In an EVPN/VXLAN environment, a spoofed or crafted ARP reply matching the IP and MAC address of a remote gateway may cause an inconsistency between the MAC and MAC-IP state maintained by the device.
Under the affected condition, the MAC entry for the remote gateway remains associated with the correct remote EVPN ESI, while the corresponding MAC-IP entry may incorrectly be updated to the local interface on which the spoofed ARP packet was received.
This results in an inconsistent MAC-IP state and can prevent ARP traffic from being correctly forwarded toward the remote gateway, causing loss of gateway connectivity for affected clients.
The following symptoms may be observed:
The issue occurs due to an inconsistency in the handling of MAC-IP updates between L2ALM and L2ALD.
L2ALM could update the existing MAC-IP entry based on the input ARP/NDP interface before receiving acknowledgement from L2ALD. If L2ALD subsequently rejected the update, the previous MAC address, interface index, and MAC-IP flags were not restored correctly.
As a result, the MAC and MAC-IP states could become inconsistent.
The software correction ensures that changes to the MAC address, interface index, and MAC-IP flags are committed only after successful acknowledgement from L2ALD.
The existing handling for invalid MAC conditions remains unchanged.
The fix is included in the following Junos releases:
If an upgrade is not immediately possible, the following workarounds may be considered: