Description

Filter was dropping the traffic. The filter was configured on output direction on an IRB.

 

{master:0}

root@EX> show configuration | display set | match JTAC_TEST              

set interfaces ge-0/0/2 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/4 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/6 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/8 unit 0 family inet filter output JTAC_TEST

set interfaces irb unit 41 family inet filter output JTAC_TEST

set firewall family inet filter JTAC_TEST term term1 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term1 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term1 from protocol udp

set firewall family inet filter JTAC_TEST term term1 from source-port term1

set firewall family inet filter JTAC_TEST term term1 then accept

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term2 then accept

set firewall family inet filter JTAC_TEST term term3 from source-address x.x.x.x/16

set firewall family inet filter JTAC_TEST term term3 from source-address x.x.x.x/16

set firewall family inet filter JTAC_TEST term term3 then accept

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/20

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term4 then accept

set firewall family inet filter JTAC_TEST term term5 from protocol ICMP

set firewall family inet filter JTAC_TEST term term5 then accept

set firewall family inet filter JTAC_TEST term DENY then count DROP

set firewall family inet filter JTAC_TEST term DENY then discard

 

Symptoms

{master:0}

root@EX> show configuration | display set | match JTAC_TEST              

set interfaces ge-0/0/2 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/4 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/6 unit 0 family inet filter output JTAC_TEST

set interfaces ge-0/0/8 unit 0 family inet filter output JTAC_TEST

set interfaces irb unit 41 family inet filter output JTAC_TEST

set firewall family inet filter JTAC_TEST term term1 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term1 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term1 from protocol udp

set firewall family inet filter JTAC_TEST term term1 from source-port term1

set firewall family inet filter JTAC_TEST term term1 then accept

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/32

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term2 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term2 then accept

set firewall family inet filter JTAC_TEST term term3 from source-address x.x.x.x/16

set firewall family inet filter JTAC_TEST term term3 from source-address x.x.x.x/16

set firewall family inet filter JTAC_TEST term term3 then accept

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/20

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term4 from source-address x.x.x.x/24

set firewall family inet filter JTAC_TEST term term4 then accept

set firewall family inet filter JTAC_TEST term term5 from protocol ICMP

set firewall family inet filter JTAC_TEST term term5 then accept

set firewall family inet filter JTAC_TEST term DENY then count DROP

set firewall family inet filter JTAC_TEST term DENY then discard

 

 

We need to match the exact prefix to be accepted in this filter so the traffic works per the filter configured.

We can add counters to evaluate the same for each term to verify the prefixes in each term.

Solution

Please add the exact prefix (y.y.y.y/24 and z.z.z.z/24) to one of the terms to accept the traffic.

Customer did not had these prefix as source-address in any of the terms in JTAC_TEST filter. Once added the traffic was accepted as intended.

Modification History

2025-04-03 : Article Created