This article describes the issue of being unable to filter BGP, ISIS, and BFD packets, which are destined to the CPU, by using the loopback filter on QFX3500.

• Firewall filters provide rules that define whether to permit or deny packets, which are transiting an interface on a switch.
• You can configure firewall filters to determine whether to permit or deny traffic before it enters or exits an interface, to which the firewall filter is applied.
• An input (or ingress) firewall filter is one that is applied to packets that are entering a network. An output (or egress) firewall filter is one that is applied to packets that are exiting a network.
• QFX-3500 has some dynamic/hardware filters to allow the control of traffic; such as BGP, ISIS, and BFD.
• The dynamic/hardware filters are not overwritten by any user defined loopback filters. So, there is no way to discard such packets.

•  Pre-installed internal hardware firewall filters on PFE, which allow BGP, ISIS, and BFD protocol packets, prevent any user defined firewall filter from taking action on such packets.
• So, these built-in filters override any user defined filters.

There are more than 70 such hardware filters, which target different protocols. The key protocols, for which traffic is allowed by dynamic or hardware filters (even though they may be explicitly blocked in the user defined loopback filters) are :

• ISIS (filter name: dyn-isis-pkts)

• BGP (filter name : dyn-bgp-pkts)

• BFD (filter name : dyn-bfd)

set firewall family inet filter block_re term t1 from protocol tcp
set firewall family inet filter block_re term t1 from destination-port bgp
set firewall family inet filter block_re term t1 then discard
set firewall family inet filter block_re term t2 from protocol tcp
set firewall family inet filter block_re term t2 from source-port bgp
set firewall family inet filter block_re term t2 then discard

set interfaces lo0 unit 0 family inet filter input block_re