Hash rotation is not being done for the traffic coming from the Service Line card.

Customer is using SPC3 LC for NAT purpose.

Traffic path:

WAN -> ingress MPC -> Fabric -> SPC3 (NAT) -> Fabric -> egress MPC -> WAN

When one child interface is down in LAG.

Link:

et-0/0/2.0

Input : 5723118886 3638307 5479550366686 27929347880

Output: 7735737405 7283769 7415026984039 55904187272 <------

et-0/0/5.0

Input : 5794608848 3614839 5567928760081 27840720592

Output: 3774069526 122 3636377262243 73016 <------

et-1/1/0.0

Input : 5810367088 3609930 5576734506203 27085893760

Output: 3798012971 169 3623158658381 103760 <------

et-11/0/2.0 <-- down

Input : 3799935441 0 3638304404035 0

Output: 3746457091 0 3601402961512 0

et-11/0/5.0

Input : 5751433454 3546632 5513121053658 26768374656

Output: 7624460407 7039925 7302290214423 53331457328 <------

This behaviour is a known limitation on MX platforms when the symmetric hash knob is enabled. In such cases, the rotate-hash mechanism becomes ineffective due to the skip_rotate_hash bit being set in the master record. This has been behaviour since day one, as recently documented under PR-1906444.

>>> The following comment from the codebase explains the rationale:

When symmetric load balancing is desired, rotate-hash must be disabled to ensure consistent behavior across chassis.

If rotate-hash were applied on one chassis but not the other, it could lead to asymmetric forwarding decisions.

To maintain symmetry, rotate-hash is overridden in the master record when symmetric hashing is enabled. This is controlled by the g_symmetric_ehash knob, which is set/unset based on the CLI configuration.

Why rotate-hash is disabled with symmetric hashing:

Background:

When AE nexthops are programmed in JNH, the selector seed would be different on different chassis as it is a function of child ifls. This would result in different distribution of AE children on each chassis. When symmetric LB is desired, the seed is fixed to zero based on the g_symmetric_ehash knob.

forwarding-options {
    enhanced-hash-key {
        services-loadbalancing {
            family inet {
                layer-3-services {
                    source-address;
                }
            }
        }
        symmetric;              >>>>>>>>