Description

On an EX4400, when configuring an ingress firewall filter attached to the loopback interface, and with the protocol selected as NTP, and setting the match condition “destination port”. This configuration can cause a denial of those packets.

root@JTAC-EX4400> show configuration firewall family inet filter JTAC-IN term JTAC-NTP-FILTER 
from { 
      source-prefix-list { 
          NTP-SERVERS-LIST; 
          HOSTS; 
      } 
      protocol udp; 
      destination-port 123; 
} 
then { 
     count NTP-COUNT; 
     accept; 
} 

Traffic is denied and the following logs are seen:

Sep 30 14:47:26.843 2024 JTAC-EX4400 kernel: FW: .local..0 D udp 10.174.156.1 10.174.156.1 123 51167

Sep 30 14:47:31.918 2024 JTAC-EX4400 kernel: FW: .local..0 D udp 10.174.156.1 10.174.156.1 123 51167

Sep 30 14:47:37.152 2024 JTAC-EX4400 kernel: FW: .local..0 D udp 10.174.156.1 10.174.156.1 123 51167

Sep 30 14:47:42.624 2024 JTAC-EX4400 kernel: FW: .local..0 D udp 10.174.156.1 10.174.156.1 123 51167




 

Solution

Below is the NTP logic on an EX4400:

  1. NTP queries the same device when you try to do “show ntp associations”.

  2. The source and destination IP address of this query packet is either the NTP source address(if configured), ELSE the loopback IP if the same is configured, ELSE it is the IP address of the interface in the switch that reaches the NTP server.

  3. So to prevent these packets from getting dropped by the loopback interface filter in the kernel, user needs to explicitly allow these packets in the loopback interface filter. It could be based on IP address that is used by the NTP packets. Also we should avoid specific destination-port based matches as NTP packets could be directed to ephemeral ports

  4. In EX4300, the loopback filter in the kernel is not active, and hence the step in 3 is not required.

This is not an issue, however we must explicitly allow these NTP packets on the basis of their IP addresses used, allocated on the basis of points above. Also ensure that none of the terms in this filter use a match condition which could potentially block these NTP packets and use NTP source port.

For example: 

root@JTAC-EX4400# set firewall family inet filter JTAC-IN term JTAC-NTP-FILTER from source-address [Interface or irb address]

 

Please refer to the following documents for context: 


https://supportportal.juniper.net/s/article/Junos-Why-does-the-Network-Time-Protocol-NTP-stop-working-if-a-loopback-firewall-filter-is-applied?language=en_US

https://supportportal.juniper.net/s/article/EX-Time-is-not-synchronizing-with-NTP-due-to-a-filter-applied-as-input-on-the-loopback-interface?language=en_US

 

 

Modification History

10-08-2024 Initial Draft