In environments where the QFX5110 Virtual-Chassis is configured to function as a Layer 2 device, unexpected L3NHOP DDoS violation events have been observed.
Ideally, this traffic should be treated as transit traffic and should not be processed by the CPU. However, packets are being incorrectly punted to the Routing Engine (RE).
This behavior is caused by a mis-programming of VCP ports on the QFX5110, where the CML flag on the VCP port is improperly set to 0x8, enabling MAC learning on the VCP port, which is unintended. This leads to ifd_lookup_failed errors appearing in SALM statistics.
The correct and expected value for the CML flags on the VCP port is 0 (BCM_PORT_LEARN_FWD), which disables MAC learning on the VCP.
Unexpected L3NHOP DDoS violation events logged on QFX5110 devices operating as Layer 2 switches.
LAB OUTPUT EXAMPLE :
% vty fpc1
Switching platform (1800 Mhz Pentium processor, 639MB memory, 0KB flash)
FPC1(switch-VC vty)# set dcbcm diag
Boot flags: Probe NOT performed
Boot flags: Cold boot
Boot flags: initialization scripts NOT loaded
BCM.0>
BCM.0> ps hg
ena/ speed/ link auto STP lrn inter max loop
port link duplex scan neg? state pause discrd ops face frame back
hg0( 55) up 100G FD HW No Forward TX RX None FA CAUI 9416
BCM.0> d chg port 55
PORT.ipipe0[55]: <VT_PORT_TYPE_SELECT_2=1,VT_PORT_TYPE_SELECT=1,VT_KEY_TYPE_2=5,VT_KEY_TYPE=4,VLAN_PROTOCOL_DATA_INDEX=0x34,VFP_ENABLE=1,V6IPMC_ENABLE=1,V4IPMC_ENABLE=1,TRUST_INCOMING_VID=1,SUBNET_BASED_VID_ENABLE=1,RTAG7_PORT_PROFILE_INDEX=0x1cc,PRI_MAPPING=0xfac688,PORT_VID=1,PORT_TYPE=1,OVID=1,OUTER_TPID_ENABLE=1,MY_MODID=1,MAC_BASED_VID_ENABLE=1,IPRI_MAPPING=0xfac688,IPMC_DO_VLAN=1,ICFI_1_MAPPING=1,HIGIG2=1,HG_TYPE=8,FP_PORT_FIELD_SEL_INDEX=0x37,FILTER_ENABLE=1,DATA_4=0x00040000e6000000,DATA_3=0x000000000000001f58d10800,DATA_2=0x0000000000000000000686e0,DATA_1=0x00000000017d634444148001,DATA_0=0x51000100000100400700e001,CML_FLAGS_NEW=8,CML_FLAGS_MOVE=8,CFI_1_MAPPING=1,>
TEMPORARY WORKAROUND:
BCM.0> mod port 55 2 CML_FLAGS_NEW=0 CML_FLAGS_MOVE=0
SOLUTION:
Upgrade the QFX5110 Junos OS to a release that includes the fix PR1824725, which resolves the incorrect CML flag setting: