This article explains one of the reason for seeing LFM session continuous flap with logs "802.3ah link-fault status changed to good" and "802.3ah link-fault status changed to fault with reason [Local unsatisfied]"
Topology
Core Network ---- MX Router --AE21 < LFM > AE21 -- ACX Router --- CPE
MX Router --- et-2/1/0 ---- et-0/1/0 ACX Router
MX Router --- et-9/1/0 ---- et-0/1/1 ACX Router
Junos
Model: acx5448
Junos: 22.2R3-S2.8
Model: mx960
Junos: 21.2X8.1
LFM session flaps and below logs are repeatedly appearing on ACX Router
Feb 14 08:39:48 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:49 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:49 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:50 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:50 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:51 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:51 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:52 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:52 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:53 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:53 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:54 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
Feb 14 08:39:54 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKDOWN: (et-0/1/0): 802.3ah link-fault status changed to fault with reason [Local unsatisfied]
Feb 14 08:39:55 2025 ACX Router lfmd[28628]: LFMD_3AH_LINKUP: (et-0/1/0): 802.3ah link-fault status changed to good
While troubleshooting, we noticed that router ACX Router is receiving LFM OAM packets from rogue MACs via ae21 and this is leading to LFM flaps on ae21. We have confirmed this by filtering the rogue MACs, and after that, the LFM session remained stable.
**Legitimate MACs**
- Upstream MX - et-2/1/0: XX:XX:XX:83:2d:7b
- Upstream MX - et-9/1/0: XX:XX:XX:83:31:fe
**Rogue MACs**
- XX:XX:XX:1a:21:af
- XX:XX:XX:1a:21:b0
labuser@ACX Router> monitor traffic interface et-0/1/0 no-resolve layer2-headers extensive matching "ether dst 01:80:c2:00:00:02"
May 07 04:51:58
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on et-0/1/0, capture size 96 bytes
04:51:58.930062 In XX:XX:XX:83:2d:7b > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:51:59.510128 In XX:XX:XX:1a:21:af > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46 << Rouge OAM Packet
04:51:59.930220 In XX:XX:XX:83:2d:7b > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:52:00.510213 In XX:XX:XX:1a:21:af > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:52:00.925192 In XX:XX:XX:83:2d:7b > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:52:01.522783 In XX:XX:XX:1a:21:af > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:52:01.925085 In XX:XX:XX:83:2d:7b > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
labuser@ACX Router> monitor traffic interface et-0/1/1 no-resolve layer2-headers extensive matching "ether dst 01:80:c2:00:00:02"
May 07 04:55:17
Listening on et-0/1/1, capture size 96 bytes
04:55:18.554283 In XX:XX:XX:1a:21:b0 > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46 << Rouge OAM Packet
04:55:18.570065 In XX:XX:XX:83:31:fe > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:19.545122 In XX:XX:XX:1a:21:b0 > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:19.570061 In XX:XX:XX:83:31:fe > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:20.560188 In XX:XX:XX:1a:21:b0 > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:20.571001 In XX:XX:XX:83:31:fe > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:21.646463 In XX:XX:XX:1a:21:b0 > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
04:55:21.646467 In XX:XX:XX:83:31:fe > 01:80:c2:00:00:02, ethertype Slow Protocols (0x8809), length 60: OAM, length 46
labuser@ACX Router> show ethernet-switching table | match "XX:XX:XX:1a:21:af|XX:XX:XX:1a:21:b0"
May 07 05:02:58
CPEMGMT XX:XX:XX:1a:21:af D - ae21.99 0 0
CPEMGMT XX:XX:XX:1a:21:b0 D - ae21.99 0 0
MSMGMT XX:XX:XX:1a:21:af D - ae21.88 0 0
MSMGMT XX:XX:XX:1a:21:b0 D - ae21.88 0 0
labuser@ACX Router# show | compare
May 07 05:41:31
[edit interfaces ae21]
+ unit 88 {
+ family ethernet-switching {
+ filter {
+ input JTAC_FW_Rouge_MAC;
+ }
+ unit 99 {
[edit firewall]
+ filter JTAC_FW_Rouge_MAC {
+ interface-specific;
+ term 10 {
+ from {
+ source-mac-address {
+ XX:XX:XX:1a:21:af/48;
+ XX:XX:XX:1a:21:b0/48;
+ destination-mac-address {
+ 01:80:c2:00:00:02/48;
+ then discard;
+ term 20 {
+ then accept;