Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

ACX, EX, MX, PTX, QFX, NFX, VRR, and VMX

Alert Description

Junos Software Service Release version 17.3R3-S8 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Warning: With VPLS/Bridge-Domain environment, an MX/EX9200 Series router with Trio-based MPCs running software version 17.3R3-S8. The MPCs may experience NH memory leak in the PFEs when using integrated routing and bridging (IRB) interface participating in the VPLS/Bridge-domain instance.

Junos Software service Release version 17.3R3-S8 is now available.

17.3R3-S8 - List of Fixed issues

PR NumberSynopsisCategory: Software build tools (packaging, makefiles, et. al.)
1417345The JSU package installation may fail
Product-Group=junos		In a specific scenario, the JSU (Junos OS selective upgrade) package installation on a router which has JET (Juniper Extension Toolkit) package installed may fail due to "Operation not permitted" error. This issue does not impact service and traffic.
PR NumberSynopsisCategory: DOT1X
1462479EX-4600-EX-4300: Mac entry missing in Ethernet-Switching table for Mac-radius client in server fail scenario when tagged is sent for 2 client
Product-Group=junos		In a server-fail scenario, when tagged traffic is sent for the first client, MAC learning happens for both data and voice. But for the second client on the same interface, learning happens only for voice. This is because the VLAN is already added for an interface due to first client authentication process.
PR NumberSynopsisCategory: L2NG RTG feature
1461293MAC addresses learned on RTG may not be aged out after aging time
Product-Group=junos		MAC addresses learned on redundant trunk group (RTG) might not be aged out after aging time if the source interface is configured as RTG.
PR NumberSynopsisCategory: EX9200 Platform
1467459The MAC move message may have an incorrect "from" interface when MAC moves rapidly
Product-Group=junos		On the EX2300/3400/4300/4600/9200 platform, in some cases, if MAC moves rapidly, traffic might be impacted and the MAC move message might have an incorrect "from" interface.
PR NumberSynopsisCategory: EX2300/3400 PFE
1448071Unicast arp requests are not replied with no-arp-trap option.
Product-Group=junos		When unicast arp request is received by EX3400/QFX5100 switch and it is configured with "set switch-options no-arp-trap option", the arp request may not be replied. This has been fixed and unicast ARP request will be replied even with "set switch-options no-arp-trap option" configuration.
PR NumberSynopsisCategory: Platform-side analytics for QFX
1456282Telemetry traffic might not be sent out when telemetry server is reachable through different routing-instance
Product-Group=junos		On QFX Series switches (except for QFX10000) with Jvision enabled, the telemetry traffic might be locally dropped when the egress interface to the telemetry server is a part of non-default routing-instance.
PR NumberSynopsisCategory: QFX Multichassis Link Aggregrate
1459201The MC-LAG configuration-consistency ICL-config might fail after committing some changes
Product-Group=junos		When adding VLANs to an MC-LAG interface, the configuration-consistency ICL-config might fail after committing the changes. Resulting in a failure to add VLANs and a disabled MC-LAG interface.
1488681MC-LAG consistency check fails if multiple IRB units are configured with same VRRP group
Product-Group=junos		Multichassis Link Aggregation Group (MC-LAG) configuration consistency check fails if the same VRRP group identifier is used for multiple IRB units configuration on the local and remote MC-LAG peers. The fix of this PR corrects the defect and makes the MC-LAG consistency check pass as expected.
PR NumberSynopsisCategory: QFX PFE L2
1467466Few MAC addresses might be missing from MAC table in software on QFX5k platform.
Product-Group=junos		On QFX5k platform, if Packet Forwarding Engine process is restarted manually or device reboot occurs, some MAC address(es) might not be seen on software MAC table but MAC address will be present in hardware table.
PR NumberSynopsisCategory: QFX L3 data-plane/forwarding
1308611The FPC might crash when implicit filter chaining is attached to an interface
Product-Group=junos		When implicit filter chaining (two or more implicit filters are attached to the same interface) is attached to an interface, in race condition, FPC might crash. For example, on the loopback interface, there is a default DDOS implicit filter exist, so add another implicit filter (e.g. attach a BFD session) to the loopback interface might trigger this issue.
1437943The IPv4 fragmented packets might be broken if PTP transparent clock is configured
Product-Group=junos		When Precision Time Protocol (PTP) transparent clock is enabled, PTP adds the residence time to the Correction Field of the PTP packets as they pass through the device. On QFX5K platforms with PTP transparent clock enabled, the IPv4 fragmented packets of UDP datagram might be broken by PTP in some rare scenario, and the corrupted packets will be discarded by system. This issue has traffic impact.
1460791JDI-RCT : QFX 5100 VC/VCF : Observing Error brcm_ipmc_route_counter_delete:3900Multicast stat destroy failed (-10:Operation still running) after ISSU with Mini-PDT base configurations
Product-Group=junos		"multicast stats related errors like " brcm_ipmc_route_counter_delete:3900Multicast stat destroy failed (-10:Operation still running)" will be observed during ISSU and these messages are harmless and does not affect multicast functionality".
1487707CPU port queue gets full due to excessive pause frames being received on interfaces, this causes control packets from the CPU to all ports to be dropped
Product-Group=junos		On QFX5000 platforms (QFX5100/QFX5110/QFX5120/QFX5200/QFX5210) with point-to-point multi-link scenario, when the switch ingress buffer saturation happens, all interfaces on multi-link stop sending traffic at the same time.
PR NumberSynopsisCategory: ACX MPLS
1449681Layer 2 circuit with a "backup-neighbor" (hot-standby) configured may stop forwarding traffic after failovers.
Product-Group=junos		On ACX platforms, if the "backup-neighbor" is configured with the "hot-standby" parameter, then l2circuit may stop passing traffic if the primary path is down and back up again (l2circuit switchovers from the primary path to the backup path, then moves back from the backup path to the primary path).
PR NumberSynopsisCategory: "agentd" software daemon
1455384Agentd memory may leak and crash when RPD session closing without releasing memory on PTX or MX
Product-Group=junos		On PTX and MX, agentd memory may leak and crash because its memory leaking happens when the internal communication is broken between agentd and rpd.
PR NumberSynopsisCategory: MPC Fusion SW
1463859The MPC2E-NG/MPC3E-NG card with specific MIC might crash after a high rate of interface flaps
Product-Group=junos		If any MIC of type MIC-3D-2XGE-XFP / MIC-3D-4XGE-XFP / MIC-3D-20GE-SFP-E / MIC-3D-20GE-SFP-EH / MIC-MACSEC-20GE is installed in MPC2E-NG/MPC3E-NG card, the Microkernel (uKern) might hog for CPU on Packet Forwarding Engine (PFE) when there is a high rate of interface flaps (~30/40 flaps per second). This will eventually trigger the MPC2E-NG/MPC3E-NG card crash with an NGMPC core file. Normally the excessive interface flapping won't happen frequently in the real-world and it may be caused due to the external environment. This fix will reduce the impact and prevent the uKern hog when having such conditions. The fix for this issue causes a regression as documented in TSB17782 [juniper.net] and PR1508794 which affects interfaces with "WAN-PHY" framing.
PR NumberSynopsisCategory: BBE interface related issues
1440872The layer2 dynamic VLAN might be missed when an interface is added or removed for an AE interface
Product-Group=junos		On MX-Series platform with dynamic VLAN configuration for subscriber management, if a physical interface is added or removed for an Aggregated Ethernet (AE) interface and if dynamic VLAN is enabled on AE interface, some of the dynamic layer2 interfaces might be deleted from the Packet Forwarding Engine (PFE), but not from bbe-smgd. This will cause the subscriber under the AE interface to be deleted.
PR NumberSynopsisCategory: BBE OS Infrastructure library
1414333DHCP/DHCPv6 subscribers might fail to establish sessions on PowerPC based MX platforms
Product-Group=junos		On MX5/10/40/80/104 platforms running with Dynamic Host Configuration Protocol version 4/version 6 (DHCPv4/v6) subscribers, if large-scale subcribers (e.g. around 3500 in total) try to establish sessions simultaneously from multiple access interfaces, the DHCPv4/v6 sessions might always fail to set up due to this issue. As a result, the session set up rate would be much lower than expected.
PR NumberSynopsisCategory: BBE Resource monitoring related issues
1431566Subscribers coming from new IFDs might not login in due to 512 entries limit in the subscriber-limit table.
Product-Group=junos		On MX platforms, in subscriber management scenario, if the 512 entries are exhausted in the subscriber-limit table, the subscribers which come from new IFDs might not login in.
PR NumberSynopsisCategory: Border Gateway Protocol
1387720BGP sessions might keep flapping on backup Routing Engine if proxy-macip-advertisement is configured on IRB interface for EVPN-VXLAN.
Product-Group=junos		In EVPN+VXLAN scenario, if proxy-macip-advertisement is configured on IRB (Integrated Routing and Bridging) interface for the EVPN (Ethernet VPN), the BGP sessions might flap on backup RE even the system is shown ready for the hitless switchover, hence there might be traffic loss after GRES switchover if BGP sessions are down on backup RE at the time of GRES switchover.
1414021The rpd gets stuck in a loop while doing the multipath calculation which leads to the high CPU usage
Product-Group=junos		In BGP with the indirect next-hop scenario, if uRPF is enabled, and then enable BGP multipath, a background job loop might be formed and the CPU utilization of rpd process might be stuck at 100%.
1437837The rpd process crash might be observed if leaking multi-pathed BGP routes from routing-instance to another routing table
Product-Group=junos		This issue applies to Junos platforms with BGP multipath configured under a routing-instance and a RIB group is deployed to leak routes from that routing-instance to another routing table. "rpd" may restarts unexpectedly when performing multipath calculation operations for the secondary routes - (such as, removing the rib-groups/bouncing BGP neighbor under routing-instance.) The secondary routes refer to the second RIB in a RIB (Routing Information Base) group.
1461602The rpd scheduler slips might be seen on RPKI route validation enabled BGP peering router in a scaled setup
Product-Group=junos		In scaled BGP environment (e.g. global table ~3M routes or more) when there are a lot of (e.g 10k or more) more specific routes for a certain IPv4 or IPv6 prefix covered by some RV (route validation) record, a change in RV records database might lead to rpd (routing protocol daemon) scheduler slips, which could trigger routing protocol adjacency flap. The same could be triggered by executing "clear validation database" command or shortly after initial session RPKI (resource public key infrastructure) establishment event.
1472671The rpd process might crash with BGP multipath and damping configured
Product-Group=junos		On all Junos platforms running with Border Gateway Protocol (BGP), if both BGP multipath and BGP damping are configured, it might happen that, when the active route, for example r1, is withdrawn but it is not really deleted due to damping, then BGP might be unable to find its original gateway when the route r1 is relearned and becomes the best route again. It will lead to the rpd process crash.
1473351Removing cluster from BGP group might cause prolonged convergence time
Product-Group=junos		Cluster removal from BGP group might lead to a state where each subsequent change to BGP configuration will trigger import policy reevaluation causing prolonged convergence time of several minutes. This might result in a traffic loss.
1482551The rpd might be crashed after BGP peer flapping
Product-Group=junos		On all Junos platforms, with BGP long-lived graceful restart (LLGR) or BGP route dampening configuration, The rpd might be cored after BGP peer flapping. This is a day-1 issue.
1487691High CPU utilization might be observed when the outgoing BGP updates are sending slowly
Product-Group=junos		On all Junos platforms with the BGP routing protocols, the rpd process might go into a high CPU utilization causing slow network convergence. If a BGP peer is receiving and processing BGP updates slowly, this may cause the BGP output queue of the sending BGP peer to be full. When the queue is full it causes high CPU utilization of the BGP IO thread (bgpio, it is part of the rpd daemon) on the sending BGP peer. This defect could cause network-wide slow BGP network convergence. (See also https://kb.juniper.net/TSB17725 [juniper.net])
1487893The process rpd may generate soft cores after "always-compare-med" is configured for BGP path-selection
Product-Group=junos		If a manually configured RIB group or an automatically generated RIB group (through "family inet labeled-unicast resolve-vpn") is used to copy inet.0 (IP routing table) routes to inet.3 (MPLS routing table), the rpd process might continuously generate soft core files after "protocols bgp path-selection always-compare-med" is configured.
PR NumberSynopsisCategory: Cassis pfe microcode software
1380566FPC Errors might be seen in subscriber scenario
Product-Group=junos		In subscriber scenario, if the"service-accounting-deferred" is configured on dynamic-profile, and there is multicast to a large number of destinations on the same physical port, the FPC Errors might be seen.
1459698Silent dropping of traffic upon interface flapping after DRD auto-recovery.
Product-Group=junos		An interface stops forwarding traffic when MX software triggers a "DRD reorder timeout recovery" event follows by an interface flap on the same XMCHIP. When the logic is triggered, you will see a "cmtfpc_xmchip_drd_reorder_id_timeout_callback" message in the PFE syslog messages. This issue affects XM based MPCs (3E 4E 5E 6E 2E-NG 3E-NG).
1464820MPC5E/6E might crash due to internal thread hogging the CPU
Product-Group=junos		PR 1382182 (which is fixed in 16.2R3 17.1R3 17.3R3-S3 17.3R4 17.4R2-S3 17.4R3 18.1R3-S2 18.1R4 18.2R2 18.2X75-D40 18.3R2 18.4R1 19.1R1) introduced an improper code which could cause an internal thread to hog the CPU and eventually result in the MPC crash. It is a timing issue and affects MPC5E/6E.
PR NumberSynopsisCategory: MX Platform SW - FRU Management
1390016The jnxFruState might show incorrect PIC state after replacing an MPC with another MPC having less PICs
Product-Group=junos		After replacing an MPC with another MPC having less PICs, for example MPC7E has only two PICs, and after MPC4E (which has 4 PICs) replacement with such card PICs 3 and 4 that were present in the system before will be reported as offline instead of not present if jnxFruState is polled.
1463169The RE switchover may not be triggered when the primary CB clock failure
Product-Group=junos		On the specific Junos platforms, the RE switchover may not be triggered when the primary CB clock failure is detected. The primary CB with faulty clock can't operate normally and this issue may cause fabric plane failure.
PR NumberSynopsisCategory: Class of Service
1428144The host-inbound packets might be dropped if configuring host-outbound FC
Product-Group=junos		On all Junos platforms, if class-of-service host-outbound-traffic forwarding-class is configured and the FC (Forwarding Class) is with an implicit/explicit discard action in the firewall filter, the kernel might classify the host-inbound traffic to the same FC and being discarded.
1500250MX with linecards using MPC1-Q/MPC2-Q might report memory errors
Product-Group=junos		MPC1-Q/MPC2-Q parity error might be detected within "QDR/RLD and Internal Memory" and invoking major alarm. The default action for major alarm is disable-pfe with JunOS version 17.3 or higher. Enhancements has been added to auto-correct parity errors within the static memory area and record the repair attempt. If repairing threshold is reached, Major Alarm is triggered.
PR NumberSynopsisCategory: L2NG Access Security feature
1478375The process dhcpd may crash in a Junos Fusion environment
Product-Group=junos		On EX92XX platforms with the DHCP snooping configured, if a peer receives DHCPv6 packets from the server without the "client-id" option present, and it is syncing packets to the other side at that time, then the process dhcpd crash may be observed.
PR NumberSynopsisCategory: Firewall Filter
1450928The ARP packets are getting dropped by PFE after chassis-control is restarted
Product-Group=junos		If bfd-liveness-detction is enable, chassis-control is performed, in a very rare situation, stale bfd implicit filter causes hostbound arp packet drop. Even if the chassis-control is finished, bgp neighbors still stuck as a result of arp resolution.
PR NumberSynopsisCategory: dhcpd daemon
1471161DHCP relay with forward-only might fail to send OFFER messages when DHCP client is terminated on logical tunnel interface
Product-Group=junos		On all Junos platforms, when DHCP relay is configured with forward-only, and DHCP client is terminated on logical tunnel interface that multiple IFLs under this lt- interface have a same VLAN, DHCP relay might fail to send OFFER messages.
PR NumberSynopsisCategory: JUNOS Dynamic Profile Configuration Infrastructure
1421589bbemg_smgd_lock_cli_instance_db should not log as error messages
Product-Group=junos		The "bbemg_smgd_lock_cli_instance_db: lock/unlock failed" messages are harmless and should not be considered as error:
PR NumberSynopsisCategory: dynamic dcd prs
1470622Executing commit might hang up due to stuck dcd process
Product-Group=junos		When dynamic DHCP sessions are existing in the device, if multiple commits in parallel are performed, the commit might hang up.
PR NumberSynopsisCategory: EVPN control plane issues
1399371When committing a configuration for a VLAN adding to an EVPN instance and an AE interface respectively the newly added VLAN interface count might be zero (0) in that bridge domain
Product-Group=junos		On all MX-Series platforms with EVPN supported, when committing a configuration for a VLAN adding to an EVPN instance and an AE interface respectively the newly added VLAN interface count might be zero (0) in that bridge domain and causes all the traffic in that VLAN to be blocked. However, if the two configurations are committed all together in one time, the interface count will be the correct number right after the committing.
1467309The rpd might crash after changing EVPN related configuration
Product-Group=junos		In EVPN scenario without encapsulation type specified (the default EVPN encapsulation type is set to MPLS), if "vlan-id none" and "vni " is configured in EVPN instance, the rpd might crash after changing EVPN related configuration (such as set the encapsulation as vxlan or delete label-allocation scheme).
PR NumberSynopsisCategory: EVPN Layer-2 Forwarding
1404857EVPN database and bridge mac-table are out of sync due to the interface's flap
Product-Group=junos		If some interfaces flap faster on the remote PE, EVPN database and bridge mac-table might be out of sync on the local PE device. When this issue occurs, it may cause the impacted PE broadcasts packets to all the other PEs. And the broadcasted packets might cause traffic congestion which results in packet loss.
PR NumberSynopsisCategory: Issues related to EX MACsec
1469663Traffic loss might be seen with framing errors or runts if MACsec is configured on EX4600/QFX5100 platforms
Product-Group=junos		On EX4600/QFX5100 platforms with MACsec configured, if traffic flows through the MACsec-enabled link, increase in framing errors or runts statistics might be seen in the "show interfaces extensive <>" command for the affected interface. Traffic loss might also happen due to this issue.
PR NumberSynopsisCategory: Express PFE FW Features
1462634The sample, syslog, or log action in output firewall filters for packets of size less than 128 bytes might cause an ASIC wedge (all packet loss) on PTX platforms
Product-Group=junos		On PTX platforms, if output firewall filter is configured with sample/syslog/log action, the host interface might get wedged for packets with lengths 0-128 including Layer 3 headers.
1491575BFD sessions start to flap when the firewall filter in the loopback0 is changed
Product-Group=junos		On PTX/QFX10000 Series platforms with large filter configuration (for example, one filter has more than 500 terms or one term has more than 500 filters) scenario, during the change operation of loopback0 filter, the BFD sessions start to flap.
PR NumberSynopsisCategory: Express PFE L2 fwding Features
1399369CPU hog may be observed on PTX/QFX10000 Series platform
Product-Group=junos		On PTX/QFX10000 series platform, CPU hog on PFC may be observed if the adaptive feature is enabled to load-balance for an AE interface.
PR NumberSynopsisCategory: PTX Express ASIC interface
1412126PTX Series device interface stays down after maintenance.
Product-Group=junos		On PTX3000/PTX5000 linecard (QSFP28-100GBASE-LR4) interface may stay down after software upgrade. Issue is usually observed on links connected to another vendors equipment.
PR NumberSynopsisCategory: Interface Information Display
1301858Reported same IFD KV by two different sensors
Product-Group=junos		The duplicate keys have been removed from being exported by IFD:PFE, they will only be exported by MIB2D now.
PR NumberSynopsisCategory: Libjtask for RPD tasks, scheduler, timers, memory, and slip
1448325The rpd process might crash if BGP is activated/deactivated multiple times
Product-Group=junos		On all Junos platforms running with Border Gateway Protocol (BGP) configured with "rib-sharding" and "update-threading", if scaled number of BGP peers are established, when BGP is activated/deactivated for multiple times, and BGP neighbor sessions are cleared repeatedly on all the BGP speakers in the network, the rpd process might crash due to this issue.
PR NumberSynopsisCategory: Kernel software for AE/AS/Container
1474300A newly added LAG member interface might forward traffic even though its micro BFD session is down
Product-Group=junos		On all Junos platforms, if a static Link Aggregate Group (LAG) is configured, and Bidirectional Forwarding Detection (BFD) is enabled on the LAG which is also called as micro BFD, a newly added member link might start to forward traffic immediately when the configuration change commits even though its micro BFD session is still down, for example, add a new member interface only on single end, and the remote member interface is disabled or not added. Therefore, traffic loss might be seen due to this issue.
PR NumberSynopsisCategory: Optical Transport Interface
1429279After member interface flapping, aggregated Ethernet interface remains down on 5X100GE DWDM CFP2-ACO PIC.
Product-Group=junos		On 5X100GE DWDM CFP2-ACO PIC on PTX series platforms, if any AE member interface flaps, the AE interface might stop receiving the LACP RX packets and fail to come up. It can be recovered by disabling/enabling the AE interface.
PR NumberSynopsisCategory: ISIS routing protocol
1455432The rpd might crash continuously due to memory corruption in ISIS setup
Product-Group=junos		With ISIS configured and in a very rare case, memory corruption may occur, this may cause rpd crash continuously.
PR NumberSynopsisCategory: Adresses ALG issues found in JSF
1483834FTPS traffic might get dropped on SRX Series or MX Series platforms if FTP ALG is used.
Product-Group=junos		On SRX Series or MX Series platforms with FTP ALG enabled, if there are more than one FTPS connection between a pair of FTP client and server, the closure of one connection might cause other connections between that pair of FTP client and server to be affected, hence there might be traffic impact. It is a rare timing issue.
PR NumberSynopsisCategory: Firewall Authentication
1475435SRX Series: Unified Access Control (UAC) bypass vulnerability (CVE-2020-1637)
Product-Group=junos		A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy; Refer to https://kb.juniper.net/JSA11018 [juniper.net] for more information.
PR NumberSynopsisCategory: Security platform jweb support
1499280Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
Product-Group=junos		Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services (CVE-2020-1631). Refer to https://kb.juniper.net/JSA11021 [juniper.net] for more information.
PR NumberSynopsisCategory: Layer 2 Circuit issues
1498040The l2circuit neighbor might be stuck in RD state at one end of MG-LAG peer
Product-Group=junos		In MC-LAG scenario, if the l2circuit is configured with primary-neighbor/backup-neighbor over the MC-LAG link and the l2ckt (l2ciruits control daemon for pseudowire) session of the primary-neighbor/backup-neighbor is flapped continuously (such as clear neighbor ldp and ospf etc), one of the remote neighbors may be stuck in RD (the remote pseudowire neighbor is down) state due to race condition between VC (virtual circuit) state update timer and L2ckt intf state change timer. Then, that pseudowire might be down, the traffic might be impacted if the RD pseudowire is not up.
PR NumberSynopsisCategory: Layer 2 Control Module
1473610ERP might not come up properly when MSTP and ERP are enabled on the same interface.
Product-Group=junos		When both MSTP and ERP are enabled on the same interface, then ERP does not come up properly.
PR NumberSynopsisCategory: mc-ae interface
1447693The l2ald might fail to update composite NH
Product-Group=junos		This is a timing issue where the l2ald receive underlay NH from rpd as part of LSI IFF ADD (VPLS core NH) and creates flood NH. Due to a flap at local IFL or core (VPLS etc.), the l2ald receives multiple LSI IFF Add and Delete in some order. In some sequence where rpd delete underlay NH from Kernel Forwarding table but the l2ald still create flood NH with this underlay NH, because IFF delete is yet to be received at the l2ald, so l2ald might fail to update Composite NH. This is generic L2 issue and can happen without mc-ae.
PR NumberSynopsisCategory: Platform issues specific to MS-MIC (XLP)
1384830Major Errors - XM Chip Error code: 0x701ca" seen after OIR of MIC's
Product-Group=junos		When a MIC is removed without being off-line from the MPC2E NG/MPC3E NG line card, the MPC2E NG/MPC3E NG card will report "Major Error" with the error id "XM Chip Error code: 0x701ca".
PR NumberSynopsisCategory: Application specific PRs (cos/snmp/time-sync/routing/BRAS)
1429797Extended Ukern thread(PFEBM task) priority to support BBE performance tuning
Product-Group=junos		Original PFEBM task, which is system-critical for internal network performance/resilience, was running a medium priority; Can see tnp queue errrors by 'show pfebm all' on VCP-bearing FPC when high rate of punt traffic (like ARPs or BGP route updates, etc.) which go through VC links. It needs to run at high priority to assure timely packet handling.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1497641The rpd might crash when SNMP polling is done using OID "jnxMplsTeP2mpTunnelDestTable"
Product-Group=junos		In a very rare P2MP with SNMP scenario, if the OID "jnxMplsTeP2mpTunnelDestTable" is polled by SNMP, the rpd (Routing Protocol Daemon) might crash since the relevant value is empty on the device and SNMP can not walk it at that time.
PR NumberSynopsisCategory: Multicast for L3VPNs
1460625The rpd process might crash due to memory leak in "MVPN RPF Src PE" block
Product-Group=junos		In NG-MVPN scenario with multiple multicast sources, the rpd process might crash due to memory leak in "MVPN RPF Src PE" block.
PR NumberSynopsisCategory: Fabric Manager for MX
1338647An enhancement for better accuracy on the drop statistic of the command "show class-of-service fabric statistics"
Product-Group=junos		The output of the CLI command show class-of-service fabric statistics now calculates traffic that was dropped because of internal errors in the fabric forwarding path.
PR NumberSynopsisCategory: Neo Interface
1400825A 10-Gigabit Ethernet interface may not come up if it has the "link-down" configured in the low-light scenario
Product-Group=junos		On MX platform, on a link which both ends have 10G Ethernet interfaces with "link-down" action configured when a low light condition is detected on one 10G interface and goes down, the link will end up in a "dead-lock" state. This condition will remain even after link restoration.
PR NumberSynopsisCategory: Track Mt Rainier RE platform software issues
1408480The alarm 'Mismatch in total memory detected' is observed after issuing "request reboot vmhost routing-engine both".
Product-Group=junos		Alarm 'Mismatch in total memory detected' is observed after reboot vmhost both.
PR NumberSynopsisCategory: Kernel Composite Next Hop (composite / l3vpn) Infrastructure
1287956Not following the guideline of rebooting entire chassis after changing chassis network-services configuration can cause vmcore and crash of FPCs/routing-engines on chassis.
Product-Group=junos		When configuration at hierarchy [edit chassis network-services] is changed a reboot of chassis is needed to avoid any unexpected behavior. One such behaviour is an assest condition due to issues in nexthop allocation leading to vmcore and reboot of FPCs/REs on the chassis. This PR introduces changes to handle such assert conditions gracefully and to avoid FPC/RE crash. The guideline of rebooting the entire chassis when configuration change is made is still valid.
PR NumberSynopsisCategory: FreeBSD Kernel Infrastructure
1146891The knob of "set system ports console log-out-on-disconnect" may not work
Product-Group=junos		"set system ports console log-out-on-disconnect" does not work.
PR NumberSynopsisCategory: "ifstate" infrastructure
1486161Kernel core might be seen if deleting an ifstate
Product-Group=junos		On all Junos platforms, some operations such as configuration change may cause state information to change and eventually cause the ifstate to be deleted. In a very rare case, deleting an ifstate (kernel state) might cause kernel core and RE (Routing Engine) restart. There is no specific trigger, this issue is reported by the configuration change.
PR NumberSynopsisCategory: Kernel MPLS / Tag / P2MP Infrastructure
1493053Backup RE might crash unexpectedly due to a rare timing issue
Product-Group=junos		The backup Routing Engine might crash unexpectedly due to a rare timing issue during a route churn in the network.
PR NumberSynopsisCategory: PFE Peer Infra
1448858Interface attributes might cause high CPU usage of dcd
Product-Group=junos		When the interface attributes are configured, this configuration might cause an error in the IRSD (IRSD syncing errors) and lead the CPU usage of dcd spike up. The convergence time of this interface will be impacted.
PR NumberSynopsisCategory: Kernel socket data replication issues for protocols that use
1472519The kernel may crash and vmcore may be observed after configuration change is committed
Product-Group=junos		On all Junos platforms, after committing the configuration change (e.g. removal of protocols like mpls, isis, ldp from the interfaces), then the kernel may crash and vmcore may be observed. This issue also may cause protocol adjacency failure.
PR NumberSynopsisCategory: TCP/UDP transport layer
1449664FPC might reboot with vmcore due to memory leak
Product-Group=junos		On all Junos platforms, if the device is up for a long period (e.g. several weeks or months), there might be a slow memory leak happening in some error scenarios where an application tries to send some data on a stale TCP socket (e.g. short-lived TCP connections used by the mgd process), and this issue might lead to FPC reboot with vmcore files.
PR NumberSynopsisCategory: PTX Broadway based PFE MPLS-LSPs RSVP VPNs tcc ccc software
1484255FPC might crash when dealing with invalid next-hops
Product-Group=junos		On a PTX3000 or PTX5000 platform with some specific FPCs, if the weights of links are set to an invalid value on an AE bundle interface or unilist (an unilist next hop composed of several unicast next-hops), an FPC crash might be observed. It is a rare issue and the FPC will try to reload to resolve this problem. Traffic loss might be seen before the FPC completes the reload period.
PR NumberSynopsisCategory: PTX5KBroadway based PFE IPv4, IPv6 software
1479789Multicast routes add/delete events might cause adjacency and LSPs to go down
Product-Group=junos		In PTX5000 platform with (FPC2-PTX-P1A | FPC-PTX-P1A), or PTX3000 with FPC-SFF-PTX-P1-A, with PIM/MVPN scenario, The adjacency relationships of routing protocols and LSPs might go down if add/delete some multicast routes (which can be achieved by flapping interface or protocol) ). It is because that though the routes are deleted, its counter for statistic will not be removed from Junos resulting in memory block for counter exhaustion. And due to the exhaustion, any protocols that are sharing the same memory scope might fail to allocate its own counter, which eventually causes protocol adjacency and LSPs to go down. [TSB17747 [juniper.net]]
PR NumberSynopsisCategory: vMX Platform Infrastructure related issue tracking
1419727The vMX might be deployed unsuccessfully on ubuntu 16.04 server for the first time
Product-Group=junos		In the scenario of deploying the vMX on the KVM based platforms (ubuntu 16.04), The vMX orchestration scripts setup up hugepages required for the vMX. The libvirt will use this hugepages to deploy the vMX. Then libvirt will be restarted so that the system can allocate resources (hugepages) to libvirtd. Sometimes system takes time to allocate these resources and hence the vMX might fail to be spawned by the orchestration scripts. The issue might not happen when the vMX is deployed for the second time.
PR NumberSynopsisCategory: VMX wrlinux changes
1386903vFPCs are in "Offline" and "Unresponsive" caused by RIOT processes fail to allocate buffer memory during start up
Product-Group=junos		vFPCs on a VMX -- especially in LITE mode -- show as "---Unresponsive---". In the LITE mode, these vFPCs could be running in a 32-bit mode. In the 32-bit mode, the amount of buffer memory (mbuf) is limited to 1G. The limit causes vFPC to not being able to come up -- caused by failing to allocate memory during its startup.
PR NumberSynopsisCategory: PTP related issues.
1421811PTP might not work on MX104 if phy-timestamping is enabled
Product-Group=junos		On MX104 platform with any 2-port license installed on 10G interfaces and phy-timestamping enabled in PTP, PTP might not work.
PR NumberSynopsisCategory: Interface related issues. Port up/down, stats, CMLC , serdes
1449406CRC error might be seen on the VCPs of the QFX5100 VC
Product-Group=junos		In QFX5100 VC (Virtual Chassis) scenario, CRC (Cyclic Redundancy Check) error might be seen on the VCPs (Virtual Chassis Port) when the VCPs are "BCM84328 PHY" ports. The CRC error indicates there is data corrupt, the issue might reduce the system performance. The issue can be avoided by using non-"BCM84328 PHY" ports as VCPs to build the VC.
1449406CRC error might be seen on the VCPs of the QFX5100 VC
Product-Group=junosvae		In QFX5100 VC (Virtual Chassis) scenario, CRC (Cyclic Redundancy Check) error might be seen on the VCPs (Virtual Chassis Port) when the VCPs are "BCM84328 PHY" ports. The CRC error indicates there is data corrupt, the issue might reduce the system performance. The issue can be avoided by using non-"BCM84328 PHY" ports as VCPs to build the VC.
PR NumberSynopsisCategory: QFX Control Plane Kernel related
1421250A vmcore is seen on QFX VC
Product-Group=junos		On QFX Series Virtual Chassis during shutdown, if an interrupt is received, the system gets into this state and vmcore is observed.
1421250A vmcore is seen on QFX VC
Product-Group=junosvae		On QFX Series Virtual Chassis during shutdown, if an interrupt is received, the system gets into this state and vmcore is observed.
PR NumberSynopsisCategory: QFX Platform related (SYSLOG/ALARMS/miscellaneous)
1402852File permissions are changed for /var/db/scripts files after reboot
Product-Group=junosvae		On newer QFX5K switches(QFX5K switch with qfx-5e image), file permissions are changed for /var/db/scripts files after reboot. This can impact scripts running on the box.
1449977FPC does not restart immediately after rebooting the system. That might cause packet loss
Product-Group=junosvae		On QFX10008 and QFX100016 switches, the traffic drop occurs after rebooting the system due to the time delay in rebooting the FPC.
1471216The speed 10m might not be configured on the GE interface
Product-Group=junos		On QFX5100 and EX4300 mixed-mode Virtual Chassis, the speed 10m might not be configured on the GE interface.
PR NumberSynopsisCategory: QFX PFE Class of Services
1453512The classifier configuration doesn't get applied to the interface in an EVPN/VXLAN environment
Product-Group=junos		On QFX5100/QFX5110/QFX5120/QFX5200/QFX5210 Series platforms with an EVPN/VXLAN scenario, the classifier might not be applied to the interface successfully and all traffic flows in the best-effort queue.
PR NumberSynopsisCategory: FIP snooping, FIP
1325408Syslog message ERROR l2cpd[X]: ppmlite_var_init: iri instance = 36736
Product-Group=junos		The error message "ppmlite_var_init: iri instance = 36736" is harmless and gets trigger whenever interface-speed is changed.
PR NumberSynopsisCategory: QFX L2 PFE
1473685The RIPv2 packets forwarded across a L2circuit connection might be dropped
Product-Group=junos		When RIPv2 routes are received on a QFX5100/EX4600 platforms, either to or from an L2 circuit connection, such packets are not propagated. This includes directed unicast RIPv2 packets.
PR NumberSynopsisCategory: QFX MPLS PFE
1474935L2circuit might fail to communicate via VLAN 2 on QFX5K platforms
Product-Group=junos		On QFX5K platforms acting as L2circuit PE (tunnel terminating node), if VLAN 2 is used for L2circuit communication with CE node, the VLAN 2 packets might be dropped on PE.
PR NumberSynopsisCategory: QFX EVPN / VxLAN
1473464QFX5K: "global-mac-table-aging-time" behavior with Multi homed EVPN VXLAN ESI
Product-Group=junos		When MAC change notification comes from L2 address learning daemon to PFE, PFE will handle this as MAC addition. That will cause the reset of MAC age timer in all FPC's of VC members in multi homed EVPN VXLAN-ESI cases. As part of MAC change HIT SA (Source Address) bits are wrongly programmed and leads to restart of the MAC age timer. So, MAC was aging in 3rd iteration and leading to this issue.
PR NumberSynopsisCategory: QFX VC Infrastructure
1414492VC Ports using DAC may not establish link on QFX5200
Product-Group=junos		On QFX5200, when virtual-chassis is configured, if the QSFP configured as VCP is removed and then inserted, VC Ports using direct attach copper (DAC) may not establish link.
PR NumberSynopsisCategory: KRT Queue issues within RPD
1485800krt-nexthop-ack-timeout may not automatically be picked up on rpd start / restart
Product-Group=junos		In some circumstances, primarily when rpd is being restarted. The value for krt-next-hop-ack-timeout may not automatically be picked up. This can be checked by checking the output of "show krt acknowledgement" and examining the value of "Kernel Next Hop Ack Timeout".
1501817Traffic blackhole might be seen in fast-reroute scenario
Product-Group=junos		From Junos release 17.2R1-S8 the session fast-reroute is enabled by default in PFE (Packet Forwarding Engines). In the platform using unilist (one kind of indirect next-hop) as route next hop type for multiple paths scenario (such as BGP PIC or ECMP), if BGP PIC or ECMP-FRR is used, In case of that the version-id of session-id of indirect next-hop (INH) is above 256, PFE might not respond to session update and hence it might cause the session-id permanently to be stuck with the weight of 65535 in PFE. It might lead PFE to have a different view of UNILIST against load-balance selectors. Then, the BGP PIC and the ECMP-FRR might not work properly, the traffic blackhole might be seen.
PR NumberSynopsisCategory: RPD Next-hop issues including indirect, CNH, and MCNH
1406070The rpd might crash or duplicated routes might be seen if doing configuration change with BGP multipath and flapping routes
Product-Group=junos		On all platforms, if doing configuration change (with BGP multipath) and flapping the IGP/LDP/RSVP routes simultaneously, the rpd crash or duplicated routes might be seen.
PR NumberSynopsisCategory: RPD policy options
1450123The rib-group might not process the exported route correctly
Product-Group=junos		The rib-group with a policy that matches route next-hop can fail to add the route to the secondary routing table when matched route next-hop is changed to another one and then referred back again after some time. This issue has traffic impact as the exported route will lose in the secondary routing table.
1453439Routes resolution might be inconsistent if any route resolving over the multipath route
Product-Group=junos		On all Junos platforms, any route resolving over the multipath routes, one scenario is BGP over BGP. After the metric value of any PNH (refers to the second PNH and using it to perform the second time next-hop resolving) changes, meanwhile, if the hash-selection changes happened, it might result in routes resolution inconsistency. Traffic drops could be observed if the packages are still forwarding to the old PNH (Protocol Next Hop). Any recursive resolving multipath scenario might trigger this issue.
PR NumberSynopsisCategory: show route table commands, tracing, and syslog facilities
1418152The rpd crash might be seen after changing the OSPF/OSPF3 interface bandwidth
Product-Group=junos		In OSPF/OSPF3 scenario, "set interface unit bandwidth" or ae member-links down/up may change the value of "OSPF reference bandwidth/interface bandwidth", then trigger rpd crash.
1421076RPD crash might occur when changing prefix list address from IPv4 to IPv6
Product-Group=junos		RPD crash might occur when changing a prefix-list address from IPv4 to IPv6 with "replace-pattern"
PR NumberSynopsisCategory: Resource Reservation Protocol
1476773RSVP LSPs might not come up in scaled network with very high number of LSPs if NSR is used on transit router
Product-Group=junos		If NSR is enabled on transit router with scaled RSVP LSPs, RESV message might not be sent from transit router because the path messages replication on primary RE does not complete in time. Hence RSVP LSPs might not come up with traffic impact.
PR NumberSynopsisCategory: jflow/monitoring services
1439630Sampling might return incorrect ASN for BGP traffic
Product-Group=junos		In a BGP scenario with sampling enabled, incorrect ASN (autonomous system number) might be returned for the traffic originated from an internal prefix. This is because some AS paths and routes don't hold the latest information in the message buffers that srrd (sampling route-record daemon) uses to send to the clients.
PR NumberSynopsisCategory: Sangria Platform including chassisd, RE, CB, power managemen
1471178A PTX5K SIB3 might fail to come up in slot 0 and/or slot 8 when RE1 is primary.
Product-Group=junos		A PTX5K SIB3 might fail to come up in slot 0 and/or slot 8 when RE1 is primary.
PR NumberSynopsisCategory: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1464020The mspmand might crash when stateful firewall and RPC ALG used on MX platforms with MS-MIC/MS-MPC
Product-Group=junos		On MX platforms with MS-MIC/MS-MPC, when stateful firewall is configured with "application junos-dce-rpc-portmap" and RPC ALG is enabled (both Sun RPC and MS-RPC), the mspmand might crash continuously (about every 15 or 20 minutes).
PR NumberSynopsisCategory: MPC7/8/9 Interface Issues
1463015The EA WAN SerDes gets into a stuck state, leading to continuous DFE tuning timeout errors and link staying down.
Product-Group=junos		The interfaces on certain MX platforms might get stuck in a down state, if the remote interface sends invalid code to the local interface. Link might not come up even after the remote peer has begun sending a good signal.
PR NumberSynopsisCategory: Stout PF fabric (SFB2)
1461356Traffic might be impacted because the fabric hardening is stuck
Product-Group=junos		Fabric hardening (FH) is the process of controlling bandwidth degradation to prevent traffic null route. When FH is processing, if SFB/SCB get failure, FH process will be stuck, which will get traffic lost.
PR NumberSynopsisCategory: MX10003/MX204 Platform SW - Chassisd s/w defects
1436832The device may not be reachable after a downgrade from some releases
Product-Group=junos		The primary routing-engine on an MX10003 may hang during a reboot after a software upgrade or downgrade. The back-up roting-engine does not subject to the same software issue.
PR NumberSynopsisCategory: Trio LU, IX, QX, MQ chip drivers, ucode & related SW
1449427On certain MPC line cards, cm errors need to be reclassified.
Product-Group=junos		Cm errors on certain MPC line cards are classified as major which should be minor or non-fatal. If these errors are generated, it might get projected as a bad hardware condition and therefore trigger Packet and Forwarding Engine disable action.
PR NumberSynopsisCategory: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1476786Traffic loss may be observed to the LNS subscribers in case the "routing-service" knob is enabled under the dynamic-profile
Product-Group=junos		On the MX platforms working in an enhanced subscriber environment, if the "routing-service" knob is enabled under the dynamic-profile for the LNS subscribers, l2tp services may not be programmed properly in the PFE due to timing, which causes forwarding issue to the affected subscribers.
PR NumberSynopsisCategory: Trio pfe stateless firewall software
1427936The policer bandwidth might be incorrect for the aggregate interface after activating the command 'shared-bandwidth-policer'.
Product-Group=junos		On MX Series with MPC, if an AE interface is with the filter of 'shared-bandwidth-policer' and the knob 'shared-bandwidth-policer' is deactivated, after activating the knob 'shared-bandwidth-policer', the policer bandwidth might be calculated as 0 and all traffic might be dropped for the AE interface.
1433034The FPC might crash when the firewalls filter manager deals with the firewall filters
Product-Group=junos		In some corner scenarios (e.g. the IGP neighbor flaps on the IFL configured with the firewall filters), the crash of FPC might be observed if the firewalls filter manager (DFW) deals with the filters of the interface.
PR NumberSynopsisCategory: Trio pfe bridging, learning, stp, oam, irb software
1491091MAC malformation might happen in a rare scenario under MX-VC setup
Product-Group=junos		On MX-VC setup, if traffic is going through a VCP (virtual chassis port) port and forwarding to an egress port to the destination, while the traffic is handled entirely by the same PFE, MAC malformation might happen.
PR NumberSynopsisCategory: Trio pfe multicast software
1478981The convergence time for MVPN fast upstream failover might be more than 50ms
Product-Group=junos		On MX platforms which act as Next Generation Mulicast Virtual Private Network (NG-MVPN) Provider Edge (PE) routers, if the hot-root-standby and sender-based-rpf features are configured to enable MVPN fast upstream failover, once the primary multicast flow rate falls below the configured "mvpn hot-root-standby min-rate rate" threshold, the egress PE router is supposed to take switchover action from the primary flows to the backup ones, and the covergence time should be within 50 milliseconds. Due to this issue, the covergence time might be more than 50ms and reach up to several seconds (e.g. 2~3s) in a highly scaled scenario (e.g. the number of the multicast groups undergoing the switchover simultaneously is greater than 250 groups). This will result in more traffic loss than expected.
PR NumberSynopsisCategory: Issues related to port-mirroring functionality on JUNOS
1411871Egress monitored traffic is not mirrored to destination for Analyzers on MX router
Product-Group=junos		Egress monitored traffic is not mirrored to destination for Analyzers on MX router
PR NumberSynopsisCategory: Configuration mgmt, ffp, load-action, commit processing
1410322The configuration database might not be unlocked automatically if the related user session is disconnected during the commit operation in progress
Product-Group=junos		Configuration database remains locked after stopping the SSH session.
1441795Junos OS: Privilege escalation vulnerability in dual REs, VC or HA cluster may allow unauthorized configuration change. (CVE-2020-1630)
Product-Group=junos		A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines (RE), Virtual Chassis (VC) or high-availability cluster may allow a local authenticated low-privileged user with access to the shell to perform unauthorized configuration modification. Refer to https://kb.juniper.net/JSA11010 [juniper.net] for more information.
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1401505Command "show | compare" output on global group changes lose the diff context after a rollback or 'load update' is performed
Product-Group=junos		Command "show | compare" output displays the output in patch format. Changes in the global groups loses the context in the patch if a rollback or 'load update' is performed. The context loses until the commit is performed. This issue can be resolved by using fast-diff option.
1464439The CPU utilization on mgd daemon might be stuck at 100% after the netconf session is interrupted by flapping interface
Product-Group=junos		If a netconf session is initiated over inband connection, the CPU utilization on mgd daemon might be stuck at 100% after the netconf session which is executing an RPC call for some commands gets interrupted by flapping interface. There is no impact observed to control-plane or forwarding-plane, the subsequent netconf session will continue to function.
PR NumberSynopsisCategory: PTX/QFX100002/8/16 platform software
1464119An FPC might restart during runtime on PTX10000 or QFX10000 lines of devices.
Product-Group=junosvae		On PTX10000 or QFX10000 platforms, FPC might restart if there is some corruption in BCM (Broadcom) switch (a small internal ethernet switch, instead of PFE engine) inside the FPC. It is a timing issue. The reason is that the PCIe speed configuration for BCM switch is not correct. And this issue is resolved in some FPC U-boot versions.
PR NumberSynopsisCategory: VMHOST platforms software
1436201ifHCInOctets counter on AE interface going to ZERO value when snmp mib walk execute.
Product-Group=junos		Customer found ifHCInOctets counter on AE interface going to ZERO when snmp gets those value via both CLI and remote snmp get commands.
PR NumberSynopsisCategory: Virtual Router Redundancy Protocol
1450652Dual VRRP mastership might be seen after RE switchover ungracefully
Product-Group=junos		When VRRP works in distributed mode (ie. delegate-processing is enabled under VRRP) with more than 250 VRRP sessions, dual VRRP mastership might be observed after RE switchover ungracefully (e.g. primary RE failure).
1454895The VRRP traffic loss is longer than one second for some backup groups after performing GRES
Product-Group=junos		On all Junos OS platforms, configuring VRRP over the AE interface whose member physical interfaces belong to different PFE (packet forwarding engine), some backup VRRP groups traffic loss are observed longer than one second after performing GRES (graceful Routing Engine switchover). As the expectation is that the outage is subsecond.

View TSB17811 Known Issues [juniper.net] for additional information

Modification History

2022-03-23: non-technical changes; corrected formatting issue
2020-09-18: Update to include a warning about PFE memory leaks when using IRB with VPLS/Bridge-domain
2020-06-25: First publication