In this KB we will discuss the Syslog message "aftd-trio: FW" reported under AFT-based line cards.

The advance forwarding toolkit daemon in TRIO MPCs is just informing the packets that are hitting by the "then syslog" action you have configured under the lo0 filter and the syslog action is logging those messages under the PFE. Not an error or issue. It's not related to any DDOS.

AFT daemon is only present on ZH ASIC or MPC10E and 11 MPCs(ZT) and ZX ASICS.
LC2103 Linecards does not run with the aftd daemon, hence such PFE logging will not be reflected. 
 

About the logs and Impact:

Logs are only debugging logs and the logs are harmless. Customers can safety ignore them.

fpc# aftd-trio[PID]: FW: <IFL>   D <Source MAC> <Destination MAC>  port PROTOCOL <Source IP> <Destination IP> (# of packets)

The firewall syslog filled the messages log file as the syslog reported with "notice" log level instead of "info" level in MPC10E and the latest line cards.
 
Customers using the following notice or any info category will report the messages under the PFE.

syslog {

       }

       file messages {

           any notice / info;  --------------------------- “notice or info” configured due to this we encountered those harmless debugging logs .

Those logs can be only visible for MPC10E and latest linecards if file messages any “notice” or "info" configured .

FPC 8           REV 61  750-070395  EBAS9751          MPC10E 3D MRATE-15xQSFPP -------------- MPC10E card.

or


FPC 0                     BUILTIN      BUILTIN           FPC-BUILTIN
  CPU            REV 13   750-122877   BCDX2470          JNP304 PMB.  >>>>>>>> MX304 is also AFTd based platform

Question in mind:

 1. Is this a Day-1 or Regression PR?
>> Day-1 for all AFT/EVO based platforms

2. Does this issue apply to all Junos platforms, or all Evo platforms?
>> All EVO platforms and Junos with AFT based platforms (MPC10+ and latest TRIO cards, like MPC11E, MX204, MX304 and MX10003)

3. Which specific platform(s) will be impacted?
>> All EVO platforms and Junos with AFT based platforms (MPC10+ and latest TRIO cards, like MPC11E, MX204, MX304 and MX10003) 

4. What's the general trigger of this issue?
>> syslog as filter action is the trigger to this issue.

6. What's the impact of this issue?
>> Firewall syslog floods with NOTICE/INFO.

7. Is there any log or symptom that can help customer identify this issue in the first place?
>> Firewall syslog floods with this harmless log

8. Is there any workaround to avoid this issue?
>> We can disable NOTICE/Info level in the logs for firewall but we might miss the real NOTICE or INFO level logs from the firewall.

8. Recommendation is to filter those messages to avoid the flood on the messages file.

https://supportportal.juniper.net/s/article/Junos-Platform-Example-How-to-prevent-certain-syslog-messages-from-being-written-to-the-log-file

1.Logs can be safely ignore the logs as these logs are harmless .

As workaround logs filtered with command:

#set system syslog file messages match "!(aftd-trio: FW)"

Customers can follow below KB to , how to filter any syslog messages

 https://supportportal.juniper.net/s/article/Junos-Platform-Example-How-to-prevent-certain-syslog-messages-from-being-written-to-the-log-file