Description

This article explains the behavior that MPLS label is not matching label correctly on egress direction.


Symptoms

In the topology below, MPLS filter is configured on R1 egress and R2 ingress/egress to match the label value.

 

CE1 --- R1(PE) --- R2(P) --- R3(P) --- R4(PE) --- CE2

set logical-systems R1 interfaces lt-6/0/0 unit 12 family mpls filter output LABEL-COUNT
set logical-systems R1 firewall family mpls filter LABEL-COUNT term 1 from label 17
set logical-systems R1 firewall family mpls filter LABEL-COUNT term 1 then count COUNT
set logical-systems R1 firewall family mpls filter LABEL-COUNT term 2 then count Others
set logical-systems R1 firewall family mpls filter LABEL-COUNT term 2 then accept

set logical-systems R2 interfaces lt-6/0/0 unit 21 family mpls filter input LABEL-COUNT-IN
set logical-systems R2 interfaces lt-6/0/0 unit 23 family mpls filter output LABEL-COUNT-OUT
set logical-systems R2 firewall family mpls filter LABEL-COUNT-IN term 1 from label 17
set logical-systems R2 firewall family mpls filter LABEL-COUNT-IN term 1 then count COUNT
set logical-systems R2 firewall family mpls filter LABEL-COUNT-IN term 2 then count Others
set logical-systems R2 firewall family mpls filter LABEL-COUNT-IN term 2 then accept
set logical-systems R2 firewall family mpls filter LABEL-COUNT-OUT term 1 from label 16
set logical-systems R2 firewall family mpls filter LABEL-COUNT-OUT term 1 then count COUNT
set logical-systems R2 firewall family mpls filter LABEL-COUNT-OUT term 2 then count Others
set logical-systems R2 firewall family mpls filter LABEL-COUNT-OUT term 2 then accept

set logical-systems R3 firewall family mpls filter LABEL-COUNT-IN term 1 from label 16
set logical-systems R3 firewall family mpls filter LABEL-COUNT-IN term 1 then count COUNT
set logical-systems R3 firewall family mpls filter LABEL-COUNT-IN term 2 then count Others
set logical-systems R3 firewall family mpls filter LABEL-COUNT-IN term 2 then accept

 

Send 1 ICMP packet to check each filter counters.


lab@lab# run ping 200.0.0.1 source 100.0.0.1 logical-system CE1 count 1
PING 200.0.0.1 (200.0.0.1): 56 data bytes
64 bytes from 200.0.0.1: icmp_seq=0 ttl=60 time=3.310 ms

--- 200.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 3.310/3.310/3.310/0.000 ms


As shown below, label value is matched on ingress only, not for egress.



[edit]
lab@lab# run show firewall

Filter: __default_bpdu_filter__

Filter: __R1/LABEL-COUNT
Counters:
Name                                                                            Bytes              Packets
COUNT                                                                               0                    0
Others                                                                             84                    1

Filter: __R2/LABEL-COUNT-IN
Counters:
Name                                                                            Bytes              Packets
COUNT                                                                              88                    1  <----- matching label 17
Others                                                                              0                    0

Filter: __R2/LABEL-COUNT-OUT
Counters:
Name                                                                            Bytes              Packets
COUNT                                                                               0                    0
Others                                                                             88                    1

Filter: __R3/LABEL-COUNT-IN
Counters:
Name                                                                            Bytes              Packets
COUNT                                                                              88                    1  <----- matching label 16
Others                                                                              0                    0
Solution
It's expected and works-per-design.


Firewall match is based on key offset of predefined locations in the packet context. Packet context fields are overloaded for multiple purposes . So when packet ingresses, then it is parsed and labels and other fields are put in the predefined location of packet context. After ingress processing, once the label is swap/push/pop . the location becomes invalided and reused for other purposes. 
Modification History
2025-12-16 : Article Created


2026-05-11: Make it published as per request