Description

On QFX series switch which is using GBP(Group Based Policy) function, gbp-tag might be disappeared after rebooting device or waiting for a while. This KB describes the behavior and cause.

Symptoms

The gbp-tag will be removed after rebooting or waiting for a while. Here is the output when there is a gbp-tag. 
user@Switch# run show route 10.1.1.100 extensive

vrf1.inet.0: 15 destinations, 21 routes (15 active, 0 holddown, 0 hidden)
10.1.1.100/32 (1 entry, 1 announced) ★
TSI:
Page 0 idx 0, (group router type External) Type 1 val 0xc4d87a0 (adv_entry)
  Advertised metrics:
   Nexthop: Self
   AS path: [65100] I
   Communities: gbp-tag:0L:100 ★
  Advertise: 00000001
Path 10.1.1.100

user@Switch# run show route | match 10.1.1.100
10.1.1.100/32   *[EVPN/7] 00:00:59
2:192.168.100.1:10::10100::00:00:xx:xx:xx:xx::10.1.1.100/304 MAC/IP ★
2:192.168.100.2:10::10100::00:00:xx:xx:xx:xx::10.1.1.100/304 MAC/IP ★
2:192.168.100.1:10::10100::00:00:xx:xx:xx:xx::10.1.1.100/304 MAC/IP ★
2:192.168.100.2:10::10100::00:00:xx:xx:xx:xx::10.1.1.100/304 MAC/IP ★

After rebooting QFX or waiting for a while, gbp-tag would be removed. 
user@Switch# run show route 10.1.1.100 extensive

​vrf1.inet.0: 12 destinations, 18 routes (12 active, 0 holddown, 0 hidden)
10.1.1.0/24 (2 entries, 1 announced) ★This is network address
TSI:
Page 0 idx 0, (group router type External) Type 1 val 0xc4d8120 (adv_entry)
  Advertised metrics:
   Nexthop: Self
   AS path: [65100] I
   Communities: ★
  Advertise: 00000001
Path 10.1.1.0

user@Switch# run show route | match 10.1.1.100
{no output}
{master:0}[edit]

Solution

This behavior is coming from ARP entry and type 2 route. When QFX does not receive ARP reply or fails to resolve ARP entry, ARP entry and type 2 route will be removed. As a result, gbp-tag will also be disappeared.
This is a specification which described in the document below:
-------------
https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/example/micro-segmentation-using-group-based-policy.html

Tag propagation is always in context of MAC and IP-based GBP. For VLANs, Port, and Port+VLAN matches this is not applicable.
-------------

Modification History

2024-06-23 : Article Created