Alert Type

SRN - Software Release Notification

Product Affected

ACX, EX, T, TX, PTX, MX, QFX5100, VMX, VRR, Network Agent

Alert Description

Junos Software Service Release version 16.1R7-S6 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to  Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select  Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 16.1R7-S6 is now available.

16.1R7-S6 - List of Open issues

PR Number Synopsis Category:Border Gateway Protocol
1414021 The CPU utilization of the rpd process is stuck at 100% if BGP multipath is configured
  		In BGP with the indirect next-hop scenario, if BGP multipath enabled, a background job loop might be formed and the CPU utilization of rpd process might be stuck at 100%. In this software issue, JUNOS RPD daemon will flash the route even if the route has not changed. This only applies for the indirect nexthop case.

16.1R7-S6 - List of Fixed issues

PR Number Synopsis Category:Border Gateway Protocol
1237006 BGP might not advertise routes on the existing BGP peer after adding Layer 3 VPN instance
  		If rib-group is configured under BGP, BGP might not advertise routes on the existing BGP peer after adding Layer 3 VPN instance. The "show bgp neighbor" shows that the neighbor state is stuck in "Send state: not advertising".
1351639 The rpd crashes in JunOS 16.1 or higher during BGP convergence
  		In JunOS 16.1 or higher, during BGP convergence, the input/output thread constructing the outgoing BGP PDU and manipulating the path attributes before hand-off the data to the socket. If this PDU length is zero, it will trigger an assertion and routing-protocol demon is restarting.
1382892 The rpd might crash under a rare condition if GR helper mode is triggered
  		When graceful restart is configured on the BGP peer device, if the peer device initiate new TCP connection when there is an existing TCP connection for the BGP session, send OPEN message and this new TCP connection also get torn down immediately after establishment/sending of OPEN message. The rpd might crash.
1402255 On the multi-access/broadcast network, 3rd party BGP router may unexpectedly select RR router as next-hop to forward the IPv6 traffic.
  		RFC 2545 has a limitation on third party next-hops where the next hop is propagated unchanged. Due to this limitation, BGP inet6 Route-Reflector router attaches the BGP neighbor's IPv6 global address and its own IPv6 link-local address as the next-hops while advertising the route to another BGP neighbor. This could introduce the forwarding issue on the BGP neighbor from other vendors if their device picks up the link-local address as next-hop. This would put the BGP RR router in the traffic forwarding path unexpectedly. This issue will not be seen on Juniper devices because IPv6 link-local address would not be selected as prefix's next hop.
1412538 BGP might stuck in Idle state when the peer triggers a GR restart event
  		When NSR (nonstop-routing) is enabled in local device and BGP GR (Graceful-Restart) is enabled in peer device, if the peer triggers a GR restart (it is usually caused by some failure in peer or the peer restarts rpd, etc), some BGP sessions might stuck in Idle state. The reason is that when the GR restart happens, the device is still doing the initial sync to the backup RE of the previous sessions, so some BGP sessions might stuck in Idle state because the router does not complete the process (the initial sync of the data set to the backup).
1461602 RPD scheduler slips might be seen on RPKI route validation enabled BGP peering router in a scaled setup
  		In scaled BGP environment (global table ~3M routes or more) when there are a lot of (10k or more) more-specific routes for a certain IPv4 or IPv6 prefix covered by some RV-record, a change in RV records database might lead to routing protocol daemon (rpd) scheduler slips, which, in turn, could trigger routing protocol adjacencies flap. The same could be triggered by executing "clear validation database" command or shortly after initial Rpki-Rtr session establishment event.
PR Number Synopsis Category:MX Platform SW - FRU Management
1442138 The chassisd is unable to power off a faulty FPC after RE switchover which leading to chassisd restart loop
  		In the MX router with a faulty (e.g. hardware error) FPC (Flexible PIC Concentrator) installed, performing RE (Routing Engine) switchover or restarting chassisd which may cause chassisd restart loop. This issue will cause traffic lose completely.
PR Number Synopsis Category:MX Platform SW - Mastership Module
1424187 The system does not reboot or halt as configuration when encountering the disk error
  		When the system encounters disk error or halted system (ex. memory leak), the chassisd might go in hung state with the blow error messages even though "disk-failure-action reboot" or "disk-failure-action halt" is configured.
PR Number Synopsis Category:Device Configuration Daemon
1336455 Momentary traffic loss may happen when a GRES is performed
  		During performing Graceful Routing Engine Switchover (GRES), in rare condition, as soon as the implicit filter being generated, momentary traffic loss may happen, which last about 10 sec. Note: Implicit filters generated by daemons automatically, which could not be configured manually, for they are not standard filters. such as when Flow-Spec feature is in use, or Fast Update Filter is used for Subscriber scenario. Flow-Spec: BGP FlowSpec is a DDoS mitigation solution that is specified in RFC 5575, which is to use BGP to advertise detailed information about the attack vector. Using BGP to disseminate this information allows the network operator to reuse the BGP session and route policy they already have in place between the two networks. (More about Flow-Spec please read this day-one book https://www.juniper.net/us/en/training/jnbooks/day-one/networking-technologies-series/deploying-bgp-flowspec/) Fast Update Filter: https://www.juniper.net/documentation/en_US/junos/topics/concept/subscriber-management-dynamic-firewall-fast-update-filters-overview.html
1409535 Unrelated AE interfaces might go down if committing configuration changes
  		On all Junos platforms, if VRRP is running upon AE interfaces while committing any configuration changes related to AE interfaces, unrelated AE interfaces might go down.
PR Number Synopsis Category:Enhanced Broadband Edge support for firewall
1463420 The subscribers might not pass traffic after doing some changes to the dynamic-profiles filter
  		On MX platform, with enhanced subscriber enabled, if doing some changes to a dynamic-profiles filter, the subscribers built on the filter might no longer forward traffic.
PR Number Synopsis Category:Stateful firewall and NAT
1391928 The spd might crash when 'any-ip' is configured in the 'from' clause of the NAT rule with the static translation type
  		If dnat-44 / basic-nat66 / basic-nat44 / stateful-nat464 / stateful-nat64 / basic-nat-pt / napt-pt' is configured for translation-type of Network Address Translation (NAT) rule, the Service PIC Daemon (spd) might crash when 'any-ip' (such as any-ipv4 or any-ipv6) is configured in the 'from' clause (such as 'from destination-address' or 'from source-address') of the NAT rule. This is a unsupported configuration. The fix implements a constraint commit checking to detect the presence of 'any-ip' in the 'from' clause and return failure.
PR Number Synopsis Category:Kernel software for AE/AS/Container
1445428 Detached LACP member link gets LACP State as enabled in PFE when switchover because of device reboot
  		If particular set of events happened the status for detached LACP link may get turned on in PFE which may later create traffic blackholing for transit traffic.
PR Number Synopsis Category:Optical Transport Interface
1297164 100-Gigabit Ethernet interfaces might not come up when "otn-options laser-enable" is configured on PTX Series platforms.
  		On PTX3000/PTX5000 platforms with P1-PTX-2-100G-WDM Physical Interface Card (PIC), if "otn-options laser-enable" is configured, the 100G interfaces might not come up.
PR Number Synopsis Category:jdhcpd daemon
1442222 The jdhcpd process might go into infinite loop and cause 100% CPU usage
  		When DHCP is configured, if subscribers are moved from one routing-instance to another or if the subscribe is deleted and re-added, the jdhcpd process might go into infinite loop and cause 100% CPU usage.
PR Number Synopsis Category:Layer 2 Circuit issues
1418870 The rpd crash might be seen if l2circuit/local-switching connections flap continuously
  		On all Junos platforms, if there are multiple interfaces configured under a single l2circuit/local-switching, and each of these interfaces has a description field configured under them, when l2circuit/local-switching connections flapping continuously, memory usage increment might happen, eventually, it will result in rpd crash because of running out of memory.
1425828 The rpd process might crash and core dump during mpls ping command on l2circuit
  		When end-interface or backup-interface/protect-interface in end-interface is used as an interface for "ping mpls l2circuit interface" command, the rpd process might crash and core dump.
PR Number Synopsis Category:Layer2 forwarding on EX/NTF/PTX/QFX
1400716 Only one PFE could be disabled on FPC with multiple PFEs in error/wedge condition
  		On MX, PTX and QFX platforms with Chassis Manager (CM) error reporting, if Flexible PIC Concentrator (FPC) has multiple Packet Forwarding Engines (PFEs) in which one of PFEs goes into wedge condition, due to this issue, the wedge condition might be reported continuously even after disable_pfe action has been taken for the corresponding PFE. Due to this issue, when CMERROR message queue is saturated and the level report-limit is reached (e.g. 10 major errors), the wedge condition on the other PFE within the same FPC will be ignored and not be able to trigger disable_pfe action any more. This issue might cause some traffic being blackholed.
PR Number Synopsis Category:Label Distribution Protocol
1416032 Services dependent on LDP might be impacted if committing any configuration changes
  		On all Junos platforms, if there is any protocol running dependent on LDP (e.g., l2circuit/L2VPN), after committing any configuration changes, even only such as changing the description on an interface, unnecessary LDP updates might be seen. Only services dependent on LDP might be impacted during the period.
1422645 LDP might not update the LDP ingress route metric when inet.3 route flash happens before inet.0
  		LDP route metric might not match IGP route metric even with "ldp track-igp-metric" configured.
PR Number Synopsis Category:PTX1000 platform
1401507 The TCP connection between ppmd and ppman might be dropped due to a kernel issue
  		The periodic packet management process daemon (ppmd) off-loads time-sensitive periodic processing from various clients to a single daemon. It is responsible for periodic transmission of packets on behalf of its various clients. Due to a kernel issue, the TCP connection between ppmd in the Routing Engine (RE) and periodic packet manager (ppman) in the packet forwarding engine (PFE) might be dropped. It will result in the clients which use ppmd (such as LACP) flapping.
PR Number Synopsis Category:Multiprotocol Label Switching
1402382 MPLS LSP traffic loss might be seen under rare conditions if CSPF is enabled
  		When make-before-break (MBB) new instance signaling experiences error and before retry is finished, other triggers such as auto bandwidth adjustment timer expiration have to be blocked until MBB finishes. Once the MBB finishes instance switching, blocked trigger needs to be scheduled, but should only be triggered after optimize-adaptive-teardown timer expires. In the affected releases, the blocked trigger is scheduled immediately after instance switching without taking optimize-adaptive-teardown timer into account, it causes old instance to be torn down before whole system finishes changing routes using the new instance, this leads to traffic loss.
PR Number Synopsis Category:Multi Protocol Label Switch OAM
1363641 Traceroute MPLS from Juniper to Huawei routers does not work as expected
  		Traceroute MPLS from Juniper to Huawei routers does not work as expected due to unsupported TLV.
PR Number Synopsis Category:next gen multicast for L3VPNs
1419891 The rpd process might crash in rare conditions when Extranet NG-MVPN is configured
  		When Extranet NG-MVPN/overlapping MVPN is configured, in rare cases, rpd might crash due to Next-hop reference count becomes 0. During the crash, the routing table and neighborship will become unstable and traffic will be dropped.
PR Number Synopsis Category:OS IPv4/ARP/ICMPv4
1449615 Some hosts behind unnumbered interface are unreachable after the router/FPC restarts
  		Some hosts behind unnumbered interface are unreachable when the donor interface is down and an ARP packet arrives at borrower interface, this issue might occur after the router/FPC restarts.
PR Number Synopsis Category:"ifstate" infrastructure
1437762 The CPU utilization on a daemon might keep around 100% or backup RE might crash in race conditions
  		The CPU utilization on a daemon might keep around 100% or backup RE might crash in race conditions (it may get hit or triggered at times by some churn in the system, no specific trigger).
PR Number Synopsis Category:IPv6/ND/ICMPv6 issues
1380600 The routes learned over an interface will be marked as "dead" next-hop after changing the prefix-length of IPv6 address on that interface
  		If an interface is configured with 128 prefix length for IPv6 address, the route learned over that interface might be marked as "dead" next-hop after the prefix length is changed from 128 to any other prefix length.
PR Number Synopsis Category:PFE Peer Infra
1448858 Interface attributes might cause high CPU usage of dcd
  		When the interface attributes are configured, this configuration might cause an error in the IRSD (IRSD syncing errors) and lead the CPU usage of dcd spike up. The convergence time of this interface will be impacted.
PR Number Synopsis Category:TCP/UDP transport layer
1394370 Command "commit synchronize" might fail due to several internal connections stuck
  		Command "commit synchronize" might fail due to kernel TCP socket stuck, the stuck can also result in login failure to the Backup RE from primary RE or to an FPC.
PR Number Synopsis Category:Protocol Independant Multicast
1235339 RPD crash on a router configured to handle multicast traffic when the route to the multicast source becomes unavailable
  		RPD Crash happens when the router doesn't have route for the source of the multicast flow and RP gets register messages for those source.
PR Number Synopsis Category:KRT Queue issues within RPD
1436080 The local route in the secondary routing table which gets stuck in the KRT
  		On Junos OS platforms with unnumbered-interface in routing instance scenario, when applying rib-groups for interface-routes in routing instance to leak unnumbered interface routes into a secondary routing table, this may cause the local route in the secondary routing table which gets stuck in the KRT (kernel routing table).
PR Number Synopsis Category:RPD Next-hop issues including indirect, CNH, and MCNH
1441438 For a route received via EBGP the AIGP value may not be considered as expected
  		This issue is related to BGP AIGP (accumulated IGP) feature. Normally, with AIGP enabled, BGP can select paths based on IGP metrics. This enables BGP to choose the shortest path between two nodes, even though the nodes might be in different ASs. But in some scenario where the same route is received from both IBGP and EBGP (the AIGP attribute is carried), the nexthop received over EBGP might not be resolved using the AIGP value. It means during the best-route selections, if the devices have to do tie-break in AIGP step then it may not work as expected. Thus the traffic might not go through the expected path.
PR Number Synopsis Category:RPD route tables, resolver, routing instances, static routes
1415077 Dynamic routing protocol flapping with vmhost RE switchover on NG-RE
  		In NG-RE dual RE platform, some commands for RE switchover might lead process rpd to go down/up, due to a delay that makes the process chassisd fail to update its status of mastership promptly. As the mastership status the chassisd governs determines which action the process rpd needs to take the next, if RE is rebooted and the chassisd mastership state is RE-Master then, in that case, rpd clears all the kernel states; and if chassisd mastership state for that RE is RE-Backup, then rpd just quits silently and restarts again in backup mode without any kernel states being cleaned. So that rpd cleanup of kernel states causes this issue.
PR Number Synopsis Category:show route table commands, tracing, and syslog facilities
1387050 The rpd might crash when traceoptions are enabled
  		When traceoptions are enabled with a lot of trace flags or 'flag all', the rpd might crash due to buffer overflow issue. This is a timing issue.
PR Number Synopsis Category:Resource Reservation Protocol
1416487 Traffic blackhole might be seen due to a long LSP switchover duration in RSVP-signaled LSP scenario
  		In RSVP-signaled LSP scenario with LSP bypass path configured, when all interfaces on a transit node along primary LSP are brought down, the LSP might not go down on the ingress node, it will take 3-4 minutes before LSP switchover begins and cause a long traffic blackhole.
PR Number Synopsis Category:Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1459306 The traffic might be stuck on MS-MPC/MS-MIC with sessions receiving huge number of affinity packets
  		On MX platforms with MS-MPC/MS-MIC, if there are sessions receiving huge number of affinity packets (e.g. thousands of packets), the service interface might be brought down by the prolonged flow-control, and the mspmand process crash might happen. In this case, the traffic will be stuck due to this issue.
PR Number Synopsis Category:Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1397628 The PPPoE subscribers are unable to reconnect after FPC reboot
  		In the scale subscribers management environment, the PPP inline keepalives don't work after all the AE (Aggregate Ethernet) member link line cards reboot. This issue may cause the PPPoE subscribers are unable to reconnect.
1442527 In "enhanced-ip" or "enhanced-ethernet" mode with DCU (destination-class-usage) accounting enabled, MS-DPC may drop all traffic that should egress via ae interface
  		On MX platform with "enhanced-ip" or "enhanced-ethernet" mode enabled, if the ae interface is configured with DCU accounting, MS-DPC might drop all traffic that should go out via the interface.
PR Number Synopsis Category:Trio pfe microcode software
1298561 MPC stops forwarding traffic upon using service queue-monitoring application or once using ddos flow-detection
  		If the application ddos flow-detection(SFCD) or QMON (set services analytics resource-profiles bla queue-monitoring) are configured, local packet forwarding context memory could get overwritten and corrupting the dispatch cookie causing permanent forwarding issue.
PR Number Synopsis Category:Configuration management, ffp, load action
1407848 The "show configuration" and "rollback compare" commands causing high CPU
  		If scaled config of interfaces and filters are configured, the CPU usage hits 100% for a few seconds while running "show configuration" or "show system rollback compare " commands.
PR Number Synopsis Category:DDL/ODL infrastructure and CLI/Op commands
1297728 The mgd process might consume high RE CPU when certain show commands are executed
  		On running certain commands that involve command-forwarding, a MGD process is created to retrieve the data. In rare cases, if this command times out or if it is manually terminated (for example, using Ctrl+C), then it can lead to MGD to utilize high Routing Engine CPU.
PR Number Synopsis Category:PTX/QFX10002/8/16 specific software components
1325392 PTX MKA sessions are not coming up, after changing CA parameters like - transmit-interval, key-server-priority
  		On a PTX, a MACsec Key Agreement (MKA) sessions fail to come up after a Connectivity Association (CA) state changed. The state changes are done under "set connectivity-association ..." stanza.
PR Number Synopsis Category:Virtual Private LAN Services
1295664 LSI interface might not be created causing remote MACs not being learnt with error log of "RPD_KRT_Q_RETRIES: ifl iff add: Device busy"
  		With VPLS being configured, after upgrade to 15.1/16.1/17.x releases, in some circumstances VPLS LSI interface are not correctly created, causing remote MACs not being learnt and L2 VPLS outage. The issue is not reproduced and the code change is not a fix but add a instrumentation using a hidden command 'show vpls ipc-history', which should be captured right away when the issue is seen on latest releases. show vpls ipc-history <<<<< show vpls connections show krt queue show route forwarding-table extensive /var/log/messages

Modification History

First publication date 2019-11-22