ISSUE: Output firewall filter not working in EX4100 ISSUE TRIGGER: New implementation. Never worked ENVIRONMENT: Lab TOPOLOGY: EX4100-22 [xe-0/1/2.92] -------[xe-0/1/2.92] EX4100-23 [xe-0/1/0.2779] ----- [xe-0/1/0.2779] EX4100-3 DEVICES: Model - EX4100 Code - 23.4R2-S3.9 TROUBLESHOOTING SUMMARY: 1. Customer is testing firewall filter in EX4100 with class of service (COS) configuration where outbound/output firewall filter is not working as expected. 2. This issue is seen in the lab testing and this is a new implementation and never worked. 3. As shown in the topology, issue is seen in the middle/transist device EX4100-23 where the firewall filter Source: 1.1.1.1 residing in EX4100-22 Destination: 10.10.0.1 residing in EX4100-3 FIREWALL FILTER in EX4100-23 (transit device): Output and input filters applied in egress of xe-0/1/0: set interfaces xe-0/1/0 unit 2779 family inet filter input DEGRADADO_IN set interfaces xe-0/1/0 unit 2779 family inet filter output DEGRADADO_OUT set firewall family inet filter DEGRADADO_IN term FILTRA from destination-address 1.1.1.0/24 set firewall family inet filter DEGRADADO_IN term FILTRA then count DEGRADADO_IN_drop set firewall family inet filter DEGRADADO_IN term FILTRA then accept set firewall family inet filter DEGRADADO_IN term DEFAULT then count DEGRADADO_IN_no_drop set firewall family inet filter DEGRADADO_IN term DEFAULT then accept set firewall family inet filter DEGRADADO_OUT term FILTRA from source-address 1.1.1.0/24 <<< packets should match here and being count but they dont set firewall family inet filter DEGRADADO_OUT term FILTRA then count DEGRADADO_OUT_drop set firewall family inet filter DEGRADADO_OUT term FILTRA then discard set firewall family inet filter DEGRADADO_OUT term DEFAULT then count DEGRADADO_OUT_no_drop set firewall family inet filter DEGRADADO_OUT term DEFAULT then accept Input/Ingress filter applied also in interface xe-0/1/2 (ping traffic classified as MULTIMEDIA): set iinterfaces xe-0/1/2 unit 92 family inet filter input IBERCOM_IP <<<<<<<<<< input filter for CLASSIFY Packets as MULTIMEDIA set firewall family inet filter IBERCOM_IP term MULTIMEDIA from source-address 1.1.1.0/24 <<<<< packets should match here set firewall family inet filter IBERCOM_IP term MULTIMEDIA then loss-priority high set firewall family inet filter IBERCOM_IP term MULTIMEDIA then forwarding-class MULTIMEDIA <<<<<< then MULTIMEDIA class set firewall family inet filter IBERCOM_IP term RESTO then forwarding-class BRONCE 4. FILTER TEST OUTPUT from EX4100-23 (transit device): TEST ping from EX4100-22 to EX4100-3, the traffic goes through EX4100-23 [xe-0/1/0.2779] PING COMMAND root@22> ping 10.10.0.1 source 1.1.1.1 OUTPUT Per the egress/output filter (DEGRADADO_OUT) this traffic should be discarded and counted but it is not taking effect so ping works root@22> ping 10.10.0.1 source 1.1.1.1 PING 10.10.0.1 (10.10.0.1): 56 data bytes 64 bytes from 10.10.0.1: icmp_seq=0 ttl=63 time=21.490 ms 64 bytes from 10.10.0.1: icmp_seq=1 ttl=63 time=25.778 ms 64 bytes from 10.10.0.1: icmp_seq=2 ttl=63 time=14.644 ms root@23> show firewall filter regex DEG* Filter: DEGRADADO_OUT Counters: Name Bytes Packets DEGRADADO_OUT_drop 0 0 <<< output packets are not counted DEGRADADO_OUT_no_drop 0 0 Filter: DEGRADADO_IN Counters: Name Bytes Packets DEGRADADO_IN_drop 744862 7027 DEGRADADO_IN_no_drop 0 0 5. I don't see filter programmed in the PFE TFXPC0(23 vty)# show filter Program Filters: --------------- Index Dir Cnt Text Bss Name -------- ------ ------ ------ ------ -------- Term Filters: ------------ Index Semantic Name -------- ---------------- 1 Classic DEGRADADO_OUT 2 Classic IBERCOM_IP 3 Classic DEGRADADO_IN 4 Classic CLASIFICACION 5 Classic PROTECCION_RE 17000 Classic __default_arp_policer__ 16777216 Classic fnp-filter-level-all 46137360 Classic pfe-cos-l3-rw-578-p:2-t:4 46137361 Classic pfe-cos-l3-rw-582-p:2-t:4 46137362 Classic pfe-cos-l3-rw-584-p:2-t:4 46137363 Classic DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-578-p:2-t:4 46137364 Classic DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-582-p:2-t:4 46137365 Classic DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-584-p:2-t:4 Resolve Filters: --------------- Index -------- TFXPC0(23 vty)# show filter hw 46137363 ====================== Filter index : 46137363 ====================== - Filter name : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-578-p:2-t:4 - No hardware instance present TFXPC0(23 vty)# show filter hw 46137364 ====================== Filter index : 46137364 ====================== - Filter name : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-582-p:2-t:4 - No hardware instance present TFXPC0(23 vty)# show filter hw 46137365 ====================== Filter index : 46137365 ====================== - Filter name : DEGRADADO_OUT-MERGE-pfe-cos-l3-rw-584-p:2-t:4 - No hardware instance present 6. No matching PR's found for this issue. 7. Issue was replicated in the lab and PR1854188 was created for DEV to look into the issue.
Thank you,Shruthi Subramani
COS filter not working as expected
Issue was further looked by DEV team and root caused to Rewrite and ERACL are in the same group. Rewrite having high priority than ERACL. Hence ERACL not working when rewrite is configured. Fix for this issue will be available in the below releases. Resolved-In junos: 23.4R2-S5 junos:24.4R2 junos:25.1R1 junos:25.2R1