<div dir="auto"><div>Glad you solved it.</div><div dir="auto"><br></div><div dir="auto">Unfortunately the aforementioned policy exceptions to allow MAC spoofing are necessary if you want to run a protocol whose core function is built around MAC spoofing ;-)</div><div dir="auto"><br></div><div dir="auto">Good reminder to document it.</div><div dir="auto"><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Fri, Jul 10, 2020, 3:44 PM Oliver O'Boyle <<a href="mailto:oliver.oboyle@gmail.com" target="_blank" rel="noreferrer">oliver.oboyle@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I believe I have resolved this issue for my particular environment,<br>
which is running on a pre vsphere 6.7 environment.<br>
<br>
It appears that Promiscuous mode, Mac Address Changes, and Forged<br>
Transmits needs to be set to Accept as Policy Exceptions on the<br>
virtual port group or above on the vsphere host.<br>
<br>
A related issue is being tracked here:<br>
<a href="https://github.com/FRRouting/frr/issues/5386" rel="noreferrer noreferrer noreferrer" target="_blank">https://github.com/FRRouting/frr/issues/5386</a><br>
<br>
I will agree with them that these policy exceptions reduce security on<br>
the host/network.<br>
<br>
I have yet to completely test this setup now but i'm receiving<br>
consistent echo replies from the VRRP addresses now. No more drops.<br>
<br>
Oliver<br>
<br>
On Fri, 10 Jul 2020 at 14:23, Oliver O'Boyle <<a href="mailto:oliver.oboyle@gmail.com" rel="noreferrer noreferrer" target="_blank">oliver.oboyle@gmail.com</a>> wrote:<br>
><br>
> So the router is returning BOTH macs in the ARP reply. Is that expected?<br>
><br>
> 18:20:52.325688 ARP, Reply lab-migw is-at 00:50:56:bd:d5:0f (oui<br>
> Unknown), length 28<br>
> 18:20:52.325777 ARP, Reply lab-migw is-at 00:00:5e:00:01:01 (oui<br>
> IANA), length 28<br>
><br>
> Oliver<br>
><br>
> On Fri, 10 Jul 2020 at 12:13, Oliver O'Boyle <<a href="mailto:oliver.oboyle@gmail.com" rel="noreferrer noreferrer" target="_blank">oliver.oboyle@gmail.com</a>> wrote:<br>
> ><br>
> > Hi,<br>
> ><br>
> > So I'm running into some issues with this setup. The configuration<br>
> > applies without any issue and I get my macvlan interfaces etc... . A<br>
> > 'show vrrp' in vtysh provides 100% good results.<br>
> ><br>
> > But the devices on the segment where I configured the vrrp address get<br>
> > mixed results. Some see the virtual macs assigned to the macvlan<br>
> > devices and some see the mac assigned to the parent vlan2049<br>
> > interface, even after flushing arp tables etc.... Pings to the macvlan<br>
> > vrrp IP from devices that do see the virtual mac mostly don't get a<br>
> > response, though one occasionally does come through. Pings to the vrrp<br>
> > IP from devices that don't see the virtual mac are, predictably, not<br>
> > getting any response at all.<br>
> ><br>
> > Device example 1 - cumulus switch eth0 port - DOES NOT see the virtual<br>
> > mac of the router's vrrp macvlan:<br>
> ><br>
> > ? (192.168.145.193) at 00:50:56:bd:d5:0f [ether] on eth0<br>
> ><br>
> > Device example 2 - windows vm - DOES see the virtual mac of the<br>
> > router's vrrp macvlan:<br>
> ><br>
> > 192.168.145.193 00:00:5e:00:01:01 dynamic<br>
> ><br>
> > Am I missing something important or is there a bug somewhere?<br>
> ><br>
> > Oliver<br>
> ><br>
> ><br>
> > On Tue, 7 Jul 2020 at 20:22, Oliver O'Boyle <<a href="mailto:oliver.oboyle@gmail.com" rel="noreferrer noreferrer" target="_blank">oliver.oboyle@gmail.com</a>> wrote:<br>
> > ><br>
> > > Not really, no. This was simple enough and I prefer to keep as close to netplan as possible as I suspect macvlan will eventually be supported.<br>
> > ><br>
> > > I could be swayed with the right argument, I suppose...<br>
> > ><br>
> > > O.<br>
> > ><br>
> > > On July 7, 2020, at 4:19 PM, Chriztoffer Hansen <<a href="mailto:ch@ntrv.dk" rel="noreferrer noreferrer" target="_blank">ch@ntrv.dk</a>> wrote:<br>
> > ><br>
> > > Dear Oliver,<br>
> > ><br>
> > > On Tue, 7 Jul 2020 at 22:04, Oliver O'Boyle <<a href="mailto:oliver.oboyle@gmail.com" rel="noreferrer noreferrer" target="_blank">oliver.oboyle@gmail.com</a>> wrote:<br>
> > > > To close the loop:<br>
> > > ><br>
> > > > I ended up going down the /etc/networkd-dispatcher route. I put:<br>
> > > ><br>
> > > > [ -e /etc/network/if-up.d ] && /bin/run-parts /etc/network/if-up.d<br>
> > > > exit 0<br>
> > > ><br>
> > > > into a script in that directory, then:<br>
> > > ><br>
> > > > if ip link show vlan2049 | grep -sq 'state UP'; then<br>
> > > > ip link add vlan2049-4 link vlan2049 addrgenmode random type<br>
> > > > macvlan mode bridge<br>
> > > > ip link set dev vlan2049-4 address 00:00:5e:00:01:01<br>
> > > > ip addr add <a href="http://192.168.145.194/26" rel="noreferrer noreferrer noreferrer" target="_blank">192.168.145.194/26</a> dev vlan2049-4<br>
> > > > ip link set dev vlan2049-4 up<br>
> > > ><br>
> > > > ip link add vlan2049-6 link vlan2049 addrgenmode random type<br>
> > > > macvlan mode bridge<br>
> > > > ip link set dev vlan2049-6 address 00:00:5e:00:02:01<br>
> > > > ip addr add 2610:139:c001:3f:1801:f20a::5/64 dev vlan2049-6<br>
> > > > ip link set dev vlan2049-6 up<br>
> > > > fi<br>
> > > > exit 0<br>
> > > ><br>
> > > > into /etc/network/if-ip.d/<br>
> > > ><br>
> > > > I figured this would allow someone not familiar with the workaround to<br>
> > > > perhaps more easily figure out what was happening.<br>
> > > ><br>
> > > > It works well enough, but it's ugly AF... I'll probably make it a bit<br>
> > > > smarter now, but it works.<br>
> > ><br>
> > > You never considered going down the system-networkd route?<br>
> > ><br>
> > > --<br>
> > ><br>
> > > Cheers,<br>
> > > CHRIZTOFFER<br>
> > ><br>
> > > _______________________________________________<br>
> > > frog mailing list<br>
> > > <a href="mailto:frog@lists.frrouting.org" rel="noreferrer noreferrer" target="_blank">frog@lists.frrouting.org</a><br>
> > > <a href="https://lists.frrouting.org/listinfo/frog" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.frrouting.org/listinfo/frog</a><br>
> ><br>
> ><br>
> ><br>
> > --<br>
> > :o@><br>
><br>
><br>
><br>
> --<br>
> :o@><br>
<br>
<br>
<br>
-- <br>
:o@><br>
<br>
_______________________________________________<br>
frog mailing list<br>
<a href="mailto:frog@lists.frrouting.org" rel="noreferrer noreferrer" target="_blank">frog@lists.frrouting.org</a><br>
<a href="https://lists.frrouting.org/listinfo/frog" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.frrouting.org/listinfo/frog</a><br>
</blockquote></div></div></div>