For all Junos platforms, the "syslog" action in the firewall filter is not capturing the traffic syslog info for the traffic passing through the me0 interface, if we apply the filter on the lo0/me0 interface.

Configure a firewall filter with action syslog and apply it on me0/lo0 interface, the firewall filter is unable to capture the syslog info for the traffic passing through me0 interface.

SAMPLE CONFIGURATION FOR THE FIREWALL FILTER :
 

root@ex4400> show configuration | display set | match firewall 
set system syslog file firewall-log firewall any
set system syslog file firewall-log archive size 10m
set system syslog file firewall-log archive files 2
set system syslog file firewall-log explicit-priority
set firewall family inet filter FILTER_TEST term 10 from protocol icmp
set firewall family inet filter FILTER_TEST term 10 from icmp-type echo-request
set firewall family inet filter FILTER_TEST term 10 from icmp-type echo-reply
set firewall family inet filter FILTER_TEST term 10 then count TEST
set firewall family inet filter FILTER_TEST term 10 then log
set firewall family inet filter FILTER_TEST term 10 then syslog
set firewall family inet filter FILTER_TEST term 10 then accept
set firewall family inet filter FILTER_TEST term 20 from protocol tcp
set firewall family inet filter FILTER_TEST term 20 then count SSH
set firewall family inet filter FILTER_TEST term 20 then log
set firewall family inet filter FILTER_TEST term 20 then syslog
set firewall family inet filter FILTER_TEST term 20 then accept
set firewall family inet filter FILTER_TEST term 30 then accept


root@ex4400> show configuration | display set | match filter
set interfaces me0 unit 0 family inet filter input FILTER_TEST

• In the above configuration, if we ping the me0 IP from any connected device, as per TERM 10, the packet counters will increase, and it will show the packet log as expected. But the syslog info will not be logged.

SAMPLE OUTPUT:

{master:0}

root@EX4400> show firewall 

Filter: FILTER_TEST                                            

Counters:

Name                                               Bytes             Packets

TEST                                                 420                   5

{master:0}

root@EX4400> show firewall log 

Log :

Time     Filter   Action Interface          Protocol       Src Addr                 Dest Addr

07:28:38 FILTER_TEST A   me0.0              ICMP           x.x.x.x                  Y.Y.Y.Y

07:28:37 FILTER_TEST A   me0.0              ICMP           x.x.x.x                  Y.Y.Y.Y

07:28:36 FILTER_TEST A   me0.0              ICMP           x.x.x.x                  Y.Y.Y.Y

07:28:35 FILTER_TEST A   me0.0              ICMP           x.x.x.x                  Y.Y.Y.Y

07:28:34 FILTER_TEST A   me0.0              ICMP           x.x.x.x                  Y.Y.Y.Y

{master:0}

root@EX4400> show log firewall-log   

Sep 7 07:28:20 ex4400 clear-log[19992]: logfile cleared
 

• The same behaviour is observed for TCP and UDP traffic passing over the me0 interface.

SOLUTION:

• Please note that me0 filter syslog messages are generated by kernel, not PFE, so the "kernel info" facility/severity is also needed.
• The following PR: PR1714988 is tracking the issue. The issue is fixed in22.2R3-S1, 22.3R3, 22.4R2-S2, 22.4R3, 23.1R2, 23.2R1, 23.3R1. Please refer to the below link for more details:

SAMPLE WORKING CONFIGURATION :
 

{master:0}

root@ex4400 > show configuration | display set | match filter  

set interfaces me0 unit 0 family inet filter input FILTER_TEST       // we can apply the filter on lo0 also

set firewall family inet filter FILTER_TEST term 10 from protocol icmp

set firewall family inet filter FILTER_TEST term 10 from icmp-type echo-request

set firewall family inet filter FILTER_TEST term 10 from icmp-type echo-reply

set firewall family inet filter FILTER_TEST term 10 then count TEST

set firewall family inet filter FILTER_TEST term 10 then log

set firewall family inet filter FILTER_TEST term 10 then syslog

set firewall family inet filter FILTER_TEST term 10 then accept

set firewall family inet filter FILTER_TEST term 20 from protocol tcp

set firewall family inet filter FILTER_TEST term 20 then count TCP

set firewall family inet filter FILTER_TEST term 20 then log

set firewall family inet filter FILTER_TEST term 20 then syslog

set firewall family inet filter FILTER_TEST term 20 then accept

set firewall family inet filter FILTER_TEST term 30 then accept

{master:0}

root@ex4400 > show configuration | display set | match firewall    

set system syslog file firewall-log kernel info                  >> Need this CLI

set system syslog file firewall-log firewall info

set system syslog file firewall-log archive size 10m

set system syslog file firewall-log archive files 2

set system syslog file firewall-log explicit-priority

SAMPLE WORKING OUTPUTS:

{master:0}

root@ex4400 > show version 

fpc0:

--------------------------------------------------------------------------

Hostname: ex440

Model: ex4400-48t

Junos: 23.2R1.13

{master:0}

root@ex4400 > show log firewall-log    

Sep 14 14:19:16 ex4400 clear-log[25445]: logfile cleared

Sep 14 14:19:29 ex4400 kernel: me0.0       A icmp x.x.x.x Y.Y.Y.Y    8    0

Sep 14 14:19:32 ex4400 last message repeated 3 times

version 1