Large size IPv6 ping is not working while RE protection is applied.
labroot@B> ping 2400:cc00:6000:10b::2 size 5000
PING6(5048=40+8+5000 bytes) 2400:cc00:6000:10b::1 --> 2400:cc00:6000:10b::2
^C
--- 2400:cc00:6000:10b::2 ping6 statistics ---
6 packets transmitted, 0 packets received, 100% packet loss
Ping work upto size 1452:
labroot@B> ping 2400:cc00:6000:10b::2 size 1452
PING6(1500=40+8+1452 bytes) 2400:cc00:6000:10b::1 --> 2400:cc00:6000:10b::2
1460 bytes from 2400:cc00:6000:10b::2, icmp_seq=0 hlim=64 time=29.979 ms
1460 bytes from 2400:cc00:6000:10b::2, icmp_seq=1 hlim=64 time=1.212 ms
1460 bytes from 2400:cc00:6000:10b::2, icmp_seq=2 hlim=64 time=1.259 ms
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 1.212/10.817/29.979/13.550 ms
labroot@B> ping 2400:cc00:6000:10b::2 size 1453
PING6(1501=40+8+1453 bytes) 2400:cc00:6000:10b::1 --> 2400:cc00:6000:10b::2
4 packets transmitted, 0 packets received, 100% packet loss
set firewall family inet6 filter protect-RE-core-IPv6 term icmp from next-header icmp6
set firewall family inet6 filter protect-RE-core-IPv6 term icmp then policer small-bandwidth-policer
set firewall family inet6 filter protect-RE-core-IPv6 term icmp then count icmpv6-count
set firewall family inet6 filter protect-RE-core-IPv6 term icmp then accept
labroot@B> show interfaces xe-0/1/0
Physical interface: xe-0/1/0, Enabled, Physical link is Up
Interface index: 150, SNMP ifIndex: 535
Description: BACKBONE: macq-per-eqnx-pe1-inet-mx204a xe-0/1/4
Link-level type: Ethernet, MTU: 1514, MRU: 1522, LAN-PHY mode, Speed: 10Gbps, BPDU Error: None, Loop Detect PDU Error: None, MAC-REWRITE Error: None, Loopback: None,
Source filtering: Disabled, Flow control: Enabled, Speed Configuration: Auto
Pad to minimum frame size: Disabled
Device flags : Present Running
Interface flags: SNMP-Traps Internal: 0x4000
Link flags : None
CoS queues : 8 supported, 8 maximum usable queues
Schedulers : 0
Current address: f0:7c:c7:0d:b8:47, Hardware address: f0:7c:c7:0d:b8:47
Last flapped : 2024-03-28 04:51:14 IST (2d 14:45 ago)
Input rate : 0 bps (0 pps)
Output rate : 0 bps (0 pps)
Active alarms : None
Active defects : None
PCS statistics Seconds
Bit errors 1
Errored blocks 1
Interface transmit statistics: Disabled
Logical interface xe-0/1/0.0 (Index 358) (SNMP ifIndex 526)
Flags: Up SNMP-Traps 0x4004000 Encapsulation: ENET2
Input packets : 85077
Output packets: 90541
Protocol inet, MTU: 1500
Max nh cache: 100000, New hold nh limit: 100000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0
Flags: Sendbcast-pkt-to-re
Addresses, Flags: Is-Preferred Is-Primary
Destination: 124.47.129.144/30, Local: 124.47.129.145, Broadcast: 124.47.129.147
Protocol inet6, MTU: 1500
Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 2, Curr new hold cnt: 0, NH drop cnt: 0
Flags: Is-Primary
Destination: 2400:cc00:6000:10b::/126, Local: 2400:cc00:6000:10b::1
Addresses, Flags: Is-Preferred
Destination: fe80::/64, Local: fe80::f27c:c7ff:fe0d:b847
Protocol multiservice, MTU: Unlimited
IPv6 ping of large size is fragmented and this is blocked by RE protection:
19:39:06.843904 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0x847c7c62:0|1448) ICMP6, echo request, seq 19
19:39:06.843927 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0x847c7c62:1448|1448)
19:39:06.843934 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0x847c7c62:2896|1448)
19:39:06.843939 Out IP6 (hlim 64, next-header: Fragment (44), length: 672) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0x847c7c62:4344|664)
19:39:07.843905 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0xa7450c85:0|1448) ICMP6, echo request, seq 20
19:39:07.843931 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0xa7450c85:1448|1448)
19:39:07.843938 Out IP6 truncated-ip6 - 18 bytes missing!(hlim 64, next-header: Fragment (44), length: 1456) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0xa7450c85:2896|1448)
19:39:07.843943 Out IP6 (hlim 64, next-header: Fragment (44), length: 672) 2400:cc00:6000:10b::1 > 2400:cc00:6000:10b::2: frag (0xa7450c85:4344|664)
labroot@B> show firewall log
Log :
Time Filter Action Interface Protocol Src Addr Dest Addr
19:40:24 pfe D xe-0/1/0.0 44 2400:cc00:6000:10b::2 2400:cc00:6000:10b::1
Need to allow next-header fragment on RE protection:
set firewall family inet6 filter protect-RE-core-IPv6 term icmp from next-header fragment <<<<
5008 bytes from 2400:cc00:6000:10b::2, icmp_seq=0 hlim=64 time=1.293 ms
5008 bytes from 2400:cc00:6000:10b::2, icmp_seq=1 hlim=64 time=1.116 ms
5008 bytes from 2400:cc00:6000:10b::2, icmp_seq=2 hlim=64 time=1.383 ms
5008 bytes from 2400:cc00:6000:10b::2, icmp_seq=3 hlim=64 time=1.199 ms
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 1.116/1.248/1.383/0.100 ms