Description

fxpc core file upon applying firewall filter configuration that has flexible match using knob "flexible-match-range" on any interface. 
user@QFX# show firewall family inet filter <flexible-FF-name>
term term1 {
    from {
        flexible-match-range {     >>>>>>>>>>>>this is not supported configuration
            match-start layer-4;
            byte-offset 24;
            bit-length 32;
            range-except 0x01020304;
        }
    }
    then {
        accept;
    }
}
set interfaces <interface_name> unit * family inet filter input <flexible-FF-name>
 

Symptoms

fxpc core file generated after applying the firewall filter to any interface. this leads to service impact
 

user@QFX> show system core-dumps no-forwarding
-rw-rw---- 1 root field  10990399 Dec 19 12:50 /var/tmp/fxpc.core.4.gz >>>>>core file generated

 

Solution

firewall filter configuration that has flexible match using knob "flexible-match-range" is not supported on QFX5K platform.
workaround is to remove this firewall filter configuration. as part of PR1710704 , code change has been made to hide flexible-match-range attribute from QFX5k

 

Modification History

2024-01-17 : Article Created

Related Information

https://prsearch.juniper.net/problemreport/PR1710704