Network instance route limits

In certain situations, you may want to limit the maximum number of IPv4 or IPv6 routes per network instance installed in the FIB. By default, routes that exceed the configured maximum are not installed. However, you can configure the system to allow the excess routes to be programmed and to record the route limit condition as a warning log event. In this case, the exceeding route remains active in state.

The route limit is determined based on the number of unique prefixes installed.

Protocol behavior when route limit is reached

When a protocol publishes an IPv4 or IPv6 route to the fib_mgr that exceeds the configured maximum route limit, fib_mgr suppresses the installation of that route. The system records the rejected routes and the exceeded limit in state at the following paths:

network-instance route-table [ipv4-unicast | ipv6-unicast] route id route-type route-owner origin-network-instance active = false

network-instance route-table [ipv4-unicast | ipv6-unicast] route id route-type route-owner origin-network-instance route-limit-exceeded = true

network-instance route-limit [ipv4 | ipv6] maximum-exceeded = true

Regardless of the source of the route, the system does not remove the failed FIB route from the route table. The route continues to appear as an entry in state under network-instance route-table [ipv4-unicast | ipv6-unicast] route. The fib_mgr does not retry the installation of suppressed routes. Each protocol must resubmit routes instead.

The behavior of the route source protocol is protocol-dependent and similar to a FIB programming failure, as described in the following sections.

BGP

When the route limit is reached, the behavior of BGP routes (including bgp, bgp-evpn, bgp-evpn-iff, bgp-evpn-ifl-host, bgp-ipvpn, bgp-label) is as follows:

  • In the BGP RIB-IN, the route is identified as used (because it is published to fib_mgr) but invalid. Under network-instance bgp-rib afi-safi <afi-safi> rib-in-out rib-in-post, the following state is displayed:
    • route used-route = true
    • route valid-route = false
    • route invalid-reason fib-programming-failed = true
  • If the route is already advertised in the RIB-OUT, the route is withdrawn. If BGP is waiting for FIB confirmation, it cancels the advertisement of the route in the RIB-OUT.
  • If the route is received again in the BGP RIB-IN (with or without modified path attributes), the system attempts to reprogram the route.

IGPs (including IS-IS, OSPFv2, and OSPFv3)

When an IS-IS or OSPF instance determines that one of its routes is rejected due to reaching the route-limit, the IGP instance immediately goes into overload state.

To clear the overload state, use the tools network-instance protocols [isis | ospf] instance overload clear command. This command triggers the IGP to perform an SPF recalculation and to resubmit all failed routes to the fib_mgr.

Static and aggregate routes

Static routes and aggregate routes that are rejected when the route limit is reached appear with the following state:

network-instance static-routes route installed = false

network-instance aggregate-routes route installed = false

To retry a static or aggregate route that has failed programming, toggle the route admin-state from disable to enable.

ARP-ND

For an IPv4 ARP or IPv6 ND host route that has failed FIB programming, the programming is retried whenever the IPv4 ARP or IPV6 neighbor entry is refreshed.

gRIBI

For gRIBI routes (except for gRIBI decapsulation pseudo-routes), the system reports the FIB programming status as FIB_FAILED.

Host, local, Linux

For host, local, and Linux routes (and gRIBI decapsulation pseudor-routes), programming never fails as a result of the route limit configuration.

Configuring network instance route limits

To configure network instance route limits for IPv4 and IPv6 families, use the route-limit command. The default value for each family is 0, which indicates no limit.

Configure network instance route limit for IPv4

--{ candidate shared default }--[  ]--
# info with-context network-instance default route-limit *
    network-instance default {
        route-limit ipv4 {
            maximum 100000
            warning-only true
            warning-threshold-percent 90
        }
        route-limit ipv6 {
            maximum 300000
            warning-only false
            warning-threshold-percent 85
        }
    }