An MX is seeing unexpected behavior with respect to how IPv6 packets are handled and forwarded.
The MX has an inet6 interface:
set interfaces xe-0/0/1:0 flexible-vlan-tagging
set interfaces xe-0/0/1:0 encapsulation flexible-ethernet-services
set interfaces xe-0/0/1:0 unit 100 vlan-id 100
set interfaces xe-0/0/1:0 unit 100 family inet6 address 2001:10::1/64
With a route to the 2001:100::2
labroot@avoid-re0> show route 2001:100::2
inet6.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2001:100::/64 *[Direct/0] 00:00:16
> via xe-0/0/1:1.100
An IPv6 neighbor is active on 0/0/1:0:
labroot@avoid-re0> show ipv6 neighbors
IPv6 Address Linklayer Address State Exp Rtr Secure Interface
2001:10::2 00:10:94:00:00:01 reachable 25 no no xe-0/0/1:0.100
fe80::1 00:10:94:00:00:01 reachable 1191 no no xe-0/0/1:0.100
fe80::210:94ff:fe00:1 00:10:94:00:00:01 reachable 1137 no no xe-0/0/1:0.100
Traffic is then sent from that host using the link local source to 2001:100::2
fe80::210:94ff:fe00:1 > 2001:100::2: ICMP6, echo request
The packets reach that router in spite of the fact that RFC4291 expressly states that link local packets should not be forwarded:
Link-Local addresses are for use on a single link. Link-Local
addresses have the following format:
| 10 |
| bits | 54 bits | 64 bits |
+----------+-------------------------+----------------------------+
|1111111010| 0 | interface ID |
Link-Local addresses are designed to be used for addressing on a
single link for purposes such as automatic address configuration,
neighbor discovery, or when no routers are present.
Routers must not forward any packets with Link-Local source or
destination addresses to other links.
The same information is reflected in the Juniper Day One Book "Exploring IPv6":
"Link-Local unicast addresses (FE80::/10): As the name implies,
Link-Local addresses are unicast addresses to be used on a single
link. Packets with a Link-Local source or destination address will
not be forwarded to other links. These addresses are used for
neighbor discovery, automatic address configuration, and in
circumstances when no routers are present."
IPv6 packets with a link local source are forwarded and not discarded.
The router is actually functioning as intended. Junos has a knob to control this behavior, source-checking under forwarding-options:
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/source-checking-edit-forwarding-options.html
When set:
[edit]
labroot@avoid-re0# set forwarding-options family inet6 source-checking
The router will receive the packet and discard it, sending back an ICMP6 destination unreachable:
labroot@avoid-re0> monitor traffic interface xe-0/0/1:0 no-resolve size 1500
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on xe-0/0/1:0, capture size 1500 bytes
12:31:23.180445 In IP6 fe80::210:94ff:fe00:1 > 2001:100::2: ICMP6, echo request, seq 1, length 450
12:31:23.180478 Out IP6 2001:10::1 > fe80::210:94ff:fe00:1: ICMP6, destination unreachable, beyond scope 2001:100::2, source address fe80::210:94ff:fe00:1, length 498
12:31:23.347123 In IP6 fe80::210:94ff:fe00:1 > 2001:100::2: ICMP6, echo request, seq 1, length 450
12:31:23.347149 Out IP6 2001:10::1 > fe80::210:94ff:fe00:1: ICMP6, destination unreachable, beyond scope 2001:100::2, source address fe80::210:94ff:fe00:1, length 498
12:31:23.430410 In IP6 fe80::210:94ff:fe00:1 > 2001:100::2: ICMP6, echo request, seq 1, length 450
12:31:23.430431 Out IP6 2001:10::1 > fe80::210:94ff:fe00:1: ICMP6, destination unreachable, beyond scope 2001:100::2, source address fe80::210:94ff:fe00:1, length 498
12:31:23.513820 In IP6 fe80::210:94ff:fe00:1 > 2001:100::2: ICMP6, echo request, seq 1, length 450