Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

ACX EX MX NFX PTX QFX SRX vSRX

Alert Description

Junos Software Service Release version 19.4R3-S10 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 19.4R3-S10 is now available.

19.4R3-S10 - List of Fixed issues

PR NumberSynopsisCategory: EX4300 PFE
1675977The fxpc process crash might be observed on EX4300 and EX4300-VC platforms
Product-Group=junos		On EX4300 platforms, if there are mac-move events, the fxpc (Packet Forwarding Engine manager) crash might be observed due to race conditions.
PR NumberSynopsisCategory: a20a40 specific issue
1642138Missing boot parameters on Junos SRX5K platforms will result in fabric plane CRC link errors
Product-Group=junos		Fabric plane link CRC errors are detected on Junos SRX5K platforms which can cause an HA switchover and in worst case scenario, throughput issues for user traffic. The hardware error message "Minor CB (Control Board) Fabric Chip Not Online" is displayed and is caused by fabric plane CRC error like "FPC plane CRC link error". The issue happens in HA (High Availability) scenario with SCB4 (Switch Control Board) and IOC3 (Input Output, I/O) cards in use.
PR NumberSynopsisCategory: BBE Autoconfigured DVLAN related issues
1680453The process bbe-smgd on the router would stop processing new PPPoE subscribers session
Product-Group=junos		On all Junos platforms configured with subscriber-management, the process bbe-smgd will stop processing new PPPoE (Point-to-Point Protocol over Ethernet) connections due to a memory leak in the control packet pool of the PPPoE plugin.
PR NumberSynopsisCategory: BBE Statistics daemon & libraries
1676049Minor memory leak in 'bbe-statsd' daemon may be seen when subscriber-management is enabled on MX platforms
Product-Group=junos		On MX platforms, a minor memory leak may be seen over time for transient subscriber sessions which last for around 30 seconds or less. The issue is reproducible consistently and may result in 'bbe-statsd' daemon crash over time.
PR NumberSynopsisCategory: Border Gateway Protocol
1680360InboundConvergencePending flag is set after RE switchover
Product-Group=junos		When the BGP EOR update is received, the BGP flag "InboundConvergencePending" should be cleared on both master and backup RE. However, after performing RE switchover, the flag "InboundConvergencePending" might be re-set on master or backup RE, which is unexpected. The potential impact may be seen ONLY when BGP multipath is used. The multipath calculation may not start or stop as expected.
PR NumberSynopsisCategory: Firewall Filter
1670622Traffic loss may be observed when changing firewall configuration
Product-Group=junos		On MX platforms supporting MPC7/8/9 line cards, traffic loss may be observed if the firewall configuration changes are made when PFE 0 (Packet Forwarding Engine) is in a disabled state. It is a rare occurrence.
PR NumberSynopsisCategory: Control Plane for Node Virtualization
1685453PICs on the GNF failed to come online after the chassisd restart
Product-Group=junos		On MX platforms supporting node-slicing (MX480, MX960, MX2010, MX2020 & MX2008) have an issue that when GNF (Guest Network Function) chassisd restarts, the FPC doesn't restart as expected which causes the PIC (Physical Interface Card) to be offline.
PR NumberSynopsisCategory: EVPN control plane issues
1680421EVPN MPLS traffic drop can be observed in a multi-vendor PE CE setup with single-active LAG
Product-Group=junos		On all Junos platforms running EVPN (Ethernet Virtual Private Network) MPLS (Multi-Protocol Labeled Switching) and a single active LAG (Link Aggregation), the traffic can get forwarded to the NDF (Non-Designed Forwarder) router which can lead to a traffic drop. This issue is seen in multi-vendor PE (Provider Edge) CE (Customer Edge) setup when there is a DF switchover i.e DF (Designated Forwarder) role changes and the backup router starts advertising the EVPN type 2 route, now there is another switchover and the old DF again becomes the DF and advertises EVPN type 1 route but the NDF does not withdraw its route consequently the traffic gets forwarded to the NDF.
PR NumberSynopsisCategory: Express PFE including evpn, vxlan
1674116The BFD packets will drop in an EVPN-VxLAN scenario due to incorrect layer3 offset being set in the host path
Product-Group=junos		On all QFX10000-60C platforms with Ethernet VPN-Virtual Extensible LAN (EVPN-VxLAN) scenario, the Bidirectional Forwarding Detection (BFD) packets are getting classified as packets of different protocols like Virtual Router Redundancy Protocol (VRRP), depending on the value at an incorrect offset which leads to BFD packet drop.
PR NumberSynopsisCategory: idp flow creation, deletion,notification, session mgr intfce
1686105IDP unwanted attacks (false positives) detected on the traffic
Product-Group=junos		On all Junos SRX platforms with 19.4 and 20.1 releases, IDP (Intrusion Detection and Prevention) false positive attacks can be exempted from the policy for traffic continuity. The impact is that unexpected signatures may trigger in certain conditions and IDP false positive attacks may be detected.
PR NumberSynopsisCategory: l2 flow module
1599891OSPF neighbor won't establish under Transparent mode when neighborship across different zone
Product-Group=junos		Some of the OSPF neighborship might not able to establish after system bootup when the neigborship connect to SRX via different zone under transparent mode
PR NumberSynopsisCategory: Label Distribution Protocol
1680574In an LDP -> BGP LU stitching scenario, Multiple LSPs will not be installed in the forwarding table, even if BGP Multipath and ECMP are enabled
Product-Group=junos		On all Junos and Junos OS Evolved Platforms, when BGP LU (Labeled Unicast) routes are exported to LDP (Label Distribution Protocol) to perform LDP->BGP-LU stitching, LDP installs only one NH(Next Hop) in the forwarding table instead of multiple NHs, even when BGP Multipath and ECMP are enabled. This issue will be seen for both EBGP (External Border Gateway Protocol) and IBGP (Internal Border Gateway Protocol) multipaths on PTX platforms and for only iBGP multipaths on all other platforms.
PR NumberSynopsisCategory: Platform issues specific to MS-MPC (XLP)
1681624Fabric Plane check/error alarm would be seen due to the burst traffic in MS-MPC line cards
Product-Group=junos		On MX2008 platforms, when the overrun interrupt is set in Multiservices Modular PIC Concentrator (MS-MPC) line cards Fabric Plane check/error alarm would be observed. Latency difference between the SFB2/SFB3 and the MS-MPC cards with burst traffic potentially causes overruns as a result the fabric planes get stuck into the check state. It is a timing issue.
PR NumberSynopsisCategory: MPC11 ULC fabric software related issues.
1658164Fabric Destination error/Fabric plane in check state
Product-Group=junos		Fabric Plane check/error alarm can be seen due to overrun interrupt being set in MS-MPC line cards. Latency difference between the SFB2/SFB3 and the MS-MPC cards potentially causes overruns to increase during the traffic burst.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1616841Protected LSP goes down with strict hops and link protection configured
Product-Group=junos		On all Junos and all EVO platforms, the sub-LSP of a Point-to-Multipoint Label Switched Path(P2MP LSP) with link-protection and having strict hops goes down when a protected link on more than one sub-LSP goes down simultaneously and TED(Traffic Engineering Database) notification or RSVP tunnel local repair message not received before the CSPF(Constrained Shortest Path First) computation. As a result, the sub-LSP fails and traffic drop is seen.
1673348CPU utilization of rpd process may reach 100% while reporting LSP states to pccd if the IS-IS update churn is high
Product-Group=junos		On all Junos and Junos Evolved platforms where PCEP (Path Computation Element Protocol) is provisioned, after IS-IS (Intermediate System-Intermediate System) PDU (Protocol Data Unit) flooding, rpd (routing protocol daemon) re-computes LSPs (Label Switched Path) and sends those to the pccd (path computation client daemon) which in turn reports those to PCE (Path Computation Element) for processing. If the update churn is high, this may cause the rpd to reach or get stuck at 100% CPU utilization.
PR NumberSynopsisCategory: FreeBSD Kernel Infrastructure
1681783On Ex4400 upgrade failure happens when upgrading through a USB drive.
Product-Group=junos		On EX4400 upgrade failure happens when upgrading through a USB drive.
PR NumberSynopsisCategory: PFE Peer Infra
1667674The FPC might fail to initialize on Junos platforms
Product-Group=junos		On all Junos platforms, in a very corner case, the FPC (Flexible PIC Concentrators) might fail to initialize and remains in a stuck state when an FPC is installed or rebooted.
PR NumberSynopsisCategory: PPPoE functional plugin for bbe-smgd
1685070Multiple bbe-smgd cores might be observed resulting in subscribers being lost or failing to login in the Enhanced subscriber scenario
Product-Group=junos		On MX platforms, multiple bbe-smgd cores might be observed due to out-of-bound memory access in the Enhanced subscriber scenario when bringing up PPPoE (Point-to-Point Protocol over Ethernet) subscribers and ACI (agent circuit identifier)/ARI (agent remote identifier) are part of the payload.
PR NumberSynopsisCategory: QFX L2 PFE
1676772VLAN translation mapping gets deleted when one of the member interface removed from LAG
Product-Group=junos		On all QFX5k, EX4650 and EX4600 platforms, if port has VLAN translation configuration and LAG interfaces connected on same FPC then incoming traffic can drop if one member of LAG interface is deleted/removed.
PR NumberSynopsisCategory: QFX10008/16 QFX10002 optics related issues.
1677325Interfaces with QFX-10000-30C and QFX10000-30C-M Line Cards will not work properly
Product-Group=junos		On QFX10K platforms, interfaces with QFX-10000-30C and QFX10000-30C-M Line Cards will not work properly with FEC (Forward Error Configuration) and links connected to them will remain down.
PR NumberSynopsisCategory: Remote Access VPN issues on SRX
1571326HTTPS connection might timeout when remote access VPN connection with Juniper Secure connect fails
Product-Group=junos		On all SRX-series devices with tcp-encap profile (with ssl-t profile i.e pfv2) attached to ike-gw, when large number of sessions (say above 4lacs) are processed by flow, remote access VPN connection fails. This leads to HTTPS connection timeout.
PR NumberSynopsisCategory: Trio LU, IX, QX, MQ chip drivers, ucode & related SW
1530244A new CMERROR has been added to the system regarding OCM parity errors
Product-Group=junos		On the MX/EX/SRX platforms with XM chip-based line card installed, PFE (Packet Forwarding Engine) wedge on the impacted line card may be observed when the FPC is reporting OCM parity errors continuously in the syslog file. The code changes in the PR are to introduce a major CMERROR to invoke "disable-pfe" action to bring the PFE down automatically to mitigate this issue.
1681533The line card gets crashed during node/interface statistics reporting with resource monitoring
Product-Group=junos		On MX platforms with specific line cards, the MPC may crash and generate core dumps in a corner case during node/interface statistics reporting scenario when resource monitoring is used.
PR NumberSynopsisCategory: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1629136,FPC crash might be observed in the subscriber scenarios
Product-Group=junos		On all Junos platforms which support subscriber configuration, in a very rare scenario the FPC crash might be observed, when the subscriber logs out. The issue is due to out-of-bound memory access while deleting the subscriber prefix.
PR NumberSynopsisCategory: Trio pfe bridging, learning, stp, oam, irb software
1669478Traffic drop observed with SP style configuration for the logical tunnel in layer2 domain
Product-Group=junos		On MX platforms, when the configuration for the logical tunnel in the layer2 domain is in the service provider style observing traffic drop for traffic over IRB (Integrated routing and bridging).
PR NumberSynopsisCategory: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1586377Authorization issue might be observed if the login class is configured on NFX platforms
Product-Group=junos		On NFX platforms, if a user assigned to a class containing parameters configured under system login class logs in, the session gets terminated and the login fails.
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1673176"gethostbyname: Host name lookup failure" is displayed during commit
Product-Group=junos		On all SRX Series devices with J-Web enabled, "gethostbyname: Host name lookup failure" is displayed during commit. This issue is a display issue and doesn't have any service impact.
PR NumberSynopsisCategory: Issues related to all UI tools (mgd-bsd/cli-bsd, XML and DMI
1681656System uptime display is shown in minutes instead of seconds
Product-Group=junos		On all Junos and Junos Evolved platforms, after the device reboot, show system uptime command is showing time in minutes instead of seconds for 24 hours.
PR NumberSynopsisCategory: Xellent Platform issues
1568294Another port will also be shutdown after shutting down one port on PTX10002-60C/QFX10002-60C
Product-Group=junos		On PTX10002-60C/QFX10002-60C platform, after disabling the standalone/non-channelized port (e.g. port 6, 16,26,36,46,56), then another port on that port group will aslo be disabled. For example, disable et-0/0/36, port et-0/0/30 is going to down as well. This issue is only exposed when using DAC cables.
 
 

19.4R3-S10 - List of Known issues

PR NumberSynopsisCategory: BBE dynamic profile related issues
1537512Configured subscriber with dynamic profiles may be missed after ISSU
Product-Group=junos		After performing an "in-service software upgrade" (ISSU), some of the configured subscriber profiles may be missing after upgrade.
PR NumberSynopsisCategory: Express BT PFE L3 Features
1657659Junos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OID (CVE-2022-22211)
Product-Group=junos		A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Denial of Service (DoS). Please refer to https://kb.juniper.net/JSA69916 [juniper.net] for more information.
PR NumberSynopsisCategory: MX Inline Jflow
1444849Sampling applications like port-mirror and inline-jflow are not supported on VPLS tunnel interfaces in ingress direction where ingress packets are sent to the IRB interface for routing. Configuration of sampling application on VPLS tunnel interfaces in such scenario causes packet to drop in ingress direction.
Product-Group=junos		Sampling applications like port-mirror and inline-jflow are not supported on VPLS tunnel interfaces in ingress direction where ingress packets are sent to the IRB interface for routing. Configuration of sampling application on VPLS tunnel interfaces in such scenario causes packet to drop in ingress direction.
PR NumberSynopsisCategory: Platform infra to support jvision
1628807Interface sensor data may not be decoded on line cards (MPC10E/MPC11/MPC12/LC9600) and Junos Evolved platforms
Product-Group=junos		On MX platforms having line cards (MPC10E/MPC11/MPC12/LC9600) and Junos Evolved platforms, the interface sensor data might not be decoded.
PR NumberSynopsisCategory: Multiprotocol Label Switching
1598207Sometimes MPLS LSP may go down due to a timing issue when a protected link goes down
Product-Group=junos		When a protected link goes down, MPLS gets tunnel local repair message from RSVP and trigger CSPF computation. Next, MPLS gets link protection information through RRO notification. If MPLS receives TED notification first before RRO notification, then CSPF computation fails. Since the link protection flag is not set, MPLS thinks it is an unprotected link and brings down the LSP.
PR NumberSynopsisCategory: TCP/UDP transport layer
1637928Junos OS: Peers not configured for TCP-AO can establish a BGP or LDP session even if authentication is configured locally (CVE-2022-22237)
Product-Group=junos		An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on confidentiality or integrity. Please refer to https://kb.juniper.net/JSA69893 [juniper.net] for more information.
PR NumberSynopsisCategory: RPM and TWAMP
1522488rmopd reports false TCP errors in the log messages: RMOPD_TWAMP _SOCKOPT_ FAILURE setsockopt(TCP_KEEP.*) failed, error: Invalid argument. This is cosmetic issue.
Product-Group=junos		rmopd reports false TCP errors in the log messages: RMOPD_TWAMP_SOCKOPT_FAILURE setsockopt(TCP_KEEP.*) failed, error: Invalid argument. This is cosmetic issue. The issue is fixed in Junos releases 21.1R1 and newer.
PR NumberSynopsisCategory: SRX branch platforms
1591951syslog messages: dot1xd[]: JTASK_IO_CONNECT_FAILED: ESP CLIENT:33010.143.144.0.1+33010: Connecting to 143.144.0.1+33010 failed: No route to host
Product-Group=junos		Misleading syslog message is generated for SRX branch chassis cluster setup with Junos 19.4. dot1xd[]: JTASK_IO_CONNECT_FAILED: ESP CLIENT:33010.143.144.0.1+33010: Connecting to 143.144.0.1+33010 failed: No route to host The syslog message is cosmetic, with no impact. This syslog message can be filtered from the syslog file. Layer 2 communication infrastructure between chassis cluster nodes improvements were added in 19.4R3-S9 resolving this problem.
1658276reth interface does not go up due to speed mismatch when reth interface speed is changed afger RG0 failover
Product-Group=junos		On SRX series platform with chassis cluster enabled, reth interface might not go up due to speed mismatch when reth interface speed is changed afger RG0 failover
PR NumberSynopsisCategory: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1689621"failed to get template var id" error messages are generated by FPC when BFD liveness detection is negotiated by DHCP subscriber which has lawful intercept enabled
Product-Group=junos		In subscriber management environment, "failed to get template var id" error messages are generated by FPC when BFD liveness detection is negotiated by DHCP subscriber which has lawful intercept enabled.

 

Modification History

First publication 2022-11-15