Description

Juniper Enhanced web-filtering Websense server connection attempt using the management fxp0 interface.

Symptoms

node0:
--------------------------------------------------------------------------
UTM web-filtering status: 
Server status: Juniper Enhanced using Websense server DOWN
Status reason: Server no response(server:99.83.233.75(99.83.233.75), src-ip:10.85.147.20, vr-id:0)
JDPI Parser : Enabled

node1:
--------------------------------------------------------------------------
UTM web-filtering status: 
Server status: Juniper Enhanced using Websense server DOWN
Status reason: Server no response(server:99.83.233.75(99.83.233.75), src-ip:10.85.147.20, vr-id:0)
JDPI Parser : Enabled

show security packet-drop records:
01:36:16.755955:LSYS-ID-00 10.85.147.20/31223-->99.83.233.75/80;tcp,ipid-255,.local..0,Dropped by FLOW:First path Ifp in Null Zone
01:36:14.751421:LSYS-ID-00 10.85.147.20/31222-->99.83.233.75/80;tcp,ipid-255,.local..0,Dropped by FLOW:First path Ifp in Null Zone
01:36:13.749334:LSYS-ID-00 10.85.147.20/31221-->99.83.233.75/80;tcp,ipid-255,.local..0,Dropped by FLOW:First path Ifp in Null Zone
01:36:12.745467:LSYS-ID-00 10.85.147.20/31220-->99.83.233.75/80;tcp,ipid-255,.local..0,Dropped by FLOW:First path Ifp in Null Zone
 

show route to destination:
root@a07-47# run show route 99.83.233.75 table inet
inet.0: 588 destinations, 588 routes (581 active, 0 holddown, 7 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0     *[Static/5] 1d 00:46:03
 > to 10.85.147.1 via fxp0.0

fxp0 zone assignement error:
root@a07-47# set security zones security-zone Trust interfaces fxp0 
error: interface-unit: 'fxp0': This interface cannot be configured in a zone
error: statement creation failed: fxp0
 

Flow Trace:
Aug 29 01:50:54 01:50:54.325557:CID-2:THREAD_ID-04:LSYS_ID-00:RT:flow_first_routing: Doing DESTINATION addr route-lookup
Aug 29 01:50:54 01:50:54.325559:CID-2:THREAD_ID-04:LSYS_ID-00:RT:flow_ipv4_rt_lkup success 99.83.233.75, iifl 0x0, oifl 0x5 
Aug 29 01:50:54 01:50:54.325561:CID-2:THREAD_ID-04:LSYS_ID-00:RT:flow_first_routing: setting out_vrf_id in lpak to 0, grp 0
Aug 29 01:50:54 01:50:54.325564:CID-2:THREAD_ID-04:LSYS_ID-00:RT:Checking in-ifp from .local..0 to fxp0.0 for src: 10.85.147.20 in vr_id:0
Aug 29 01:50:54 01:50:54.325566:CID-2:THREAD_ID-04:LSYS_ID-00:RT: routed (x_dst_ip 99.83.233.75) from junos-host (.local..0 in 0) to fxp0.0, Next-hop: 10.85.147.1
Aug 29 01:50:54 01:50:54.325568:CID-2:THREAD_ID-04:LSYS_ID-00:RT: packet dropped, out_ifp is null or in null-zone
Aug 29 01:50:54 01:50:54.325569:CID-2:THREAD_ID-04:LSYS_ID-00:RT:Out-ifp fxp0.0 is null or in null zone
Aug 29 01:50:54 01:50:54.325573:CID-2:THREAD_ID-04:LSYS_ID-00:RT:flow_initiate_first_path: first pak no session
Aug 29 01:50:54 01:50:54.325574:CID-2:THREAD_ID-04:LSYS_ID-00:RT: flow find session returns error.
Aug 29 01:50:54 01:50:54.325575:CID-2:THREAD_ID-04:LSYS_ID-00:RT:flow_proc_rc: -1.

Solution

Use any revenue ports (ge-*/xe-*) instead of the fxp0 Interface which is the Dedicated Management Port.

Modification History

2024-08-29 : Article Created