No Default VRF Route Fallback HLD #2067
Conversation
|
/azp run |
|
No pipelines are associated with this pull request. |
|
/azp run |
|
No pipelines are associated with this pull request. |
|
/azp run |
|
No pipelines are associated with this pull request. |
Default unreachable route, global fallback knob added
|
/azp run |
|
No pipelines are associated with this pull request. |
|
/azp run |
|
No pipelines are associated with this pull request. |
|
|
||
| ## 2. Scope | ||
|
|
||
| This high-level design document covers the implementation of a configurable mechanism to disable VRF (Virtual Routing and Forwarding) route fallback behavior in SONiC. The scope includes: |
There was a problem hiding this comment.
Please include some explicit wording to clarify that the HLD covers only the Kernel routes and software forwarding.
| In prior SONiC releases, Linux kernel allowed VRF lookup fallback if a route was missing in a non-default VRF, which could cause divergence from ASIC behavior and security/operational risks. | ||
|
|
||
| **This design ensures:** | ||
| - By default, fallback is disabled both in kernel and ASIC by installing an unreachable default route in every new non-default VRF. |
There was a problem hiding this comment.
I thought that unreachable route installed by the proposed implementation doesn't get propogated to ASIC DB, so this design doesn't do anything specific to disable fallback in the ASIC.
There was a problem hiding this comment.
@ashutosh-agrawal the unreachable route is NOT propagated to ASIC DB. The feature makes the kernel behavior consistent with ASIC. will re-word accordingly.
|
|
||
| ### 7.2. Global Fallback Knob | ||
|
|
||
| - New global configuration (in CONFIG_DB and CLI): `KERNEL_VRF_FALLBACK` |
There was a problem hiding this comment.
IIRC, in the HLD review meeting, we agreed to implement only the CONFIG_DB mechanism and not the CLI.
| ### 9.3. Backward Compatibility | ||
|
|
||
| - Default (knob unset): fallback disabled, matches ASIC. | ||
| - Knob enabled: fallback restored (legacy only). |
There was a problem hiding this comment.
Please change to "fallback restored in the kernel forwarding path only"
|
I've submitted a similar PR before. Here's just a link for reference: sonic-net/sonic-swss#2943 |
7 participants
This document provides a high level design of VRF fallback disable feature that disallows VRF lookups falling back to default VRF and other non default VRF when the route lookup fails in the intended VRF.