Applying control plane filter and adding 'interface group' as part of existing FW filter. But after adding 'interface group' the NTP commands do not work and it appears NTP breaks after adding interface group.
lab@router> show ntp associations no-resolve
localhost: timed out, nothing received
***Request timed out
When the Junos CLI command 'show ntp associations', 'show ntp status' and 'show system uptime' is executed, the ntpqd (NTP query daemon) queries to the ntpd (NTP daemon) over the internal socket.
The external communication with the NTP server happens with the fxp0 address (or whatever source address is defined in the NTP) and this seems to be working since 'interface group' is correctly configured. The functionality of NTP time sync seems to be working since when 'set date ntp' is executed it gives the time inline with NTP
However, the internal socket does not meet the 'interface-group' criteria and hence the packet seems to be dropping on the socket.
when applying ‘interface-group-except’ it will start working for NTP.
term NTP {
from {
interface-group-except [ 01 01 01 01 ];
source-prefix-list {
LO0;
TEST-SERVERS;
IPV4-MGMT;
}
protocol udp;
port ntp;
then accept;