Routes inside a vrf or virtual-router aren't having their validation-state updated when ROA's change in the validation database despite the notification-rib option being included.
Lab testing shows notification-rib working correctly on Junos 20.4R3-S4.8, but broken on 22.4R3-S3.3, 23.4R2-S2.1, and 24.4R1.9.
Example of the issue on a production MX204:
user@MX> show version
Hostname: MX
Model: mx204
Junos: 22.4R3-S3.3
user@MX> show configuration routing-options validation
notification-rib [ nzpeer.inet.0 nzpeer.inet6.0 internet-and-nren.inet.0 internet-and-nren.inet6.0 ];
group rpki2-hlz {
session 172.24.65.50 {
port 8282;
local-address 172.23.0.23;
}
group rpki2-wlg {
session 172.24.64.50 {
user@MX> show validation database record 130.123.0.0/16
RV database: default
Prefix Origin-AS Session State Mismatch
130.123.0.0/16-16 9433 172.24.65.50 valid
130.123.0.0/16-16 9433 172.24.64.50 valid
user@MX> show route table internet-and-nren.inet 130.123.0.0/16 active-path
internet-and-nren.inet.0: 47481 destinations, 91546 routes (47481 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
130.123.0.0/16 *[BGP/170] 6w6d 03:09:14, MED 0, localpref 200
AS path: 9433 ?, validation-state: unknown
> to 210.7.39.54 via irb.5307
You'll note the incorrect validation state "unknown" when it should be "valid".
route validation-state wont change with the modification of the validation-database, unless the BGP route is flapped.
Further testing found this issue is introduced by PR1788277 fix.
After the RV component receives an update in any of the ROAs from the cache server, it is not relaying that to the BGP-RV broker for an import reevaluation of the routes based on that update. Resulting to which the validation-state of the routes are not getting updated.
At the time of this writing, the problem is understood by Juniper engineering team, the fix is under review.