After applying an input firewall filter to the loopback interface for managing host-bound traffics, the customer experienced a BFD(ICCP) down issue while the ICCP TCP connection was in an ESTABLISHED state.

It was found that the customer configured the firewall filter with the term condition from port qualifier, which is not properly supported in QFX5k until 21.1R1.

The ICCP liveness detection state is DOWN, while the TCP connection is ESTABLISHED.

{master:0}
labroot@d01-33> show iccp 

Redundancy Group Information for peer 192.168.0.2
  TCP Connection       : Established
  Liveliness Detection : Down
  Backup liveness peer status: Up
  Redundancy Group ID          Status
    1                           Up   

Client Application: lacpd
  Redundancy Group IDs Joined: 1 

Client Application: l2ald_iccpd_client
  Redundancy Group IDs Joined: 1 

Client Application: MCSNOOPD
  Redundancy Group IDs Joined: 1 

From the monitor traffic interface in both nodes, only outgoing BFD packets are seen.

{master:0}
labroot@d01-34> monitor traffic interface irb.3 no-resolve matching udp 
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on irb.3, capture size 96 bytes

01:32:49.852351 Out IP truncated-ip - 14 bytes missing! 192.168.0.2.49152 > 192.168.0.1.4784: [|BFD]
01:32:53.876118 Out IP truncated-ip - 14 bytes missing! 192.168.0.2.49152 > 192.168.0.1.4784: [|BFD]
01:32:57.787681 Out IP truncated-ip - 14 bytes missing! 192.168.0.2.49152 > 192.168.0.1.4784: [|BFD]

The customer has applied an input firewall filter at the loopback interface to manage host-bound traffics.

That firewall filter has the below terms to allow NTP with specific hosts only.

set firewall family inet filter access_control term 10 from source-address x.x.x.x/32
set firewall family inet filter access_control term 10 from protocol udp
set firewall family inet filter access_control term 10 from port ntp
set firewall family inet filter access_control term 10 then accept
set firewall family inet filter access_control term 20 from protocol udp
set firewall family inet filter access_control term 20 from port ntp
set firewall family inet filter access_control term 20 then discard
set firewall family inet filter access_control term 100 then accept

Using the port qualifier should program two entries in the PFE for matching source-port and destination-port each, but in QFX5k, there's no PFE entry for a port qualifier, resulting in the term being matched for any ports as if there is no matching condition for ports.

Therefore all inbound UDP packets were discarded, and as a result, BFD for ICCP which uses UDP 4784 port went down too.

As a workaround, you must configure two terms with the matching condition source-port and destination-port separately.

Initial version