fxpc core file upon applying firewall filter configuration that has flexible match using knob "flexible-match-range" on any interface.
user@QFX# show firewall family inet filter <flexible-FF-name> term term1 { from { flexible-match-range { >>>>>>>>>>>>this is not supported configuration match-start layer-4; byte-offset 24; bit-length 32; range-except 0x01020304; } } then { accept; } } set interfaces <interface_name> unit * family inet filter input <flexible-FF-name>
fxpc core file generated after applying the firewall filter to any interface. this leads to service impact
user@QFX> show system core-dumps no-forwarding -rw-rw---- 1 root field 10990399 Dec 19 12:50 /var/tmp/fxpc.core.4.gz >>>>>core file generated
firewall filter configuration that has flexible match using knob "flexible-match-range" is not supported on QFX5K platform. workaround is to remove this firewall filter configuration. as part of PR1710704 , code change has been made to hide flexible-match-range attribute from QFX5k
https://prsearch.juniper.net/problemreport/PR1710704