I have firewall filter "protect-RE" that configured under lo0.
I added two new terms, after commit bfd + isis flapped.
May 13 12:02:30 JTAC bfdd[10713]: BFDD_STATE_UP_TO_DOWN: BFD Session 172.17.8.10 (IFL 1006) state Up -> Down LD/RD(19/19) Up time:20:21:19 Local diag: CtlExpire Remote diag: None Reason: Detect Timer Expiry.
May 13 12:02:30 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_DOWN: local discriminator: 19, new state: down, interface: et-0/0/3.0, peer addr: 172.17.8.10
May 13 12:02:30 JTAC bfdd[10713]: BFDD_STATE_UP_TO_DOWN: BFD Session 172.17.3.155 (IFL 1052) state Up -> Down LD/RD(18/5) Up time:20:36:37 Local diag: CtlExpire Remote diag: None Reason: Detect Timer Expiry.
May 13 12:02:30 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_DOWN: local discriminator: 18, new state: down, interface: et-0/0/7.0, peer addr: 172.17.3.155
May 13 12:02:30 JTAC rpd[12840]: RPD_ISIS_ADJDOWN: IS-IS lost L2 adjacency to PE-ACX7024-HFA-1 on et-0/0/3.0, reason: BFD Session Down
May 13 12:02:30 JTAC rpd[12840]: RPD_ISIS_ADJDOWN: IS-IS lost L2 adjacency to RR-7750SR1-HFA on et-0/0/7.0, reason: BFD Session Down
May 13 12:02:30 JTAC rpd[12840]: RPD_LDP_SESSIONDOWN: LDP session 172.31.8.9 is down, reason: received notification from peer
May 13 12:02:33 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_UP: local discriminator: 18, new state: up, interface: et-0/0/7.0, peer addr: 172.17.3.155
May 13 12:02:35 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_UP: local discriminator: 19, new state: up, interface: et-0/0/3.0, peer addr: 172.17.8.10
This issue is related to internal PR PR1866553, which do not have a fix.
https://prsearch.juniper.net/problemreport/PR1866553
Since ACX uses TCAM for the filters also, add/remove of tcam entries can affect the time sensitive protocols (Ex. Inline-BFD) mainly during the filter modify operation. Modify can be triggered indirectly also when prefix-lists used in filters are modified (say, 'apply-path' inheritance). Best practice is to keep the sensitive protocols to just above the last term which is usually to discard all.
Example:
From:
set firewall family inet filter PROTECT-RE term BFD from protocol udp
set firewall family inet filter PROTECT-RE term BFD from destination-port 3784
set firewall family inet filter PROTECT-RE term BFD then accept
.
set firewall family inet filter PROTECT-RE term DENY then count count-deny
set firewall family inet filter PROTECT-RE term DENY then discard
To:
The workaround suggested is not remove CLIs from terms, but move the BFD terms to end, just before default term in lo0 filter.
Also take car of below mentioned points:
We usually discourage 'destination-prefix-list' in lo0 filters, unless absolutely needed for fine tuning within the interface-ip's.
Because, having this will put more load on tcam when any changes are made, which directly or indirectly impacts filter.