Description

I have firewall filter "protect-RE" that configured under lo0.

I added two new terms, after commit bfd + isis flapped.

Symptoms

May 13 12:02:30 JTAC bfdd[10713]: BFDD_STATE_UP_TO_DOWN: BFD Session 172.17.8.10 (IFL 1006) state Up -> Down LD/RD(19/19) Up time:20:21:19 Local diag: CtlExpire Remote diag: None Reason: Detect Timer Expiry.

May 13 12:02:30 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_DOWN: local discriminator: 19, new state: down, interface: et-0/0/3.0, peer addr: 172.17.8.10

May 13 12:02:30 JTAC bfdd[10713]: BFDD_STATE_UP_TO_DOWN: BFD Session 172.17.3.155 (IFL 1052) state Up -> Down LD/RD(18/5) Up time:20:36:37 Local diag: CtlExpire Remote diag: None Reason: Detect Timer Expiry.

May 13 12:02:30 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_DOWN: local discriminator: 18, new state: down, interface: et-0/0/7.0, peer addr: 172.17.3.155

May 13 12:02:30 JTAC rpd[12840]: RPD_ISIS_ADJDOWN: IS-IS lost L2 adjacency to PE-ACX7024-HFA-1 on et-0/0/3.0, reason: BFD Session Down

May 13 12:02:30 JTAC rpd[12840]: RPD_ISIS_ADJDOWN: IS-IS lost L2 adjacency to RR-7750SR1-HFA on et-0/0/7.0, reason: BFD Session Down

May 13 12:02:30 JTAC rpd[12840]: RPD_LDP_SESSIONDOWN: LDP session 172.31.8.9 is down, reason: received notification from peer

May 13 12:02:33 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_UP: local discriminator: 18, new state: up, interface: et-0/0/7.0, peer addr: 172.17.3.155

May 13 12:02:35 JTAC bfdd[10713]: BFDD_TRAP_SHOP_STATE_UP: local discriminator: 19, new state: up, interface: et-0/0/3.0, peer addr: 172.17.8.10

Solution

This issue is related to internal PR PR1866553, which do not have a fix.

https://prsearch.juniper.net/problemreport/PR1866553

 

Since ACX uses TCAM for the filters also, add/remove of tcam entries can affect the time sensitive protocols (Ex. Inline-BFD) mainly during the filter modify operation. Modify can be triggered indirectly also when prefix-lists used in filters are modified (say, 'apply-path' inheritance). Best practice is to keep the sensitive protocols to just above the last term which is usually to discard all.

 

Example:

From:

set firewall family inet filter PROTECT-RE term BFD from protocol udp

set firewall family inet filter PROTECT-RE term BFD from destination-port 3784

set firewall family inet filter PROTECT-RE term BFD then accept

.

.

set firewall family inet filter PROTECT-RE term DENY then count count-deny

set firewall family inet filter PROTECT-RE term DENY then discard

 

To:

.

set firewall family inet filter PROTECT-RE term BFD from protocol udp

set firewall family inet filter PROTECT-RE term BFD from destination-port 3784

set firewall family inet filter PROTECT-RE term BFD then accept

set firewall family inet filter PROTECT-RE term DENY then count count-deny

set firewall family inet filter PROTECT-RE term DENY then discard

 

The workaround suggested is not remove CLIs from terms, but move the BFD terms to end, just before default term in lo0 filter.

 

Also take car of below mentioned points:

We usually discourage 'destination-prefix-list' in lo0 filters, unless absolutely needed for fine tuning within the interface-ip's.

Because, having this will put more load on tcam when any changes are made, which directly or indirectly impacts filter.

Modification History

2025-07-07 : Article Created