Firewall filter does not get applied to L2 port in EX4300 platform when implementing Dynamic Firewall Filter based on Radius Attributes.
This behavior is expected. Please refer to the documentation on Understanding Dynamic Filters Based on RADIUS Attributes.
Example topology:
Supplicant <--> ge-0/0/0 EX4300 ge-0/0/1 ------ Network Resources | Radius Server
While the configuration seems to get applied on the dot1x authenticated port, the policer attached to the firewall filter does not seem to function.
The following excerpt show the configurations to get dynamic filter named "high_bw_policer" through dot1x authentication.
[master:0]
root@SWITCH> show configuration interfaces | display set
set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan200
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan200
set interfaces irb unit 200 family inet address 192.168.200.1/24
root@SWITCH> show configuration access | display set
set access radius-server 192.168.209.59 secret “$ABC123"
set access radius-server 192.168.209.59 source-address 192.168.200.1
set access profile CWA-Test-Profile authentication-order radius
set access profile CWA-Test-Profile radius authentication-server 192.168.209.59
set access profile CWA-Test-Profile radius options nas-identifier 192.168.152.187
root@SWITCH> show configuration firewall | display set
set firewall family ethernet-switching filter high_bandwidth interface-specific
set firewall family ethernet-switching filter high_bandwidth term allow_all from ip-source-address 192.168.200.0/24
set firewall family ethernet-switching filter high_bandwidth term allow_all then policer high_bw_policer
set firewall policer high_bw_policer if-exceeding bandwidth-limit 10m
set firewall policer high_bw_policer if-exceeding burst-size-limit 2k
set firewall policer high_bw_policer then discard
However, even when the supplicant is authenticated, and the CLI output shows the dynamic filter is applied to the right ge-0/0/0, the filter does not work as expected:
root@SWITCH> show dot1x interface detail
ge-0/0/0.0
Role: Authenticator
Administrative state: Auto
Supplicant mode: Multiple
Number of retries: 3
Quiet period: 60 seconds
Transmit period: 30 seconds
Mac Radius: Enabled
Mac Radius Restrict: Enabled
Mac Radius Authentication Protocol: EAP-MD5
Reauthentication: Enabled
Configured Reauthentication interval: 3600 seconds
Supplicant timeout: 30 seconds
Server timeout: 30 seconds
Maximum EAPOL requests: 2
Guest VLAN member: not configured
Number of connected supplicants: 1
Supplicant: 00001e1b4da5, 00:00:1E:1B:4D:A5
Operational state: Authenticated <-- shows user is authenticated
Backend Authentication state: Idle
Authentication method: Mac Radius
Authenticated VLAN: vlan200
Dynamic Filter: high_bandwidth <-- shows dynamic filter is applied
Session Reauth interval: 3600 seconds
Reauthentication due in 3577 seconds
Eapol-Block: Not In Effect
Domain: Data
root@SWITCH> show dot1x firewall
Filter name: dot1x_ge-0/0/0
Policer:
Name Packets
high_bw_policer-allow_all 1180820 <-- looks fine here
Bytes=b, Clear=c, Delta=d, Packets=p, Quit=q or ESC, Rate=r, Up=^U, Down=^D
SWITCH Seconds: 12 Time: 16:01:33
Interface Link Input bytes (bps) Output bytes (bps)
ge-0/0/0 Up 2255861248 (742036992) 2255880768 (742036736)
gr-0/0/0 Up 0 (0) 0 (0)
pfh-0/0/0 Up 0 0
ge-0/0/1 Up 2255892288 (742036992) 2255911488 (742036992) <-- Traffic not getting policed
ge-0/0/2 Down 0 (0) 0 (0)
The policer applied through Dynamic Firewall Filter is not getting attached to the port.
The following error message can be seen from syslog which indicates that the policer is not applied on the interface:
Jan 10 15:57:57 SWITCH pfex: dfw_bind_policer_template_to_filter:339 Binding policer high_bw_policer to filter 12582912 failed
The workaround is to configure static Firewall Filters to police the traffic and apply them directly on the L2 port.
Or upgrade to the following fixed Junos releases:
Please refer to PR1410973 - The policer might not work when it is applied through the dynamic filter
2020-02-21: Changed encrypted password to “$ABC123".