This KB explains on why the BFD packets are not getting syslogged in ACX-7100 though the firewall filter term has an action to syslog the discard packets.

Though the firewall filter has a term to log the discard traffic, when a BFD packet sent from Spirent traffic generator to ACX-7100 it is not being logged. Packets with other UDP ports are getting logged.

lab> show configuration firewall family inet6 filter TF_PROTECT-RE_6 term DISCARDV6    
then {
    count discard-all-v6;
    syslog;
    discard;



lab> show firewall filter TF_PROTECT-RE_6-lo0.0-i    

Filter: TF_PROTECT-RE_6-lo0.0-i                                
Counters:
Name                                                                            Bytes              Packets

discard-all-v6-lo0.0-i                                                        6625792                12941

The BFD packets with destination port 3784 and 6784 are not being logged. Tried with some other known protocols port number such as DNS, NTP and other BFD ports those are getting logged. See the logs below


lab clear-log[3430]: logfile cleared
lab evo-pfemand[10688]: FW: et-0/0/3.2104 D  UDP 2600:6ce3:1020:200::2 2001:506:100:f806::192  1024    53 (64 packets)
lab last message repeated 71 times
lab evo-pfemand[10688]: FW: et-0/0/3.2104 D  UDP 2600:6ce3:1020:200::2 2001:506:100:f806::192  1024   123 (26 packets)

The reason BFD packets from Spirent is getting dropped in the ASIC was not due to Lo0-ACL 'discard' but due to invalid UDP checksum. Even if the lo0 filter action is accept, this packet would be dropped in the asic.

PFE design for Logging is as below:
If the action is "accept", CPU take a copy of the original packet and send to host (discard-queue) for syslog. Original packet will go as destined.
If the action is "discard", CPU take the original packet itself to the host (discard-queue) for logging instead of the original destination. This avoids unwanted duplication of packet for syslog.

In this case also, since the filter action is discard we try change the destination of original packet to host (discard-q).
Since the packet itself is wrong packet with asic exception, device is not able to override the destination to host.
So the logging does not happen.

If a proper BFD packet is sent (IXIA), then no asic exceptions are packets are sent to host for log.
If the action is accept, then a copy is sent always so no issue in log.
In an ideal scenario of right packet, it will be logged.