Customer uses SPC3 on a MX Virtual-Chassis for CGNAT and uses interface on MPC10 as the WAN interface. But when the active WAN interface is on member-1 node, the returning traffic got dropped.

For example:

set interfaces et-16/0/0 gigether-options 802.3ad ae1
set interfaces ae1 flexible-vlan-tagging
set interfaces ae1 mtu 1600
set interfaces ae1 aggregated-ether-options lacp active
set interfaces ae1 unit 3101 description "UPLINK to ISP CORE"
set interfaces ae1 unit 3101 vlan-id 3101
set interfaces ae1 unit 3101 family inet address 10.191.2.2/30
set interfaces ams1 load-balancing-options member-interface mams-8/0/0
set interfaces ams1 unit 20 family inet
set interfaces ams1 unit 20 service-domain inside
set interfaces ams1 unit 30 family inet
set interfaces ams1 unit 30 service-domain outside

set routing-options static route 192.85.1.0/24 next-hop ams1.20

set routing-instances TRANSIT instance-type virtual-router
set routing-instances TRANSIT routing-options static route 0.0.0.0/0 next-hop 10.191.2.1
set routing-instances TRANSIT interface ae1.3101
set routing-instances TRANSIT interface ams1.30

{master:member0-re0}

labroot@jtac-mx960-r2037-re0> show chassis hardware models 

member1:

--------------------------------------------------------------------------

Hardware inventory:

Item       Version Part number Serial number   FRU model number

FPC 4      REV 60  750-070395  EBAN9097     MPC10E-15C-X

labroot@jtac-mx960-r2037-re0> show services sessions    
Session ID: 4308074506, Service-set: SS_NAT, Policy name: allowall/131085, Timeout: 26, Session State: Valid
Member name: mams-8/0/0
  In: 10.185.0.2/5690 --> 192.85.1.3/8;icmp, Conn Tag: 0x0, If: ams1.20, Pkts: 10, Bytes: 840,  <<<<<<<<<<<<<< NAT works
  Out: 192.85.1.3/8 --> 103.153.242.13/1024;icmp, Conn Tag: 0x0, If: ams1.30, Pkts: 0, Bytes: 0, <<<<<<<<<<<<< the return traffic got dropped
Total sessions: 1

We've been trying to get an SPC3 working for CGNAT on an MX VC and found that any traffic entering the MPC10 in member-1 node got dropped.

​

There has a bug in MPC10 image that incorrectly used the local IFD for forwarding. PR1775980 has fixed this bug.