Client-------DUT-EX4400-------Server
Client to Server traffic: Is not getting counting on term DHCPV6_CLIENT.
Server to Client traffic: Is properly getting counted on term DHCPV6_SERVER
Following terms (DHCPV6_SERVER and DHCPV6_CLIENT) to their existing PROTECT_RE_IPV6_FILTER
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER from source-prefix-list DHCPV6_NETS
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER from source-prefix-list ROUTING_INSTANCE_DHCPV6_NETS
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER from next-header udp
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER from destination-port 547
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER then count DHCPV6_SERVER
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER then accept
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT from source-address fe80::/10
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT from destination-address ff02::/123
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT from next-header udp
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT from source-port 546
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT from destination-port 547
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT then count DHCPV6_CLIENT
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT then accept
{master:0}
root@hla30wlwlwagc> show firewall
Filter: PROTECT_RE_IPV6_FILTER
Counters:
Name Bytes Packets
DHCPv6_CLIENT 0 0
DHCPv6_SERVER 446 2
DROP 288 4
Policers:
SMALL_BW_POLICER-ICMPV6 0 0
SMALL_BW_POLICER-TRACEROUTE 0 0
root@hla30wlwlwagc> show dhcpv6 relay statistics routing-instance L3_DAA_ACCESS_INSTANCE
Dhcpv6 Packets dropped:
Total 3
Bad Send 3
Messages received:
DHCPV6_DECLINE 0
DHCPV6_SOLICIT 4
DHCPV6_INFORMATION_REQUEST 0
DHCPV6_RELEASE 0
DHCPV6_REQUEST 1
DHCPV6_CONFIRM 0
DHCPV6_RENEW 0
DHCPV6_REBIND 0
DHCPV6_RELAY_FORW 0
DHCPV6_LEASEQUERY_REPLY 0
DHCPV6_LEASEQUERY_DATA 0
DHCPV6_LEASEQUERY_DONE 0
DHCPV6_ACTIVELEASEQUERY 0
Messages sent:
DHCPV6_ADVERTISE 1
DHCPV6_REPLY 1
DHCPV6_RECONFIGURE 0
DHCPV6_RELAY_REPLY 0
DHCPV6_LEASEQUERY 0
Packets forwarded:
Total 7
FWD REQUEST 5
FWD REPLY 2
root@hla30wlwlwagc> show configuration interfaces lo0
description "[TYPE=LOOPBACK][NAME=HLA30WLWLWAGC][FUNC=HLA][CLLI=WLWLWAGC][SITE=CHTR][AS=22513]";
unit 0 {
family inet6 {
filter {
input PROTECT_RE_IPV6_FILTER;
}
address 2602:107:431f::b9/128;
root@EX4400> show configuration | display set | match PROTECT_RE_IPV6_FILTER | match DHCP
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_SERVER then count DHCPv6_SERVER
set firewall family inet6 filter PROTECT_RE_IPV6_FILTER term DHCPV6_CLIENT then count DHCPv6_CLIENT
root@EX4400>
The Firewall counters were not incrementing for DHCPv6 from client to server.
IPv6 Loopback filter are not subjected to these Destination multicast IPv6 packets. Only Reserved multicast packets having IP ff:0X::XX are subjected to loopback filters.
This behaviour is similar to NS/ND packets which are also not subjected to IPv6 loopback firewall.
So this is expected behavior with respect to loopback filter.
These packets are expected to be consumed by the DHCP daemon.
Kindly use firewall on IRB as a Work-around