Alert Type
SRN - Software Release Notification
Risk
Risk Description
Low/Notification
Software Release Notification
Impact
Impact Description
Low/Notification
Software Release Notification
Product Affected
ACX EX MX NFX PTX QFX SRX vSRX
Alert Description
Junos Software Service Release version 20.2R3-S7 is now available for download from the Junos software download site
Download Junos Software Service Release:
Go to
Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select
Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts
Solution
Junos Software service Release version 20.2R3-S7 is now available.
20.2R3-S7 - List of Fixed issues
PR Number
Synopsis
Category: EX4300 Layer 2 implementation
1684072
The l2cpd process crash may be observed when disabling RSTP on an interface
Product-Group=junos
On all Junos and Junos Evolved platforms, the l2cpd process may crash and generates the core when disabling RSTP (Rapid Spanning Tree Protocol) on an interface.
PR Number
Synopsis
Category: EX-Series VC Infrastructure
1700133
One of the Virtual Chassis members on EX4600-VC might be disconnected during VC initialization
Product-Group=junos
On EX4600-VC, when "request system reboot all members" is executed, post-reboot one of the VC member/Flexible PIC Concentrator(FPC) might disconnect and join the VC back due to Packet Forwarding Engine (PFE) restart. Traffic loss is seen when FPC is disconnected.
PR Number
Synopsis
Category: QFX Control Plane Analyzer related
1676220
QFX51xx switches can report PFE syslog message 'ACL Unresolve DOT1Q failedin setting udf settings on unit'
Product-Group=junos
QFX51xx switches can report PFE message 'ACL Unresolve DOT1Q failedin setting udf settings on unit' These are harmless message. These are reported on QFX51xx due to unsupported feature Flex Hash.
PR Number
Synopsis
Category: OAM support on ACX
1637615
Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS) (CVE-2023-22391)
Product-Group=junos
A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Refer to https://kb.juniper.net/
JSA70187
[juniper.net]
for more information.
PR Number
Synopsis
Category: a20a40 specific issue
1681701
"%DAEMON-4: Set system alarm failed: Operation not supported by device" message is seen on high end SRX
Product-Group=junos
On high end SRX platform, "%DAEMON-4: Set system alarm failed: Operation not supported by device" message is seen when system/chassis alarm is generated
1698797
Fabric monitoring suspension and control link failure may cause HA cluster outage
Product-Group=junos
In HA cluster, a local node failure which causes control link to go down may not guarantee the other node to take over primary if the fabric link monitoring suspension was triggered earlier before (e.g. - caused by a minor hardware failure), as the fabric link down event would be ignored when the other node was in RG0 ineligible state. This is a corner case to https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-failover-parameters.html#id-understanding-chassis-cluster-control-link-heartbeats-failure-and-recovery__d27575e82. And PR1698797 fixed this defect.
PR Number
Synopsis
Category: srx5k service offloading related PR
1702138
TCP packet drops are seen when services-offload is enabled
Product-Group=junos
On Junos SRX5400, SRX5600, SRX5800 and SRX4600 Platforms, packet drops may be observed while services-offload is enabled.
PR Number
Synopsis
Category: Border Gateway Protocol
1526061
BGP Monitoring Protocols may not releases IO buffer correctly
Product-Group=junos
When using BGP Monitoring Protocol (BMP), update sent to the monitoring stations may not be released causing the router to ran out of memory and swap space.
PR Number
Synopsis
Category: Device Configuration Daemon
1633339
The Syslog messages and the dcd crash might be seen in Junos
Product-Group=junos
On all Junos platforms, "duplicate VLAN-ID on untagged interface gr-x/x/x.xxx: conflicts with unit 1" syslog message might be seen and dcd process might be crashed if the same VLAN is configured on the GRE-tunnel interfaces.
PR Number
Synopsis
Category: Firewall Filter
1604494
The 'aftd" core might be observed while deactivating and activating an AE interface
Product-Group=junos
On MX platforms having AFT-based line cards with scaled firewall-config scenario, the crash might be observed while adding/deleting the prefixes from the radix trees.
PR Number
Synopsis
Category: Covers Application classification workflows apart from custo
1595310
The flowd process might crash when AppID marks the application as complete and the inspection limits are hit
Product-Group=junos
On SRX Series devices, when JDPI inspection-limits are reached, under certain circumstances, classification details are not propagated to interested Layer-7 Services, such as IDP, which might also cause the flowd process crash.
PR Number
Synopsis
Category: Control plane EVPN multicast
1670435
EVPN multicast traffic may get impacted because of routes getting stuck in the kernel routing table (krt) queue
Product-Group=junos
On all Junos and Junos Evolved platforms with Ethernet Virtual Private Network(EVPN) enabled, in the presence of certain triggers like rpd restart, rollback of configuration etc., EVPN multicast routes might get stuck in the kernel routing table (krt) queue due to which the corresponding routes in the forwarding table may point to 'fictitious' next hops, resulting in traffic disruption.
PR Number
Synopsis
Category: Express PFE including evpn, vxlan
1627876
Traffic loss might be observed due to Address Resolution Protocol (ARP) getting programmed as indirect next-hop by control plane for external routes distributed over IRB on QFX10k Junos platforms
Product-Group=junos
On QFX10k Junos platforms Address Resolution Protocol (ARP) host might get programmed as indirect next-hop by control plane for routes reachable via IRB host.
PR Number
Synopsis
Category: Express PFE L2 fwding Features
1627566
QFX10002-60C platform might not respond back to ICMP packets received with TTL or hop limit value of 1
Product-Group=junos
On QFX10002-60C platform when ICMPv4 (Internet Control Message Protocol) packet with TTL (Time To Live) value of 1 or ICMPv6 packet with hop limit value of 1 is received at the IRB (Integrated Routing and Bridging) interface, it might not respond back with the corresponding ICMP error codes [TTL expired or hop limit exceeded] to the source device.
1693424
Traffic loss is observed when the ECMP path is IRB over AE (IPv4 -> MPLS)
Product-Group=junos
On QFX10002 switches, when the ECMP path is integrated routing and bridging (IRB) over aggregated Ethernet {IPv4 -> MPLS}, this results in packets getting discarded and traffic loss is observed.
PR Number
Synopsis
Category: Express pfe Mclag
1640483
Junos OS: QFX10k Series: ICCP flap will be observed due to excessive specific traffic (CVE-2023-22403)
Product-Group=junos
An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). Refer to https://kb.juniper.net/
JSA70199
[juniper.net]
for more information.
PR Number
Synopsis
Category: SRX4100/SRX4200 platform software
1624078
A major chassis alarm for Intel NIC Tx port stuck issue is added on SRX4100/4200
Product-Group=junos
On the SRX4100 and SRX4200 platforms, it can detect intel NIC Tx port stuck issue and central chassis alarm goes off which might trigger RG1 and hardware monitoring failure.
1626562
A major alarm DPDK (data plane development kit) Tx stuck issue of SRX4100/4200
Product-Group=junos
On the SRX4100 and SRX4200 platforms, it can detect DPDK (data plane development kit) Tx stuck issue and trigger a major chassis alarm goes which might trigger RG1 failover to the healthy node. A DPDK reset will be triggered only to the stuck port and if the reset resolves the tx stuck issue, the major chassis alarm will go off.
PR Number
Synopsis
Category: Kernel software for AE/AS/Container
1649958
The user-defined speed does not take effect on the AE interface in certain scenarios on Junos platforms
Product-Group=junos
On Junos platforms supporting GRES (Graceful Routing Engine Switchover), the bandwidth flag on the backup RE (Routing Engine) for the AE interfaces is set unconditionally, hence the bandwidth is struck at a value despite not being set by the user statically. When GRES is performed followed by link delete/add for the AE interface, the interface would get stuck with the bandwidth and gets synced with the backup RE. There can be seen partial service impact in the case of the RSVP (Resource Reservation Protocol) and the restoration to recover from this issue is to configure bandwidth manually and then remove the configuration.
PR Number
Synopsis
Category: PFE infra to support jvision
1608871
The FPC might crash when the option 'sensor-based-stats' is configured
Product-Group=junos
On MX Series routers with IS-IS segment routing scenario, if the option 'sensor-based-stats' is configured, the FPC might crash when adding/deleting the aggregated multiservices (AMS) member interface or adding/deleting load-balancing-options on the AMS interface.
PR Number
Synopsis
Category: SW PRs for MPC10E Chassisd
1664448
The command "show chassis fpc" shows inaccurate information about heap memory
Product-Group=junos
The command "show chassis fpc" shows inaccurate information about heap memory in output.
PR Number
Synopsis
Category: Multiprotocol Label Switching
1694648
The rpd crash will be observed during the MPLS label block allocation
Product-Group=junos
On all Junos and Junos Evolved platforms in the Multiprotocol Label Switching (MPLS) scenario, the rpd crash will happen in rare conditions during MPLS label block allocation.
1697982
[MX]L2VPN ping is failing when UHP rsvp LSP is used
Product-Group=junos
MPLS L2VPN ping is getting failed when MX is egress. In egress, RE verifies whether received label is VC label or not. For most of the platforms, tunnel label will be removed in PFE before punting the echo request packet to RE. But in this platform, tunnel label is not removed hence RE verifies this tunnel label and it is returning no-mapping.
1701800
Memory leak issue in TED
Product-Group=junos
On all Junos and Junos Evolved platforms, a memory leak is observed in TED (Traffic Engineering Database) when the inet tables is not cleaned up after routing instance deactivation.
PR Number
Synopsis
Category: OS IPv4/ARP/ICMPv4
1681250
The traffic loss duration increases during the LSP switchover
Product-Group=junos
On all Junos platforms, the traffic loss duration increases during the LSP switchover. The time consumption for processing indexed NH was more which got reduced due to this fix.
PR Number
Synopsis
Category: OSPF routing protocol
1700966
OSPF stuck in InitStrictBFD state for the neighbor which doesn't send LLS header
Product-Group=junos
When Strict BFD (Bidirectional Forwarding Detection) for OSPF (Open Shortest Path First) configured on all Junos OS and Junos OS Evolved platforms, and one or more OSPF neighbors don't support Link-Local Signaling ("LLS", RFC5613), the adjacency with these neighbor(s) might stuck in InitStrictBFD state upon adjacency initialization. Neighbor doesn't support LLS, hence it doesn't attach the LLS header, which is a pre-requisite for Strict BFD.
PR Number
Synopsis
Category: QFX L2 PFE
1672583
The link is up after a power cycle and software reboot but traffic does not flow
Product-Group=junos
On the EX4600 device with SFP-LX10/SFP-SX, after a power cycle/software reboot, all ports are initialized and links are up with auto-negotiation enabled. Few ports are up and traffic flows whereas few ports are up but no traffic flow through them.
PR Number
Synopsis
Category: QFX MPLS PFE
1687257
QFX5120 will drop ingress traffic on an l2circuit configured interface on continuous flapping
Product-Group=junosvae
On QFX5120 platforms, when a flap occurs in a Layer 2 Circuit (L2Circuit) configured interface, l2circuit configuration programming fails on the interface and leads to a traffic drop.
PR Number
Synopsis
Category: QFX5100 Interface related issues
1665800
Ports with SFP-T 1G plugged in may go to hung state on QFX5100 platforms
Product-Group=junos
When the remote end server/system reboots, QFX5100 platform ports with SFP-T 1G inserted may go into a hung state and remain in that state even after the reboot is complete. This may affect traffic after the remote end system comes online and resumes traffic transmission.
1669436
On specific QFX5k platforms, member links may reduce their configured speed when the other side doesn't have auto-negotiation disabled
Product-Group=junos
On QFX5110, QFX5120, QFX5200-32C and QFX5100 Junos platforms, the member link reduces its speed if there is an optics/cable issue, which effectively reduces the overall AE (Aggregate Ethernet) link speed. This is an undesired behavior since the matching speed is one of the mandatory criteria for a member link to join an AE.
1688023
The LLDP output packets are not transmitting on the em0 interface of Junos and Junos OS Evolved platforms
Product-Group=junos
On Junos and Junos OS Evolved platforms, if a management Ethernet interface(em0) has an inet or inet6 family configured and "delete interfaces em0" is issued, the Link Layer Discovery Protocol (LLDP) output packets will stop transmitting, causing the LLDP neighborship to remain down in peer router.
PR Number
Synopsis
Category: QFX5200/5110/5120/5210 Platfom issues
1710855
qfx-5e (TVP) Junos image installation issue on certain Junos Release on QFX5100.
Product-Group=junosvae
Due to software defect caused by PR1676220, qfx-5e (TVP) Junos image cannot be installed on QFX5100. The PFE (Packet forwarding Engine) will crashing continuously and FPC wouldn't be seen online in show chassis fpc output.
PR Number
Synopsis
Category: Cover Logical System Infrastrcuture Development
1694449
The process srxpfd/ flowd will crash on SRX devices
Product-Group=junos
On all SRX platforms (except branch SRX series) configured with chassis cluster redundancy group, when numerous logical interfaces or IFLs (> 1K) are deleted and traffic is running for those IFLs, or if the RG failover then the process srxpfed/ flowd will crash.
PR Number
Synopsis
Category: MPC7/8/9 Interface Issues
1692063
PCS errors and framing errors on 100GE interfaces on certain Juniper platforms
Product-Group=junos
On certain Junos platforms having 20.2R1 or later release, with specific PIC (Physical Interface Card)/MIC (Modular Interface Card)/FPC (Flexible PIC Concentrator), PCS (Physical Coding Sublayer) errors and framing errors would be seen on 100GE interfaces with LR4 optics or on its peer device. The framing/CRC (Cyclic Redundancy Check) errors which would be seen when the PCS error rate is high could lead to packet drops hence impacting data services. Enabling FEC (forwarding Error Correction) feature on the impacted interface may reduce the frequency of packet drop.
PR Number
Synopsis
Category: SRX-1RU platfom related protocol, QoS, filtering features et
1689705
SNMP MIB walk for jnxBoxDescr OID returns incorrect value
Product-Group=junosvae
On SRX4600 platforms running Junos, SNMP MIB walk for jnxBoxDescr OID returns the incorrect chassis name and model. This is only a display issue with no service impact.
PR Number
Synopsis
Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1641025
Unable to access configure exclusive mode after mgd process is killed
Product-Group=junos
On all Junos OS and Junos OS Evolved devices, when copy-config, get-configuration, and discard-change RPCs run in two parallel NETCONF sessions and the database is also accessed in parallel by two NETCONF sessions, it leads to database corruption and mgd-related services might crash.
1643209
Commit fails with message "statement does not match patch" due to TOD mismatches between Primary RE and Backup RE
Product-Group=junos
When time-zone for the router is set as EST5EDT and if the TOD (Time-Of-Day) values under "event-options generate-events" are modified in different time zones, that is TOD configurations created on EST time zones are getting modified in EDT time zone, then it can cause commit failures. When such commits happens at different time-zones, internally, it generates a patch file and tries to load the patch at both RE. But due to different time zone, it is not getting excepted by backup RE.
PR Number
Synopsis
Category: Junos Fusion Satellite Device Infrastructure
1682680
The Junos Fusion Satellite device will be stuck in the SyncWait state
Product-Group=junos
On Junos MX, EX, and QFX platforms, post rebooting the device the Junos Fusion Satellite devices are trying to generate the ssh keys before clearing the old keys. The Satellite devices will not be responsive as they are stuck in the SyncWait state leading to traffic loss.
20.2R3-S7 - List of Known issues
PR Number
Synopsis
Category: EX-Series VC Infrastructure
1685067
EX4600-VC - Master RE reboot and All-member reboot lead to PFE Manager hogging logs when SFP-T is plugged in
Product-Group=junos
On Junos EX4600 Virtual Chassis (VC), the master RE reboot and all-members reboot lead to the PFE Manager hogging logs when SFP-T pluggable is installed in. The PFE Manager hogging logs has no functionality impact (PR 1641556).
Resolved In:
junos:20.2R3-S6 junos:21.4R3-S2
1700134
EX4600 VC: CMQFX PIC reset: Member Disconnect observed during VC initialization after reboot
Product-Group=junos
On EX4600 VC, when an FPC comes up after reboot by the "request system reboot all members" command, if a new PIC is detected during initialization, the PIC validation may fail due to an invalid pic slot.
Resolved In:
PR Number
Synopsis
Category: QFX Control Plane VXLAN
1650202
ARP/NS response to anycast IRB might fail due to missing mac-ip entry
Product-Group=junos
On all Junos and EVO platforms, IRB (Integrated routing and bridging) static entry might be missing in the mac-ip-table for mac move allowed for local static IRB entry.
Resolved In:
evo:21.2R3-EVO evo:21.4R2-EVO evo:21.4R3-EVO evo:22.2R1-EVO junos:20.2R3-S7 junos:20.4R3-S5 junos:21.2R3 junos:21.3R3 junos:21.4R2 junos:21.4R3 junos:22.1R2 junos:22.2R1 junos:22.3R1
PR Number
Synopsis
Category: OpenSSL and related subsystems
1653861
Junos OS: OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)
Product-Group=junos
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Refer to https://kb.juniper.net/
JSA70180
[juniper.net]
for more information.
Resolved In:
junos:20.4R3-S4 junos:20.4R3-S5 junos:20.4R3-S6 junos:21.2R3-S1 junos:21.2X32-D10 junos:21.3R2-S2 junos:21.4R1-S2 junos:21.4R2 junos:22.1R1-S1 junos:22.1R2 junos:22.2R1 junos:22.3R1
PR Number
Synopsis
Category: Firewall support for DNX
1559665
On the ACX5448 routers, single rate three color policer does not work.
Product-Group=junos
On ACX710/5448 platforms running 20.2R1 releases onwards, "single-rate-three-color" policer and "two-rate-three-color" policer may not be working as expected. All packets are marked as green, and no packets are marked as yellow and red (i.e., all packets are going to the same queue).
Resolved In:
junos:20.3R3 junos:20.4R2 junos:20.4R3 junos:21.1R2 junos:21.2R1
PR Number
Synopsis
Category: Express ASIC platform
1683562
On PTX5000 platforms when a command is issued to power off an FPC, it gets stuck in the 'Announce Offline' state
Product-Group=junos
When an FPC (Flexible PIC Concentrator) on PTX5000 platforms is shut down by issuing a request command (request chassis offline slot ) or by FPC power off configuration (set chassis fpc x power off), it gets stuck in the 'Announce Offline' state since the associated timer (fru_graceful_offline_timer) doesn't increment and expire as it is supposed to.
Resolved In:
junos:19.2R3-S5-J2 junos:20.4R3-S2-J17 junos:20.4R3-S5-J3 junos:20.4R3-S6 junos:21.4R3-S2 junos:22.3R2 junos:22.4R1 junos:22.4R2 junos:23.1R1
PR Number
Synopsis
Category: jpppd daemon
1686940
Subscribers will fail to negotiate the PPP session and be unable to login post-software upgrade
Product-Group=junos
On MX platforms with Subscriber Management configured, the subscribers will fail to negotiate the PPP (Point-to-Point Protocol) session and be unable to login when jpppd transitions from Backup to Master and does not receive all the Routing Table events from Kernel post upgrade.
Resolved In:
evo:22.4R2-EVO evo:23.1R1-EVO junos:22.4R2 junos:23.1R1
PR Number
Synopsis
Category: Adresses ALG issues found in JSF
1604123
Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processed (CVE-2022-22175)
Product-Group=junos
An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. Refer to https://kb.juniper.net/
JSA11281
[juniper.net]
for more information.
Resolved In:
junos:20.4R3-S1 junos:21.1R2-S2 junos:21.1R3 junos:21.2R1-S2 junos:21.2R2 junos:21.2R3 junos:21.3R1-S1 junos:21.3R2 junos:21.4R1 junos:22.1R1
1668830
Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if SIP ALG is enabled and a malicious SIP packet is received (CVE-2023-22416)
Product-Group=junos
A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). Please refer to https://kb.juniper.net/
JSA70212
[juniper.net]
for more information.
Resolved In:
junos:20.4R3-S5 junos:21.1R3-S4 junos:21.2R3-S2 junos:21.2X32-D10 junos:21.3R3-S1 junos:21.3X30-D10 junos:21.4R3 junos:22.1R1-S2 junos:22.1R2 junos:22.1R3 junos:22.2R1-S1 junos:22.2R2 junos:22.3R1 junos:22.4R1
PR Number
Synopsis
Category: Security platform jweb support
1712454
[Jweb] "address-book attach zone" is unexpectedly removed when address-book entry is added or removed by Jweb
Product-Group=junos
On SRX platform series, when address-book entry is added or removed by Jweb, "address-book attach zone" might be unexpectedly removed at configuration commit.
Resolved In:
junos:20.4R3-S7 junos:22.2R3 junos:22.3R3 junos:22.4R2 junos:23.1R1 junos:23.1R2 junos:23.2R1
PR Number
Synopsis
Category: Label Distribution Protocol
1550158
NSR may get in out of sync status due to race condition
Product-Group=junos
LDP add duplicate registertion and infra does not like it. This happen during the race condition between rpd and kernel to detect the unreplicate NSR config with error condition.
Resolved In:
evo:20.4R1-EVO evo:21.1R1-EVO junos:20.4R1 junos:20.4R2 junos:21.1R1
PR Number
Synopsis
Category: Express Chip L3 software
1564147
The dcpfe process might crash in ECMP scenario
Product-Group=junos
On PTX Series routers and the QFX10000 line of switches, if more than 64-link ECMP is configured, the memory leak for the dcpfe process could be observed, which might lead to a crash. The dcpfe crash is restored automatically after some time.
Resolved In:
junos:20.3X75-D10 junos:20.3X75-D20 junos:20.4R3-S7 junos:21.1R1 junos:21.2R1
PR Number
Synopsis
Category: QFX L2 PFE
1629680
Traffic might get dropped when "family ethernet-switching" is configured on the interface in Q-in-Q scenario
Product-Group=junos
In Q-in-Q scenario, traffic starts getting dropped when "family ethernet-switching" is added to ingress interface, which is already configured with "encapsulation extended-vlan-bridge". This is due to incorrect port setting in hardware.
Resolved In:
junos:19.4R3-S11 junos:20.2R3-S5 junos:21.2R3 junos:21.3R2 junos:21.3R3 junos:21.4R2 junos:22.1R1 junos:22.2R1
PR Number
Synopsis
Category: QFX5100 Virtual Chassis
1679919
PFE process crash might be observed on QFX5100 platforms
Product-Group=junos
On QFX5100 platforms (both stand-alone and VC scenario) running Junos, occasionally during the normal operation of the device, PFE (Packet Forwarding Engine) can crash resulting in total loss of traffic. The PFE reboots itself following the crash.
Resolved In:
junos:20.4R3-S7 junos:21.4R3-S2
Modification History
First publication 2023-02-24
20.2R3-S7: Software Release Notification for JUNOS Software