A customer experienced a huge delay and 0 counter issue when issuing the command "show firewall" after modifying the lo0 firewall filter. The issue is seen only when there is EX9200-15C installed.
A customer created a new firewall filter for lo0, named new_filter, and applied it to the lo0 within a single commit. After that, a significant delay in the command "show firewall" output was observed, with the firewall counter not increasing. When the issue is hit, an error log is generated in the messages log as below:
Sep 12 02:18:03 EX9214_RE0 fpc5 user.err aftd-trio: dfw_accept_gencfg_term:1835 Kernel sending a term ADD for filter (2) before filter-head
There is a workaround to avoid the issue when modifying the lo0 firewall filter for chassis with EX9200-15C installed.1. Modifying the existing firewall terms won't trigger the issue. 2. If you would like to create a new filter and replace it with the old one, follow the below steps exactly:- delete the existing firewall filter and its association with the interface
delete firewall family inet filter old_filter delete interfaces lo0 unit 0 filter input old_filter
- commit the changes
commit
- create a new firewall filter and apply it to the lo0 interface
set firewall family inet filter new_filter set interfaces lo0 unit 0 filter input new_filter