Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

17.3R3-S3: Software Release Notification for Junos Software Service Release version 17.3R3-S3

0

0

Article ID: TSB17512 TECHNICAL_BULLETINS Last Updated: 05 Mar 2020Version: 2.0
Alert Type:
SRN - Software Release Notification
Product Affected:
ACX, EX, MX, NFX, PTX, QFX, VMX, VRR
Alert Description:
Junos Software Service Release version is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts
Solution:

Junos Software service Release version 17.3R3-S3 is now available.

17.3R3-S3 - List of Fixed issues

PR Number Synopsis Category: DCHP
1369785 MAC move might occur in DHCP security scenario.
 
On EX4300/EX4600/QFX Series switches except QFX10000, with DHCP security enabled, if the DHCP packets from DHCP clients are received from the DHCP snooping trust interface (by default, all trunk ports on the switch are trusted), such packets might be sent back on the same interface, resulting in the MAC move of the source MAC on the other L2 devices.
PR Number Synopsis Category: EX4300 PFE
1376804 ECMP route installation failure with log messages like unilist install failure might be observed on EX4300 device
 
On EX4300 devices with two ECMP interfaces, if multiple iteration happens for one interface link goes down/up, stale ECMP entries might not be deleted and still be seen in hardware due to the next-hop delete failure and unilist install failure.
1392082 EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVE-2019-0048)
 
On the EX4300 Series, when a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail (CVE-2019-0048); Refer to https://kb.juniper.net/JSA10942 for more information.
PR Number Synopsis Category: Marvell based EX PFE L3
1376057 Traffic black-hole with indirect next hop and load balancing
 
On EX4300/EX4600/QFX Series switches except for QFX10000, pass-through traffic might be dropped if using multiple routes with indirect next hop and load balancing.
PR Number Synopsis Category: EX9200 Control Plane
1316272 Replace "show vlans evpn" command to "show ethernet-switching evpn " command for EX92xx and QFX
 
"show ethernet-swtching evpn" command used in EX92xx and QFX is now replaced with "show vlans evpn " command.
PR Number Synopsis Category: EX9200 Platform
1364246 FPM board status is missing in SNMP MIB walk result.
 
On EX9xxx, or MX240/480/960 platforms with FPM board, FPM board status is missing in SNMP walk result.
PR Number Synopsis Category: HW Board, FPGA, CPLD issues
1372041 PFE is in a bad state after performing optics insertion/removal on a port.
 
On QFX5000 Series platforms, performing optics insertion/removal on a port might result in the PFE Manager CPU spike and eventually microcode failure.
PR Number Synopsis Category: QFX L2 Protocols Control Plane related
1390573 The vmcore might be seen when routing changes are made on the peer spine in an EVPN-VXLAN scenario.
 
On all QFX-Series platforms with a standard EVPN VXLAN scenario, when the eBGP is used for underlay and iBGP for the overlay, the OSPF neighborship is established between two IRBs on the spines, upon exporting OSPF routes on any of the spines, as a result, a routing loop might occur on the spine once it receives the OSPF route update and causes the Routing Engine to have a kernel crash with a vmcore generated on the peer spine.
1394380 L2ALD core seen when l2-learning traceoptions were enabled.
 
L2ALD core may be seen when l2-learning traceoptions are enabled. This occurs due to a race condition when l2ald log file is getting rotated and simultaneously l2ald trying to write a new trace log message. Issue may not get reproduce easily.
PR Number Synopsis Category: QFX PFE CoS
1354377 The packets with destination-address 224.0.0.0/4 cannot be matched by loopback filter
 
Firewall filter cannot filter packets with DstIP as 224/4 and DST MAC = QFX_intf_mac on loopback interface using a single match condition for source address 224.0.0.0/4.
PR Number Synopsis Category: QFX PFE L2
1354889 Storm control configuration may be disabled for the interface
 
When QFX5100 is initialized, in rare condition, if storm control is configured on the interface, it might not work as expected. The traffic levels will not be monitored and the unknown unicast packets will not be dropped.
1354889 Storm control configuration may be disabled for the interface
 
When QFX5100 is initialized, in rare condition, if storm control is configured on the interface, it might not work as expected. The traffic levels will not be monitored and the unknown unicast packets will not be dropped.
1377521 DHCP Discover packets might be dropped if there is VXLAN configured
 
On QFX5000/EX4600 platforms, if changing an interface from Virtual Extensible Local Area Network (VXLAN) to a member of an Aggregated Ethernet (AE) interface, the Dynamic Host Configuration Protocol (DHCP) relay would not work and the DHCP client would not get IP address normally.
1397229 QFX5k - symmetric hash
 
This fix allows to configure the hash function such that packets belonging to the same flow receive the same hash in back and forward direction. This is a requirement when state-based applications are connected via link/LAG bundles to the device which require that both traffic directions of the same flow is being forwarded on the same physical interface to operate properly. To enable symmetric hashing configure: "set forwarding-option enhanced-hash-key no-incoming-port"
1398251 On QFX5K platforms, the DCPFE process might core-dump on interface specific events
 
On QFX5K platforms, the DCPFE process might core-dump on interface specific events due to a deadlock situation between the pfeman thread and the linkscan thread that causes the watchdog event to trigger.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1367584 When VRF fallback is enabled, running "show pfe route ip hw lpm" may crash the switch
 
When VRF fallback is enabled, running "show pfe route ip hw lpm" may crash the switch
PR Number Synopsis Category: QFX PFE MPLS
1362936 QFX5210: MPLS LSP ingress statistics not incrementing / zero
 
Statistics of transit traffic does not increment LSP statistics signaled by RSVP-TE.
1390445 LSP "statistics" and "auto-bandwidth" functionality may not take effect with single hop LSPs
 
In an Multiprotocol Label Switching (MPLS) scenario, label-switched path (LSP) "statistic" and "auto-bandwidth" functionality may not take effect with single hop LSPs on QFX10000 platform.
PR Number Synopsis Category: Accounting Profile
1392550 The filter counter is not written to the accounting file when accounting is enabled on the bridge firewall filter.
 
Whenever bridge firewall filter is configured and accounting is enabled on it, the filter counter is not written to the accounting file.
1452363 The pfed might crash and not be able to come up on the PTX or TVP platforms
 
The flow label statistics are retrieved periodically by pfed for PTX or TVP platforms, if the statistics reply becomes very big number, the pfed might crash hence affecting traffic.
PR Number Synopsis Category: ACX Interfaces IFD, IFL, vlans, and BRCM init
1328207 Port XE-0/3/0 did not turn UP
 
The EEPROM contents were not read properly when 1gig SFP was plugged into a 10gig mic. Therefore a check is done to see if the contents are read properly or not.
1393947 [ACX] MTU is not properly applied - and output of - ping mpls l2circuit sweep is giving lower values than expected
 
On ACX1x00/ACX2x00/ACX4x00 the MPLS MTU value is derived from the INET family MTU.
PR Number Synopsis Category: ACX Services feature
1393729 Certain builds of Junos OS do not allow you to upgrade or commit configuration changes when the SI service interface is used.
 
Certain builds of JUNOS do not allow you to upgrade or commit config changes when the SI service interface is used. 17.2R3, 17.4R2, 18.1R3, 18.2R2, 18.3.R1, 16.1R8, 16.2R3 are known to encounter this issue.
PR Number Synopsis Category: "agentd" software daemon
1326366 Executing "commit full" might cause disconnection from Streaming Telemetry
 
In streaming telemetry scenario, when performing "commit full", the na-grpd daemon might restart, causing disconnection of streaming telemetry.
1390740 An incorrect error message might be seen when Jflow sensors are configured with reporting rate less than 30 seconds.
 
On all TVP platforms for QFX devices (QFX10000, QFX5100, QFX5200 platforms), when Jflow sensors are configured with reporting rate less than 30 seconds, the error message was incorrect.
1394927 WITHDRAWN: Junos OS: gRPC hardcoded credentials may allow unauthorized access to systems with Junos Network Agent installed (REJECTED)
 
NO RISK. CVE REJECTED. 04-11-2019: Further investigation has determined that this issue has no impact. While the credentials exist in affected releases there is no way to exploit this issue, and even if the issue were exploitable, there would be no impact. Refer to https://kb.juniper.net/JSA10923 for more information.
PR Number Synopsis Category: MPC Fusion SW
1350098 The MPC might crash when the MIC is removed.
 
When the MIC is removed from the MPC, the MPC might crash.
PR Number Synopsis Category: access node control protocol daemon
1405318 Configuration load override or load replace resets ANCP neighbors.
 
In ANCP (Access Node Control Protocol) scenario, if executing configuration load override or replace, after the commit operation, All ANCP neighbour sessions might be restarted, even though without any ANCP configuration change.
PR Number Synopsis Category: MX Layer 2 Forwarding Module
1377749 In EVPN A-A scenario with an MX Series or EX Series device acting as a PE device,flood next hops to handle BUM traffic may not get created or miss certain branches when the configuration is performed in a particular sequence.
 
In EVPN A-A scenario with MX or EX acting as PE device,flood NHs to handle BUM traffic may not get created or miss certain branches when the configuration is performed in a particular sequence
1388454 The LSI binding for the IPv6 neighbor is missing.
 
On ACX, EX, MX, QFX and Virtual Chassis Fabric platform, if irb interface is configured under VPLS instance, after switchover the lsi binding for the IPv6 neighbor might be missing.
PR Number Synopsis Category: MX SCB software
1399744 No Alarm was generated when FPC connected to master RE via backup RE/CB
 
The fix produces alarm on the RE if the communication from RE to one or more FPC is failed through primary interface and establishes the communication via backup RE.
PR Number Synopsis Category: BBE Autoconfigured DVLAN related issues
1359520 The IPv6 subscriber may fail to access network
 
The IPv6 subscriber may not be authenticated successfully and fail to access network because of missing attributes (agent-circuit-id & agent-remote-id) for radius-access-request packets if they are the needed parameters for radius authentication.
1386662 In subscriber management environment, DHCP subscriber might get stuck in terminated state.
 
In subscriber management environment DHCP Subscriber might get stuck in terminated state, if If SDB was unavailable during the dvlan session is logging out, an SDB failure can occur. When that error happens, the processing for that session is stalled, leaving the dvlan stranded.
PR Number Synopsis Category: BBE dynamic profile related issues
1391562 The bbe-smgd process might crash after commiting configuration changes.
 
In enhanced subscriber management environment, the bbe-smgd process might crash after commiting config changes, especially when some parts of the dynamic-profiles are modified.
PR Number Synopsis Category: BBE GRES related issues
1375070 Few L2BSA subscribers might be stuck in init/terminating/terminated status after previous logout.
 
On MX platforms with Access Node Control Protocol(ANCP) triggered dynamic L2 subscriber management (L2BSA Service) scenario, if scaled L2BSA subscribers (e.g. 20K) login and logout repeatedly, together with other stressful operations, e.g. Graceful Routing Engine Switchover(GRES), some daemon restart (e.g. bbe-smgd, authd, dfwd, cosd, etc.), or Flexible PIC Concentrator(FPC) reboot, few L2BSA subscribers might be stuck in init/terminating/terminated status due to this issue. These affected subscribers can't login again after previous logout.
PR Number Synopsis Category: BBE interface related issues
1403480 Smg-service could become unresponsive when doing some GRE-related CLI operations.
 
On BNG (Broadband Network Gateway) or subscriber scenario, when doing GRE related CLI operations and config commit, smg-service could become unresponsive and the bbe-smgd core might happen. The effect detail depends on if there is a crash and what is happening during a crash. Generally it would not cause a crash, but if the resulting concurrent access occurs, it might lead to a crash, thus the bbe-smgd would restart and restore state. In the meantime the service might be affected but it would be temporary.
PR Number Synopsis Category: BBE multicast related issues
1374530 The bbe-smgd might crash continuously in centralized IGMP scenario.
 
In enhanced subscriber management scenario with centralized IGMP configuration, after the last subscriber of a multicast group leaves that group and in some rare cases the bbe-smgd could not delete the multicast group node from the tree, this insistent state of the node causes the bbe-smgd process to restart. However, when the bbe-smgd restarts in init phase, it would try to delete that multicast node again, this inconsistent state results in bbe-smgd restarting again, so the bbe-smgd could never come out of the init phase and it restarts continuously.
1384491 Multiple bbe-smgd core files with reference to bbe_mcast_vbf_dist_policy_service_encoder( ).
 
When commit, any changed policy was being pushed to PFE even if the policy is not used (installed in the PFE). This caused bbe-smgd process to restart unexpectedly at the bbe_mcast_vfb_dist_policy_service_encoder() routine.
PR Number Synopsis Category: BBE network stack related issues
1388595 The bbe-smgd might not respond to the NS message for the SLAAC client on dynamic VLAN.
 
On all MX-Series with dynamic VLAN and NDRA deployment for the subscriber access, the SLAAC (Stateless Address Autoconfiguration) client might not get the gateway MAC address from the BNG (Broadband Network Gateways), as a result, the SLAAC client will not get a link-local prefix and the IPv6 global connectivity will not be established.
PR Number Synopsis Category: BBE OS Infrastructure library
1414333 DHCP/DHCPv6 subscribers might fail to establish sessions on PowerPC based MX platforms
 
On MX5/10/40/80/104 platforms running with Dynamic Host Configuration Protocol version 4/version 6 (DHCPv4/v6) subscribers, if large-scale subcribers (e.g. around 3500 in total) try to establish sessions simultaneously from multiple access interfaces, the DHCPv4/v6 sessions might always fail to set up due to this issue. As a result, the session set up rate would be much lower than expected.
PR Number Synopsis Category: BBE state synchronization issues
1380231 The Routing Engines might crash with various core files due to the deadlock issue on the SDB STS.
 
In the system that uses session database (SDB), the deadlock might happen when getting the lock on the SDB short term storage (STS) due to a rare timing issue. It is more likely to happen on Enhanced Subscriber Management environment with large-scale subscribers (such as 50k subscribers). The issue will cause the master Routing Engine (RE) to crash with various core files and lose the management connectivity. And the subscriber service could be affected. The issue might happen on single RE system as well as dual RE system. In the dual RE system, the master RE crash could trigger a RE switchover. But the issue could cause the incomplete state on the SDB in the new master RE, which could cause the subscribers login failure. A restart of smg-service on the new master RE will recover this login issue.
PR Number Synopsis Category: Border Gateway Protocol
1391084 Race condition causes all the BGP sessions to flap after NSR switchover
 
With GRES and NSR enabled, if executing switchover, in very rare cases, all the BGP session might flap because of a race condition.
1391767 Non-BGP protocol route with an AS PATH might cause inappropriate route selection
 
Rpd's route selection mechanism has multiple user-configurable mechanisms by which route ordering may be changed. To assist with debugging issues with defects in the route selection code, a function would generate a low priority soft core that didn't crash rpd when route selection was incorrect. However, there have been circumstances wherein not-best was incorrectly being determined. One such situation that is addressed in this PR involves when routes are learned or redistributed from non-BGP protocols and had an AS_PATH attribute. Using BGP route selection rules, if a BGP route and a non-BGP route had a leading AS_PATH with the same AS, BGP MED selection rules for grouping were being applied. Such MED election should only be done using BGP-only routes. Such a situation can come from various BGP carried VPN protocols wherein routes from the VPN protocol generated IPv4 routes when redistributed from one routing instance to another. An example of this would be an EVPN route.
1395098 The best and the second-best routes might have the same weight value if BGP PIC is enabled
 
In BGP PIC (Prefix Independent Convergence) scenario, next-hop of unequal BGP multipath routes might have the same weight (0x1), resulting in unexpected load balance for traffic.
1398685 The rpd soft core files and inappropriate route selection might be seen when Layer 2 VPN is used
 
The rpd provides a mechanism to validate that route selection has successfully been done. When errors in route selection are detected, a soft core is dropped: the rpd remains running, a single core file is dropped, it is rate limited to not do this frequently. When running L2VPN, BGP MED selection may be inappropriately run on the routes. As a result, a soft core is created, and features that rely on skipping such routes such as BGP add-paths, may advertise an alternate path that is inappropriate.
1398700 The process rpd might crash in BGP setup with NSR enabled.
 
The routing protocol daemon (rpd) may restart when BGP teardown a peer when the peer's "prefix-limit" is exceeded. This issue is applicable when the "non-stop-routing" feature is configured.
1399141 Junos OS: BGP packets can trigger rpd crash when BGP tracing is enabled. (CVE-2019-0019)
 
Junos OS: BGP packets can trigger rpd crash when BGP tracing is enabled. (CVE-2019-0019); Refer to https://kb.juniper.net/JSA10931 for more information.
1400838 EX4300 might drop incoming ISIS hello packets when IGMP or MLD snooping is configured.
 
On EX4300 platform, when IGMP or MLD snooping is enabled, and ESIS/ISIS packets with below destination multicast mac-address are received, ESIS/ISIS packets are not flooded. It would cause ISIS adjacency establish failure. The MAC-level point-to-point addresses are: 09-00-2B-00-00-04 (AllEndSystems) 09-00-2B-00-00-05 (AllIntermediateSystems)
PR Number Synopsis Category: BBE Remote Access Server
1374295 Address pool does not correctly cycle to the beginning of the pool when linked-pool-aggregation parameter is defined
 
In subscriber scenario, when "linked-pool-aggregation" is enabled on MX platform and standalone IPv4/IPv6 pool is in use, the address pool might not cycle to the beginning of the pool and it might report "Out of Addresses" even though not all addresses are in use.
1376265 The subscribers might be stuck in terminating state if RADIUS redirect is used.
 
On MX-Series platforms that act as a Broadband Network Gateway (BNG), the subscribers might be stuck in terminating state if radius redirect is used during the Session Database (SDB) synchronization.
1382074 The value of 'predefined-variable-defaults routing-instances' overrides the RADIUS-supplied VSA (26-1 Virtual-Router)
 
If the default value for the $junos-routing-instance predefined variable is configured (i.e. 'dynamic-profiles <> predefined-variable-defaults routing-instances <>'), the subsciber will come up in the configured default routing-instance even if RADIUS has already supplied the VSA of '26-1 Virtual-Router'.
1384599 Log Message: authd: gx-plus: logout: wrong state for request session-id
 
When a Subscriber is Manually Logged out using CLI "clear network-access aaa subscriber username ", Following Log Message gets Printed (messages file) in process of when GX-Plus Module is Clearing/Freeing up the Subscriber Session-id from its Table. Aug 28 12:11:50 jtac-test-node: authd [XXXX]: %DAEMON-3: gx-plus: logout: wrong state for request session-id:
1391411 Usage-Monitoring-Information AVP might activate service accounting.
 
Usage-Monitoring-Information AVP as part of PCRF gx-plus provisioning is causing service accounting activation.
1403835 JSRC used Radius Service accounting protocol instead of JSRC for SRC installed service
 
JSRC provisioned service used Radius Service accounting protocol instead of JSRC for SRC installed service
PR Number Synopsis Category: MX Platform SW - Environment Monitoring
1395539 The minor alarm of "Bottom Fan Tray Pred Fail" might be wrongly raised when the fan speed is at high speed on MX960
 
On the MX960 a check of the "actual" fan speed is compared to the "set" fan speed. If the difference between the actual fan speed and the set fan speed is greater than 20% the system uses this to predict that the fan might be about to fail. When the fans are set to run in high speed mode, some deviation from the set fan speed is expected to occur with the fans and it is expected to sometimes see a deviation greater than 20%. Going forward this 20% tolerance check will be disabled while running in high speed mode.
PR Number Synopsis Category: MX Platform SW - FRU Management
1375242 SFB and PDM/PSU related information is missing in jnxBoxAnatomy MIB on high end MX Series routers (MX2010/2020).
 
SFB and PDM/PSU related info is missing in jnxBoxAnatomy MIB on high end MX routers (MX2010/2020).
PR Number Synopsis Category: Virtual-chassis platform/chassisd infrastructure PRs for MX
1391011 Interim accounting updates might not be sent for subscribers after Junos OS selective update
 
On MX/MXVC platforms enabled with enhanced subscriber management, if Graceful Routing Engine Switchover (GRES) and Nonstop active Routing (NSR) are disabled, when the chassisd process is going to restart (which is resulted from Junos Selective Update), the system will make the transition of Routing Engine (RE) mastership from master to standby before the chassisd process restart. Due to this issue, the new standby RE didn't reboot as expected, which causes the pfed process being passive for 15 minutes. During the 15 minutes, all the interim accounting update will not sent for all the subscribers who login during this time range.
PR Number Synopsis Category: PTX Chassis Manager
1301835 In JVision setup, the payload MTU(maximum transmission unit) might be much less than 16KB when subscribing to component sensor
 
RE sensors have a payload MTU of 16KB per packet, however 2.6KB is seen in JVision setup when subscribing to component sensor.
1315672 Memory leak in chassisd daemon might be noticed while streaming telemetry subscriptions are active
 
Memory leak in chassisd daemon is noticed while streaming telemetry subscriptions are active.
PR Number Synopsis Category: MX Platform SW - ukern core dumps
1273353 Flexible PIC concentrator (FPC) crash/reboot is observed when bringing up about 12K Layer 2 Bit Stream Access(L2BSA) subscribers simultaneously.
 
In an L2BSA scaling scenario, after bringing up about 12,000 subscribers, one or more FPCs will reboot.
PR Number Synopsis Category: Class of Service
1375189 The 802.1P rewrite might not work on inner VLAN.
 
If a logical interface (IFL) is configured with 802.1P rewrite-rules (for both outer and inner VLAN) and fixed classification, after deactivating Class of Service (CoS) on any other IFL, the packets sent from this IFL may still have the original 802.1P bit set in the inner VLAN without being rewritten.
1403147 The cosd process might crash during committing configuration change through NETCONF.
 
If excess-priority is configured, the cosd process might crash during committing configuration change which includes assigning CoS profile on any logical interface via netconf.
PR Number Synopsis Category: Enhanced Broadband Edge support for cos
1405876 FPC crash might be seen when adding or deleting a leg to an AE bundle or FPC restarts in subscriber scenario
 
In subscriber scenario, when using AE bundle with active subscribers and the AE bundle is configured with a lot of interfaces within one interface-set, FPC might crash if adding a leg to an AE bundle or an existing leg is replayed (after FPC restarts). It is a timing issue. In detail, this issue happens in two scenarios. The first one is "a leg is added to an AE bundle". That can cause a FPC crash as the device may perform a long walk to install schedulers on all legs. The second one is 'a line card rebooting'. After FPC reboot, the bundle is updated locally on that line card as it is populated with all of the existing state. In this case a long walk would also be performed and FPC crash might be seen.
1422542 The CoS IEEE-802.1 classifier might not get applied when it is configured with service activation on underlying interface.
 
In a subscriber management environment, the Class-of-Service (CoS) ieee-802.1 classifier might not get applied when it is configured with service activation on underlying-interface. Instead, the default IP Precedence classifier would be applied.
PR Number Synopsis Category: QFX Access Control related
1363964 On EX4300/EX4600/QFX3500/QFX3600/QFX5000 platforms, the l2ald process might crash in dot1x scenario
 
On EX4300/EX4600/QFX3500/QFX3600/QFX5000 platforms, during any client's dynamic VLAN membership creation in a dot1x scenario, the l2ald process might crash.
PR Number Synopsis Category: Device Configuration Daemon
1322678 Subscribers might fail to access the device after deleting the needless aggregated Ethernet configuration.
 
In subscriber management scenario with Dynamic Demultiplexing Interfaces(DEMUX) configured, in the case where subscribers belonging to one AE interface are migrated to a new configured AE interface, subscribers may fail to access the device after deleting the old AE configuration.
1336455 Momentary traffic loss might happen when a GRES is performed.
 
Momentary traffic loss might happen when performing GRES. The traffic lost last about 10 sec. After that, it works normally.
1369757 Constant dcpfe process crash might be seen if using an unsupported GRE interface configuration
 
On QFX platform, if configuring GRE interface and its underlying tunnel source interface in two different routing instances, although this is a limitation, but the configuration can be committed and will cause constant dcpfe process crash.
1373927 JDI-RCT: QFX5200 MCLAG: parse_remove_ifl_from_routing_inst() ERROR : No route inst on et-0/0/16.16386, errors seen after restart l2cpd daemon
 
JDI-RCT: QFX5200 MCLAG: parse_remove_ifl_from_routing_inst() ERROR : No route inst on et-0/0/16.16386, errors seen after restart l2cpd daemon
1376216 Race condition during Routing Engine mastership transition might cause improper deletion/recreation of logical interface em0.0 Interface family address.
 
Race condition during RE mastership transition may cause improper deletion/recreation of IFL em0.0 Interface family address. This may impact master Routing-engine communication to other FRU/Routing-engine via the Juniper private routing-instance resulting in un-stable state of the router in GRES environment.
1387962 DCD core files can be seen after FPC restart if channelized interfaces are configured.
 
If channelized interface coc1 is configured and FPC restart is performed then a core will generate and DCD restart can be seen. Currently we do not have any workaround for this issue. In case of all other interfaces core will not generate and normal behavior is seen.
1425339 The logical interfaces in EVPN routing instances might flap after committing configurations.
 
When EVPN (Ethernet VPN) routing instance is created, there is an implicit bridge domain created for this EVPN. After creating another routing instance, the index of the implicit bridge domain created for EVPN is not updated properly in DCD. Therefore, the IFLs in EVPN routing instances might flap. [TSB17573]
1439257 Targeted-distribution for static demux interface over aggregate Ethernet interface does not take correct LACP link status into consideration when choosing primary and backup links.
 
The value of "lacp-port-mode" (or LACP mode on child-links of AE bundle) is always "0", irrespective of whether LACP is turned ON or OFF on AE bundle. Whereas the expectation is that as per the LACP mode (OFF/ACTIVE/PASSIVE) present on AE bundle, the same should be propagated to child-links. Since the lacp mode was not propagated to child links, Device Control Daemon (DCD) used to assign the links to subscribers only based on its physical status. But there were few links which were physically UP but lacp down, so traffic disrupted.
PR Number Synopsis Category: JUNOS Dynamic Profile Configuration Infrastructure
1401148 The framed route beyond the first might not be installed in a DHCP subscriber management environment.
 
In a DHCP subscriber management environment, the framed route beyond the first may not be installed to a subscriber session if receiving it from the radius which has more than one Framed-Route.
PR Number Synopsis Category: dynamic dcd prs
1399184 All dcd operations might be blocked if profile-db is corrupt
 
In 'dynamic-profiles' scenario, if the profile-db is corrupt, all dcd operations are blocked. (e.g., not be able to add any interfaces). The device control process (dcd) is used to control the device's interfaces.
PR Number Synopsis Category: EA chips SW
1388780 Fabric drops might be seen if using a newer generation of MPC with SFB2
 
On MX2020, MX2010 and MX2008 platforms with SFB2 cards installed, if a newer generation of MPC (e.g. MPC type 3, 4, 5, 6, 7, 8 or 9) is installed into a slot which had MPC 3D 16x10GE, MPC type 1 or MPC type 2 previously installed, the available fabric bandwidth to the new MPC card would be rate-limited due to residual programming on the fabric planes. Traffic impact is observed during peak utilization. *** The fix in this PR is not applicable to NG-MPC2E/NG-MPC3E, refer to PR 1417001 for the fix with these cards.
PR Number Synopsis Category: EA ucode SW issues
1350909 PPE Errors async xtxn error when FPC is restart/removal
 
XTXN error seen at FPC restart (with or without impact) needs to be communicated to the customer. As it is not an expected behavior.
PR Number Synopsis Category: Ethernet OAM (LFM)
1365709 In case of MPLS ,DMR packets are sent with different mpls exp bits if MX receives CFM DMM packets with varying exp values on MPLS header
 
When below conditions are met, after traversing through MPLS network, if CFM DMM packets arrive with varying exps value on MPLS header, DMR packets sent with different MPLS exp bit. The varying bit may cause VLAN priority bit viariation, then impact the receiver end, if receiver only matches one particular priority bit. 1/ CFM delay measurement is configured on CE facing AE interface 2/fixed forwarding-class is not configured on interface COS setting.
PR Number Synopsis Category: EVPN control plane issues
1369705 Small rpd memory leak when configuring EVPN.
 
In EVPN scenarios, rpd migh leak small amount of memory. In the long run, rpd might crash and generate a core file due to a memory allocation problem.
PR Number Synopsis Category: EVPN Layer-2 Forwarding
1362598 Type 2 EVPN routes are missing after deactivating/activating protocol evpn
 
Type 2 EVPN routes are missing after the EVPN protocol is deactivated and then reactivated.
1397925 IPv6 link-local address for virtual-gateway address is marked as duplicate in EVPN.
 
In EVPN A-A mode, if the same link-local IPv6 address is configured on both IRB interfaces on the two PEs, DAD will mark one of the IRB interfaces as the duplicate.
1403524 EVPN: In the non-collapsed (centralized) topology, when one of the 2 spines deactivates the underlay protocol (ospf), the leaf still points the virtual-gw-mac's next hop to the down spine
 
In the ECMP path, MAC update should happen when the previously pointed node goes down for a RVTEP. Also the learn_mask was not updated. The issue is fixed in Junos:17.3R3-S3 junos:17.3R4 junos:17.4R3 junos:18.1R3-S2 junos:18.1R3-S3 junos:18.1R4 junos:18.2R3 junos:18.3R1-S3 junos:18.3R2 junos:18.4R2 junos:19.1R1
1432702 Stale MAC addresses are present in the bridge mac-table in EVPN/MPLS scenario
 
In EVPN/MPLS scenario, if many MAC (about 10k) addresses move from remote to local interface, some MAC addresses might never get cleared up from the bridge table due to next-hop is not getting cleared in time within the PFE. So they might remain present in the bridge MAC table even after the aging time (default 300s).
PR Number Synopsis Category: Express PFE CoS Features
1378392 Traffic might be dropped on third-generation FPCs on PTX.
 
On PTX with third-generation FPCs, if optics not certified by Juniper Networks (NON-JNPR) are used and there is specific traffic pattern with congestion, traffic might be dropped.
PR Number Synopsis Category: Express PFE FW Features
1345744 Netconf over SSH traffics get dropped due to DDOS protection
 
On QFX10000/PTX Series platforms, Netconf over SSH traffic via TCP port 830 might hit the host path Queue that is unclassified. This can result in DDoS violations in the unclassified queue.
PR Number Synopsis Category: Express PFE including evpn, vxlan
1387593 Traffic drop might be seen on QFX10K platform with EVPN/VXLAN configured
 
On QFX10K platform configured with Ethernet Virtual Private Network (EVPN) and Virtual Extensible LAN protocol (VXLAN), traffic drop might be seen for the Virtual Tunnel End Point (VTEP) tunnel interface due to this issue. It might also lead to Packet Forwarding Engine (PFE) crash in some rare condition.
PR Number Synopsis Category: Express PFE L2 fwding Features
1383623 DHCP packets may be dropped on a Junos Fusion Data Center scenario (QFX10000 series)
 
In a Junos Fusion Data Center scenario where Satellite Devices (SD) are dual-homed to Aggregation Devices (AD), if the DHCP relay is enabled for at least one IRB and both the DHCP server and clients are connected to ADs over native ports, the discover packets sent from clients which are not using DHCP-relay may be dropped on AD device.
1389411 MAC learning might stop working on some LAG interfaces.
 
On QFX10000 platforms, MAC learning does not work on some LAG interfaces after frequent MAC moves
PR Number Synopsis Category: Express PFE L3 Features
1376366 PFE wedge may be observed if there are interfaces going to down state
 
On QFX10000 or certain PTX series platform, the Packet Forwarding Engine might get wedged if there are too many interfaces (for example, more than 35) with the physical or operational state changing to down, and for which the LACP force-up parameter is enabled, while the administration state is still up.
1393937 IPV6 Next-Hop programming issue might be observed on QFX10K/PTX1K/PTX10K devices
 
On QFX10K/PTX1K/PTX10K devices, when 6PE (the 'protocols mpls ipv6-tunneling' statement) is configured, the IPv6 Next-Hop installation might be incorrect and it might cause IPv6 traffic drop.
PR Number Synopsis Category: Stateful firewall and NAT
1398542 Invalid Layer 4 checksum might be observed on IPv4 packets generated by NAT64 with MS-DPC after translating fragmented IPv6 UDP/TCP packets
 
On MX-Series platforms wherever the MS-DPC or MS-MPC/MS-MIC line card is used, when the router executes the NAT64 translation for the fragmented IPv6 UDP/TCP packets, invalid Layer 4 checksum would be observed on IPv4 packets generated by NAT64. The reason is that during fragmentation the first fragment`s next-header doesn`t point to the L4 information and hence wrong calculation is done at L4 checksum. And due to this invalid checksum, the traffic would be dropped.
1402450 The ICMPv6 packet with embedded IPv6 fragment might not be translated correctly to IPv4 ICMP packet in a NAT64 with MS-DPC deployment
 
On MX-Series platforms with MS-DPC deployed for NAT64, the translation for IPv6 packet to IPv4 packet might not be translated correctly when a node in IPv6 network sends an ICMPv6 Packet Too Big (PTB) message with an embedded ipv6 fragment towards a node in IPv4 network. This results in Path MTU discovery failure.
PR Number Synopsis Category: PTX Express ASIC platform
1393643 third-generation FPC reboot loop because of having internal intf issues
 
new stanza to prevent an FPC having hw issue from periodic bouncing
PR Number Synopsis Category: to track infrastructure replication bugs
1393884 If FPGA on the new master CB has a specific hardware failure, the chassisd might keep crashing after GRES switchover.
 
On MX/EX/SRX platforms, after GRES switchover, if a chassis has bent-pin or failed Field Programmable Gate Array (FPGA) on the new CB has a specific hardware failure and fails to detect FPC presence properly, the chassisd might keep crashing.
PR Number Synopsis Category: Libjtask for RPD tasks, scheduler, timers, memory, and slip
1301849 The rpd might crash by executing the command "show route extensive" during deletion of IS-IS configuration.
 
The rpd might crash by executing the command of "show route extensive" during deleting ISIS configuration.
PR Number Synopsis Category: Software Interfaces 100GE PIC
1375030 "PE Chip:pe0[0]: IPW: oversize_drop error" causes Major error on FPC
 
PTX routers with FPC3s that encounter oversize_drop errors will trigger an FPC Major alarm with each error seen. The alarm should clear on its own. The severity of this alarm is being reduced as there is no lasting impact to the FPC.
PR Number Synopsis Category: Kernel software for AE/AS/Container
1353583 Traffic loss might be seen on new master Routing Engine after the interface flaps followed by Routing Engine switchover in VRRP scenario
 
VRRP MAC filter will not be seen in PFE if interfaces flap followed by GRES, before VRRP state settles down after flap. During this time VRRP state is backup in master-RE and VRRP state is idle in Backup-RE. This issue is only for AE interfaces with VRRP configuration. It's irrespective of VRRP scale. The traffic can be recovered by deactivating/activating the ae interfaces.
1370015 Kernel crash might be seen after committing demux related config
 
In subscriber management scenario, if an AE interface is associated as the underlying-interface of a demux0 unit and both demux0 unit and AE unit (corresponding to the above AE interface) are configured with a duplicated VLAN id, kernel may crash after committing the config. Same core-dump may appear even in a non subscriber-management environment, while adding/modifying an IFL (Any logical link) which has the duplicate VLAN configuration or a bulk configuration.
1373079 The Routing Engine might crash after non-GRES switchover
 
When LAG-enhanced is disabled, one child next hop is created for each member link of a LAG interface. During the Non-GRES switchover, the kernel memory might be exhausted, which leads to the creation failure of the child next hop, hence the Routing Engine crash happens. This crash can be avoided by enabling LAG-enhanced.
1390367 Traffic destined to VRRP VIP gets dropped as filter is not updated to related logical interface
 
On MX platform with enhanced-ip and VRRP configured, if remove/add a child link from AE bundles, traffic destined to VRRP VIP might be dropped.
PR Number Synopsis Category: LSQ
1398445 The backup Routing Engine might get stuck in amnesiac mode after reboot.
 
In the original implementation of inline LSQ (ICHIP), it was not possible to configure the "delay-buffer-rate" knob for buffer adjustment purposes. This restriction is not relevant for Trio family of ASICs anymore. The fix, committed as part of this PR, removes unneeded checks.
PR Number Synopsis Category: ISIS routing protocol
1372937 Route entry might be missing when IS-IS shortcut is enabled and MPLS link flaps.
 
If ISIS shortcut is enabled and ISIS "topologies ipv6-unicast" is configured, when any link with no IPv6 address configured in the MPLS LSP path is flapping (or bring down and then up), the route entry go through this flapping link might be missing for about 10 minutes, which might lead to traffic loss. The issue is because when the flapping link is down and then up, the flash route update checks both IPv4 and IPv6 address family, since IPv6 is not configured for this link, the flash route update is not triggered, hence the route entry is missing.
1394082 RPD core files on backup Routing Engine during neighborship flap when using authentication-key with size larger than 20 character.
 
RPD core on backup routing-engine during neighbor-ship flap when using authentication-key with size larger than 20 character. When using "security authentication-key-chains key-chain <*> key <*> secret <*> " with hmac-sha-1 algorithm and the secret key length is higher than 20 character, this causes memory corruption in RPD and later RPD crashes on backup RE.
PR Number Synopsis Category: ISSU related issues for MMx
1369635 The MPC5E/MPC2E-NG/3E-NG might crash and restart during ISSU
 
With MPC5E/MPC2E-NG/3E-NG and large-scale config along with large amount of traffic causing non-zero stats on multiple queues, when executing ISSU, the ISSU prepare stage might take longer time than usual because PR 1283850 introduced a bug which could cause the stats disable to take longer. As a result, the chassisd triggers restart/crash of the MPC. And The ISSU completes after the crash.
PR Number Synopsis Category: jdhcpd daemon
1329390 Junos core file jdhcpd.core.0 found in dhcpv6_packet_handle is seen
 
jdhcpd JUNOS core with if_cfg is NULL and is being accessed. In JUNOS software we fix the logic to return FALSE in case of bogus input parameters.
1391983 Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVE-2019-0037)
 
Junos OS: jdhcpd crash upon receipt of crafted DHCPv6 solicit message (CVE-2019-0037); Refer to https://kb.juniper.net/JSA10926 for more information.
1432162 The jdhcpd memory leak might happen on MX5, MX10, MX40, MX80, and MX104 when testing DHCP subscribers log-in/out.
 
On MX5/MX10/MX40/MX80/MX104 Series platforms with DHCP server configuration for DHCP subscribers, the jdhcpd memory leak might happen and the memory increase by 15MB which depends on the number of subscribers when testing the DHCP subscribers log-in/out.
PR Number Synopsis Category: jl2tpd daemon
1362542 L2TP Access Concentrator (LAC) tunnel connection request packets may be discarded on LNS device
 
In subscriber management environment where LNS is deployed, if frequently changing the "local-gateway" of an L2TP tunnel on LNS device using "replace" command, the gateway may not be operational and the tunnel connection request packets sent by the corresponding LAC devices (having "remote-gateway" matching the LNS's gateway) may be discarded on LNS device.
PR Number Synopsis Category: jpppd daemon
1370610 MLPPP subscribers might be unable to negotiate sessions when the dynamic-profile name contains more than 30 characters
 
On MX platform which supports dynamic Multi-link Point-to-Point (MLPPP) subscriber, if the dynamic-profile name contains more than 30 characters, MLPPP subscribers might be unable to negotiate sessions with the server, and couldn't login due to this issue.
1405055 The subscriber might not be able to access the device due to the conflicted assigned address.
 
In a subscriber management environment, the subscriber (say, subscriber A) may not access the device (A can get IP address x.x.x.x but then the connection will be terminated), because the address x.x.x.x is previously assigned to another subscriber B and then re-assigned to A before confirming whether the respective access route for address x.x.x.x is removed.
PR Number Synopsis Category: Junos Selective Update infrastructure
1429392 JSU gets deactivated from FPC in case of power cycle
 
Few JSUs (Junos Selective Update), including 16.1R4-S11-J5, might be deactivated from FPC in case of the power cycle. Re-installation of JSU is needed.
PR Number Synopsis Category: PFE infra to support jvision
1361015 FPC core files might be observed after GRES switchover
 
In the dual Routing Engine (RE) platform with telemetry sensor configured. After graceful routing engine switchover (GRES) switchover, flexible PIC concentrator (FPC) core might be observed in the master RE. This issue might impact the device traffic.
PR Number Synopsis Category: Key Management Daemon
1398242 IP ToS bits are not copied to outer IPsec header
 
On MX platform, if Dynamic End Points (DEP) tunnel is configured, IP ToS bits might not be copied from inner header to outer IPSec header.
PR Number Synopsis Category: Layer2 forwarding on EX/NTF/PTX/QFX
1368802 Forwarding broken after adding protocol EVPN extended-vlan-id
 
Traffic will dropp on PFE as "invalid L2 token" when protocol changes from VPLS to EVPN.
1380798 Daemon dfwd might crash with DFWD_TRASHED_RED_ZONE log messages.
 
In certain scenario with OTN options configuration, memory corruption might occur in dfwd (the firewall daemon) due to large IFL (logical interface) ifstate messages. This can lead to DFWD_TRASHED_RED_ZONE messages reported in dfwd log and occasionally dfwd crashes.
1383665 Adjusting mac-table-size configuration might cause l2ald crash.
 
Sometimes L2ald might crash when try adjusting mac-table-size configuration.
1395368 The l2ald process might crash when doing "commit check" for some specific configurations
 
On all Junos platforms, if bridge-domain parameters are defined in routing-instance group and applied to a routing-instance via apply-group, at the same time, the routing-instance type is setting to be "virtual-switch", and no bridge-domain is configured in the routing-instance, the l2ald process might crash during executing "commit check" or "commit" for these configurations. The l2ald process will restart automatically and therefore impact related Layer 2 service. Due to this issue, all the further commits will be blocked until the offending configurations are removed.
PR Number Synopsis Category: L2TP service related issues
1370405 Inline Service interface might not UP when bandwidth is configured.
 
Inline-service interfaces are not getting created with BW=40G after fix of PR1355168.
1406179 The stale si-logical interface might be seen when L2TP subscribers with duplicated prefixes or framed-route log in.
 
If L2TP LNS uses inline service (si) interface and the routing service (such as framed-route) is configured in dynamic-profiles, when subscribers login with duplicated prefixes or framed-route, the LNS will reject the second subscriber due to route adding failure. But the si- IFL for the failure subscriber will be left in PFE as a stale IFL.
PR Number Synopsis Category: lacp protocol
1395943 After GRES switchover, LACP will be down on peer device and never been recovered automatically
 
On VC series platforms, RE switchover will cause LACP down on peer device as the LACP does not sync between master and backup RE.
PR Number Synopsis Category: Label Distribution Protocol
1373575 The traffic might not be load-balanced equally across LSPs with ldp-tunneling configured
 
When there are more than one RSVP LSP toward the same downstream neighbor and more than one such downstream neighbor exist, if one of the interfaces toward one downstream neighbor is brought down, the weight might become unequal for ECMP and then the traffic might not be load-balanced equally.
1405359 The L2circuit information is not advertised over the LDP session if "ldp dual-transport inet-lsr-id" is different from the router-id
 
The L2circuit label mapping is not advertised to the LDP (Label Distribution Protocol) neighbor if "ldp dual-transport inet-lsr-id" is different from the router-id.
PR Number Synopsis Category: Link Management Protocol
1392704 The ppmd on the Routing Engine might run with high CPU utilization after Routing Engine switchover.
 
In the rare case, ppmd on RE might stay high cpu usage after RE master switch event. There will be no impact on this problem.
PR Number Synopsis Category: Multiprotocol Label Switching
1373313 The rpd might crash when executing Routing Engine switchover under BGP environment and route churn occurs
 
On MX/PTX/QFX platforms and in BGP environment, if GRES (graceful Routing Engine switch-over) and NSR (Nonstop active routing) are configured, RPD might crash while performing or after an RE switchover. The reason is that severe route churn events result in multiple cycles of addition/deletion of routes/labels. And due to a software bug introduced in 17.2R1, the labels freed up in the process may not get reallocated when executing RE switchover. As a result, the RPD might crash while trying to allocate a label which has not been freed.
1374102 LSP with auto-bandwidth enabled goes down during HMC error condition
 
On PTX or QFX10K platform, when HMC (Hybrid Memory Cube) error occurs, LSPs (Label Switched Paths) might go down due to incorrect bandwidth requested for auto-bandwidth adjustment.
1382249 The rpd might crash on backup Routing Engine after switchover
 
If vrf-table-label is configured for VRF routing-instance, after executing GRES or ISSU, the VRF table label which is not released may be reused by another VRF. This might cause an rpd core on backup RE.
PR Number Synopsis Category: Multi Protocol Label Switch OAM
1217566 The command of "ping mpls l2circuit" might fail if the flow-label is enabled for l2circuit
 
When Flow-Label (FL) is enabled for PW, the OAM packets are not sent with Flow-Label because RPD is not aware of the Flow-Label values assigned by PFE software. Hence the packets are getting dropped by PFE at the tail-end PE. The remote PE is expecting the packet with FL and PW label.
PR Number Synopsis Category: For multicast snooping on MX
1394213 Multicast traffic might be interrupted in H-VPLS scenario
 
In H-VPLS (Hierarchical-VPLS) with IGMP v2 scenario, if the interface (on Hub-VPLS side to Spoke-VPLS) flaps repeatedly; or remove one or more the VPLS-instances, Spoke will clear the Mroute towards the Hub, which finally causes multicast traffic interrupted.
PR Number Synopsis Category: Multicast for L3VPNs
1315011 Non-optimal route to source might be selected for next-generation MVPN with unicast-umh-election enabled.
 
The configuration knob unicast-umh-election for NG-MVPN (next-generation multicast virtual private network) might not work as expected in special cases. This knob is to use the unicast route preference for UMH (upstream multicast hop) selection. However the non-optimal route might be selected if the routes have the same IP address value in route-import community.
1392792 High rpd CPU utilization on the backup Routing Engine might be observed in MVPN+NSR scenario
 
Under extreme case, Routing process under Backup Routing Engine might be under high utilization upon route updates.
PR Number Synopsis Category: Bugs related to ethernet interface on MX platform
1367224 I2C error logs are seen when configuring wavelength on tunable SFP+.
 
I2C error logs are seen when configuring wavelength on tunable SFP+
PR Number Synopsis Category: Interface related ISSU PRs on Mx-series
1362324 JDI-RCT:M/Mx: Traffic loss of 1% is seen during GRES phase of ISSU from 17.3-20180527.0 to17.3-20180527.0
 
JDI-RCT:M/Mx: Traffic loss of 1% is seen during GRES phase of ISSU from 17.3-20180527.0 to17.3-20180527.0
PR Number Synopsis Category: Microkernel for neo mpc
1326746 Potential heap leak at tcp_conn_create under UKERN TCP stack.
 
memory leak happen due to tcp sockets did not close properly when tcp connection did not successfull between FPCs.
PR Number Synopsis Category: OS IPv4/ARP/ICMPv4
1318556 JSA10911 Junos OS: Kernel crash after processing specific incoming packet to the out of band management interface (CVE-2019-0011)
 
The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Please see https://kb.juniper.net/JSA10911 for details.
1345720 The rpd might crash when doing Routing Engine switchover with NSR and logical-system configurations.
 
When doing RE switchover with NSR (nonstop-routing) and logical-system configurations, rpd core might happen. This issue is platform independent. And it would cause traffic or service impact.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1356423 The command "show system virtual-memory | display xml validate" displays errors
 
The xmlised output of "show system virtual-memory" is created under a single container(for each table format) with repeated tag names. Because of the repeated tag names in the same container xml validation is failing. Added changes to xmlise each row output of table format in a separate container.
PR Number Synopsis Category: "ifstate" infrastructure
1338895 The rpd might crash when high-priority routes flap
 
When the rpd crashes, the core files could be seen by executing the CLI command "show system core-dumps". The routing protocols are impacted and traffic disruption will be seen due to loss of routing information.
1379657 Protocol adjacency might flap and FPC might reboot if jlock hog happens.
 
On all platforms and in scaling scenario, if doing some operations which causes jlock hog, the protocols adjacency might flap and all the FPCs might reboot.
PR Number Synopsis Category: TCP/UDP transport layer
1394370 The command "commit synchronize" might fail because several internal connections are stuck.
 
Command "commit synchronize" might fail due to kernel TCP socket stuck, the stuck can also result in login failure to the Backup RE from Master RE or to an FPC.
PR Number Synopsis Category: Kernel Tunnel Interface Infrastructure
1327099 GRE interface might not come up after deactivating or activating the routing instances.
 
GRE interface might not come up after deactivating/activating the routing-instances or related changes that might result in route table change.
PR Number Synopsis Category: Path computation client daemon
1395205 Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash. [CVE-2020-1601]
 
Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Element (PCE) in a PCEP environment using Juniper's path computational element protocol daemon (pccd) process allows an attacker to cause the pccd process to crash and generate a core file thereby causing a Denial of Service (DoS). Refer to https://kb.juniper.net/JSA10980 for more information.
PR Number Synopsis Category: Protocol Independant Multicast
1394259 The rpd process might crash when rp-register-policy is configured with more than 511 terms
 
On all Junos platforms, when rp-register-policy is configured for Protocol Independent Multicast (PIM) Rendezvous Point (RP), and the policy is defined with more than 511 terms, if the incoming register messages doesn't match initial 511 terms in the policy, but match the term afterwards, the rpd process might crash due to this issue, therefore impact normal routing functions and service.
PR Number Synopsis Category: vMX Platform Infrastructure related issue tracking
1220671 TACACS access does not work after upgrade.
 
The /etc/passwd file is created in the process of the first commit when a pristine jinstall image is used to boot for the first time. If event-options is configured, the system will try to read the configuration from the available event scripts, which requires privileges obtained from the /etc/passwd file. That causes a circular dependency because the commit will not pass if the configuration includes event-options the first time a pristine image boots up, which is the case of an upgrade performed with virsh create.
PR Number Synopsis Category: Periodic Packet Management Daemon
1361800 The PPM mode for BFD session in EX4300 is centralized and not distributed by default
 
Periodic packet management (PPM) is responsible for processing a variety of time-sensitive periodic tasks so that other processes on the EX Series switch can more optimally direct their resources. It has two modes: distributed PPM and non-distributed (centralized) PPM. The distributed PPM should be enabled by default (such as, in 14.1 or prior to 14.1 version). But BFD session over IRB (integrated routing and bridging) runs in centralized mode instead of running distributed mode in some versions. It may not cause service impact since the BFD sessions will come UP fine. However, when the RE CPU is very busy or when configured intervals are less than 300 ms then BFD sessions running over IRB may flap since the sessions are not distributed. Also, during RE switchover cases these sessions may flap if the configured intervals are less than 2.5 secs.
PR Number Synopsis Category: PPPoE functional plugin for bbe-smgd
1398873 The bbe-smgd process might crash when executing "show pppoe lockout"
 
On MX platforms for Point-to-Point Protocol over Ethernet (PPPoE) subscriber management scenario, the bbe-smgd process might crash when executing "show pppoe lockout".
PR Number Synopsis Category: PTP related issues.
1404002 The time synchronization through PTPoE might not work when Enhanced Subscriber Management is enabled on MX Series routers.
 
When Enhanced Subscriber Management is enabled on MX (i.e. set system services subscriber-management enable), the Precision Time Protocol (PTP) with PTP-over-Ethernet (PTPoE) configuration might not work on MPC2E-NG/3E-NG or MPC5E and above (such as MPC6E/7E/8E/9E/10E/11E).
PR Number Synopsis Category: Chassis mgmt for all QFX systems - chassis MIB, alarms, CLI
1363186 Log messages: kernel: tcp_timer_keep: Dropping socket connection
 
On QFX5110 with Junos version 17.3R1, it is possible to see the following logs in messages file: kernel: tcp_timer_keep: Dropping socket connection due to keepalive timer expiration, idle/intvl/cnt: 7200000/75000/8 kernel: tcp_timer_keep:Local(0x80000001:60287) Foreign(0x80000001:33015) These log messages are harmless.
PR Number Synopsis Category: Interface related issues. Port up/down, stats, CMLC , serdes
1323323 Port 0 does not come up in Qfx5100-48t member in mixed VCF
 
Port 0 of Qfx5100-48t does not come up in mixed VCF. As a workaround, use "phy diag xe0 dsc" command as of now from BCM shell upon reboot which brings up the port and stays up continuously until the next reboot
1386400 The QFX10K-12C-DWDM line card might crash when booting up
 
On QFX10008/10016 with QFX10K-12C-DWDM line card installed, the line card might crash when booting up. The issue results in traffic disruption during the line card booting up.
PR Number Synopsis Category: QFX Control Plane Kernel related
1393044 sdk-vmmd causes a high write I/O in Virtual Chassis Linecard members and SSD lifetime might be shorten.
 
In Virtual Chassis environment with Solid State Drive (SSD) installed on the Linecard side, the sdk-vmmd (app-engine-virtual-machine management service) should not try to establish the retry connection to SNMPD when it is running in line card because SNMP is not running in line cards members. A debug logging might be written to the SSD card frequently due to repetitive retry connection. Therefore, the SSD lifetime might be shorten due to the exceeded amount of read/write. Due to this issue, the SSD card failure might be observed.
PR Number Synopsis Category: QFX Platform related (SYSLOG/ALARMS/miscellaneous)
1340897 QFX5000 platforms may display fpc0 Error requesting CMTFPC SET INTEGER, illegal setting 37 observed after upgrade
 
QFX5000 series platforms may show the following ERROR MESSAGE: fpc0 Error requesting CMTFPC SET INTEGER, illegal setting 37 observed after software upgrade.
1383608 The DMA failure errors might be seen when the cache flush or the cache is full.
 
The DMA failure errors might be seen when the cache flush or the cache is full. It might cause the device not to accept ssh credentials and Virtual-Chassis to go into the hang state.
1395534 Unable to install licenses automatically on QFX platforms
 
On QFX Series platforms, it is unable to update licenses automatically with "request system license update" command.
1402852 File permissions are changed for /var/db/scripts files after reboot
 
On newer QFX5K switches(QFX5K switch with qfx-5e image), file permissions are changed for /var/db/scripts files after reboot. This can impact scripts running on the box.
PR Number Synopsis Category: QFX platform optics related issues
1381545 The 40G-SR4 transceiver might not be recognized after upgrading to qfx5100e OS
 
On the QFX5100 platform, after upgrading from a 'qfx5100' OS to a 'qfx5100e' OS via CLI (not via USB media), the 40G-SR4 transceiver might not be recognized, resulting in the invalidation. The chassis must be power cycle off/on to recover.
PR Number Synopsis Category: QFX access control list
1241733 The pfe process might crash after changing the filter for lo0 interface
 
On EX4600/QFX5100/QFX5110/QFX5200/ACX5K switches, the dcpfe might create a core file when the applied lo0 firewall filter term is changed in scaled conditions.
1364020 QFX52100: Filter with routing-instance applied to family inet logical interface (IFL) causes traffic to be discarded on unrelated interfaces.
 
QFX52100: Filter with then routing-instance applied to family inet IFL causes traffic to be discarded on unrelated interfaces
PR Number Synopsis Category: QFX PFE Class of Services
1380294 There is an inconsistency in applying scheduler map with excess-rate on the physical interface and AE interface
 
On QFX5100/QFX5110/QFX5120/QFX5200/QFX5210 Series platforms, there is an inconsistency when applying a scheduler map with excess-rate on the physical interface and aggregated ethernet (AE) interface. The excess-rate is not supported on the physical interface, but it could be committed successfully on the AE interface containing that physical interface with the same excess-rate parameter.
PR Number Synopsis Category: QFX L2 PFE
1353241 ARP learning might fail after changing the interface MAC address
 
On QFX5000 Series switches, the PFE might drop the ARP reply packets after changing the interface MAC address.
1368913 On QFX5k Series switches ISIS adjacency with Cisco might go down
 
On QFX5k Series, If ISIS packet is received with DMAC as 09:00:2b:00:00:05 (ISO 9542, All Intermediate System Network Entities Address) and Jumbo frame with EtherType as 0x8870 (non-standard, used by Cisco), such packet will be dropped, resulting in failure in the adjacency.
1382209 LACP might stuck in Detached state on QFX5K platforms in VXLAN scenario
 
On QFX5K platforms with LACP configured, if an AE interface has native-vlan-id configured and that native vlan is VXLAN enabled, LACP on that interface might stop processing received LACP PDUs and stuck in Detached state. LACP in Detached state will not carry traffic.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1374436 TPI-50840: qfx5110 ethernet-switching flood group shows incorrect information
 
TPI-50840: On the QFX5110, the Ethernet switching flood group shows incorrect information.
PR Number Synopsis Category: QFX MPLS PFE
1400868 The dcpfe crashes might be seen after several times of adding/deleting a large number of LSPs
 
On ACX/EX/QFX platforms, if adding/deleting a large number of LSPs several times, the dcpfe crashes and MPLS warning messages might be seen.
PR Number Synopsis Category: QFX VC Infrastructure
1383876 The VC could not come up after upgrading to QFX5E platforms (TVP-based platforms for QFX5100 or QFX5200 switches)
 
On QFX5100/QFX5200-VC (Virtual-chassis) scenario, if the switches upgrade to QFX5E platforms (TVP-based platform), and when the VC ports are connected to the expansion modules (PIC0/PIC1), all VC ports might be down and the VC could not come up.
1383876 The VC could not come up after upgrading to QFX5E platforms (TVP-based platforms for QFX5100 or QFX5200 switches)
 
On QFX5100/QFX5200-VC (Virtual-chassis) scenario, if the switches upgrade to QFX5E platforms (TVP-based platform), and when the VC ports are connected to the expansion modules (PIC0/PIC1), all VC ports might be down and the VC could not come up.
1389872 FPC might crash on QFX5100 platforms in a large-scale scenario
 
On QFX5100 platforms, if the size of the configuration is huge, when upgrade from a lower release to a higher one, the FPC might crash.
PR Number Synopsis Category: KRT Queue issues within RPD
1374558 The rpd process might crash when route flap and LSP flap occur with CBF enabled.
 
When CBF (CoS-based forwarding) is enabled, due to the indexed nexthop installation issue in kernel, the rpd process might crash upon route flap and LSP flap.
PR Number Synopsis Category: RPD Next-hop issues including indirect, CNH, and MCNH
1360354 rpd cores at 'Assertion failed rpd[10169]: file "../../../../../../../../src/junos/usr.sbin/rpd/lib/rt/rt_attrib.c", line 3329: "rt_template_get_rtn_ngw(nhp) <= 1" ' on doing RE switchover with SRTE routes
 
When RPD reads nexthops from Kernel on restart, for INH -> FWD NH{List NH} -> {Chain NH} scenario, RPD should not create old-style List NH for the forwarding nexthop.
1370174 The rpd might crash after Routing Engine switchover is performed or the rpd is restarted if interface-based dynamic GRE tunnel is configured.
 
With interface-based Dynamic GRE Tunnel configured, there might be 2 next-hops for a single dynamic GRE tunnel when a new route is resolved over the dynamic tunnel after RE switchover is performed or the rpd is restarted. Subsequent withdrawal of the routes over that tunnel or master Routing Engine restarting will cause the rpd crash. This issue is introduced in PR 1202926 (which is fixed in 15.1F7 16.1R4 16.2R1-S6 16.2R1-S6-J1 16.2R2 17.1R2-S7 17.1R2-S8 17.1R3 17.2R1).
1402390 In JUNOS Logical System, configuration of "chained-composite-next-hop ingress l3vpn extended-space" failed to commit after upgrading to 17.2/later releases
 
After upgrading Junos to Junos OS Release 17.2 or later, the statement "chained-composite-next-hop ingress l3vpn extended-space" cannot be configured any longer on a logical system.
PR Number Synopsis Category: RPD Infrastructure Issues.
1373855 LDP convergence delay might be seen after IGP metric change with the statement bgp-igp-both-ribs configured.
 
In a large-scale BGP/LDP environment with 'protocols mpls traffic-engineering bgp-igp-both-ribs' configured, when IGP metric of interface is changed by configuration modification (commit), the metric change could get propagated to LDP slowly, leading to long delay of LDP convergence.
PR Number Synopsis Category: RPD route tables, resolver, routing instances, static routes
1341720 The VRF static route might not be exported when route-distinguisher-id is used on RR in BGP Layer 3 VPN scenario.
 
In Border Gateway Protocol (BGP) Layer 3 Virtual Private Network (L3VPN) scenario, on the Route Reflector (RR) with Virtual Routing and Forwarding (VRF) instance deployed, if Auto-RD (Automatic Route Distinguishers) feature is used, the VRF static route might not be exported to bgp.l3vpn.0 table correctly under race condition. Hence the static route could not be advertised to remote device.
1377279 static route age is the same as last commit.
 
Whenever ribgroup config changes for static routes (inet.0), all static routes are removed and then added to new ribgroup. But for unrelated config changes (e.g. adding a prefix to prefix-list policy) , also triggers this del+add, resulting in static routes' age same as last commit. This issue is not service impacting.
PR Number Synopsis Category: jflow/monitoring services
1393696 The srrd process might be stuck at 100 percent usage when J-Flow is used.
 
SRRD stuck at 100% CPU utilization
PR Number Synopsis Category: Scuba interfaces software
1382182 The MPC6E might crash while fetching PMC device states.
 
PMC device is OTN framer which is sitting on the MIC6-100G-CFP2. While fetching PMC states, CPU might be hogged by the thread more than 2.5 sec. If this occurs, MPC6E might crash.
PR Number Synopsis Category: Issues related to control plane security
1421539 Failed to reload keyadmin database for /var/etc/keyadmin.conf.
 
During commit of the configuration change the following warning message can appear: warning: Command exited: PID 7527, status 255, command keyadmin error: failed to reload keyadmin database for /var/etc/keyadmin.conf
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1382531 Flows are getting exported before the expiry of the configured active timeout value.
 
The export of the Jflow records is seen at the collector before the expire of the configured active timeout value. This export result might not be the expected.
PR Number Synopsis Category: SFW, CGNAT on MS-MIC/MS-MPC (XLP)
1386011 IPSec VPN traffic might fail when passing through MS-MPC of MX Series routers with CGNAT enabled.
 
While dynamic IP Security (IPSec) virtual private network (VPN) is re-keyed due to lifetime expiration, IPSec internet key exchange (IKE) phase 1 user datagram protocol (UDP) port 500 and phase 2 UDP port 4500 sessions would be translated into two different public internal protocol (IP) addresses while passing through carrier-grade network address translation (CGNAT), which causes IPSec VPN traffic to fail. This behavior does not cause an issue for Juniper MX devices with MS-MIC or SRX routers since the identify key is used to authenticate the sessions and it allows the private IP address to be translated to the different public IP addresses.
1405882 NAT64 translation issues of ICMPv6 Packet Too Big message with MS-MPC/MS-PIC
 
On MX series with MS-MPC/MS-PIC, in NAT64 scenario, if ICMPv6 Packet Too Big message is required to be translated, the translated ICMPv4 Destination Unreachable packet is incorrect. L4 destination port under embedded IPv4 address is not translated, IPv4 Identification field doesn't copy from IPv6, header checksum in IPv4 under ICMPv4 is wrong.
PR Number Synopsis Category: Stout PF fabric (SFB2)
1406030 Fabric performance drop on MPC7, MPC8, or MPC9E and SFB2 based MX2000 platform.
 
On MPC7/8/9E and SFB2 based MX2000 Series platforms, code change done by PR 1336446 fixing MPC7/8/9E fabric re-ordering issue with SFB causes fabric performance drop. The throughput might not reach the expected value in high volume traffic scenario.
PR Number Synopsis Category: Trio LU, IX, QX, MQ chip drivers, ucode & related SW
1364514 The "Disconnected after ISSU and before switchover" error might be seen and FPC is restarted during ISSU
 
The "Disconnected after ISSU and before switchover" error might be seen and FPC is restarted during ISSU.
1368414 Subscribers over AE interface might have tail drops which will affect the fragmented packets due to QXCHIP buffer getting filled up
 
On MX platform with MPC1/MPC1E/MPC2/MPC2E, Subscribers over AE interface can't utilize their bandwidth as packets larger than 1500 is dropped.
1380746 Packet drops on interface if the statement "gigether-options loopback" is configured.
 
On MX ,EX9200 and SRX5K platforms, with the knob "gigether-options loopback" configured on interface, if the interface is connected using copper SFP (SFP-T), packet drops might be seen.
PR Number Synopsis Category: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1374248 The filter service might fail to get installed for the subscriber in a scaled BBE scenario
 
On MX Series platform enabled with enhanced subscriber management, if the subscriber profile initiates a filter service for each subscriber, and there are large scale of broadband edge (BBE) subscribers (for example, 10000) logging in and out repeatedly, the filter service might fail to get installed for the subscriber due to this issue. In some rare condition, it might also lead to the Flexible PIC Concentrator (FPC) crash.
1402345 The MPC might crash due to CPU overuse by dfw thread.
 
When a large amount of packets hit the firewall filter term action 'syslog' and a thread hogs CPU for more than 4 minutes, the MPC might crash.
1402484 Some error logs might be seen on FPC when reading is attempted from Uninitialized memory location.
 
On all MX platforms that support enhanced subscriber management (Next Generation Subscriber Management) with L2TP subscriber scenario, when a packet arrives with size higher than LNS (L2TP network server) IFL (Logical interface) MTU and 'Do-not fragment' bit is set, because the micro kernel generates ICMP error messages and increment 'out-mtu-errors' in IFD (Pysical interface) stream counter, and then the OIF (Outgoing interface) index is wrongly programmed in LNS IFL output feature list. So some error logs would be seen when reading attempt from Uninitialized memory location. This only impacts the traffic from Core to LNS subscriber on PFE which needs to generate ICMP error message like MTU exceeded. It would not impact normal transit traffic.
PR Number Synopsis Category: Trio pfe l3 forwarding issues
1381580 The unicast traffic from IRB interface towards LSI might be dropped due to Packet Forwarding Engine mismatching at egress processing.
 
On all Junos with Trio platforms, the unicast traffic might get dropped when it is passed from an Integrated Routing and Bridging (IRB) interface towards label switch interface (LSI) if the Aggregation Ethernet (AE) load balancing adaptive or per-packet is configured.
PR Number Synopsis Category: Trio pfe multicast software
1355334 Some line cards might crash in subscriber scenario enabled with distributed IGMP.
 
On MX platforms enabled with Next Generation Subscriber Management, if subscribers are enabled with distributed Internet Group Management Protocol (IGMP), and there are some stressful operations, e.g. subscribers login/logout as well as join/leave IGMP groups repeatedly, some linecards might crash due to the timing issue.
PR Number Synopsis Category: Trio pfe microcode software
1346403 RLT subinterfaces not reporting statistics.
 
RLT sub-interfaces not reporting stats
1373631 JNH memory leaks in multicast scenario with MoFRR enabled
 
On MX platform, with Multicast-Only Fast Reroute (MoFRR) enabled, if doing any change that causes to create a new rpf nexthop, JNH memory leak might be seen.
PR Number Synopsis Category: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1389944 Individual command authorization might cause mgd crash.
 
For a user with allow-commands and deny-commands configured, mgd crash is happening sometimes when the user enters into CLI mode and executes any show commands.
PR Number Synopsis Category: Junos Automation, Commit/Op/Event and SLAX
1405903 Some files are missing during log archiving
 
When there are any scripts running on the router cscript.log will be created. It is found that the permission are set wrongly hence when any non-root user tries to archive the /var/log along with cscript, some other files in /var/log go missing in the archived file. So when we untar the file, less files are found. This issue is not seen when root user does the archive. With the fix of the PR non-root user would be able to archive the files.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1368998 Junos OS:set system ports console insecure allows root password recovery on OAM volumes (CVE-2019-0035)
 
Junos OS: set system ports console insecure allows root password recovery on OAM volumes (CVE-2019-0035); Refer to https://kb.juniper.net/JSA10924 for more information.
1401249 The authd process might stop when issuing the show network-access requests pending command during the authd restart
 
The authd might crash when issuing "show network-access requests pending" command during the authd restarting.
PR Number Synopsis Category: We can use this category for Host protocols (LACP, LAG, ARP,
1321575 In Junos Fusion the AD LAG interface might flap during SD upgrade or downgrade
 
During SD (Satellite Device) upgrade in Junos Fusion, there is a race condition that the LACP (Link Aggregation Control Protocol) defaulted PDU received from the peer device connected in a LAG (Link Aggregation Group) is incorrectly sent to AD (Aggregation Device) with AE ECID (E-channel Identifier) instead of member ECID, which causes that LACP PDU to be received on another member in the LAG, resulting in the LAG interface flapping.
1383642 In a Junos Fusion (MC-LAG based) deployment with dual Aggregation Devices (ADs) and dual-homed Satellite Devices (SDs) it may be possible for SDs to get into a state where LACP will not transmit to attached end/client devices.
 
When a Satellite Device (SD) boots up (powered on) it receives the SD configuration file from the Aggregation Devices (ADs). If the SD is configured to be dual-homed to both ADs (connections from one SD to both AD1/AD2) it will receive a configuration file which instructs the SD to communicate to both ADs. If one of the ADs is offline at the time the SD receives the configuration file specifying AD Redundancy then the SD will not be able to properly transmit LACP PDUs until it communicates and synchronizes with both ADs as specified in the received configuration.
PR Number Synopsis Category: V44 Aggregation Device Infra
1384440 BUM traffic may get dropped on peer Fusion Aggregation Device when the link between Satellite Device and local Aggregate Device goes down
 
In the dual AD Junos Fusion setup, BUM (Broadcast, Unknown Unicast, and Multicast) traffic may get dropped on peer Fusion Aggregation Device when the link between Satellite Device and local Aggregate Device goes down.
PR Number Synopsis Category: V44 Satellite Device Infra
1369062 QFX satellite device may restart in JunOS Fusion solutions when copper SFP is used
 
When using QFX5100/5110/5200/5210 as a satellite device (SD), configuring a copper small form-factor pluggable (SFP) may cause the SD to restart unexpectedly.
PR Number Synopsis Category: PTX/QFX10002/8/16 specific software components
1311875 PTX10K: an FPC may restart without a warning when the speed on an interface is by configuration
 
Without the fix, whenever a user changes pic or port speed, the affected FPCs will restart automatically. With this change, an alarm is raised and user intervention is required to take the effect.
PR Number Synopsis Category: VMHOST platforms software
1398333 Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure (CVE-2019-0074)
 
A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series, and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. Please refer to https://kb.juniper.net/JSA10975 for more information.

17.3R3-S3 - List of Known issues

PR Number Synopsis Category: EX4300 PFE
1388324 ICMPV6 packets are not classified with static or multifield forwarding-class mapping.
 
ICMPv6 packets are hitting the dynamic ingress filter with higher priority, thus never reaching an MF or static classifier.
PR Number Synopsis Category: EX4300 Platform
1405168 Traffic drop is seen on EX4300 when 10G Fiber port is using 1 Gigabit Ethernet SFP optics with Auto-Negotiation enabled
 
Traffic drop is seen on EX4300 when 10G Fiber port is using 1 Gigabit Ethernet SFP optics with Auto-Negotiation enabled. Auto-Negotiation is enabled by default on these ports. This issue is applicable to EX4300 platforms using 10G Fiber ports supporting 1G optics in any of the applicable PIC ( PIC0 last 4 ports and PIC2 of EX4300-32F and PIC2 of EX4300-24/48 T/P ). Traffic will not egress out of these ports and the peer will not receive the traffic.
PR Number Synopsis Category: QFX Access control list
1379718 Host destined packets with filter log action might not reach to the routing engine if log/syslog is enabled.
 
On EX4300/EX4600/QFX Series switches except for QFX10k, if host destined packets (that is, the destination address belongs to the device) come from the interface with ingress filter of log/syslog action (for example, 'filter <> term <> then log/syslog'), such packets should not be dropped and reach the Routing Engine.
PR Number Synopsis Category: QFX L3 data-plane/forwarding
1363708 TPI 50840: L3-GW on qfx5110 will not work consistently with flexible tagging interface (SP style configuration)
 
L3-GW is not supported on QFX5110 with SP style of config in 17.3R3.
1383680 The IRB transit traffic might not be counted for EVPN/VXLAN traffic
 
On QFX10002\QFX10008\QFX10016 Series platforms with EVPN/VXLAN deployment scenario, the transit statistics of Integrated Routing and Bridging (IRB) interface might fail to be counted for the EVPN/VXLAN traffic, but it works for the regular IRB interface.
1388235 QFX does not send ' ICMP packet too big' message when source send large frame with DF bit set
 
QFX does not send ' ICMP packet too big' message when source send large frame with DF bit set
1394866 JDI-RCT: EVPN-VXLAN NON-COLLAPSED: AUTONEG Errors and flush operation failed error, seen after power cycle of the device
 
AUTONEG Errors and flush operation failed error, seen after power cycle of the device as mentioned below. These error message does not have any functionality impact. "LOG: Err] ifd 153; Ether autonegotiation error (1000)" and "ch_vchassis_ipc_flush_pipe: flush operation failed for pipe 155333280"
PR Number Synopsis Category: QFX Analyzer, sflow
1334711 Ethernet frames with Ethernet type of 0x8922 might be modified at egress by QFX10K platforms
 
On QFX10002, QFX10008 and QFX10016 Series platforms, all the Ethernet frames with Ethernet type of 0x8922 might be modified at the egress because it is an unknown Ethernet type.
PR Number Synopsis Category: Accounting Profile
1383354 LTS subscriber statistics are reported to RADIUS.
 
LTS subscriber stats are reported to RADIUS.
1452363 The pfed might crash and not be able to come up on the PTX or TVP platforms
 
The flow label statistics are retrieved periodically by pfed for PTX or TVP platforms, if the statistics reply becomes very big number, the pfed might crash hence affecting traffic.
PR Number Synopsis Category: ACX MPLS
1360967 On a ACX ring topo, after link between ACX and MX flap, VPLS RI on PE (MX) have no MAC of CE over l2circuit
 
Issue: During the core interface flap, the specific label route is switched between SWAP and PHP mode, when there is two paths are available in the ring (core interface which is flapping is giving PHP mode and other one is in SWAP mode). In issue case, the hardware route config is in SWAP mode and the Junos/HAL routes are in PHP mode. It leads to drop the forwarding traffic for the given label. Fix: Whenever the active member of unilist NH is changed, the same is not reflected in the corresponding routes. It leads the route is working with older active NH instead of latest one. To avoid this case, whenever the existing unilist NH's active member is changed, then route update is triggered for the same using topo walk.
1381487 The L2circuit might stop forwarding traffic when one core interface flapping happens
 
On ACX-series platforms with L2circuit scenario, if the L2cicuit peer is connected via RSVP (with link protection) through two interfaces (e.g. master and backup interface, AE0 and AE1), and after both interfaces flapped, the L2circuit link is brought down and back to up. And at this point, if one core interface (such as AE0 or AE1) flaps alone, the L2circuit link still stays up because another interface is up, but the traffic to CE would be dropped due to one internal table in kernel is not be programmed correctly.
PR Number Synopsis Category: ACX PFE
1183120 After upgrade to ACX stuck in holdover state
 
When upstream PTP master is not stable local PTP status will be moved to holdover state. However current logic is not marking the master as unstable. This leads to situation where servo is not able to function as designed when the upstream is found reachable and stable again.
PR Number Synopsis Category: ACX GE, 10GE, PoE, IDT framers
751695 SyncE on ACX platform may not work when the port is selected is other than ge-0/1/0 as source.
 
SyncE on ACX platform may not work when the port is selected is other than ge-0/1/0 as source
PR Number Synopsis Category: MX SCB software
1399744 No Alarm was generated when FPC connected to master RE via backup RE/CB
 
The fix produces alarm on the RE if the communication from RE to one or more FPC is failed through primary interface and establishes the communication via backup RE.
PR Number Synopsis Category: BBE interface related issues
1389611 BBE SMGD cores if MTU is changed while subscribers are logged in on the ifd
 
Bbe-smgd generates core file when MTU configuration is changed with subscribers still logged in on the physical interface. MTU configuration change should only be done when there are no subscribers logged in on the physical interface. Catastrophic configuration changes should be done only in maintenance mode, when no subscribers are on the physical interface.
1404369 Incorrect display of assigned prefixes to a subscriber in the output of 'show interface < dynamic demux interface>'
 
Incorrect display of assigned prefixes to a subscriber in the output of 'show interface < dynamic demux interface>':
PR Number Synopsis Category: BBE network stack related issues
1432957 Junos OS: MX Series: In BBE configurations, receipt of a specific MPLS or IPv6 packet causes a Denial of Service
 
Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge (BBE) service may trigger a kernel crash (vmcore), causing the device to reboot. Please refer to https://kb.juniper.net/JSA10987 for more details.
PR Number Synopsis Category: BBE OS Infrastructure library
1414333 DHCP/DHCPv6 subscribers might fail to establish sessions on PowerPC based MX platforms
 
On MX5/10/40/80/104 platforms running with Dynamic Host Configuration Protocol version 4/version 6 (DHCPv4/v6) subscribers, if large-scale subcribers (e.g. around 3500 in total) try to establish sessions simultaneously from multiple access interfaces, the DHCPv4/v6 sessions might always fail to set up due to this issue. As a result, the session set up rate would be much lower than expected.
PR Number Synopsis Category: BBE Resource monitoring related issues
1396886 Subscriber flapping might cause SMID resident memory leak.
 
In MX subscriber management scenario, if the subscribers keep flapping, the SMID (subscriber management infrastructure daemon) memory leak is observed. When the SMID resident memory is exhausted, SMID will crash and subscriber session can't be established.
1408833 Syslog flooded with "Limit check for pppoe subscriber failed" messages
 
In subscriber-management scenario, the syslog is printed with "Limit check for pppoe subscriber failed" on every login request when the subscriber count reached the max.
PR Number Synopsis Category: Border Gateway Protocol
1304639 Multihop eBGP peering session exchanging EVPN routes can result in rpd core files when BGP updates are sent.
 
When eBGP multihop sessions exchanging EVPN routes are configured, a core can result due to an internal error.
1349167 Rpd crash might be seen after executing RE switchover
 
On all platforms with GRES enabled, if bring up scaling number of BGP peers, after executing RE switchover, rpd crash might be seen.
1387720 BGP sessions might keep flapping on backup Routing Engine if proxy-macip-advertisement is configured on IRB interface for EVPN-VXLAN.
 
In EVPN+VXLAN scenario, if proxy-macip-advertisement is configured on IRB (Integrated Routing and Bridging) interface for the EVPN (Ethernet VPN), the BGP sessions might flap on backup RE even the system is shown ready for the hitless switchover, hence there might be traffic loss after GRES switchover if BGP sessions are down on backup RE at the time of GRES switchover.
1403881 EVPN multi-homing MAC might not be installed by remote PE.
 
In EVPN-MPLS multi-homing scenario, on MX series and with Junos 18.2R2, multi-homing MAC entries learnt from remote EVPN peers, may not be installed in the MAC table.
1414021 The rpd gets stuck in a loop while doing the multipath calculation which leads to the high CPU usage
 
In BGP with the indirect next-hop scenario, if uRPF is enabled, and then enable BGP multipath, a background job loop might be formed and the CPU utilization of rpd process might be stuck at 100%.
PR Number Synopsis Category: BBE Remote Access Server
1391411 Usage-Monitoring-Information AVP might activate service accounting.
 
Usage-Monitoring-Information AVP as part of PCRF gx-plus provisioning is causing service accounting activation.
1402012 The authd crash might be seen due to a memory corruption issue
 
In subscriber scenario, the authd might crash multi-times due to a memory corruption issue.
PR Number Synopsis Category: MX Platform SW - UI management
1394308 BBE during login rtslib: ERROR received async message with no handler: 90 CHASSISD_RTS_SEQ_ERROR: ifmsg sequence gap 1515870811 - 1 chassid 1400m memory leak
 
BBE during login rtslib: ERROR received async message with no handler: 90 CHASSISD_RTS_SEQ_ERROR: ifmsg sequence gap 1515870811 - 1 chassid 1400m memory leak
PR Number Synopsis Category: Enhanced Broadband Edge support for cos
1404325 The FPC might crash in a CoS scenario
 
If MPC1/MPC2 are used ("Trio" based MPCs) in HCoS scenario, the FPCs might crash due to an invalid IFL referred by the dynamic BBE subscriber interface.
PR Number Synopsis Category: L2NG Access Security feature
1394341 The dhcp-security binding table might not be updated due to the renew request with '0.0.0.0' value in 'ciaddr'
 
In DHCP security scenario, if the DHCP renew request packet is of the broadcast message and with '0.0.0.0' value in 'ciaddr' field, the DHCP security binding table might not be updated. That binding information is present till its lease time expiry. After lease time expiry the binding information got deleted, which might result in traffic drop of the DHCP client at the old lease expiration time.
PR Number Synopsis Category: QFX L2 Protocols Control Plane related
1408230 MAC address movement might not happen in Flexible Ethernet Services mode when family inet/inet6 and vlan-bridge are configured on the same ifd
 
On EX4300/EX4600/QFX3000/QFX5000 platforms with flexible-ethernet-services enabled, when family inet/inet6 and vlan-bridge are configured on the same physical interface, and family inet/inet6 is configured first, MAC address movement (MAC learning/deleting) might not happen on this interface. This might cause a traffic drop.
PR Number Synopsis Category: QFX Control Plane VXLAN
1215510 EVPN: When disable an ESI (all member links), traffic to other ESI also get impacted and seeing drop of 0.1 to 0.4 second
 
EVPN: When an end system identifier (ESI) (all member links) is disabled, the traffic to other ESI also get impacted. As a result, you can observe a drop of 0.1 to 0.4 second.
1398230 QFX5100 - EVPN/VXLAN - Configuration change on the leafs is bringing vtep interfaces down
 
BGP graceful restart helper does not work when the peer is configured implicitly with BGP group 'allow' command
PR Number Synopsis Category: Device Configuration Daemon
1402122 Certain otn-options cause interface flapping during commit.
 
With following configuration present, the interface flaps after a commit where an AE interface is being added. set interfaces otn-options trigger oc-tsf hold-time up <> down <> set interfaces otn-options trigger odu-bei hold-time up <> down <>
PR Number Synopsis Category: Firewall Filter
1389103 Add more information to the firewall flexible match syntax
 
This PR provides additional information for the "set firewall flexible-match source-ipv6-match ..." cli commands to avoid confusion.
1394922 Junos OS: Firewall filter terms named "internal-1" and "internal-2" being ignored (CVE-2019-0036)
 
Junos OS: Firewall filter terms named "internal-1" and "internal-2" being ignored (CVE-2019-0036); Refer to https://kb.juniper.net/JSA10925 for more information.
PR Number Synopsis Category: JUNOS kernel/ukernel changes for DNX
1376448 IRB as a DHCP client does not get an IP address once the DHCP server IP is changed
 
IRB as a DHCP client does not get an IP address once the DHCP server IP is changed
PR Number Synopsis Category: Ethernet OAM (LFM)
1281073 The cfmd process might continuously crash after upgrade
 
The /var/db/cfm.db format is changed as part of PR 1249979 (which is fixed in 16.1R4-S2 16.1R5 17.1R3 17.2R1 17.3R1 trunk). With CFM configuration, if executing upgrade between releases which uses different db format, the continuous cfmd crashes might be seen after upgrade.
PR Number Synopsis Category: EVPN control plane issues
1366032 TPI-52277: Deleting a EVPN-VXLAN tenant causes scheduler slippage and BFD flap
 
TPI-52277: Deleting a EVPN-VXLAN tenant causes scheduler slippage and BFD flap
1367766 The EVPN implementation does not follow RFC-7432.
 
The EVPN implementation does not follow RFC-7432 when encoding/decoding 20-bit MPLS labels into ESI Label field in ESI Label Extended Community.
PR Number Synopsis Category: Express pfe Analyzer features
1300716 Interfaces might go down when PFE encounters "TOE::FATAL ERROR"
 
Interfaces might go down when PFE (Packet Forwarding Engine) encounters "TOE::FATAL ERROR" (TOE is a module in PFE, the fatal error can be caused either by software issue or hardware issues like memory parity errors or others). Please reboot the line card to recover the service when hitting the issue.
PR Number Synopsis Category: Express PFE Services including JTI, TOE, HostPath, Jflow
1379227 PTX10008: error logs seen when flows are sample through aggregate bundles when jflow sampling enabled
 
When you sample flows which the ingress and egress interfaces are of "aggregate" type on PTX10000s and QFX10000s, you may see syslog info messages about "expr_get_local_pfe_child_ifl" and "flowtb_get_cpu_header_fields". Even though these messages are non-impact messages, they will crowd syslog files and syslog servers.
PR Number Synopsis Category: Express PFE L2 fwding Features
1405786 Ping over loopback might not work over TYPE 5 tunnel on QFX10000 platforms
 
On QFX10000 platforms, in EVPN-VXLAN scenarios, ping between Spine to Spine loopback over TYPE 5 tunnel might not work.
PR Number Synopsis Category: Express PFE L3 Features
1385723 The IPv6 packet might not be routed when IPv6 packet is encapsulated over IPv4 GRE tunnel on QFX10000..
 
On QFX10002/QFX10008/QFX10016 platforms, the IPv6 traffic might be dropped if the IPv6 over IPv4 Generic Routing Encapsulation (GRE) tunnel is configured because when an Interface family (IFF) member is removed on the Logical interface (IFL), the property of IFL to learn MAC is getting set to NULL which is causing ARP failure.
PR Number Synopsis Category: Express pfe Mclag
1402142 QFX10002 Junos Fusion DC setup running would generate DCPFE core and cause traffic disruption if extended ports are configured as access or trunk ports.
 
QFX10002 Junos Fusion DC setup would generate DCPFE core and cause traffic disruption if extended ports are changing from access port to trunk port or vice-versa. It was detected in 17.3R3.9 AND 17.3R3.10 and SNOS 3.5R1.4.
PR Number Synopsis Category: jdhcpd daemon
1333381 2019-04 Security Bulletin: Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets. (CVE-2019-0031)
 
Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Refer to JSA10920 for more information.
PR Number Synopsis Category: Category for JET(JUNOS Extension Toolkit) related issues
1295831 xmlproxyd core during telemetry streaming
 
When OC package upgrade is triggered when telemetry is going on, xmlproxyd may crash. It will recover automatically and xmlproxyd related streaming will restart as the process come up again. The recommendation from Juniper is to stop the streaming and then do the OC pkg upgrade.
PR Number Synopsis Category: Platform issues specific to MS-MPC (XLP)
1205593 The error messages about "OUT OF SYNC" might be seen on certain condition
 
Various common situations lead to different views of forwarding information between kernel and Packet Forwarding Engines. For example, fpc7 KERNEL/PFE APP=NH OUT OF SYNC: "error code 3 REASON: NH add received for an ifl that does not exist ERROR-SPECIFIC INFO: nh_id=562 , type = Hold, ifl index 334 does not exist TYPE-SPECIFIC INFO: none". No service impact is seen in MPC2 and MPC3 type cards.
PR Number Synopsis Category: Multiprotocol Label Switching
1401813 Backup rpd crash may be observed due to incorrect label assignment
 
With NSR enabled, when master RPD is restarted, occasionally, out-of-order add and delete messages can arrive on the backup RE causing label assignment collisions leading backup RPD to crash.
1406400 The rpd might crash when RSVP bypass path flaps
 
In the MPLS-TE with RSVP scenario, in rare cases, when bypass path of RSVP goes down or comes up, CSPF re-calculation is triggered by this update event of state changing and rpd needs to try to remove/add this path from the TED (Traffic Engineering Database), but at that moment, the TED database corruption happens and that may cause the rpd crash.
PR Number Synopsis Category: For multicast snooping on MX
1408812 M/Mx/QFX:mcsnoopd core generated immediately after the commit change related to VXLAN-EVPN configuration
 
M/Mx/QFX:mcsnoopd core generated immediately after the commit change related to VXLAN-EVPN configuration
PR Number Synopsis Category: MX104 Software - Chassis Daemon
1393716 JUNOS enhancement configuration knob to modify mcontrol watchdog timeout
 
Junos CLI enhancement to configure mastership refresh timeout value 9 to 30 via the chassis CLI command 'set chassis redundancy mastership-refresh-timeout'.
PR Number Synopsis Category: MX104 Software - Kernel
1253155 MX104 mgiht be stuck in boot loop after fxp0 is disabled
 
MX104 Routing Engine (RE) might be stuck in boot loop after disabling interface fxp0 in configuration.
PR Number Synopsis Category: Track Mt Rainier RE platform software issues
1399654 The unexpected alarm might be shown on NG-RE
 
unexpected alarm might be shown on NG-RE
PR Number Synopsis Category: OS IPv4/ARP/ICMPv4
1402121 ksyncd coredump, Unknown Error has been encountered while processing an incoming (RTM_ROUTE) message
 
ksyncd might crash in case of deleting/adding the same ip address on different interfaces.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1345506 The FPC might fail to boot after toggling back and forth between 15.1 release (any release where 'JUNOS OS runtime' < 20180321) and a later release
 
After upgrading and downgrading between an older 15.1 release (any release where 'JUNOS OS runtime' < 20180321) without the fix for this PR and a later release that has extra optional platform packages (e.g 16.1), the system running 15.1 gets confused as to the state of such packages and discards them upon the the next upgrade to a later release. Thus, for example, changing Junos version between 16.1 -> 15.1 -> 16.1 may result in some PFE packages missing and therefore may prevent some MPCs from booting.
1360444 Error messages might be seen when the system boots up
 
nfsd not running causing the core to fail to be written to the memory ms22 /etc/mount-re: Mounting 128.0.0.1:/var/tmp/pics on /var/re: mount_nfs failed/timed out Capture below to validate if you see the above logs. root@ms22% mount root@ms22% df -k
PR Number Synopsis Category: Kernel MPLS / Tag / P2MP Infrastructure
1258308 Collecting LDP statistics not work correctly and kernel memory leak observed after configuring "ldp traffic-statistics"
 
For ACX/EX/M/MX/PTX/QFX/SRX/T Series devices with Junos OS release 16.1R4, due to a software defect, the "ldp traffic-statistics" configuration does not work correctly. The defect not only prevents periodical LDP statistic gathering but also causes kernel memory leaks. Kernel memory leaks may lead to various side issues.
PR Number Synopsis Category: IPv6/ND/ICMPv6 issues
1222670 The kernel might crash if interface family gets deleted
 
The kernel might crash if interface family get deleted.
PR Number Synopsis Category: PFE Peer Infra
1404368 chassisd process becomes unresponsive causing line-cards disconnecting from the RE due to high CPU usage. The peer-proxy-thread was stuck in a tight loop causing high CPU
 
During a major network churn event, the chassisd process may become unresponsive due to the ppt ( peer-proxy-thread) being in a tight loop. This leads to FPCs being disconnected and reboot.
PR Number Synopsis Category: Kernel Stats Infrastructure
1398128 The alarm might be seen if the PEM's serial number starts with "1F1"
 
On ACX/EX/QFX/SRX platforms, if the PEM's serial number starts with "1F1", the alarm "Minor FPC PEM Temp Sensor Failed" might be seen.
PR Number Synopsis Category: QFX Platform related (SYSLOG/ALARMS/miscellaneous)
1394655 QFX5110 VC: Fan tray output not displayed for backup routing engine
 
Fan tray details may be missing in the 'show chassis hardware' output on backup RE of QFX5110 VC running certain Junos versions. This issue has been fixed in upcoming Junos versions.
PR Number Synopsis Category: for all ipv6 related issues
1400399 Unicast traffic from Leaf to Spine send multiple copies after deactivate bgp in one of the spine
 
Unicast traffic from Leaf to Spine send multiple copies after deactivate bgp in one of the spine
PR Number Synopsis Category: QFX L2 PFE
1371495 AS7816-64X Changing the bridge-domain name break the communication for that particular bridge domain
 
On an AS7816-64X platform, changing the bridge-domain name breaks the communication for that particular bridge domain.
1390559 EVPN-VxLAN: ARP entries of same ESI are not syncronized between 2 PE VTEPs
 
EVPN-VxLAN: ARP entries of same ESI are not syncronized between 2 PE VTEPs
1411338 Storm control not shutting down mc-ae interface
 
On QFX10000 platform, when storm control profile is applied on mc-ae interface, although the traffic exceeds the bandwidth of the storm configuration it is not getting shut down, but storm control works on regular interfaces.
PR Number Synopsis Category: QFX MPLS PFE
1396014 BRCM_NH-, brcm_bcm_mpls_tunnel_initiator_clear(), 226:bcm_mpls_tunnel_initiator_get failed intf = 4 failure error logs might seen in syslog
 
MPLS config changes/topology changes might result in the tunnel initiator clear messages in the syslog.
PR Number Synopsis Category: QFX VC Infrastructure
1394060 Log frequently show up on 5200 vc console : dmar: DMAR:[DMA Write] Request device [0a:00.0] fault addr
 
This issue is due to the DMA access. This issue was with the old BSD kernel and It is fixed on the latest BSD kernel .
1414492 VC Ports using DAC may not establish link on QFX5200
 
On QFX5200, when virtual-chassis is configured, if the QSFP configured as VCP is removed and then inserted, VC Ports using direct attach copper (DAC) may not establish link.
PR Number Synopsis Category: RPD Next-hop issues including indirect, CNH, and MCNH
1398362 MPLSoUDP/MPLSoGRE tunnel may not come up on interface route
 
In MPLS over UDP or MPLS over GRE scenario, if the next hop type of the MPLSoUDP/MPLSoGRE tunnel is interface route, the tunnel might not come up.
PR Number Synopsis Category: Resource Reservation Protocol
1417931 RSVP LSP might get stuck in down state in OSPF multiarea topology.
 
In OSPF Multiarea topology (ABR has one or more multi-area adjacencies--one interface is attached to multiple OSPF areas), and inter-area RSVP LSP is configured (inter-domain is configured inside LSP), when primary path failure or optimize-timer triggers to signal a new instance of LSP, the LSP might get stuck in down state and it could not complete the signaling process. The reason is the incorrect CSPF on ABR which leads to RSVP path message loop and also causes next CSPF run to be skipped on the headend.
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1358019 Traffic might be blocked on MX with MS-MPC/MS-MIC
 
On MX Series platforms with MS-MPC or MS-MIC, if a large sum of similar packets (for example, thousands of packets) are received, because of the flaw in the method to process these packets, data/management path was completely blocked and dead locked. Eventually, traffic might be blocked.
1396785 The MS-MPC might core when mspmand receives a non-syn packet of TCP
 
On MX Series platforms and when MS-MPC line card is used, if the ms/ams-interface is not configured and mspmand (Multiservices PIC management daemon) receives a non-synchronized packet of TCP, the MS-MPC might crash due to some NULL pointer issues of the global configuration variable.
PR Number Synopsis Category: SFW, CGNAT on MS-MIC/MS-MPC (XLP)
1356133 mspmand crash due to incorrect jframe_magic_check
 
Configuring PPTP-ALG on MX services box can cause the MS-MPC PIC to crash.
PR Number Synopsis Category: MPC7, MPC8, MPC9, SFB2, MRATE & 8x100 MICs
1359149 Node Slicing: Error messages Err] localttp_offload_tx_errcheck: failed to send packet 4 times in last one second seen
 
PFE error messages "localttp_offload_tx_errcheck: failed to send packet 11 times in last one second" may be seen on a Node Slicing deployment. No known impact.
PR Number Synopsis Category: Issues related to broadband edge apps (PPP, DHCP) on Trio ch
1369503 when you configure vrrp delegate-processing with tomcat enabled, the Packet Forwarding Engine dropped VRRP packets and count sw error.
 
When configure vrrp delegate-processing with tomcat enabled. The pfe dropped vrrp packet and make the VRRP cannot send out the router. This may make the VRRP group have dual master.
PR Number Synopsis Category: Trio pfe bridging, learning, stp, oam, irb software
1362934 Newly elected DF does not resume BUM traffic forwarding until ~90 seconds after BDF stops forwarding on MX series
 
With 17.3R3 on MX series, on moving from the baseline configuration to EVPN scaled (4000 VLANs) config with multihoming, the newly elected designated forwarder may take up to 90 seconds to resume forwarding BUM traffic. The time required for convergence is proportional to the scale used, so a lower scale incurs a smaller dark window. Workaround for faster convergence with high scale: Distributing the configuration across several FPCs can potentially bring down the BUM traffic drop from 90 seconds to a significantly lower value.
1369365 Inter-VN and Intra-VN traffic between PEs is suspected to be affected when LT interface is used with the family bridge in service provider or enterprise style confguration
 
Inter-VN and Intra-VN traffic between PEs is suspected to be affected ONLY when LT interface is used with the family bridge in service provider or enterprise style configuration.
1420626 The unicast traffic to destination reachable over IRB and LSI with two next-hops might be dropped due to PFE mis programming
 
On MX Series routers with Trio chip set based MPCs, unicast traffic might get dropped when the destination is reachable over an integrated routing and bridging (IRB) interface and a label-switched interface (LSI) with two next hops.
PR Number Synopsis Category: Trio pfe l3 forwarding issues
1386061 ALB-ECMP may not work as expected for LDP tunnels
 
While verifying ALB-ECMP load balancing for LDP tunnels, observing measured deviation is more than the configured tolerance. It might cause alb-tolerance not be honoured and then the traffic might not be load-balanced equally.
PR Number Synopsis Category: Configuration management, ffp, load action
1359585 Commit failure along with 'statement does not match patch' warning might be seen
 
If commit is done in "edit private/configure private" and "edit/configure" sessions simultaneously, commit failure along with 'statement does not match patch' warning might be seen.
1363048 The "max-db-size" configuration do not work on some MX platforms
 
The "max-db-size" configuration do not work on MX5, MX10, MX40, MX80, and MX104.
PR Number Synopsis Category: Configuration mgmt, ffp, load-action, commit processing
1385902 The device with more than five IP addresses configured in the DHCP server group goes into amnesiac mode after reboot
 
If the knob "commit fast-synchronize" is enabled, the device with more than 5 IP addresses configured in the dhcp server-group might go into amnesiac mode after reboot. But in practice it should not allow more than 5 IP addresses based on the implementation, and this validation for "commit check" is skipped when fast-synchronize is configured.
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1352504 Large-scale users' login and logout may cause mgd memory leak.
 
The mgd memory usage is shown as increased by about 450 MB over the weekend (greater than 72 hours).
PR Number Synopsis Category: PFE on Aggregation Device
1358007 Laser receive power of extended ports is higher than the output power of the peer link
 
On Junos Fusion aggregate device platform, the interface diagnostics optics output of the extended ports shows the laser receive power is higher than the output power from the peer link. This is due to the Rx Optical power value received by Junos from SNOS is a raw Rx value, it has to be converted to nano-watts.
PR Number Synopsis Category: PFE on Satellite Device
1341254 ARP request packets might be dropped at egress SD in Junos Fusion Data Center environment
 
In Junos Fusion Data Center environment, when Aggregation Devices (ADs) are configured with irb interfaces and hosts in the same vlan connect to different Satellite Devices (SDs) over the same numbered physical ports, the ARP requests from one host might be dropped at the egress SD.
1397992 Extended Port (EP) LAG may go down on the Satellite Devices (SDs) if the related Cascade Port (CP) links to an Aggregation Device (AD) goes down
 
In a Junos Fusion Data Center if one Aggregation Device (AD) is isolated by disabling Inter Chassis Link (ICL) and all cascade ports (Link between AD and SD) and later if only ICL is reenabled on the AD then EP-LAG LACP will go down.This issue will not be seen if ICL is up and only AD-SD links go down.
PR Number Synopsis Category: Virtual Private LAN Services
1393447 Flow label is still used by ingress PE though the egress PE is not configured/supporting Flow label in a VPLS multihomed scenario.
 
if a LDP-VPLS routing instance is configured with active and backup neighbors, and flow label capability is enabled on active neighbor but not on backup neighbor, upon switching to the PW to backup neighbor, Junos on the VPLS PE will continue to send traffic with flow label based on the capability learnt from previously active neighbor.
PR Number Synopsis Category: Virtual Private Networks - rpd
1356763 Junos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host. (CVE-2019-0059)
 
A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device.
Modification History:
Update 2020-03-04 to address the use of specific login or IP addresses
- Update format
- Add a table of the known issues in this release
First publication 2019-01-18
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search