[dns-operations] ECN & Juniper load balancing breaks TCP queries
Ben.O'Hara at team.neustar
Thu Aug 31 09:30:22 UTC 2017
We are using Juniper routers in-front of our anycast dns nodes in some locations.
Noticed if the client set the ECN flags in a TCP query the router sends the threeway handshake to one node, but the data to a second node which correctly sends a RESET.
Looks like it possibly could affect others using juniper in the same way for anycast.
Enable ECN, on linux
echo '1' > /proc/sys/net/ipv4/tcp_ecn
dig @nameserver zone +tcp
ie (random root server that looks to be affected)
dig @b.root-servers.net . soa +tcp
;; communications error to 2001:500:200::b#53: connection reset
We've got a bug raised with Juniper at the moment, looks pretty much identical to this, but were using M series and latest 15 code didn't fix.
Explicitly disabling ECN on the DNS nodes themselves, from the default of 2 on RHEL, (respond with ECN if client requests it) resolves the issues as they no longer nogotiate ECN and the data flows to the same node as the threeway handshake.
echo '0' > /proc/sys/net/ipv4/tcp_ecn
Anyone else seen this?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the dns-operations