This issue affects all Junos QFX5K platforms where the user-vlan-id match condition under the family ccc firewall filter hierarchy is incorrectly limited to a maximum of 255. VLAN IDs are expected to support values up to 4095, but values above 255 are rejected during configuration commit.
Example CLI commands to trigger the issue:
user@device#set firewall family ccc filter <filter> term <term> from user-vlan-id <256 to 4095>
user@device#set firewall family ccc filter <filter> term <term> then accept
This will result in the following commit error:
user@device#commit check
[edit firewall family ccc filter <filter> term <term> from user-vlan-id]
'<256 to 4095>'
create match failed: value/range <256 to 4095> exceeds field maximum 255
commit-check failed
error: configuration check-out failed
This issue might be seen if the following conditions are met:
* On all Junos QFX5K platforms running versions 22.2, 22.4, or 23.2
* A firewall filter is configured under family ccc
* A user-vlan-id value greater than 255 is specified
This behavior is tracked in https://prsearch.juniper.net/problemreport/PR1876904
which is resolved in the following JunOS
junos:22.2R3-S7 junos:22.4R3-S7 junos:23.2R2-S4 junos:24.4R2 junos:25.2R1
2025-07-21 : Article Created by dcole