Description

On MX platform, if traffic has been generated directly by the Routing Engine, the output firewall filter matching condition for IPv6 (inet6) traffic will not be evaluated if it contains any match condition which needs MPC/PFE support.

Solution

If IPv6 (inet6) firewall filter is applied to the interface, the output IPv6 traffic generated directly by the Routing Engine might not be evaluated by any term with any match condition which needs MPC/PFE support. This is due to the fact that the packet which has been generated by Routing Engine will be injected directly into L2, without passing any FPC/PFE level lookup. As a result, it will bypass any match condition which has to be done on PFE level. This behavior is by design.

For example, if the following IPv6 firewall filter has been defined:

family inet6 {
    filter flex {
        term ICMP6 {
            from {
                payload-protocol icmp6;
            }
            then discard;
        }                               
        term ALL {
            then accept;
        }
    }
}

And was applied as below:

user@router# show interfaces et-0/1/5 
unit 0 {
    family inet6 {
        filter {
            output flex;
        }
        address 2020:078f:1203::1200:1/64;
    }
}

If ICMPv6 ping is initiated from this router, all such packets sent by the router will not be discarded as defined in the term "ICMP6" of filter "flex", because locally generated IPv6 traffic will not be evaluated by this term and this condition.

Refer to the following technical documentation for more about firewall filter flexible match condition:

Modification History

2020-06-24: Minor, non-technical edits.