Description
Can’t telnet to peer device’s directly connected interface with error Operation timed out
Symptoms
Can’t telnet to peer device’s directly connected interface with error below:
labroot@R1> telnet 10.55.252.198 source 10.55.252.199
Trying 10.55.252.198...
telnet: connect to address 10.55.252.198:
Operation timed out
telnet:
Unable to connect to remote host
SSH works fine:
labroot@R1> ssh 10.55.252.198 source 10.55.252.199
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.55.252.198' (ECDSA) to the list of known hosts.
Password:
labroot@R1> ssh 10.55.252.198 source 10.55.252.199
Password:
Last login: Tue Feb 13 08:21:41 2024
--- JUNOS 19.4R3-S3.3 Kernel 64-bit JNPR-11.0-20210308.e5f5942_buil
labroot@r2_re>
-------------
Ping works from local device 10.55.252.199 to remote device 10.55.252.198.
labroot@R1> ping 10.55.252.198 source 10.55.252.199
PING 10.55.252.198 (10.55.252.198): 56 data bytes
64 bytes from 10.55.252.198: icmp_seq=0 ttl=255 time=2.792 ms
64 bytes from 10.55.252.198: icmp_seq=1 ttl=255 time=2.736 ms
64 bytes from 10.55.252.198: icmp_seq=2 ttl=255 time=2.672 ms
64 bytes from 10.55.252.198: icmp_seq=3 ttl=255 time=2.745 ms
64 bytes from 10.55.252.198: icmp_seq=4 ttl=255 time=2.785 ms
64 bytes from 10.55.252.198: icmp_seq=5 ttl=255 time=2.691 ms
^C
--- 10.55.252.198 ping statistics ---
6 packets transmitted, 6 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.672/2.737/2.792/0.044 ms
Solution
The remote router has already configured telnet permission:
labroot@R2# show |display set|match telnet
set system services telnet
Checked if there is any related firewall filter applied to lo0 blocked the telnet traffic.
PROTECT_RE_GROUP {
interfaces {
lo0 {
unit <*> {
family inet {
filter {
input
PROTECT_RE_FILTER;
}
}
-------------
Lab replicated the issue:
Telnet not working:
labroot@R1> telnet 10.55.252.198 source 10.55.252.199
Trying 10.55.252.198...
telnet: connect to address 10.55.252.198: Operation timed out
telnet: Unable to connect to remote host
-------------
SSH works fine:
labroot@R1> ssh 10.55.252.198 source 10.55.252.199
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.55.252.198' (ECDSA) to the list of known hosts.
Password:
labroot@R1> ssh 10.55.252.198 source 10.55.252.199
Password:
Last login: Tue Feb 13 08:21:41 2024
--- JUNOS 19.4R3-S3.3 Kernel 64-bit JNPR-11.0-20210308.e5f5942_buil
labroot@r2_re>
-----------
The reason is because the firewall policy applied to lo0 allow SSH and not allow port telnet , the discard policy discarded the telnet traffic
The config below replicated the issue:
set family inet filter PROTECT_RE_FILTER term PERMIT_
REMOTE
from protocol tcp
set family inet filter PROTECT_RE_FILTER term PERMIT_ REMOTE from port ssh
set family inet filter PROTECT_RE_FILTER term PERMIT_ REMOTE then accept
set family inet filter PROTECT_RE_FILTER term OTHERS then count COUNT_DENY_LOG
set family inet filter PROTECT_RE_FILTER term OTHERS then log
set family inet filter PROTECT_RE_FILTER term OTHERS then discard
set interface lo0 unit * family inet filter input PROTECT_RE_FILTER
After adding the term below, telnet works:
set family inet filter PROTECT_RE_FILTER term PERMIT_ REMOTE from port telnet
labroot@R1> telnet 10.55.252.198 source 10.55.252.199
Trying 10.55.252.198...
Connected to 10.55.252.198.
Escape character is '^]'.
login: labroot
Password:
Last login: Tue Feb 13 09:01:49 from 10.55.252.199
--- JUNOS 19.4R3-S3.3 Kernel 64-bit JNPR-11.0-20210308.e5f5942_buil
labroot@R2>
Modification History
4/11 KB article created
Can’t telnet with error Operation timed out