In this article we will discuss commit error for "next-header" knob noticed when copying firewall filter configuration from PTX with 20.4R3-S4.2-EVO to PTX with 21.4R3-S5.9-EVO code.

In 20.4R3-S4.2-EVO PTX device, firewall filters such as Protect_RE called on lo0 unit 0 are configured with next-header to match the protocol.

Example :

    filter PROTECT_RE_IPV6 {
      term PERMIT_VALID_ICMP {
        from {
          next-header icmpv6;
          hop-limit 255;
        }
        then {
          count PERMIT_VALID_ICMP;
          accept;
        }
      }

After moving the same firewall-filter configuration from PTX with 20.4R3-S4.2-EVO to PTX with 21.4R3-S5.9-EVO code, you would noticed below commit error.

root@Router 1# commit check 
[edit]
 'interfaces'
  filter with next-header cannot be attached to the lo0 interface
error: configuration check-out failed: (validation hook evaluation failed)



Or


root@Router 1# commit check 
[edit firewall family inet6 filter PROTECT_RE_IPV6 term PERMIT_VALID_ICMP from]
 'next-header'
  Port match without payload-protocol match not supported
error: configuration check-out failed: (validation hook evaluation failed)

In 21.4R3-S5.9-EVO next-header knob is not supported instead use payload-protocol which works exactly the same.

Example :

[edit firewall family inet6 filter PROTECT_RE_IPV6 term PERMIT_VALID_ICMP from]
-    next-header icmp6;
-    hop-limit 255;
+    payload-protocol icmp6;
+    hop-limit 255;


root@Router 1# commit check 
configuration check succeeds

2024-11-08 : Article Created

2025-31-3: Platform added(PTX10003)