BFD sessions remained down after applying RFC 5884-compliant configuration to interop MPLS BFD sessions from ingress/other vendors to egress/Juniper. A configuration rollback was performed but still the session remained down 

Change snippet

set policy-options policy-statement UDP-4784 term INFRA_LOOPBACK from route-filter 10.185.94.0/24 orlonger

...

set policy-options policy-statement UDP-4784 term INFRA_LOOPBACK from route-filter 10.118.0.0/24 orlonger

set policy-options policy-statement UDP-4784 term INFRA_LOOPBACK from route-filter 10.118.30.0/24 orlonger

set policy-options policy-statement UDP-4784 term INFRA_LOOPBACK then mhop-bfd-port

set policy-options policy-statement UDP-4784 term INFRA_LOOPBACK then accept

...

set protocols mpls oam bfd-port import UDP-4784

TCPDUMP before the changes

root@LEAF1_RE> monitor traffic interface ae0 no-resolve matching "udp port 3784"

verbose output suppressed, use <detail> or <extensive> for full protocol decode

Address resolution is OFF.

Listening on ae0, capture size 96 bytes

00:28:14.670138 Out IP 10.118.0.177.49152 > 10.118.0.1.3784: BFDv1, One-hop Control, State Up, Flags: [none], length: 24

..

The changes applied caused BFD to use port 4784, which was not allowed in the RE loopback filter, resulting in the BFD packets being dropped. A configuration rollback was performed, but the BFD session continued using port 4784, so the rollback did not help. The issue was resolved only after flapping the MPLS LSP, which is the expected behavior.

TCPDUMP after the change

root@LEAF1_RE> monitor traffic interface ae0 no-resolve matching udp  

verbose output suppressed, use <detail> or <extensive> for full protocol decode

Address resolution is OFF.

Listening on ae0, capture size 96 bytes

01:33:29.209516 Out IP 10.118.0.177.49152 > 10.118.0.1.4784: BFDv1, Multi-hop Control, State Down, Flags: [none], length: 24

…

The session to port 4784 is not allowed on the RE filter - Routing_Engine_Firewall

root@LEAF1_RE> show configuration firewall family inet filter Routing_Engine_Firewall term BFD  

from {

  protocol udp;

  source-port 49152-65535;

  destination-port [ 3784 3785 ];

}

then {

  count BFD;

  accept;

}

root@LEAF1_RE> show configuration firewall family inet filter Routing_Engine_Firewall term BFD_LSP

from {

  source-prefix-list {

    CORE_LOOPBACK;

  }

  protocol udp;

  port 3503;

}

then {

  count BFD_LSP;

  accept;

}

root@LEAF1_RE> show configuration firewall family inet filter Routing_Engine_Firewall term BFD_o_BUNDLE

from {

  destination-port 6784;

}

then accept;

TCPDUMP after rolling back the change

root@LEAF1_RE> monitor traffic interface ae0 no-resolve matching udp  

verbose output suppressed, use <detail> or <extensive> for full protocol decode

Address resolution is OFF.

Listening on ae0, capture size 96 bytes

01:33:29.209516 Out IP 10.118.0.177.49152 > 10.118.0.1.4784: BFDv1, Multi-hop Control, State Down, Flags: [none], length: 24

…