Description

Firewall logging does not work for ICMP packets with terminating action 'accept'. It does work for the firewall filter action 'discard' or 'reject'.

Symptoms

If a firewall filter is configured to accept and log ICMP traffic, accept works fine. However, the packets do not get logged for the accepted ICMP traffic:

[Device 1] ge-0/0/1 --------------- ge-0/0/1 [Device 2]

Device 1: 
ge-0/0/1: 10.0.0.1

Device 2:
ge-0/0/1: 10.0.0.2

{master:0}[edit]
root@device1# show firewall family inet filter TEST| display set
set firewall family inet filter TEST term t1 from protocol icmp
set firewall family inet filter TEST term t1 then count ICMP
set firewall family inet filter TEST term t1 then log <<----- All the terms are being logged with action as accept
set firewall family inet filter TEST term t1 then accept
set firewall family inet filter TEST term t2 from protocol tcp
set firewall family inet filter TEST term t2 from destination-port 22
set firewall family inet filter TEST term t2 then count SSH
set firewall family inet filter TEST term t2 then log <<-----
set firewall family inet filter TEST term t2 then accept
set firewall family inet filter TEST term t3 then count REST
set firewall family inet filter TEST term t3 then log <<-----
set firewall family inet filter TEST term t3 then accept

{master:0}[edit]
root@device1# run show firewall
Jun 12 17:02:07

Filter: TEST
Counters:
Name Bytes Packets
ICMP 20400 200 << Ping packets do increment in the counter but do not get logged
REST 5351 57
SSH 0 0

{master:0}[edit]
root@device1# run show firewall log | no-more
Jun 12 17:02:10


{master:0}[edit]
root@device1# show firewall family inet filter TEST| display set << Changed action accept to discard, we do see the packets being logged for term T1 and T2
Jun 12 17:03:26
set firewall family inet filter TEST term t1 from protocol icmp
set firewall family inet filter TEST term t1 then count ICMP
set firewall family inet filter TEST term t1 then log
set firewall family inet filter TEST term t1 then discard << --- DISCARD
set firewall family inet filter TEST term t2 from protocol tcp
set firewall family inet filter TEST term t2 from destination-port 22
set firewall family inet filter TEST term t2 then count SSH
set firewall family inet filter TEST term t2 then log
set firewall family inet filter TEST term t2 then discard << --- DISCARD
set firewall family inet filter TEST term t3 then count REST
set firewall family inet filter TEST term t3 then log
set firewall family inet filter TEST term t3 then accept << --- ACCEPT


{master:0}[edit]
root@device1# run show firewall
Jun 12 17:04:50

Filter: TEST
Counters:
Name    Bytes    Packets
ICMP    5304     52    << Packets with action discard are being logged
REST    1825     22
SSH     164      2 

{master:0}[edit]
root@device1# run show firewall log | no-more
Jun 12 17:04:56
Log :
Time     Filter Action Interface   Protocol  Src Addr  Dest Addr
17:04:46 pfe    D      ge-0/0/1.0  TCP       10.0.0.2  10.0.0.1 << Packets with action discard are being logged
17:04:43 pfe    D      ge-0/0/1.0  TCP       10.0.0.2  10.0.0.1
17:04:08 pfe    D      ge-0/0/1.0  ICMP      10.0.0.2  10.0.0.1 << Packets with action discard are being logged
17:04:08 pfe    D      ge-0/0/1.0  ICMP      10.0.0.2  10.0.0.1
17:04:08 pfe    D      ge-0/0/1.0  ICMP      10.0.0.2  10.0.0.1
17:04:07 pfe    D      ge-0/0/1.0  ICMP      10.0.0.2  10.0.0.1

Solution

This is expected behavior. For control packets, with accept action the actual packet is punted to the CPU with CPU code as ICMP. Logging also requires the packet to be sent to the CPU with CPU code as log. Since both cannot be done, only the ICMP CPU code is sent.

For a discard action, the original packet needs to be dropped, hence it is sent to the CPU with CPU code as LOG only and not ICMP as we do not want them to be processed further.

This is the expected behavior.