Firewall filter not blocking traffic as expected.
In some rare instances, the configured filter, either applied on loopback or on data ports, does not block traffic as expected.
This is a transient issue which is not yet root caused. It is not known if it happens during the first time config or broke all of a sudden when it was working.
In such cases, the shell can be checked and as mentioned in the below output, we can see that only the filters indexed are the default ones, but the manual filters like PRIOTECT_RE, etc are not seen
(vty)# show filter
Program Filters:
---------------
Index Dir Cnt Text Bss Name
-------- ------ ------ ------ ------ --------
Term Filters:
------------
Index Semantic Name
-------- ----------------
<---- No filters
57006 Classic __jdhcpd__
57007 Classic __dhcpv6__
65008 Classic __jdhcpd_l2_snoop_filter__
16777216 Classic fnp-filter-level-all
46137360 Classic pfe-cos-cl-557-5-1
46137361 Classic pfe-cos-cl-558-5-1
46137362 Classic pfe-cos-cl-559-5-1
46137363 Classic pfe-cos-cl-560-5-2
46137364 Classic pfe-cos-cl-561-5-1
46137365 Classic pfe-cos-cl-562-5-1
46137366 Classic pfe-cos-cl-563-5-1
46137367 Classic pfe-cos-cl-564-5-1
46137368 Classic pfe-cos-cl-565-5-1
46137369 Classic pfe-cos-cl-566-5-1
46137370 Classic pfe-cos-cl-567-5-1
46137371 Classic pfe-cos-cl-568-5-1
46137372 Classic pfe-cos-cl-569-5-1
46137373 Classic pfe-cos-cl-570-5-1
46137374 Classic pfe-cos-cl-571-5-1
46137375 Classic pfe-cos-cl-572-5-1
46137376 Classic pfe-cos-cl-573-5-1
46137377 Classic pfe-cos-cl-574-5-1
46137378 Classic pfe-cos-cl-575-5-1
46137379 Classic pfe-cos-cl-576-5-1
46137380 Classic pfe-cos-cl-577-5-1
46137381 Classic pfe-cos-cl-578-5-1
46137382 Classic pfe-cos-cl-579-5-1
46137383 Classic pfe-cos-cl-580-5-1
46137384 Classic pfe-cos-cl-581-5-1
46137385 Classic pfe-cos-cl-582-5-1
46137386 Classic pfe-cos-cl-583-5-1
46137387 Classic pfe-cos-cl-584-5-2
46137388 Classic pfe-cos-cl-585-5-1
46137389 Classic pfe-cos-cl-586-5-1
46137390 Classic pfe-cos-cl-587-5-2
46137391 Classic pfe-cos-cl-588-5-2
46137392 Classic pfe-cos-cl-589-5-1
46137393 Classic pfe-cos-cl-590-5-1
46137394 Classic pfe-cos-cl-591-5-2
46137395 Classic pfe-cos-cl-592-5-2
46137396 Classic pfe-cos-cl-593-5-2
46137397 Classic pfe-cos-cl-594-5-2
46137398 Classic pfe-cos-cl-595-5-2
142606336 Classic __jdhcpd_l3_tag__
142606337 Classic __dhcpv6_l3_tag__
Resolve Filters:
Index
As a recovery, we can deactivate the impacted filter applied under interface hierarchy (not the filter itself) and activate it back again, Once this is dene, pl recheck shell using the above command and check of the configured filter is programmed and indexed using
show filter command and show filter_hw<index> command- where the 'programmed' column should be 'YES'
eg-
(vty)# show filter [Mon Nov 4 15:51:10.577 LOG: Debug] Uplink SFP+ PIC(0), SFP 1: not Juniper supported SFP Program Filters: --------------- Index Dir Cnt Text Bss Name -------- ------ ------ ------ ------ -------- Term Filters: ------------ Index Semantic Name -------- ---------------- 1 Classic PROTECT_ABC<<<<<<filter is now seen 2 Classic PROTECT_RE 3 Classic PROTECT_XYZ 4 Classic PROTECT_LMN
(vty)# show filter hw 1 ====================== Filter index : 1 ====================== - Filter name : PROTECT_ABC + AE intf match list: + Programmed: YES<<<<<<<<<<<<<<<<<<<<<<<<<<<< programmed YES here