Description

ISSUE :

Customers may experience unexpected firewall filter behavior when configuring loopback interfaces (lo0.0, lo0.220, etc.) with separate filters per VRF.

 

EXAMPLE SCENARIO: 

  • lo0.0 is assigned to the Default routing instance.
  • lo0.220 is assigned to the INTERNET routing instance.
  • Firewall filters are applied separately to each loopback unit:
    • IN_PROTECT_RE_v4 applied on lo0.220 (input).
    • ON_PROTECT_RE_v4 applied on lo0.0 (input).
  • When SSH is denied in IN_PROTECT_RE_v4 on lo0.220, SSH is unexpectedly blocked on lo0.0 as well.

    Symptoms

    Firewall filters on different loopback units affect all instances rather than being isolated per VRF.

    Solution

    EX4300 switches do not support per-VRF loopback filtering. Firewall filters applied to loopback interfaces are evaluated as a whole, rather than per individual VRF.

    Software Behavior Changes

    • Before PR 1775558 (e.g., 21.4R3-S5.4):
      • Firewall filters on loopback interfaces were processed in order from lowest to highest priority.
      • In this version, an SSH rule with a higher priority on lo0.0 would take effect even if another rule existed on lo0.220.

    • After PR 1775558:
      • Processing order changed to highest to lowest priority.
      • This change altered the behavior, causing filters on one loopback unit to affect all VRFs.

     

    The computations have changed in PR1775558, https://prsearch.juniper.net/problemreport/PR1775558 to prioritize the loopback filter from the interface filters. 

     

    SOLUTION:

    • Since per-VRF loopback filtering is not supported on EX4300, the recommended approach is to use a single, well-structured firewall filter for all loopback interfaces.
    • Starting with version 21.4R3-S12-X1, a commit error will occur if a customer attempts to configure a loopback filter across multiple VRFs.

    {master:1}[edit]

    labroot@switch# commit check

    [edit groups LOOPBACK interfaces lo0 unit 220 family inet filter input]

      'IN_PROTECT_RE_v4'
    Loopback filter does not support VRF/Multiple filters at Ingress.
    commit-check failed
    commit-check failed
    error: configuration check-out failed

     

     

    Modification History

    2025-03-06 : Article Created