FRR marks BGP route as invalid due to allegedly "inaccessible" next-hop

[g00g1]

Simplified, I have the following FRR configuration:

router bgp 64512
 neighbor fe80::28f:cff:fe2b:5457 remote-as 65534
 neighbor fe80::28f:cff:fe2b:5457 interface 3543906233
 neighbor fe80::28f:cff:fe2b:5457 passive
 neighbor fe80::28f:cff:fe2b:5457 local-role provider
 neighbor fe80::28f:cff:fe2b:5457 update-source 3543906233
 neighbor fe80::28f:cff:fe2b:5457 capability extended-nexthop
 no neighbor fe80::28f:cff:fe2b:5457 capability fqdn
 !
 address-family ipv6 unicast
  redistribute kernel
  neighbor fe80::28f:cff:fe2b:5457 activate
  neighbor fe80::28f:cff:fe2b:5457 next-hop-self
  neighbor fe80::28f:cff:fe2b:5457 default-originate
  neighbor fe80::28f:cff:fe2b:5457 prefix-list pl-v6-generic-any in
  neighbor fe80::28f:cff:fe2b:5457 prefix-list pl-v6-generic-defroute out
  neighbor fe80::28f:cff:fe2b:5457 route-map rm-bgp-customer-in in
 exit-address-family
exit
!
route-map rm-bgp-customer-in permit 30
 match as-path al-cust-as65534
 set community 64512:3100 additive
 set local-preference 300
exit

BGP peer fe80::28f:cff:fe2b:5457 has global IPv6 address 2001:db8:fe00:5b::a that is routed to a next-hop fe80::28f:cff:fe2b:5457 via interface 3543906233, however FRR struggles to install route for received announcement of 2001:db8:ae16::/48:

# show bgp ipv6 2001:db8:ae16::/48
BGP routing table entry for 2001:db8:ae16::/48, version 0
Paths: (1 available, no best path)
  Not advertised to any peer
  65534
    2001:db8:fe00:5b::a (inaccessible, import-check enabled) from fe80::28f:cff:fe2b:5457 (x.x.x.x)
    (fe80::28f:cff:fe2b:5457) (used)
      Origin IGP, localpref 300, invalid, external
      Community: 64512:3100
      Last update: Mon Mar  3 13:17:01 2025

# show bgp nexthop detail
 2001:db8:fe00:5b::a overlay index unresolved [IGP metric 0], #paths 1
  Last update: Mon Mar  3 11:25:13 2025
  Paths:
    2/1 2001:db8:ae16::/48 flags 0x420
 fe80::28f:cff:fe2b:5457 valid [IGP metric 0], #paths 0, peer fe80::28f:cff:fe2b:5457
  Resolved prefix fe80::/64
  if 3951123873
  Last update: Mon Mar  3 11:54:30 2025
  Paths:

Is it expected behavior? Any suggestions how can I fix it?

[ton31337]

Which version?

[g00g1]

# sh version
FRRouting 10.2.1 (REDACTED) on Linux(5.14.0-427.22.1.el9_4.x86_64).
Copyright 1996-2005 Kunihiro Ishiguro, et al.
configured with:
    '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-static' '--disable-werror' '--enable-multipath=256' '--enable-vtysh' '--enable-ospfclient' '--enable-ospfapi' '--enable-rtadv' '--enable-ldpd' '--enable-pimd' '--enable-pim6d' '--enable-pbrd' '--enable-nhrpd' '--enable-eigrpd' '--enable-babeld' '--enable-vrrpd' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-fpm' '--enable-watchfrr' '--disable-bgp-vnc' '--enable-isisd' '--enable-rpki' '--enable-bfdd' '--enable-pathd' '--disable-grpc' '--enable-snmp' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig' 'CC=gcc' 'CXX=g++' 'LT_SYS_LIBRARY_PATH=/usr/lib64:'

[ton31337]

Could you enable debug bgp updates and show the logs? It should say why the route is marked as invalid.

[g00g1]

My bad, was looking to wrong SSH session, however debug logs still don't disclose much:

[XXWBM-V772F] fe80::28f:cff:fe2b:5457(Unknown) rcvd UPDATE w/ attr: , origin i, mp_nexthop 2001:db8:fe00:5b::a(fe80::28f:cff:fe2b:5457), path 65534
[YCKEM-GB33T] fe80::28f:cff:fe2b:5457(Unknown) rcvd 2001:db8:ae16::/48 IPv6 unicast
[M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv6 Unicast from fe80::28f:cff:fe2b:5457

[ton31337]

Could you also show:

show ipv6 bgp nexthop
show ipv6 nht

And then enable debug bgp nht additionally (+ logs).

[g00g1]

# show ipv6 bgp nexthop
% Unknown command: show ipv6 bgp nexthop
# show ipv6 nht
VRF default:
 Resolve via default: on
2001:db8:fe00:5b::a(Connected)
 unresolved(Connected)
 Client list: bgp(fd 33)
fe80::28f:cff:fe2b:5457(Connected)
 resolved via connected, prefix fe80::/64
 is directly connected, 3951123873 (vrf default), weight 1
 Client list: bgp(fd 33)

[ton31337]

Sorry, show bgp nexthop

[g00g1]

debug bgp nht:

[ZBY0C-GC5CK] bgp_unlink_nexthop_check: freeing bnc fe80::28f:cff:fe2b:5457/128(520)(0)(VRF default)
[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[W3X54-30BTE] Allocated bnc fe80::28f:cff:fe2b:5457/128(520)(0)(VRF default) peer 0x0
[M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv6 Unicast from fe80::28f:cff:fe2b:5457 in vrf default

It looks strange that ifindex is 0, in ip-link it is 520:

520: 3543906233: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN mode DEFAULT group default qlen 1000

# show bgp nexthop
Current BGP nexthop cache:
 2001:db8:fe00:5b::a overlay index unresolved [IGP metric 0], #paths 0
  Last update: Mon Mar  3 11:25:13 2025
 fe80::28f:cff:fe2b:5457 valid [IGP metric 0], #paths 0, peer fe80::28f:cff:fe2b:5457
  Resolved prefix fe80::/64
  if 3951123873
  Last update: Mon Mar  3 14:19:21 2025
 fe80::7007:46ff:fe25:4f48 valid [IGP metric 0], #paths 1
  Resolved prefix fe80::/64
  if 3951123873
  Last update: Sun Mar  2 00:13:00 2025
 fe80::28f:cff:fe2b:5457 overlay index unresolved [IGP metric 0], #paths 1
  Last update: Thu Oct 17 11:41:06 2024

[g00g1]

Another interesting observation:

# sh bgp ipv6 2001:db8:ae16::/48
BGP routing table entry for 2001:db8:ae16::/48, version 0
Paths: (1 available, no best path)
  Not advertised to any peer
  65534
    2001:db8:fe00:5b::a (inaccessible, import-check enabled) from fe80::28f:cff:fe2b:5457 (x.x.x.x)
    (fe80::28f:cff:fe2b:5457) (prefer-global)
      Origin IGP, localpref 300, invalid, external
      Community: 64512:3100
      Last update: Mon Mar  3 15:02:52 2025
# sh ipv6 route 2001:db8:fe00:5b::a
Routing entry for 2001:db8:fe00:5b::a/128
  Known via "kernel", distance 0, metric 1024, best
  Last update 02:48:13 ago
  * directly connected, 3543906233, weight 1

But debug bgp nht says:

[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[VWNP2-DNMFV] Found existing bnc fe80::28f:cff:fe2b:5457/128(0)(VRF default) flags 0xf ifindex 0 #paths 0 peer 0x562af6c82680, resolved prefix fe80::/64
[VWNP2-DNMFV] Found existing bnc 2001:db8:fe00:5b::a/128(0)(VRF default) flags 0x8e ifindex 0 #paths 0 peer 0x562a8aa398f0, resolved prefix UNK prefix
[M59KS-A3ZXZ] bgp_update_receive: rcvd End-of-RIB for IPv6 Unicast from fe80::28f:cff:fe2b:5457 in vrf default