Description

When configuring a firewall filter in QFX5k switches, the condition "from port" will not get programmed to the PFE, leading to all packets passing the firewall filter condition and thus ending up with unwanted accept or discard of packets. 

Symptoms

Unexpected discard of packets can happen when applying firewall filter with terms as below: 
set firewall family inet filter access_control term 10 from source-address x.x.x.x/32
set firewall family inet filter access_control term 10 from protocol udp
set firewall family inet filter access_control term 10 from port ntp
set firewall family inet filter access_control term 10 then accept
set firewall family inet filter access_control term 20 from protocol udp
set firewall family inet filter access_control term 20 from port ntp
set firewall family inet filter access_control term 20 then discard
set firewall family inet filter access_control term 100 then accept

Using the port qualifier should program two entries in the PFE for matching source-port and destination-port each, but in QFX5k, there's no PFE entry for a port qualifier, resulting in the term being matched for any ports as if there is no matching condition for ports.
Therefore, all UDP packets will pass term 20 of the above firewall filter, ending up being discarded.

Solution

An internal PR addressed this issue, and the fix is applied to the following releases:
21.1R2, 21.2R1, 21.2R2, 21.3R1

The issue is applicable with all QFX5k series using Junos. 

For releases without the fix applied, you need to divide the term into two terms, each with source-port and destination-port as a workaround.

Modification History

Dec 18: Internal PR and fix release information added