22.3R1-S2: Software Release Notification for JUNOS Software

Alert Type

PSN - Product Support Notification

RiskRisk Description

Low/Notification

Software Release Notification

ImpactImpact Description

Low/Notification

Software Release Notification

Product Affected

ACX EX MX NFX PTX QFX SRX vSRX running Junos software

Alert Description

Junos Software Service Release version 22.3R1-S2 is now available for download from the Junos software download site

Download Junos Software Service Release:

Go to Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 22.3R1-S2 is now available.

22.3R1-S2 - List of Fixed issues

PR Number	Synopsis	Category: Daily JUNOS build failures - automated builder use only
1691209	Use latest os-package when upgrading Product-Group=junos	Upgrade to 22.3R1 while using os-package published between July 2022 and November 2022 may incorrectly link os-libs package
PR Number	Synopsis	Category: EX4300 Layer 2 implementation
1684072	The l2cpd process crash may be observed when disabling RSTP on an interface Product-Group=junos	On all Junos and Junos Evolved platforms, the l2cpd process may crash and generates the core when disabling RSTP (Rapid Spanning Tree Protocol) on an interface.
PR Number	Synopsis	Category: Track PRs in BGP Flow Spec area & is part of BGP inside RPD.
1698446	Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute in version 22.3R1 (CVE-2022-22184) Product-Group=junos	If a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute will propagate through unaffected systems and intermediate AS (if any). Please refer to https://kb.juniper.net/JSA70175 [juniper.net] for more information.
PR Number	Synopsis	Category: QFX Access Control related
1693640	The dot1x reauthentication will not work for a port with VoIP VLAN Product-Group=junos	On Junos EX platforms, the dot1x clients will remain in connecting state after the 'clear dot1x interface' is done due to which the interface would not get authenticated to become a member of the configured access VLAN. When this happens, VLAN membership will not be formed.
PR Number	Synopsis	Category: EX4100 RE, Platform Infra, Drivers
1658584	EX4100 MACsec interface statistics of encrypted/decrypted bytes do not increment further after reaching a 40-bit limit (1099511627775) Product-Group=junos	EX4100 MACsec interface statistics of encrypted/decrypted bytes do not increment further after reaching a 40-bit limit (1099511627775)
PR Number	Synopsis	Category: EX4400 platform
1683753	EX/QFX SNMP: jnxOperatingDescr.1.1.0.0 returns blank, but jnxOperatingState.1.1.0.0 returns value. Product-Group=junos	On EX/QFX series switch, jnxOperatingDescr.1.1.0.0 returns blank, but jnxOperatingState.1.1.0.0 returns value.
1687848	EX4400 SNMP : FRU removal/insertion trap may not be generated when Fan try or PIC is removed and inserted Product-Group=junos	On EX4400, FRU removal/insertion trap may not be generated when Fan try or PIC is removed and inserted.
1690674	On EX4100 and EX4400 platform, alarm 'PEM is not supported' might be seen. Product-Group=junos	On EX4100 and EX4400 platform, system alarm 'PEM is not supported' might be seen with a specific trigger and it keeps remain even after supplied power.
PR Number	Synopsis	Category: EX POE
1671311	EX4100 and EX4100-F series: On device reboot in scaled PoE scenario with perpetual PoE configured, it takes some time (a few minutes) for the CLI to reflect the correct status for LLDP enabled ports. Product-Group=junos	EX4100 and EX4100-F series: On device reboot in scaled PoE scenario with perpetual PoE configured, it takes some time (a few minutes) for the CLI to reflect the correct status for LLDP enabled ports.
PR Number	Synopsis	Category: Express PFE L2 fwding Features
1693424	Traffic loss is observed when the ECMP path is IRB over AE (IPv4 -> MPLS) Product-Group=junos	On QFX10002 platforms, when the ECMP (Equal-cost multi-path) path is IRB (Integrated routing and bridging) over AE (Aggregated Ethernet) {IPv4 -> MPLS (Multiprotocol Label Switching)} results in packets getting discarded for which traffic loss is observed.
PR Number	Synopsis	Category: SRX1500 platform software
1690621	SRX1500 chassis cluster port ge-0/0/1 does not work in switching mode Product-Group=junos	SRX1500 chassis cluster port ge-0/0/1 on a node is not working in switching mode when this interface is configured in L2 (layer2) mode.
PR Number	Synopsis	Category: Firewall Network Address Translation
1699407	MNHA: Incorrectly a warning is thrown at commit check for Source NAT config when the source-address or destination-address of the NAT rule is set as 0.0.0.0/0 Product-Group=junos	n SRX platforms with MNHA (Multi-Node High Availability) enabled, when a source NAT rule is configured with 0.0.0.0/0 as source-address or destination-address, then a commit warning is displayed for the nat configuration. However the warning is not applicable to source nat and can be disregarded.
PR Number	Synopsis	Category: Protocol Independant Multicast
1675212	KRT queue shows deferred operation while creating IFL after FPC offline/online event Product-Group=junos	Dynamic IFL add request is waiting to be processed in KRT queue during that if chassid down event occurs. To handle the chassid down event RPD Infra sends notification to protocol(producer of Dynamic IFL add request) and it is producer jobs to DELETE the dynamic ifls request which were there in the KRT queue. PIM code is not clearing those Dyanamic IFLs ADD request during chassis fpc down event. Hence getting error 'ENOENT -- Item not found' when chassis comes back up.
PR Number	Synopsis	Category: JRR - VRR running on SRX4200
1691694	A 802.1Q tagged Ethernet traffic with an expected VLAN ID and with a non-zero 802.1P value ingressing a JRR200 VLAN enabled interface is dropped. Product-Group=junos	A 802.1Q tagged Ethernet traffic with an expected VLAN ID and with a non-zero 802.1P value ingressing a JRR200 VLAN enabled interface is dropped. This problem could happen at a JRR200 system running a 21.1+ JUNOS release.
PR Number	Synopsis	Category: Configuration management, ffp, load action
1671112	Test Configuration might fail even though the config file is having valid configurations Product-Group=junos	Root cause; In test configuration flow we are calling mustd as "/usr/sbin/mustd -q /var/run/db/file.data /var/run/db/file.data+ -F -m" where we just copy the existing cog.db (generated out of committed config) as cdg.db+ , use it for testing the configuration passed, and remove it once the testing is done. This is creating the issue because the configuration is tested against the existing cdg.db. Fix would be to create the cdg.db fresh from the configuration to be tested and test the configuration against that. This new cdg.db should not replace the existing one in /var/run/db.
PR Number	Synopsis	Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1679413	Configuration filtering doesn't work when the logical system is present Product-Group=junos	On SRX platforms, configuration filtering doesn't work when the logical system is present.
1699245	The mgd process might crash during commit synchronize Product-Group=junos	On all Junos OS and Evolved OS platforms with dual RE (Routing Engine) during commit script synchronize, backup RE mgd get crash once the memory leak reaches to 65K due to which commit configuration will fail which are performed through Master RE.
PR Number	Synopsis	Category: Issues related to all UI tools (mgd-bsd/cli-bsd, XML and DMI
1681656	System uptime display is shown in minutes instead of seconds Product-Group=junos	On all Junos and Junos Evolved platforms, after the device reboot, show system uptime command is showing time in minutes instead of seconds for 24 hours.

22.3R1-S2 - List of Known issues

PR Number	Synopsis	Category: EX2300/3400 PFE
1706845	Layer 3 forwarding issues for IRB Product-Group=junos	On EX2300, EX3400, EX4400, EX4100 and EX4300-MP platforms, when master FPC with mac-persistence-timer configured on a virtual chassis switch is halted, it leads to layer 3 (l3) forwarding issues for the integrated routing and bridging (IRB). Resolved In: junos:20.4R3-S7 junos:21.4R3-S3 junos:22.3R3 junos:22.4R2 junos:23.1R1
PR Number	Synopsis	Category: OAM support on ACX
1637615	Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS) (CVE-2023-22391) Product-Group=junos	A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Refer to https://kb.juniper.net/JSA70187 [juniper.net] for more information. Resolved In: junos:19.4R3-S9 junos:20.2R3-S7 junos:20.3R3-S6 junos:20.3X75-D35 junos:20.3X75-D42 junos:20.4R3-S4 junos:21.2R3-S3 junos:21.3R3-S3
PR Number	Synopsis	Category: Control Plane for Node Virtualization
1683312	'clear interfaces statistics all' taking more than 9 min due to invalid PIC configuration inside GNF. Product-Group=junos	Invalid PIC configuration inside GNF may add delay to 'clear interface statistic all' command. This issue does not impact any functionality. chassis fpc pic Resolved In: junos:21.2R3-S4 junos:21.4R3-S3 junos:22.1R3 junos:22.2R3 junos:22.3R2 junos:22.4R1 junos:23.1R1
PR Number	Synopsis	Category: EX4100 RE, Platform Infra, Drivers
1681673	EX4100 & EX4100-F Virtual chassis: Non-existing PIC ports are seen in jvision queries Product-Group=junos	EX4100 & EX4100-F Virtual chassis: Non-existing PIC ports (e.g. PIC0:PORT100, PIC2:PORT102) while running the jvision query. Resolved In:
PR Number	Synopsis	Category: Express PFE including evpn, vxlan
1646489	Vxlan Tunnel termination fails due to a change in config Product-Group=junos	Packet drop can be seen when a new VNI (Virtual Network Index)config is applied over the existing VNI config. Resolved In: junos:20.4R3-S5 junos:21.1R3-S4 junos:21.2R3-S1 junos:21.3R3 junos:21.4R2 junos:21.4R3 junos:22.1R1 junos:22.1R2 junos:22.2R1 junos:22.3R1
PR Number	Synopsis	Category: Express PFE MPLS Features
1590387	ISIS adjacency is not coming up through TCC l2circuit Product-Group=junos	On ACX/PTX/QFX platforms(PTX10002/10003/10008/10016/QFX10002/10003/10008/10016/ACX6360) if protocols l2circuit and channel tcc is enabled for providing layer 2 transaction, ISIS connection through the layer 2 domain might get failed and traffic loss might be seen. Resolved In: junos:19.4R3-S8 junos:20.3R3-S4 junos:21.1R3-S1 junos:21.2R3 junos:21.2R3-S3 junos:21.3R2 junos:21.3R3-S3 junos:21.4R2 junos:21.4R3-S1 junos:22.1R1 junos:22.1R3 junos:22.2R1-S2 junos:22.2R2 junos:22.2R3 junos:22.3R2 junos:22.4R1
PR Number	Synopsis	Category: jdhcpd daemon
1666943	MX240:Verify VRRP stats is failed after Deactivate the Access interface Product-Group=junos	VRRP statistic may not be accurate with subscriber services Resolved In: evo:22.2R3-EVO evo:22.3R2-EVO evo:22.4R2-EVO evo:23.1R1-EVO junos:22.2R2-S1 junos:22.2R3 junos:22.3R2 junos:22.4R1 junos:22.4R2 junos:23.1R1
1693124	phone-home and SZTP may fail if phone-home daemon restarts Product-Group=junos	Onboarding device with Phone-home or SZTP fails in rare cases where phone-home daemon restarts. Resolved In: junos:21.4R3-S3 junos:22.2R3 junos:22.3R2 junos:22.3R3 junos:22.4R1 junos:23.1R1
PR Number	Synopsis	Category: Layer 2 Control Module
1686596	If MVRP is enabled on an MSTP enabled interface, the interface will be made part of all the existing instances on the switch Product-Group=junos	, If MVRP is enabled on an MSTP enabled interface, the interface will be made part of all the existing instances on the switch, So, if there are two interfaces between R1 and R2 as below: R1(et-0/0/1 & et-0/0/2)======(et-0/0/1 & et-0/0/2)R2 And one interface is MVRP enabled (say et-0/0/1), and et-0/0/2 is not MVRP enabled. By configuration et-0/0/1 is part of MSTI-1 and et-0/0/2 is part of MSTI-2. MSTI-1 is running on vlan-100 and MSTI-2 is running on Vlan-200. R2 in this case, is advertising only vlan-100. The MVRP enabled interface will become part of all the MSTIs(MSTI-1 and MSTI-2 both) configured on the device and it will take part in the FSM of all the MSTIs. Although et-0/0/1 is not member interface of vlan-200(correspnding to MSTI-2). This potentially can cause a problem where et-0/0/1 although not a vlan-200 member, will go into FWD state and et-0/0/2, genuine member of vlan-200 goes into BLK state for MSTI-2. So, when traffic is received in vlan-200 it will be sent out of et-0/0/1, an it will be dropped. Resolved In: evo:22.4R1-EVO
PR Number	Synopsis	Category: OSPF routing protocol
1682506	Traffic loss is seen when the router in helper mode deletes the route for the router undergoing graceful restart Product-Group=junos	On all Junos OS and Junos OS Evolved devices, traffic loss is seen when the router in helper mode to support an OSPF graceful restart deletes the route for the router undergoing graceful restart. The device deletes the route due to the topology change. Resolved In: evo:22.4R1-EVO junos:18.2X75-D436 junos:20.3X75-D42 junos:21.4R2-S1-J4 junos:22.4R1
PR Number	Synopsis	Category: QFX L2 PFE
1706515	DCPFE crashes which leads to FPC restart Product-Group=junos	On Junos QFX and EX platforms, the DCPFE (Dense Concentrator Packet Forwarding Engine) crashed continuously after configuring the unsupported telemetry sensor '/junos/system/linecard/npu/utilization/' leading to the restarting of FPC. Once FPC is restarted, traffic is impacted. Resolved In: junos:21.4R3-S3 junos:22.2R3 junos:22.3R3 junos:22.4R2 junos:23.1R1
PR Number	Synopsis	Category: ZT/YTpfe bridging, learning, stp, oam, irb software
1664694	Not all MAC addresses are learnt for some VPLS instances after "clear vpls mac-table" command is executed Product-Group=junos	Not all MAC addresses are learnt for some VPLS instances after "clear vpls mac-table" command is executed Resolved In: evo:23.2R1-EVO
PR Number	Synopsis	Category: MX10K linecard
1688651	JUNOS_REG:MX10008:Carrier transition count is more than expected at DUT(mx10008) after flapping the interface at peer non-DUT end. Product-Group=junos	When laser off and on happens on the remote end, within an interval of less than 500 ms, the local interface undergoes additional flap, before the link comes up. There is no impact of the additional flap, as the link does come up eventually. Resolved In:

Modification History

First publication 2023-02-03