This problem happened with an improper filter configuration.

The related BGP ipv6 connection kept flapping 

> show bgp summary

From the control plane, the local NDP seems normal but the ping to remote peer's global address got dropped, but the ping to remote's link-local address works successfully.

> show ipv6 neighbors

But on the remote side, the global address NDP didn't become reachable.

This behavior made the ipv6 packets loss and bgp ipv6 peer flapping.

Notes: the ipv4 under the same interface is working well with well-established bgpv4 peer.

Bgpv6 peer got flapping:

Aug 22 11:09:52  x.router rpd[57983]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2007:f798:14:a6::2 (External AS 62787) changed state from EstabSync to Established (event RsyncAck) (instance master)
Aug 22 11:35:38  x.router rpd[57983]: BGP_IO_ERROR_CLOSE_SESSION: BGP peer 2007:f798:14:a6::2 (External AS 62787): Error event Operation timed out(60) for I/O session - closing it (instance master)
Aug 22 11:35:38  x.router rpd[57983]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2007:f798:14:a6::2 (External AS 62787) changed state from Established to Idle (event HoldTime) (instance master)
Aug 22 11:35:38  x.router rpd[57983]: bgp_io_mgmt_cb:2314: NOTIFICATION sent to 2007:f798:14:a6::2 (External AS 62787): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2007:f798:14:a6::2 (External AS 62787), socket buffer sndacc: 76 rcvacc: 0 , socket buffer sndccc: 76 rcvccc: 0 TCP state: 4, snd_una: 3338858446 snd_nxt: 3338858484 snd_wnd: 32486 rcv_nxt: 3245796174 rcv_adv: 3245812558, hold timer 60s, hold timer remain 0s, last sent 4s, TCP port (local 179, remote 43500), JSR handle (primary 1297036693946171393, secondary 1297036693795176449)
Aug 22 11:36:14  x.router rpd[57983]: BGP_RESET_PENDING_CONNECTION: 2007:f798:14:a6::2 (External AS 62787): reseting pending active connection (instance master)
Aug 22 11:36:14  x.router rpd[57983]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2007:f798:14:a6::2 (External AS 62787) changed state from EstabSync to Established (event RsyncAck) (instance master)
Aug 22 11:55:59  x.router rpd[57983]: BGP_IO_ERROR_CLOSE_SESSION: BGP peer 2007:f798:14:a6::2 (External AS 62787): Error event Operation timed out(60) for I/O session - closing it (instance master)
Aug 22 11:55:59  x.router rpd[57983]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2007:f798:14:a6::2 (External AS 62787) changed state from Established to Idle (event HoldTime) (instance master)

Ipv6 ping got dropping:

18:30:42.821550 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 0, length 16
18:30:43.322325 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 1, length 16
18:30:43.823402 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 2, length 16
18:30:44.324302 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 3, length 16
18:30:44.835344 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 4, length 16
18:30:45.341962 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 5, length 16
18:30:45.843989 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 6, length 16
18:30:46.345121 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 7, length 16
18:30:46.847752 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 8, length 16
18:30:47.350832 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 9, length 16
18:30:47.852307 Out IP6 2007:f798:14:21::1 > 2007:f798:14:21::2: ICMP6, echo request, seq 10, length 16

One. check  local control plane traffic for icmp6

monitor traffic interface xe-0/0/3:0.0 matching icmp6 no-resolve 
verbose output suppressed, use <detail> or <extensive> for full protocol decode

18:22:00.243646  In IP6 fe80::ae4a:67ff:fef8:6f5d > fe80::dab1:22ff:fef9:858a: ICMP6, neighbor solicitation, who has fe80::dab1:22ff:fef9:858a, length 32
18:22:00.243709 Out IP6 truncated-ip6 - 4 bytes missing!fe80::dab1:22ff:fef9:858a > fe80::ae4a:67ff:fef8:6f5d: ICMP6, neighbor advertisement[|icmp6]
18:22:06.495014 Out IP6 truncated-ip6 - 12 bytes missing!2607:f798:14:21::1 > 2607:f798:14:21::2: ICMP6, neighbor solicitation[|icmp6]
18:22:06.499358  In IP6 2007:f798:14:21::2 > 2007:f798:14:21::1: ICMP6, neighbor advertisement, tgt is 2607:f798:14:21::2, length 32

Two. check remote peer traffic for icmp6 (simulated)

monitor traffic interface xe-10/0/0 matching icmp6 layer2-headers no-resolve 
verbose output suppressed, use <detail> or <extensive> for full protocol decode
 
15:25:53.050699  Out PFE proto 6 (ipv6): fe80::ae4a:67ff:fef8:6f5d > 2007:f798:14:21::1 ICMP6, neighbor solicitation, who has 2007:f798:14:21::1, length 32
15:26:40.341480  In PFE proto 6 (ipv6): fe80::dab1:22ff:fef9:858a > fe80::ae4a:67ff:fef8:6f5d ICMP6, neighbor solicitation, who has fe80::ae4a:67ff:fef8:6f5d, l

Three. local NDP seems good., but the remote peer NDP does not keep a reachable entry for the global unicast address

show ipv6 neighbors interface xe-0/0/3:0.0 
IPv6 Address                            Linklayer Address  State       Exp   Rtr  Secure  Interface               
2007:f798:14:21::2                       ac:4a:67:f8:6f:5d  reachable   19    yes  no      xe-0/0/3:0.0           
fe80::ae4a:67ff:fef8:6f5d                ac:4a:67:f8:6f:5d  stale       836   yes  no      xe-0/0/3

Four. found the filter's counter on the interface increasing.

 show firewall filter xe-0/0/3:0.0-inet6-i | match IPV6_DENY_ACCESS    
IPV6_DENY_ACCESS-xe-0/0/3:0.0-inet6-i          14919625824            168394609
 
show firewall filter xe-0/0/3:0.0-inet6-i | match IPV6_DENY_ACCESS    
IPV6_DENY_ACCESS-xe-0/0/3:0.0-inet6-i          14919627594            168394630

----------------

set firewall family inet6 filter IPV6_ACL term DENY_ACCESS from destination-address 2007:f798:0010::/44
set firewall family inet6 filter IPV6_ACL term DENY_ACCESS then count IPV6_DENY_ACCESS
set firewall family inet6 filter IPV6_ACL term DENY_ACCESS then discard

----------------

Final solution:

At last, it found that the interface filter blocks the NS from the remote peer, and the filter only allows the options : ipv6 global address as SRC and DST and link-local address as SRC and DST.

If the remote peer sent the NS with link-local address as SRC and ipv6 global address as DST, it would be blocked on the interface, so the NA cannot be sent out locally.

This behavior made the remote peer's NDP working improperly.

After correcting this blocking filter item or setting up static NDP, the problem got solved with ipv6 bgp peer stable.

2025-10-10 : Article Created

2025-10-15 : Pulished