Description

On QFX5K platform the implicit deny on egress filter does not work due to the unavailable interface configured as "from interface" in the filter.

This is a product limitation. This KB describes the issue details.

Symptoms

If unavailable interfaces are configured as “from interface” on egress filter, all other terms below “from interface” term including implicit deny do not work.
Also if unavailable interfaces are used then suppose if we configure count, syslog, log nothing will work as expected.
If other match conditions are used, the implicit deny on egress filter DOES work.
And even if we configure unavailable interface as "from interface" in the ingress filter, all the filters including implicit deny would work.
If AE interface is configured as “from interface” on egress filter, the “from interface” term and all other terms below would work fine even if a member link of AE interface has no IFD.  That is because AE interface’s IFD will only disappear when AE interface config gets deleted.  The member links’ IFD status would not affect AE interface’s IFD status. 

 

[Config]ONLY implicit deny

set firewall family ethernet-switching filter ae0-fliter term from-Extra from interface et-0/0/0.0
set firewall family ethernet-switching filter ae0-fliter term from-Extra from interface et-0/0/1.0
set firewall family ethernet-switching filter ae0-fliter term from-Extra then accept
set firewall family ethernet-switching filter ae1-filter term from-Extra from interface et-0/0/0.0
set firewall family ethernet-switching filter ae1-filter term from-Extra from interface et-0/0/1.0
set firewall family ethernet-switching filter ae1-filter term from-Extra then accept

 TESTER                          QFX5210(DUT)                                                   Switch
+---------+                   +------------------+                                        +-----------------+
|         |                   |                  |-->02                                   |                 |
|         |                   |         et-0/0/32+----------------------------------------+et-0/0/48        |
|         |                   |                  |-->04[Here]         ae0                 |                 |
|         |                   |         et-0/0/33+----------------------------------------+et-0/0/49        |
|         |-->01.Arp request  |                  |                                        |                 |
|         +-------------------+et-0/0/0          |                                        |                 |
|         |                   |                  |<--03                                   |                 |
|         |                   |         et-0/0/40+----------------------------------------+et-0/0/50        |
|         |                   |                  |                    ae1                 |                 |
|         |                   |         et-0/0/41+----------------------------------------+et-0/0/51        |
|         |                   |                  |                                        |                 |
+---------+                   +------------------+                                        +-----------------+


user@qfx5210# run monitor interface traffic

Interface    Link  Input packets        (pps)     Output packets        (pps)
 et-0/0/0      Up         339391        (100)     293173704090  (141990565)
 et-0/0/32     Up           3429          (0)     176372042692     (791274)
 et-0/0/33     Up           5092          (0)     116824496541  (141283907)<<<<< Filter does not work
 et-0/0/40     Up   293151500946  (142074576)             5104          (0)
 et-0/0/41     Up        2255695          (1)             3444          (0)
 ae0           Up           8521          (0)     293196539233  (142075181)

 

Solution

01. Create an IFD with IFs included in the Hit condition of the filter (insert a transceiver with IFs that are the conditions of the filter).

02. Only IFs that are actually used should be specified in the Hit condition of the filter.

03. explicitly define a term to be discarded as the very first term in the existing filter because all other terms including implicit deny below the “from interface” term are not valid.
If a transceiver configured as "from interface" in the filter unplugs from the device, this issue happens. So, you should configure explicitly define a Term to be Discarded in an existing filter. 

[Sample config]

set firewall family ethernet-switching filter ae0-fliter term from-ae1 from interface ae1.0
set firewall family ethernet-switching filter ae0-fliter term from-ae1 then discard
set firewall family ethernet-switching filter ae0-fliter term from-Extra from interface et-0/0/0.0
set firewall family ethernet-switching filter ae0-fliter term from-Extra from interface et-0/0/1.0
set firewall family ethernet-switching filter ae0-fliter term from-Extra then accept
set firewall family ethernet-switching filter ae1-fliter term from-ae0 from interface ae0.0
set firewall family ethernet-switching filter ae1-fliter term from-ae0 then discard
set firewall family ethernet-switching filter ae1-filter term from-Extra from interface et-0/0/0.0
set firewall family ethernet-switching filter ae1-filter term from-Extra from interface et-0/0/1.0
set firewall family ethernet-switching filter ae1-filter term from-Extra then accept

You can confirm this limitation on the following url.
Firewall Filter Match Conditions and Actions (QFX and EX Series Switches)
 

Modification History

2024-01-23 : Article Created
2024-03-22 : Symptoms and Solution Modified