Alert Type

PSN - Product Support Notification
HighFirewall filter change of behavior
HighFirewall filter change of behavior

Product Affected

PTX10001-36MR PTX10003 PTX10004 PTX10008 PTX10016

Alert Description

Summary

Before 21.4R2-S1-EVO, WAN interfaces (interfaces used for transit traffic forwarding) on PTX platforms running Junos OS Evolved supports the "next-header" match clause which matches on the IPv6 header's last NH. There is no match clause to match the IPv6 header's first NH. With the change, the IPv6 header match clause will be the same as MX platforms running Junos (See Firewall Filter Match Conditions for IPv6 Traffic | Juniper Networks for detail)

This change is introduced into Junos OS Evolved versions:
  • 21.4R2-S1-EVO, 21.4R2-S2-EVO, 21.4R3-S1-EVO and later
  • Exclude 21.4R3-EVO
  • 22.2R2-EVO
  • 22.3R1-EVO


Detail Explanation

MX platforms have a "next-header" match that matches the first Next Header (NH) in the packet and the "payload-protocol" to match the last NH. On the other hand, EVO-PTX platforms currently support the "next-header" match on the last NH, but not the first one. The most common use case is to match the last NH, and this is native to the PTX platforms. This software change alters the existing implementation by making the "next-header" matches the first NH, and the "payload-protocol" to match the last NH. (See fig 1 below). The goal is to make the IPv6 firewall match clauses behave the same way as those on the MX platforms.

Change Summary

PlatformFirst NH match conditionLast NH match condition
MXnext-headerpayload-protocol
PTX (Pre-this change)N/Anext-header 
PTX (Post-this change)next-headerpayload-protocol

Solution

If you are using the IPv6 filter "next-header" clause on your WAN interfaces' firewall, you need to review and modify the firewall to match the new behavior. 

Note: the combination of the "next-header" match in the previous implementation, while not providing any matching, may result in a commit-check fail after the software upgrade. Please pay attention to the combinations below. If you are unsure, we recommend that you disable IPv6 filters before performing a software upgrade and enable the filters afterward.

New Functional Behavior

The functional behavior (below) is captured for various scenarios of v6 packets with or without extension headers. See - "Understanding IPv6 Packet Header Extensions"  for the detail of "Routing", "HBH" or "Hop-by-Hop" options

image.png

image.png

Previous Functional Behavior

image.png
image.png

Modification History

  • 2022-12-15 Update the tables. The changes are for egress lo0 for the pp match row. This match was not supported and a commit check was put during the testing
  • 2022-09-30 Update to exclude 21.4R3-EVO from the affected software release
  • First publication 2022-07-07