This article explains an issue observed on Juniper SRX2300 and SRX1600 platforms where traffic drops or complete outages may occur when the device is configured with global-mode switching.

The issue is triggered under specific circumstances when the firewall receives IGMP or PIM packets on an interface. This results in a memory buffer (mbuf) leak within the Packet Forwarding Engine (PFE), eventually leading to resource exhaustion and traffic impact.

The issue is encountered when all of the following conditions are met:

• Global mode is set to switching
• The device receives IGMP or PIM packets on an interface
• Multicast traffic is not handled or filtered before reaching the interface

Impact:

• Intermittent traffic drops
• Complete traffic outage over time
• Forwarding degradation as mbuf resources are depleted

The mbuf leak can be identified using the following command: (The I/O Socket 0 pool free_count continuously decreases over time, indicating an mbuf leak.)

root@device> request pfe execute command "show mbuf counters" target fpc0              

================ tnp_0x10000080 ================

SENT: Ukern command: show mbuf counters

Mbuf Pool Counters:

         Name          total_count  enq_count   deq_count   free_count  err_count  err_mtag

      -----------------       ---------   ---------   ----------   ---------   ------- --------

      Flow shared 1K packet pool    18432 3877829753  3877826511      2655      0     0

      Flow shared 2K packet pool   737280 2205918621  2205231970     686651      0     0

      Flow shared 16K packet pool    6144    6144       0      6144      0     0

      Flow shared 64K packet pool     128     128       0      128      0     0

          RT to RT event pool    2048 1661155318  1661153270      2048      0     0

         PFE to RT event pool    6144 2252537535  2252531391      6144      0     0

  Flow shared 1K Socket 1 packet pool      0      0       0       0      0     0

  Flow shared 2K Socket 1 packet pool      0      0       0       0      0     0

 Flow shared 16K Socket 1 packet pool      0      0       0       0      0     0

 Flow shared 64K Socket 1 packet pool      0      0       0       0      0     0

     RT to RT Socket 1 event pool      0      0       0       0      0     0

     PFE to RT Socket 1 event pool      0      0       0       0      0     0

           I/O Socket 0 pool   131072      0       0      470      0     0 <<<<<<<<<<<<<<<

           I/O Socket 1 Pool      0      0       0       0      0     0

Exponential Increase in rx_mbuf_allocation_errors

root@device> request pfe execute command "show nic queue-stats port 0" target fpc0 | match mbuf   

Mar 31 18:18:48

rx_mbuf_allocation_errors: 6530004468352

root@device> request pfe execute command "show nic queue-stats port 0" target fpc0 | match mbuf   

Mar 31 18:18:56

rx_mbuf_allocation_errors: 6540755046336

root@device> request pfe execute command "show nic queue-stats port 0" target fpc0 | match mbuf   

Mar 31 18:19:09

rx_mbuf_allocation_errors: 6557450024960

When global-mode is set to switching, the receipt of IGMP or PIM packets causes an mbuf leak in the PFE. Over time, this depletes the I/O Socket 0 mbuf pool, resulting in packet drops and potential outages.

Workarounds

Option 1: Block IGMP / PIM Traffic (Recommended if Multicast Is Not Required)

If IGMP or PIM is not in use, block the traffic so that it does not reach the interface:

Apply a firewall filter at the interface level

Drop IGMP (protocol 2) and PIM (protocol 103) packets

This prevents the trigger condition and avoids the mbuf leak.

Option 2: Remove Global Mode and use interface as L3.

Engineering is investigating the issue and permanent fix to be released soon. Please contact JTAC for more information.  

This issue is being tracked under PR1927896