A firewall filter with a counter that is applied to the out-of-band management interface of an ACX7348 (re0:mgmt-0) is not seeing the counter tied to a policer increment even though traffic is hitting the term and being policed.

The filter in this case has a term to match on SSH with a policer and a count:

set firewall family inet filter Protect-Mgmt interface-specific
set firewall family inet filter Protect-Mgmt term ssh from source-prefix-list mgmt-net
set firewall family inet filter Protect-Mgmt term ssh from protocol tcp
set firewall family inet filter Protect-Mgmt term ssh from port ssh
set firewall family inet filter Protect-Mgmt term ssh then policer management-1m
set firewall family inet filter Protect-Mgmt term ssh then count count-ssh
set firewall family inet filter Protect-Mgmt term ssh then accept

Policer configuration:

set firewall policer management-1m if-exceeding bandwidth-limit 1m
set firewall policer management-1m if-exceeding burst-size-limit 625k
set firewall policer management-1m then discard

Filter is attached to re0:mgmt-0:

set interfaces re0:mgmt-0 unit 0 family inet filter input-list Protect-Mgmt
set interfaces re0:mgmt-0 unit 0 family inet filter input-list accept-icmp
set interfaces re0:mgmt-0 unit 0 family inet filter input-list accept-traceroute
set interfaces re0:mgmt-0 unit 0 family inet filter input-list Protect-Mgmt-last

Traffic is policed correctly, with the count for SSH incrementing, but not the policer counter:

jnpr@SFE-3-re0> show firewall filter re0:mgmt-0.0-inet-i

Filter: re0:mgmt-0.0-inet-i
Counters:
Name Bytes Packets
count-icmp-re0:mgmt-0.0-inet-i 0 0
count-ssh-re0:mgmt-0.0-inet-i 1102574720 27564368     << Increments
dropped-packets-re0:mgmt-0.0-inet-i 0 0

Policers:
Name Bytes Packets
management-1m-accept-dns-re0:mgmt-0.0-inet-i 0 0
management-1m-accept-icmp-re0:mgmt-0.0-inet-i 0 0
management-1m-ssh-re0:mgmt-0.0-inet-i 0 0         << Working, but not incrementing

Note that when the policer is configured as "filter-specific", the policer counter increments.

The problem is fixed in PR184437:

https://prsearch.juniper.net/PR1844737

As a workaround, if the filter is not attached as an input-list, the problem will not be seen.