Description:
PL: NE20E-X8A
Version: V800R009C10SPC200
Patch: V800R009C10SPH032
During the tests for this device we have noticed an issue with pinging the IP of a vpn-instance.
When pinging the main interface, the router starts to send ICMP reply messages to the client’s MAC address using the same IP as source and destination, his own IP address and with a TTL of 2.
Alarm:
ICMP reply with same source and destination as main router interface IP.
Handling:
1. Doing a capture of the packets of the main router interface.
2. After checking the captured traffic we noticed that this is a mechanism of NE device. If the interface is up and received the packets, then NE will start the link detection automatically, it sends the ICMP packets(source and destination IP is NE itself, TTL is 2), the remote side receives this packet and will send it back to NE since the destination IP is the sender.
3. After NE receives the ICMP packet, it will compare the packet, if the data has been modified or it is time-out, NE will consider the link is unstable or problematic.
Root cause:
Behavior is normal, it is a keepalive mechanism used by the NE router.
Solution:
We can disable it or ignore. To disable, here said-node 2 is for physical interface, 3 is for eht-trunk interface, use commands below:
[Huawei]set said-node 2 slot 1 disable
[Huawei]set said-node 3 slot 1 disable
Source: https://support.huawei.com/hedex/hdx.do?docid=EDOC1100109721&id=EN-US_CONCEPT_0172351393&lang=en
