9 mins read
BGP – IPv6 Peers
In this post we will explore a few variations of an IPv6 BGP neighborship. We will configure an IPv6 eBGP neighborship between two directly connected routers. The routers will advertise to each other the IPv6 loopback addresses.
1. Basic setup
A simple basic setup, where we are using the inet6 address that was configured on the interface for BGP neighborship:
### R1 config:
set interfaces ge-0/0/1 description "R1-to-R2"
set interfaces ge-0/0/1 unit 0 family inet6 address 2001:db88:8::1/64
set interfaces lo0 unit 0 family inet6 address 2001:db88::1/128
#
set policy-options policy-statement BGP-EXPORT term 1 from route-filter 2001:db88::1/128 exact
set policy-options policy-statement BGP-EXPORT term 1 then accept
#
set protocols bgp group AS-200 family inet6 unicast
set protocols bgp group AS-200 export BGP-EXPORT
set protocols bgp group AS-200 peer-as 200
set protocols bgp group AS-200 neighbor 2001:db88:8::2
### R2 config is not displayed here, but it is identical
### We are receiving the loopback of R2:
root@R1# run show route protocol bgp table inet6.0
inet6.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2001:db88::2/128 *[BGP/170] 00:02:11, localpref 100
AS path: 200 I, validation-state: unverified
> to 2001:db88:8::2 via ge-0/0/1.0
### R1 to R2 loopback ping:
root@R1# run ping 2001:db88::2 source 2001:db88::1
PING6(56=40+8+8 bytes) 2001:db88::1 --> 2001:db88::2
16 bytes from 2001:db88::2, icmp_seq=0 hlim=64 time=2.965 ms
16 bytes from 2001:db88::2, icmp_seq=1 hlim=64 time=2.620 ms
16 bytes from 2001:db88::2, icmp_seq=2 hlim=64 time=2.421 ms
^C
--- 2001:db88::2 ping6 statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 2.421/2.669/2.965/0.225 ms2. IPv6 BGP neighborship using the link local address
Let’s make this more interesting, and imagine that we don’t know the link local address of R2 router and we don’t have access to R2 to find out the address. R2 was already configured, our job now is to configure R1 without touching R2.
### R1 config:
set interfaces ge-0/0/1 description "R1-to-R2"
set interfaces ge-0/0/1 unit 0 family inet6
set interfaces lo0 unit 0 family inet6 address 2001:db88::1/128
#
set policy-options policy-statement BGP-EXPORT term 1 from route-filter 2001:db88::1/128 exact
set policy-options policy-statement BGP-EXPORT term 1 then accept
#
set protocols bgp group AS-200 family inet6 unicast
set protocols bgp group AS-200 export BGP-EXPORT
set protocols bgp group AS-200 peer-as 200We don’t know the link local IPv6 address of the R2 router, but one easy way to discover that is to check the log messages:
### Check the log messages to see R2 link local address:
root@R1# run show log messages | match bgp | last 2
Jun 30 08:27:29 R1 rpd[19418]: bgp_peer_addr_ok: Connection attempt from unconfigured neighbor: fe80::5604:dff:fe00:3241+56479
Jun 30 08:27:29 R1 rpd[19418]: bgp_listen_accept:7344: NOTIFICATION sent to fe80::5604:dff:fe00:3241+56479 (proto): code 6 (Cease) subcode 5 (Connection Rejected), Reason: Connection attempt from unconfigured neighbor: fe80::5604:dff:fe00:3241+56479We can also discover the link-local address of R2 with monitor traffic interface command:
### Use the 'monitor traffic interface' command to discover the peer link local:
root@R1# run monitor traffic interface ge-0/0/1 no-resolve
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on ge-0/0/1, capture size 96 bytes
[...]
12:07:20.361989 In IP6 fe80::5604:dff:fe00:3241.60784 > fe80::5604:dff:fe00:7cb6.179: S 1567084764:1567084764(0) win 16384 <mss 1440,nop,wscale 0,nop,nop,[|tcp]>
### It will not take long until we will spot the link local address of our R2 neighbor.
### We will see captures similar to the one above, In packets from the peer link local address
### And we can also see the 179 port number to confirm it is indeed a BGP packet. Note: other potential solutions to discover the neighbors link local address are router advertisements and trace options.
Now, because we know the link local address of R2 router, we can complete the configuration on R1:
### Add the missing link local neighbor:
root@R1# set protocols bgp group AS-200 neighbor fe80::5604:dff:fe00:3241
[edit]
root@R1# show | compare
[edit protocols bgp group AS-200]
+ neighbor fe80::5604:dff:fe00:3241;
### Indeed, we need to configure the 'local-interface' when using the link local address:
[edit]
root@R1# commit
[edit protocols]
'bgp'
Error in neighbor fe80::5604:dff:fe00:3241 of group AS-200:
local interface required for IPv6 link local direct EBGP
error: configuration check-out failed
[edit]
root@R1# set protocols bgp group AS-200 local-interface ge-0/0/1.0
[edit]
root@R1# show | compare
[edit protocols bgp group AS-200]
+ local-interface ge-0/0/1.0;
[edit protocols bgp group AS-200]
+ neighbor fe80::5604:dff:fe00:3241;
[edit]
root@R1# commit
commit complete
### Job done:
root@R1# run show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 1 Peers: 1 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
0 0 0 0 0 0
inet6.0
1 1 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
fe80::5604:dff:fe00:3241%ge-0/0/1.0 200 8 7 0 0 3 Establ
inet6.0: 1/1/1/0
root@R1# run show route protocol bgp
inet6.0: 18 destinations, 18 routes (18 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2001:db88::2/128 *[BGP/170] 00:02:21, localpref 100
AS path: 200 I, validation-state: unverified
> to fe80::5604:dff:fe00:3241 via ge-0/0/1.0
root@R1# run ping 2001:db88::2 source 2001:db88::1
PING6(56=40+8+8 bytes) 2001:db88::1 --> 2001:db88::2
16 bytes from 2001:db88::2, icmp_seq=0 hlim=64 time=2.902 ms
16 bytes from 2001:db88::2, icmp_seq=1 hlim=64 time=2.760 ms
16 bytes from 2001:db88::2, icmp_seq=2 hlim=64 time=2.273 ms
^C
--- 2001:db88::2 ping6 statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 2.273/2.645/2.902/0.269 ms
3. IPv4 BGP peer with inet6 family
In this variation, we will configure an IPv4 BGP peer, and we will activate both inet and inet6 address families.
### R1 config:
set interfaces ge-0/0/1 description "R1-to-R2"
set interfaces ge-0/0/1 unit 0 family inet address 17.8.0.1/24
set interfaces ge-0/0/1 unit 0 family inet6
#
set policy-options policy-statement BGP-EXPORT term IPv4 from route-filter 17.0.0.1/32 exact
set policy-options policy-statement BGP-EXPORT term IPv4 then accept
set policy-options policy-statement BGP-EXPORT term IPv6 from route-filter 2001:db88::1/128 exact
set policy-options policy-statement BGP-EXPORT term IPv6 then accept
#
set protocols bgp group AS-200 family inet unicast
set protocols bgp group AS-200 family inet6 unicast
set protocols bgp group AS-200 export BGP-EXPORT
set protocols bgp group AS-200 peer-as 200
set protocols bgp group AS-200 neighbor 17.8.0.2
### The BGP session is up:
root@R1# run show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 1 Peers: 1 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
1 1 0 0 0 0
inet6.0
1 0 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
17.8.0.2 200 478 476 0 1 7:07 Establ
inet.0: 1/1/1/0
inet6.0: 0/1/0/0
### The IPv4 part is fine:
root@R1# run show route protocol bgp
inet.0: 25 destinations, 25 routes (25 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
17.0.0.2/32 *[BGP/170] 00:02:34, localpref 100
AS path: 200 I, validation-state: unverified
> to 17.8.0.2 via ge-0/0/1.0
inet6.0: 18 destinations, 18 routes (17 active, 0 holddown, 1 hidden)
root@R1# run ping 17.0.0.2 source 17.0.0.1
PING 17.0.0.2 (17.0.0.2): 56 data bytes
64 bytes from 17.0.0.2: icmp_seq=0 ttl=64 time=2.502 ms
64 bytes from 17.0.0.2: icmp_seq=1 ttl=64 time=2.453 ms
^C
--- 17.0.0.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.453/2.478/2.502/0.024 ms
### But next hop resolution for IPv6 is not working:
root@R1# run show route protocol bgp table inet6.0 hidden detail
inet6.0: 18 destinations, 18 routes (17 active, 0 holddown, 1 hidden)
2001:db88::2/128 (1 entry, 0 announced)
BGP
Next hop type: Router, Next hop index: 0
Address: 0x7bbe1f4
Next-hop reference count: 1, key opaque handle: 0x0, non-key opaque handle: 0x0
Kernel Table Id: 0
Source: 17.8.0.2
Next hop: ::ffff:17.8.0.2 via ge-0/0/1.0, selected
Session Id: 0
State: <Hidden Ext Changed>
Local AS: 100 Peer AS: 200
Age: 9:02
Validation State: unverified
Task: BGP_200.17.8.0.2
AS path: 200 I
Router ID: 17.0.0.2
Hidden reason: Protocol nexthop is not on the interface
Thread: junos-main In Junos, ::ffff refers to an IPv4-mapped IPv6 address (e.g., ::ffff:172.8.0.2). It is used to embed a 32-bit IPv4 address within a 128-bit IPv6 address, common transition mechanisms for dual-stack routing scenarios. The simple solution is to configure the ::ffff:17.8.0.1/120 inet6 address on R1 (and similarly on R2):
### Configure the ::ffff:17.8.0.1/120 inet6 address on R1:
root@R1# set interfaces ge-0/0/1.0 family inet6 address ::ffff:17.8.0.1/120
[edit]
root@R1# commit
commit complete
### Now the prefix is accepted R1:
root@R1# run show route protocol bgp table inet6.0
inet6.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2001:db88::2/128 *[BGP/170] 00:00:19, localpref 100, from 17.8.0.2
AS path: 200 I, validation-state: unverified
> to ::ffff:17.8.0.2 via ge-0/0/1.0
### Ping works:
root@R1# run ping 2001:db88::2 source 2001:db88::1
PING6(56=40+8+8 bytes) 2001:db88::1 --> 2001:db88::2
16 bytes from 2001:db88::2, icmp_seq=0 hlim=64 time=2.673 ms
16 bytes from 2001:db88::2, icmp_seq=1 hlim=64 time=2.622 ms
^C
--- 2001:db88::2 ping6 statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 2.622/2.647/2.673/0.025 msExternal Resources: