Alert Type

SRN - Software Release Notification

Product Affected

ACX, EX, MX, PTX, QFX, NFX, SRX, VRR, vMX, vSRX

Alert Description

Junos Software Service Release version 19.3R2-S5 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to  Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select  Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 19.3R2-S5 is now available.

19.3R2-S5 - List of Fixed issues

PR Number Synopsis Category: NFX Series Platform Software
1477151 Process jdmd is not responsive due to /etc/hosts file getting corrupted
Product-Group=junosvae 		On NFX platforms, after a power outage, the process jdmd may become unresponsive and any the VMs running on it cannot work properly due to /etc/hosts file getting corrupted. The fix is to make the jdmd more resilient even if the hosts file contains corrupted characters, the device is still able to work stably. Note: Junos Device Manager is a Linux Container that provides CLI/NETCONF for device management and isolation for the Host OS from user applications.
1480976 NFX150: Multiple vulnerabilities in BIOS firmware (INTEL-SA-00241)
Product-Group=junosvae 		Potential security vulnerabilities in Intel firmware, used in the NFX150 network services platform, may allow escalation of privilege, denial of service or information disclosure. Intel has released firmware updates to mitigate these potential vulnerabilities. Refer to https://kb.juniper.net/JSA11026 [juniper.net] for more information.
PR Number Synopsis Category: Accounting Profile
1458143 In some rare scenarios upon FPC or PIC reboot, the Packet Forwarding Engine daemon database might not get updated with the correct location_id for some physical interfaces, then a problem with statistics on some interfaces of a router might be observed.
Product-Group=junos 		In some rare scenarios upon FPC or PIC reboot, the pfed (packet forwarding engine daemon) database may not get updated with the correct location_id for some physical interfaces (IFDs), then a problem with statistics on some interfaces of a router may be observed. If this issue happens in the subscriber management environment, and depending on the radius server configuration, it may cause the subscribers to get disconnected by the radius server because of the radius server can not receive the proper statistics update for the subscribers from the pfed.
PR Number Synopsis Category: Border Gateway Protocol
1323306 The BGP session might be become nonresponsive with high BGP OutQ value after GRES on both sides
Product-Group=junos 		From 16.1 or above release, when both sides of a BGP session are doing NSR RE switchover simultaneously (double failures), depending on the configuration and scale, there is a chance the BGP session may stuck and BGP PDUs can't be exchanged. The permanently stuck OutQ are seen which is a typical symptom for this issue. This is because both sides are waiting for socket record boundary. Both sides are waiting to drain their partially written PDU. Due to this bug, neither side read at this state, leading to permanent stuck.
1466734 The configured BGP damping policy might not take effect after BGP is disabled and then enabled followed by commit.
Product-Group=junos 		The configured BGP damping policy might not take effect when BGP is disabled and then enabled followed by a "commit" CLI, only the default damping policy is in effect. However, if the BGP is disabled and enabled followed by a "commit full" CLI then both default damping and configured damping policy are both in effect.
1473351 Removal of cluster from the BGP group might cause prolonged convergence times.
Product-Group=junos 		Cluster removal from BGP group might lead to a state where each subsequent change to BGP configuration will trigger import policy reevaluation causing prolonged convergence time of several minutes. This might result in a traffic loss.
1482209 The BGP multipathed traffic might not fully load-balance for a while after adding a new path for load sharing.
Product-Group=junos 		On all Junos platforms with the BGP-ECMP (Equal Cost Multi-Path) scenario, if adding a new path for load sharing, the traffic might not fully load-balanced for a while. The worst-case scenario is much traffic moving to the new path and lead to a link oversubscription.
PR Number Synopsis Category: MX Platform SW - FRU Management
1502118 The chassisd process might become nonresponsive
Product-Group=junos 		On the MX240, MX480, and MX960 platforms if a faulty SFP is inserted into the Enhanced Switch Control Board (SCBE) front port, it may cause the chassisd process to stall. This front port is only used for Node Slicing systems.
PR Number Synopsis Category: MX Platform SW - Power Management
1501108 The MX2020 and MX2010 routers continuously log pem_tiny_power_remaining: in the chassisd log.
Product-Group=junos 		On MX2020/MX2010, the "pem_tiny_power_remaining" message might be continuously logged in chassisd log.
PR Number Synopsis Category: MX Platform SW - UI management
1498538 SNMP polling does not show correct PSM jnxOperatingState when one of the PSM inputs fails.
Product-Group=junos 		SNMP polling does not show correct PSM jnxOperatingState when one of the PSM Inputs failed or not exists
PR Number Synopsis Category: Device Configuration Daemon
1491363 The mgd might hang up on a crashed dcd commit check process and the dcd might also crash
Product-Group=junos 		When a commit is issued through Netconf or CLI, the configuration committing action might be failed due to the dcd commit check process crashes. After that, the dcd might crash due to this crashed process, the related mgd might keep the waiting state for the unexpected non-response from the dcd commit check process.
PR Number Synopsis Category: Covers Application classification workflows apart from custo
1473151 Junos OS: SRX Series: High CPU load due to processing for HTTP traffic when Application Identification is enabled.
Product-Group=junos 		On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilization, which could lead to traffic interruption. Refer to https://kb.juniper.net/JSA11081 [juniper.net] for more information.
1500938 The srxpfe or flowd process might stop due to memory corruption within JDPI.
Product-Group=junos 		On SRX/MX platforms, if there are any services (e.g. AppID, IDP, APBR and so on) running based on Juniper Deep Packet Inspection (JDPI), when the work load is reaching heavy level, for example, above 50% of max connection per second for Layer 7 security policy, or 30% for IDP, the srxpfe/flowd process might crash due to memory corruption caused by this issue.
PR Number Synopsis Category: SRX4100/SRX4200 platform software
1502462 Redundancy Group (RG) IP monitoring might fail after RG0 failover
Product-Group=junos 		IP monitoring on SRX4100 and SRX4200 device might fail in the rare event that a chassis internal connection between RE and PFE is temporarily down after RG0 failover.
PR Number Synopsis Category: Kernel software for AE/AS/Container
1462310 Traffic drops over the aggregated Ethernet interfaces configured with Virtual Router Redundancy Protocol (VRRP).
Product-Group=junos 		This issue happens on the scale scenario with VRRP sessions configured on AE interfaces, such as, one AE IFD (physical interface) has 50 IFLs (logical interface) and in total 100 VRRP sessions (IPV4 or IPV6 VRRP sessions) exist on this interface. (The occurrence is not consistent with this number, and the probability is higher with more scaled configurations, such as 500 IFLs and 1000 VRRP sessions.) On MX platforms which use MPC10E line card, when loading the scaled configuration, once VRRP is up, and load the baseline configuration, and then load back the scale configuration again, the traffic drop might be seen because of no filter installed in PFE.
PR Number Synopsis Category: Integrated Routing & Bridging (IRB) module
1484721 ARP entry may not be created in the EVPN-MPLS environment
Product-Group=junos 		In the EVPN-MPLS environment, if a VLAN is created without having it in "protocols evpn extended-vlan-list", then adding it, the ARP entry may not be created on the device even it receives the ARP packets through the newly added VLAN.
PR Number Synopsis Category: jdhcpd daemon
1521704 DHCP does not work after running request system zeroize or load factory-default.
Product-Group=junos 		On SRX platfroms, DHCP client might not work after performing 'request system zeroize' or 'load factory-default'. This happens when the interface configured as 'dhcp-local-server' has changed the role from server to 'dhcp-client'.
PR Number Synopsis Category: Adresses NAT/NATLIB issues found in JSF
1532249 Improve the max ENODE connections for one persistent NAT binding from 8 to 32
Product-Group=junos 		Improve the max ENODE connections for one persistent NAT binding from 8 to 32
PR Number Synopsis Category: Firewall Module
1521325 The TCP packet might be dropped if syn-proxy protection enabled
Product-Group=junos 		On SRX series devices, if TCP SYN flood protection is enabled with TCP SYN Proxy and the 3rd and 4th packet from the client arrive at the same time, then it can cause an SEQ error that may break the TCP connection.
PR Number Synopsis Category: IPSEC/IKE VPN
1530684 On all SRX series devices using IPsec with NAT Traversal, MTU size for the external interface might be changed after IPSEC SA is re-established.
Product-Group=junos 		On all SRX series devices using IPsec with NAT Traversal, MTU size might be changed to a lower value for the ike external interface after IPSEC SA is re-established.
PR Number Synopsis Category: Layer2 forwarding on EX/NTF/PTX/QFX
1504409 The show bridge statistics command output does not display the statistics information for the pseudowire subscriber interfaces.
Product-Group=junos 		"show bridge statistics" will not display the statistics information for pseudowire subscriber interfaces.
PR Number Synopsis Category: Label Distribution Protocol
1538124 The rpd process might crash when the LDP route with indirect next hop is deleted on the aggregated Ethernet interface.
Product-Group=junos 		If the Label Distribution Protocol (LDP) route with indirect next-hop exists (e.g. LDP egress-policy is used to advertise BGP route into LDP), the rpd might crash when the LDP route is deleted from the AE interface.
PR Number Synopsis Category: Jflow and sflow on MX
1487876 Incorrect 'frame length' of 132 bytes might be captured in packet header
Product-Group=junos 		On all MX/PTX5k/EX platforms with Trio based line cards, if a packet is send with more than 128 bytes it will always show incorrect "Frame length" of 132 bytes in raw packet header of sflow collector captured data.
PR Number Synopsis Category: Neo Interface
1453433 Interfaces shut down by the disable-pfe action might not come up when you use the MIC offline or online command
Product-Group=junos 		On MX Series devices, MPC wedge might cause disable-pfe action. The disable-pfe action shuts down interfaces to avoid traffic being silently dropped. MIC bouncing (offline/online) operation brings WAN interfaces up, causing traffic to be dropped or silently discarded. Restoring the Packet Forwarding Engine entity upon disable-pfe action needs MPC restart.
1541382 With hold time configuration, GE Interfaces remain down on reboot
Product-Group=junos 		With hold time configuration, GE Interfaces from MPC cards which use MIC driver (such as MPC2E/3E NG, MPC Type 1, MPC Type 2) may go down.
PR Number Synopsis Category: OS IPv4/ARP/ICMPv4
1496429 The Routing Engine might crash when a large number of next hops are quickly deleted and added again in a large ARP or ND scaled scenario.
Product-Group=junos 		On all Junos platforms with large ARP/ND scale scenario, if a large number of nexthops are deleted and re-added very quickly (such as a result of link flap), the memory corruption might occur and eventually cause RE crash.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1518898 The kernel might crash if a file/directory is accessed for the first time and is not created locally.
Product-Group=junos 		On the Junos with Virtual Filesystem (VirtFS), if a file/directory is accessed for the first time and is not created locally, the kernel might crash and generate a vmcore file. Junos might reboot due to this issue.
PR Number Synopsis Category: "ifstate" infrastructure
1486161 Kernel core might be seen if deleting an ifstate
Product-Group=junos 		On all Junos OS platforms, some operations such as configuration change might cause the state information to change and eventually cause the ifstate to be deleted. In a very rare case, deleting an ifstate (kernel state) might cause kernel core and Routing Engine restart. There is no specific trigger. This issue is reported by the configuration change.
PR Number Synopsis Category: JUNOS Network App Infrastructure (for ping, traceroute, etc)
1484689 In the MX104 chassis, the show system buffer command displays all zeros.
Product-Group=junos 		Corrected the odl tags and buffer data handling while xmlizing the output.
PR Number Synopsis Category: Kernel Stats Infrastructure
1482379 Junos OS: Memory leak leads to kernel crash (vmcore) due to SNMP polling (CVE-2020-1683)
Product-Group=junos 		On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash (vmcore). Refer to https://kb.juniper.net/JSA11080 [juniper.net] for more information.
PR Number Synopsis Category: OSPF routing protocol
1489637 The rpd crashes when reset OSPF neighbours
Product-Group=junos 		On all Junos platforms, if more than one million routes are installed into Open Shortest Path First (OSPF) routing table, also, either Nonstop Active Routing (NSR) or Graceful Routing Engine Switchover (GRES) with warm standby is enabled, rpd might crash on backup routing engine (RE) when OSPF neighbors are reset. This is a scaled issue. This issue could be recovered after rpd on backup RE self-restart.
PR Number Synopsis Category: vMX Data Plane Issues
1544856 MX150 FPC crash and stops forwarding the traffic
Product-Group=junos 		MX150 FPC crash and stops forwarding the traffic
PR Number Synopsis Category: Resource Reservation Protocol
1359087 The FPC might be stuck in the Ready state after making a change in the configuration that removes RSVP and triggers FPC restart.
Product-Group=junos 		When 'tunnel-services' is configured under 'chassis fpc <> pic <>', the vt-x/y/z physical interface (IFD) is created for the corresponding FPC. If 'protocols rsvp' is configured, RSVP will create a default vt-x/y/z.u logical interface (IFL) under the corresponding vt-x/y/z IFD. After applying a configuration change that will remove RSVP and trigger FPC restart, the vt-x/y/z.u IFL is not cleaned up due to a code issue. Hence the corresponding vt-x/y/z IFD cannot be cleaned up during the corresponding FPC coming up. The IFD cleaning keeps retrying which cause the corresponding FPC to be stuck in 'Ready' state.
1476773 RSVP LSPs might not come up in a scaled network with very high number of LSPs if NSR is used on a transit router.
Product-Group=junos 		If NSR is enabled on transit router with scaled RSVP LSPs, RESV message might not be sent from transit router because the path messages replication on primary RE does not complete in time. Hence RSVP LSPs might not come up with traffic impact.
1505834 The rpd process might crash with RSVP configured in a rare timing case.
Product-Group=junos 		On all Junos platforms running with the Resource Reservation Protocol (RSVP) configured, when some socket error happens, RSVP might be unable to send messages. However, the counter for sent messages has already been increased due to the software design defect. The wrong counter might lead to the rpd process crash. It's a rare timing issue that might be more likely to happen in a scaled scenario.
PR Number Synopsis Category: SNMP Infrastructure (snmpd, mib2d)
1461839 Junos OS used to send a cold start trap from the new primary just after the first GRES
Product-Group=junos 		Junos OS is used to send a cold trap from the new primary just after the first GRES. This is because the cold_start timestamp file is not present or updated after the reboot. So, for the first GRES, it is used to send the cold start trap.
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1482400 The vmcore process crashes sometimes along with the mspmand process on MS-MPC/MS-MIC if large-scale traffic flows are processed
Product-Group=junos 		With NAT/Stateful-firewall/TCP tickle (enable by default) configured on MS-MPC/MS-MIC, the vmcore crash sometimes along with mspmand crash might happen if large-scale traffic flows (e.g. million flows) are processed by it.
1489942 Prolonged flow control might occur with MS-MPC or MS-MIC
Product-Group=junos 		On MX platforms with MS-MPC/MS-MIC, if there are lots of self-generated packets like TCP-tickle and UDP-logging, there might be data congestion on the data path due to no throttling functionality for such types of packets. When the data path is blocked, prolonged flow-control might happen with the service interfaces being brought down and the PIC reboot. At the same time, the mspmand core file will be generated if dump-on-flow-control is enabled.
PR Number Synopsis Category: Trio pfe bridging, learning, stp, oam, irb software
1430440 core.vmxt.mpc0 is seen at 5 0x096327d5 in l2alm_sync_entry_in_pfes (context=0xd92e7b28, sync_info=0xd92e7a78) at ../l2alm/l2alm_common_hw_api.c:1727.
Product-Group=junos 		On vMX, core.vmxt.mpc0' seen at 5 0x096327d5 in l2alm_sync_entry_in_pfes (context=0xd92e7b28, sync_info=0xd92e7a78) at ../../../../../src/pfe/common/applications/l2alm/l2alm_common_hw_api.c:1727.
1533857 FPC crash might be observed when the ASIC's NH memory exhausted in the EVPN-MPLS scenario
Product-Group=junos 		On all MX/EX92xx platforms with EVPN-MPLS configured, NH (Next-Hop) memory leak in Trio ASIC happens whenever there is a route churn for remote MAC-IP entries learned bound to the IRB interface in EVPN-MPLS routing-instance. When the ASIC's NH memory partition exhausted (free% NH memory is close to 20% or below), which will result in the line card to reboot.
PR Number Synopsis Category: Configuration mgmt, ffp, load-action, commit processing
1527848 Commit confirmed rollback is not working.
Product-Group=junos 		On SRX Series devices, when the commit fails, the rollback of the previous commit might not happen which could impact the services. Ideally, a commit confirmed must be rolled back if there is no subsequent successful commit or commit check performed before the timer expires.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1464439 If a NETCONF session is initiated over an inband connection, the CPU utilization on mgd daemon might be 100 percent after the NETCONF, which executes an RPC call for some commands and gets interrupted by flapping interface. There is no impact observed to the control plane or the forwarding plane, the subsequent NETCONF session continues to function.
Product-Group=junos 		If a NETCONF session is initiated over an inband connection, the CPU utilization on mgd daemon might be 100 percent after the NETCONF, which executes an RPC call for some commands and gets interrupted by flapping interface. There is no impact observed to the control plane or the forwarding plane, the subsequent NETCONF session continues to function.
1489575 Previous configuration may still take effect after "rollback rescue" is performed
Product-Group=junos 		When adding new configuration and using "rollback rescue", it is found that even though this configuration has been removed it is still functional.
PR Number Synopsis Category: UI Misc
1457602 The version information under the configuration changes from Junos OS Release 19.1 onwards.
Product-Group=junos 		Under configuration on 19.x, version info is different from prior 18.x release.
PR Number Synopsis Category: Web-Management UI
1513612 Installing J-Web application package may fail on the EX2300/EX3400 platforms
Product-Group=junos 		On the EX2300/EX3400 platforms, J-Web application package may fail to be installed with the affected releases.
PR Number Synopsis Category: VSRX platform software
1524243 The control link may be broken when there is excessive traffic load on the control link in vSRX cluster deployment
Product-Group=junosvae 		In the vSRX2.0 cluster running on KVM, when there is excessive traffic load on the control link (em0 link), the error message "kernel: em0: watchdog timeout on queue 0" may be shown in the syslog. This interruption may cause the cluster control link to fail and dynamic routing protocols not to work properly.
 

19.3R2-S5 - List of Known issues

PR Number Synopsis Category: NFX Layer 2 Features Software
1517995 vSRX VM Cluster: IPC disconnect could be seen on JCP if the CPU0 gets hogged.
Product-Group=junos 		This issue is applicable to vSRX VM cluster running on NFX250. The "dcpfe" process may consumes higher CPU cycles while flushing the stale/aged mac entries from the mac-to-interface ethernet-switching table. This can cause IPC connections to be disconnected on a JCP.
PR Number Synopsis Category: NFX Series Platform Software
1462556 Junos OS: NFX350: Password hashes stored in world-readable format (CVE-2020-1669)
Product-Group=junos 		The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system. Refer to https://kb.juniper.net/JSA11066 [juniper.net] for more information.
PR Number Synopsis Category: MPC Fusion SW
1508794 A Regression issue introduced by PR1463859 causing WAN-PHY interface continuously flaps with default hold-time down of 0
Product-Group=junos 		PR1463859 introduces a software defect that causes a 10GE interface to flap continuously when configuring with the WAN-PHY framing with the default "hold-down" timer (0). Once upgrading a router to an affected software release, the interface may flap continuously. This is not applicable to an interface with the default framing - LAN-PHY.
PR Number Synopsis Category: Border Gateway Protocol
1256965 BGP state replication does not begin until 40+ seconds after BGP established on primary RE
Product-Group=junos 		This is not a functionality impacting BUG, Issue here is BGP NSR replication starts after some delay in certain cases.
PR Number Synopsis Category: Device Configuration Daemon
1429045 If an aggregated Ethernet interface has the VRRP configuration, in the following use cases, member logical interfaces cannot be created after the member physical interface comes up, and the aggregated Ethernet interface will be in the Down state: fpc restart (request chassis fpc restart slot <>) chassis-control restart (restart chassis-control) reboot both Routing Engine (request system reboot both-routing-engines) Therefore, before performing these operations, remove the VRRP configuration from the aggreg
Product-Group=junos 		If an aggregated Ethernet interface has the VRRP configuration, in the following use cases, member logical interfaces cannot be created after the member physical interface comes up, and the aggregated Ethernet interface will be in the Down state: fpc restart (request chassis fpc restart slot <>) chassis-control restart (restart chassis-control) reboot both Routing Engine (request system reboot both-routing-engines) Therefore, before performing these operations, remove the VRRP configuration from the aggregated Ethernet interface.
PR Number Synopsis Category: IPSEC/IKE VPN
1517262 The flowd might crash in IPsec VPN scenario
Product-Group=junos 		On SRX platforms with IPsec VPN configured, the flowd might crash during the IPsec VPN rekey window. The traffic/service might be impacted if hitting this issue.
PR Number Synopsis Category: MPC11 ULC interface software related issues.
1442439 On the MPC11E line card, the number-of-sub-ports configuration on the 4x10G channelized ports might cause the channels to go down.
Product-Group=junos 		The number-of-sub-ports configuration is not supported on the MPC11E line-card interfaces.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1463802 The scheduled tasks might not be executed if the cron daemon goes down without restarting automatically.
Product-Group=junos 		The service utility "cron" runs in the background and regularly checks /etc/crontab for tasks to execute and searches /var/cron/tabs for custom crontab files. These files are used to schedule tasks which "cron" runs at the specified times. "cron" daemon is started during boot. If for some reason, the "cron" process exits, the scheduled tasks will not be executed. "cron" was not restarted automatically and had to be started manually.
PR Number Synopsis Category: Kernel MPLS / Tag / P2MP Infrastructure
1515868 kernel core can be seen when processing the labeled packet
Product-Group=junos 		When we have labeled packet punted to RE due to ttl expiry, During the processing of this packet, the mpls header is stripped off wrongly, because of which the subsequent code execution frees up the packet. When the kernel tried to access this freed packet a vmcore can be seen. This is a rare occurrence and not every labeled packet punted to RE should see this crash. Two internal tracking PR's will address this problem, These PRs will - Correct the mpls header stripping logic - Correct the error handling, so that freed up memory buffers storing this packet aren't accessed. The fix for these went in to 17.3R3-S9
PR Number Synopsis Category: RPD Next-hop issues including indirect, CNH, and MCNH
1429949 dynamic tunnel summary is displaying wrong count of up and total tunnels
Product-Group=junos 		Dynamic tunnel summary displays an incorrect count of up and total tunnels after multiple iterations of activating and deactivating the dynamic tunnel configuration. It is just a display issue, and there is no problem with the functionality.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1452136 The mgd might crash when you use the replace pattern command.
Product-Group=junos 		When you use the "replace pattern" command to replace the name in the apply-group, the mgd crashes.
1454387 Timestamp is not shown with count option after changing the match condition for the show <> | mathc <> | count command.
Product-Group=junos 		When you edit a command and run the command from CLI command history, the timestamp might not appear.
PR Number Synopsis Category: ZT pfe firewall software
1465766 Bandwidth percent with shaping rate is not working on aggregated Ethernet after deactivating and activating the class of service.
Product-Group=junos 		On MX platforms with MPC10E/11E line cards used, if the policer with bandwidth-percent and CoS shaping-rate are configured on AE interface, and then changing COS shaping-rate (e.g. deactivating class-of-service), the policer may not work as expected (the percentage policer does not get updated as the config change). It might cause traffic congestion even traffic drop.

Modification History

First publication 2020-11-13