[FROG] classic config has reachability issues

[Randy Bush]

Debian 12
FRR 10.4.1
BGP and IS-IS with VRRP, i.e. old skool isp style
                                                                     
when both routers are up, some LAN hosts are not reachable from WAN,
others are; no pattern i can see.  but all are reachable from within
LAN.

`systemctl stop frr.service` on r0, and everything is fine, i.e.
reachable from WAN (well, r0 isn't unless those gateways are
uncommented).

i suspect vrrp issues, but have no real basis to do so.  i have checked
the /25 netmask everywhere.

but i am sure i am doing something wrongly.  clue bat appreciated.

randy

---

             NTT                                   Cogent            
              |                                      |               
     +--------+--------+                    +--------+--------+      
     |                 |                    |                 |      
     |       r0        |                    |       r1        |      
     |                 |                    |                 |      
     +--------+--------+                    +--------+--------+      
              |                                      |               
           Primary                                Primary            
              &                                      &               
             VRRP                                   VRRP             
              |              LAN/25                  |               
    ----------+--------------------------------------+----------

`/etc/network/interfaces` look like

    auto lo
    iface lo inet loopback
    # IS-IS loopback for iBGP peering
    auto lo:0
    iface lo:0 inet static
	    address 192.168.254.10/32
    iface lo:0 inet6 static
	    address fc00::10/128
    # LAN
    auto eno1
    iface eno1 inet static
	    address 198.180.150.120/25
	    dns-nameservers 127.0.0.1 198.180.150.8
	    dns-search rg.net
    iface eno1 inet6 static
	    address 2001:418:8006::120/64
    iface eno1
	    vrrp 6 198.180.150.126/25 2001:418:8006::126/64
    # WAN
    auto eno4
    iface eno4 inet static
	    address 129.250.10.158/30
    #       gateway 129.250.10.157

    iface eno4 inet6 static
	    address 2001:418:8000:5000::1a/126
    #       gateway 2001:418:8000:5000::19

IS-IS and BGP converge happily

frr configs

    frr version 10.4.1
    frr defaults traditional
    hostname r0.iad.rg.net
    log syslog informational
    service password-encryption
    service integrated-vtysh-config
    !
    ip prefix-list export4 seq 5 permit 198.180.150.0/24
    !
    ipv6 prefix-list export6 seq 5 permit 2001:418:8006::/48
    !
    route-map accept-all permit 10
    exit
    !
    route-map deny-all deny 10
    exit
    !
    route-map transit-in4 permit 10
     set community 3927:2914
    exit
    !
    route-map transit-in6 permit 10
     set community 3927:386
    exit
    !
    route-map cust-in4 permit 10
     set community 3927:374
    exit
    !
    route-map cust-in6 permit 10
     set community 3927:376
    exit
    !
    route-map transit-out4 deny 10
     match ip address prefix-list export4
    exit
    !
    route-map transit-out4 permit 20
     match community comm-cust4
    exit
    !
    route-map transit-out6 deny 10
     match ipv6 address prefix-list export6
    exit
    !
    route-map transit-out6 permit 20
     match community comm-cust6
    exit
    !
    password 8 foo
    enable password 8 bar
    !
    interface eno1
     description RGnet LAN
     ip router isis p1
     ipv6 router isis p1
     isis circuit-type level-2-only
     vrrp 6 version 3
     vrrp 6 priority 90
     vrrp 6 ip 198.180.150.126
     vrrp 6 ipv6 2001:418:8006::126
    exit
    !
    interface eno4
     description NTT
     ip router isis p1
     ipv6 router isis p1
     isis circuit-type level-2-only
     isis passive
    exit
    !
    interface lo
     ip router isis p1
     ipv6 router isis p1
     isis circuit-type level-2-only
     isis passive
    exit
    !
    router bgp 3927
     bgp router-id 198.180.150.120
     no bgp default ipv4-unicast
     no bgp network import-check
     neighbor 129.250.10.157 remote-as 2914
     neighbor 129.250.10.157 password feen
     neighbor 192.168.254.11 remote-as 3927
     neighbor 192.168.254.11 password foon
     neighbor 192.168.254.11 update-source 192.168.254.10
     neighbor 2001:418:8000:5000::19 remote-as 2914
     neighbor 2001:418:8000:5000::19 password feen
     neighbor fc00::11 remote-as 3927
     neighbor fc00::11 password foon
     neighbor fc00::11 update-source fc00::10
     !
     address-family ipv4 unicast
      network 198.180.150.0/24
      neighbor 129.250.10.157 activate
      neighbor 129.250.10.157 route-map transit-in4 in
      neighbor 129.250.10.157 route-map transit-out4 out
      neighbor 192.168.254.11 activate
      neighbor 192.168.254.11 route-map accept-all in
      neighbor 192.168.254.11 route-map accept-all out
     exit-address-family
     !
     address-family ipv6 unicast
      network 2001:418:8006::/48
      neighbor 2001:418:8000:5000::19 activate
      neighbor 2001:418:8000:5000::19 route-map transit-in6 in
      neighbor 2001:418:8000:5000::19 route-map transit-out6 out
      neighbor fc00::11 activate
     exit-address-family
    exit
    !
    router isis p1
     net 47.0001.1921.6825.4010.00
    exit
    !
    bgp community-list standard comm-cust4 seq 5 permit 3927:374
    bgp community-list standard comm-cust6 seq 5 permit 3927:376
    bgp community-list standard comm-trans4 seq 5 permit 3927:384
    bgp community-list standard comm-trans6 seq 5 permit 3927:386
    !
    end

-30-