21.1R3-S4: Software Release Notification for JUNOS Software

Alert Type

SRN - Software Release Notification

RiskRisk Description

Low/Notification

Software Release Notification

ImpactImpact Description

Low/Notification

Software Release Notification

Product Affected

ACX EX MX NFX PTX QFX SRX vSRX

Alert Description

Junos Software Service Release version 21.1R3-S4 is now available for download from the Junos software download site

Download Junos Software Service Release:

Go to Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 21.1R3-S4 is now available.

21.1R3-S4 - List of Fixed issues

PR Number	Synopsis	Category: EX4300 PFE
1673000	VLAN ID of a VSTP BPDU changes when it transits through the switch Product-Group=junos	On EX4300-24T, EX4300-48P, EX4300-VC, EX430024P, EX430032F and EX430048T platforms, when a VSTP (VLAN Spanning Tree Protocol) BPDU (Bridge Protocol Data Unit) arrives with a VLAN ID that is not configured in the switch, but that matches with an HW Token of any other configured VLAN, the VLAN ID of the BPDU will be changed to the VLAN ID corresponding to the matched HW Token and flooded. This disrupts STP convergence on the configured VLAN because some ports can incorrectly go into blocking state.
PR Number	Synopsis	Category: EX4300 Layer 2 implementation
1655511	The egress traffic is not tagged properly in a L2PT scenario Product-Group=junos	On EX4400/EX4100 and QFX5120 platforms, in a Layer 2 protocol tunneling (L2PT) scenario, the egress traffic from network-to-network interface (NNI) ports on a device, to user-to-network interface (UNI) ports, remains untagged at the UNI end, which will impact the protocols enabled on the interface.
PR Number	Synopsis	Category: EX2300/3400 PFE
1647209	DHCP traffic might be dropped when DHCP-security and RTG are enabled Product-Group=junos	On EX2300, EX2300-48MP, and EX3400 platforms, when DHCP-security and Redundant Trunk Group (RTG) are enabled clients connected over RTG might not get DHCP IP and DHCP traffic might be dropped.
1678430	AE interface will receive unknown unicast traffic on FPC3 reboot of a VC Product-Group=junos	On VC (Virtual Chassis) supporting EX and QFX platforms, having VC of 4 or more nodes, with an AE (Aggregated Ethernet) interface connected to other VC members, if FPC3 (Flexible PIC Concentrator) of VC is rebooted, unknown unicast traffic will be received on the AE interface.
1679094	DHCP binding will fail for the clients (Clients connected on an AE interface with 2 or more VLANs) on a VLAN where DHCP security is not configured Product-Group=junos	On Junos EX2300, EX3400, and EX4300-MP, DHCP (Dynamic Host Configuration Protocol) binding will fail for clients on a VLAN where DHCP security is not configured. This is seen when an Aggregated Ethernet (AE) interface has two or more VLANs, and DHCP security is configured on only one interface DHCP security is not configured on the other VLAN.
1685938	MAC address learning might not happen on specific EX/QFX platforms Product-Group=junos	On specific EX/QFX platforms (EX2300/EX3400/EX4300-MP/EX4100/EX4400/QFX5K), MAC learning is not happening in any of the interfaces of the particular VLAN (contains both LAG (Link Aggregation Group) and non-LAG interfaces) when VSTP (VLAN Spanning Tree Protocol) is enabled on LAG interface with no child interface and VSTP is disabled for non-LAG interfaces. It causes a traffic impact as mac address learning does not happen for all interfaces on the VLAN.
PR Number	Synopsis	Category: EX2300/3400 platform
1667564	High numbers of PDs connected may result in high CPU utilization Product-Group=junos	On EX2300 and EX3400 platforms, high CPU utilization may be observed when more PoE devices (more than 25 PDs) are connected to the switch.
PR Number	Synopsis	Category: NFX Series Platform Software
1674872	VNF's Getting DHCP Address from virbr0 with Default Route Product-Group=junosvae	VNF with DHCP configured on virbr0 is getting a default route and it should not
PR Number	Synopsis	Category: QFX Multichassis Link Aggregrate
1579016	VRRP flaps between MC-LAG peers Product-Group=junos	On all Junos platforms, On deletion/addition of MC-AE (Multi Chassis Aggregated Ethernet ) IFD (Interface Device), VRRP (Virtual Router Redundancy Protocol) flaps between the MC-LAG peers.
PR Number	Synopsis	Category: SPC3 HW and SW Issues
1641793	Traffic might be dropped due to the RX queue being full Product-Group=junos	Incoming packets might be sent to RX queues of core0 or core14 mistakenly, might result in the queue buffer full and the packets getting dropped.
PR Number	Synopsis	Category: ACX MPLS
1665178	ACX5048 after upgrade to 20.4R3-S3 VPLS multihoming is not working Product-Group=junos	In VPLS MH cases, the standby UNI ifl in backup router will be programmed in disable state, by adding the UNI interface to invalid vpn id in HW. During switch over the UNI ifl will be deleted and will be added under the VPLS instance VPN id. In issue case, UNI interface added under invalid VPN id in backup router is tried to deleted by passing the VPLS instance vpn id, causing the issue. This issue is applicable only for ACX5k series.
PR Number	Synopsis	Category: "agentd" software daemon
1657886	The 'agentd' and 'eventd' process might cause high CPU utilization and may also affect Telemetry services Product-Group=junos	On all Junos and Junos Evolved platforms, high CPU utilization is observed with the 'agentd' and 'eventd' processes. This is caused by 'rpd' issues.
PR Number	Synopsis	Category: a20a40 specific issue
1642138	Missing boot parameters on Junos SRX5K platforms will result in fabric plane CRC link errors Product-Group=junos	Fabric plane CRC link errors are detected on Junos SRX5K platforms which can cause an HA switchover and in worst case scenario, throughput issues for user traffic. The hardware error message "Minor CB (Control Board) Fabric Chip Not Online" is displayed and is caused by fabric plane CRC error like "FPC plane CRC link error". The issue happens in HA (High Availability) scenario with SCB4 (Switch Control Board) and IOC3 (Input Output, I/O) cards in use.
PR Number	Synopsis	Category: BBE Autoconfigured DVLAN related issues
1680453	The process bbe-smgd on the router would stop processing new PPPoE subscribers session Product-Group=junos	On all Junos platforms configured with subscriber-management, the process bbe-smgd will stop processing new PPPoE (Point-to-Point Protocol over Ethernet) connections due to a memory leak in the control packet pool of the PPPoE plugin.
PR Number	Synopsis	Category: BBE Statistics daemon & libraries
1676049	Minor memory leak in 'bbe-statsd' daemon may be seen when subscriber-management is enabled on MX platforms Product-Group=junos	On MX platforms, a minor memory leak may be seen over time for transient subscriber sessions which last for around 30 seconds or less. The issue is reproducible consistently and may result in 'bbe-statsd' daemon crash over time.
PR Number	Synopsis	Category: Border Gateway Protocol
1635339	BGP multipath computation for the prefix may cause the rpd to crash Product-Group=junos	On all Junos and Junos Evolved platforms, rpd (routing processor daemon) crash can be seen when there is a computation of the BGP (Border Gateway Protocol) multipath prefix. This is a rare timing issue which is observed only when BGP multipath is configured with list-nexthop and there is a peer cleanup and re-establishment. There might be a service impact because of the rpd crash, however, the system recovers to functional state by itself.
1669716	The rpd crash is observed while making configurational changes Product-Group=junos	On all Junos and Junos Evolved platforms, which supports protocol BGP (Border Gateway Protocol), RPD (Routing Protocol daemon) crash is seen when a eBGP peering interface is moved to a "no-forwarding" instance and resetting the BGP peer.
PR Number	Synopsis	Category: BBE Remote Access Server
1669284	Errors are seen when the accounting server source address is IPv6 Product-Group=junos	On all Junos platforms having a profile assigned to the RI (Routing Instance) and using a source IPv6 (Internet Protocol version6) address for the radius server, errors might be observed and the accounting services might not work in an expected manner.
PR Number	Synopsis	Category: Express Broadway PFE L3
1680757	BFD sessions will remain down in the EVPN-VxLAN scenario Product-Group=junos	On QFX 10008 and QFX10016 platforms, in a distributed mode Bidirectional Forwarding Detection(BFD) session might remain down if the anchor FPC and the FPC where BFD packets are received over Virtual Tunnel Endpoint (VTEP) are different.
PR Number	Synopsis	Category: MX Platform SW - FRU Management
1664274	MX80 TFEB/FPC is not starting after the upgrade Product-Group=junos	On Junos MX80 series platforms, TFEB/FPC (Trio Forwarding Engine Board/Flexible PIC Concentrators) got stuck while performing a software upgrade. This can impact the FPC functionality. The issue is seen due to high port utilisation. 'Commit full' can be used to recover the FPC/TFEB.
PR Number	Synopsis	Category: Class of Service
1675781	QoS may not work as expected on AE interfaces with explicit-null label Product-Group=junos	On all Junos platforms having explicit-null label along with other labels, the QoS (Quality of Service) may not work in an expected manner for AE(Aggregated Ethernet) interfaces. This is because AE interfaces do not consider the explicit-null label which carries the exp bits and thus the exp bits carried are not considered for classification by PHP (Penultimate Hop Popping) router.
PR Number	Synopsis	Category: Device Configuration Daemon
1658016	when moving few child members from one AE bundle to another AE bundle observed error log "UI_CONFIGURATION_ERROR: Process: dcd, path: , statement: , ae12, Micro BFD local address should be configured on ae12 or lo0" Product-Group=junos	Due to the issue, an error log is printed, and DCD is restarted. But there is no functionality impact for BFD sessions. There may be a slight delay in the new config taking effect as DCD is restarted.
PR Number	Synopsis	Category: Firewall Filter
1670622	Traffic loss may be observed when changing firewall configuration Product-Group=junos	On MX platforms supporting MPC7/8/9 line cards, traffic loss may be observed if the firewall configuration changes are made when PFE 0 (Packet Forwarding Engine) is in a disabled state. It is a rare occurrence.
PR Number	Synopsis	Category: ACX IRB specific issues
1683770	On the ACX710 router, the IEEE 802.1p priority and DEI values in the locally generated VLAN-based IP packets might be changed when sourced from the IRB interface. Product-Group=junos	On ACX710, when locally generated VLAN-based IP packets (e.g. ping packet) are sourced from IRB interface, the Priority and DEI bits may be changed in PFE.
PR Number	Synopsis	Category: ACX VRRP
1666853	Traffic loss is observed when the VRRP is configured over the AE interface Product-Group=junos	On ACX5448 platforms, the Virtual Router Redundancy Protocol (VRRP) is up from Routing Engine (RE) but the group is not created under the Packet Forwarding Engine (PFE) due to this VRRP virtual IP (VIP) is neither responding to ping nor accept any traffic when the VRRP is configured over Aggregated Ethernet (AE) interface. This results in traffic loss.
PR Number	Synopsis	Category: ACX VxLAN Issue
1665828	MAC-IP bindings for IPv4 (ARP) and IPv6 (ND) may not be processed for IRB interfaces in an EVPN scenario Product-Group=junos	On all Junos and Junos Evolved platforms, when EVPN (Ethernet Virtual Private Network) related configuration is introduced from baseline, due to a rare timing issue between the IRB (Integrated Routing and Bridging) interfaces coming up and an attempt is made by the 'l2ald' (l2 address learning) daemon to process the corresponding MAC-IP entries, this issue may occur. This may also occur when IRB logical units are activated and deactivated.
PR Number	Synopsis	Category: Covers Application classification workflows apart from custo
1638588	AppID installation failure on the secondary HA node in case of failover Product-Group=junos	On SRX platforms, installation of Application Identification service failed on the secondary HA node in case of failover due to checksum validation.
PR Number	Synopsis	Category: Manageability for Node Virtualization
1583324	JDM server creation might fail on junos node slicing setup in in-chassis mode Product-Group=junos	On MX platforms the JDM (Juniper Device Manager) server could not be created in in-chassis mode of junos node slicing, which results in mgd process crash and affects GNF's (Guest Network Function) provisioning.
PR Number	Synopsis	Category: EVPN control plane issues
1680421	EVPN MPLS traffic drop can be observed in a multi-vendor PE CE setup with single-active LAG Product-Group=junos	On all Junos platforms running EVPN (Ethernet Virtual Private Network) MPLS (Multi-Protocol Labeled Switching) and a single active LAG (Link Aggregation), the traffic can get forwarded to the NDF (Non-Designed Forwarder) router which can lead to a traffic drop. This issue is seen in multi-vendor PE (Provider Edge) CE (Customer Edge) setup when there is a DF switchover i.e DF (Designated Forwarder) role changes and the backup router starts advertising the EVPN type 2 route, now there is another switchover and the old DF again becomes the DF and advertises EVPN type 1 route but the NDF does not withdraw its route consequently the traffic gets forwarded to the NDF.
PR Number	Synopsis	Category: EVPN Layer-2 Forwarding
1649234	The kernel crash would be observed in an EVPN multi-homed scenario Product-Group=junos	On QFX10002/QFX10008/QFX10016 (only QFX10K) platforms, when Assisted Replication (AR) feature as Replicator role is used in an Ethernet VPN (EVPN) multi-homed scenario, there would be out-of-bound memory access issue observed which could result in the kernel crash leading to the service impact.
PR Number	Synopsis	Category: EX4400 platform
1662288	LEDs on ports 0-35 are always lit on EX4400-48MP platforms Product-Group=junos	On EX4400-48MP platforms running Junos, Link LEDs on ports 0-35 are always lit, even if there are no cables connected.
PR Number	Synopsis	Category: Express PFE including evpn, vxlan
1646489	Vxlan Tunnel termination fails due to a change in config Product-Group=junos	Packet drop can be seen when a new VNI (Virtual Network Index)config is applied over the existing VNI config.
1674116	The BFD packets will drop in an EVPN-VxLAN scenario due to incorrect layer3 offset being set in the host path Product-Group=junos	On all QFX10000-60C platforms with Ethernet VPN-Virtual Extensible LAN (EVPN-VxLAN) scenario, the Bidirectional Forwarding Detection (BFD) packets are getting classified as packets of different protocols like Virtual Router Redundancy Protocol (VRRP), depending on the value at an incorrect offset which leads to BFD packet drop.
PR Number	Synopsis	Category: Express PFE L2 fwding Features
1659732	On QFX10K Junos platforms configuration of IGMP group range might result in traffic loss Product-Group=junos	On QFX10K Junos platforms, the configuration of the IGMP group range might result in a specific multicast route getting programmed and this might cause traffic loss.
PR Number	Synopsis	Category: Express ASIC interface
1669267	PCS errored blocks count increments on PTX3000/PTX5000 after Junos software upgrade Product-Group=junos	On PTX platforms, packets drop is seen because of increment in PCS and framing errors on some of the 100GE ports on PIC or its peer devices after firmware migration.
PR Number	Synopsis	Category: SRX4100/SRX4200 platform software
1650112	Packet loss might be seen on SRX4100 and SRX4200 devices from 20.2R2 Product-Group=junosvae	Packet loss might be seen on SRX4100 and SRX4200 devices from 20.2R2
PR Number	Synopsis	Category: MX Inline Jflow
1652901	After enabling inline-jflow(sampling), PPE traps/logs or traffic drop may be seen Product-Group=junos	On all MPC type linecards(applicable to MX, EX and SRX series), When we enable inline sampling on a device already scaled on PFE nexthop memory, we might see PPE xtxn error trap
PR Number	Synopsis	Category: ISIS routing protocol
1682778	The rpd process will crash and generate core post graceful restart Product-Group=junos	The rpd process crash is seen when a graceful rpd restart is initiated and ISIS auto-bandwidth is not configured in the system.
PR Number	Synopsis	Category: jdhcpd daemon
1676573	The DHCP unicast acknowledge packet might be dropped Product-Group=junos	On all Junos platforms configured with forward-only and server-id override under DHCP Relay, the DHCP unicast acknowledge packet from the server will be dropped for the DHCP Request from the client for renewing lease or reconnection.
PR Number	Synopsis	Category: JFlow bug tracker for SRX platforms
1688627	The system may crash when Jflow inactive timeout is configured to be less than 'previous flow-inactive-timeout + 180' seconds Product-Group=junos	On SRX platforms, when Jflow inactive timeout is configured to be less than 'previous flow-inactive-timeout + 180' seconds result in a system crash and core files are generated.
PR Number	Synopsis	Category: jl2tpd daemon
1667861	L2TP session might not come up when L2TP access-line-information is not configured Product-Group=junos	When MX platform running JUNOS enhanced subscriber management feature as LNS (L2TP network server) receives DSL/PON attributes from LAC (L2TP access concentrator) and "services L2TP access-line-information" switch is not configured, the l2TP session might be disconnected.
1667950	VMcore or RE crash might be triggered due to the memory corruption when the FPC is restarted for LNS subscribers Product-Group=junos	On all MX platforms, when Flexible PIC Concentrators (FPCs) restart for L2TP network server (LNS) subscribers stacked over aggregated service interface (asi) and LNS subscribers belong to more than one routing instance causes the VMcore or Routing Engine (RE) crash and brings down all the traffic.
PR Number	Synopsis	Category: Adresses ALG issues found in JSF
1677554	SIP 200 OK(INVITE) response packets are dropped leading to SIP Call failure Product-Group=junos	On SRX and MX platforms with SIP (Session Initiation Protocol) ALG (Application Layer Gateway) configured, SIP call failure is observed due to SIP 200 OK(INVITE) response packets being dropped.
1686613	SIP calls are getting dropped due to NAT failure and SIP ALG is enabled Product-Group=junos	On all MX and SRX platforms which support the SIP ALG (Session Initiation Protocol Application Layer Gateway) feature, SIP calls are getting dropped due to NAT (Network Address Translation) failure and failure to allocate XLATE context. The issue happens when there are multiple SIP INVITEs with different media IPs that arrive on the same SIP call. The drop is seen from the 4th SIP INVITE packet onwards.
PR Number	Synopsis	Category: Flow Module
1688658	The flow sessions traversing the IOC2 card would time out early when Express Path is enabled Product-Group=junos	On SRX5K series devices with IOC2 line-cards installed, when running JUNOS 21.2R1 or later where Express Path is enabled by default, sessions traversing the IOC2 card would time out early, leading to a traffic loss and unpredictable flow behavior.
PR Number	Synopsis	Category: SRX Firewall Authentication
1672378	The Forwarding plane crashes during HA failover Product-Group=junos	On SRX platforms with firewall authentication feature enabled, the forwarding plane could crash during HA (High Availability) failover.
PR Number	Synopsis	Category: l2 flow module
1599891	OSPF neighbor won't establish under Transparent mode when neighborship across different zone Product-Group=junos	Some of the OSPF neighborship might not able to establish after system bootup when the neigborship connect to SRX via different zone under transparent mode
PR Number	Synopsis	Category: all logging related bugs on srx platforms
1687244	unexpected default event-rate value for event mode logging Product-Group=junos	On SRX platform, when event mode logging is used without event-rate option, the logging rate was unexpectedly set to 100 although the default event rate is 1500
PR Number	Synopsis	Category: IPSEC/IKE VPN
1626830	The process kmd might crash if the ike gateway is configured with two ip-address Product-Group=junos	The process kmd might crash if the ike gateway is configured with two ip-address and the IPSec vpn tunnel is failed over to another ike gateway address.
1665332	IPSec tunnels may flap on SRX platforms Product-Group=junos	On all SRX platforms running the Junos-ike (Internet Key Exchange) package, when the flow trace options are committed, the ikemd process may restart and IPSec tunnels may flap.
1673391	High Control Plane CPU utilisation while the kmd process is stuck after the core file Product-Group=junos	On all SRX platforms, during key management (kmd) core file, with VPN/Internet Key Exchange (IKE) implemented and a high number of file descriptors open, the kmd process will reach above 80% CPU utilisation and stay for a long period of time if the kmd process is stuck after the core file is generated.
PR Number	Synopsis	Category: Label Distribution Protocol
1671187	LDP Traffic will be blackholed when the L-ISIS/L-OSPF route changes due to interface level configuration Product-Group=junos	On all Junos and Junos Evolved platforms running Segment Routing (SR), with "set protocols ldp sr-mapping-client" configured, and when interface level configuration changes are done leading to Labeled-ISIS /Labeled-OSPF route change, Labeled Distribution Protocol (LDP) traffic will be blackholed.
1680574	In an LDP -> BGP LU stitching scenario, Multiple LSPs will not be installed in the forwarding table, even if BGP Multipath and ECMP are enabled Product-Group=junos	On all Junos and Junos OS Evolved Platforms, when BGP LU (Labeled Unicast) routes are exported to LDP (Label Distribution Protocol) to perform LDP->BGP-LU stitching, LDP installs only one NH(Next Hop) in the forwarding table instead of multiple NHs, even when BGP Multipath and ECMP are enabled. This issue will be seen for both EBGP (External Border Gateway Protocol) and IBGP (Internal Border Gateway Protocol) multipaths on PTX platforms and for only iBGP multipaths on all other platforms.
PR Number	Synopsis	Category: lldp sw on MX platform
1669677	LLDP neighborship might fail if the chassis-id format of the LLDP packet is xx:xx:xx:XX:XX:xx' Product-Group=junos	On all Junos platforms, Link Layer Discovery Protocol (LLDP) neighborship fails if the chassis-id format of the LLDP packet is xx:xx:xx:XX:XX:xx'
PR Number	Synopsis	Category: MPC11 ULC fabric software related issues.
1658164	Fabric Destination error/Fabric plane in check state Product-Group=junos	Fabric Plane check/error alarm can be seen due to overrun interrupt being set in MS-MPC line cards. Latency difference between the SFB2/SFB3 and the MS-MPC cards potentially causes overruns to increase during the traffic burst.
PR Number	Synopsis	Category: Multiprotocol Label Switching
1672804	The rpd crash might be observed with Container LSPs Product-Group=junos	On all Junos/EVO platforms, the rpd process might get crash if the Container LSP (Label Switch Path) is associated with an external-controller.
1673348	CPU utilization of rpd process may reach 100% while reporting LSP states to pccd if the IS-IS update churn is high Product-Group=junos	On all Junos and Junos Evolved platforms where PCEP (Path Computation Element Protocol) is provisioned, after IS-IS (Intermediate System-Intermediate System) PDU (Protocol Data Unit) flooding, rpd (routing protocol daemon) re-computes LSPs (Label Switched Path) and sends those to the pccd (path computation client daemon) which in turn reports those to PCE (Path Computation Element) for processing. If the update churn is high, this may cause the rpd to reach or get stuck at 100% CPU utilization.
1690458	On a controller based MPLS setup with container LSPs, rpd daemon crashes after LSP deletion occurs Product-Group=junos	On all Junos-based platforms, in a scenario where an external controller is provisioned, rpd crashes when an externally controlled container LSP (Label Switched Path) is deleted and the software tries to update its status.
PR Number	Synopsis	Category: For multicast snooping on MX
1636261	Message 'Initialize libjtask-license first! for mcsnoopd' is seen after committing configuration Product-Group=junos	On all Junos platforms, a harmless message is observed on the terminal output after committing the multicast snooping configuration.
1672488	MCSNOOPD will be restarted and will again learn the states after core Product-Group=junos	On all JUNOS and EVO platforms, with IGMP/MLD with EVPN configured.
PR Number	Synopsis	Category: MX10K platform
1655089	The 1G port always stays down while changing of 10G interface lane speed to 1G Product-Group=junos	Due to an incorrect hardware setting, the 1G port stays down while changing of 10G interface lane speed to 1G and vice versa on LC2101.
PR Number	Synopsis	Category: Microkernel for neo mpc
1664602	Line card may crash after offline/online plane Product-Group=junos	On platforms supporting MQ and XM-based line cards, destination error, self-ping error and line cards can be offline after swapping the XM-based uplink cards and toggling the fabric planes. The issue will be seen on other MQ-based line cards in the chassis.
PR Number	Synopsis	Category: Category for tracking Olympus-MX issues
1671649	Traffic loss seen due to SPC3's packets getting stuck Product-Group=junosvae	On Junos MX960, MX480 platforms, Flowd restart or PIC offline/online( Physical Interface Cards) causes SPC3's sending of packets to get stuck.
PR Number	Synopsis	Category: Kernel Composite Next Hop (composite / l3vpn) Infrastructure
1608991	Public nexthops cleanup fails for "mpls" family nexthops on MX platforms Product-Group=junos	On MX platforms, when GRES is performed multiple times, public nexthops cleanup failed for "mpls" family nexthops and system might not be GRES ready (init_err connection_errsoft_mask_err).
PR Number	Synopsis	Category: Kernel MPLS / Tag / P2MP Infrastructure
1681892	The RE crashes when MPLS next-hop is created and deleted frequently Product-Group=junos	On all Junos platforms, when the system is up for a very long time, tag stats counters increase and cross the 32-bit capacity when MPLS next-hop is created/deleted frequently, resulting in RE (routing engine) crash.
PR Number	Synopsis	Category: PFE Peer Infra
1667674	The FPC might fail to initialize on Junos platforms Product-Group=junos	On all Junos platforms, in a very corner case, the FPC (Flexible PIC Concentrators) might fail to initialize and remains in a stuck state when an FPC is installed or rebooted.
PR Number	Synopsis	Category: Kernel Tunnel Interface Infrastructure
1676912	IS-IS packet drop observed for packets having GRE over FTI-VXLAN header Product-Group=junos	All Junos platforms face the issue of IS-IS (Intermediate System-to-Intermediate System) packet drop where the packet headers are GRE (Generic routing encapsulation) over FTI-VXLAN (Flexible Tunnel Interface-Virtual Extensible LAN). Such packets are dropped at sender side kernel in the egress direction due to incorrect handling.
PR Number	Synopsis	Category: OSPF routing protocol
1671672	The backup next hop computation might not be as expected for some random prefixes when there is a topology change Product-Group=junos	On all Junos and Junos OS Evolved platforms, when there is a topology change, unexpected flags might be generated which prevents the backup path from being computed accurately. This will lead to functional impact.
PR Number	Synopsis	Category: Used for tracking OVSDB software issues and features
1687847	OVSDB certificate files are not copied from the Master to the Backup Product-Group=junos	On all Junos devices which support OVSDB (Open vSwitch Database) functionality, when a new backup is added on VC (virtual chassis), the master does not copy the certificate files to the backup. This impacts the OVSDB functionality and affects the traffic.
PR Number	Synopsis	Category: vMX Platform Infrastructure related issue tracking
1662524	In the EVPN-VXLAN scenario, the DHCP packets will get dropped when the DHCP relay agent is configured Product-Group=junos	On EX92XX series and MX platforms with the EVPN-VXLAN (Ethernet VPN-Virtual Extensible LAN) scenario, the DHCP (Dynamic Host Configuration Protocol) packets from the client get dropped while tunneling to the EVPN-VXLAN. When this happens, the packets will not reach the DHCP server and the host could not get the IP address.
PR Number	Synopsis	Category: PPPoE functional plugin for bbe-smgd
1685070	Multiple bbe-smgd cores might be observed resulting in subscribers being lost or failing to login in the Enhanced subscriber scenario Product-Group=junos	On MX platforms, multiple bbe-smgd cores might be observed due to out-of-bound memory access in the Enhanced subscriber scenario when bringing up PPPoE (Point-to-Point Protocol over Ethernet) subscribers and ACI (agent circuit identifier)/ARI (agent remote identifier) are part of the payload.
PR Number	Synopsis	Category: QFX PFE Class of Services
1667879	Shaping-rate is not taking 20bytes of overhead into account. Product-Group=junos	During shaping-rate, 20 byte of Layer 1 overhead was not taken into account.
PR Number	Synopsis	Category: for all ipv6 related issues
1662707	IPv6 ND packets might be dropped in QFX5100 and QFX5110 platforms Product-Group=junos	On QFX5100 and QFX5110 platforms, with L2circuit configured, after performing an upgrade, the IPv6 ND (Neighbor Discovery) packets might be dropped.
PR Number	Synopsis	Category: QFX L2 PFE
1667069	PVLAN IGMP packet is forwarded between Isolated ports and also duplicated to primary vlan port (Promiscous). Product-Group=junos	When Isolated port receives IGMP packet, it should not be forwarded to other Isolated ports but was forwarded and also duplicated to primary vlan port (Promiscous).
1676772	VLAN translation mapping gets deleted when one of the member interface removed from LAG Product-Group=junos	On all QFX5k, EX4650 and EX4600 platforms, if port has VLAN translation configuration and LAG interfaces connected on same FPC then incoming traffic can drop if one member of LAG interface is deleted/removed.
1681614	LLDP neighborship fails to come up with a Private VLAN configuration Product-Group=junos	On the Junos platforms, In a Virtual Chassis (VC) scenario if the interface is configured with Private VLAN (PVLAN) and connected through the Flexible PIC Concentrator (FPC) of the non-master switch, the LLDP (Link Layer Discovery Protocol) neighborship fails to come up and traffic through the interface will be impacted.
1683771	Traffic loss is seen when MAC flaps between the MC-AE interface and the ICL interface. Product-Group=junos	On QFX5K/EX46XX platforms, post zeroizing, traffic loss is seen when the optics of the child interface of an Inter Chassis Link (ICL) Aggregated Ethernet(AE) interface is unplugged or Multi Chassis-Aggregated Ethernet(MC-AE) ICL configuration is deleted(Using delete chassis aggregated-devices ethernet device-count).
PR Number	Synopsis	Category: QFX L3 data-plane/forwarding
1667751	Multihop BFD sessions might remain down in inline mode Product-Group=junos	On all QFX10002 platforms, multihop Bidirectional Forwarding Detection (BFD) over routing instance with inline mode configuration keeps the BFD sessions down.
PR Number	Synopsis	Category: QFX VCCP
1646561	VCP neighborship might not be formed on the LX4 40G VCP port Product-Group=junos	On all QFX5100 Virtual Chassis platforms, after the reboot, Virtual Chassis port (VCP) ports may not establish a VCP connection and Cyclic Redundancy Check (CRC) errors are also observed.
PR Number	Synopsis	Category: QFX10008/16 QFX10002 linecard, serdes and uboot
1688993	On QFX10008/QFX10016 platforms fails to detect flaps even though the remote device connected has observed flaps Product-Group=junos	On QFX10008/QFX10016 platforms, interface faults(Local/Remote) of very short duration (<30msec) can go undetected. The interface does not go down due to these faults leading to unidirectional link and traffic blackholing.
PR Number	Synopsis	Category: QFX10008/16 QFX10002 optics related issues.
1677325	Interfaces with QFX-10000-30C and QFX10000-30C-M Line Cards will not work properly Product-Group=junos	On QFX10K platforms, interfaces with QFX-10000-30C and QFX10000-30C-M Line Cards will not work properly with FEC (Forward Error Configuration) and links connected to them will remain down.
PR Number	Synopsis	Category: QFX5100 Interface related issues
1669436	On specific QFX5k platforms, member links may reduce their configured speed when the other side doesn't have auto-negotiation disabled Product-Group=junos	On QFX5110, QFX5120, QFX5200-32C and QFX5100 Junos platforms, the member link reduces its speed if there is an optics/cable issue, which effectively reduces the overall AE (Aggregate Ethernet) link speed. This is an undesired behavior since the matching speed is one of the mandatory criteria for a member link to join an AE.
PR Number	Synopsis	Category: QFX5200/5110/5120/5210 Platform optics related issues
1660532	The port LEDs do not light up when 40G physical interfaces are up. Product-Group=junosvae	The port LEDs do not light up when 40G physical interfaces are up. This is a display issue. There is no service impact when this issue occurs.
PR Number	Synopsis	Category: QFX5200/5110/5120/5210 Platfom issues
1677376	The ge interface of QFX5110-48s-4c stay down post connected ACX device reboot Product-Group=junos	On Junos QFX5110-48s-4c platform, when ge port of QFX5110-48s-4c is connected to em0 of ACX, it is observed that the ge interface of QFX5110-48-4c stay down post ACX device reboot. Due to this, all the traffic running on particular interface will be impacted.
PR Number	Synopsis	Category: RPD Interfaces related issues
1659102	The rpd memory leak might be seen while processing vlan-ccc configuration Product-Group=junos	On all Junos and Junos Evolved platforms, when deleting/adding the whole interface unit of family vlan-ccc, the rpd will observe a memory leak.
PR Number	Synopsis	Category: RPD Next-hop issues including indirect, CNH, and MCNH
1659255	The multipath route might be missing when multipath is configured Product-Group=junos	On all Junos and Evolved platforms, when multipath is configured multipath computation is missed for the routes resulting in missing multipath routes.
PR Number	Synopsis	Category: RPD policy options
1670998	The rpd process crashes whenever it is getting shut down with router reboot, rpd restart, RE switchover, software upgrade Product-Group=junos	The routing process daemon crashes whenever the rpd process is getting shutting down with router reboot, rpd restart, RE switchover, and software upgrade with Border Gateway Protocol configured on the device.
PR Number	Synopsis	Category: Resource Reservation Protocol
1661954	A LSP might get stuck in the CSPF path computation stage Product-Group=junos	A label-switched path (LSP) might get stuck in the Constrained Shortest Path First (CSPF) computation and might not finish the session setup. The LSP retry continues to fail when no error feedback is received from downstream routers.
PR Number	Synopsis	Category: IPSEC functionality on M/MX/T ser
1674585	The 'kmd' process may crash due to SA re-negotiation failure during IKE phase-1 Product-Group=junos	On platforms running Junos 16.2 onwards releases, if for some reason IKE (Internet Key Exchange) phase-1 SA (Security Association) re-keying fails, 'kmd' process may crash and the IPSec (Internet Protocol Security) tunnels may also get torn down. Most of the time, the reason is that the initiator changes its offerings after the initial successful key exchange.
PR Number	Synopsis	Category: SRX Argon module
1629972	SMS Channel Down alarm on primary node of HA pair after upgrade Product-Group=junos	After upgrading an SRX HA pair, a chassis alarm for "SMS Channel Down" is triggered and remains present though no cloud connectivity issues detected.
1666420	SRX alarming "SMS control channel down" without SMS feature configured Product-Group=junos	At times an AAMW connection issue can trigger an SMS Control channel down alarm even when the SMS feature is not configured on the device. It is safe to ignore the SMS alarm if the feature is not in use.
PR Number	Synopsis	Category: Remote Access VPN issues on SRX
1674522	VPN tunnel will not be established in exclusive client scenario Product-Group=junos	On SRX platforms, if NCP(Network Control Protocol) pathfinder client is enabled with tcp-encap mode, VPN(Virtual Private Network) tunnel will not be established.
PR Number	Synopsis	Category: SRX branch platforms
1594014	During reboot, "warning: requires 'idp-sig' license" can be seen on the screen even when the device has valid license Product-Group=junos	If a device is rebooted manually or reboots for any other reason, The following messages can be seen on the boot up screen even when the device has valid license and proper configuration to use the features like IDP/UTM
1675853	Netbios traffic (IRB broadcast) is getting dropped post upgrade on the SRX platform Product-Group=junos	On SRX platforms, NetBIOS (Network Basic Input/Output System) broadcast packets originating from the client do not reach the SRX routing engine, which is required in case "set forwarding-options helpers port 137" is configured to forward NetBIOS to a server.
PR Number	Synopsis	Category: MPC7/8/9 Interface Issues
1651526	PCS Errored blocks count will increment after Junos software upgrade to 20.2R1 or above releases Product-Group=junos	After a Junos upgrade to 20.2R1 or above releases with 100G-LR4 optics, Physical Coding Sublayer (PCS) Errored blocks and framing errors on 100G-LR4 interfaces are seen, which impacts traffic.
1660154	Some of ports on MX platforms with MPC7E-10G do not come up with 1G speed Product-Group=junos	On MX platforms with MPC7E-10G, random interfaces with 1G speed fail to come up after PIC or FPC restart.
PR Number	Synopsis	Category: Stout PF fabric (SFB2)
1674309	During the smooth upgrade from SFB1 to SFB2, SFB2 gets detected as "Unknown Fabric Board" Product-Group=junos	On MX2010 and MX2020 platforms, SFB2 gets detected as "Unknown Fabric Board" during the smooth upgrade from SFB1 to SFB2 causing fabric issues.
PR Number	Synopsis	Category: MX10003/MX204 MPC defects tracking
1659087	Speed change from 10G to 1G on MX causes all other lanes to flap Product-Group=junos	LC2101 on MX10k8 and LC2103 on MX10003 do not support mixed optical and copper mode on line side of PHY, due to which when 1G mode is configured, 10G lanes go down.
PR Number	Synopsis	Category: SRX-1RU platfom related protocol, QoS, filtering features et
1689705	SNMP MIB walk for jnxBoxDescr OID returns incorrect value Product-Group=junosvae	On SRX4600 platforms running Junos, SNMP MIB walk for jnxBoxDescr OID returns the incorrect chassis name and model. This is only a display issue with no service impact.
PR Number	Synopsis	Category: MX10003/MX204 Timing/Sync-E issues tracking
1663065	The offset value might be high on the downstream node while switching between line cards which impacts 5G services Product-Group=junosvae	On Junos MX10003 platform, the offset value might be high on a downstream node which impacts 5G services. While switching the SyncE(Synchronous Ethernet) and slave PTP (Precision Time Protocol) interface between line cards, SyncE will be in a holdover state for a long time and the clock will not get locked. SyncE clock status can be monitored using the following command "show chassis synchronization extensive"
PR Number	Synopsis	Category: ZT/YT pfe firewall software
1567313	The sub line cards (SLC) might reboot after loading the configured inline services and services along with dfwd filters Product-Group=junos	In an external server-based Junos Node Slicing scenario, the logical partitions (called sub line cards or SLCs) can be additionally configured for MX2K-MPC11E and assigned to different guest network functions (GNFs). If the inline services and services are applied to SLCs, some issues might happen during processing these services along with firewall process (dfwd) filter actions. Then it might cause SLCs to reboot and aftd crash.
1608723	MPC10/11 - filter matching unknown-unicast does not take effect Product-Group=junos	On MX platforms with MPC10/11 line cards, if firewall filters contain match rules of unknown-unicast, the filter does not work. The filter will be applied in the configuration but no action is taken, e.g., policing action will not take effect.
PR Number	Synopsis	Category: ZT/YTpfe bridging, learning, stp, oam, irb software
1669609	The error will be observed if eTree is used with EVPN-MPLS and the routing-instance is changed Product-Group=junos	On all MX platforms, when eTree is used with EVPN (Ethernet VPN) over MPLS (Multiprotocol Label Switching) and the routing-instance is changed, the syslog errors will be reported. This happens when the leaf label is not properly updated in the table. There is no service impact other than error message.
PR Number	Synopsis	Category: Trio pfe bridging, learning, stp, oam, irb software
1631217	The core interface goes down Product-Group=junos	Using static LSP(labeled switched path) configuration, the child node is not removed from the flood composite when the core interface goes down.
1677631	DHCP bindings will fail for the client connected on an LT interface when DHCP snooping is enabled Product-Group=junos	On all Junos and Junos Evolved platforms, Dynamic Host Configuration Protocol (DHCP) bindings will fail for the clients connected on an LT(Logical Tunnel) interface when DHCP snooping is enabled. This issue is not seen when DHCP snooping is disabled or when clients and server are on other interfaces.
PR Number	Synopsis	Category: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1662172	The CPU utilization might increase when a user login and logout to the device continuously Product-Group=junos	When multiple users log in and log out using SSH public-private key authentication to the device every few seconds, then the CPU utilization might increase on all Junos and Junos OS Evolved platforms.
PR Number	Synopsis	Category: Configuration mgmt, ffp, load-action, commit processing
1659783	The configuration might roll back after performing "commit confirmed" and then reboot Product-Group=junos	On all Junos OS and Junos OS Evolved platforms, the configuration might roll back after performing "commit confirmed" and then a reboot.
PR Number	Synopsis	Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1637552	During the ephemeral configuration database changes, "mgd" core files might be generated Product-Group=junos	On all Junos platforms, "mgd" core files might be generated when the ephemeral configuration database changes.
1673176	"gethostbyname: Host name lookup failure" is displayed during commit Product-Group=junos	On all SRX Series devices with J-Web enabled, "gethostbyname: Host name lookup failure" is displayed during commit. This issue is a display issue and doesn't have any service impact.
PR Number	Synopsis	Category: Issues related to all UI tools (mgd-bsd/cli-bsd, XML and DMI
1681656	System uptime display is shown in minutes instead of seconds Product-Group=junos	On all Junos and Junos Evolved platforms, after the device reboot, show system uptime command is showing time in minutes instead of seconds for 24 hours.
PR Number	Synopsis	Category: PTX/QFX10002/8/16 specific software components
1599183	False fan failure alarm flaps (set and cleared) frequently Product-Group=junosvae	Fan Trays (FT) on PTX10008/10016 EVO system has implemented dampening with the zero speed failures. The same will be implemented in Junos.
PR Number	Synopsis	Category: For GPRS security features on highend SRX series
1673879	GTP control packets might be incorrectly dropped/passed if there is more than one APN IMSI filter configured Product-Group=junos	On SRX platforms, during General Packet Radio Services (GPRS) Tunneling Protocol (GTP) inspection if there is more than one APN IMSI (Access Point Name or International Mobile Subscriber Identification) filter configured in the GTP profile, the filter may incorrectly drop/pass CrPdpRequest and CrSessRequest GTP Control packets.
PR Number	Synopsis	Category: Virtual Private Networks - rpd
1661542	Traffic drop may be seen when Inter-AS option-B label spoofing is configured along with vrf-table-label Product-Group=junos	On all Junos and Junos OS Evolved platforms, when the router is configured as both Autonomous System Border Router and Provider Edge (ASBR and PE), and virtual-router/mpls-forwarding as "forwarding-context" is in use along with "vrf-tabel-label" for the Local Layer 3 Virtual Private Network - Virtual Routing and Forwarding (L3VPN VRF) traffic drop may be seen.
PR Number	Synopsis	Category: VSRX platform software
1681042	ARP will not get learned if reth interface is configured with VLAN Product-Group=junos	On vSRX 3.0 platforms in High availability (HA) cluster environment, ARP (Address Resolution Protocol) will not get learned if VLAN is configured on the reth (redundant Ethernet) interface.
PR Number	Synopsis	Category: usf nat related issues
1632278	DSLite might not work on MX platforms installed with MPC7E line card and SPC3 service PIC Product-Group=junos	DSLite (Dual-Stack Lite) may not work on MX platforms when MPC7E line card and SPC3 service PIC (Physical Interface Card) are installed and subsequently NAPT44 (Network Address Port Translation) will not work.
PR Number	Synopsis	Category: usf service set related issues
1672819	Traffic impact might be seen due to an unexpected reboot of SPC3 card Product-Group=junos	On all MX platforms with SPC3 service card installed, when endpoint independent filtering is configured along with DS-LITE (Dual Stack Lite) then PIC might reboot along with a core dump.
PR Number	Synopsis	Category: Unified Services Framework
1664517	SPC3: Receive [Rx] queue of direct memory access might be stuck which may cause issues in packet processing Product-Group=junos	SPC3:Receive [Rx] queue of direct memory access might be stuck which may cause issues in packet processing

21.1R3-S4 - List of Known issues

PR Number	Synopsis	Category: EX-Series VC Infrastructure
1669241	On JUNOS (EX4600, EX4650, QFX5k VC) platforms, line card might be disconnected from VC post master RE reboot Product-Group=junos	On JUNOS EX4600, EX4650, QFX5k VC platforms, when master RE is rebooted, the line card might be disconnected from Virtual Chassis (VC). Packet Forwarding Engine (PFE) planned restart may be seen on the new backup due to which line card leaves and rejoins the VC automatically.
PR Number	Synopsis	Category: QFX PFE CoS
1688455	The FPC crash would be observed when the same CoS configuration is applied with wildcard for all the physical interfaces and AE Product-Group=junos	On all Junos platforms, in a scaled scenario when some of the ge/xe/et interfaces are members of Aggregated Ethernet (AE) and the Class of Service (CoS) forwarding-class-set configuration is applied with a wildcard for all the physical interfaces and AE, it would trigger a Flexible PIC Concentrators (FPC) crash which leads to traffic loss.
PR Number	Synopsis	Category: a20a40 specific issue
1681701	"%DAEMON-4: Set system alarm failed: Operation not supported by device" message is seen on high end SRX Product-Group=junos	On high end SRX platform, "%DAEMON-4: Set system alarm failed: Operation not supported by device" message is seen when system/chassis alarm is generated
PR Number	Synopsis	Category: Bi Directional Forwarding Detection (BFD)
1678016	Traffic drops due to the generation of the FPC core, which makes the system unstable. Product-Group=junos	All Junos (other than MX) configured with sBFD responder with the following command: "set protocols bfd sbfd local-discriminator <>" which triggers FPC core and leads to drops traffic.
PR Number	Synopsis	Category: Border Gateway Protocol
1665610	BGP labeled-unicast inactive routes might not be advertised when add-path is configured Product-Group=junos	On all Junos and Junos Evolved platforms, by default, inactive routes from inet.3 are advertised in BGP. When add-path is configured, inactive routes from inet.3 are no longer advertised, this behavior is unexpected.
1669615	RPD crash might be observed due to multiple sequences of flap events Product-Group=junos	On all Junos and Junos Evolved platforms, when BGP update-threading is enabled and executed a certain sequence of flap events like flapping ISIS adjacencies, LDP, iBGP peers, clearing ARP table, interface flap for an hour by turning OFF and ON laser which triggers the rpd crash. It is a rare case.
1675893	The process rpd (route process daemon) crashes with BGP VPN (Border gateway protocol - Virtual Private Network) config, while ebgp (external bgp) routes exported into ibgp (internal bgp) core with vrf (virtual route forward) configured Product-Group=junos	On all Junos devices, rpd crashes with BGP VPN configured with vrf-label and exporting eBGP routes to iBGP.
PR Number	Synopsis	Category: Express BT PFE L3 Features
1657659	Junos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OID (CVE-2022-22211) Product-Group=junos	A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Denial of Service (DoS). Please refer to https://kb.juniper.net/JSA69916 [juniper.net] for more information.
PR Number	Synopsis	Category: Class of Service
1693977	The oid tree jnxCosQstatEntry returns nothing for some interfaces after restarting class-of-service Product-Group=junos	When the oid tree of jnxCosQstatEntry is used to get value, and cosd restart or global swichover happens, the oid woun't return values for that oid. That is because the IFD/IFL async events come from kernel before cosd triggers snmp_subagent_init. The fix will make sure cosd triggers snmp_subagent_init before IFD/IFL async events.
PR Number	Synopsis	Category: OAM support on DNX
1592571	:On delete remote-mep and and auto-discovery on R0, interface not going down on R1 where Action profile attached Product-Group=junos	On deleting remote-mep and auto-discovery in the peer, RDI sent by peer device is not processed in DUT. Hence, action configured for RDI event in the action-profile is not happening as expected.
PR Number	Synopsis	Category: FIB telemetry, fibtd, libocaft repositories
1662999	network-instance name for streaming telemetry to be changed from default to DEFAULT to align with CONFIG stanza Product-Group=junos	for ONDATRA test case which tested this with different network-instance names - DEFAULT. test is failing. for TEST to pass ,use network-instance names - default.
PR Number	Synopsis	Category: EX4400 PFE software
1603015	On EX4400 dot1x authentication may not work on EVPN/xlan enabled endpoints. Product-Group=junos	On EX4400 dot1x authentication may not work on EVPN/xlan enabled endpoints. The issue is due to EAPOL packets received on VxLAN ports are not processed in hostpath.
PR Number	Synopsis	Category: EX4400 platform
1653499	Additional debug logs may be printed onto device console, when device is booted from a bootable USB Product-Group=junos	When EX4400 device is booted from a USB image with 22.1R1.8 software, additional debug log messages may be printed onto the console of the EX4400 device.
PR Number	Synopsis	Category: SRX4100/SRX4200 platform software
1626562	A major alarm DPDK (data plane development kit) Tx stuck issue of SRX4100/4200 Product-Group=junos	On the SRX4100 and SRX4200 platforms, it can detect DPDK (data plane development kit) Tx stuck issue and trigger a major chassis alarm goes which might trigger RG1 failover to the healthy node. A DPDK reset will be triggered only to the stuck port and if the reset resolves the tx stuck issue, the major chassis alarm will go off.
PR Number	Synopsis	Category: idp flow creation, deletion,notification, session mgr intfce
1686105	IDP unwanted attacks (false positives) detected on the traffic Product-Group=junos	On all Junos SRX platforms with 19.4 and 20.1 releases, IDP (Intrusion Detection and Prevention) false positive attacks can be exempted from the policy for traffic continuity. The impact is that unexpected signatures may trigger in certain conditions and IDP false positive attacks may be detected.
PR Number	Synopsis	Category: Security platform jweb support
1656806	Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web (CVE-2022-22242) Product-Group=junos	A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. Refer to https://kb.juniper.net/JSA69899 [juniper.net] for more information.
PR Number	Synopsis	Category: Layer2 forwarding on EX/NTF/PTX/QFX
1686523	VPLS traffic loss might be seen when deleting and adding a routing-instance Product-Group=junos	VPLS (Virtual Private LAN Service) traffic stops on all Junos and Junos Evolved platforms after adding/changing interfaces in the routing instance. Restarting l2ald daemon may restore the VPLS services.
PR Number	Synopsis	Category: Multiprotocol Label Switching
1616841	Protected LSP goes down with strict hops and link protection configured Product-Group=junos	On all Junos and all EVO platforms, the sub-LSP of a Point-to-Multipoint Label Switched Path(P2MP LSP) with link-protection and having strict hops goes down when a protected link on more than one sub-LSP goes down simultaneously and TED(Traffic Engineering Database) notification or RSVP tunnel local repair message not received before the CSPF(Constrained Shortest Path First) computation. As a result, the sub-LSP fails and traffic drop is seen.
PR Number	Synopsis	Category: QFX VCCP
1669702	FPC1 is getting disconnected after ISSU and before switchover while checking ISSU status Product-Group=junosvae	On QFX5120-48T platforms with VC setup, FPC1 is getting disconnected after In-Service-Software-Upgrade(ISSU)/Nonstop Software Upgrade (NSSU) and before switchover while checking ISSU status.
PR Number	Synopsis	Category: QFX5200/5110/5120/5210 Platfom issues
1667397	Some 10G ports are missing from FPCs after rebooting the EX4650-VC with 1G Ports enabled on one FPC Product-Group=junosvae	On Junos EX4650 virtual chassis (VC) setup, after enabling 1G ports on one FPC and rebooting the entire VC, some 10G ports which have already been up and running on other FPCs may miss from CLI output of "show interfaces terse". Production traffic will be impacted by this issue. The cause of issue is that configuration change on one FPC is propagated to other members of VC. Configuration files should be removed on FPCs on which the 10G ports are present. After that, upgrade/re-image the VC to fixed versions and issue will not be observed any longer.
PR Number	Synopsis	Category: RPD policy options
1616167	The rpd process might get stuck at 100% when EVPN vrf-target is enabled and after any configuration change Product-Group=junos	On all Junos and EVO platforms with EVPN (Ethernet VPN)/EVPN-VXLAN (Virtual Extensible LAN Protocol) implemented, any configuration (related/unrelated) change with the knobs 'vrf-target auto' and/or 'protocols evpn vni-options vni vrf-target ' being enabled might result in CPU spike and thus, rpd (routing protocol process) gets stuck at 100%. Traffic could be blackholed during the incident happening and could be back to normal once CPU usage is decremented after an interval.
PR Number	Synopsis	Category: Resource Reservation Protocol
1657872	Memory utilization keeps incrementing due to the path error message Product-Group=junos	On all Junos and Junos Evolved platforms, when a no-cspf Label Switched Path (LSP) with strict Explicit Route Object (ERO) is configured and the egress device is disconnected, a high rate of Path Error (PathErr) messages are observed which is leading to high memory utilization and triggering the chassisd crash that causes the device to be out of control, either it can not be accessible via console/ssh or it will not trigger Routing Engine (RE) switchover as well if it is dual-RE. So this would cause an outage.
1681403	In the RSVP-TE scenario, with Entropy label capability is enabled during MBB issues handling Resv Messages Product-Group=junos	On all platforms with entropy-label configured, the issue shows up during Make-Before-Break (MBB) at a transit Juniper node when non-Juniper Egress constructs and sends a Resv message with multiple flow-descriptors (includes descriptors for both old and new instances). Juniper transit device has an issue handling such Resv Messages, the RRO object that is part of the flow-descriptor was getting dropped when the LSP_ATTRIBUTES object was also present within the flow-descriptor.
PR Number	Synopsis	Category: SRX branch platforms
1658276	reth interface does not go up due to speed mismatch when reth interface speed is changed afger RG0 failover Product-Group=junos	On SRX series platform with chassis cluster enabled, reth interface might not go up due to speed mismatch when reth interface speed is changed afger RG0 failover
PR Number	Synopsis	Category: Trio pfe bridging, learning, stp, oam, irb software
1522896	Egress traffic loss might happen because of PFE MTU feature problem Product-Group=junos	On MX and EX9200 serial platforms, under Ethernet VPN (EVPN) environment, packets routed using IRB interface could not be fragmented due to media maximum transmission unit (MTU) problem.
PR Number	Synopsis	Category: MX10K platform
1628050	MX10008 - Commit fail seen while testing family mpls filter is configured with ip-version match. Product-Group=junos	MX10008 - firewall filter "set firewall family mpls filter term from ip-version ipv4 destination-address ..." does not work on the MX10008 or MX10016. Using such configuration causes a commit error.

Modification History

First publication 2022-11-21