Description

When the packet matches a static route with "discard" option, the packet is sent to loopback interface and the Firewall action will be executed accordingly.

 

Symptoms

Assume that there is a Firewall configured on loopback interface but not on an ingress interface. When the ingress interface receives a packet and a packet matches a static route with the discard option (set routing-options static route x.x.x.x/x discard), it is sent to the process of a loopback filter instead of silently being discarded.

set routing-options static route 0.0.0.0/0 discard
set interfaces lo0 unit 0 family inet filter input Filter-RE-in
set firewall family inet filter Filter-RE-in interface-specific
set firewall family inet filter Filter-RE-in term Last-discard then count Filter-RE-in-File-Discard
set firewall family inet filter Filter-RE-in term Last-discard then log
set firewall family inet filter Filter-RE-in term Last-discard then discard

The default route matches the packet whose destination is 172.28.11.1 and source is 172.28.1.1 and the firewall log and counter are hitting the packet.

root@switch> show firewall log
Log :
Time      Filter    Action Interface           Protocol        Src Addr                         Dest Addr
17:56:19  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1
17:56:19  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1
17:56:19  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1
17:56:19  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1

root@switch> show firewall log
Log :
Time      Filter    Action Interface           Protocol        Src Addr                         Dest Addr
17:56:21  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1
17:56:21  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1
17:56:21  pfe       D      xe-0/2/0.0          UDP             172.28.1.1                       172.28.11.1

root@switch# run show firewall

Filter: Filter-RE-in-lo0.0-i
Counters:
Name                                                                            Bytes              Packets
Filter-RE-in-File-Discard-lo0.0-i                                           101423462               338094  <<<< Increasing!

{master:0}[edit]
root@switch#

 

Solution

This is day-1 design on all QFX5000 and EX products supporting ELS.

Modification History

2023-05-09 : First Version
2023-05-29 : Updated Affected platforms in the Categories section