Description

Using the "is-fragment" term for matching in a firewall term on 5K switches is not supported and may result in traffic blackholing. To check if the configuration is currently applied, review the configuration as outlined below.

 

qfx> show configuration firewall family inet6 filter protect_RE6 term icmp-frags 

from {

 ##

 ## Warning: statement ignored: unsupported platform (qfx5120-32c)

 ##

 is-fragment;

}

then {

  count ICMP-FRAGS;

 syslog;

 discard;

}

Solution

This is not a supported term and needs to be removed to prevent traffic from being black-holed.

Modification History

2025-09-05 : Article Created