Traffic is blocked despite a firewall filter allows the packets.
Topology
source 192.168.1.129----switch2------ge-0/0/0---switch1---destination 192.168.100.66
The following filter was applied on ge-0/0/0 on switch1.
set firewall family ethernet-switching filter test term 1 from ip-source-address 192.168.1.128/26
set firewall family ethernet-switching filter test term 1 then accept
set firewall family ethernet-switching filter test term 4 then discard
set interfaces ge-0/0/0 unit 0 family ethernet-switching filter input test
Traffic is blocked.
root@GW> ping 192.168.100.66 source 192.168.1.129
PING 192.168.100.66 (192.168.100.66): 56 data bytes
^C
--- 192.168.100.66 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
Use the log & count actions to determine what traffic is blocked.
set firewall family ethernet-switching filter test term 1 then log
set firewall family ethernet-switching filter test term 1 then count vlan101
set firewall family ethernet-switching filter test term 4 then log
set firewall family ethernet-switching filter test term 4 then count discard
Use "show firewall log detail" to verify if the packet is allow or blocked.
root@switch1# run show firewall log
Log :
Time Filter Action Interface Protocol Src Addr Dest Addr
14:24:15 pfe D ge-0/0/0.0 88cc 2c:21:31:cb:e4:50 01:80:c2:00:00:0e
14:23:46 pfe D ge-0/0/0.0 88cc 2c:21:31:cb:e4:50 01:80:c2:00:00:0e
14:23:38 pfe A ge-0/0/0.0 ICMP 192.168.1.129 192.168.100.66
14:23:37 pfe A ge-0/0/0.0 ICMP 192.168.1.129 192.168.100.66
14:23:36 pfe A ge-0/0/0.0 ICMP 192.168.1.129 192.168.100.66
root@switch1# run show firewall log detail
Time of Log: 2023-05-16 14:23:46 PDT, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: 88cc, Packet Length: 389, Source address: 2c:21:31:cb:e4:50, Destination address: 01:80:c2:00:00:0e
Time of Log: 2023-05-16 14:23:38 PDT, Filter: pfe, Filter action: accept, Name of interface: ge-0/0/0.0
Name of protocol: ICMP, Packet Length: 84, Source address: 192.168.1.129, Destination address: 192.168.100.66
ICMP type: 8, ICMP code: 0
The ICMP packet is accepted, but ping is failing.
The filter is blocking a protocol 88cc which are the LLDP packets.
13:59:15.191134 In 2c:21:31:cb:e4:50 > 01:80:c2:00:00:0e, ethertype LLDP (0x88cc), length 389: LLDP, name switch2.ultralab.juniper.net, length 375
Adding a term to allow LLDP will fix this issue.
set firewall family ethernet-switching filter test term mac from destination-mac-address 01:80:c2:00:00:0e/48
set firewall family ethernet-switching filter test term mac then accept
set firewall family ethernet-switching filter test term mac then log
set firewall family ethernet-switching filter test term mac then count mac
insert firewall family ethernet-switching filter test test term mac before term 1
{master:0}
root@switch1> show firewall log detail
Time of Log: 2023-05-16 14:40:03 PDT, Filter: pfe, Filter action: accept, Name of interface: ge-0/0/0.0
After allow LLDP, the filter works.
64 bytes from 192.168.100.66: icmp_seq=0 ttl=63 time=33.398 ms
64 bytes from 192.168.100.66: icmp_seq=1 ttl=63 time=33.218 ms
64 bytes from 192.168.100.66: icmp_seq=2 ttl=63 time=33.097 ms
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 33.097/33.238/33.398/0.124