This article explains a scenario, where the firewall counters are not being displayed even though they are configured. As you can see from below outputs,  the counter ‘block-ospf3’ is defined, yet it is not appearing in the output as expected.

[email protected]> show version 

Hostname: re0.labhost

Model: mx960

Junos: 21.2X8.1

...

[email protected]> show configuration firewall family inet6 filter v6-OSPF3 

term accept-OSPF3 {

  from {

    source-prefix-list {

      v6-ROUTER-INTERCONNECT;

      v6-LINK-LOCAL;

    }

    destination-prefix-list {

      v6-ROUTER-INTERCONNECT;

      v6-OSPF3-MULTICAST;

    }

    next-header ospf;

  }

  then {

    count accept-ospf3;

    accept;

  }

}

term block-OSPF3 {

  from {

    destination-prefix-list {

      v6-ROUTER-INTERCONNECT;

    }

    next-header ospf;

  }

  then {

    count block-ospf3;

    log;

    discard;

  }

}

[email protected]# run show firewall filter v6-OSPF3 

Filter: v6-OSPF3                        

Counters:

Name                        Bytes       Packets

accept-ospf3                      0          0

The issue was due to an empty or incorrect destination prefix list named v6-ROUTER-INTERCONNECT.

Below output indicates that the v6-ROUTER-INTERCONNECT is not matching to an prefixes or interface address

[email protected]> show configuration policy-options prefix-list v6-ROUTER-INTERCONNECT 

apply-path "interfaces <ae*> unit 0 family inet6 address <*/127>";

[email protected]> show configuration policy-options prefix-list v6-ROUTER-INTERCONNECT |display inheritance 

##

## apply-path was expanded to:

##

apply-path "interfaces <ae*> unit 0 family inet6 address <*/127>";

Modified prefix-list v6-ROUTER-INTERCONNECT as below. With this change, prefix-list v6-ROUTER-INTERCONNECT is now able to match prefixes

[email protected]# show | compare 

May 07 07:31:31

[edit policy-options prefix-list v6-ROUTER-INTERCONNECT]

-  apply-path "interfaces <ae*> unit 0 family inet6 address <*/127>";

+  apply-path "interfaces <[agxe][et]*> unit 0 family inet6 address <*/127>";

[email protected]> show configuration policy-options prefix-list v6-ROUTER-INTERCONNECT |display inheritance 

##

## apply-path was expanded to:

##   XXXX:X000:0:X::X:4c/127; 

##   XXXX:X000:0:X::X:4e/127; 

##

apply-path "interfaces <[agxe][et]*> unit 0 family inet6 address <*/127>";

[email protected]> show firewall filter v6-OSPF3 

May 07 07:51:15

Filter: v6-OSPF3                        

Counters:

Name                        Bytes       Packets

accept-ospf3                      0          0

block-ospf3                       0          0