A firewall configuration was created to filter and count IGMP packets. However, the commit failed with the following error when attempting to apply it to the interface:
labroot@jtac-acx7024-r2022# commit check
[edit]
'interfaces'
name 'direction' is not defined
error: configuration check-out failed: (validation hook evaluation failed)
labroot@jtac-acx7024-r2022# run show version
Hostname: jtac-acx7024-r2022
Model: ACX7024
Junos: 24.2R2.16-EVO
Yocto: 4.0.20
Linux Kernel: 5.15.76-yocto-standard-juniper-02098-g28f34d35a895
JUNOS-EVO OS 64-bit [junos-evo-install-acx-f-x86-64-24.2R2.16-EVO]
[edit interfaces ae1001 unit 600 family ethernet-switching]
+ filter {
+ input IGMP;
+ }
+ firewall {
+ family ethernet-switching {
+ filter IGMP {
+ term 10 {
+ from {
+ ip-source-address {
+ 172.16.XX.XX/32;
+ ip-destination-address {
+ 224.0.0.1/32;
+ ip-protocol igmp;
+ then {
+ accept;
+ count IGMP_OUT;
+ term 20 {
+ then accept;
Juniper supports firewall filters in different flavors: interface-specific, physical-interface-specific, and global. However, the ACX7204 platform supports only interface-specific firewall filters. The issue was resolved by modifying the configuration accordingly. The changes (highlighted below) ensured compatibility with the platform's supported filter type.
labroot@jtac-acx7024-r2022# show | compare
+ interface-specific;
configuration check succeeds
...
labroot@jtac-acx7024-r2022> show firewall
Filter: IGMP-ae1001.600-i
Counters:
Name Bytes Packets
IGMP_OUT-ae1001.600-i 0 0