Article Detail

Alert Type

SRN - Software Release Notification

RiskRisk Description

Low/Notification

Software Release Notification

ImpactImpact Description

Low/Notification

Software Release Notification

Product Affected

ACX, EX, MX, NFX, PTX, QFX, VMX, VRR

Alert Description

Junos Software Service Release version is now available for download from the Junos software download site
Download Junos Software Service Release:

Go to Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 17.3R3-S3 is now available.

17.3R3-S3 - List of Fixed issues

PR Number	Synopsis	Category: DCHP
1369785	MAC move might occur in DHCP security scenario.	On EX4300/EX4600/QFX Series switches except QFX10000, with DHCP security enabled, if the DHCP packets from DHCP clients are received from the DHCP snooping trust interface (by default, all trunk ports on the switch are trusted), such packets might be sent back on the same interface, resulting in the MAC move of the source MAC on the other L2 devices.
		Category: EX4300 PFE
1376804	ECMP route installation failure with log messages like unilist install failure might be observed on EX4300 device	On EX4300 devices with two ECMP interfaces, if multiple iteration happens for one interface link goes down/up, stale ECMP entries might not be deleted and still be seen in hardware due to the next-hop delete failure and unilist install failure.
1392082	EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVE-2019-0048)	On the EX4300 Series, when a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVE-2019-0048); Refer to https://kb.juniper.net/JSA10942 [juniper.net] for more information.
		Category: Marvell based EX PFE L3
1376057	Traffic null route with indirect next hop and load balancing	On EX4300/EX4600/QFX Series switches except for QFX10000, pass-through traffic might be dropped if using multiple routes with indirect next hop and load balancing.
		Category: EX9200 Control Plane
1316272	Replace "show vlans evpn" command to "show ethernet-switching evpn " command for EX92xx and QFX	"show ethernet-swtching evpn" command used in EX92xx and QFX is now replaced with "show vlans evpn " command.
		Category: EX9200 Platform
1364246	FPM board status is missing in SNMP MIB walk result.	On EX9xxx, or MX240/480/960 platforms with FPM board, FPM board status is missing in SNMP walk result.
		Category: HW Board, FPGA, CPLD issues
1372041	PFE is in a bad state after performing optics insertion/removal on a port.	On QFX5000 Series platforms, performing optics insertion/removal on a port might result in the PFE Manager CPU spike and eventually microcode failure.
		Category: QFX L2 Protocols Control Plane related
1390573	The vmcore might be seen when routing changes are made on the peer spine in an EVPN-VXLAN scenario.	On all QFX-Series platforms with a standard EVPN VXLAN scenario, when the eBGP is used for underlay and iBGP for the overlay, the OSPF neighborship is established between two IRBs on the spines, upon exporting OSPF routes on any of the spines, as a result, a routing loop might occur on the spine once it receives the OSPF route update and causes the Routing Engine to have a kernel crash with a vmcore generated on the peer spine.
1394380	L2ALD core seen when l2-learning traceoptions were enabled.	L2ALD core may be seen when l2-learning traceoptions are enabled. This occurs due to a race condition when l2ald log file is getting rotated and simultaneously l2ald trying to write a new trace log message. Issue may not get reproduce easily.
		Category: QFX PFE CoS
1354377	The packets with destination-address 224.0.0.0/4 cannot be matched by loopback filter	Firewall filter cannot filter packets with DstIP as 224/4 and DST MAC = QFX_intf_mac on loopback interface using a single match condition for source address 224.0.0.0/4.
		Category: QFX PFE L2
1354889	Storm control configuration may be disabled for the interface	When QFX5100 is initialized, in rare condition, if storm control is configured on the interface, it might not work as expected. The traffic levels will not be monitored and the unknown unicast packets will not be dropped.
1354889	Storm control configuration may be disabled for the interface	When QFX5100 is initialized, in rare condition, if storm control is configured on the interface, it might not work as expected. The traffic levels will not be monitored and the unknown unicast packets will not be dropped.
1377521	DHCP Discover packets might be dropped if there is VXLAN configured	On QFX5000/EX4600 platforms, if changing an interface from Virtual Extensible Local Area Network (VXLAN) to a member of an Aggregated Ethernet (AE) interface, the Dynamic Host Configuration Protocol (DHCP) relay would not work and the DHCP client would not get IP address normally.
1397229	QFX5k - symmetric hash	This fix allows to configure the hash function such that packets belonging to the same flow receive the same hash in back and forward direction. This is a requirement when state-based applications are connected via link/LAG bundles to the device which require that both traffic directions of the same flow is being forwarded on the same physical interface to operate properly. To enable symmetric hashing configure: "set forwarding-option enhanced-hash-key no-incoming-port"
1398251	On QFX5K platforms, the DCPFE process might core-dump on interface specific events	On QFX5K platforms, the DCPFE process might core-dump on interface specific events due to a deadlock situation between the pfeman thread and the linkscan thread that causes the watchdog event to trigger.
		Category: QFX L3 data-plane/forwarding
1367584	When VRF fallback is enabled, running "show pfe route ip hw lpm" may crash the switch	When VRF fallback is enabled, running "show pfe route ip hw lpm" may crash the switch
		Category: QFX PFE MPLS
1362936	QFX5210: MPLS LSP ingress statistics not incrementing / zero	Statistics of transit traffic does not increment LSP statistics signaled by RSVP-TE.
1390445	LSP "statistics" and "auto-bandwidth" functionality may not take effect with single hop LSPs	In an Multiprotocol Label Switching (MPLS) scenario, label-switched path (LSP) "statistic" and "auto-bandwidth" functionality may not take effect with single hop LSPs on QFX10000 platform.
		Category: Accounting Profile
1392550	The filter counter is not written to the accounting file when accounting is enabled on the bridge firewall filter.	Whenever bridge firewall filter is configured and accounting is enabled on it, the filter counter is not written to the accounting file.
1452363	The pfed might crash and not be able to come up on the PTX or TVP platforms	The flow label statistics are retrieved periodically by pfed for PTX or TVP platforms, if the statistics reply becomes very big number, the pfed might crash hence affecting traffic.
		Category: ACX Interfaces IFD, IFL, vlans, and BRCM init
1328207	Port XE-0/3/0 did not turn UP	The EEPROM contents were not read properly when 1gig SFP was plugged into a 10gig mic. Therefore a check is done to see if the contents are read properly or not.
1393947	[ACX] MTU is not properly applied - and output of - ping mpls l2circuit sweep is giving lower values than expected	On ACX1x00/ACX2x00/ACX4x00 the MPLS MTU value is derived from the INET family MTU.
		Category: ACX Services feature
1393729	Certain builds of Junos OS do not allow you to upgrade or commit configuration changes when the SI service interface is used.	Certain builds of JUNOS do not allow you to upgrade or commit config changes when the SI service interface is used. 17.2R3, 17.4R2, 18.1R3, 18.2R2, 18.3.R1, 16.1R8, 16.2R3 are known to encounter this issue.
		Category: "agentd" software daemon
1326366	Executing "commit full" might cause disconnection from Streaming Telemetry	In streaming telemetry scenario, when performing "commit full", the na-grpd daemon might restart, causing disconnection of streaming telemetry.
1390740	An incorrect error message might be seen when Jflow sensors are configured with reporting rate less than 30 seconds.	On all TVP platforms for QFX devices (QFX10000, QFX5100, QFX5200 platforms), when Jflow sensors are configured with reporting rate less than 30 seconds, the error message was incorrect.
1394927	WITHDRAWN: Junos OS: gRPC hardcoded credentials may allow unauthorized access to systems with Junos Network Agent installed (REJECTED)	NO RISK. CVE REJECTED. 04-11-2019: Further investigation has determined that this issue has no impact. While the credentials exist in affected releases there is no way to exploit this issue, and even if the issue were exploitable, there would be no impact. Refer to https://kb.juniper.net/JSA10923 [juniper.net] for more information.
		Category: MPC Fusion SW
1350098	The MPC might crash when the MIC is removed.	When the MIC is removed from the MPC, the MPC might crash.
		Category: access node control protocol daemon
1405318	Configuration load override or load replace resets ANCP neighbors.	In ANCP (Access Node Control Protocol) scenario, if executing configuration load override or replace, after the commit operation, All ANCP neighbour sessions might be restarted, even though without any ANCP configuration change.
		Category: MX Layer 2 Forwarding Module
1377749	In EVPN A-A scenario with an MX Series or EX Series device acting as a PE device,flood next hops to handle BUM traffic may not get created or miss certain branches when the configuration is performed in a particular sequence.	In EVPN A-A scenario with MX or EX acting as PE device,flood NHs to handle BUM traffic may not get created or miss certain branches when the configuration is performed in a particular sequence
1388454	The LSI binding for the IPv6 neighbor is missing.	On ACX, EX, MX, QFX and Virtual Chassis Fabric platform, if irb interface is configured under VPLS instance, after switchover the lsi binding for the IPv6 neighbor might be missing.
		Category: MX SCB software
1399744	No Alarm was generated when FPC connected to primary RE via backup RE/CB	The fix produces alarm on the RE if the communication from RE to one or more FPC is failed through primary interface and establishes the communication via backup RE.
		Category: BBE Autoconfigured DVLAN related issues
1359520	The IPv6 subscriber may fail to access network	The IPv6 subscriber may not be authenticated successfully and fail to access network because of missing attributes (agent-circuit-id & agent-remote-id) for radius-access-request packets if they are the needed parameters for radius authentication.
1386662	In subscriber management environment, DHCP subscriber might get stuck in terminated state.	In subscriber management environment DHCP Subscriber might get stuck in terminated state, if If SDB was unavailable during the dvlan session is logging out, an SDB failure can occur. When that error happens, the processing for that session is stalled, leaving the dvlan stranded.
		Category: BBE dynamic profile related issues
1391562	The bbe-smgd process might crash after commiting configuration changes.	In enhanced subscriber management environment, the bbe-smgd process might crash after commiting config changes, especially when some parts of the dynamic-profiles are modified.
		Category: BBE GRES related issues
1375070	Few L2BSA subscribers might be stuck in init/terminating/terminated status after previous logout.	On MX platforms with Access Node Control Protocol(ANCP) triggered dynamic L2 subscriber management (L2BSA Service) scenario, if scaled L2BSA subscribers (e.g. 20K) login and logout repeatedly, together with other stressful operations, e.g. Graceful Routing Engine Switchover(GRES), some daemon restart (e.g. bbe-smgd, authd, dfwd, cosd, etc.), or Flexible PIC Concentrator(FPC) reboot, few L2BSA subscribers might be stuck in init/terminating/terminated status due to this issue. These affected subscribers can't login again after previous logout.
		Category: BBE interface related issues
1403480	Smg-service could become unresponsive when doing some GRE-related CLI operations.	On BNG (Broadband Network Gateway) or subscriber scenario, when doing GRE related CLI operations and config commit, smg-service could become unresponsive and the bbe-smgd core might happen. The effect detail depends on if there is a crash and what is happening during a crash. Generally it would not cause a crash, but if the resulting concurrent access occurs, it might lead to a crash, thus the bbe-smgd would restart and restore state. In the meantime the service might be affected but it would be temporary.
		Category: BBE multicast related issues
1374530	The bbe-smgd might crash continuously in centralized IGMP scenario.	In enhanced subscriber management scenario with centralized IGMP configuration, after the last subscriber of a multicast group leaves that group and in some rare cases the bbe-smgd could not delete the multicast group node from the tree, this insistent state of the node causes the bbe-smgd process to restart. However, when the bbe-smgd restarts in init phase, it would try to delete that multicast node again, this inconsistent state results in bbe-smgd restarting again, so the bbe-smgd could never come out of the init phase and it restarts continuously.
1384491	Multiple bbe-smgd core files with reference to bbe_mcast_vbf_dist_policy_service_encoder( ).	When commit, any changed policy was being pushed to PFE even if the policy is not used (installed in the PFE). This caused bbe-smgd process to restart unexpectedly at the bbe_mcast_vfb_dist_policy_service_encoder() routine.
		Category: BBE network stack related issues
1388595	The bbe-smgd might not respond to the NS message for the SLAAC client on dynamic VLAN.	On all MX-Series with dynamic VLAN and NDRA deployment for the subscriber access, the SLAAC (Stateless Address Autoconfiguration) client might not get the gateway MAC address from the BNG (Broadband Network Gateways), as a result, the SLAAC client will not get a link-local prefix and the IPv6 global connectivity will not be established.
		Category: BBE OS Infrastructure library
1414333	DHCP/DHCPv6 subscribers might fail to establish sessions on PowerPC based MX platforms	On MX5/10/40/80/104 platforms running with Dynamic Host Configuration Protocol version 4/version 6 (DHCPv4/v6) subscribers, if large-scale subcribers (e.g. around 3500 in total) try to establish sessions simultaneously from multiple access interfaces, the DHCPv4/v6 sessions might always fail to set up due to this issue. As a result, the session set up rate would be much lower than expected.
		Category: BBE state synchronization issues
1380231	The Routing Engines might crash with various core files due to the deadlock issue on the SDB STS.	In the system that uses session database (SDB), the deadlock might happen when getting the lock on the SDB short term storage (STS) due to a rare timing issue. It is more likely to happen on Enhanced Subscriber Management environment with large-scale subscribers (such as 50k subscribers). The issue will cause the primary Routing Engine (RE) to crash with various core files and lose the management connectivity. And the subscriber service could be affected. The issue might happen on single RE system as well as dual RE system. In the dual RE system, the primary RE crash could trigger a RE switchover. But the issue could cause the incomplete state on the SDB in the new primary RE, which could cause the subscribers login failure. A restart of smg-service on the new primary RE will recover this login issue.
		Category: Border Gateway Protocol
1391084	Race condition causes all the BGP sessions to flap after NSR switchover	With GRES and NSR enabled, if executing switchover, in very rare cases, all the BGP session might flap because of a race condition.
1391767	Non-BGP protocol route with an AS PATH might cause inappropriate route selection	Rpd's route selection mechanism has multiple user-configurable mechanisms by which route ordering may be changed. To assist with debugging issues with defects in the route selection code, a function would generate a low priority soft core that didn't crash rpd when route selection was incorrect. However, there have been circumstances wherein not-best was incorrectly being determined. One such situation that is addressed in this PR involves when routes are learned or redistributed from non-BGP protocols and had an AS_PATH attribute. Using BGP route selection rules, if a BGP route and a non-BGP route had a leading AS_PATH with the same AS, BGP MED selection rules for grouping were being applied. Such MED election should only be done using BGP-only routes. Such a situation can come from various BGP carried VPN protocols wherein routes from the VPN protocol generated IPv4 routes when redistributed from one routing instance to another. An example of this would be an EVPN route.
1395098	The best and the second-best routes might have the same weight value if BGP PIC is enabled	In BGP PIC (Prefix Independent Convergence) scenario, next-hop of unequal BGP multipath routes might have the same weight (0x1), resulting in unexpected load balance for traffic.
1398685	The rpd soft core files and inappropriate route selection might be seen when Layer 2 VPN is used	The rpd provides a mechanism to validate that route selection has successfully been done. When errors in route selection are detected, a soft core is dropped: the rpd remains running, a single core file is dropped, it is rate limited to not do this frequently. When running L2VPN, BGP MED selection may be inappropriately run on the routes. As a result, a soft core is created, and features that rely on skipping such routes such as BGP add-paths, may advertise an alternate path that is inappropriate.
1398700	The process rpd might crash in BGP setup with NSR enabled.	The routing protocol daemon (rpd) may restart when BGP teardown a peer when the peer's "prefix-limit" is exceeded. This issue is applicable when the "non-stop-routing" feature is configured.
1399141	Junos OS: BGP packets can trigger rpd crash when BGP tracing is enabled. (CVE-2019-0019)	Junos OS: BGP packets can trigger rpd crash when BGP tracing is enabled. (CVE-2019-0019); Refer to https://kb.juniper.net/JSA10931 [juniper.net] for more information.
1400838	EX4300 might drop incoming ISIS hello packets when IGMP or MLD snooping is configured.	On EX4300 platform, when IGMP or MLD snooping is enabled, and ESIS/ISIS packets with below destination multicast mac-address are received, ESIS/ISIS packets are not flooded. It would cause ISIS adjacency establish failure. The MAC-level point-to-point addresses are: 09-00-2B-00-00-04 (AllEndSystems) 09-00-2B-00-00-05 (AllIntermediateSystems)
		Category: BBE Remote Access Server
1374295	Address pool does not correctly cycle to the beginning of the pool when linked-pool-aggregation parameter is defined	In subscriber scenario, when "linked-pool-aggregation" is enabled on MX platform and standalone IPv4/IPv6 pool is in use, the address pool might not cycle to the beginning of the pool and it might report "Out of Addresses" even though not all addresses are in use.
1376265	The subscribers might be stuck in terminating state if RADIUS redirect is used.	On MX-Series platforms that act as a Broadband Network Gateway (BNG), the subscribers might be stuck in terminating state if radius redirect is used during the Session Database (SDB) synchronization.
1382074	The value of 'predefined-variable-defaults routing-instances' overrides the RADIUS-supplied VSA (26-1 Virtual-Router)	If the default value for the $junos-routing-instance predefined variable is configured (i.e. 'dynamic-profiles <> predefined-variable-defaults routing-instances <>'), the subsciber will come up in the configured default routing-instance even if RADIUS has already supplied the VSA of '26-1 Virtual-Router'.
1384599	Log Message: authd: gx-plus: logout: wrong state for request session-id	When a Subscriber is Manually Logged out using CLI "clear network-access aaa subscriber username ", Following Log Message gets Printed (messages file) in process of when GX-Plus Module is Clearing/Freeing up the Subscriber Session-id from its Table. Aug 28 12:11:50 jtac-test-node: authd [XXXX]: %DAEMON-3: gx-plus: logout: wrong state for request session-id:
1391411	Usage-Monitoring-Information AVP might activate service accounting.	Usage-Monitoring-Information AVP as part of PCRF gx-plus provisioning is causing service accounting activation.
1403835	JSRC used Radius Service accounting protocol instead of JSRC for SRC installed service	JSRC provisioned service used Radius Service accounting protocol instead of JSRC for SRC installed service
		Category: MX Platform SW - Environment Monitoring
1395539	The minor alarm of "Bottom Fan Tray Pred Fail" might be wrongly raised when the fan speed is at high speed on MX960	On the MX960 a check of the "actual" fan speed is compared to the "set" fan speed. If the difference between the actual fan speed and the set fan speed is greater than 20% the system uses this to predict that the fan might be about to fail. When the fans are set to run in high speed mode, some deviation from the set fan speed is expected to occur with the fans and it is expected to sometimes see a deviation greater than 20%. Going forward this 20% tolerance check will be disabled while running in high speed mode.
		Category: MX Platform SW - FRU Management
1375242	SFB and PDM/PSU related information is missing in jnxBoxAnatomy MIB on high end MX Series routers (MX2010/2020).	SFB and PDM/PSU related info is missing in jnxBoxAnatomy MIB on high end MX routers (MX2010/2020).
		Category: Virtual-chassis platform/chassisd infrastructure PRs for MX
1391011	Interim accounting updates might not be sent for subscribers after Junos OS selective update	On MX/MXVC platforms enabled with enhanced subscriber management, if Graceful Routing Engine Switchover (GRES) and Nonstop active Routing (NSR) are disabled, when the chassisd process is going to restart (which is resulted from Junos Selective Update), the system will make the transition of Routing Engine (RE) mastership from master to standby before the chassisd process restart. Due to this issue, the new standby RE didn't reboot as expected, which causes the pfed process being passive for 15 minutes. During the 15 minutes, all the interim accounting update will not sent for all the subscribers who login during this time range.
		Category: PTX Chassis Manager
1301835	In JVision setup, the payload MTU(maximum transmission unit) might be much less than 16KB when subscribing to component sensor	RE sensors have a payload MTU of 16KB per packet, however 2.6KB is seen in JVision setup when subscribing to component sensor.
1315672	Memory leak in chassisd daemon might be noticed while streaming telemetry subscriptions are active	Memory leak in chassisd daemon is noticed while streaming telemetry subscriptions are active.
		Category: MX Platform SW - ukern core dumps
1273353	Flexible PIC concentrator (FPC) crash/reboot is observed when bringing up about 12K Layer 2 Bit Stream Access(L2BSA) subscribers simultaneously.	In an L2BSA scaling scenario, after bringing up about 12,000 subscribers, one or more FPCs will reboot.
		Category: Class of Service
1375189	The 802.1P rewrite might not work on inner VLAN.	If a logical interface (IFL) is configured with 802.1P rewrite-rules (for both outer and inner VLAN) and fixed classification, after deactivating Class of Service (CoS) on any other IFL, the packets sent from this IFL may still have the original 802.1P bit set in the inner VLAN without being rewritten.
1403147	The cosd process might crash during committing configuration change through NETCONF.	If excess-priority is configured, the cosd process might crash during committing configuration change which includes assigning CoS profile on any logical interface via netconf.
		Category: Enhanced Broadband Edge support for cos
1405876	FPC crash might be seen when adding or deleting a leg to an AE bundle or FPC restarts in subscriber scenario	In subscriber scenario, when using AE bundle with active subscribers and the AE bundle is configured with a lot of interfaces within one interface-set, FPC might crash if adding a leg to an AE bundle or an existing leg is replayed (after FPC restarts). It is a timing issue. In detail, this issue happens in two scenarios. The first one is "a leg is added to an AE bundle". That can cause a FPC crash as the device may perform a long walk to install schedulers on all legs. The second one is 'a line card rebooting'. After FPC reboot, the bundle is updated locally on that line card as it is populated with all of the existing state. In this case a long walk would also be performed and FPC crash might be seen.
1422542	The CoS IEEE-802.1 classifier might not get applied when it is configured with service activation on underlying interface.	In a subscriber management environment, the Class-of-Service (CoS) ieee-802.1 classifier might not get applied when it is configured with service activation on underlying-interface. Instead, the default IP Precedence classifier would be applied.
		Category: QFX Access Control related
1363964	On EX4300/EX4600/QFX3500/QFX3600/QFX5000 platforms, the l2ald process might crash in dot1x scenario	On EX4300/EX4600/QFX3500/QFX3600/QFX5000 platforms, during any client's dynamic VLAN membership creation in a dot1x scenario, the l2ald process might crash.
		Category: Device Configuration Daemon
1322678	Subscribers might fail to access the device after deleting the needless aggregated Ethernet configuration.	In subscriber management scenario with Dynamic Demultiplexing Interfaces(DEMUX) configured, in the case where subscribers belonging to one AE interface are migrated to a new configured AE interface, subscribers may fail to access the device after deleting the old AE configuration.
1336455	Momentary traffic loss might happen when a GRES is performed.	Momentary traffic loss might happen when performing GRES. The traffic lost last about 10 sec. After that, it works normally.
1369757	Constant dcpfe process crash might be seen if using an unsupported GRE interface configuration	On QFX platform, if configuring GRE interface and its underlying tunnel source interface in two different routing instances, although this is a limitation, but the configuration can be committed and will cause constant dcpfe process crash.
1373927	JDI-RCT: QFX5200 MCLAG: parse_remove_ifl_from_routing_inst() ERROR : No route inst on et-0/0/16.16386, errors seen after restart l2cpd daemon	JDI-RCT: QFX5200 MCLAG: parse_remove_ifl_from_routing_inst() ERROR : No route inst on et-0/0/16.16386, errors seen after restart l2cpd daemon
1376216	Race condition during Routing Engine mastership transition might cause improper deletion/recreation of logical interface em0.0 Interface family address.	Race condition during RE mastership transition may cause improper deletion/recreation of IFL em0.0 Interface family address. This may impact primary Routing-engine communication to other FRU/Routing-engine via the Juniper private routing-instance resulting in un-stable state of the router in GRES environment.
1387962	DCD core files can be seen after FPC restart if channelized interfaces are configured.	If channelized interface coc1 is configured and FPC restart is performed then a core will generate and DCD restart can be seen. Currently we do not have any workaround for this issue. In case of all other interfaces core will not generate and normal behavior is seen.
1425339	The logical interfaces in EVPN routing instances might flap after committing configurations.	When EVPN (Ethernet VPN) routing instance is created, there is an implicit bridge domain created for this EVPN. After creating another routing instance, the index of the implicit bridge domain created for EVPN is not updated properly in DCD. Therefore, the IFLs in EVPN routing instances might flap. [TSB17573 [juniper.net]]
1439257	Targeted-distribution for static demux interface over aggregate Ethernet interface does not take correct LACP link status into consideration when choosing primary and backup links.	The value of "lacp-port-mode" (or LACP mode on child-links of AE bundle) is always "0", irrespective of whether LACP is turned ON or OFF on AE bundle. Whereas the expectation is that as per the LACP mode (OFF/ACTIVE/PASSIVE) present on AE bundle, the same should be propagated to child-links. Since the lacp mode was not propagated to child links, Device Control Daemon (DCD) used to assign the links to subscribers only based on its physical status. But there were few links which were physically UP but lacp down, so traffic disrupted.
		Category: JUNOS Dynamic Profile Configuration Infrastructure
1401148	The framed route beyond the first might not be installed in a DHCP subscriber management environment.	In a DHCP subscriber management environment, the framed route beyond the first may not be installed to a subscriber session if receiving it from the radius which has more than one Framed-Route.
		Category: dynamic dcd prs
1399184	All dcd operations might be blocked if profile-db is corrupt	In 'dynamic-profiles' scenario, if the profile-db is corrupt, all dcd operations are blocked. (e.g., not be able to add any interfaces). The device control process (dcd) is used to control the device's interfaces.
		Category: EA chips SW
1388780	Fabric drops might be seen if using a newer generation of MPC with SFB2	On MX2020, MX2010 and MX2008 platforms with SFB2 cards installed, if a newer generation of MPC (e.g. MPC type 3, 4, 5, 6, 7, 8 or 9) is installed into a slot which had MPC 3D 16x10GE, MPC type 1 or MPC type 2 previously installed, the available fabric bandwidth to the new MPC card would be rate-limited due to residual programming on the fabric planes. Traffic impact is observed during peak utilization. *** The fix in this PR is not applicable to NG-MPC2E/NG-MPC3E, refer to PR 1417001 for the fix with these cards.
		Category: EA ucode SW issues
1350909	PPE Errors async xtxn error when FPC is restart/removal	XTXN error seen at FPC restart (with or without impact) needs to be communicated to the customer. As it is not an expected behavior.
		Category: Ethernet OAM (LFM)
1365709	In case of MPLS ,DMR packets are sent with different mpls exp bits if MX receives CFM DMM packets with varying exp values on MPLS header	When below conditions are met, after traversing through MPLS network, if CFM DMM packets arrive with varying exps value on MPLS header, DMR packets sent with different MPLS exp bit. The varying bit may cause VLAN priority bit viariation, then impact the receiver end, if receiver only matches one particular priority bit. 1/ CFM delay measurement is configured on CE facing AE interface 2/fixed forwarding-class is not configured on interface COS setting.
		Category: EVPN control plane issues
1369705	Small rpd memory leak when configuring EVPN.	In EVPN scenarios, rpd migh leak small amount of memory. In the long run, rpd might crash and generate a core file due to a memory allocation problem.
		Category: EVPN Layer-2 Forwarding
1362598	Type 2 EVPN routes are missing after deactivating/activating protocol evpn	Type 2 EVPN routes are missing after the EVPN protocol is deactivated and then reactivated.
1397925	IPv6 link-local address for virtual-gateway address is marked as duplicate in EVPN.	In EVPN A-A mode, if the same link-local IPv6 address is configured on both IRB interfaces on the two PEs, DAD will mark one of the IRB interfaces as the duplicate.
1403524	EVPN: In the non-collapsed (centralized) topology, when one of the 2 spines deactivates the underlay protocol (ospf), the leaf still points the virtual-gw-mac's next hop to the down spine	In the ECMP path, MAC update should happen when the previously pointed node goes down for a RVTEP. Also the learn_mask was not updated. The issue is fixed in Junos:17.3R3-S3 junos:17.3R4 junos:17.4R3 junos:18.1R3-S2 junos:18.1R3-S3 junos:18.1R4 junos:18.2R3 junos:18.3R1-S3 junos:18.3R2 junos:18.4R2 junos:19.1R1
1432702	Stale MAC addresses are present in the bridge mac-table in EVPN/MPLS scenario	In EVPN/MPLS scenario, if many MAC (about 10k) addresses move from remote to local interface, some MAC addresses might never get cleared up from the bridge table due to next-hop is not getting cleared in time within the PFE. So they might remain present in the bridge MAC table even after the aging time (default 300s).
		Category: Express PFE CoS Features
1378392	Traffic might be dropped on third-generation FPCs on PTX.	On PTX with third-generation FPCs, if optics not certified by Juniper Networks (NON-JNPR) are used and there is specific traffic pattern with congestion, traffic might be dropped.
		Category: Express PFE FW Features
1345744	Netconf over SSH traffics get dropped due to DDOS protection	On QFX10000/PTX Series platforms, Netconf over SSH traffic via TCP port 830 might hit the host path Queue that is unclassified. This can result in DDoS violations in the unclassified queue.
		Category: Express PFE including evpn, vxlan
1387593	Traffic drop might be seen on QFX10K platform with EVPN/VXLAN configured	On QFX10K platform configured with Ethernet Virtual Private Network (EVPN) and Virtual Extensible LAN protocol (VXLAN), traffic drop might be seen for the Virtual Tunnel End Point (VTEP) tunnel interface due to this issue. It might also lead to Packet Forwarding Engine (PFE) crash in some rare condition.
		Category: Express PFE L2 fwding Features
1383623	DHCP packets may be dropped on a Junos Fusion Data Center scenario (QFX10000 series)	In a Junos Fusion Data Center scenario where Satellite Devices (SD) are dual-homed to Aggregation Devices (AD), if the DHCP relay is enabled for at least one IRB and both the DHCP server and clients are connected to ADs over native ports, the discover packets sent from clients which are not using DHCP-relay may be dropped on AD device.
1389411	MAC learning might stop working on some LAG interfaces.	On QFX10000 platforms, MAC learning does not work on some LAG interfaces after frequent MAC moves
		Category: Express PFE L3 Features
1376366	PFE wedge may be observed if there are interfaces going to down state	On QFX10000 or certain PTX series platform, the Packet Forwarding Engine might get wedged if there are too many interfaces (for example, more than 35) with the physical or operational state changing to down, and for which the LACP force-up parameter is enabled, while the administration state is still up.
1393937	IPV6 Next-Hop programming issue might be observed on QFX10K/PTX1K/PTX10K devices	On QFX10K/PTX1K/PTX10K devices, when 6PE (the 'protocols mpls ipv6-tunneling' statement) is configured, the IPv6 Next-Hop installation might be incorrect and it might cause IPv6 traffic drop.
		Category: Stateful firewall and NAT
1398542	Invalid Layer 4 checksum might be observed on IPv4 packets generated by NAT64 with MS-DPC after translating fragmented IPv6 UDP/TCP packets	On MX-Series platforms wherever the MS-DPC or MS-MPC/MS-MIC line card is used, when the router executes the NAT64 translation for the fragmented IPv6 UDP/TCP packets, invalid Layer 4 checksum would be observed on IPv4 packets generated by NAT64. The reason is that during fragmentation the first fragment`s next-header doesn`t point to the L4 information and hence wrong calculation is done at L4 checksum. And due to this invalid checksum, the traffic would be dropped.
1402450	The ICMPv6 packet with embedded IPv6 fragment might not be translated correctly to IPv4 ICMP packet in a NAT64 with MS-DPC deployment	On MX-Series platforms with MS-DPC deployed for NAT64, the translation for IPv6 packet to IPv4 packet might not be translated correctly when a node in IPv6 network sends an ICMPv6 Packet Too Big (PTB) message with an embedded ipv6 fragment towards a node in IPv4 network. This results in Path MTU discovery failure.
		Category: PTX Express ASIC platform
1393643	third-generation FPC reboot loop because of having internal intf issues	new stanza to prevent an FPC having hw issue from periodic bouncing
		Category: to track infrastructure replication bugs
1393884	If FPGA on the new primary CB has a specific hardware failure, the chassisd might keep crashing after GRES switchover.	On MX/EX/SRX platforms, after GRES switchover, if a chassis has bent-pin or failed Field Programmable Gate Array (FPGA) on the new CB has a specific hardware failure and fails to detect FPC presence properly, the chassisd might keep crashing.
		Category: Libjtask for RPD tasks, scheduler, timers, memory, and slip
1301849	The rpd might crash by executing the command "show route extensive" during deletion of IS-IS configuration.	The rpd might crash by executing the command of "show route extensive" during deleting ISIS configuration.
		Category: Software Interfaces 100GE PIC
1375030	"PE Chip:pe0[0]: IPW: oversize_drop error" causes Major error on FPC	PTX routers with FPC3s that encounter oversize_drop errors will trigger an FPC Major alarm with each error seen. The alarm should clear on its own. The severity of this alarm is being reduced as there is no lasting impact to the FPC.
		Category: Kernel software for AE/AS/Container
1353583	Traffic loss might be seen on new primary Routing Engine after the interface flaps followed by Routing Engine switchover in VRRP scenario	VRRP MAC filter will not be seen in PFE if interfaces flap followed by GRES, before VRRP state settles down after flap. During this time VRRP state is backup in primary-RE and VRRP state is idle in Backup-RE. This issue is only for AE interfaces with VRRP configuration. It's irrespective of VRRP scale. The traffic can be recovered by deactivating/activating the ae interfaces.
1370015	Kernel crash might be seen after committing demux related config	In subscriber management scenario, if an AE interface is associated as the underlying-interface of a demux0 unit and both demux0 unit and AE unit (corresponding to the above AE interface) are configured with a duplicated VLAN id, kernel may crash after committing the config. Same core-dump may appear even in a non subscriber-management environment, while adding/modifying an IFL (Any logical link) which has the duplicate VLAN configuration or a bulk configuration.
1373079	The Routing Engine might crash after non-GRES switchover	When LAG-enhanced is disabled, one child next hop is created for each member link of a LAG interface. During the Non-GRES switchover, the kernel memory might be exhausted, which leads to the creation failure of the child next hop, hence the Routing Engine crash happens. This crash can be avoided by enabling LAG-enhanced.
1390367	Traffic destined to VRRP VIP gets dropped as filter is not updated to related logical interface	On MX platform with enhanced-ip and VRRP configured, if remove/add a child link from AE bundles, traffic destined to VRRP VIP might be dropped.
		Category: LSQ
1398445	The backup Routing Engine might get stuck in amnesiac mode after reboot.	In the original implementation of inline LSQ (ICHIP), it was not possible to configure the "delay-buffer-rate" knob for buffer adjustment purposes. This restriction is not relevant for Trio family of ASICs anymore. The fix, committed as part of this PR, removes unneeded checks.
		Category: ISIS routing protocol
1372937	Route entry might be missing when IS-IS shortcut is enabled and MPLS link flaps.	If ISIS shortcut is enabled and ISIS "topologies ipv6-unicast" is configured, when any link with no IPv6 address configured in the MPLS LSP path is flapping (or bring down and then up), the route entry go through this flapping link might be missing for about 10 minutes, which might lead to traffic loss. The issue is because when the flapping link is down and then up, the flash route update checks both IPv4 and IPv6 address family, since IPv6 is not configured for this link, the flash route update is not triggered, hence the route entry is missing.
1394082	RPD core files on backup Routing Engine during neighborship flap when using authentication-key with size larger than 20 character.	RPD core on backup routing-engine during neighbor-ship flap when using authentication-key with size larger than 20 character. When using "security authentication-key-chains key-chain <> key <> secret <*> " with hmac-sha-1 algorithm and the secret key length is higher than 20 character, this causes memory corruption in RPD and later RPD crashes on backup RE.
		Category: ISSU related issues for MMx
1369635	The MPC5E/MPC2E-NG/3E-NG might crash and restart during ISSU	With MPC5E/MPC2E-NG/3E-NG and large-scale config along with large amount of traffic causing non-zero stats on multiple queues, when executing ISSU, the ISSU prepare stage might take longer time than usual because PR 1283850 introduced a bug which could cause the stats disable to take longer. As a result, the chassisd triggers restart/crash of the MPC. And The ISSU completes after the crash.
		Category: jdhcpd daemon
1329390	Junos core file jdhcpd.core.0 found in dhcpv6_packet_handle is seen	jdhcpd JUNOS core with if_cfg is NULL and is being accessed. In JUNOS software we fix the logic to return FALSE in case of bogus input parameters.
1391983	Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVE-2019-0037)	Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVE-2019-0037); Refer to https://kb.juniper.net/JSA10926 [juniper.net] for more information.
1432162	The jdhcpd memory leak might happen on MX5, MX10, MX40, MX80, and MX104 when testing DHCP subscribers log-in/out.	On MX5/MX10/MX40/MX80/MX104 Series platforms with DHCP server configuration for DHCP subscribers, the jdhcpd memory leak might happen and the memory increase by 15MB which depends on the number of subscribers when testing the DHCP subscribers log-in/out.
		Category: jl2tpd daemon
1362542	L2TP Access Concentrator (LAC) tunnel connection request packets may be discarded on LNS device	In subscriber management environment where LNS is deployed, if frequently changing the "local-gateway" of an L2TP tunnel on LNS device using "replace" command, the gateway may not be operational and the tunnel connection request packets sent by the corresponding LAC devices (having "remote-gateway" matching the LNS's gateway) may be discarded on LNS device.
		Category: jpppd daemon
1370610	MLPPP subscribers might be unable to negotiate sessions when the dynamic-profile name contains more than 30 characters	On MX platform which supports dynamic Multi-link Point-to-Point (MLPPP) subscriber, if the dynamic-profile name contains more than 30 characters, MLPPP subscribers might be unable to negotiate sessions with the server, and couldn't login due to this issue.
1405055	The subscriber might not be able to access the device due to the conflicted assigned address.	In a subscriber management environment, the subscriber (say, subscriber A) may not access the device (A can get IP address x.x.x.x but then the connection will be terminated), because the address x.x.x.x is previously assigned to another subscriber B and then re-assigned to A before confirming whether the respective access route for address x.x.x.x is removed.
		Category: Junos Selective Update infrastructure
1429392	JSU gets deactivated from FPC in case of power cycle	Few JSUs (Junos Selective Update), including 16.1R4-S11-J5, might be deactivated from FPC in case of the power cycle. Re-installation of JSU is needed.
		Category: PFE infra to support jvision
1361015	FPC core files might be observed after GRES switchover	In the dual Routing Engine (RE) platform with telemetry sensor configured. After graceful routing engine switchover (GRES) switchover, flexible PIC concentrator (FPC) core might be observed in the primary RE. This issue might impact the device traffic.
		Category: Key Management Daemon
1398242	IP ToS bits are not copied to outer IPsec header	On MX platform, if Dynamic End Points (DEP) tunnel is configured, IP ToS bits might not be copied from inner header to outer IPSec header.
		Category: Layer2 forwarding on EX/NTF/PTX/QFX
1368802	Forwarding broken after adding protocol EVPN extended-vlan-id	Traffic will dropp on PFE as "invalid L2 token" when protocol changes from VPLS to EVPN.
1380798	Daemon dfwd might crash with DFWD_TRASHED_RED_ZONE log messages.	In certain scenario with OTN options configuration, memory corruption might occur in dfwd (the firewall daemon) due to large IFL (logical interface) ifstate messages. This can lead to DFWD_TRASHED_RED_ZONE messages reported in dfwd log and occasionally dfwd crashes.
1383665	Adjusting mac-table-size configuration might cause l2ald crash.	Sometimes L2ald might crash when try adjusting mac-table-size configuration.
1395368	The l2ald process might crash when doing "commit check" for some specific configurations	On all Junos platforms, if bridge-domain parameters are defined in routing-instance group and applied to a routing-instance via apply-group, at the same time, the routing-instance type is setting to be "virtual-switch", and no bridge-domain is configured in the routing-instance, the l2ald process might crash during executing "commit check" or "commit" for these configurations. The l2ald process will restart automatically and therefore impact related Layer 2 service. Due to this issue, all the further commits will be blocked until the offending configurations are removed.
		Category: L2TP service related issues
1370405	Inline Service interface might not UP when bandwidth is configured.	Inline-service interfaces are not getting created with BW=40G after fix of PR1355168.
1406179	The stale si-logical interface might be seen when L2TP subscribers with duplicated prefixes or framed-route log in.	If L2TP LNS uses inline service (si) interface and the routing service (such as framed-route) is configured in dynamic-profiles, when subscribers login with duplicated prefixes or framed-route, the LNS will reject the second subscriber due to route adding failure. But the si- IFL for the failure subscriber will be left in PFE as a stale IFL.
		Category: lacp protocol
1395943	After GRES switchover, LACP will be down on peer device and never been recovered automatically	On VC series platforms, RE switchover will cause LACP down on peer device as the LACP does not sync between primary and backup RE.
		Category: Label Distribution Protocol
1373575	The traffic might not be load-balanced equally across LSPs with ldp-tunneling configured	When there are more than one RSVP LSP toward the same downstream neighbor and more than one such downstream neighbor exist, if one of the interfaces toward one downstream neighbor is brought down, the weight might become unequal for ECMP and then the traffic might not be load-balanced equally.
1405359	The L2circuit information is not advertised over the LDP session if "ldp dual-transport inet-lsr-id" is different from the router-id	The L2circuit label mapping is not advertised to the LDP (Label Distribution Protocol) neighbor if "ldp dual-transport inet-lsr-id" is different from the router-id.
		Category: Link Management Protocol
1392704	The ppmd on the Routing Engine might run with high CPU utilization after Routing Engine switchover.	In the rare case, ppmd on RE might stay high cpu usage after RE primary switch event. There will be no impact on this problem.
		Category: Multiprotocol Label Switching
1373313	The rpd might crash when executing Routing Engine switchover under BGP environment and route churn occurs	On MX/PTX/QFX platforms and in BGP environment, if GRES (graceful Routing Engine switch-over) and NSR (Nonstop active routing) are configured, RPD might crash while performing or after an RE switchover. The reason is that severe route churn events result in multiple cycles of addition/deletion of routes/labels. And due to a software bug introduced in 17.2R1, the labels freed up in the process may not get reallocated when executing RE switchover. As a result, the RPD might crash while trying to allocate a label which has not been freed.
1374102	LSP with auto-bandwidth enabled goes down during HMC error condition	On PTX or QFX10K platform, when HMC (Hybrid Memory Cube) error occurs, LSPs (Label Switched Paths) might go down due to incorrect bandwidth requested for auto-bandwidth adjustment.
1382249	The rpd might crash on backup Routing Engine after switchover	If vrf-table-label is configured for VRF routing-instance, after executing GRES or ISSU, the VRF table label which is not released may be reused by another VRF. This might cause an rpd core on backup RE.
		Category: Multi Protocol Label Switch OAM
1217566	The command of "ping mpls l2circuit" might fail if the flow-label is enabled for l2circuit	When Flow-Label (FL) is enabled for PW, the OAM packets are not sent with Flow-Label because RPD is not aware of the Flow-Label values assigned by PFE software. Hence the packets are getting dropped by PFE at the tail-end PE. The remote PE is expecting the packet with FL and PW label.
		Category: For multicast snooping on MX
1394213	Multicast traffic might be interrupted in H-VPLS scenario	In H-VPLS (Hierarchical-VPLS) with IGMP v2 scenario, if the interface (on Hub-VPLS side to Spoke-VPLS) flaps repeatedly; or remove one or more the VPLS-instances, Spoke will clear the Mroute towards the Hub, which finally causes multicast traffic interrupted.
		Category: Multicast for L3VPNs
1315011	Non-optimal route to source might be selected for next-generation MVPN with unicast-umh-election enabled.	The configuration knob unicast-umh-election for NG-MVPN (next-generation multicast virtual private network) might not work as expected in special cases. This knob is to use the unicast route preference for UMH (upstream multicast hop) selection. However the non-optimal route might be selected if the routes have the same IP address value in route-import community.
1392792	High rpd CPU utilization on the backup Routing Engine might be observed in MVPN+NSR scenario	Under extreme case, Routing process under Backup Routing Engine might be under high utilization upon route updates.
		Category: Bugs related to ethernet interface on MX platform
1367224	I2C error logs are seen when configuring wavelength on tunable SFP+.	I2C error logs are seen when configuring wavelength on tunable SFP+
		Category: Interface related ISSU PRs on Mx-series
1362324	JDI-RCT:M/Mx: Traffic loss of 1% is seen during GRES phase of ISSU from 17.3-20180527.0 to17.3-20180527.0	JDI-RCT:M/Mx: Traffic loss of 1% is seen during GRES phase of ISSU from 17.3-20180527.0 to17.3-20180527.0
		Category: Microkernel for neo mpc
1326746	Potential heap leak at tcp_conn_create under UKERN TCP stack.	memory leak happen due to tcp sockets did not close properly when tcp connection did not successfull between FPCs.
		Category: OS IPv4/ARP/ICMPv4
1318556	JSA10911 [juniper.net] Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)	The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Please see https://kb.juniper.net/JSA10911 [juniper.net] for details.
1345720	The rpd might crash when doing Routing Engine switchover with NSR and logical-system configurations.	When doing RE switchover with NSR (nonstop-routing) and logical-system configurations, rpd core might happen. This issue is platform independent. And it would cause traffic or service impact.
		Category: FreeBSD Kernel Infrastructure
1356423	The command "show system virtual-memory \| display xml validate" displays errors	The xmlised output of "show system virtual-memory" is created under a single container(for each table format) with repeated tag names. Because of the repeated tag names in the same container xml validation is failing. Added changes to xmlise each row output of table format in a separate container.
		Category: "ifstate" infrastructure
1338895	The rpd might crash when high-priority routes flap	When the rpd crashes, the core files could be seen by executing the CLI command "show system core-dumps". The routing protocols are impacted and traffic disruption will be seen due to loss of routing information.
1379657	Protocol adjacency might flap and FPC might reboot if jlock hog happens.	On all platforms and in scaling scenario, if doing some operations which causes jlock hog, the protocols adjacency might flap and all the FPCs might reboot.
		Category: TCP/UDP transport layer
1394370	The command "commit synchronize" might fail because several internal connections are stuck.	Command "commit synchronize" might fail due to kernel TCP socket stuck, the stuck can also result in login failure to the Backup RE from primary RE or to an FPC.
		Category: Kernel Tunnel Interface Infrastructure
1327099	GRE interface might not come up after deactivating or activating the routing instances.	GRE interface might not come up after deactivating/activating the routing-instances or related changes that might result in route table change.
		Category: Path computation client daemon
1395205	Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash. [CVE-2020-1601]	Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Element (PCE) in a PCEP environment using Juniper's path computational element protocol daemon (pccd) process allows an attacker to cause the pccd process to crash and generate a core file thereby causing a Denial of Service (DoS). Refer to https://kb.juniper.net/JSA10980 [juniper.net] for more information.
		Category: Protocol Independant Multicast
1394259	The rpd process might crash when rp-register-policy is configured with more than 511 terms	On all Junos platforms, when rp-register-policy is configured for Protocol Independent Multicast (PIM) Rendezvous Point (RP), and the policy is defined with more than 511 terms, if the incoming register messages doesn't match initial 511 terms in the policy, but match the term afterwards, the rpd process might crash due to this issue, therefore impact normal routing functions and service.
		Category: vMX Platform Infrastructure related issue tracking
1220671	TACACS access does not work after upgrade.	The /etc/passwd file is created in the process of the first commit when a pristine jinstall image is used to boot for the first time. If event-options is configured, the system will try to read the configuration from the available event scripts, which requires privileges obtained from the /etc/passwd file. That causes a circular dependency because the commit will not pass if the configuration includes event-options the first time a pristine image boots up, which is the case of an upgrade performed with virsh create.
		Category: Periodic Packet Management Daemon
1361800	The PPM mode for BFD session in EX4300 is centralized and not distributed by default	Periodic packet management (PPM) is responsible for processing a variety of time-sensitive periodic tasks so that other processes on the EX Series switch can more optimally direct their resources. It has two modes: distributed PPM and non-distributed (centralized) PPM. The distributed PPM should be enabled by default (such as, in 14.1 or prior to 14.1 version). But BFD session over IRB (integrated routing and bridging) runs in centralized mode instead of running distributed mode in some versions. It may not cause service impact since the BFD sessions will come UP fine. However, when the RE CPU is very busy or when configured intervals are less than 300 ms then BFD sessions running over IRB may flap since the sessions are not distributed. Also, during RE switchover cases these sessions may flap if the configured intervals are less than 2.5 secs.
		Category: PPPoE functional plugin for bbe-smgd
1398873	The bbe-smgd process might crash when executing "show pppoe lockout"	On MX platforms for Point-to-Point Protocol over Ethernet (PPPoE) subscriber management scenario, the bbe-smgd process might crash when executing "show pppoe lockout".
		Category: PTP related issues.
1404002	The time synchronization through PTPoE might not work when Enhanced Subscriber Management is enabled on MX Series routers.	When Enhanced Subscriber Management is enabled on MX (i.e. set system services subscriber-management enable), the Precision Time Protocol (PTP) with PTP-over-Ethernet (PTPoE) configuration might not work on MPC2E-NG/3E-NG or MPC5E and above (such as MPC6E/7E/8E/9E/10E/11E).
		Category: Chassis mgmt for all QFX systems - chassis MIB, alarms, CLI
1363186	Log messages: kernel: tcp_timer_keep: Dropping socket connection	On QFX5110 with Junos version 17.3R1, it is possible to see the following logs in messages file: kernel: tcp_timer_keep: Dropping socket connection due to keepalive timer expiration, idle/intvl/cnt: 7200000/75000/8 kernel: tcp_timer_keep:Local(0x80000001:60287) Foreign(0x80000001:33015) These log messages are harmless.
		Category: Interface related issues. Port up/down, stats, CMLC , serdes
1323323	Port 0 does not come up in Qfx5100-48t member in mixed VCF	Port 0 of Qfx5100-48t does not come up in mixed VCF. As a workaround, use "phy diag xe0 dsc" command as of now from BCM shell upon reboot which brings up the port and stays up continuously until the next reboot
1386400	The QFX10K-12C-DWDM line card might crash when booting up	On QFX10008/10016 with QFX10K-12C-DWDM line card installed, the line card might crash when booting up. The issue results in traffic disruption during the line card booting up.
		Category: QFX Control Plane Kernel related
1393044	sdk-vmmd causes a high write I/O in Virtual Chassis Linecard members and SSD lifetime might be shorten.	In Virtual Chassis environment with Solid State Drive (SSD) installed on the Linecard side, the sdk-vmmd (app-engine-virtual-machine management service) should not try to establish the retry connection to SNMPD when it is running in line card because SNMP is not running in line cards members. A debug logging might be written to the SSD card frequently due to repetitive retry connection. Therefore, the SSD lifetime might be shorten due to the exceeded amount of read/write. Due to this issue, the SSD card failure might be observed.
		Category: QFX Platform related (SYSLOG/ALARMS/miscellaneous)
1340897	QFX5000 platforms may display fpc0 Error requesting CMTFPC SET INTEGER, illegal setting 37 observed after upgrade	QFX5000 series platforms may show the following ERROR MESSAGE: fpc0 Error requesting CMTFPC SET INTEGER, illegal setting 37 observed after software upgrade.
1383608	The DMA failure errors might be seen when the cache flush or the cache is full.	The DMA failure errors might be seen when the cache flush or the cache is full. It might cause the device not to accept ssh credentials and Virtual-Chassis to go into the hang state.
1395534	Unable to install licenses automatically on QFX platforms	On QFX Series platforms, it is unable to update licenses automatically with "request system license update" command.
1402852	File permissions are changed for /var/db/scripts files after reboot	On newer QFX5K switches(QFX5K switch with qfx-5e image), file permissions are changed for /var/db/scripts files after reboot. This can impact scripts running on the box.
		Category: QFX platform optics related issues
1381545	The 40G-SR4 transceiver might not be recognized after upgrading to qfx5100e OS	On the QFX5100 platform, after upgrading from a 'qfx5100' OS to a 'qfx5100e' OS via CLI (not via USB media), the 40G-SR4 transceiver might not be recognized, resulting in the invalidation. The chassis must be power cycle off/on to recover.
		Category: QFX access control list
1241733	The pfe process might crash after changing the filter for lo0 interface	On EX4600/QFX5100/QFX5110/QFX5200/ACX5K switches, the dcpfe might create a core file when the applied lo0 firewall filter term is changed in scaled conditions.
1364020	QFX52100: Filter with routing-instance applied to family inet logical interface (IFL) causes traffic to be discarded on unrelated interfaces.	QFX52100: Filter with then routing-instance applied to family inet IFL causes traffic to be discarded on unrelated interfaces
		Category: QFX PFE Class of Services
1380294	There is an inconsistency in applying scheduler map with excess-rate on the physical interface and AE interface	On QFX5100/QFX5110/QFX5120/QFX5200/QFX5210 Series platforms, there is an inconsistency when applying a scheduler map with excess-rate on the physical interface and aggregated ethernet (AE) interface. The excess-rate is not supported on the physical interface, but it could be committed successfully on the AE interface containing that physical interface with the same excess-rate parameter.
		Category: QFX L2 PFE
1353241	ARP learning might fail after changing the interface MAC address	On QFX5000 Series switches, the PFE might drop the ARP reply packets after changing the interface MAC address.
1368913	On QFX5k Series switches ISIS adjacency with Cisco might go down	On QFX5k Series, If ISIS packet is received with DMAC as 09:00:2b:00:00:05 (ISO 9542, All Intermediate System Network Entities Address) and Jumbo frame with EtherType as 0x8870 (non-standard, used by Cisco), such packet will be dropped, resulting in failure in the adjacency.
1382209	LACP might stuck in Detached state on QFX5K platforms in VXLAN scenario	On QFX5K platforms with LACP configured, if an AE interface has native-vlan-id configured and that native vlan is VXLAN enabled, LACP on that interface might stop processing received LACP PDUs and stuck in Detached state. LACP in Detached state will not carry traffic.
		Category: QFX L3 data-plane/forwarding
1374436	TPI-50840: qfx5110 ethernet-switching flood group shows incorrect information	TPI-50840: On the QFX5110, the Ethernet switching flood group shows incorrect information.
		Category: QFX MPLS PFE
1400868	The dcpfe crashes might be seen after several times of adding/deleting a large number of LSPs	On ACX/EX/QFX platforms, if adding/deleting a large number of LSPs several times, the dcpfe crashes and MPLS warning messages might be seen.
		Category: QFX VC Infrastructure
1383876	The VC could not come up after upgrading to QFX5E platforms (TVP-based platforms for QFX5100 or QFX5200 switches)	On QFX5100/QFX5200-VC (Virtual-chassis) scenario, if the switches upgrade to QFX5E platforms (TVP-based platform), and when the VC ports are connected to the expansion modules (PIC0/PIC1), all VC ports might be down and the VC could not come up.
1383876	The VC could not come up after upgrading to QFX5E platforms (TVP-based platforms for QFX5100 or QFX5200 switches)	On QFX5100/QFX5200-VC (Virtual-chassis) scenario, if the switches upgrade to QFX5E platforms (TVP-based platform), and when the VC ports are connected to the expansion modules (PIC0/PIC1), all VC ports might be down and the VC could not come up.
1389872	FPC might crash on QFX5100 platforms in a large-scale scenario	On QFX5100 platforms, if the size of the configuration is huge, when upgrade from a lower release to a higher one, the FPC might crash.
		Category: KRT Queue issues within RPD
1374558	The rpd process might crash when route flap and LSP flap occur with CBF enabled.	When CBF (CoS-based forwarding) is enabled, due to the indexed nexthop installation issue in kernel, the rpd process might crash upon route flap and LSP flap.
		Category: RPD Next-hop issues including indirect, CNH, and MCNH
1360354	rpd cores at 'Assertion failed rpd[10169]: file "../../../../../../../../src/junos/usr.sbin/rpd/lib/rt/rt_attrib.c", line 3329: "rt_template_get_rtn_ngw(nhp) <= 1" ' on doing RE switchover with SRTE routes	When RPD reads nexthops from Kernel on restart, for INH -> FWD NH{List NH} -> {Chain NH} scenario, RPD should not create old-style List NH for the forwarding nexthop.
1370174	The rpd might crash after Routing Engine switchover is performed or the rpd is restarted if interface-based dynamic GRE tunnel is configured.	With interface-based Dynamic GRE Tunnel configured, there might be 2 next-hops for a single dynamic GRE tunnel when a new route is resolved over the dynamic tunnel after RE switchover is performed or the rpd is restarted. Subsequent withdrawal of the routes over that tunnel or primary Routing Engine restarting will cause the rpd crash. This issue is introduced in PR 1202926 (which is fixed in 15.1F7 16.1R4 16.2R1-S6 16.2R1-S6-J1 16.2R2 17.1R2-S7 17.1R2-S8 17.1R3 17.2R1).
1402390	In JUNOS Logical System, configuration of "chained-composite-next-hop ingress l3vpn extended-space" failed to commit after upgrading to 17.2/later releases	After upgrading Junos to Junos OS Release 17.2 or later, the statement "chained-composite-next-hop ingress l3vpn extended-space" cannot be configured any longer on a logical system.
		Category: RPD Infrastructure Issues.
1373855	LDP convergence delay might be seen after IGP metric change with the statement bgp-igp-both-ribs configured.	In a large-scale BGP/LDP environment with 'protocols mpls traffic-engineering bgp-igp-both-ribs' configured, when IGP metric of interface is changed by configuration modification (commit), the metric change could get propagated to LDP slowly, leading to long delay of LDP convergence.
		Category: RPD route tables, resolver, routing instances, static routes
1341720	The VRF static route might not be exported when route-distinguisher-id is used on RR in BGP Layer 3 VPN scenario.	In Border Gateway Protocol (BGP) Layer 3 Virtual Private Network (L3VPN) scenario, on the Route Reflector (RR) with Virtual Routing and Forwarding (VRF) instance deployed, if Auto-RD (Automatic Route Distinguishers) feature is used, the VRF static route might not be exported to bgp.l3vpn.0 table correctly under race condition. Hence the static route could not be advertised to remote device.
1377279	static route age is the same as last commit.	Whenever ribgroup config changes for static routes (inet.0), all static routes are removed and then added to new ribgroup. But for unrelated config changes (e.g. adding a prefix to prefix-list policy) , also triggers this del+add, resulting in static routes' age same as last commit. This issue is not service impacting.
		Category: jflow/monitoring services
1393696	The srrd process might be stuck at 100 percent usage when J-Flow is used.	SRRD stuck at 100% CPU utilization
		Category: Scuba interfaces software
1382182	The MPC6E might crash while fetching PMC device states.	PMC device is OTN framer which is sitting on the MIC6-100G-CFP2. While fetching PMC states, CPU might be hogged by the thread more than 2.5 sec. If this occurs, MPC6E might crash.
		Category: Issues related to control plane security
1421539	Failed to reload keyadmin database for /var/etc/keyadmin.conf.	During commit of the configuration change the following warning message can appear: warning: Command exited: PID 7527, status 255, command keyadmin error: failed to reload keyadmin database for /var/etc/keyadmin.conf
		Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1382531	Flows are getting exported before the expiry of the configured active timeout value.	The export of the Jflow records is seen at the collector before the expire of the configured active timeout value. This export result might not be the expected.
		Category: SFW, CGNAT on MS-MIC/MS-MPC (XLP)
1386011	IPSec VPN traffic might fail when passing through MS-MPC of MX Series routers with CGNAT enabled.	While dynamic IP Security (IPSec) virtual private network (VPN) is re-keyed due to lifetime expiration, IPSec internet key exchange (IKE) phase 1 user datagram protocol (UDP) port 500 and phase 2 UDP port 4500 sessions would be translated into two different public internal protocol (IP) addresses while passing through carrier-grade network address translation (CGNAT), which causes IPSec VPN traffic to fail. This behavior does not cause an issue for Juniper MX devices with MS-MIC or SRX routers since the identify key is used to authenticate the sessions and it allows the private IP address to be translated to the different public IP addresses.
1405882	NAT64 translation issues of ICMPv6 Packet Too Big message with MS-MPC/MS-PIC	On MX series with MS-MPC/MS-PIC, in NAT64 scenario, if ICMPv6 Packet Too Big message is required to be translated, the translated ICMPv4 Destination Unreachable packet is incorrect. L4 destination port under embedded IPv4 address is not translated, IPv4 Identification field doesn't copy from IPv6, header checksum in IPv4 under ICMPv4 is wrong.
		Category: Stout PF fabric (SFB2)
1406030	Fabric performance drop on MPC7, MPC8, or MPC9E and SFB2 based MX2000 platform.	On MPC7/8/9E and SFB2 based MX2000 Series platforms, code change done by PR 1336446 fixing MPC7/8/9E fabric re-ordering issue with SFB causes fabric performance drop. The throughput might not reach the expected value in high volume traffic scenario.
		Category: Trio LU, IX, QX, MQ chip drivers, ucode & related SW
1364514	The "Disconnected after ISSU and before switchover" error might be seen and FPC is restarted during ISSU	The "Disconnected after ISSU and before switchover" error might be seen and FPC is restarted during ISSU.
1368414	Subscribers over AE interface might have tail drops which will affect the fragmented packets due to QXCHIP buffer getting filled up	On MX platform with MPC1/MPC1E/MPC2/MPC2E, Subscribers over AE interface can't utilize their bandwidth as packets larger than 1500 is dropped.
1380746	Packet drops on interface if the statement "gigether-options loopback" is configured.	On MX ,EX9200 and SRX5K platforms, with the knob "gigether-options loopback" configured on interface, if the interface is connected using copper SFP (SFP-T), packet drops might be seen.
		Category: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1374248	The filter service might fail to get installed for the subscriber in a scaled BBE scenario	On MX Series platform enabled with enhanced subscriber management, if the subscriber profile initiates a filter service for each subscriber, and there are large scale of broadband edge (BBE) subscribers (for example, 10000) logging in and out repeatedly, the filter service might fail to get installed for the subscriber due to this issue. In some rare condition, it might also lead to the Flexible PIC Concentrator (FPC) crash.
1402345	The MPC might crash due to CPU overuse by dfw thread.	When a large amount of packets hit the firewall filter term action 'syslog' and a thread hogs CPU for more than 4 minutes, the MPC might crash.
1402484	Some error logs might be seen on FPC when reading is attempted from Uninitialized memory location.	On all MX platforms that support enhanced subscriber management (Next Generation Subscriber Management) with L2TP subscriber scenario, when a packet arrives with size higher than LNS (L2TP network server) IFL (Logical interface) MTU and 'Do-not fragment' bit is set, because the micro kernel generates ICMP error messages and increment 'out-mtu-errors' in IFD (Pysical interface) stream counter, and then the OIF (Outgoing interface) index is wrongly programmed in LNS IFL output feature list. So some error logs would be seen when reading attempt from Uninitialized memory location. This only impacts the traffic from Core to LNS subscriber on PFE which needs to generate ICMP error message like MTU exceeded. It would not impact normal transit traffic.
		Category: Trio pfe l3 forwarding issues
1381580	The unicast traffic from IRB interface towards LSI might be dropped due to Packet Forwarding Engine mismatching at egress processing.	On all Junos with Trio platforms, the unicast traffic might get dropped when it is passed from an Integrated Routing and Bridging (IRB) interface towards label switch interface (LSI) if the Aggregation Ethernet (AE) load balancing adaptive or per-packet is configured.
		Category: Trio pfe multicast software
1355334	Some line cards might crash in subscriber scenario enabled with distributed IGMP.	On MX platforms enabled with Next Generation Subscriber Management, if subscribers are enabled with distributed Internet Group Management Protocol (IGMP), and there are some stressful operations, e.g. subscribers login/logout as well as join/leave IGMP groups repeatedly, some linecards might crash due to the timing issue.
		Category: Trio pfe microcode software
1346403	RLT subinterfaces not reporting statistics.	RLT sub-interfaces not reporting stats
1373631	JNH memory leaks in multicast scenario with MoFRR enabled	On MX platform, with Multicast-Only Fast Reroute (MoFRR) enabled, if doing any change that causes to create a new rpf nexthop, JNH memory leak might be seen.
		Category: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1389944	Individual command authorization might cause mgd crash.	For a user with allow-commands and deny-commands configured, mgd crash is happening sometimes when the user enters into CLI mode and executes any show commands.
		Category: Junos Automation, Commit/Op/Event and SLAX
1405903	Some files are missing during log archiving	When there are any scripts running on the router cscript.log will be created. It is found that the permission are set wrongly hence when any non-root user tries to archive the /var/log along with cscript, some other files in /var/log go missing in the archived file. So when we untar the file, less files are found. This issue is not seen when root user does the archive. With the fix of the PR non-root user would be able to archive the files.
		Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1368998	Junos OS:set system ports console insecure allows root password recovery on OAM volumes (CVE-2019-0035)	Junos OS: set system ports console insecure allows root password recovery on OAM volumes (CVE-2019-0035); Refer to https://kb.juniper.net/JSA10924 [juniper.net] for more information.
1401249	The authd process might stop when issuing the show network-access requests pending command during the authd restart	The authd might crash when issuing "show network-access requests pending" command during the authd restarting.
		Category: We can use this category for Host protocols (LACP, LAG, ARP,
1321575	In Junos Fusion the AD LAG interface might flap during SD upgrade or downgrade	During SD (Satellite Device) upgrade in Junos Fusion, there is a race condition that the LACP (Link Aggregation Control Protocol) defaulted PDU received from the peer device connected in a LAG (Link Aggregation Group) is incorrectly sent to AD (Aggregation Device) with AE ECID (E-channel Identifier) instead of member ECID, which causes that LACP PDU to be received on another member in the LAG, resulting in the LAG interface flapping.
1383642	In a Junos Fusion (MC-LAG based) deployment with dual Aggregation Devices (ADs) and dual-homed Satellite Devices (SDs) it may be possible for SDs to get into a state where LACP will not transmit to attached end/client devices.	When a Satellite Device (SD) boots up (powered on) it receives the SD configuration file from the Aggregation Devices (ADs). If the SD is configured to be dual-homed to both ADs (connections from one SD to both AD1/AD2) it will receive a configuration file which instructs the SD to communicate to both ADs. If one of the ADs is offline at the time the SD receives the configuration file specifying AD Redundancy then the SD will not be able to properly transmit LACP PDUs until it communicates and synchronizes with both ADs as specified in the received configuration.
		Category: V44 Aggregation Device Infra
1384440	BUM traffic may get dropped on peer Fusion Aggregation Device when the link between Satellite Device and local Aggregate Device goes down	In the dual AD Junos Fusion setup, BUM (Broadcast, Unknown Unicast, and Multicast) traffic may get dropped on peer Fusion Aggregation Device when the link between Satellite Device and local Aggregate Device goes down.
		Category: V44 Satellite Device Infra
1369062	QFX satellite device may restart in JunOS Fusion solutions when copper SFP is used	When using QFX5100/5110/5200/5210 as a satellite device (SD), configuring a copper small form-factor pluggable (SFP) may cause the SD to restart unexpectedly.
		Category: PTX/QFX10002/8/16 specific software components
1311875	PTX10K: an FPC may restart without a warning when the speed on an interface is by configuration	Without the fix, whenever a user changes pic or port speed, the affected FPCs will restart automatically. With this change, an alarm is raised and user intervention is required to take the effect.
		Category: VMHOST platforms software
1398333	Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure (CVE-2019-0074)	A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series, and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. Please refer to https://kb.juniper.net/JSA10975 [juniper.net] for more information.

View TSB17512 Known Issues [juniper.net] for additional information

Modification History

2020-03-04: update login and IP addresses; updated format; added table of the known issues in this release
2019-01-18: First publication