Description

ISSUE: Output firewall filter not working in EX4100
ISSUE TRIGGER: New implementation. Never worked
ENVIRONMENT: Lab

TOPOLOGY:
EX4100-22 [xe-0/1/2.92] -------[xe-0/1/2.92] EX4100-23 [xe-0/1/0.2779] ----- [xe-0/1/0.2779] EX4100-3

DEVICES:
Model - EX4100
Code - 23.4R2-S3.9

TROUBLESHOOTING SUMMARY:
1. Customer is testing firewall filter in EX4100 with class of service (COS) configuration where outbound/output firewall filter is not working as expected.
2. This issue is seen in the lab testing and this is a new implementation and never worked.
3. As shown in the topology, issue is seen in the middle/transist device EX4100-23 where the firewall filter

Source: 1.1.1.1 residing in EX4100-22
Destination: 10.10.0.1 residing in EX4100-3

FIREWALL FILTER in EX4100-23 (transit device):

Output and input filters applied in egress of xe-0/1/0:
set interfaces xe-0/1/0 unit 2779 family inet filter input DEGRADADO_IN
set interfaces xe-0/1/0 unit 2779 family inet filter output DEGRADADO_OUT
set firewall family inet filter DEGRADADO_IN term FILTRA from destination-address 1.1.1.0/24
set firewall family inet filter DEGRADADO_IN term FILTRA then count DEGRADADO_IN_drop
set firewall family inet filter DEGRADADO_IN term FILTRA then accept
set firewall family inet filter DEGRADADO_IN term DEFAULT then count DEGRADADO_IN_no_drop
set firewall family inet filter DEGRADADO_IN term DEFAULT then accept
set firewall family inet filter DEGRADADO_OUT term FILTRA from source-address 1.1.1.0/24  <<< packets should match here and being count but they dont
set firewall family inet filter DEGRADADO_OUT term FILTRA then count DEGRADADO_OUT_drop
set firewall family inet filter DEGRADADO_OUT term FILTRA then discard
set firewall family inet filter DEGRADADO_OUT term DEFAULT then count DEGRADADO_OUT_no_drop
set firewall family inet filter DEGRADADO_OUT term DEFAULT then accept

Input/Ingress filter applied also in interface xe-0/1/2 (ping traffic classified as MULTIMEDIA):
set iinterfaces xe-0/1/2 unit 92 family inet filter input IBERCOM_IP <<<<<<<<<< input filter for CLASSIFY Packets as MULTIMEDIA
set firewall family inet filter IBERCOM_IP term MULTIMEDIA from source-address 1.1.1.0/24 <<<<< packets should match here
set firewall family inet filter IBERCOM_IP term MULTIMEDIA then loss-priority high
set firewall family inet filter IBERCOM_IP term MULTIMEDIA then forwarding-class MULTIMEDIA <<<<<< then MULTIMEDIA class
set firewall family inet filter IBERCOM_IP term RESTO then forwarding-class BRONCE

4. FILTER TEST OUTPUT from EX4100-23 (transit device):

TEST
ping from EX4100-22 to EX4100-3, the traffic goes through  EX4100-23 [xe-0/1/0.2779]

PING COMMAND
root@22> ping 10.10.0.1 source 1.1.1.1

OUTPUT
Per the egress/output filter (DEGRADADO_OUT) this traffic should be discarded and counted but it is not taking effect so ping works

root@22> ping 10.10.0.1 source 1.1.1.1
PING 10.10.0.1 (10.10.0.1): 56 data bytes
64 bytes from 10.10.0.1: icmp_seq=0 ttl=63 time=21.490 ms
64 bytes from 10.10.0.1: icmp_seq=1 ttl=63 time=25.778 ms
64 bytes from 10.10.0.1: icmp_seq=2 ttl=63 time=14.644 ms

root@23> show firewall filter regex DEG*
Filter: DEGRADADO_OUT
Counters:
Name                                                                            Bytes              Packets
DEGRADADO_OUT_drop                                                                  0                    0  <<< output packets are not counted
DEGRADADO_OUT_no_drop                                                               0                    0
Filter: DEGRADADO_IN
Counters:
Name                                                                            Bytes              Packets
DEGRADADO_IN_drop                                                              744862                 7027
DEGRADADO_IN_no_drop                                                                0                    0

5. I don't see filter programmed in the PFE

TFXPC0(23 vty)# show filter   
Program Filters:
---------------
   Index     Dir     Cnt    Text     Bss  Name
--------  ------  ------  ------  ------  --------

Term Filters:
------------
   Index    Semantic    Name
--------  ----------------
       1  Classic   DEGRADADO_OUT
       2  Classic   IBERCOM_IP
       3  Classic   DEGRADADO_IN
       4  Classic   CLASIFICACION
       5  Classic   PROTECCION_RE
   17000  Classic   __default_arp_policer__
16777216  Classic   fnp-filter-level-all
46137360  Classic   pfe-cos-l3-rw-578-p:2-t:4
46137361  Classic   pfe-cos-l3-rw-582-p:2-t:4
46137362  Classic   pfe-cos-l3-rw-584-p:2-t:4
46137363  Classic   DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-578-p:2-t:4
46137364  Classic   DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-582-p:2-t:4
46137365  Classic   DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-584-p:2-t:4

Resolve Filters:
---------------
   Index
--------
            
TFXPC0(23 vty)# show filter hw 46137363
======================
Filter index   : 46137363
======================

- Filter name  : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-578-p:2-t:4
- No hardware instance present

TFXPC0(23 vty)# show filter hw 46137364
======================
Filter index   : 46137364
======================

- Filter name  : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-582-p:2-t:4
- No hardware instance present

TFXPC0(23 vty)# show filter hw 46137365
======================
Filter index   : 46137365
======================

- Filter name  : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-584-p:2-t:4
- No hardware instance present

6. No matching PR's found for this issue.
7. Issue was replicated in the lab and PR1854188 was created for DEV to look into the issue.



Thank you,
Shruthi Subramani

Symptoms

COS filter not working as expected

Solution

Issue was further looked by DEV team and root caused to Rewrite and ERACL are in the same group. Rewrite having high priority than ERACL. Hence ERACL not working when rewrite is configured.
Fix for this issue will be available in the below releases.

Resolved-In
junos: 23.4R2-S5 junos:24.4R2 junos:25.1R1 junos:25.2R1

Modification History

2025-03-07 : Article Created