When port-mirroring is applied on an interface, any transit traffic that enters the interface and which is to be denied by the firewall filter applied at the loopback interface will be displayed as accepted in the firewall logs.

R1(ge-1/1/8)----(ge-1/1/8)R2

R1(ge-1/1/8) has 10.1.1.1
R2(ge-1/1/8) has 10.1.1.2

On R1, the ' Protect-RE' filter on lo0 interface is configured as follows:

 filter Protect-RE{
        interface-specific;
        term 1 {
            from {
                source-address {
                    10.1.1.2/32;
                }
                destination-address {
                    10.1.1.1/32;
                }
                protocol icmp;
            }
            then {
                count icmp;
                syslog;
                discard;
            }
        }
        term 2 {
            then accept;
        }
    }
 

It is applied to the lo0 interface as follows:

unit 0 {
    family inet {
        filter {
            input Protect-RE;
        }
        address 127.0.0.1/32;
        address 10.10.10.10/32 {
            primary;
        }
    }
}

With the above configuration, when we ping 10.1.1.1 from R2, the ping fails and are logged as expected.

R1 tfeb0 PFE_FW_SYSLOG_IP: FW: ge-1/1/8.0   D icmp 10.1.1.2 10.1.1.1     8     0 (1 packets)
R1 last message repeated 4 times
R1 last message repeated 120 times

Configuring port-mirroring on the incoming interface, ge-1/1/8.0, with the following filters:

filter IN-mirror {

    interface-specific;

    term mirror {

        then {

            port-mirror;

            next term;

        }

    }

    term 2 {

        then accept;

    }

}

filter OUT-mirror {

    interface-specific;

    term mirror {

        then {

            port-mirror;

            next term;

        }

    }

    term 2 {

        then accept;

    }

}

 

lab@R1# show interfaces ge-1/1/8.0   

family inet {

    filter {

        input IN-mirror;

        output OUT-mirror;

    }

    address 10.1.1.1/30;

}

Then start to ping 10.1.1.1 from R2. The ping still drops but the logs show that it is being accepted as follows with 'show log firewall-log' :

R1 tfeb0 PFE_FW_SYSLOG_IP: FW: ge-1/1/8.0   A icmp 10.1.1.2 10.1.1.1     8     0 (1 packets)

R1 last message repeated 27 times

The above traffic is denied but shows as accepted in the syslog. The syslog level is as follows:

set system syslog file firewall-log firewall any

This is expected behavior. Due to the port-mirroring action on the physical reason, the punt reason for the traffic packet is Sample instead of Discard. When the loopback filter tries to syslog this packet, upon seeing the punt reason as 'Sample', it flags the packet as “Accepted” or “A” in the syslog. 

This behavior is not seen if there is no port-mirroring action on the incoming interface.