Description

This article clarifies that on QFX Series switches, there is a product limitation where you cannot filter certain traffic with a firewall filter applied in the output direction. 

 

Symptoms

On QFX platforms, certain traffic firewall filters cannot be applied in the egress direction.

For example: 

{master:0}[edit]
root@QFX5100# set firewall family ethernet-switching filter TEST term 1 from ip-protocol icmp 

{master:0}[edit]
root@QFX5100# set firewall family ethernet-switching filter TEST term 1 then count icmp-pkts-out 

{master:0}[edit]
root@QFX5100# set firewall family ethernet-switching filter TEST term 2 then accept 

{master:0}[edit]
root@QFX5100# set interfaces ae7 unit 0 family ethernet-switching filter output TEST 

{master:0}[edit]
root@QFX5100# show | compare 
[edit interfaces ae7 unit 0 family ethernet-switching]
+       filter {
+           output TEST;
+       }
[edit]
+  firewall {
+      family ethernet-switching {
+          filter TEST {
+              term 1 {
+                  from {
+                      ip-protocol icmp;
+                  }
+                  then count icmp-pkts-out;
+              }
+              term 2 {
+                  then accept;
+              }
+          }
+      }
+  }

{master:0}[edit]
root@QFX5100# commit check 
[edit interfaces ae7 unit 0 family ethernet-switching]
  'filter'
    Referenced filter 'TEST' can not be used as ip-protocol not supported on egress
error: Failed to read config
commit-check failed

{master:0}[edit]
root@QFX5100#

 

Solution

On a QFX Series switch, you cannot filter certain traffic with a firewall filter applied in the output direction. This limitation applies to control traffic for protocols such as ICMP (ping), STP, and LACP. 

This is a product limitation.

 

Modification History

2020-06-15: Minor non-technical changes made

 

Related Information