An MX is seeing odd behavior with respect to a firewall filter and the processing of DHCPv6 client packets. The router is setup for relay:
set forwarding-options dhcp-relay apply-groups AG-VRF-DHCP-RELAY
set forwarding-options dhcp-relay dhcpv6 overrides allow-snooped-clients
set forwarding-options dhcp-relay dhcpv6 overrides no-bind-on-request
set forwarding-options dhcp-relay dhcpv6 overrides delete-binding-on-renegotiation
set forwarding-options dhcp-relay dhcpv6 forward-snooped-clients non-configured-interfaces
set forwarding-options dhcp-relay dhcpv6 group TEST active-server-group JTAC
set forwarding-options dhcp-relay dhcpv6 group TEST interface xe-0/0/0.0
set forwarding-options dhcp-relay dhcpv6 server-group JTAC 2001:db8:3000::1
Lo0 has a protect filter:
set interfaces lo0 unit 0 family inet filter input PROTECT_RE
set interfaces lo0 unit 0 family inet6 filter input PROTECT_RE_IPv6
For IPv6 that has accept statements for DHCPv6 Broadcast packets and a final discard term:
...
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from source-address fe80::/10
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from destination-address ff02::1:2/128
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from port 546
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from port 547
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST then count dhcpv6-testbcst
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST then log
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST then accept
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_ACK from prefix-list DHCP_SERVERS_IPv6
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_ACK from port 546
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_ACK from port 547
set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_ACK then accept
set firewall family inet6 filter PROTECT_RE_IPv6 term default-term then discard
With the above filter in place, the DHCPv6 solicit packets from the client are not forwarded on.
labroot@mx960-re0> show log DHCP.log
Sep 06 08:06:02
Sep 6 08:02:37 mx960-re0 clear-log[31650]: logfile cleared
labroot@mx960-re0>
labroot@mx960-re0> show dhcpv6 relay statistics
Sep 06 08:06:17
Dhcpv6 Packets dropped:
Total 0
Messages received:
DHCPV6_DECLINE 0
DHCPV6_SOLICIT 0
DHCPV6_INFORMATION_REQUEST 0
DHCPV6_RELEASE 0
DHCPV6_REQUEST 0
DHCPV6_CONFIRM 0
DHCPV6_RENEW 0
DHCPV6_REBIND 0
DHCPV6_RELAY_FORW 0
DHCPV6_LEASEQUERY_REPLY 0
DHCPV6_LEASEQUERY_DATA 0
DHCPV6_LEASEQUERY_DONE 0
DHCPV6_ACTIVELEASEQUERY 0
Messages sent:
DHCPV6_ADVERTISE 0
DHCPV6_REPLY 0
DHCPV6_RECONFIGURE 0
DHCPV6_RELAY_REPLY 0
DHCPV6_LEASEQUERY 0
The term for the packets to be accepted increments though:
labroot@mx960-re0> show firewall filter PROTECT_RE_IPv6
Sep 06 08:08:33
Filter: PROTECT_RE_IPv6
Counters:
Name Bytes Packets
dhcpv6-testbcst 460 5
And, a log term will show reception of the packets:
labroot@mx960-re0> show firewall log
Sep 06 08:08:37
Log :
Time Filter Action Interface Protocol Src Addr Dest Addr
08:08:34 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:31 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:28 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:25 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:22 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:19 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
08:08:16 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
If the term to match the DA of the packet:
Which is correct using the /128 is changed to a /64:
labroot@mx960-re0# delete firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from destination-address ff02::1:2/128
Sep 06 08:21:06
[edit]
labroot@mx960-re0# set firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from destination-address ff02::1:2/64
Sep 06 08:21:13
The client packets are forwarded:
Sep 06 08:22:01
dhcpv6-testbcst 242 2
Sep 06 08:22:16
DHCPV6_SOLICIT 1
DHCPV6_REQUEST 1
DHCPV6_ADVERTISE 1
DHCPV6_REPLY 1
If a count and log term is added to the discard:
labroot@mx960-re0# show | compare
[edit firewall family inet6 filter PROTECT_RE_IPv6 term DHCPv6_BCST from destination-address]
+ ff02::1:2/128;
- ff02::1:2/64;
[edit firewall family inet6 filter PROTECT_RE_IPv6 term default-term then]
+ count discardPkt;
+ log;
The discard rule is clearly hit:
dhcpv6-testbcst 644 7
discardPkt 1592 10
dhcpv6-testbcst 736 8
discardPkt 1772 11
Firewall log shows the DA is changed to ff02::1 when the kernel/RE picks up the packet:
10:24:15 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:24:15 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:12 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:12 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:24:09 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:09 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:24:06 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:06 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:24:03 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:03 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:24:00 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:24:00 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:57 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:23:57 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:54 pfe D xe-0/0/0.0 0 fe80::211:1ff:fe00:1 ff02::16
10:23:54 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:23:54 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:51 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:23:51 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:49 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:49 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:23:48 PROTECT_RE_IPv6 D xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1
10:23:48 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
10:23:46 pfe D xe-0/0/0.0 0 :: ff02::16
10:20:01 pfe R xe-0/0/0.0 UDP fe80::211:1ff:fe00:1 ff02::1:2
Or, firewall log shows the change of the DA to be the IPv6 all Multicast address:
labroot@mx960-re0> show firewall log detail
Time of Log: 2024-09-06 10:24:27 PDT, Filter: pfe, Filter action: reject, Name of interface: xe-0/0/0.0
Name of protocol: UDP, Packet Length: 52, Source address: fe80::211:1ff:fe00:1 Port 546, Destination address: ff02::1:2 Port 547
Time of Log: 2024-09-06 10:24:27 PDT, Filter: PROTECT_RE_IPv6, Filter action: discard, Name of interface: xe-0/0/0.0
Name of protocol: UDP, Packet Length: 0, Source address: fe80::211:1ff:fe00:1 Port 546, Destination address: ff02::1 Port 547
Time of Log: 2024-09-06 10:24:24 PDT, Filter: pfe, Filter action: reject, Name of interface: xe-0/0/0.0
Time of Log: 2024-09-06 10:24:24 PDT, Filter: PROTECT_RE_IPv6, Filter action: discard, Name of interface: xe-0/0/0.0
Time of Log: 2024-09-06 10:24:21 PDT, Filter: pfe, Filter action: reject, Name of interface: xe-0/0/0.0
Time of Log: 2024-09-06 10:24:21 PDT, Filter: PROTECT_RE_IPv6, Filter action: discard, Name of interface: xe-0/0/0.0
Time of Log: 2024-09-06 10:24:18 PDT, Filter: pfe, Filter action: reject, Name of interface: xe-0/0/0.0
FW issue.
The MX is Functioning as Designed with this behavior. The PFE is intentionally changing the DA of the packet to ff02::1 to punt the packet up to the RE. The behavior is by design and thus, the filter to match the DHCPv6 packets will need to be adjusted accordingly to allow the Solicit to the relayed to the server.