The customer encountered some unexpected behavior with the MPC2s (Service Card) and header decapsulation.

They see that the filter isn’t applied/supported on an IPSec interface when applying header decapsulation:

dfwd[4923]: Filter (decap-test) applied on FTF-sp-10-0-0-discard(input) is not supported on Non TRIO FPCs and will not be applied on DPC, if any

Here’s the basics of the configurations:

Router>show configuration interfaces ms-2/0/0 unit 1

family inet {

filter {

input sp-10-0-0-discard;

}

}

service-domain inside;

Router>show configuration firewall family inet filter sp-10-0-0-discard

term decap {

from {

source-address {

1.1.1.1/32;

}

}

then {

decapsulate gre-in-udp;

}

}

Enable enhanced-ip mode using below CLI command in configuration:

#set chassis network-services enhanced-ip

2025-01-08 : Article Created

2026-06-15 : Mark to be external

https://www.juniper.net/documentation/us/en/software/junos/virtual-chassis-mx/topics/task/virtual-chassis-mx-series-enhanced-ip.html