I’m trying out a simple topology for testing MPLS L3VPN with VyOS, and I’m running 1.4-rolling-202204130521.
I have a simple topology with 2 MPLS PE, and two CE routers (each one connected to a PE), with a VRF called blue. Each CE announces over BGP the loopback address and a local subnet.
I am encountering some issues on the transport plane, while the control plane seems good.
When pinging from the network 100.64.1.x to 100.64.2.x (from CE1 to CE2), I see the ICMP ECHO between PE1 and PE2 (MPLS encapsulated)… but nothing goes out from PE2 to CE2 (edge2).
From PE2 I am able to ping CE2 (so I can exclude any problem between that two).
CAPTURE ON PE2 eth1 (interface between PE1-PE2):
vagrant@pe2:~$ sudo tcpdump -n -i eth1
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:46:14.825542 MPLS (label 80, exp 0, [S], ttl 63) IP 100.64.1.21 > 100.64.2.22: ICMP echo request, id 57916, seq 1006, length 64
10:46:15.849529 MPLS (label 80, exp 0, [S], ttl 63) IP 100.64.1.21 > 100.64.2.22: ICMP echo request, id 57916, seq 1007, length 64
10:46:16.873433 MPLS (label 80, exp 0, [S], ttl 63) IP 100.64.1.21 > 100.64.2.22: ICMP echo request, id 57916, seq 1008, length 64
PE2 routing table for VRF blue:
vagrant@pe2:~$ show ip route vrf blue
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
VRF blue:
B> 10.0.0.21/32 [20/0] via 10.0.0.11 (vrf default) (recursive), label 80, weight 1, 00:18:46
* via 10.1.0.1, eth1 (vrf default), label implicit-null/80, weight 1, 00:18:46
B>* 10.0.0.22/32 [20/0] via 10.1.0.9, eth2, weight 1, 00:19:00
B> 10.1.0.4/30 [20/0] via 10.0.0.11 (vrf default) (recursive), label 80, weight 1, 00:18:46
* via 10.1.0.1, eth1 (vrf default), label implicit-null/80, weight 1, 00:18:46
C>* 10.1.0.8/30 is directly connected, eth2, 00:19:21
B> 100.64.1.0/24 [20/0] via 10.0.0.11 (vrf default) (recursive), label 80, weight 1, 00:18:46
* via 10.1.0.1, eth1 (vrf default), label implicit-null/80, weight 1, 00:18:46
B>* 100.64.2.0/24 [20/0] via 10.1.0.9, eth2, weight 1, 00:19:00
MPLS table on PE2:
vagrant@pe2:~$ show mpls table
Inbound Label Type Nexthop Outbound Label
-----------------------------------------------
16 LDP 10.1.0.1 implicit-null
80 BGP blue -
So, as you can see, the next hop for the service label 80 is VRF blue.
The packets are arriving at PE2 with that correct label (see 80 in tcpdump capture above), but then they get lost somewhere.
Working ping from PE2 to CE2, just to make sure PE2 can reach CE2 on blue vrf:
vagrant@pe2:~$ ping 100.64.2.22 vrf blue count 2
PING 100.64.2.22 (100.64.2.22) 56(84) bytes of data.
64 bytes from 100.64.2.22: icmp_seq=1 ttl=64 time=0.756 ms
64 bytes from 100.64.2.22: icmp_seq=2 ttl=64 time=0.676 ms
--- 100.64.2.22 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1010ms
rtt min/avg/max/mdev = 0.676/0.716/0.756/0.040 ms
Not sure whether it’s a bug or a configuration issue (but the config looks fine to me)… Kindly asking for your help 
relevant PE2 config (symmetrical on PE1):
interfaces {
dummy dum0 {
address 10.0.0.12/32
}
ethernet eth0 {
address dhcp
description Out-Of-Band
hw-id 08:4f:a9:00:00:0c
vrf management
}
ethernet eth1 {
address 10.1.0.2/30
description "pe2 -> pe1"
hw-id 52:54:00:bf:4c:db
}
ethernet eth2 {
address 10.1.0.10/30
description "pe2 -> edge2 [external]"
hw-id 52:54:00:a1:b7:c3
vrf blue
}
loopback lo {
}
}
protocols {
bgp {
address-family {
ipv4-unicast {
network 10.0.0.12/32 {
}
}
}
local-as 65000
neighbor 10.0.0.11 {
address-family {
ipv4-unicast {
nexthop-self {
}
}
ipv4-vpn {
nexthop-self {
}
}
}
description pe1
remote-as 65000
update-source dum0
}
parameters {
router-id 10.0.0.12
}
}
mpls {
interface dum0
interface eth1
ldp {
discovery {
transport-ipv4-address 10.0.0.12
}
interface dum0
interface eth1
router-id 10.0.0.12
}
}
ospf {
interface dum0 {
area 0.0.0.0
passive {
}
}
interface eth1 {
area 0.0.0.0
network point-to-point
}
parameters {
router-id 10.0.0.12
}
}
}
vrf {
name blue {
protocols {
bgp {
address-family {
ipv4-unicast {
export {
vpn
}
import {
vpn
}
label {
vpn {
export auto
}
}
rd {
vpn {
export 65000:1
}
}
redistribute {
connected {
}
}
route-target {
vpn {
export 65000:1
import 65000:1
}
}
}
}
local-as 65000
neighbor 10.1.0.9 {
address-family {
ipv4-unicast {
nexthop-self {
}
}
}
description edge2
remote-as 65102
}
}
}
table 100
}
name management {
table 65530
}
}
thanks!
Stefano
