Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Alert Description

Junos Software Service Release version 18.4R1-S7 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to  Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select  Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 18.4R1-S7 is now available.

NOTE: Know critical issue for EX Series. The Service Release Software for EX Series has been recalled. The issue caused by PR1510224 - Performing "request system zeroize" on an EX may brick the switch

18.4R1-S7 - List of Fixed issues

PR Number Synopsis Category: MX Platform SW - Mastership Module
1424187 The system does not reboot or halt as configuration when encountering the disk error
Product-Group=junos 		When the system encounters disk error or halted system (ex. memory leak), the chassisd might go in hung state with the blow error messages even though "disk-failure-action reboot" or "disk-failure-action halt" is configured.
PR Number Synopsis Category: CoS support on DNX
1432720 CCM packets drop might be seen in a scaling ethernet OAM scenario
Product-Group=junos 		On ACX5448 box with ethernet OAM scenario, if CFM (Connectivity Fault Management) sessions are based on 40G/100G ports, CCM (continuity check message) packets drop might be seen after scaling up beyond 650 CFM sessions.
PR Number Synopsis Category: ACX platform interface issues
1398270 "Output packet error Count" incrementing on 100GE, 40GE ports on RIO
Product-Group=junos 		The "Output packet error count" is increasing when the interface MTU is greater than 1524 and the traffic is pumped with packet size greater than 1524. This is happening because the forwarding ASIC is treating these bigger packets as error packets. However, there is no impact to the traffic seen. Currently this issue is under investigation
1401718 Link Fault Signaling (LFS) not working on ACX5448 10/40/100GbE interfaces
Product-Group=junos 		Link Fault Signaling (LFS) feature is not supported on ACX5448 10/40/100GbE interfaces.
PR Number Synopsis Category: DNX L2 related features
1453766 ACX5448 FPC crashed due to segmentation fault
Product-Group=junos 		ACX5448 FPC crashed due to segmentation fault, due to timing issue. There is very low chance of this core occurring.
1461485 SW:Rio-X NPI:Platforms: ACX5448-D Interfaces and Optics support: sometimes during the bring up of AE interface there are ARP resolution issue
Product-Group=junos 		Arp issue is seen with AE :When one member of AE is removed and also when device is rebooted with AE configuration.
PR Number Synopsis Category: DNX platform MPLS FRR features
1485444 ACX5448 L2VPN with interface ethernet-ccc input-vlan-map/output-vlan-map can cause traffic blackhole
Product-Group=junos 		On the ACX5448 platform, l2vpn application with ethernet-ccc input-vlan-map/output-vlan-map can experience traffic blackhole while the control plane is still up. This issue is a software defect introduced by changes made via PR1456624 in the ethernet-ccc ingress interface. This software defect adds an internal vlan tag to all packets. As a result, customers' desired vlan-tag was not added in ccc->mpls direction. Causing the remote PE -- expecting vlan-tagged traffic -- to drop these packets due to vlan mismatch.
PR Number Synopsis Category: Interface Information Display
1439440 The number of mgd processes increases because the mgd processes are not closed properly.
Product-Group=junos 		On SRX Series platforms, sometimes the mgd processes are not properly closed. As a result, many mgd instances are unnecessarily left running.
PR Number Synopsis Category: Libjtask for RPD tasks, scheduler, timers, memory, and slip
1429719 Junos OS: A race condition vulnerability may cause RPD daemon to crash when processing a BGP NOTIFICATION message. (CVE-2020-1629)
Product-Group=junos 		A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. Refer to https://kb.juniper.net/JSA11009 [juniper.net] for more information.
PR Number Synopsis Category: Kernel software for AE/AS/Container
1459692 In MC-LAG scenario traffic destined to VRRP virtual MAC gets dropped
Product-Group=junos 		When VRRP (virtual router redundancy protocol) is configured on MC-LAG (multichassis link aggregation groups), traffic destined to VRRP virtual MAC address might get dropped because the virtual MAC is not correctly programmed in PFE (packet forwarding engine).
PR Number Synopsis Category: jdhcpd daemon
1419437 The dhcp relay sessions could not be established successfully
Product-Group=junos 		If dhcp group configuration is added without any interface, the jdhcpd maybe not aware of the group configuration after the group is applied on an interface.
1429456 The DHCP DECLINE packets are not forwarded to DHCP server when forward-only is set within dhcp-reply
Product-Group=junos 		If forward-only is set within dhcp-reply in Juniper device as a DHCP relay agent, the DHCP DECLINE packets which are broadcasted from DHCP client are dropped and not forwarded to DHCP server.
PR Number Synopsis Category: Security platform jweb support
1499280 Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
Product-Group=junos 		Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services (CVE-2020-1631). Refer to https://kb.juniper.net/JSA11021 [juniper.net] for more information.
PR Number Synopsis Category: Platform infra to support jvision
1415884 Possible memory leak in Chassisd
Product-Group=junos 		Chassisd process will be leaking memory without specific operation. Memory leak continues as long as chassisd is running and there is no way to stop leaking. This would cause eventual chassisd crash and unexpected MPC restarting. Process would crash when its memory utilization goes beyond 3Gbyte.
PR Number Synopsis Category: Layer 2 Control Module
1469635 Memory leak on l2cpd process might lead to l2cpd crash
Product-Group=junos 		On all Junos platforms with l2cpd (Layer-2 control protocols) daemon, committing configuration changes which are processed by l2cpd (e.g., flexible-vlan-tagging, stacked-vlan-tagging, vlan-tagging, family ethernet-switching) might cause marginally memory leak. Committing the l2cpd processed configuration changes in a successive manner might cause the memory resource exhaustion (Some operations have the same effect as the committing action, e.g., bouncing a vlan-tagged interface in a successive way). Eventually, it could result in the l2cpd process crash.
PR Number Synopsis Category: rtsock kernel instrastructure
1407000 Kernel memory leak in virtual-memory due to interface flaps (CVE-2020-1625)
Product-Group=junos 		The kernel memory usage represented as "temp" via 'show system virtual-memory' may constantly increase when Integrated Routing and Bridging (IRB) is configured with multiple underlay physical interfaces, and one interface flaps. This memory leak can affect running daemons (processes), leading to an extended Denial of Service (DoS) condition. Refer to https://kb.juniper.net/JSA11004 [juniper.net] for more information.
PR Number Synopsis Category: QFX PFE Class of Services
1476829 QFX Platforms are exhibiting invalid PFE PG counter pairs to copy, src 0xfffff80, dst 0
Product-Group=junos 		On QFX Series Switches one may see "invalid PFE PG counter pairs" errors might be displayed as a result of polling class of service-related SNMP OIDs. These messages might eventually lead to interface counters not being populated properly.
PR Number Synopsis Category: QFX MPLS PFE
1469998 If continuous interface flaps at ingress/egress of PE devices, IP routed packets might be looped on the MPLS PHP node
Product-Group=junos 		On QFX5K platform, when MPLS node-link-protection is configured on all nodes (PE and P device), the IP routed packets might be looped on the MPLS PHP node (P device) if continuous interface flaps at ingress/egress of PE devices.
PR Number Synopsis Category: KRT Queue issues within RPD
1446320 ,The rpd process might crash when it is terminated immediately after it has been started
Product-Group=junos 		When the rpd process is terminated immediately after it has been started, the rpd process might crash due to a race condition.
PR Number Synopsis Category: RPD Next-hop issues including indirect, CNH, and MCNH
1424819 The rpd keeps crashing after changing configuration
Product-Group=junos 		In the ECMP (Equal-Cost Multipath) environment with existing more than 8 multipath for a given route, changing configuration (e.g. delete routing protocol IGP or LSP) is trying to delete a software structure which was already corrupted sometime earlier due to memory corruption, and this may cause the rpd to keep crashing. This issue applies to all types of nexthops with multipath.
PR Number Synopsis Category: show route table commands, tracing, and syslog facilities
1421076 RPD crash might occur when changing prefix list address from IPv4 to IPv6
Product-Group=junos
RPD crash might occur when changing a prefix-list address from IPv4 to IPv6 with "replace-pattern"
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1396785 The MS-MPC might core when mspmand receives a non-syn packet of TCP
Product-Group=junos 		On MX Series platforms and when MS-MPC line card is used, if the ms/ams-interface is not configured and mspmand (Multiservices PIC management daemon) receives a non-synchronized packet of TCP, the MS-MPC might crash due to some NULL pointer issues of the global configuration variable.
1402260 The mspmand process might crash with lots of error logs seen in high scaled MX platforms with MS-MPC/MS-MIC
Product-Group=junos 		On MX platforms with MS-MPC/MS-MIC, if "services-options tcp-tickles" is enabled for the Transmission Control Protocol (TCP) traffic which needs TCP tickles packets, when there are high scale of application sessions and traffic loaded (e.g. 200K sessions), there might be lots of error logs observed, together with the service interface flapping and the mspmand process crash.
1405917 The FPC crash might be observed in MS-MPC HA environment
Product-Group=junos 		On MX Series platform with MS-MPC card used, in race condition, if the MS-MPC is used on HA (High Availability) scenario ( the 'set interfaces ms-x/x/x redundancy-options redundancy-peer/redundancy-local' knob and GRES is configured), the FPC might crash due to the bus error (segmentation fault). The reason is that two CPUs simultaneously access the same session-extension memory in the session structure, one for writing, the other for reading. A reading CPU gets an incorrect value and uses that as the memory address. This causes the bus error (segmentation fault).
PR Number Synopsis Category: Junos Automation, Commit/Op/Event and SLAX
1436773 The /var/db/scripts directory might be deleted after executing "request system zeroize"
Product-Group=junos 		On all platforms which support ZTP (Zero Touch Provisioning), the /var/db/scripts directory might get deleted after executing "request system zeroize", and it won't be recreated automatically.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1465171 Commit script does not apply changes in private mode unless a commit full is performed
Product-Group=junos 		Commit script does not apply changes in private mode unless a commit full is performed.
 

18.4R1-S7 - List of Known issues

PR Number Synopsis Category: Border Gateway Protocol
1454198 The rpd scheduler slip for BGP GR might be up to 120s after the peer goes down
Product-Group=junos 		In BGP GR (graceful-restart) scenario (graceful-restart is configured for BGP or GR-helper mode is enabled by default), when high-scale routes get learnt from one peer, the rpd scheduler slip might be up to 120s after that BGP peer flaps.
PR Number Synopsis Category: Cassis pfe microcode software
1459698 Traffic blackholing upon interface flap after DRD auto-recovery
Product-Group=junos 		An interface stops forwarding traffic when MX software triggers a "DRD reorder timeout recovery" event follows by an interface flap on the same XMCHIP. When the logic is triggered, you will see a "cmtfpc_xmchip_drd_reorder_id_timeout_callback" message in the PFE syslog messages. This issue affects XM based MPCs (3E 4E 5E 6E 2E-NG 3E-NG).
PR Number Synopsis Category: ACX platform interface issues
1499130 [PDT][DNX] QSFP I2C errors in steady state, linux_i2c_mq : 224 Error in read ack, status 5, qsfp_tk_eeprom_scanning_check: RIO-MIC(0/1)(0) failed scanning eeprom addr 0x40 err 1
Product-Group=junos 		The error log "linux_i2c_mq : 224 Error in read ack, status 5, qsfp_tk_eeprom_scanning_check: RIO-MIC(0/1)(0) failed scanning eeprom addr 0x40 err 1" is seen due to I2C read failure in one of the periodic calls. It is seen intermittently and not causing any impact to functionality. The I2C read eventually succeeds in the subsequent periodic calls thereby not causing any problem.
PR Number Synopsis Category: Flow Module
1465944 Junos OS: High-End SRX Series: Multicast traffic might cause all FPCs to reset. (CVE-2020-1634)
Product-Group=junos 		On High-End SRX Series devices, in specific configurations and when specific networking events or operator actions occur, an SPC receiving genuine multicast traffic may core. Refer to https://kb.juniper.net/JSA11014 [juniper.net] for more information.
PR Number Synopsis Category: Layer 2 Control Module
1505710 L2CPD core found @ erp_add_restart_perst_stp_inst_info pmem_walk erp_build_restart_perst_stp_inst_info
Product-Group=junos 		This core will be seen if you have added/deleted ERP config multiple times and then restarted l2cpd or rebooted the box. When this issue is hit, l2cpd will not recover again and it would be coring continuously.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1463802 The scheduled tasks might not be executed if "cron" daemon goes down without restart automatically
Product-Group=junos 		The service utility "cron" runs in the background and regularly checks /etc/crontab for tasks to execute and searches /var/cron/tabs for custom crontab files. These files are used to schedule tasks which "cron" runs at the specified times. "cron" daemon is started during boot. If for some reason, the "cron" process exits, the scheduled tasks will not be executed. "cron" was not restarted automatically and had to be started manually.
PR Number Synopsis Category: IPv6/ND/ICMPv6 issues
1439844 DHCPv6 relay binding is not up when integrated routing and bridging(IRB) interface enabling DHCPv6 Snooping and Neighbor Discovery Inspection (NDI) simultaneously on EX9200
Product-Group=junos 		In DHCPv6 relay scenario, when DHCPv6 snooping and NDI enable simultaneously on IRB interface on EX9200, DHCPv6 relay binding is not up.
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1376060 MS-MPC might have performance degradation under scaled fragmented packets
Product-Group=junos 		On MX Series platforms with MS-MPC, it might have performance degradation if the MS-MPC receives scaled fragmented packets.
1459306 The traffic might be stuck on MS-MPC/MS-MIC with sessions receiving huge number of affinity packets
Product-Group=junos 		On MX platforms with MS-MPC/MS-MIC, if there are sessions receiving huge number of affinity packets (e.g. thousands of packets), the service interface might be brought down by the prolonged flow-control, and the mspmand process crash might happen. In this case, the traffic will be stuck due to this issue.
1489942 mspmand core due to Prolonged flow-control asserted.
Product-Group=junos 		On MX platforms with MS-MPC/MS-MIC, mspmand currently doesn't have throttling of local generated packets like TCP-tickle and UDP-logging. As the result of this, there can be data congestion on data path of XLP leading to blocking of data-path. Eventually, this leads too prolonged flow-control, the service interface might be brought down by the prolonged flow-control, and the mspmand process crash might happen.
PR Number Synopsis Category: SFW, CGNAT on MS-MIC/MS-MPC (XLP)
1335956 The MAC_STUCK might be seen on MS-MPC or MS-MIC
Product-Group=junos 		On MS-MPC/MS-MIC in ALG scenario, MAC_STUCK might be seen and traffic may be lost.
1442552 Different formats of the B4 addresses may be observed in the SERVICES_PORT_BLOCK_ALLOC/RELEASE/ACTIVE log messages
Product-Group=junos 		In DS-lite setup implementation on MS-MPC card different B4(Basic Bridging Broadband) address formats for JSERVICES_NAT_PORT_BLOCK_RELEASE log may be observed when softwire-prefix is configured under the service set, but a unified behaviour is required.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1404946 Configuring using the CLI editor in J-Web generates an mgd core dump and commit does not work.
Product-Group=junos 		Configuring using the CLI Editor in the J-Web generates an mgd core dump and commit does not work.
1439805 When group is applied at non-root level then updating knobs inside the group is not updating hierarchies where it's applied
Product-Group=junos 		On all Junos platforms, if a group is applied at non-root level and later some knob from the group is deleted, then change bits are not set for the hierarchy where the group is applied.

Modification History

2022-03-23: non-technical changes; corrected formatting issue
2020-05-20: First publication