Description

The traffic for the same flow with the same tuple will be sent through different interfaces if "the TTL value in IPv4" or "the payload length in IPv6" are different.

This issue matches PR1738709.

Symptoms

When a user did HTTP GET to anycast address 2001:db8:1:lh::1 from the client device, it behaved as follows and HTTP GET could not be performed correctly.

1. Client sends SYN -> Server A receives and replies SYN, ACK

2. ACK sent from Client -> Server B received, RST returned because session does not exist

3. Send HTTP GET from Client -> Server B receives, RST is returned because session does not exist

From the situation, QFX5130-32CD transfers frames with the same SrcIP, DstIP, and next-header to different next-hops, which makes it appear that HTTP communication is not established.

 

[Topology]

Two servers are connected to QFX5130-32CD by BGP.

Addresses for services are distributed to two servers by ECMP.

+------+      +-----------------+        +--------------------+
|      |      |                 +------->+      Server A      |
|      |      |                 |        +--------------------+
|Client+------+QFX5130-32CD(DUT)| ECMP    2001:db8:1:lh::1/128
|      |      |                 |        +--------------------+
|      |      |                 +------->+      Server B      |
+------+      +-----------------+        +--------------------+

Solution

If you configure "set forwarding-options enhanced-hash-key inet6 no-next-header" in forwarding-options, then it works fine and hashes the flow only to a single device.

For permanent fix you can go to fixed versions under PR1738709.

https://prsearch.juniper.net/problemreport/PR1738709

Modification History

2023-07-14:<First Version>

Related Information