Boot configuration fails when multiple pseudo-ethernet anycast gateways share the same MAC

Bugs
,
1

I am testing the new anycast-gateway support for pseudo-ethernet interfaces in an EVPN/VXLAN fabric and I think I found a boot-time configuration issue. This is for Single VXlan Device, single bridge.

Version

VyOS 1.5-rolling-20260823xxx
FRR 10.6.1

My setup has several L2VNIs in the same VRF. The anycast gateway interfaces within a VRF intentionally share the same anycast MAC. (Not sure why I chose this. Unique MACs per anycast gateway is probably more expected, and works without issue).

For example, approximately:

VRF lylat_lan

peth9009 -> anycast MAC bc:24:11:00:69:00
peth9010 -> anycast MAC bc:24:11:00:69:00
peth9011 -> anycast MAC bc:24:11:00:69:00

The same MAC is also used on the other VTEPs that provide these anycast gateways.

On a cold boot, the VyOS configuration does not fully apply. The first pseudo-ethernet interface using a given anycast MAC appears to succeed, but subsequent interfaces using the same MAC fail while trying to create the local bridge FDB entry:

OSError: [Errno 255] failed to run command:
bridge fdb add bc:24:11:00:69:00 dev br0 self local

exit code: 255

Sending reply: ERROR_COMMIT_APPLY

The boot process eventually reports:

vyos-config: Configuration error

One visible consequence is that BGP is not configured correctly after boot:

% BGP instance not found

Interestingly, after the system has booted, I can do:

configure
load /config/config.boot
commit

and the configuration applies normally.

Looking at the implementation, the pseudo-ethernet anycast gateway path eventually calls:

bridge.add_local_fdb_entry(mac)

which results in:

bridge fdb add <MAC> dev br0 self local

It looks like this operation is not idempotent when several pseudo-ethernet anycast gateways on the same bridge intentionally use the same MAC.

I tested simply changing the anycast-gateway bridge fdb command from add to replace, and it seems to resolve the cold-boot issue.

user@vyos-builder:~/vyos/vyos-1x$ git diff
diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index f04d52546..876eb0982 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -114,7 +114,7 @@ class BridgeIf(Interface):
             'shellcmd': 'ip link set dev {value} nomaster',
         },
         'add_local_fdb_entry': {
-            'shellcmd': 'bridge fdb add {value} dev {ifname} self local',
+            'shellcmd': 'bridge fdb replace {value} dev {ifname} self local',
         },
         'del_local_fdb_entry': {
             'shellcmd': 'bridge fdb del {value} dev {ifname} self local',
user@vyos-builder:~/vyos/vyos-1x$

I can provide the complete boot traceback and a minimal configuration if useful.

2

With at least Arista its a thing to also setup `ip virtual-router mac-address` to be the same among nodes also sharing the same ESI using EVPN/VXLAN.

Example:

3

I don’t think the ip virtual-router mac address is relevant to this issue. My issue is with a single vtep starting up, not a mac address conflict with other vteps.

The problem I am describing is with the pseudo ethernet anycast gateway (w/ Single Vxlan Device).

The anycast-gateway command will run bridge fdb add [mac] [bridge] ...
If the same mac is used on multiple pseudo ethernet devices with the same underlying bridge, the exact same bridgr fdb add command runs multiple times. This fails when the mac entry already exists, after the first time the command runs.

I changed this behavior to use bridge fdb replace which succeeds when ran multiple times.