Description

This Article mentions the details of firewall filter blocking NTP traffic when it has MAC-Matching Term 
Snap of the configuration :
set firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/48
set firewall family ethernet-switching filter Test term term1 from destination-prefix-list TEST_PREFIX_LIST
set firewall family ethernet-switching filter Test term term1 from ip-source-address 0.0.0.0/0
set firewall family ethernet-switching filter Test term term1 then accept
set firewall family ethernet-switching filter Test term term1 then log

Symptoms

Customer reported NTP traffic getting dropped in firewall log and any device connecting to port  applied with this firewall filter cannot synch with NTP server .
 
Here The NTP packets were getting dropped by the  firewall filter TEST_PREFIX_LIST   applied on the interfaces . (Herethe filter was applied on all interfaces )


family ethernet-switching {
    filter TEST {
      term ARP {
        from {
          ether-type arp;
        }
        then accept;
      }
      term term1 {
        from {
          source-mac-address {
            00:00:00:00:00:00/48;
          }
          destination-prefix-list {
            TEST_PREFIX_LIST;
          }
          ip-source-address {
            0.0.0.0/0;
          }
        }
        then accept;
      }

Firewall log showing discard : 
Time of Log: 2023-05-26 08:10:56 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: UDP, Packet Length: 76, Source address: 10.110.124.235:123, Destination address: 10.25.65.16:123
Time of Log: 2023-05-26 08:10:56 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: UDP, Packet Length: 76, Source address: 10.110.124.235:123, Destination address: 10.5.195.148:123

 

 

Solution

As we have the configuration  to match  MAC-address  with prefix  /48  (00:00:00:00:00:00/48 ), the switch will match all the octets .
If the MAC had exact match  , here 00:00:00:00:00:00 then the traffic will be allowed else it will be dropped.


Here we can follow any of the below solution to allow any MAC 

Solution 1: 
We can remove the MAC matching  from the term term1  to allow all the MAC-address 


delete firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/48

Solution 2:
we can change the condition to match any MAC with statement as below , 
set firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:00/0  << instead of /48 we should use /0 

NOTE:
The prefix value followed  by MAC Address behaves same as prefix followed  IP address. 
In this case as we had /48 so it matched all 48 bits of mac-address ,so we need to have exact match  of MAC-address to accept the traffic .
The above behaviour  are verified  in JTAC Lab 

JTAC Test Results : 

We have tested prefix value with  /47 and below is the observation , 

1. Configured  /47 prefix as below

set firewall family ethernet-switching filter Test term term1 from source-mac-address 00:00:00:00:00:01/47

2. Sent Traffic with source MAC-address  00:00:00:00:00:01 which is accepted 

Time of Log: 2023-06-06 14:18:01 IST, Filter: pfe, Filter action: accept , Name of interface: xe-0/0/8:0.0
Name of protocol: ffff, Packet Length: 60, Source address: 00:00:00:00:00:01, Destination address: ff:ff:ff:ff:ff:ff 

3.sent Traffic with source MAC-address  00:00:00:00:00:11 which is dropped 

Time of Log: 2023-06-06 14:20:12 IST, Filter: pfe, Filter action: discard , Name of interface: xe-0/0/8:0.0
Name of protocol: ffff, Packet Length: 60, Source address: 00:00:00:00:00:11, Destination address: ff:ff:ff:ff:ff:ff 

 

Modification History

2023-06-08 : Initial  Publication