Description

When next-ip is defined as the action and there is no ARP (Address Resolution Protocol) for the IP address specified under next-ip, the traffic is not forwarded. A manual ping needs to be initiated for things to work.

Symptoms

Example topology

alt

FBF has been applied as input direction on interface ge-1/0/0 of router R2. 

user@R2# show firewall 
filter fbf {
    term 1 {
        from {
            source-address {
                15.16.1.1/32;
            }
        }
        then {
            next-ip 15.16.4.2/32;
        }
    }
    term 2 {
        then accept;
    }
}

user@R2# show interfaces ge-1/0/0 
unit 0 {
    family inet {
        filter {
            input fbf;
        }
        address 15.16.1.2/30;
    }
}

Then start ping from R1.
All packets are dropped due to "Destination Net Unreachable": 

user@R1# show routing-options static          
route 8.1.1.0/24 next-hop 15.16.1.2;     

user@R1# run ping 8.1.1.1 count 2 
PING 8.1.1.1 (8.1.1.1): 56 data bytes
36 bytes from 2.2.2.2: Destination Net Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 f084   0 0000  3f  01 7212 15.16.1.1  8.1.1.1 

36 bytes from 2.2.2.2: Destination Net Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 fa31   0 0000  3f  01 6865 15.16.1.1  8.1.1.1 

^C
--- 8.1.1.1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss

When these packets arrive in R2, they are dropped because there is no ARP entry of 15.16.4.2 and these packets cannot trigger the ARP process.

Solution

The next-ip feature works as designed from day one.

Take one of following actions to avoid this issue:
  1. Add a static route of "next-ip" with next-hop to itself, for example:

    user@R2# set routing-options static route 15.16.4.2/32 next-hop 15.16.4.2

  • Add a static ARP entry of "next-ip" in FBF filter.

    user@R2# set interfaces ge-1/0/1.0 family inet address 15.16.4.1/30 arp 15.16.4.2 mac xx:xx:xx:xx:xx:xx

Related Information