SNMP monitoring of end devices impacted when a firewall filter added on QFX5100.

snmp tools > xe-0/0/24 QFX5100 ae5.400 > intermediate devices--- host--- devices being monitored. There are 24 hosts. 22 hosts are working fine with filter.

Remaining 2 hosts that has more end devices connected have issue.

Filter is added on ae5.400 ingress.

Specific term to allow SNMP return traffic from monitored devices

term SNMP {

        from {

          destination-prefix-list {

            <list 1>;

           <list 2>;

            <list 3>;

          }

          protocol udp;

          source-port 161;

        }

        then accept;

      }

last term

term DENY-ALL {

        then {

          discard;

        }

      }

When SNMP server polls hosts which has devices with a large number devices, the reply is bigger than IP MTU.

Device fragments it into multiple packets.

Only first packet has UDP header and source port 161. Hence it matches to SNMP term of filter.

But other packets (fragments) don't have UDP ports information.

They are just IP fragments with UDP protocol code in IP header.

Hence they don't match that rule and fall under DENY-ALL where they are dropped.

That is why issue was intermittent , as issue is seen only when SNMP response exceeds MTU.

Added " is-fragment" ; to SNMP term to accept the fragmented packets.