We have seen that the LDP session do not become operational when ospf3 has ipsec-sa is active.
We have both v4/v6 addresses transport-preference as ipv6.
set protocols ldp transport-preference ipv6 set protocols ospf3 area 0.0.0.0 interface lo0.0 passive set protocols ospf3 area 0.0.0.0 interface ae11.10 metric 256 set protocols ospf3 area 0.0.0.0 interface ae11.10 ipsec-sa sa1 set protocols ospf3 area 0.0.0.0 interface ae12.10 metric 256 set protocols ospf3 area 0.0.0.0 interface ae12.10 ipsec-sa sa1 set protocols ospf3 export OSPFv6 show ldp session Address State Connection Hold time Adv. Mode 213.239.236.93 Nonexistent Closed 0 DU show ldp neighbor Address Interface Label space ID Hold time 213.239.236.93 ae11.10 213.133.126.11:0 14
The driver is marking incoming packets as coming from a helper interface (iflxxxx) instead of the main one (jdtdv0).
It does this because it cannot tell whether a packet needs a security check, so it sends everything through a path where that check can happen if required.
Because of this, the helper interface must listen to the same network addresses as the main interface. Otherwise, some important packets (like certain routing messages) will not be passed up correctly.
This is fixed via internal PR1919313 (as of now in below releases & all later releases).
23.2R2-S7-EVO
23.4R2-S8-EVO
25.4R2-EVO
26.1R1-EVO
26.2R1-EVO
Workaround is to deactivate ipsec-sa in ospf3.
set protocols ospf3 area 0.0.0.0 interface lo0.0 passive set protocols ospf3 area 0.0.0.0 interface ae11.10 metric 256 set protocols ospf3 area 0.0.0.0 interface ae11.10 ipsec-sa sa1 deactivate protocols ospf3 area 0.0.0.0 interface ae11.10 ipsec-sa set protocols ospf3 area 0.0.0.0 interface ae12.10 metric 256 set protocols ospf3 area 0.0.0.0 interface ae12.10 ipsec-sa sa1 set protocols ospf3 export OSPFv6 show ldp session Address State Connection Hold time Adv. Mode 2a01:4f8:0:3::8dd Operational Open 27 DU