BFD is going down when ip spoofing screen options is configured for st0 interface with /31 subnet

BFD is going down when ip spoofing screen options is configured for st0 interface with /31 subnet

Initially the BFD session is up however after some time it comes down due to BFD packets dropped due to spoofing.

BGP sessions are not going down, so there is no production impact.

This is seen in version 21.2R3-S2.

Once the BFD session is cleared the session comes up and again goes down after some time.

root> show interfaces terse st0.1020
Interface               Admin Link Proto    Local                 Remote
st0.1020                up    up   inet     192.168.249.100/31
 
root> show route 192.168.249.101
 
inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
 
192.168.249.100/31 *[Direct/0] 00:09:04
                    >  via st0.1020
 
root> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 1 Peers: 1 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0              
                       0          0          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.249.101         200          9          8       0       1        3:15 Establ
  inet.0: 0/0/0/0
 
root> show bfd session
                                                  Detect   Transmit
Address                  State     Interface      Time     Interval  Multiplier
192.168.249.101          Down      st0.1020       0.000     2.000        3  
 
1 sessions, 1 clients
Cumulative transmit rate 0.5 pps, cumulative receive rate 0.0 pps
 
root> show security packet-drop records
08:45:58.138103:LSYS-ID-00 192.168.249.101/49152-->192.168.249.100/3784;udp,ipid-44330,st0.1020,Dropped by IDS:IP spoofing
08:45:56.379100:LSYS-ID-00 192.168.249.101/49152-->192.168.249.100/3784;udp,ipid-22314,st0.1020,Dropped by IDS:IP spoofing
08:45:54.700204:LSYS-ID-00 192.168.249.101/49152-->192.168.249.100/3784;udp,ipid-64809,st0.1020,Dropped by IDS:IP spoofing



Sample config:

set security ike proposal vSRX authentication-method pre-shared-keys
set security ike proposal vSRX dh-group group20
set security ike proposal vSRX authentication-algorithm sha-384
set security ike proposal vSRX encryption-algorithm aes-256-cbc
set security ike proposal vSRX lifetime-seconds 28800
set security ike policy vSRX mode main
set security ike policy vSRX proposals vSRX
set security ike policy vSRX pre-shared-key ascii-text "$9$wt2oZHqfn/tUj/tuOcSwYg"
set security ike gateway vSRX ike-policy vSRX
set security ike gateway vSRX address 10.10.12.2
set security ike gateway vSRX external-interface ge-0/0/0
set security ike gateway vSRX version v2-only
set security ipsec proposal vSRX protocol esp
set security ipsec proposal vSRX authentication-algorithm hmac-sha-256-128
set security ipsec proposal vSRX encryption-algorithm aes-256-cbc
set security ipsec proposal vSRX lifetime-seconds 3600
set security ipsec policy vSRX perfect-forward-secrecy keys group20
set security ipsec policy vSRX proposals vSRX
set security ipsec vpn vSRX bind-interface st0.1020
set security ipsec vpn vSRX ike gateway vSRX
set security ipsec vpn vSRX ike ipsec-policy vSRX
set security screen ids-option TEST ip spoofing
set security policies default-policy permit-all
set security zones security-zone OPEN-WAN screen TEST
set security zones security-zone OPEN-WAN host-inbound-traffic system-services ping
set security zones security-zone OPEN-WAN host-inbound-traffic system-services ike
set security zones security-zone OPEN-WAN host-inbound-traffic protocols bgp
set security zones security-zone OPEN-WAN host-inbound-traffic protocols bfd
set security zones security-zone OPEN-WAN interfaces ge-0/0/0.0
set security zones security-zone OPEN-WAN interfaces st0.1020
set interfaces ge-0/0/0 unit 0 family inet address 10.10.12.1/24
set interfaces lo0 unit 0 family inet address 1.1.1.1/32
set interfaces st0 unit 1020 family inet mtu 1460
set interfaces st0 unit 1020 family inet address 192.168.249.100/31
set protocols bgp group eBGP bfd-liveness-detection minimum-interval 2000
set protocols bgp group eBGP bfd-liveness-detection multiplier 3
set protocols bgp group eBGP neighbor 192.168.249.101 peer-as 200
set routing-options autonomous-system 100

As per Engineering, this is a Day 1 behavior to identify the broadcast ip address as spoofed ip and drop it.

In a /31 subnet, only 2 ip addresses are available, 1 network address and the other as broadcast address.

However, now a days it is common scenario where customers use /31 subnets for point to point links like the st0{vpn) interfaces, who will get affected by this behavior.

Engineering concluded that this is not a bug, this is an expected behavior in Junos screen options.