Description

The article introduces a scenario why there is Rejectv6 DDOS Violation before BGP ipv6 peer down.
For ipv4 , the nh will become hold if arp expired ;
For ipv6 , the nh will become reject if peer unreachable .

Symptoms

<< The loopback address is reachable via static route.

[EBGP RouterA] --- [EBGP RouterB]
R1 loopback: 2001:db8:1:255::1/128
R2 loopback: 2001:db8:1:255::2/128



<< Rejectv6 DDOS Violation was set on all FPCs before BGPv6 peer down.

Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 4 for 1 times, started at 2023-11-16 13:11:37 CST
Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 7 for 1 times, started at 2023-11-16 13:11:37 CST
Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 5 for 1 times, started at 2023-11-16 13:11:37 CST
Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 10 for 1 times, started at 2023-11-16 13:11:37 CST
Nov 16 13:11:42 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 2 for 1 times, started at 2023-11-16 13:11:41 CST

Nov 16 13:12:16 RouterB rpd[37932]: BGP_IO_ERROR_CLOSE_SESSION: BGP peer 2001:db8:1:255::1 (External AS 64497): Error event Operation timed out(60) for I/O session - closing it (instance master)
Nov 16 13:12:16 RouterB rpd[37932]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2001:db8:1:255::1 (External AS 64497) changed state from Established to Idle (event HoldTime) (instance master)
Nov 16 13:12:16 RouterB rpd[37932]: bgp_io_mgmt_cb:2314: NOTIFICATION sent to 2001:db8:1:255::1 (External AS 64497): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2001:db8:1:255::1 (External AS 64497), socket buffer sndacc: 57 rcvacc: 0 , socket buffer sndccc: 57 rcvccc: 0 TCP state: 4, snd_una: 3321890571 snd_nxt: 3321890609 snd_wnd: 16384 rcv_nxt: 936898106 rcv_adv: 936914490, hold timer 90s, hold timer remain 0s, last sent 11s, TCP port (local 179, remote 55514)


<< During the problem, it is noticed that RouterB keep sending NS every 5 seconds , but never send back NA to RouterA , which indicates a possible one-way communication that RouterB might not be able to receive pkts from RouterA.
user@RouterA> monitor traffic interface ae1
......
14:44:10.627547  In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 32
14:44:10.627596 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]
14:44:10.937397 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]
14:44:15.627210  In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 32
14:44:15.627274 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]
14:44:15.937401 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]
14:44:20.638175  In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 32
14:44:20.638224 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]
14:44:20.937405 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]

 

<< According to ipv6 NS/NA mechanism , the ipv6 neighbor will become unreachable without receiving NA , and it happened in a short time before BGPv6 peer holdtime expired. 

user@RouterB# run show ipv6 neighbors | grep 2001:db8:1:12::1
2001:db8:1:12::1 none unreachable 3 yes no ae1.0

 

<< At same time all related static route and BGP protocol nh would become reject nh in FIB. All traffic send to BGP routes would  hit reject nh on all FPCs , and that is the reason why rejectv6 DDOS Violation were set on all FPCs before BGPv6 peer down.
user@RouterB# run show route forwarding-table destination 2001:db8:1:255::1
Routing table: default.inet6
Internet6:
Destination             Type RtRef Next hop           Type      Index   NhRef   Netif
2001:db8:1:255::1/128   user     0 2001:db8:1:12::1   rjct      597     3       ae1.0

Solution

It is recommended to enable bfd on the static route or any fast detection mechanism to avoid the one-way communication scenario.

Modification History

2023-12-05 : Article Created