A customer operating two data center facilities (Datacenter 1 and Datacenter 2) with Juniper MX-Series routers, DDoS scrubber appliances, and Internet peerings encountered an issue during DDoS mitigation testing. The environment uses BGP Flowspec to redirect attack traffic into a "dirty" VRF for scrubbing, then reinjects clean traffic into the "clean" VRF. While IPv4 traffic behaves as expected, IPv6 traffic loops indefinitely during an attack scenario.

• IPv6 traffic targeting a test VM loops at the core router until TTL expires.

• IPv4 traffic is correctly scrubbed and delivered to the test VM.

• Traceroute shows repeated hops to the same IPv6 address (clean VLAN interface).

• No interface-group exclusion is configured for IPv6 flowspec filters.

• IPv6 flowspec rules are installed and redirect traffic to the dirty VRF as expected.

The issue stems from a missing configuration for IPv6 flowspec interface-group exclusion. While the IPv4 configuration correctly excludes the clean VLAN interface from flowspec filtering, the IPv6 configuration lacks this exclusion. As a result, cleaned IPv6 traffic re-entering the router is matched again by the flowspec rule and redirected back to the dirty VRF, causing a loop.

To resolve the issue, configure an interface-group exclusion for IPv6 flowspec filtering:

1. Exclude this group from IPv6 flowspec filtering:

set routing-options rib inet6.0 flow interface-group 1 exclude

This configuration ensures that cleaned IPv6 traffic is not rematched by the flowspec rule, preventing looping.

Additional Notes

• The Junos documentation lacks clarity on IPv6-specific flowspec configuration, particularly regarding interface-group exclusions.

• The flow statement is available under rib *.inet6.0 but not under rib *.inet.0, which may cause confusion during configuration.

• Ensure that both IPv4 and IPv6 flowspec configurations are symmetrical to avoid inconsistencies in traffic handling.

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/flow-ipv6-edit-routing-options.html