As Per the documentation, platform limitation on EX2300, ARP/NDP IPv6 broadcast and unicast traffic received on interfaces is punted to the kernel.

IPv6 Protect-RE is not blocking transit ICMPv6 Neighbor Solicitation transit traffic on a transit EX2300 switch.

Applying firewall filters to lo0 had no effect, and the associated firewall counters remain at zero, indicating that the filter is not being invoked.

13:14:17.141588 In IP6 truncated-ip6 - 22 bytes missing!2001:x:x:x::x > ff02::1:yyyy:2: ICMP6, neighbor solicitation[|icmp6]
13:14:19.144842 In IP6 truncated-ip6 - 22 bytes missing!2001:x:x:x::x > ff02::1:yyyy:2: ICMP6, neighbor solicitation[|icmp6]

Solution:

• Due to ex2300 device limitations, IPv6 transit traffic cannot be prevented from reaching the CPU. Additionally, such transit traffic will not be captured by loopback protect-RE despite this will be seen on ingress physical interface going towards CPU.
• Transit IPv6 ND packets are coming to RE due to ASIC port-based setting ND_PKT_TO_CPU, which will be set whenever an IRB configured on vlan where port belong.
• Though ND packet is coming on non-IRB vlan, due to ASIC limitation of being per port-based setting, we cannot avoid ND packet coming to CPU due to this.
• Loopback filter in ASIC cannot detect this kind of transit traffic copied by this setting.
• Engineering team confirmed below hidden knob will be enabled in 25.4R2.S2 it will be available in other even release.
• This hidden knob prevents transit IPv6 NDP/NS packets from being punted to the CPU (Routing Engine)

set switch-options no-arp-trap

Note: This knob comes with feature checks as well. For example if dhcp-security with arp / nd-inspection enabled then this knob cannot be configured. 

2026-08-01 : Article Created

2026-08-06 : Updated Symptoms, Symptoms and Description