BGP IPv4 PIC: PFE Selector stuck in rerouted state on Unilist NH after Primary AE link deactivate/activate

BGP IPv4 PIC: PFE Selector stuck in a rerouted state on the Unilist NH after Primary AE link deactivate/activate

MPLS routes might be dead if MPLS is disabled/deleted from the interface and enabled/added back to the same interface or the maximum number of labels is changed in quick succession without a delay

If family MPLS is disabled/deleted from the interface and enabled/added back to the same interface or the maximum number of labels is changed in quick succession, without a delay, the routes might be dead in the forwarding table with a label using this interface as out interface. Note: It is always recommended to add a slight delay (5 seconds is recommended) for this issue. Otherwise, the current fix also might not work and routes could remain dead.

On a ACX ring topo, after link between ACX and MX flap, VPLS RI on PE (MX) have no MAC of CE over l2circuit

Issue: During the core interface flap, the specific label route is switched between SWAP and PHP mode, when there is two paths are available in the ring (core interface which is flapping is giving PHP mode and other one is in SWAP mode). In issue case, the hardware route config is in SWAP mode and the Junos/HAL routes are in PHP mode. It leads to drop the forwarding traffic for the given label. Fix: Whenever the active member of unilist NH is changed, the same is not reflected in the corresponding routes. It leads the route is working with older active NH instead of latest one. To avoid this case, whenever the existing unilist NH's active member is changed, then route update is triggered for the same using topo walk.

On Ex2300/Ex3400 LLDP packets are dropped at L2PT NNI port when the configuration is applied for the first time.

On EX2300/EX3400, While configuring L2PT for tunneling LLDP, it is observed the LLDP packets are dropped at the L2PT NNI interface. Issue seen only first time the configuration is done and recovers with reboot.

Traffic spikes generated by IPFIX might be seen on QFX10002

From 17.3R1, on QFX10002 platform, in a rare condition, the IPFIX flow statistics (packet/byte counters) are incorrect in the exported record. Since the stats are not collected properly, the flow might timeout and get deleted due to inactive timeout, causing the number of exported records to be sent out unexpected. Traffic spikes generated by IPFIX might be seen.

The backup member switch might fail to become the master switch after switchover on QFX5100/QFX5200/EX4600 Virtual Chassis platform

On QFX5100/QFX5200/EX4600 Series Virtual Chassis platform with graceful-switchover (GRES) configured, if the backup member has file of /var/run/consoleredirect.pid, then reboot the master member of do Router Engine switchover, the backup cannot become the master member.

Fail to decap l2l hdr & invalid L2Lheader error messages are seen on FPCs during Master/Backup RE reboot

When an RE reboots and comes up again it sends Gratuitous ARP packets to the internal interfaces in order to advertise its MAC address. These packets get in to the UKERN running on the FPC, which drops these packets. The messages seen here are printed just before dropping these packets. These error messages are harmless and do not disrupt working of any feature.

LACP PDU may be looped towards peer MC-LAG nodes

In MC-LAG with force-up scenario, the LACP PDU loop may be seen when both MC-LAG nodes and access device using same admin key.

FPC Errors might be seen in subscriber scenario

In subscriber scenario, if the"service-accounting-deferred" is configured on dynamic-profile, and there is multicast to a large number of destinations on the same physical port, the FPC Errors might be seen.

Static default route with next-table inet.0 does not work

On QFX5000 paltforms, when a static default route with next-table inet.0 is configured in a routing instance, the traffic hitting this route will be dropped.

VxLAN nexthop entry leak issue on EX4600 and QFX5K platforms

On EX4600 and QFX5K series platforms, due to a sync issue between Kernel and PFE, VxLAN nexthop entry might fail to be deleted on PFE upon route change, with log "brcm_vxlan_riot_destroy_nh" reported. If too many nexthop entries cannot be deleted and fill up the l3 egress table, new entries will not be added and might result in traffic impact.

In rare cases rpd might crash after RE switchover when BGP multipath and L3VPN vrf-table-label are configured

When BGP multipath and L3VPN vrf-table-label are configured, after RE switchover, in rare cases, rpd might crash due to a vrf-table-label reallocation issue. During the crash, the routing table and neighborship will become unstable and traffic will be dropped, it will be restored automatically.

BFD flaps are seen on PTX or QFX10K platforms with inline BFD

With inline-BFD configured on the PTX or QFX10000 platforms, BFD sessions might flap continuously.

Targeted Broadcast might not work on EX3400

On EX3400 platforms, in the Targeted Broadcast scenario, the broadcast packets might not be generated on the LAN even if the Targeted Broadcast feature is enabled.

[EVPN/VXLAN] VTEP tunnel doesn't get deleted when EVPN peer goes down

On a QFX and MX running Junos and EVPN-VXLAN, the VXLAN tunnel created dynamically to other EVPN peers, may not be deleted if a EVPN PE goes down or access link(s) is disabled.

QFX5100// vlan-xlate - Q-in-Q - Table full

On a QFX5100 Q-in-Q may stop working for certain vlan-id-list configured under an IFD. This is result of a PFE binary issue which is addressed through an upcoming image.

L3 gateway did not update ARP entries if IP or MAC quickly move from one router to another router in EVPN-VXLAN environment

If IP or MAC quickly move from one router to another router in a highly scaled EVPN-VXLAN environment, such as 1000+ simultaneous VMs mobility events where the VMs move to a new leaf switch and the VM MAC addresses are also changed, L3 gateway did not update ARP entries with new location of the VM and MAC.

The process rpd may crash in BGP setup with NSR enabled

In BGP setup where "prefix-limit" is configured with teardown parameter and damping is configured, if a flapping route is received, the related figure of merit doesn't reach the "suppress-limit" but it causes the device to teardown the respective peer since the "prefix-limit" to be exceeded, then the process rpd may crash because of the corruption on the NSR process to resync the database entries.

12th and 13th SFP-T ports on the NFX250 device are going down with the 18.4R1.3 image installation

On an NFX250, an SFP-T interface will not become active (UP) when it is plugged into either a ge-12/0/0 or a ge-13/0/0 interface.

EVPN database and bridge mac-table are out of sync due to the interface's flap

If some interfaces flap faster on the remote PE, EVPN database and bridge mac-table might be out of sync on the local PE device. When this issue occurs, it may cause the impacted PE broadcasts packets to all the other PEs. And the broadcasted packets might cause traffic congestion which results in packet loss.

Voltage read failed for rail LTC3887-EA1-VDD0V9R2-CH0

On an MX10003 and an MX10008, its i2c bus may fail a read operation. There is a retry operation to address this particular error. This PR optimize the retry logic and its alerting mechanism

QFX5120 : In VxLAN-EVPN configuration , transition from collapsed to non-collapsed L2/L3 GW and vice versa needs switch reload

On a QFX5120 system Transition from VXLAN/EVPN collapsed to non-collapsed L2/L3 GW and vice versa needs switch reload due to stale source vtep IP.

IGMP-snooping on EVPN-VXLAN might impact OSPF hello packets flooding after VTEP leaf reboot

In EVPN-VXLAN (Ethernet VPN - Virtual Extensible LAN protocol) scenario, if IGMP-snooping (Internet Group Management Protocol) is configured, OSPF (Open Shortest Path First) hello packets flooding might be broken after the VTEP (VXLAN Tunnel Endpoint) reboot. After the reboot, OSPF hello packets are received by the VTEP, but they might be no longer flooded out. The issue results in OSPF neighbor down which leads to traffic loss.

Without dot1x configuration, the syslog "dot1xd[2192]: task_connect: task PNACAUTH./var/run/authd_control addr /var/run/authd_control: Connection refused" is generated repeatedly.

Without dot1x configuration, the syslog "dot1xd[2192]: task_connect: task PNACAUTH./var/run/authd_control addr /var/run/authd_control: Connection refused" is generated repeatedly.

MAC address movement might not happen in Flexible Ethernet Services mode when family inet/inet6 and vlan-bridge are configured on the same ifd

On EX4300/EX4600/QFX3K/QFX5K platforms with flexible-ethernet-services enabled, when family inet/inet6 and vlan-bridge are configured on the same ifd, and family inet/inet6 is configured first, MAC address movement (MAC learning/deleting) might not happen on this interface, it will cause traffic drop.

AE interface Twamp History Stats Verification on Client is not as expected getting "Request Timed Out" error.

This fix enables the ACX platform to set Enhanced IP ( optimized container NH ) for AE interfaces during boot time. Thus, resolving the issue with AE interface on ACX platform.

Parity error might cause FPC alarm

The parity errors related to static memory areas in the XQ chip can be corrected by writing back the scheduling node configuration again. This part was missing and as a result we used to generate alarm for every such occurrence.

Virtual Route Reflector may reports DAEMON-3-JTASK_SCHED_SLIP_KEVENT error on some hypervisor or host machine because of NTP sync. Routing protocol may be impacted.

Virtual Route Reflector may report DAEMON-3-JTASK_SCHED_SLIP_KEVENT error on some hypervisor or host machine. Routing protocol may be timed-out because of this slip. When hypervisor is providing inaccurate hardware time-counter , NTP time sync may trigger temporarily JUNOS kernel hang which may end up with protocol impact.

hostname does not update at FPC shell after system configuration change on CLI

On PTX platform, hostname does not update at FPC shell after host name change unless FPC reboot.

The PTX10002 may stop forwarding packets after the "chassis-control" process restarts

This issue is specific to PTX10002. During normal operation, if the "chassis-control" process restarts, Express ASICs are not initialized. This causes packets dropped on the output queue.

SRRD crash in read_route_rpd_select_cb

RSVP Path error received on PSB:2 ( new path calculated by CSPF) is not treated as Optimization when CSPF is computed and optimization retry is not honoring 2^retry + rsvp-error-hold-time

The optimization timer is being updated in an incorrect manner in the code path. Due to this a particular check fails when the exponential increase function is called. This code path has been fixed.

RSVP LSP might stuck in down state in OSPF Multiarea topology

In OSPF Multiarea topology (ABR has one or more multi-area adjacencies--one interface is attached to multiple OSPF areas), and inter-area RSVP LSP is configured (inter-domain is configured inside LSP), when primary path failure or optimize-timer triggers to signal a new instance of LSP, the LSP might stuck in down state and it could not complete the signaling process. The reason is the incorrect CSPF on ABR which leads to RSVP path message loop and also causes next CSPF run to be skipped on the headend.

Post ISSU, Filter configuration change getting error logs "Error compiling filters" logs and none of the new filter configs are getting applied

When firewall filter compiled objects are not synced between the master RE and backup RE. The filter objects are in /var/etc/filters directory. If anyone of these object is missing on the router will cause this issue.

A new tunnel could not be established after changing the NAT mapping IP address until the IPEC SA Clear command is run

On IPSEC VPN with NAT-T scenario, when changing the NAT mapping IP address on NAT device, the new tunnel could not be established until the IPEC SA clear command is run. The reason is that the NAT IP change with any IKE negotiation triggers IPsec SA cleanup even before handling the delete request, and old NAT IP is still present even after the internal IPSEC SA update/handling. And this causes a problem in new IPsec SA setup later because old entry for this proxy ID is present with some other remote gateway (which is nothing but old NATTed IP entry). The related syslog messages could be seen in the External Description.

High CPU usage on fxpc process might be seen on ACX5K platform

On ACX5K platform, the fxpc process high CPU usage might be seen under rare condition if parity errors are detected in devices. It has no direct service/traffic impact. However since CPU utilization is high during this issue, there are some side-effects. Eg, it could impact time-sensitive features like BFD.

The FPC CPU might be hogged if channelized interfaces are configured

On MX platform, with 1xCOC12 or 4XCOC3 used, if channelized interfaces are configured, FPC CPU hog might be seen.

QFX5200-even same traffic flow, but the hash for ECMP NH is not consistency

When the Mpls traffic with the same inner IP flow(same 5-tuples) landing into the QFX5200 via different physical ports and outgoing via ECMP next-hop, the traffic flow may select a different next-hop due to ECMP having Port/Mod-Id for hashing.

PFE wedge may be observed after performing the command "show forwarding-options load-balance ..."

On MX platform, performing the command "show forwarding-options load-balance ..." may cause PFE wedge after some number of attempts (<200 in test), if the option "destination-address" of the command matches the default route with "discard" action, this is because a defect code causing internal flow errors is involved in that scenario.

4x10G interfaces on PTX3000/PTX5000 FPC type 3 might not come up after frequently flap for a large amount of time

On PTX3000/PTX5000 platforms with FPC3, if remote-connected interface continuously flaps for a large amount of time, the 4x10G interfaces on FPC3 might get down and never come up. The probability of occurrence increases with the number of continuous flaps.

The allocation of MAC address may fall out of the MAC address pool on MX204 platform

On MX204 platform, the allocation of MAC address for 2nd PIC in the FPC may fall out of the MAC address pool, which may further cause MAC confliction in the network.

MACSEC connection on ex4600 will not come back up after interface disconnect while traffic is passing

If a interface is physically disconnected (cable or sfp removed) and that interface is a member of a aggregate link AND MACSEC traffic is passing when the interface is pulled. The MACSEC will stop working. Reset of the AE interface and or physical interface is required to restore service.

The native VLAN ID of packets might fail to be removed when leaving out

On EX9200 switches with EX9200-12QS line card, packets will be sent with tagged native VLAN ID via access interface or trunk interface, because the native VLAN ID is not removed when being forwarded out, communications failure will be met.

CFM and BFD might flap while collecting MPLS statistics

When the transmission timer for the CFM/BFD session is between 100ms and 1 second, during the MPLS statistics collection if there are a large number of next-hops (several thousand) related to MPLS forwarding, the transmission of the periodic packet may be delayed to cause the session to expire on the remote side of the session due to timeout.

On EX4300 interface flapping might lead to ECMP nexthop install failure

On EX4300 platform with ECMP (Equal-Cost MultiPath) enabled, interface flapping might trigger a sequence of ulst nexthop install/uninstall events which exceed the system limit, leading to nexthop install failure on PFE (Packet Forwarding Engine).

Heap memory leak might be seen on QFX10000 platforms

On QFX10000 platforms (QFX10002, QFX10008, QFX10016 ), if BFD is configured, heap memory leak will be seen.

The device may proxy the ARP Probe packets in an EVPN environment

In an EVPN environment, Proxy ARP and ARP Suppression is enabled on the PE device by default for reducing the flooding of ARP packets, however, in the case of ARP Probe packets used in the process of DAD (Duplicate Address Detection), the client may treat the IP address that it's in use as duplicated address after receiving the proxied packets from PE device.

The rpd might crash while handling the withdrawal of an imported VRF route

In L3VPN scenario with multipath enabled for BGP L3VPN family, if the knob "no-vrf-propagate-ttl" and "maximum-prefix" are configured for VRF, in some certain conditions, the rpd might crash when the maximum-prefix is hit and the withdrawal of VPN route occurs.

fxpc core dump on EX2300 VC

On EX2300, FXPC core is seen. This is due to DMA memory stuck in hardware.

MPLS LSP auto-bandwidth stats miscalculations may lead to high bandwidth reservation

With auto-bandwidth configured for Resource Reservation Protocol (RSVP) Label Switched Path (LSP), when current stats collected are lower than previous values, the current stats is used to calculate rate and the rate can be skewed, hence large bandwidth might be wrongly reserved for the LSP. If there is no sufficient resources (e.g. bandwidth, alternative path) in the network, other LSPs might be torn down, or might not go up.

rebooting VC member causes 30 sec down on RTG link

when rebooting VC backup node, traffic on RTG link may down for 30 sec around.

CFM message flooding.

When an action profile is configured on a VPLS PE functioning as a CFM MEP, transit CFM packets are flooded throughout the VPLS instead of being sent unicast to its destination.

The rpd would core dump due to improper handling of Graceful Restart stale routes

In BGP Graceful Restart scenario, including helper mode which is enabled by default, rdp would core dump due to improper handling of BGP Graceful Restart stale routes during the BGP neighbor deleting. The rpd would crash and service/traffic impact would occur.

Licenses used flag for ovsdb on "show system license" won't be flagged even though ovsdb is configured and working

Licenses used flag for ovsdb on "show system license" won't be flagged even though ovsdb is configured and working root@jtac-qfx5100> show system license License usage: Licenses Licenses Licenses Expiry Feature name used installed needed bgp 1 1 0 2020-03-28 05:30:00 IST isis 1 1 0 2020-03-28 05:30:00 IST mpls 0 1 0 2020-03-28 05:30:00 IST vxlan 1 1 0 2020-03-28 05:30:00 IST ovsdb 0 1 0 2020-03-28 05:30:00 IST<<<

The fxpc may continually crash when firewall filter is applied on a logical unit of a dsc interface

On QFX5000 platforms, the fxpc may continually crash when firewall filter is applied on a logical unit of a dsc interface. It has traffic impact.

IP missing in mac-ip-table of evpn database but present in evpn database when CE interface has two primary IP address

in some scenarios where CE has more than one IPs (VRRP or similar setup), after switch over or similar event, secondary/virtual IP might be missing in evpn mac-ip table (as well as arp table) causing traffic/host reach ability issue.

When MBB for P2MP LSP fails, it is stuck in old path

When MBB for P2MP LSP fails due to one or more sub LSPs did not come UP, the MBB is stopped and it is not re-tried until there is a change in the TED, during the subsequent re-optimization.

DHCP-relay may not work in an EVPN-VxLAN scenario

On QFX10000 platform with an EVPN-VxLAN setup, DHCP-relay may not work if the DHCP server is reached via the routes learnt through EVPN type-5 routes.

The vrrpd process might crash after deleting VRRP sessions for several times

If VRRP group has preemption configured and corresponding logical interface has been disabled/deactivated and re-enabled/re-activated some time after, the VRRP process may crash at the moment of changing mastership for that group.

Interface on QFX does not come up after the transceiver is replaced with one having different speed

On QFX series platforms, interface may not come up when the transceiver is replaced with another transceiver which has different speed.

QFX10K: Hold-down timer configured interface are processing incoming packets leading to packet forwarding through the ASIC

QFX10K: Hold-down timer configured interface are processing incoming packets leading to packet forwarding through the ASIC

COS rewrite rule for protocol mpls-inet-both-non-vpn may be not applied in combination with Chained Composite NH

When Chained Composite NH is configured in the system, CoS rewrite rule for protocol mpls-inet-both-non-vpn may fail to be applied to the non-VPN IPv4 traffic. The problem is introduced in the following Junos releases: 16.1R8 16.2R3 17.1R3 17.2R3 17.3R4 17.4R2 18.1R2-S3 18.1R3 18.2R2 18.2X75-D20 18.3R1 18.4R1

The NCP session might be brought down after IPCP Configure-Reject is sent

On MX platforms running with Point-to-Point Protocol (PPP) subscribers, if the subscriber repeatedly send PPP Internet Protocol Control Protocol (IPCP) Conf-Request packet with a fixed IP address which couldn't be offered, MX will reply with IPCP Conf-NAK. Then after Network Control Protocol (NCP) max-failure is reached, MX will send Conf-Reject and directly bring down the NCP session due to this issue. The unnumbered Conf-Request with no IP address in IP option sent by subscriber later will be discarded due to NCP event down already takes place.

Incorrect Model Information while polling via SNMP from Virtual-Chassis

When polling the VC information about the members via SNMP, Juniper was sending incorrect information, which was showing the model info of the Master only. After the fix, the model information for every member of the VC is sent correctly back to the polling request.

IPv6 aggregate routes are hidden

IPv6 aggregate routes get hidden in the routing table until the rpd is restarted in some rare situations.

IPFIX Flow timestamp is not matching with NTP synchronized system time

The timestamp reported for packet arrival in NetFlow records will report inaccurate time due to the synchronization issue with NTP.

QFX5110 SFP-T: All ingress traffic are dropped on 100m fixed speed port with no-auto-negotiation

On QFX5110, ingress traffic will be dropped on 100m fixed speed port which has no-auto-negotiation setting.

MX10003 - PEM not present alarm raised when minimum required PEM exist in the system

On MX10003, PEM not present alarm raised when minimum required PEM exist in the system.

The jdhcpd memory leak might happen on MX5/MX10/MX40/MX80/MX104 when testing DHCP subscribers log-in/out

On MX5/MX10/MX40/MX80/MX104 Series platforms with DHCP server configuration for DHCP subscribers, the jdhcpd memory leak might happen and the memory increase by 15MB which depends on the number of subscribers when testing the DHCP subscribers log-in/out.

Incorrect MAC count with "show evpn/bridge statistics"

After a mac move from local interface to a remote mac, "show bridge/evpn statistics" command reports the wrong number of MACs learned on an interface. "show bridge/evpn mac-table count" provides the accurate number of MACs learnt

The ERPS failover does not work as expected on EX4300 device

On EX4300 Series switches with Ethernet Ring Protection Switching (ERPS) deployment scenario, the firewall daemon (dfwd) may not be able to read the configuration file for the policer actions which are blocking the filter push operation to the Packet Forwarding Engine (PFE), as a result, the ERP packet gets dropped in hardware.

The device is in Amnesiac mode after ISSUe with "mgd: error: configuration check-out failed" generate

If "service-filter" is configured, the device might be in Amnesiac mode after executing ISSU and error message "mgd: error: configuration check-out failed" might be seen.

Stale MAC addresses are present in the bridge mac-table in EVPN/MPLS scenario

In EVPN/MPLS scenario, if many MAC (about 10k) addresses are removed, some MAC addresses might never get cleared up from the bridge table due to next-hop is not getting cleared in time within the PFE. So they might remain present in the bridge MAC table even after the aging time (default 300s).

Policy matching RD changes next-hop of the routes which do not carry RD

If a policy-option with only conditions "from route-distinguisher" and "then next-hop a.b.c.d" is applied to BGP, the next-hop for routes in the inet.0 might be set to this next-hop a.b.c.d, even though these routes do not carry any route-distinguisher value (l3vpn.inet.0 is unaffected).

PIM join not sent upstream until MSDP SA is received

There could be a significant delay between the time when the (*,G) PIM JOIN is received from downstream interface and a corresponding PIM JOIN is sent to the Upstream router. In order to hit this problem there has to be (*,G) state and the source information has to be received over MSDP. In this case if the PIM JOIN from the downstream device expires the subsequent PIM JOIN from this downstream device will not trigger an Upstream PIM JOIN until the corresponding MSDP SA is received.

Traffic gets dropped when end behind NAT is the responder

This issue happened when the end behind NAT is the responder for IKE SA. With this setting, the remote gw port was incorrectly set as 500 instead of 4500. So the outbound traffic has UDP port 500 as the destination port. Hence the traffic gets dropped.

rpd core after exeucting ping mpls ldp

In LDP to BGP-LU stitching scenario, when user performs a MPLS ping, if the BGP routes for that LSP is unavailable, the rpd will crash.

Transit DHCPv6 packets might be dropped on QFX5000 platforms

On QFX5000 platforms, transit DHCPv6 packets might be dropped. I.e., pass-through DHCPv6 packets might not be forwarded.

QFX5110, QFX5200, QFX5210 There is no jnxFruOK SNMP trap message when only the Power cable is disconnected and connected back.

QFX5110, QFX5200, QFX5210 There is no jnxFruOK SNMP trap message when only the Power cable is disconnected and connected back. This issue is not shown when pull out PSU and reset. The issue is seen when disconnect power cable and reconnect it. The issue is fixed as "Power Supply OK" SNMP trap is generated. May 28 02:15:58 [Alarm CLEAR] Object 75 reason 24 Device PSU-PEM 1, reason PEM 1 No Power(FPC0: PEM 1 Not Powered), color 1, slot 1 Alarm id 1258356760 May 28 02:15:58 send: red alarm clear, device PSU-PEM 1, reason FPC0: PEM 1 Not Powered May 28 02:16:05 CHASSISD_SNMP_TRAP6: SNMP trap generated: Power Supply OK (jnxContentsContainerIndex 2, jnxContentsL1Index 1, jnxContentsL2Index 2, jnxContentsL3Index 0, jnxContentsDescr Power Supply 1 @ 0/1/*, jnxOperatingState 2)

MX104 ingress multicast replication with latency fairness drops multicast traffic on 18.4R1

Multicast Latency Fairness bug results in packet being dropped when the only PFEs present in the list are less than 32.

The socket resource leaks might be seen if repeating set/delete LDP configuration

On 16.1R1 onwards releases, the LDP TCP port 646 keeps opening as "LISTEN" state even after deleting LDP protocol from the configuration, resulting in socket leak.