Description

This document details a critical issue reported by one of our customer. They have received feedback from multiple end users indicating that they are unable to reach certain destinations. 


This problem appears to have arisen following the customer's decision to decommission an existing device and upgrade to the Juniper PTX EVO router. The newly brought up PTX EVO router is connected to another border router (PTX10K16) and using filters, we've managed to narrow down the issue to this border router. 


Model: ptx10016

Junos: 21.4R3-S5.4



Symptoms

1. Pings to the destination are failing.


2. On the border router (PTX10K16), we are seeing high rates of traps associated with FPC4, which is holding member links of the AE bundle. The following entries were noted during this time:


2 ( 161) flt.Dispatcher.rule_deny            41834667        38150   

3 ( 161) flt.Dispatcher.rule_deny            63502435        58921   

4 ( 161) flt.Dispatcher.rule_deny            20982605        19090   

5 ( 161) flt.Dispatcher.rule_deny            21230548        20976  


Solution

We observed that the peering interface has been set up with an RPF filter, and we are experiencing RPF filter drops. We believe the root cause of these drops is related to asymmetric routing. The border router is currently relying solely on a default route to reach external destinations, with the next hop directed towards the new PTX10K EVO router for external destination. This routing setup likely contributes to the RPF filter drops we are observing.


We found a resolution by advertising specific routes from the PTX10K EVO router to the border router.




Below are from a lab router to depict configuration and relevant outputs 


1. RPF Filter Configuration 


set interfaces ae1048 unit 0 family inet rpf-check fail-filter RPF_IPV4_FILTER

set interfaces ae1048 unit 0 family inet rpf-check mode loose


set firewall family inet filter RPF_IPV4_FILTER term DISCARD from prefix-list DEFAULT_IPV4_NETS

set firewall family inet filter RPF_IPV4_FILTER term DISCARD then count IPV4_RPF_DISCARDED_PACKETS

set firewall family inet filter RPF_IPV4_FILTER term DISCARD then discard


set policy-options prefix-list DEFAULT_IPV4_NETS 0.0.0.0/0



2. Topology and Outputs 



Modification History

2025-02-22 : Article Created