This article explains why firewall counters do not work for aggregated Ethernet (aE) interfaces when the filter is applied on the ingress.

A firewall filter is created to accept traffic from an aggregated Ethernet interface (ae0.200, a vlan-tagging interface) and to count the traffic, but the counter does not increment.

This situation is shown in the example below.

set chassis aggregated-devices ethernet device-count 64 ==> Device count configuration for lag .

set interfaces ae0 vlan-tagging
set interfaces ae0 unit 200 vlan-id 200
set interfaces ae0 unit 200 family inet filter input test ==> Filter is applied on ae0.200 interface in ingress .
set interfaces ae0 unit 200 family inet address 10.0.0.1/24

set firewall family inet filter test term 1 from interface ae0.200
set firewall family inet filter test term 1 then count ae20
set firewall family inet filter test term 1 then accept
set firewall family inet filter test term else then accept

set interfaces ge-0/0/15 ether-options 802.3ad ae0
set interfaces ge-0/0/16 ether-options 802.3ad ae0

{master:0}[edit]
root@DHCP-RELAY# run show interfaces terse | match ae ==> aE is up .
ge-0/0/15.0 up up aenet --> ae0.0
ge-0/0/15.200 up up aenet --> ae0.200
ge-0/0/16.0 up up aenet --> ae0.0
ge-0/0/16.200 up up aenet --> ae0.200
ae0 up up
ae0.0 up up
ae0.200 up up inet 10.0.0.1/24

root@DHCP-RELAY# run show firewall

Filter: test
Counters:
Name Bytes Packets
ae20 0 0 ==> No counter increment.

Now, when the same configuration is applied on the child members of the link aggregation group (LAG), the counter increments.

{master:0}[edit]
root@DHCP-RELAY# delete firewall family inet filter test term 1 from interface ae0.200 ==> Deleted and reconfigured on child interfaces.
root@DHCP-RELAY# set firewall family inet filter test term 1 from interface ge-0/0/15.200
root@DHCP-RELAY# set firewall family inet filter test term 1 from interface ge-0/0/16.200

{master:0}[edit]
root@DHCP-RELAY# show firewall
family inet {
filter test {
term 1 {
from {
interface ge-0/0/15.200;
interface ge-0/0/16.200;
}
then {
count ae20;
accept;
}
}
term else {
then accept;
}
}
}

{master:0}[edit]
root@DHCP-RELAY# commit
configuration check succeeds
commit complete

{master:0}[edit]
root@DHCP-RELAY# run show firewall

Filter: test
Counters:
Name Bytes Packets
ae20 6197672 4140 ==> Counter is incrementing.
 

Note: This is a limitation on EX devices.

Apply the filter on the child interfaces of the aggregated Ethernet (aE) bundle so that the counters increment on the firewall filter.

2020-03-30: Article verified for accuracy, its valid and accurate.

• Firewall Filters for EX Series Switches Overview