Alert Type

PSN - Product Support Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

ACX EX MX NFX PTX QFX SRX vSRX

Alert Description

Junos Software Service Release version 23.4R2-S1 is now available for download from the Junos software download site

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

NOTE: This SRN is for 23.4R2-S1.3 which is built on 2024-08-15. If you download 23.4R2-S1 prior to 2024-08-15,  please see TSB85282 [juniper.net]

Junos Software service Release version 23.4R2-S1 is now available.

23.4R2-S1 - List of Fixed issues 

PR NumberSynopsisCategory: BBE Autoconfigured DVLAN related issues
1777139FPC gets stuck at 100% utilization after upgrade from 21.2R1 or below to 21.3R1 or higher release
Product-Group=junos		On Junos MX platforms with PPPoE (point-to-point protocol over ethernet) subscribers over dynamic VLAN (virtual local area network) scenario, FPC (flexible physical interface cards concentrator) gets stuck at 100% after upgrade from 21.2R1 or below to 21.3R1 or higher release. The line card PFE (packet forwarding engine) is busy because of huge punt traffic which is process-switched by the CPU.
PR NumberSynopsisCategory: MX Platform SW - FRU Management
1784438MX304 not reachable with the power-off failure on the PIC
Product-Group=junos		When an MX304 LMIC is offline due to a power issue, it may take up to 20 minutes for the LMIC to come back online. You can configure event-options to reduce the time to restart the LMIC. See also: TSB83899 [juniper.net]
PR NumberSynopsisCategory: Dynamic rendering infrastructure
1745615Telemetry data is not exported in an IS-IS scaled Segment Routing scenario
Product-Group=junos		On all Junos and Junos OS Evolved platforms configured with SR-ISIS and with gRPC/gNMI telemetry, subscription to the path: "/junos/services/segment-routing/sid/usage/" will not work and the output could not be proper. The issue could happen only in scaled configuration (Approximately, 4000 or more per-sid ingress sensors and 4000 or more IPv4/IPv6 per-sid egress sensors are configured).
PR NumberSynopsisCategory: jdhcpd daemon
1818919JDHCPD core dumps in tcp_io_reader may be seen on ALQ setups when subscriber synchronization happens
Product-Group=junos		DHCP ALQ (Active Leasequery) Sessions go down due to core dumps in JDHCPD (Juniper DHCP Daemon). These JDHCPD core dumps in tcp_io_reader may be seen on ALQ setups when subscriber synchronization happens after the TCP (Transmission Control Protocol) connection comes up.
PR NumberSynopsisCategory: Flow Module
1817211On SRX Series devices, when using IPv6 Multi-path BGP with MX configured with EVPN, transit SFW traffic experiences packet drops during IPv6 Neighbor discovery refresh.
Product-Group=junos		On SRX Series devices, when using IPv6 Multi-path BGP with MX configured with EVPN, transit SFW traffic experiences packet drops during IPv6 Neighbor discovery refresh.
PR NumberSynopsisCategory: Platform infra to support jvision
1817967Product annotation missing for sensors for specific platforms
Product-Group=junos		Product annotation files with correct product support/exclude information for specific sensors with respect to platform MX, PTX and EX92XX products. Request customer to enable CLI "set services analytics product-path-check no-path-check" configure to override product annotation issue.
PR NumberSynopsisCategory: Protocol Independant Multicast
1819741PIM Prune is not sent to upstream
Product-Group=junos		With RPF-vector TLV PIM prune message might not be sent out of upstream interface when corresponding prune message received from last downstream interface (i.e. S, G state needs to be removed).
PR NumberSynopsisCategory: RPD route tables, resolver, routing instances, static routes
1807037BGP backup routes are installed as primary routes after enabling 'protect core' feature
Product-Group=junos		On all Junos and Junos OS Evolved platforms when Border Gateway Protocol (BGP) multipath is enabled for Layer 3 Virtual Private Network (L3VPN) routes and 'protect core' is enabled on the Virtual Routing and Forwarding (VRF) instance, the backup BGP path is installed as primary path. The Next hop weight value is not updated correctly, it is weight 0x1 instead of weight 0x4000 for the backup.
PR NumberSynopsisCategory: MPC7/8/9 chassis issues
1814801Faulty MPC8 or MPC9 line cards can lead to spontaneous chassisd crash on certain Junos MX platforms
Product-Group=junos		On Junos MX2008, MX2010, MX2020 platforms, if a faulty MPC8 or MPC9 line card is present in the chassis, chassisd process may crash and triggers routing-engine switchover.
PR NumberSynopsisCategory: ZT/YT pfe infra issues
1817609Interface Connectivity issue with MPC10E on Member 1, Slot 0 in MX Virtual Chassis
Product-Group=junos		On all Junos in MX-Virtual-Chassis (MXVC) setups involving MPC10E Flexible PIC Concentrators (FPCs) on member #1 in slot #0 causes incorrect interface number conversion, leading to all interfaces being down on this FPC. This problem affects any MXVC configuration with MPC10 FPCs positioned in this slot.
PR NumberSynopsisCategory: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1788669Traffic drop due to mac-validate failure on MX platforms
Product-Group=junos		On Junos MX platforms, when subscriber management is enabled and mac-validate is configured on interfaces, traffic drop is seen while attempting to add a new link to an existing AE (Aggregate Ethernet) bundle from a different FPC.
PR NumberSynopsisCategory: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1826666The console login no longer works after software upgrade when having "system services ... authentication-order ..." configuration stanza
Product-Group=junos		With the "system services ... authentication-order ..." configuration stanza, the console login will no longer work. See also TSB85280 [juniper.net].
PR NumberSynopsisCategory: UI Infrastructure - mgd, DAX API, DDL/ODL
1821845The system scripts refresh will fail when using load CLI option
Product-Group=junos		On all Junos and Junos OS Evolved platforms when the 'edit system scripts' hierarchy configuration is changed using loading a configuration from a file or the terminal using 'load' option, the scripts refresh will fail.
PR NumberSynopsisCategory: web filterig issues
1806786UTM Web filtering does not work for HTTPS traffic sent from Google Chrome browser or MS Edge v124
Product-Group=junos		On SRX platforms, Unified Threat Management (UTM) web filtering does not work for Hypertext transfer protocol secure (HTTPS) traffic sent from Google Chrome browser or MS Edge v124.
 
 

23.4R2-S1 - List of Known issues 

PR NumberSynopsisCategory: SRX1600 MACsec
1812427Macsec do not work when interface is transparent mode
Product-Group=junos		MACSec is supported in routing mode but not in transparent mode.

Resolved In:
PR NumberSynopsisCategory: EVO L2 Control Plane PRs
1817677MX and ACX platforms running Virtual Extensible LAN Multi Protocol Label Switching (VX-LAN MPLS) in Data Center Interconnect (DCI) stitching environments will experience catastrophic traffic disruption
Product-Group=junos		On Junos OS and Junos Evolved MX and ACX platforms with VX-LAN symmetric route stitching between data center networks enabled the Control Word (CW) flag changes will trigger catastrophic behavior and traffic disruption in the Packet Forwarding Enginee (PFE)

Resolved In: evo:24.2R2-EVO evo:24.4R1-EVO junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: to track infrastructure replication bugs
1754351vmcore on device with evpn-vxlan configs
Product-Group=junos		Graceful Routing Engine Switchover (GRES) not supporting the configuration of a private route, such as fxp0 , when imported into a non-default instance or logical system. Please see KB https://kb.juniper.net/InfoCenter/index?page=content&id=KB26616 [juniper.net] resolution rib policy is required to apply as a work-around

Resolved In:
PR NumberSynopsisCategory: Flow Module
1798672Packet drops on Inter Chassis Datapath (ICD) link in Multinode High Availability (MnHA) configuration
Product-Group=junos		On all SRX platforms with Multinode High Availability (MnHA) configuration, some packets will be dropped when traffic traverses the Inter Chassis Datapath (ICD) link.

Resolved In: junos:24.2R1 junos:24.3R1
PR NumberSynopsisCategory: IPSEC/IKE VPN
1804965Traffic loss for VPN going down due to inconsistency between the VPN configuration in the iked and the service-redundancy-group database
Product-Group=junos		On certain SRX platforms using iked (Internet Key Exchange Protocol Daemon) with IPsec (Internet Protocol Security) and MNHA (Multi-Node High Availability) configured, traffic loss can occur when the VPN (Virtual Private Network) service-redundancy-group becomes active and there is a configuration mismatch between the iked and ikemd (Internet Key Exchange Protocol Management Daemon) services. This issue arises if the reconciliation process takes over 5 minutes and the VPN service-redundancy-group switches to backup before completing the reconciliation, especially with a high number of VPN tunnels (up to 16, 000) and VPN IKE traceoptions set to the highest level.

Resolved In: junos:22.4R3-S4 junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: Security platform jweb support
1810991Display issue is observed when range option is used to configure destination/source port range in custom application
Product-Group=junos		On Junos SRX platform, J-web shows error message "The maximum length for this field is 9", when range option is used to configure destination/source port range in custom application and if the value is more than 10 characters.

Resolved In: junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: Layer2 forwarding on EX/NTF/PTX/QFX
1816049MAC addresses learnt on interfaces part of VLAN with MAC limiting by interface and "drop-and-log" action configured are cleared after VLAN description is changed
Product-Group=junos		On all Junos and Junos Evolved platforms, when "set vlans switch-options interface-mac-limit packet-action drop-and-log" is configured, changing the Virtual Local Area Network (VLAN) description will cause flush of Media Access Control (MAC) addresses learnt on the interfaces part of the VLAN and traffic impact

Resolved In: evo:21.4R3-S9-EVO evo:22.2R3-S5-EVO evo:22.4R3-S4-EVO evo:23.2R2-S2-EVO evo:23.4R2-S2-EVO evo:24.2R1-S1-EVO evo:24.2R2-EVO evo:24.4R1-EVO junos:21.4R3-S9 junos:22.4R3-S4 junos:23.2R2-S2 junos:24.2R1-S1 junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: PTX1000 platform
1653316Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition (CVE-2024-21600)
Product-Group=junos		An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/JSA75741 [juniper.net] for more information.

Resolved In: junos:18.2X75-D67 junos:19.1R3-S11 junos:19.2R3-S8 junos:19.3R3-S9 junos:19.4R3-S11 junos:20.2R3-S7 junos:20.3R3-S6 junos:20.3X75-D36 junos:20.3X75-D41 junos:20.4R3-S8 junos:21.1R3-S4 junos:21.2R3-S6 junos:21.2X32-D10 junos:21.3R3-S3 junos:21.4R3-S5 junos:22.1R2-S2 junos:22.1R3 junos:22.2R2-S1 junos:22.2R3 junos:22.3R1 junos:22.4R2 junos:22.4R3
PR NumberSynopsisCategory: MX Timing software
1738532[Clocking Solution]:MX480:PTP state went to Freerun and acquiring upon SyncE ESMC is disabled/downgraded from GM or the upstream node one hop above the parent node
Product-Group=junos		PTP state went to Freerun and acquiring before phase-aligning again when the SyncE ESMC is disabled or downgraded from GM or the upstream node one hop above the parent node

Resolved In:
PR NumberSynopsisCategory: KRT Queue issues within RPD
1805427The rpd process crashes during rpd restart on Junos and Junos Evolved platforms
Product-Group=junos		This is a timing issue during the restart of rpd. When a new rpd comes up, during bulk-sync, the flagged entries are getting deleted later at kernel, which will not be notified to RPD (master rpd), so RPD is unaware of this delete and holds this entry in DBs, which leads to non-sync between kernel and rpd process.

Resolved In: evo:24.2R2-EVO evo:24.4R1-EVO junos:24.2R1 junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: Track usability related J-Web PR, like UI layout, workflow
1823264J-Web: Unable to Define NAT Policy Address Names Containing Dots or Slashes
Product-Group=junos		On all SRX Junos platforms, unable to add/edit any field in NAT policy from J-Web if destination address name '.' dot or '/' slash.

Resolved In: junos:21.4R3-S9 junos:22.4R3-S4 junos:23.2R2-S2 junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: SRX branch platforms
1811858Monitored-Status keeps Up after CTL link down in branch model SRX HA
Product-Group=junos		After CTL link down, Monitored-Status in "show chassis cluster interfaces" keeps showing "Up" state.

Resolved In: junos:23.2R2-S2 junos:24.2R2 junos:24.3R1
PR NumberSynopsisCategory: MPC7E, MPC8E and MPC9E timing and synchronization
1791949[MX] Configured queue is not honored for outbound PTP traffic
Product-Group=junos		Configured queue is not honored for outbound PTP traffic. Instead packets go out on queue 0 or network control queue 3

Resolved In: evo:24.2R1-EVO evo:24.3R1-EVO junos:21.2R3-S8 junos:23.4R2 junos:24.2R1 junos:24.3R1
PR NumberSynopsisCategory: usf ams related issues
1804616NSD validation failure results into upgrade failure for Junos MX platforms
Product-Group=junos		On Junos MX240, MX480, MX960 platforms, the Network Security Daemon (nsd) validation fails during upgrades.

Resolved In: junos:21.4R3-S9 junos:22.4R3-S4 junos:23.2R2-S2 junos:24.2R2 junos:24.3R1