Article Detail

Description

This article describes the issue of the firewall filter (on MX series ICHIP based FPC) marking packets, which are not forwarded, as Discard (D) ; even though they were configured with the Accept (A) action.

Symptoms

On the ICHIP based FPC, when the firewall log is enabled, some packets that are dropped by the router, apart from the specified firewall action, might be logged as Discard (D) ; even though the firewall term explicitly accepts the packet.

In the following example, the ae6.100 and xe-3/2/0.100 interfaces are part of the same bridge and irb.100 is the routing interface of this bridge domain. The TEST firewall filter is applied in the inbound direction on irb.100 . The filter's ACCEPT term has accept and log actions for packets, which are coming in with 172.16.10.10 as the source IP and destined to the 192.168.10.0/24 network.

Traffic is flowing from IXIA_2 to IXIA_1 . The source is always 172.16.10.10/32 . The destination varies- 192.168.10.20 ... 29 . On IXIA_1 , only 192.168.10.24 ... 29 is active; so R1 successfully resolved the ARP and the packet itself is accepted by the firewall action. The firewall filter marks them as Accept (A) , as they were accepted by the firewall filter and the packets are forwarded to the destination.

However, the 192.168.10.20 , 192.168.10.21 , 192.168.10.22 , and 192.168.10.23 destination IP addresses are not active on IXIA_1 ; so the related packets pass the Accept (A) firewall action, but their respective ARP resolution fails. So, the router has to drop the traffic due to Host Unreachable . When the related packets are dropped, they are logged as Discard (D) .

The topology and related configurations are as follows:

      +--------+                         +--------+
         |        |                         |        |
         | IXIA_1 |                         | IXIA_2 |
         |        |                         |        |
         +--------+                         +--------+
             |                                  |
             |                                  |
             |                                  |
             |                                  |
             |                                  |
             |                                  |
             |                                  |
             |                                  |
    xe-3/2/0 |                                  | xe-0/0/0
         +--------+                         +--------+
         |        |-------------------------|        |
         |   R1   |   		AE6	    |   R2   |
         |        |-------------------------|        |
         +--------+                         +--------+


    irb.100
    IP        192.168.10.3
    VRRP VIP  192.168.10.1

	
[edit]
lab@R1-re1# show interfaces ae6 
description Connection_to_R2;
flexible-vlan-tagging;
mtu 9114;
encapsulation flexible-ethernet-services;
aggregated-ether-options {
    link-speed 10g;
}
unit 100 {
    encapsulation vlan-bridge;
    vlan-id 100;
}


[edit]
lab@R1-re1# show bridge-domains 
BD-TEST {
    vlan-id 100;
    interface ae6.100;
    interface xe-3/2/0.100;
    routing-interface irb.100;
}


[edit]
lab@R1-re1# show interfaces irb 
no-gratuitous-arp-reply;
no-gratuitous-arp-request;
unit 100 {
    proxy-arp;
    family inet {
        filter {
            input TEST;
        }
        address 192.168.10.3/24 {
            primary;
            preferred;
            vrrp-group 100 {
                virtual-address 192.168.10.1;
                priority 110;
            }
        }
    }
}


[edit]
lab@R1-re1# show firewall 
family inet {
    filter TEST {
        term ACCEPT {
            from {
                source-address {
                    172.16.10.10/32;
                }
                destination-address {
                    192.168.10.0/24;
                }
            }
            then {
                count ACCEPT;
                syslog;
                accept;
            }
        }
        term DENY {
            then {
                log;
                discard;
            }
        }
    }
}

May  9 16:59:57  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (513 packets) 
May  9 16:59:57  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (504 packets) 
May  9 16:59:57  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.24    63    63 (507 packets) 
May  9 16:59:57  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.25    63    63 (517 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (521 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (519 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (508 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (496 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.23    63    63 (510 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.21    63    63 (495 packets) 
May  9 16:59:58  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (495 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (552 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (551 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (540 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (512 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (510 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (471 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (473 packets) 
May  9 16:59:59  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (485 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (491 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.21    63    63 (489 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (491 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (492 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (520 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (516 packets) 
May  9 17:00:00  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (509 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.21    63    63 (498 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (491 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (513 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (500 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (479 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (496 packets) 
May  9 17:00:01  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (483 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.24    63    63 (481 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.25    63    63 (493 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (499 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (509 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (514 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (508 packets) 
May  9 17:00:02  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.24    63    63 (510 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.25    63    63 (496 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (480 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.21    63    63 (545 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (526 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (498 packets) 
May  9 17:00:03  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (502 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (496 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (486 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (515 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (504 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.24    63    63 (498 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.25    63    63 (485 packets) 
May  9 17:00:04  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.26    63    63 (496 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.27    63    63 (515 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.28    63    63 (531 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.29    63    63 (527 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.20    63    63 (514 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.21    63    63 (506 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.22    63    63 (528 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     D  udp 172.16.10.10 192.168.10.23    63    63 (517 packets) 
May  9 17:00:05  R1-re1 fpc3 PFE_FW_SYSLOG_IP: FW: irb.100     A  udp 172.16.10.10 192.168.10.24    63    63 (524 packets)


lab@R1-re1# run show arp no-resolve 
MAC Address       Address         Interface     Flags
02:00:00:00:00:04 10.0.0.4        em1.0               none
80:71:1f:c0:11:f0 192.168.10.2    ae6.100             none
00:00:e6:94:1a:11 192.168.10.24   xe-3/2/0.100        none
00:00:e6:94:1a:12 192.168.10.25   xe-3/2/0.100        none
00:00:e6:94:1a:13 192.168.10.26   xe-3/2/0.100        none
00:00:e6:94:1a:14 192.168.10.27   xe-3/2/0.100        none
00:00:e6:94:1a:15 192.168.10.28   xe-3/2/0.100        none
00:00:e6:94:1a:16 192.168.10.29   xe-3/2/0.100        none
02:00:00:00:00:04 128.0.0.4       em1.0               none

Solution

On the ICHIP based FPC, the firewall filter log is influenced by the final next hop resolution of the packet.
Packets are discarded by the firewall filter or the next hop resolution failures are logged by the firewall as Discard (D) .
Only packets that are accepted by the firewall action and next-hops that are properly resolved are marked as accept (A) .
An example of next hop resolution failure is failure to resolve the ARP.

This is working as per design. So, the behavior is expected and not a symptom of any issue.