On QFX5130-48CM and QFX5130-32CD platforms running Junos OS Evolved, when VXLAN (Virtual Extensible LAN) is configured and an access interface is configured with MACsec (Media Access Control Security), the device does not send ARP (Address Resolution Protocol) replies for the IRB interface, resulting in failed host connectivity to the local gateway.



This issue might be seen if the following conditions are met:

* VXLAN configured

* IRB interface on QFX5130-48CM or QFX5130-32CD platforms running Junos OS Evolved

* Configure an access interface with MACsec enabled and generate Address Resolution Protocol (ARP) traffic from a directly connected host toward the local IRB interface.

On QFX5130-48CM and QFX5130-32CD platforms running Junos OS Evolved, when VXLAN is configured and an access interface is configured with MACsec, Address Resolution Protocol (ARP) requests from directly connected hosts reach the device successfully, but the corresponding ARP replies generated for the Integrated Routing and Bridging (IRB) interface are not transmitted back through the MACsec enabled interface. This occurs because Secure Vector Tag (SVTAG) information is not added to ARP reply packets generated by the control plane before they are forwarded to the packet processing pipeline. As a result, directly connected hosts fail to resolve the IRB MAC address dynamically. The issue affects only host-path traffic generated by the local control plane. Transit traffic and traffic destined to remote hosts are not affected. The issue can be identified when directly connected hosts are unable to learn the IRB MAC address dynamically while ARP requests are observed arriving on the device. Command "show interfaces terse | match irb" can be used to check the status of the IRB interface.

The issue is resolved in the following versions: evo:23.4X100-D20-EVO evo:24.4R1-EVO evo:25.1R1-EVO .