Alert Type
SRN - Software Release Notification
Risk
Risk Description
Low/Notification
Software Release Notification
Impact
Impact Description
Low/Notification
Software Release Notification
Product Affected
ACX, EX, MX, PTX, QFX, NFX, SRX, VRR, vMX, vSRX
Alert Description
Junos Software Service Release version 19.1R3-S8 is now available for download from the Junos software download site
Download Junos Software Service Release:
Go to
Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select
Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts
Solution
Junos Software service Release version 19.1R3-S8 is now available.
19.1R3-S8 - List of Fixed issues
PR Number
Synopsis
Category: EX4300 PFE
1623429
Route leak from master routing-instance to custom routing-instance failure occurs for local interface
Product-Group=junos
Local interface(e.g..lo0.0) is configured under master routing-instance and leaked the route to another routing-instance.
PR Number
Synopsis
Category: EX2300/3400 PFE
1627857
Packet drop might be observed when L2PT is configured on transit device
Product-Group=junos
On ACX/EX/QFX Junos platforms with Q-in-Q setup in SP(Service Provider) style configuration, when L2PT (Layer2 Protocol Tunneling) is enabled on a transit switch, mac rewritten packets might get dropped on the transit device due to which protocol (for example, STP) convergence fails between the end nodes and thus L2PT breakage could be observed for service-VLANs included in the environment.
PR Number
Synopsis
Category: QFX Analyzer, sflow
1585728
High FPC CPU utilization may be seen on PTX10002-60C/QFX10002-60C platform
Product-Group=junos
On PTX10002-60C/QFX10002-60C platform, if a number of optics are plugged in and interfaces down, high FPC CPU utilization may be seen due to PIC periodic thread consumes lots of CPU.
PR Number
Synopsis
Category: BBE Remote Access Server
1625858
Radius CoA (Change of Authorization) NAK may not be sent with the configured Source Address in a virtual-router environment
Product-Group=junos
On all Junos, when running a radius server in multiple routing instances, the CoA NAK messages uses the interface address instead of the configured source address for non-existent sessions. This issue happens when the Radius server is configured in different virtual routers with different settings.
PR Number
Synopsis
Category: Covers Application classification workflows apart from custo
1599053
Junos OS: SRX Series: If no-syn-check is enabled, traffic classified as UNKNOWN gets permitted by pre-id-default-policy (CVE-2022-22167)
Product-Group=junos
A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection (JDPI) rules and access unauthorized networks or resources, when 'no-syn-check' is enabled on the device. While JDPI correctly classifies out-of-state asymmetric TCP flows as the dynamic-application UNKNOWN, this classification is not provided to the policy module properly and hence traffic continues to use the pre-id-default-policy, which is more permissive, causing the firewall to allow traffic to be forwarded that should have been denied. Refer to https://kb.juniper.net/
JSA11265
[juniper.net]
for more information.
PR Number
Synopsis
Category: EX driver issues
1600291
The SFP-T port might stop forwarding traffic on EX4600 platforms
Product-Group=junosvae
On EX4600, after performing an upgrade, the peer device is rebooted, the peer interface is disabled/enabled or rebooting EX4600, then the SFP-T port on EX4600 might remain in up state but could not forward traffic.
PR Number
Synopsis
Category: jdhcpd daemon
1588813
Delegated prefix ipv6 address is missing in accounting stop messages
Product-Group=junos
DP (Delegated prefix) is cleared when underlying session (dhcpv6 over ppp) ifl is deconfigured. DP is not seen in Radius accounting stop messages.
PR Number
Synopsis
Category: jl2tpd daemon
1629104
L2TP tunnels may go down and not able to re-establish after restarting the bbe-smgd process
Product-Group=junos
On MX configured as L2TP access concentrator (LAC), if the bbe-smgd process is restarted when L2TP tunnels are getting down (e.g. L2TP tunnel will get down due to retransmission timed out caused by loss of IP connection between LAC and LNS) and later on the same tunnels are selected to tunnel new subscriber sessions, these L2TP tunnels may be stuck in down state and not be able to re-establish. The issue could cause the subscriber to lose connectivity. This is a timing issue.
PR Number
Synopsis
Category: User Firewall related issues
1589108
The jsqlsyncd process files generation might cause device to panic crash after upgrade
Product-Group=junos
On SRX-Series devices configured in high-availability, after upgrade jsqlsyncd process files might get generated which might result in device panic crash.
PR Number
Synopsis
Category: Layer2 forwarding on EX/NTF/PTX/QFX
1599094
The l2ald process may crash due to memory leak when all active interfaces in a VLAN are unstable
Product-Group=junos
When none of the constituent active interfaces on a VLAN is stable, memory leak may occur which might eventually lead l2ald to crash. No memory leak will be seen if one or some constituent interfaces are flapping but the VLAN has at least one active stable interface overall.
PR Number
Synopsis
Category: Track Mt Rainier RE platform software issues
1464679
Upgrade failure on next generation routing-engine with grub-editenv: error: invalid environment block
Product-Group=junos
Junos upgrade might fail on next-generation routing-engines due to this grub error "grub-editenv: error: invalid environment block".
PR Number
Synopsis
Category: FreeBSD Kernel Infrastructure
1570148
A false error related to insufficient space might appear while installing a Junos image that is corrupted
Product-Group=junos
On all Junos platforms, the upgrade might fail with a false error related to insufficient space when trying to install Junos from a corrupted package.
PR Number
Synopsis
Category: vMX Data Plane Issues
1599158
Junos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC reboot (CVE-2022-22168)
Product-Group=junos
An Improper Validation of Specified Type of Input vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to trigger a Missing Release of Memory after Effective Lifetime vulnerability. Continued exploitation of this vulnerability will eventually lead to an FPC reboot and thereby a Denial of Service (DoS). Refer to https://kb.juniper.net/
JSA11275
[juniper.net]
for more information.
PR Number
Synopsis
Category: VRR (Virtual Route Reflector) for MX
1635950
vRR VM might establish its identity as "Olive" after a CLI s/w upgrade
Product-Group=junos
vRR VM might come up as Olive after a CLI sw upgrade using junos-install-mx* package if the XML used to spawn the VM didn't have SMBIOS entry "VRR".
PR Number
Synopsis
Category: Chassis mgmt for all QFX systems - chassis MIB, alarms, CLI
1479930
The lasers may keep lasting after the device reboots
Product-Group=junos
On the QFX5210-64C platforms, the laser on the optic "QSFP+-4X10G-LR" may still keep lasting after rebooting even the port is disabled via CLI command before restarting.
PR Number
Synopsis
Category: QFX L2 PFE
1637249
Configuring L2PT on a transit switch in a Q-in-Q environment breaks L2PT for other S-VLANs
Product-Group=junos
When L2PT (Layer2 Protocol Tunneling) is enabled on a transit switch using SP style configuration, protocol convergence between end nodes might fail.
PR Number
Synopsis
Category: QFX EVPN / VxLAN
1611488
Inter-vlan connectivity might be lost in an EVPN-VXLAN with CRB topology
Product-Group=junos
In a fabric consisting of 2 or more spines and QFX5k as leaf switches in an EVPN-VXLAN CRB(Ehernet VPN-Virtual Extensible LAN Centrally-routed Bridging) overlay topology with VGA(Virtual Gateway Address) configured on the spine, inter-vlan connectivity with the hosts connected to leaf switches might be lost when the interfaces on second spine connected to leaf switches is enabled.
PR Number
Synopsis
Category: QFX5100 Virtual Chassis
1619997
Disabled VCP (Virtual chassis port) will be UP after the optic on it is reseated
Product-Group=junos
On all EX and QFX platforms, disabled VCP(Virtual Chassis Port) using the command "request virtual-chassis vc-port set interface vcp-xx/xx/xx disable member XX" will be up after the optic on it is reseated. It should keep disabling VC on the port. After it is UP and then a Master switchover is performed, the port will be disabled.
PR Number
Synopsis
Category: RPD route tables, resolver, routing instances, static routes
1635009
Multipath route getting formed for a VPN prefix due to incorrect BGP route selection logic
Product-Group=junos
On all Junos and EVO platforms running BGP, when a specific route is received from multiple places under a VRF, multipath route is getting formed even though the BGP route selection algorithm has the active route with higher local preference. Once multipath is formed, the traffic forwarding is happening based on that, and it may result in some traffic going to an unwanted path. Please refer to
KB37775
[juniper.net]
for more details.
PR Number
Synopsis
Category: SRX5XX platform
1575231
The fxp0 interface of an SRX550 in cluster might become unreachable from an external network
Product-Group=junos
On SRX550 configured with chassis cluster, fxp0 interfaces might not be reachable from external management interface when the fxp0 and redundant Ethernet(reth) interfaces are in separate routing instances. This is because there is no ARP entry for the reth interface in fxp0 ARP table. As a result of this, SRX cluster cannot be accessed from an external management network.
PR Number
Synopsis
Category: MPC7/8/9 Interface Issues
1441816
Egress stream flush failure and traffic black hole might occur.
Product-Group=junos
Egress stream flush failure and silent dropping of traffic could occur in a rare occasion for a repeatedly flapping link on MPC7E, MPC8E, MPC9E cards, MX204 and MX10003.
PR Number
Synopsis
Category: Stout cards (MPC8, MPC9) fabric issues
1617469
MPC8E in 1.6T bandwidth mode may not work correctly
Product-Group=junos
If MPC8E is set in 1.6T bandwidth mode, it may not work correctly and the end result is that the MPC8E will not be able to see 1.6T throughput (as configured) and will see fabric drops at higher traffic rates. The 1.6T bandwidth fabric parameters are not getting applied to SFBs.
PR Number
Synopsis
Category: VMHOST platforms software
1414845
MX204 and EX9251 may fail to shut down or reboot with pciehp errors reported
Product-Group=junos
If the Routing Engine BIOS version is 0.15.1, MX204 and EX9251 may fail to shut down or reboot with pciehp errors reported. If this issue happens, manual power cycling is needed to complete a reboot process.
1453783
Fabric Hardening and rngd read error may occur after system is idle for some time
Product-Group=junos
Passing access authorization of folder /dev/random to guest is causing FPC to enter an unstable state(leading to unexpected issues such as fabric healing, slow response to snmp polling, etc) when host entropy drops below 200, especially when it reaches close to '0'. So removing the authorization of virtio random feature to guest for now until proper fix version is available.
1547669
WR Linux 6 platforms and WR Linux 9 platforms might be stuck after upgrading or downgrading image version and restarting the device
Product-Group=junos
On Wind River Linux 6 (WR Linux 6) platforms and WR Linux 9 platforms using VMHOST based routing engine (RE), device might be stuck after upgrading image or downgrading image and reload the device. There is service impact if this issue happens.
19.1R3-S8 - List of Known issues
PR Number
Synopsis
Category: EX4300 PFE
1630935
Application of firewall filters might break connectivity towards the hosts on EX4300
Product-Group=junos
On EX4300 platforms except EX4300-MP/EX4300-48MP, once input/output firewall filters are applied to the interfaces under family ethernet-switching, it might result in disrupting the connectivity towards few hosts connected to the device and thus impacts the related traffic.
PR Number
Synopsis
Category: EX2300/3400 PFE
1564941
The DHCP client might not obtain IP address when dhcp-security is configured
Product-Group=junos
On EX2300 platforms, if enterprise Style (EP) and service provider (SP) style configurations are mixed on a trunk interface, the DHCP client under SP style configuration might not obtain IP address when dhcp-security is enabled on one of the trunk VLANs.
PR Number
Synopsis
Category: "agentd" software daemon
1478200
Xmlproxyd sensors does not get programmed in some scenarios
Product-Group=junos
XMLproxyd sensors are custom defined sensors which require yang package installation. When the package is not installed prior to subscribing to the paths served by xmlproxyd, the Network Agent fails to deallocate the resources associated with the failed xpath. So, next time when the yang pkg is installed and the sensor is subscribed again, Network Agent doesn't install the sensor presuming that there is already resource allocated for the xpath. Hence streaming for sensor doesn't happen.
PR Number
Synopsis
Category: MPC5/6E PFE ISSU software
1542882
The JNH memory leak could be observed on MPCs or MICs
Product-Group=junos
On all Junos platforms with Trio-based line cards, a Junos next-hop (JNH) memory leak might be observed. This issue is due to the counters applications under firewall filters taking the additional memory space from the shared JNH pool. In an extreme scenario, this could also lead to FPC crash.
PR Number
Synopsis
Category: Firewall Filter
1421621
With IPSec configuration, following GRES, Standby RE is not accessible via SSH until a 2nd GRES is performed
Product-Group=junos
With IPSec configuration, after GRES, trying to ssh to the "new" standby RE may fail until the IPSec Key management daemon no longer running.
PR Number
Synopsis
Category: Ethernet OAM (LFM)
1500048
The fpc process might crash in the inline mode with CFM configured.
Product-Group=junos
On the Junos platforms with inline mode CFM (Connectivity Fault Management) configured, if there are several CFM adjacencies flapping, due to the flaw in the CFM module to process the error-adjacencies messages, the FPC may crash alongside with NPC core-dump file generated. All services/traffic configured on the FPC will see outage till FPC recovers from an automatic reboot.
PR Number
Synopsis
Category: EX driver issues
1600291
The SFP-T port might stop forwarding traffic on EX4600 platforms
Product-Group=junos
On EX4600, after performing an upgrade, the peer device is rebooted, the peer interface is disabled/enabled or rebooting EX4600, then the SFP-T port on EX4600 might remain in up state but could not forward traffic.
PR Number
Synopsis
Category: Layer2 forwarding on EX/NTF/PTX/QFX
1627617
The line card might crash and reload if the EVPN MAC entry is not deleted correctly
Product-Group=junos
On all Junos and EVO platforms, the line card might crash and reload in an EVPN-MPLS scenario when there is a MAC move from local to remote and the request to delete MAC entry is received from remote. Core files are generated and complete traffic loss might be observed until the line card reloads.
PR Number
Synopsis
Category: lldp sw on SRX platform
1485290
The LLDP protocol can be configured on SRX4100, SRX4200, SRX4600 and SRX5k, which it is not actually supported on those platforms.
Product-Group=junos
The LLDP protocol can be configured on SRX4100, SRX4200, SRX4600 and SRX5k, which it is not actually supported on those platforms.
PR Number
Synopsis
Category: MX10K platform
1569167
The agent sensor __default_fabric_sensor__ are partly applied to some FPCs, which causes zero payload issue AGENTD received empty payload for pfe sensor __default_fabric_sensor__.
Product-Group=junos
PR 1507864 had fixed the invalid data exported from PFE (empty payload), which could be ignored. However, the system logs this event as an error. The fix changed the event as an info.
PR Number
Synopsis
Category: FreeBSD Kernel Infrastructure
1555748
Devices might get stuck in "OK" prompt while loading the image.
Product-Group=junos
EX, MX, PTX & SRX series devices may stuck in the "OK" prompt while loading image for certain junos versions like 18.3R1, 21.1R1.
1579331
EX4400: Under some conditions, the FPGA reset reason may be incorrectly shown in console logs as 0.
Product-Group=junos
EX4400: Under some special conditions, such as boot from OAM volume following a graceful/warm reboot, the FPGA reset reason incorrectly shown in console logs as 0.
1602005
Upgrade might fail when upgrading from legacy release
Product-Group=junos
On all platforms while directly upgrading from Junos with FreeBSD 6 (e.g. 15.1X49 or before) to the affected releases, the system will check the USB connection. The upgrading will fail if there is no USB device detected during the upgrading process.
PR Number
Synopsis
Category: QFX L2 PFE
1560086
On the QFX5200 line of switches, the pseudorandom binary sequence (PRBS) test fails for 100GbE interfaces with the default settings.
Product-Group=junos
On the QFX5200 line of switches, the pseudorandom binary sequence (PRBS) test fails for 100GbE interfaces with the default settings.
PR Number
Synopsis
Category: Resource Reservation Protocol
1453705
On the MX2010 Series routers, the BFD session on the IS-IS step up flaps during the ISSU - FRU upgrade stage.
Product-Group=junos
Bfd session flaps during ISSU only in mpc7e card(Bfd sessions from other cards of DUT to peer routers did not flap during ISSU). Issue is not seen frequently.
PR Number
Synopsis
Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1489942
Prolonged flow control might occur with MS-MPC or MS-MIC.
Product-Group=junos
On MX platforms with MS-MPC/MS-MIC, datapath is getting blocked due to incorrect handling of fragment packets with payload size 0. When the datapath is blocked for more than 5 seconds, it is identified as Prolonged flow control, and the pic is rebooted. Core dump is generated if dump-on-flow-control is enabled.
PR Number
Synopsis
Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1452136
The mgd might crash when you use the replace pattern command.
Product-Group=junos
When you use the "replace pattern" command to replace the name in the apply-group, the mgd crashes.
Modification History
First publication 2022-01-25
19.1R3-S8: Software Release Notification for JUNOS Software Version 19.1R3-S8