This Article mentions the details of firewall filter blocking NTP traffic when it has MAC-Matching Term Snap of the configuration :set firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/48set firewall family ethernet-switching filter Test term term1 from destination-prefix-list TEST_PREFIX_LISTset firewall family ethernet-switching filter Test term term1 from ip-source-address 0.0.0.0/0set firewall family ethernet-switching filter Test term term1 then acceptset firewall family ethernet-switching filter Test term term1 then log
Customer reported NTP traffic getting dropped in firewall log and any device connecting to port applied with this firewall filter cannot synch with NTP server . Here The NTP packets were getting dropped by the firewall filter TEST_PREFIX_LIST applied on the interfaces . (Herethe filter was applied on all interfaces )family ethernet-switching { filter TEST { term ARP { from { ether-type arp; } then accept; } term term1 { from { source-mac-address { 00:00:00:00:00:00/48; } destination-prefix-list { TEST_PREFIX_LIST; } ip-source-address { 0.0.0.0/0; } } then accept; }Firewall log showing discard : Time of Log: 2023-05-26 08:10:56 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0Name of protocol: UDP, Packet Length: 76, Source address: 10.110.124.235:123, Destination address: 10.25.65.16:123Time of Log: 2023-05-26 08:10:56 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0Name of protocol: UDP, Packet Length: 76, Source address: 10.110.124.235:123, Destination address: 10.5.195.148:123
As we have the configuration to match MAC-address with prefix /48 (00:00:00:00:00:00/48 ), the switch will match all the octets .If the MAC had exact match , here 00:00:00:00:00:00 then the traffic will be allowed else it will be dropped.Here we can follow any of the below solution to allow any MAC Solution 1: We can remove the MAC matching from the term term1 to allow all the MAC-address delete firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/48Solution 2:we can change the condition to match any MAC with statement as below , set firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/0 << instead of /48 we should use /0 NOTE:The prefix value followed by MAC Address behaves same as prefix followed IP address. In this case as we had /48 so it matched all 48 bits of mac-address ,so we need to have exact match of MAC-address to accept the traffic .The above behaviour are verified in JTAC Lab JTAC Test Results : We have tested prefix value with /47 and below is the observation , 1. Configured /47 prefix as belowset firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:01/472. Sent Traffic with source MAC-address 00:00:00:00:00:01 which is accepted Time of Log: 2023-06-06 14:18:01 IST, Filter: pfe, Filter action: accept , Name of interface: xe-0/0/8:0.0Name of protocol: ffff, Packet Length: 60, Source address: 00:00:00:00:00:01, Destination address: ff:ff:ff:ff:ff:ff 3.sent Traffic with source MAC-address 00:00:00:00:00:11 which is dropped Time of Log: 2023-06-06 14:20:12 IST, Filter: pfe, Filter action: discard , Name of interface: xe-0/0/8:0.0Name of protocol: ffff, Packet Length: 60, Source address: 00:00:00:00:00:11, Destination address: ff:ff:ff:ff:ff:ff