Discovery messages announce and maintain the presence of a router in a network. Routers indicate their presence in a network by sending hello messages periodically. Hello messages are transmitted as UDP packets to the LDP port at the group multicast address for all routers on the subnet.

LDP uses the following discovery procedures:

Basic discovery—A router periodically sends LDP link hello messages through an interface. LDP link hello messages are sent as UDP packets addressed to the LDP discovery port. Receipt of an LDP link hello message on an interface identifies an adjacency with the LDP peer router.

Extended discovery—LDP sessions between routers not directly connected are supported by LDP extended discovery. A router periodically sends LDP targeted hello messages to a specific address. Targeted hello messages are sent as UDP packets addressed to the LDP discovery port at the specific address. The targeted router decides whether to respond to or ignore the targeted hello message. A targeted router that chooses to respond does so by periodically sending targeted hello messages to the initiating router.

Incorrect handling of the Lo0 filter could block the LDP discovery packets that use UDP and it causes all L2Circuits DOWN. This is crucial because LDP uses UDP for discovery messages, specifically on port 646. If your filter inadvertently blocks these UDP packets, it can prevent LDP from successfully discovering and establishing sessions with its peers. As a result, the necessary label mappings for the l2circuit would not be exchanged, keeping the circuit in an OL state and unable to pass traffic.

If you add a lo0 filter and under LDP term you forget to add from protocol UDP, the discovery does not happen and hence l2circuit will keep down as Ongoing Label (OL).

Example of incorrect use:

set firewall family inet filter lo0-protect term LDP-ACCEPT from source-prefix-list backbone-red

set firewall family inet filter lo0-protect term LDP-ACCEPT from protocol tcp

set firewall family inet filter lo0-protect term LDP-ACCEPT from destination-port ldp

set firewall family inet filter lo0-protect term LDP-ACCEPT then count LDP-ACCEPT

set firewall family inet filter lo0-protect term LDP-ACCEPT then accept

To resolve this issue, you would need to adjust the lo0 filter configuration to allow UDP packets, particularly those destined for or originating from port 646, which is used by LDP. Here's a general approach to fix this:

set firewall family inet filter lo0-protect term LDP-ACCEPT from protocol udp