On QFX5k devices, when egress router firewall filter (eRACL) is applied on one logical unit under one interface with Service provider style configuration, same filter gets programmed to other interfaces having the same vlan-id configure under logical unit in Service provider style. This is the expected behaviour.
Firewall filter is affecting interfaces it is not configured.
QFX5k device series have introduced a change through PR1472206 which makes more efficient use of TCAM to provide larger number of entries in firewall filters (access control lists). Given Junos code enhancements and respective change has an impact on egress router firewall filter (also known as eRACL) as follows: If a firewall filter is applied to egress direction on one logical unit under one interface with Service provider style configuration, same filter will be applied to other interfaces having the same vlan-id configured for logical unit in Service provider style. So it is expected behaviour per code after changes done through PR1472206.
In following example, we have a situation where eRACL filter is applied only to one member interface of VLAN 10. However, the same filter gets applied to all interfaces with VLAN 10.
Example:
Assume there is RACL named "TEST_Filter" configured under [edit firewall family inet filter] stanza.
This filter is then applied to egress on example logical unit "10" with vlan-id 10 under only one interface named "interface-1" with Service provider style configuration:
-----
[edit interfaces]
interface-1 {
vlan-tagging;
unit 10 {
vlan-id 10;
family inet {
filter {
output TEST_Filter; <==== eRACL Filter applied
}
Same filter might get progremmed to other interfaces named "interface-2" and "interface-3" having the same vlan-id "10" configure for logical unit in Service provider style:
interface-2 {
unit <unit-2> {
vlan-id 10; <==== no "TEST_Filter" eRACL Filter applied, yet it might get programmed
interface-3 {
unit <unit-3> {
https://prsearch.juniper.net/problemreport/PR1656960