Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

ACX, EX, MX, PTX, QFX, NFX, SRX, VRR, vMX, vSRX

Alert Description

Junos Software Service Release version 19.2R3-S4 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to  Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select  Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 19.2R3-S4 is now available.

19.2R3-S4 - List of Fixed issues

PR Number Synopsis Category: Marvell based EX PFE ACL
1611480 The fxpc process might crash and generate core
Product-Group=junos 		On EX4600/QFX5K platforms, the fxpc process might crash and generate core when router-advertisement-guard is configured under DHCP (Dynamic Host Configuration Protocol) forwarding-options.
PR Number Synopsis Category: EX2300/3400 PFE
1602003 On EX2300 VC platforms ARP might not get resolved
Product-Group=junos 		On EX2300/2300MP VC platforms with 2 menbers, after adding L3 interface, on the other FPC ARP is not getting resolved, which might lead to traffic drop.
1610253 DHCP packets might be received and then returned back to DHCP relay through the same interface on EX2300/EX3400/EX4300/QFX VC platforms
Product-Group=junos 		On EX2300/EX3400/EX4300/QFX Virtual Chassis (VC) platforms which are connected to Dynamic Host Configuration Protocol (DHCP) server via DHCP relay, if the interface connected with DHCP relay is located on non master node, and the interface has the knob "dhcp-security" enabled under vlan, when the DHCP packets are received via DHCP relay and then need to be send out within the affected vlan through the same interface, the DHCP packets might get returned back to DHCP relay, instead of being dropped. Due to this issue, it might lead to Media Access Control (MAC) address move on DHCP relay and therefore bring potential risk of service impact.
PR Number Synopsis Category: NFX Layer 2 Features Software
1592019 Unable to configure ports on firewall filter of NFX devices
Product-Group=junos 		On NFX platforms, commit error may be seen when configuring firewall filter with destination-port and/or source-port match conditions for ethernet-switching family
PR Number Synopsis Category: BBE GRES related issues
1610476 The authd process and RADIUS might have stale L2BSA subscriber entries
Product-Group=junos 		In subscriber management scenario, if JSU package for Broadband Edge Subscriber Management daemon (bbe-smgd) is installed on backup RE when it is syncing subscriber information from master then the authd process and RADIUS might have stale Layer 2 Bit Stream Access (L2BSA) subscriber entries which might cause subscribers logout and re-login.
PR Number Synopsis Category: BBE interface related issues
1525036 Problem with static VLAN deletion with active subscribers and the FPC might be stuck at the Ready state during restart.
Product-Group=junos 		In subscriber brought up over static VLAN scenario on MX platforms, during the restart process, some resources are stuck in the FPC and the FPC is never able to reach online state but stuck at Ready state. The fix is to make sure the device control daemon deletes the static VLAN interface only after the dependency table associated with the static VLAN interface are resolved/removed.
PR Number Synopsis Category: Border Gateway Protocol
1446499 The command "show task replication" might show BGP replication complete even before BGP NSR replication is completed
Product-Group=junos 		The command "show task replication" might show BGP replication complete before NSR replication is finished.
1616931 Excessive logging of RPD_RV_INVALID_ENTRY messages
Product-Group=junos 		Every time a BGP policy evaluates RPKI status of a prefix as INVALID, a syslog message is printed.
1620463 The rpd may crash and restart when NSR is enabled
Product-Group=junos 		On all Junos with NSR (nonstop routing) enabled the rpd crash and restart may occur when RPKI (Resource Public Key Infrastructure) records are being replicated between the primary and backup RE (Routing Engine) and some of the records are withdrawn over the RPKI session.
PR Number Synopsis Category: BBE Remote Access Server
1609403 Prefix duplication errors might occur for DHCPv6 over PPPoE subscribers
Product-Group=junos 		On MX platforms with DHCPv6 (Dynamic Host Configuration Protocol) over PPPoE (Point-to-Point Protocol over Ethernet) configured in BBE(Broadband Edge) environment, where the PPPoE sessions have delegated IPv6 prefix assigned from a local pool, when a DHCP session comes up over the PPPoE leading to a change to the PPPoE session's address, an address-change notification would be triggered. The processing of this notification by general-authentication-service would result in wrong marking of the delegated IPv6 prefix as available. Once this happens, DHCP service might re-assign the same prefixes which would be rejected because of IP duplication.
1612196 DHCP session fails with CLI knob 'session-limit-per-username'
Product-Group=junos 		On all Junos platforms with DHCP (Dynamic Host Configuration Protocol) over PPPoE (Point-to-Point Protocol over Ethernet) and 'session-limit-per-username' configured, if either interface or access configuration is modified while DHCP sessions are logged in, any new DHCP (v4/v6/PD/NA) session without authentication that uses the same access profile cannot log in.
PR Number Synopsis Category: MX Platform SW - Environment Monitoring
1551760 The LCM Peer Absent message might be seen.
Product-Group=junosvae 		On all TVP platforms, a major alarm of "LCM Peer Absent" might be seen.
PR Number Synopsis Category: CFM
1619231 OAM CFM adjacency is not forming on EX4300.
Product-Group=junos 		Due to the HW programming error, CFM sessions gets failed.
PR Number Synopsis Category: Device Configuration Daemon
1553148 The dcd process might leak memory on pushing the configuration to the ephemeral database.
Product-Group=junos 		The dcd (device control daemon) memory leak issue could be observed on all Junos platforms, on pushing the scaled routing-instance configuration with bridge-domain stanza into the Ephemeral database.
1611098 [interface] [platformtag] mx960 : :: PDT - MX960 : seeing dcd[40867]: %DAEMON-5: lo0 family maximum labels is non-adjustable in syslog messages
Product-Group=junos 		When "maximum-labels" under mpls family is not specified in the configuration, DCD tries to set the value internally to 3 as default while parsing the configuration. While processing the parsed configuration, it is seen that setting or changing "maximum-labels" attribute is not allowed for lo0 interfaces. Hence the setting the default value is skipped and a syslog is printed.
PR Number Synopsis Category: dns-proxy feature
1607867 DNS proxy functionality might not work on VRRP interfaces
Product-Group=junos 		On all SRX platforms, if DNS proxy is enabled on VRRP interfaces, then DNS proxy functionality might fail to work.
PR Number Synopsis Category: Express PFE L2 fwding Features
1594255 ARP entry might be found missing intermittently post FPC reboot
Product-Group=junos 		On some QFX series, using Ethernet Virtual Private Network (EVPN) with Virtual Extensible LAN protocol (VXLAN) when the Flexible PIC Concentrator (FPC) is rebooted, in rare occasions some of the Address Resolution Protocol (ARP) entries might be found missing intermittently on the FPC rebooted spine leading to intermittent connectivity issues.
PR Number Synopsis Category: IDP policy
1599954 IDP policy compilation is not happening when a commit check is issued prior to a commit
Product-Group=junos 		On SRX platforms, IDP policy compilation is not loaded when a commit check command is run before commit command.
PR Number Synopsis Category: IDP SSL related bugs
1513335 Traffic might not pass when SSL and IDP configuration is enabled on SRX platforms
Product-Group=junos 		On SRX platforms, traffic might not pass due to global memory overflow in IDP (Intrusion Detection and Prevention) when SSL (secure sockets layer) and IDP configuration is enabled.
PR Number Synopsis Category: Internet Group Management Protocol
1607493 Multicast traffic might be duplicated on subscriber interface on MX platforms
Product-Group=junos 		On MX platforms with distributed IGMP enabled, if a non-bbe junos interface joins the same multicast group as the subscriber interface followed by GRES/NSR switchover, then multicast traffic might be duplicated on subscriber interface.
PR Number Synopsis Category: ISIS routing protocol
1514867 The IS-IS SR routes might not be updated to reflect the change in the SRMS advertisements
Product-Group=junos 		On all Junos platforms, ISIS protocol running with Segment Routing and LDP, if both ISIS levels are enabled on all routers and if conflicting ISIS Segment Routing Mapping Server (SRMS) advertisements are present across the ISIS topology, removal of the preferred SRMS advertisement by the originating node might not be reflected in the corresponding ISIS SR routes on the other nodes. The Labeled-ISIS (ISIS-SR) routes might not be updated to reflect the change in SRMS advertisements. This could potentially lead to traffic drops.
PR Number Synopsis Category: interfaces and zones for junos js software
1553888 The speed mismatch error is seen while trying to commit reth0 with gigether-options.
Product-Group=junos 		When an existing reth configuration is updated so that the existing member interfaces are removed and new member interfaces are added, the commit would fail if the speed of the new member interfaces are different from the speed of the old member interfaces.
PR Number Synopsis Category: User Firewall related issues
1605933 Memory leak at the useridd process might be observed when Integrated User Firewall is configured
Product-Group=junos 		On SRX-Series devices having Integrated User Firewall enabled with Active Directory as the authentication source, memory leak might be observed at the useridd process.
PR Number Synopsis Category: IPSEC/IKE VPN
1605634 Traffic might be dropped in a corner case of IPsec VPN scenario on SRX5000 platforms with SPC3 installed
Product-Group=junos 		On SRX5000 platforms with SPC3 installed and IP security (IPsec) Virtual Private Network (VPN) tunnels configured, if the gcm cipher (e.g. aes-128-gcm and aes-256-gcm) is used as the encryption algorithm, when the Internet Key Exchange Daemon (iked) process restore (e.g. caused by redundancy group 0 failover) happens, the iked process might get a wrong key being restored into the memory. After that, once there is Packet Forwarding Engine (PFE) reset/restart before the IKE Security Association (SA) rekey, traffic drop might happen due to this issue.
PR Number Synopsis Category: Security platform jweb support
1449280 Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal (CVE-2021-31355)
Product-Group=junos 		A persistent cross-site scripting (XSS) vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device; Refer to https://kb.juniper.net/JSA11220 [juniper.net] for more information.
PR Number Synopsis Category: Layer2 forwarding on EX/NTF/PTX/QFX
1599094 The l2ald process may crash due to memory leak when all active interfaces in a VLAN are unstable
Product-Group=junos 		When none of the constituent active interfaces on a VLAN is stable, memory leak may occur which might eventually lead l2ald to crash. No memory leak will be seen if one or some constituent interfaces are flapping but the VLAN has at least one active stable interface overall.
PR Number Synopsis Category: Multiprotocol Label Switching
1573517 The rpd process on the transit node might crash when MPLS traceroute on the ingress node is performed
Product-Group=junos 		On all Junos and EVO platforms with Label Distribution Protocol (LDP) enabled, when bgp peer goes down, if performing MPLS LSP traceroute before ingress node is updated about bgp peer down, the rpd process might crash on the transit node.
PR Number Synopsis Category: MX104 Software - Kernel
1607282 In subscriber management scenario, under a rare condition, the RE reboots and generates a vmcore
Product-Group=junos 		In subscriber management scenario, under a rare condition, the kernel might crash at very rare condition due to a null pointer check when an entry lookup is performed.
PR Number Synopsis Category: MX10K platform
1325946 Chassisd process memory leak issue on MX10008/MX10016 platform which might cause traffic loss.
Product-Group=junos 		Starting with Junos 19.4, the chassisd process on the primary Routing-Engine (RE) for MX10008 and MX10016 platforms keeps leaking memory. When chassisd memory usage reaches 3.5GB it may crash and trigger RE switchover. In some production cases, the RE switchover has triggered temporary traffic impact even on NSR/GRES enabled systems. The rate of memory leak is depending on how many optics/SFPs the system has. Rate of leak = 'Number of optics/SFPs under the system has' * 16Bytes per every 6 seconds. 19.3 and earlier releases still have the same issue, but the leak only happens during MIC/optics initialization stage. The frequency of the leak should be ignorable compare to 19.4 and later releases.
1569167 The agent sensor __default_fabric_sensor__ are partly applied to some FPCs, which causes zero payload issue AGENTD received empty payload for pfe sensor __default_fabric_sensor__.
Product-Group=junos 		PR 1507864 had fixed the invalid data exported from PFE (empty payload), which could be ignored. However, the system logs this event as an error. The fix changed the event as an info.
PR Number Synopsis Category: OS IPv4/ARP/ICMPv4
1511833 The kernel might crash causing the router or the Routing Engine to reboot when performing virtual IP related change.
Product-Group=junos 		On all Junos platforms with VRRP enabled, if delete and add any configuration which involves the virtual IP in the same commit, the kernel might crash. When this happens, the system or the RE will reboot.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1602005 Upgrade might fail when upgrading from legacy release
Product-Group=junos 		On all platforms while directly upgrading from Junos with FreeBSD 6 (e.g. 15.1X49 or before) to the affected releases, the system will check the USB connection. The upgrading will fail if there is no USB device detected during the upgrading process.
PR Number Synopsis Category: "ifstate" infrastructure
1545463 Continuous rpd errors might be seen and new routes fails to be programmed by the rpd process
Product-Group=junos 		In case of high route churn in the network, all kuackmem (Kernel ACK mechanism) entries may be exhausted as a result of a rare timing issue and any new routes will fail to get programmed by rpd.
PR Number Synopsis Category: Paradise pfe ddos protection feature
1578579 TACACS traffic might be dropped
Product-Group=junos 		On PTX Series routers and QFX Series switches, the traffic from TACACS port 49 might not be classified into a proper DDoS queue. When the issue happens, it might cause the unclassified traffic to get dropped when the CPU utilization is very high.
PR Number Synopsis Category: PTP related issues.
1520394 The proper PTP clock might not be synchronized to the downstream node
Product-Group=junos 		In PTP (Precision Time Protocol) mode (PTP only) and hybrid mode (Synchronous ehternet+ PTP) with multiple line cards on MX platform scenario, if the master PTP line card is rebooted, the function issue of acquiring and distributing clock for the PTP might cause the PTP master line card to be stuck in "freerun" state. In such a case, downstream nodes accruing clock from this line card might be out of synchronization.
PR Number Synopsis Category: QFX L2 PFE
1602914 Traffic drop might be observed on QFX5K platforms in virtual chassis scenario when firewall filter is configured
Product-Group=junos 		On QFX5k platforms in the Virtual chassis scenario, when the firewall filter is applied over the AE interface and AE is having only one child member from FPC0 and there are no child members from FPC1, all the packets flowing through backup FPC will be dropped.
1607249 LLDP packets received on VxLAN enabled port might be flooded unexpectedly
Product-Group=junos 		If Link Layer Discovery Protocol (LLDP) packets are received on Virtual Extensible LAN (VxLAN) enabled port, these LLDP packets might be flooded unexpectedly. The issue could make LLDP session keep swapping. As a result, services like Power over Ethernet (PoE) etc might be affected.
PR Number Synopsis Category: qfx-sw-mclag
1605234 MAC move may be seen between the ICL and MC-LAG interface if adding/removing VLANs on the ICL interface
Product-Group=junos 		On QFX/EX platforms with MC-LAG used, if adding/removing VLANs on the ICL (the interchassis link) interface which is used to forward data packets link between two MC-LAG peers, a continuous MAC move might be seen between the ICL and MC-LAG interface. When this happens, it will cause traffic drop due to the flooding as a consequence of the MAC moves.
PR Number Synopsis Category: QFX EVPN / VxLAN
1561588 Dcpfe process might crash on after committing EVPN-VXLAN profile configuration and ARP resolution may fail causing traffic issues.
Product-Group=junos 		Dcpfe process might crash on after committing EVPN-VXLAN profile configuration and ARP resolution may fail causing traffic issues.
PR Number Synopsis Category: QFX5100 Virtual Chassis
1619997 Disabled VCP (Virtual chassis port) will be UP after the optic on it is reseated
Product-Group=junos 		On all EX and QFX platforms, disabled VCP(Virtual Chassis Port) using the command "request virtual-chassis vc-port set interface vcp-xx/xx/xx disable member XX" will be up after the optic on it is reseated. It should keep disabling VC on the port. After it is UP and then a Master switchover is performed, the port will be disabled.
PR Number Synopsis Category: Shard routing infrastructure within RPD
1613104 Memory might be exhausted when both the BGP rib-sharding and the BGP ORR (Optimal Route Reflection) enabled
Product-Group=junos 		On all MX series platforms with 64-bit RPD, when the BGP ORR is enabled together with the BGP rib-sharding, memory utilization might keep increasing when IGP routes are changing. Eventually, this might lead to memory depletion and a service impact.
PR Number Synopsis Category: SFW, CGNAT on MS-MIC/MS-MPC (XLP)
1602528 Jflow-syslog for CGNAT might use 0x0000 in IPV4 Identification field for all fragments
Product-Group=junos 		On all MX platforms with MS-MPC using Jflow logging, Jflow-syslog for CGNAT might use 0x0000 in IPv4 identification fields for all fragments when the Jflow-syslog packets undergo fragmentation. This issue might impact the flow monitoring.
PR Number Synopsis Category: SRX branch platforms
1580667 [SRX] error message tcp_timer_keep:Local(0x81100001:60753) Foreign(0x8f100001:33010) is seen in messages log every 80 seconds
Product-Group=junos 		On SRX series platform with Chassis Cluster, tcp_timer_keep:Local(0x81100001:60753) Foreign(0x8f100001:33010) is seen in messages log every 80 seconds.
PR Number Synopsis Category: Trio pfe stateless firewall software
1586817 FPC might crash in a scaled firewall configuration
Product-Group=junos 		On MX Series routers, PTX Series routers, and QFX Series switches running Junos OS, traffic loss might be observed in a scaled firewall filter configuration setup due to FPC crash. When the issue occurs, a core file is generated, which can be checked using the CLI command 'show system core-dumps'. host@device> show system core-dumps -rw-r--r-- 1 root wheel 89322187 /var/crash/core-NGMPC0.gz.core.0 ----> Core file
PR Number Synopsis Category: Trio pfe l3 forwarding issues
1558899 Some transmitting packets may get dropped due to the "disable-pfe" action is not invoked when the fabric self-ping failure is detected
Product-Group=junos 		On the Trio-based line card with more than one PFEs, if there is a fabric self-ping failure detected on one of the PFE, the chassisd will disable all the IFD (physical interfaces) associated with the PFE to prevent blackhole and report a major CMERROR. Because the affected PFE is still active, and some applications (like BFD over AE across multiple FPCs/PFEs) are still using the PFE to transmit packets, the packets will get dropped due to all interfaces being disabled.
PR Number Synopsis Category: Junos Automation, Commit/Op/Event and SLAX
1604622 File download using "request system download" might fail
Product-Group=junos 		On a EX4400 device, any files scheduled for download using the cli command "request system download" might fail due to error. The files can be downloaded using normal ftp/scp commands on the device.
PR Number Synopsis Category: VMHOST platforms software
1529710 Multiple FRUs disconnection alarms might be displayed post the firmware upgrade
Product-Group=junosvae 		On the MX/PTX platforms with NG-RE installed, after upgrading the Intel i40e-NVM firmware to version 6.01, the FRUs disconnection alarms may be seen along with traffic loss. Please refer to the TSB17603 [juniper.net] (https://kb.juniper.net/TSB17603 [juniper.net]) to upgrade Junos software and Intel i40e-NVM firmware.
PR Number Synopsis Category: VSRX platform software
1603199 Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks. (CVE-2021-31386)
Product-Group=junos 		A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. Refer to https://kb.juniper.net/JSA11254 [juniper.net] for more information.
 

19.2R3-S4 - List of Known issues

PR Number Synopsis Category: Border Gateway Protocol
1323306 Routing Protocols The BGP session might be stuck with high BGP OutQ value after GRES on both sides.
Product-Group=junos 		From 16.1 or above release, when both sides of a BGP session are doing NSR RE switchover simultaneously (double failures), depending on the configuration and scale, there is a chance the BGP session may stuck and BGP PDUs can't be exchanged. The permanently stuck OutQ are seen which is a typical symptom for this issue. This is because both sides are waiting for socket record boundary. Both sides are waiting to drain their partially written PDU. Due to this bug, neither side read at this state, leading to permanent stuck.
1626367 Time delay to export prefixes to BGP neighbors might occur post applying peer-specific bgp export policies
Product-Group=junos 		On all Junos and EVO Platforms, when BGP export policies were changed from deny all to the peer-specific export policies, it might take several hours for the RPD/BGP to finish the export evaluation.
PR Number Synopsis Category: CFM
1536417 FPC might core if CFM flap trap monitor feature in use
Product-Group=junos 		FPC might core if flap-trap-monitor feature under "set protocols oam ethernet cfm performance-monitoring sla-iterator-profiles" is used and performance monitoring flap occurs.
PR Number Synopsis Category: Express PFE FW Features
1420560 The firewall counter for lo0 interface might not increase
Product-Group=junos 		The firewall counter for lo0 does not increase on PTX if lo0 filter family any is configured.
PR Number Synopsis Category: MX Timing software
1442055 PTP packets dropped depending on multicast configuration
Product-Group=junos 		PTP master and PTP slave port configuration only accepts PTP packets with multicast MAC address according to the port settings If forwardable multicast is configured, only PTP packets with forward-able MAC address is accepted, non-forwardable is dropped. link-local multicast is configured, only PTP packets with non-forwardable MAC address is accepted, forwardable is dropped.
PR Number Synopsis Category: Track veHostd, vmm-sdk issues on Mt Rainier RE
1468550 The "SDK_VMMD_APPSERVER_OPAQUE_MSG_ERR" message might be seen on VMHost platforms
Product-Group=junos 		The "SDK_VMMD_APPSERVER_OPAQUE_MSG_ERR" message might be seen on VMHost platforms. On VMHost platform, the current implementation uses the read/write system calls for the TCP socket communication between sdk-vmmd on Junos and vehostd on WRLinux. In some cases, the read/write system calls could result in corruption of data. Because there is no fault handling for these errors, the following error message could be seen. However, the error message is harmless.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1477603 The unexpected next-hop might be seen after route deleted
Product-Group=junos 		On QFX5000/EX4600 Series platforms with "instance-import", deleting route which has "next-table" used might result in unexpected route next-hop.
PR Number Synopsis Category: RPD policy options
1596436 BGP import policy is not applied to all the routes when CCNH inet is enabled
Product-Group=junos 		BGP import policy might be not applied to all the routes when CCNH is configured.
PR Number Synopsis Category: Resource Reservation Protocol
1453705 On the MX2010 Series routers, the BFD session on the IS-IS step up flaps during the ISSU - FRU upgrade stage.
Product-Group=junos 		Bfd session flaps during ISSU only in mpc7e card(Bfd sessions from other cards of DUT to peer routers did not flap during ISSU). Issue is not seen frequently.
PR Number Synopsis Category: All Asgard Platform Related Issues
1335526 The ppmd process might crash after an upgrade on SRX platforms
Product-Group=junos 		On SRX platforms with Bidirectional Forwarding Detection (BFD) enabled for multiple protocols (such as OSPF, ISIS, BGP, PIM), the ppmd process might crash after an upgrade.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1226104 The auditd might crash due to a rare timing issue
Product-Group=junos 		The crash happening in this issue is for auditd tacplus process. The crash is happening while reading the configuration from the database in auditd tacplus process. There is no impact due to this issue since auditd tacplus process will get restarted automatically after it gets terminated.
 

Modification History

First publication 2021-11-30