Description

When an inet firewall filter for L3 packets is created and applied to a routed VLAN interface (RVI), it affects L2 multicast traffics as well, even though IGMP snooping is disabled.  If the term to allow multicast addresses in the firewall filter is not added, all L2 multicast traffic passing through the same VLAN as the RVI is dropped. This article explains this behavior and shows how to add a multicast address to the firewall filter to fix the issue.

Symptoms

When an inet firewall filter for L3 packets is created and applied to a routed VLAN interface (RVI), it affects L2 multicast traffics as well, even though IGMP snooping is disabled. If the term to allow multicast address in firewall filter is not added, all L2 multicast traffic passing through the same VLAN as the RVI is dropped.

Sample Topology: 

  +-----------+     +-----------+
  |VRRP master|     |VRRP backup|
  +-----|-----+     +-----|-----+
        |                 |
        |                 |
        |  +-----------+  |
        +--|   EX4200  |--+
   ge-0/0/0+-----------+ge-0/0/1
     vlan10             vlan10

Using this topology, with the following configuration on EX4200, VRRP packets from VRRP primary are not forwarded to the VRRP backup. As a result, two VRRP masters will have the same virtual address in the segment. 

-----------------
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members v10
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members v10
set interfaces vlan unit 10 family inet filter input FF-test
set interfaces vlan unit 10 family inet address 10.1.1.1/24
set firewall family inet filter FF-test term 1 from destination-address 192.168.0.0/16
set firewall family inet filter FF-test term 1 then accept
set vlans v10 vlan-id 10
set vlans v10 l3-interface vlan.10
-----------------

Solution

On EX Series except for the EX9200, multicast traffic always hits an L3 firewall filter even though it does not need to be routed.

To allow VRRP multicast traffic as defined in the sample topology, add a multicast address to the firewall filter. 

-----------------
set firewall family inet filter FF-test term 2 from destination-address 224.0.0.18/32
set firewall family inet filter FF-test term 2 then accept
-----------------

Modification History

2020-05-20: Article reviewed for accuracy; no changes required. Article is correct and complete.