1 and included in FRR 8.5) is no longer effective in FRR 9.1.3. The redistribute connected directive within a VRF BGP instance does not export connected prefixes into the VPNv4 table, even though the full VPN export policy is correctly configured.
Bug reproduction:
```
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast export vpn
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast import vpn
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast label vpn export 'auto'
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast rd vpn export '10.208.90.3:19'
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast route-target vpn both '64512:19'
set vrf name CUST-DEMO1 protocols bgp address-family ipv4-unicast redistribute connected metric '0'
set interfaces ethernet eth2 vif 999 address '169.254.1.1/24'
set interfaces ethernet eth2 vif 999 vrf 'CUST-DEMO1'
```
```
vyos@vyos:~$ show ip route vrf CUST-DEMO1
C>* 169.254.1.0/24 is directly connected, eth2.999
vyos@vyos:~$ show bgp ipv4 vpn neighbors 10.208.90.1 advertised-routes
(empty)
```
Workaround:
Using the network command combined with "no bgp network import-check" allows the prefix to be exported. However, this workaround introduces a secondary issue: when no bgp network import-check is disabled, FRR does not withdraw the prefix from the BGP table when the interface is removed, resulting in a stale advertisement:
# Deleting the interface:
show ip route vrf CUST-DEMO1
169.254.10.0/24 #is correctly away from the RIB
show ip bgp vrf CUST-DEMO1
*> 169.254.10.0/24 0.0.0.0 0 32768 i #still advertised
---
Environment:
VyOS version: 1.4 and 1.5.0 H1
FRR version: 9.1.3 and 10.5.2-0
Underlay: OSPF + MPLS + Segment Routing
Overlay: iBGP VPNv4 (L3VPN)
Reproduced by: VyOS TAC team + multiple engineers in lab
Reproducible: 100% of the time
---
References:
T4846 — L3VPN network command does not install direct connected prefix
FRR Issue #12502
FRR PR #12545
FRR fix included in FRR 8.5 — regression confirmed in FRR 9.1.3{F114101832}