When configuring a firewall family filter to match the precedence value, for example, of internet-control (6) and net-control (7) in the same term, packets do not match the correct term, and the action is not achieved. This is observed under all ACX evo.
(Working Example) Scenario 1: With matching only one precedence value, either (6 or 7) as an example, packets match the correct term and the action is achieved.
Example for Scenario 1: Configure firewall with only one precedence value to match (in this case internet-control (6))
set firewall family inet filter test-mpls-ping interface-specific
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control from precedence internet-control <<<<<<
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control from protocol udp
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control from source-port 8503
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control then count control-8503
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control then accept
set firewall family inet filter test-mpls-ping term else-8503 from protocol udp
set firewall family inet filter test-mpls-ping term else-8503 from source-port 8503
set firewall family inet filter test-mpls-ping term else-8503 then count else-8503
set firewall family inet filter test-mpls-ping term else-8503 then accept
set firewall family inet filter test-mpls-ping term else then count else
set firewall family inet filter test-mpls-ping term else then accept
Filter: test-mpls-ping-lo0.0-i
Counters:
Name Bytes Packets
control-8503-lo0.0-i 5000 50 <<<<<<< working
else-8503-lo0.0-i 0 0
else-lo0.0-i 0 0
---(refreshed at 2025-06-27 13:30:12 PDT)---
control-8503-lo0.0-i 9000 90 <<<<<<<
---(refreshed at 2025-06-27 13:30:14 PDT)---
(Non-Working Example) Scenario 2: When configuring a firewall family filter to match the precedence value, for example, of internet-control (6) and net-control (7) in the same term, packets do not match the correct term, and the action is not achieved.
Example for Scenario 2: Configure firewall with two precedence values to match in the same term (in this case internet-control (6) and net-control (7))
In this case, only the first precedence value will be matched. So, only internet-control (6) will be matched correctly, and net-control (7) will not be matched correctly.
set firewall family inet filter test-mpls-ping term accept-mpls-ping-control from precedence [internet-control net-control] <<<<<<<<<<<<
root@m06-28> show firewall filter test-mpls-ping-lo0.0-i
control-8503-lo0.0-i 73900 739
else-8503-lo0.0-i 73800 738 <<<<<<<<<<<<<< wrong count
Need to configure individual IPP matches in separate terms to be effective.
Example:
set firewall family inet filter test-mpls-ping term accept-mpls-ping-internet-control from precedence internet-control
set firewall family inet filter test-mpls-ping term accept-mpls-ping-net-control from precedence net-control