Description

Firewall filter not blocking traffic as expected.


Symptoms

In some rare instances, the configured filter, either applied on loopback or on data ports, does not block traffic as expected.

This is a transient issue which is not yet root caused. It is not known if it happens during the first time config or broke all of a sudden when it was working.

In such cases, the shell can be checked and as mentioned in the below output, we can see that only the filters indexed are the default ones, but the manual filters like PRIOTECT_RE, etc are not seen


(vty)# show filter

Program Filters:

---------------

Index Dir Cnt Text Bss Name

-------- ------ ------ ------ ------ --------


Term Filters:

------------

Index Semantic Name

-------- ----------------

<---- No filters

57006 Classic __jdhcpd__

57007 Classic __dhcpv6__

65008 Classic __jdhcpd_l2_snoop_filter__

16777216 Classic fnp-filter-level-all

46137360 Classic pfe-cos-cl-557-5-1

46137361 Classic pfe-cos-cl-558-5-1

46137362 Classic pfe-cos-cl-559-5-1

46137363 Classic pfe-cos-cl-560-5-2

46137364 Classic pfe-cos-cl-561-5-1

46137365 Classic pfe-cos-cl-562-5-1

46137366 Classic pfe-cos-cl-563-5-1

46137367 Classic pfe-cos-cl-564-5-1

46137368 Classic pfe-cos-cl-565-5-1

46137369 Classic pfe-cos-cl-566-5-1

46137370 Classic pfe-cos-cl-567-5-1

46137371 Classic pfe-cos-cl-568-5-1

46137372 Classic pfe-cos-cl-569-5-1

46137373 Classic pfe-cos-cl-570-5-1

46137374 Classic pfe-cos-cl-571-5-1

46137375 Classic pfe-cos-cl-572-5-1

46137376 Classic pfe-cos-cl-573-5-1

46137377 Classic pfe-cos-cl-574-5-1

46137378 Classic pfe-cos-cl-575-5-1

46137379 Classic pfe-cos-cl-576-5-1

46137380 Classic pfe-cos-cl-577-5-1

46137381 Classic pfe-cos-cl-578-5-1

46137382 Classic pfe-cos-cl-579-5-1

46137383 Classic pfe-cos-cl-580-5-1

46137384 Classic pfe-cos-cl-581-5-1

46137385 Classic pfe-cos-cl-582-5-1

46137386 Classic pfe-cos-cl-583-5-1

46137387 Classic pfe-cos-cl-584-5-2

46137388 Classic pfe-cos-cl-585-5-1

46137389 Classic pfe-cos-cl-586-5-1

46137390 Classic pfe-cos-cl-587-5-2

46137391 Classic pfe-cos-cl-588-5-2

46137392 Classic pfe-cos-cl-589-5-1

46137393 Classic pfe-cos-cl-590-5-1

46137394 Classic pfe-cos-cl-591-5-2

46137395 Classic pfe-cos-cl-592-5-2

46137396 Classic pfe-cos-cl-593-5-2

46137397 Classic pfe-cos-cl-594-5-2

46137398 Classic pfe-cos-cl-595-5-2

142606336 Classic __jdhcpd_l3_tag__

142606337 Classic __dhcpv6_l3_tag__


Resolve Filters:

---------------

Index


Solution

As a recovery, we can deactivate the impacted filter applied under interface hierarchy (not the filter itself) and activate it back again, Once this is dene, pl recheck shell using the above command and check of the configured filter is programmed and indexed using

show filter command and show filter_hw<index> command- where the 'programmed' column should be 'YES'


eg-

(vty)# show filter [Mon Nov  4 15:51:10.577 LOG: Debug] Uplink SFP+ PIC(0), SFP 1: not Juniper supported SFP

Program Filters:
---------------
   Index     Dir     Cnt    Text     Bss  Name
--------  ------  ------  ------  ------  --------

Term Filters:
------------
   Index    Semantic    Name
--------  ----------------
       1  Classic   PROTECT_ABC<<<<<<filter is now seen
       2  Classic   PROTECT_RE
       3  Classic   PROTECT_XYZ
       4  Classic   PROTECT_LMN



(vty)# show filter hw 1  
======================
Filter index   : 1
======================

- Filter name  : PROTECT_ABC

  + AE intf match list: 
  + Programmed: YES<<<<<<<<<<<<<<<<<<<<<<<<<<<< programmed YES here




Modification History

2024-11-12 : Article Created