Alert Type

SRN - Software Release Notification
Low/NotificationSRN Notificaiton
Low/NotificationSRN Notification

Product Affected

ACX EX MX NFX PTX QFX SRX

Alert Description

Junos Software Service Release version 18.4R3-S9 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to  Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select  Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 18.4R3-S9 is now available.

18.4R3-S9 - List of Fixed issues 
PR Number Synopsis Category: EX4300 PFE
1515234 DHCP binding does not happen after GRES.
Product-Group=junosvae 		After GRES, interfaces may flap due to which DHCP bindings may be lost.
1597548 Broadcast traffic might be discarded when a firewall filter is applied to the loopback interface
Product-Group=junos 		On EX4300 platforms, when a firewall filter for broadcast traffic with discard action policer is applied to the loopback interface, all broadcast packets (including Layer 2 forwarding packets, such as DHCP discover packets) that match this filter rule might be dropped.
1598251 VLAN tagged traffic might be dropped with service provider style configuration
Product-Group=junos 		On EX4300 platforms with both enterprise style and service provider style configurations, an interface with enterprise style IFL and flexible-vlan-tagging configured, VLAN tagged traffic might be dropped due to incorrect programming in the system.
PR Number Synopsis Category: Marvell based EX PFE L2
1579293 Some MAC addresses might not be aged out on EX4300 platforms
Product-Group=junos 		On EX4300 platforms, when the number of MAC addresses learned in the system is close to the MAC limit of 65535, some MAC addresses might not be aged out even if the traffic stops and aging timeout occurs. It is a rare issue and hard to be reproduced.
PR Number Synopsis Category: EX2300/3400 PFE
1586341 DSCP Rewriting might fail to work on EX2300
Product-Group=junos 		On EX2300-48 platforms with dual tags VLAN used, DSCP Rewriting might not work when QinQ traffic sent across different chip units (in Ex2300 one PFE has 2 chip units).
PR Number Synopsis Category: EX-Series VC Infrastructure
1579430 EX4300 VCP might not come up after upgrade when QSFP+-40G-SR4/QSFP+-40G-LR4/QSFP+40GE-LX4 is used
Product-Group=junos 		On EX4300 VC platform, the virtual-chassis ports might go down after the image upgrade. This issue is seen in a scenario when QSFP+-40G-SR4/QSFP+-40G-LR4/QSFP+40GE-LX4 is used as VCP. The issue is fixed in the following Junos releases: junos:18.4R3-S9 junos:19.1R3-S6 junos:19.4R3-S4 junos:20.2R3-S2 junos:20.3R3 junos:20.4R3 junos:21.1R2 junos:21.2R1 junos:21.2R2 junos:21.3R1
PR Number Synopsis Category: QFX PFE L2
1582473 MAC addresses learnt from the MC-LAG client device might keep flapping between the ICL interface and MC-AE interface after one child link in the MC-AE interface is disabled.
Product-Group=junos 		On QFX/EX series products using Broadcom chip based PFE (i.e., QFX3500/QFX3600/QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4300/EX4600/EX4650), if Multichassis link aggregation group (MC-LAG) is configured, and the interchassis link (ICL) interface is a physical interface instead of an aggregated Ethernet (AE) interface, after one of the child links in Multichassis Aggregated Ethernet (MC-AE) interface on one of MC-LAG peers is disabled, the MAC addresses learnt from MC-LAG client device might keep flapping between the ICL interface and MC-AE interface. It could cause traffic drop when MAC addresses are learnt on ICL interface. This issue is only exposed in Junos release having the code change in PR 1504586 (which is fixed in Junos: 17.3R3-S9 17.4R3-S3 18.1R3-S11 18.2R3-S6 18.3R3-S3 18.4R2-S6 18.4R3-S6 19.1R3-S2 19.2R3 19.3R3 19.4R3 20.1R2 20.2R2 20.3R1 20.3X75-D10 20.4R1) but not having fix of PR 1582473.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1576775 Multicast Packets with TTL=1 are dropped on VXLAN enabled interface when igmp-snooping/MLD-snooping is enabled
Product-Group=junos 		On QFX5100 platform with EVPN-VXLAN setup, IPv4/IPv6 Multicast traffic with TTL=1 might be dropped on VXLAN enabled interface when IGMP-snooping/MLD-snooping is enabled.
PR Number Synopsis Category: Border Gateway Protocol
1541768 The rpd process generates the core file at gp_rtarget_tsi_update,bgp_rtarget_flash_rt,bgp_rtarget_flash.
Product-Group=junos 		If RTarget module tries to take an access of the active route which does not exist (since NextHop is not resolved), a reference is taken on the non-existent active route, and rpd crashes.
1556062 The rpd crash might be seen when removing/adding BGP configuration
Product-Group=junos 		The rpd crash might be seen when removing BGP configuration and then adding them back with "multipath" enabled.
PR Number Synopsis Category: Virtual-chassis platform/chassisd infrastructure PRs for MX
1587499 Unable to configure pseudowire interface on an MX10003 in virtual chassis mode
Product-Group=junos 		An MX10003 in virtual chassis (VC) mode, configuring a pseudowire interface over a logical tunnel (LT) or a redundant logical tunnel (RLT) results in a commit error that states that the anchor point interface is not configured, even when the LT or RLT interface is operationally up. The issue is not present on MX10003 in non-VC mode.
PR Number Synopsis Category: QFX Access Control related
1587837 Process dot1xd crash might be seen and re-authentication may be needed on EX9208 platform
Product-Group=junos 		On EX9208 platform with fusion scenario where around 30,000 mac-radius authenticated sessions are established, process dot1xd might crash and the users may need to have re-authentication due to relevant memory not getting freed when dot1x is deleted on any interface, which causes a memory leak and leads the crash.
1589678 Packet loss could be observed on dynamically assigning VoIP vlan
Product-Group=junos 		On all Junos platforms, if the received dynamically assigned VoIP vlan is same as the configured static VoIP vlan, packet loss could be observed for the connected IP phone on re-authentication for the VoIP session.
PR Number Synopsis Category: Express PFE Services including JTI, TOE, HostPath, Jflow
1445585 Receipt of a malformed packet for J-Flow sampling might create a FPC core file.
Product-Group=junos 		Receipt of a malformed packet for J-Flow sampling might create a FPC process core.
PR Number Synopsis Category: Express PFE MPLS Features
1551736 Packet drop might happen on the AE bundle which have the single child member only
Product-Group=junos 		In Link aggregation groups (LAGs) Enhanced link aggregation group (a.k.a. Aggregated Ethernet child NH reduction/AE Simple/LAG Enhanced) scenario, if FPC hosting single child member AE bundle is rebooted, the aggregate next-hops on such AE bundles might be discarding traffic, as the IFL reroute tables might get stuck in the down state, the packets drop might be seen on all other FPCs that the ingress traffic towards such AE bundles and the AE interfaces might not be used.
PR Number Synopsis Category: Enhanced Broadband Edge support for firewall
1474542 Problem with final accounting statistics associated with vbf_dfw_bbe_push_acc_acctg error logs reported on FPCs.
Product-Group=junos 		Problem with final accounting statistics associated with vbf_dfw_bbe_push_acc_acctg error logs reported on FPCs.
PR Number Synopsis Category: Express ASIC interface
1512919 Error messages "t6e_dfe_tuning_state:et-6/0/0 - Failed to dfe tuning count 10" might be seen after links flap
Product-Group=junos 		On PTX3000 and PTX5000 routers with t6e-pic installed, the interface may fail to perform DFE tuning after link flaps on those PICs. Because of this, the interface might be stuck in down status.
PR Number Synopsis Category: ISIS routing protocol
1542932 ISIS route convergence from L1 to L2 might take more than 10 minutes
Product-Group=junos 		As design of ISIS, if a prefix is received from both L1 and L2, the prefix from L1 has priority and will be installed into routing table. If the L1 prefix is withdrawn, route convergence occurs immediately and the L2 prefix is installed into routing table instead in a very short time. The traffic destined to the prefix will not be impacted in this condition. However if this issue is hit, the route convergence from L1 to L2 might take more than 10 minutes, the route of the prefix does not exist in routing table during this period, and the traffic destined to the prefix will lose completely.
PR Number Synopsis Category: jdhcpd daemon
1594371 jdhcpd core dump post Junos upgrade to 18.4R3-S4.2
Product-Group=junos 		Post Junos upgrade to 18.4R3-S4.2, sometimes jdhcpd core dump can be observed with dhcp process restarts and there's no service impacts.
PR Number Synopsis Category: High Availability/NSRP/VRRP
1591559 Security policies might not be synced to all PFEs (Packet Forwarding Engine) post upgrade
Product-Group=junos 		On SRX-Series devices configured in chassis-cluster, after ISSU (in-service software upgrade) when there is any policy or ipid related events/config change, the security policies might not sync to all the PFEs.
PR Number Synopsis Category: Security platform jweb support
1511853 Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root. (CVE-2021-0278)
Product-Group=junos 		An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated attacker to escalate their privileges to root over the target device. Please refer to https://kb.juniper.net/JSA11182 [juniper.net] for more information.
PR Number Synopsis Category: mc-ae interface
1583547 New added MC-LAGs do not come up after RE switchover
Product-Group=junos 		In the MC-LAG scenario, after RE switchover on the peer node, due to a timing issue, new added MC-LAGs do not come up on the peer.
PR Number Synopsis Category: Multicast for L3VPNs
1591228 The ddos-protection reason "packets failed the multicast RPF check" may be seen in NG-MVPN scenario with GRE transport
Product-Group=junos 		In Next Generation Multicast VPN scenario where GRE is used as a transport and router receives high amount of traffic via Inclusive PMSI without active multicast subscribers, the ddos-protection may be violated with "packets failed the multicast RPF check" reason.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1552952 The vme/me0 management interface cannot process any incoming packets.
Product-Group=junos 		On EX2300/EX2300-MP/EX3400 platforms, when me0 interface is deleted and vme interface is configured, the device cannot process any incoming packet on vme/me0 management interface.
PR Number Synopsis Category: Paradise pfe ddos protection feature
1564807 Junos OS: Upon receipt of specific packets BFD sessions might flap due to DDoS policer implementation in Packet Forwarding Engine (CVE-2021-0280)
Product-Group=junos 		On PTX platforms and QFX10K Series with Paradise (PE) chipset-based line cards, DDoS protection configuration changes made from the CLI will not take effect as expected beyond the default DDoS (Distributed Denial of Service) settings in the Packet Forwarding Engine (PFE). This may cause BFD sessions to flap when a high rate of specific packets are received. Refer to https://kb.juniper.net/JSA11184 [juniper.net] for more information.
PR Number Synopsis Category: Express Chip L3 software
1582780 On the QFX10000 line of switches, the firewall filter logs are incorrectly populated the protocol 8847 entries.
Product-Group=junos 		When an MPLS TTL 1 packet is received by the QFX10K, the PE Chip traps a copy and sends it to the host path with sample class SAMPLE_CLASS_EXCEPTION - this is expected. However, the PE chip is trapping and sending an additional copy to the host path with sample class SAMPLE_CLASS_PFE due to the lkup type property set incorrectly. This causes the firewall filter log to be filled with entries for protocol 8847 even when no firewall filter is configured - it is not known to cause any functional impact. This PR fixes the issue with the lkup type property being set incorrectly, which stops the PE chip from trapping and sending an additional copy to the host path with sample class SAMPLE_CLASS_PFE, and preventing the firewall filter logs from being filled unnecessarily with entries for protocol 8847.
PR Number Synopsis Category: Interface related issues. Port up/down, stats, CMLC , serdes
1475081 100G-SR4 port is converted into two channelized ports without any channelization configuration
Product-Group=junos 		On QFX platforms, if auto-speed is enabled on the 100G-SR4 port, the port is converted into two channelized ports without any channelization configuration.
PR Number Synopsis Category: analyzer on QFX 5100,5200, 5110
1580473 While mapping analyzers to the channelized port, mirror might not work properly
Product-Group=junosvae 		On AS7816-64X/QFX51xx/QFX52xx Series platforms, the analyzer may not work properly when port channelization is done after the analyzer configuration and with these newly created ports new analyzer is created.
PR Number Synopsis Category: QFX EVPN / VxLAN
1561588 Dcpfe process might crash on after committing EVPN-VXLAN profile configuration and ARP resolution may fail causing traffic issues.
Product-Group=junos 		Dcpfe process might crash on after committing EVPN-VXLAN profile configuration and ARP resolution may fail causing traffic issues.
1582017 The traffic may not be load-balanced properly in an EVPN overlay-ecmp setup
Product-Group=junos 		On QFX5100/QFX5110/QFX5120/QFX5130 and EX4300/EX4600/EX4650 devices with overlay-ecmp configuration for EVPN-VxLAN, the traffic might not get load-balanced correctly when multi traffic streams with different source address are sent across the fabric.
PR Number Synopsis Category: RPD route tables, resolver, routing instances, static routes
1589309 The process rpd may crash with dynamic tunnel configuration
Product-Group=junos 		If a route with low mask (e.g., 1.1.1.0/24) is used as the forwarding route for multiple dynamic tunnels first, and some more specific routes (e.g., 1.1.1.1/32, 1.1.1.2/32) are learnt later, during the stage of updating them as the new forwarding routes for those dynamic tunnels respectively, the process rpd may crash.
PR Number Synopsis Category: SW PRs for SCBE3 related kernel drivers
1564539 MX platforms with MX-SCBE3 may reboot continuously
Product-Group=junos 		A recent change in the kernel boot loader causes a system with MX-SCBE3 to experience the Routing Enginne's kernel memory corruption which causes the system to reboot continuously.
PR Number Synopsis Category: SNMP Infrastructure (snmpd, mib2d)
1536350 Junos OS and Junos OS Evolved: A vulnerability allows a network based unauthenticated attacker which sends a high rate of specific traffic to cause a partial Denial of Service (CVE-2021-0291)
Product-Group=junos 		An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently protected, allows a network-based unauthenticated attacker to send specific traffic which partially reaches this resource. A high rate of specific traffic may lead to a partial Denial of Service (DoS) as the CPU utilization of the RE is significantly increased. Refer to https://kb.juniper.net/JSA11193 [juniper.net] for more information.
1557384 The mib2d process crashes and generates a core dump on backup RE
Product-Group=junos 		The mibd process might crash on backup RE and generate core dumps. No major impact due to this issue.
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1544489 Sessions creation rate is set to minimal rate after IDS and CPU throttling in place during DDOS attack
Product-Group=junos 		On MX platforms with MS-MPC/MS-MIC service card installed, when DDOS attack happens, CPU throttling triggered and set the sessions creation rate to minimum to bring down the CPU usage. Once IDS is programmed, DDOS attack is removed and CPU is brought back to normal stage, but the sessions creation rate is still at minimal value (gradually increases), leading to drop in sessions creation.
PR Number Synopsis Category: Trio pfe bridging, learning, stp, oam, irb software
1553917 ARP resolution might fail if ARP packets are received over multicast based VxLAN access network from CE
Product-Group=junos 		On Trio based platform which acts as Provider Edge (PE) node for Ethernet VPN (EVPN) Virtual Extensible LAN (VxLAN), if Address Resolution Protocol (ARP) request packets are received over multicast based VxLAN network from the Customer Edge (CE) node, the ARP protocol data units (PDUs) might hit the implicit ARP snoop filter default term instead of the match term, and might not get snooped due to this issue. It will lead to ARP resolution failure and service impact.
 

18.4R3-S9 - List of Known issues 
PR Number Synopsis Category: SFI Infra-structure
1485038 The following error message is observed continuously in AD with base configurations: IFDE: Null uint32 set vector, ifd and IFFPC: 'IFD Ether uint32 set' (opcode 151) failed.
Product-Group=junos 		EX9251 : "IFDE: Null uint32 set vector, ifd and IFFPC: 'IFD Ether uint32 set' (opcode 151) error message is observed continuously in AD with base configurations.
PR Number Synopsis Category: EX4300 Platform
1602498 EX4300: The scheduled tasks might not be executed if the "cron" daemon goes down and does not restart automatically
Product-Group=junos 		The service utility "cron" runs in the background and regularly checks /var/etc/crontab for tasks to execute. "cron" daemon is started during boot. If for some reason, the "cron" process exits, the scheduled tasks will not be executed. "cron" was not restarted automatically and had to be started manually on the EX4300 platform.
PR Number Synopsis Category: Marvell based EX PFE L2
1596329 When xSTP is enabled on ae interfaces in distribution mode, xSTP sessions can flap when the PFE hosting ae distribution is rebooted.
Product-Group=junos 		When the fpc on which STP sessions are hosted for lag interfaces is rebooted, STP sessions will flap and re-converge again. This can lead to traffic loss.
PR Number Synopsis Category: MX10008/16 Platform
1420571 After changing the power feeds to either turn off or turn on, the show chassis power output does not match the real condition, and incorrect syslog information is recorded.
Product-Group=junosvae 		After changing the power feed(s), either turn off or turn on, show chassis power outputs do not match real condition and there are also incorrect Syslog information recorded.
PR Number Synopsis Category: NFX Series Platform Software
1441248 NFX Series: Hard-coded credentials allows an attacker to take control of any instance through administrative interfaces. (CVE-2021-0248)
Product-Group=junos 		On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. Refer to https://kb.juniper.net/JSA11141 [juniper.net] for more information.
PR Number Synopsis Category: JUNOS kernel/ukernel changes for ACX
1483959 On the ACX5048 router, traffic loss is observed during the unified ISSU upgrade.
Product-Group=junos 		On ACX5048/ACX5096 platforms, there might be issues with packet processing on the interfaces post ISSU. The upgrade happens without any issue, however, after the upgrade, the ports does not get enabled in PFE (Packet Forwarding Engine) which might result in traffic loss. This issue is seen when an internal register value gets reset to 0 during ISSU.
PR Number Synopsis Category: SRX1500 platform software
1501505 "set system archival configuration" creates zero bytes sized files on some SCP servers which do no support the -p option.
Product-Group=junos 		When using the 'system archival configuration' feature using SCP to transfer configuration files, this feature always uses the -p scp option (Preserves modification times, access times, and modes from the original file). Some SCP servers, such as SolarWinds and freesshd installed on Windows OS, are observed not to support the -p option and the file transfer will fail. As a workaround, a commit script or event options can be used to execute the cli command: start shell user root command "scp -i /config/juniper.conf.gz test@:" using public-key authentication.
PR Number Synopsis Category: SRX4100/SRX4200 platform software
1571675 Device fails to load PFE after abrupt device shutdown due to power failure
Product-Group=junos 		The SRX platforms (1500, 4100, 4200 and 4600) with Junos 18.4R3 will fail to come up fully, if the device undergo abrupt power failure. The RE will boot up, but PFE fails to load, which will result traffic drop. messages will show the following logs: chassisd[10724]: CHASSISD_I2C_MIDPLANE_CORRUPT: Corruption on midplane ID EEPROM (ID: 0x9E01, MAC address: 0x40, 0x1A) chassisd[10724]: CHASSISD_UNSUPPORTED_FPC: FPC with I2C ID of 0x2e00 is not supported alarmd[7681]: shutting down chassisd connection: chassisd ipc pipe read error chassisd[10814]: CHASSISD_FILE_OPEN: File open: /dev/hgcommdev, error: 2 -- No such file or directory This issue is addressed from Junos 19.3R2-S3 and higher versions. Since this is caused by a file system corruption due to power outage, even re-installing the same Junos version will address the issue temporarily.
PR Number Synopsis Category: idp flow creation, deletion,notification, session mgr intfce
1579055 Global data SHM utilization increase quickly and FTP traffic might impacted
Product-Group=junos 		On SRX platforms, if IDP and FTP ALG are enabled, the FTP data channel might not be established as IDP memory for data utilization increases quickly. It happened intermittently.
PR Number Synopsis Category: track re issu control procedure bugs
1588636 Repd (replication daemon) core might be seen after ISSU upgrade
Product-Group=junos 		On SRX platforms after performing an ISSU system upgrade from release A to Release B, the repd core might be seen on the primary node/master RE. There is a traffic loss of around 1 sec for the entire ISSU upgrade.
PR Number Synopsis Category: IPSEC/IKE VPN
1381328 Kmd logs are not generated for 'ike debug-enable" cli after enabling and disabling ike traceoptions in config mode
Product-Group=junos 		When using the operational mode request security ike debug-enable command for IKE debugging after using IKE traceoptions with a filename specified in the configuration, the debugged files are written to the same filename.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1573047 A traffic loop might be observed after the VCP interface flap
Product-Group=junos 		Traffic loop might be seen on QFX5K VCF (Virtual Chassis Fabric) when VCP (Virtual Chassis Port) cable is reseated. This is a rare issue and hard to reproduce. It might also lead to traffic loss when the issue happens.
PR Number Synopsis Category: SRX5XX platform
1591884 T1/T3 interfaces are going down after assigning IP address on SRX345 and SRX550m Platforms .
Product-Group=junos 		On 18.4R3-S3 T1 interfaces are going down when configured with ip address.The issue is seen on all Siege Platforms (srx345 & srx550m).The issue is seen on CT1 Pics's too.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
991081 The configuration change on Backup RE cannot be synchronized while deleting inactivated interfaces/routing-instances from master
Product-Group=junos 		In the dual Routing Engine scenario, the backup Routing Engine does not sync up the configuration change while deleting an inactivated interface/routing-instances from the master. So after the operation, the inactivated interface/routing-instances still exists on the backup Routing Engine. This issue has been addressed via PR/1586229.
 

Modification History

First publication 2021-08-06