Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

20.3R3-S2: Software Release Notification for JUNOS Software Version 20.3R3-S2



Article ID: TSB18223 TECHNICAL_BULLETINS Last Updated: 08 Dec 2021Version: 1.0
Alert Type:
SRN - Software Release Notification
Product Affected:
Alert Description:
Junos Software Service Release version 20.3R3-S2 is now available for download from the Junos software download site
Download Junos Software Service Release:
  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts
Risk Risk Description
Low/Notification - No defined time impact to take action Software Release Notification
Impact Impact Description
Low/Notification - Monitor the situation but no action needed Software Release Notification


Junos Software service Release version 20.3R3-S2 is now available.

20.3R3-S2 - List of Fixed issues
PR Number Synopsis Category: QFX PFE MPLS
1616878 Traffic loss seen on QFX5k after STP topology change
On QFX5k running Junos, when two switches are connected to each other over redundant links with STP (Spanning Tree Protocol) enabled and MPLS (Multiprotocol Label Switching) is configured on an IRB (Integrated Routing and Bridging) interface, complete loss of traffic is observed when one of the link flaps or is disabled.
PR Number Synopsis Category: SPC3 HW and SW Issues
1625579 The flowd process lost heartbeat for 45 consecutive seconds without alarm raised
On SRX5K platforms with SPC3 card used, if the flowd process lost heartbeat for 45 consecutive seconds, all FPCs might reboot. However, the device marks the flowd process as down without alarm raised, the failover does not happen right away. Traffic loss might be seen due to this issue. Fix raises alarm at earlier stage. If cluster, there will be sooner failover.
PR Number Synopsis Category: CoS support on ACX
1620137 Traffic might get equally load-balanced irrespective of the scheduler configuration
On legacy ACX platforms, when HQOS(Hierarchical Quality of Service) is configured on physical interface and TCP(Traffic Control Profile) is attached to an IFL(logical interface) that has scheduler-map with transmit-rate configured in percent without guaranteed-rate configuration, traffic would be equally load-balanced, and not based on the configured transmit-rate.
PR Number Synopsis Category: "agentd" software daemon
1571999 gRPC session hanging in CLOSED state
On all platforms supporting JET and Telemetry, some gRPC sessions are hanging in CLOSED state.
1589103 The jsd process crash might be seen in a rare condition in a telemetry scenario
On Junos platforms with telemetry implemented, the JET service process (jsd) might crash if tracing is enabled for libgrpc while the collector continues to flap.
PR Number Synopsis Category: BBE GRES related issues
1616611 The Dual RE system might not be GRES ready after backup RE reboot in a subscriber management environment
On MX platforms in a high scaled subscriber management scenario, the system might not go GRES ready after Backup RE reboot. This impacts the GRES functionality.
PR Number Synopsis Category: BBE interface related issues
1616454 "show subscribers accounting-statistics ", "show services l2tp session interface asi0.xx statistics". may not work on LNS with asi- interfaces.
In a subscriber management environment, CLI commands "show subscribers accounting-statistics ", "show services l2tp session interface asi0.xx statistics" may not work on LNS with asi- interface.(Aggregated service interface)
PR Number Synopsis Category: Border Gateway Protocol
1611070 The rpd may crash after a commit if there are more than one address in the same address ranges configured under 'bgp allow'
If the 'bgp allow' feature is used and there are more than one address in the same address range, the rpd may crash on a commit with such configuration. And the subsequent commits related to BGP configuration change can cause rpd to crash as well.
1616931 Excessive logging of RPD_RV_INVALID_ENTRY messages
Every time a BGP policy evaluates RPKI status of a prefix as INVALID, a syslog message is printed.
1620463 The rpd may crash and restart when NSR is enabled
On all Junos with NSR (nonstop routing) enabled the rpd crash and restart may occur when RPKI (Resource Public Key Infrastructure) records are being replicated between the primary and backup RE (Routing Engine) and some of the records are withdrawn over the RPKI session.
1626367 Time delay to export prefixes to BGP neighbors might occur post applying peer-specific BGP export policies
On all Junos and EVO Platforms, when BGP export policies were changed from deny all to the peer-specific export policies, it might take several hours for the RPD/BGP to finish the export evaluation.
PR Number Synopsis Category: Enhanced Broadband Edge support for cos
1613126 Traffic loss might be observed due to the shaping rate be adjusted incorrectly in a subscriber environment on MX platforms.
On MX platforms with subscriber management enabled, if Class of service (CoS) adjustment based on DHCP tags and Point-to-Point Protocol Over Ethernet (PPPoE) Intermediate Agent (IA) tags are enabled, and a first subscriber that triggered the creation of the interface set is Dynamic Host Configuration Protocol (DHCP), statically configured shaping rate for the parent interface set may be incorrectly adjusted to a very low value. In this case, traffic loss might be observed.
PR Number Synopsis Category: CFM
1619231 OAM CFM adjacency is not forming on EX4300.
Due to the HW programming error, CFM sessions gets failed.
PR Number Synopsis Category: Device Configuration Daemon
1569399 ,Traffic might be interrupted while adding xe-/ge- interfaces as member of aggregated Ethernet interface bundle
On all Junos platforms, if a xe- or ge- interface has the "set interfaces disable" configuration, the interface is added as a member of an aggregated Ethernet interface bundle, and "delete interfaces disable" command is committed, then in some rare scenario it might result in vmcore and cause the system to reboot. This leads to traffic impact. After vmcore, system boots up and comes to normal state.
1599266 Duplicate source and destination pair check is done only across same tunnel encapsulation type for FTI
When configuring multiple flexible tunnel interface (FTI) tunnels, the source and destination address pair needs to be unique only among the FTI tunnels of the same tunnel encapsulation type. Prior to this PR, the source and destination address pair had to be unique among all the FTI tunnels regardless of the tunnel encapsulation type.
PR Number Synopsis Category: dns-proxy feature
1607867 DNS proxy functionality might not work on VRRP interfaces
On all SRX platforms, if DNS proxy is enabled on VRRP interfaces, then DNS proxy functionality might fail to work.
PR Number Synopsis Category: DNX platform MPLS FRR features
1621425 On ACX5448 and ACX710 platforms with L3VPN scenarios after multiple core link or protocol flaps, the errors may be observed
On the ACX5448 and ACX710 platforms running with L3VPN service, After multiple core link or protocol flaps, the following errors could be seen which will result in repeated L3VPN service Unilist next-hop install and uninstall in HW.
PR Number Synopsis Category: Covers Application classification workflows apart from custo
1595310 The flowd process might crash when AppID marks the application as complete and the inspection limits are hit
On SRX Series devices, when JDPI inspection-limits are reached, under certain circumstances, classification details are not propagated to interested Layer-7 Services, such as IDP, which might also cause the flowd process crash.
1608915 On All SRX devices that use Layer 7 inspection like ipd or APPId, a coredump may be seen in rare situations
AppID is double freeing the memory during appsigpack switch in a corner case which is causing the core. This double free can also happen without appsigpack switch in a rare corner case.
1613516 For apps getting classified on first packet, the volume update syslog is not getting generated.
On Junos 21.3R1 release, due to the default enablement of PMI(Power Mode IPSec) express path at FLOW end, for apps getting classified on first packet, the volume update log is not getting triggered. Workaround is to disable PMI using config : "set security flow power-mode-disable".
PR Number Synopsis Category: Ethernet OAM (LFM)
1571476 PPM crash may be seen if CFM (connectivity-fault-management) is configured on MX platforms with MPC10E line card used
On MX platforms with MPC10E line card used, PPM crash might be seen if CFM sla-iterator-profiles is configured. When this issue happens, the card will not go online which will cause the service traffic to be dropped.
PR Number Synopsis Category: FIB telemetry daemon
1619011 Support whole (atomic) updates at CNHG level.
1. As per current implementation, on-change updates for the below entities are already being sent as a whole (with both updated and unchanged leaves bundled together): - ipv4-entry - ipv6-entry - label-entry - next-hop - next-hop-group (without conditional) 2. As per current implementation, the only exception was for on-change update of next-hop-group (conditional) entity, in cases such as below: - interface being associated with a classifier - interface being removed from a classifier - dscp value mapping in a classifier changes In the current PR, we will be taking care of point 2 also to make it similar to 1.
PR Number Synopsis Category: SRX1500 platform software
1588627 IP packets might be dropped on SRX platforms
On SRX platforms, if IRB (integrated routing and bridging) interface is configured, IP packets whose size is bigger than 1450 Bytes and processed by the IRB interface might be dropped
PR Number Synopsis Category: IDP attack detection in the subscriber qmodules
1601926 This release includes optimizations made to IDP that help improve its performance and behaviour under load
This release includes optimizations made to IDP that help improve its performance and behaviour under load
PR Number Synopsis Category: Signature Database
1615985 IDP signature install taking longer time
IDP signature install is taking longer time on SRX Branch platforms
PR Number Synopsis Category: jdhcpd daemon
1625617 The rpd scheduler might continuously slip after GRES when there are 7k DHCP clients in a subscriber management environment
On the MX10008 platform with larger subscribers management, when it is configured as a DHCP (Dynamic Host Configuration Protocol) server having 7k DHCP clients binding, the commit can become very slow. After doing GRES (Graceful Routing Engine Switchover), the rpd may continuously run high CPU and scheduler slips for 20 minutes and may cause protocol flaps.
PR Number Synopsis Category: Flow Module
1619321 Security traffic log display service-name="None" for some application
On SRX series devices, the expected service name for some application does not display in security traffic log, however service-name="None" is displayed.
PR Number Synopsis Category: Firewall Policy
1579425 High CPU usage might be seen on some SRX platforms
On SRX300/320/340/345/380/550M platforms with Advanced Anti-Malware (AAMW) enabled, high CPU spike might be observed. This issue might cause device performance degradation.
PR Number Synopsis Category: User Firewall related issues
1589108 The jsqlsyncd process files generation might cause device to panic crash after upgrade
On SRX-Series devices configured in high-availability, after upgrade jsqlsyncd process files might get generated which might result in device panic crash.
1605933 Memory leak at the useridd process might be observed when Integrated User Firewall is configured
On SRX-Series devices having Integrated User Firewall enabled with Active Directory as the authentication source, memory leak might be observed at the useridd process.
PR Number Synopsis Category: IPSEC/IKE VPN
1596103 The kmd process might crash when VPN peer initiates using source-port other than 500
On SRX Series devices, when site-to-site IPsec VPN is configured with traffic-selectors, if the VPN peer initiates an IKE negotiation using source-port other than 500, and at the same time, the IPsec IKE rekey (For the same VPN tunnel as the previous VPN peer initiates) occurs on the SRX device, the kmd process might crash.
PR Number Synopsis Category: Layer2 forwarding on EX/NTF/PTX/QFX
1599094 The l2ald process may crash due to memory leak when all active interfaces in a VLAN are unstable
When none of the constituent active interfaces on a VLAN is stable, memory leak may occur which might eventually lead l2ald to crash. No memory leak will be seen if one or some constituent interfaces are flapping but the VLAN has at least one active stable interface overall.
1615269 The l2ald process might crash in EVPN scenario
On all MX and QFX platforms, memory corruption might happen when the IRB interface configuration is changed or MAC is added/deleted from VLAN MAC list of a Bridge Domain in an Ethernet Virtual Private Network (EVPN) scenario. The l2ald process crashes and multiple cores are generated. This is a rare issue and it recovers automatically.
PR Number Synopsis Category: lacp protocol
1599029 Uneven traffic distribution might be observed between member links of LAG
On PTX Series routers with LAG scenario where a prefix is advertised by two devices that are connected to the same upstream device, if the traffic with explicit null MPLS label from the upstream device to this prefix is shifted away from one of the devices by any means (like withdrawing the route advertising or disconnecting all its LAG links to the upstream device), the uneven traffic distribution might be seen on a few member links of the LAG on another device. This is due to an improper hash algorithm for LAG, which might cause performance degradation.
PR Number Synopsis Category: MX10K platform
1597066 Major alarms on all FPCs in chassis might be seen after some time from bootup
On MX10008/MX10016 platforms, the Flexible PIC Concentrator (FPCs) may get into Major alarm state which would mean Packet Forwarding Engine 0 (PFE0) disables operation after some days from start of the chassis, for instance bootup.
PR Number Synopsis Category: Neo Interface
1621286 All ports from the same pfe going down at the same time causes mqchip_disable_ostream timeout then triggers host loopback path wedge and disable-pfe
In a very rare situation, all ports from the same pfe going down may cause mqchip_disable_ostream timeout. When this error is seen, it is possible to have a temporary host loopback path wedge error and trigger disable-pfe. The wedge can be cleared by itself but the disable-pfe needs a FPC reboot to recover. After the fix, mqchip_disable_ostream timeout might be still seen but it won't trigger wedge and disable-pfe.
PR Number Synopsis Category: FreeBSD Kernel Infrastructure
1551193 VM might crash if file is shared between host operating system and guest operating system using virtFS
On Virtual Machines (VM) based platforms running Junos images, file might not be shared between host operating system and guest operating system via Virtual Filesystem (virtFS). When this issue happens, device might be restarted.
1563647 Memory corruption of any binary in /usr/bin/ or /usr/sbin/ may be triggered when a recovery snapshot is being copied to the OAM volume or system while it's in heavily stressed condition
Memory corruption of a binary from /usr/bin/ or /usr/sbin/ directory can occur if such binary is invoked when a recovery snapshot creation is in progress. The exact symptoms will be different depending on the exact binary and JUNOS version - some programs will show an error, and some programs will crash every time it is executed. Such memory corruption will be persistent until the affected Routing Engine is restarted. Please refer to TSB17954 ( for further details. In addition to recovery snapshot, a device reboot could also be a possible trigger when the system is under heavier read operations across the mounted packages.
1602005 Upgrade might fail when upgrading from legacy release
On all platforms while directly upgrading from Junos with FreeBSD 6 (e.g. 15.1X49 or before) to the affected releases, the system will check the USB connection. The upgrading will fail if there is no USB device detected during the upgrading process.
PR Number Synopsis Category: Kernel Tunnel Interface Infrastructure
1621696 Traffic loss can be seen on the new master RE post GRES
On all Junos platforms with GRE (Generic Routing Encapsulation) configuration, when we disable the gr interface on master RE and enable it on new master RE post GRES, traffic loss can be seen on the new master RE.
PR Number Synopsis Category: vMX Platform Infrastructure related issue tracking
1623237 Port speed might show as 100G even though chassis configuration is set for 40G manually
On vmx/mx-86 platforms, port speed might show as 100G even though the chassis config is set to 40G. This is a cosmetic display issue and does not impact services.
PR Number Synopsis Category: VRR (Virtual Route Reflector) for MX
1606819 Enable support for SR-IOV on X552/X557/82599-ES 10G interfaces on vRR
Support for SR-IOV on X552/X557/82599-ES 10G interfaces was missing on vRR. It's fixed now.
PR Number Synopsis Category: PTP related issues.
1618929 The clksyncd might crash and PTP/SyncE might not work
On MX240/MX480/MX960 with 1pps measurement port output and PTP/Hybrid mode configured by default during bootup, clksyncd may crash and dump a core. This issue will cause the PTP/SyncE to not work if the problematic configuration is present.
PR Number Synopsis Category: Chassis mgmt for all QFX systems - chassis MIB, alarms, CLI
1584902 The QFX5k/10k device might get hanged after reboot for sometime
On QFX5k/10K switches, during reboot in certain instances the device may get into a state where Junos virtual machine hangs until the NMI is triggered and reboots fully. The system recovers after ~30 mins.
PR Number Synopsis Category: QFX5K hostpath
1610295 MAC move or MAC flap may be triggered in the QFX5k VC environment
On all QFX5k platforms with VC (Virtual-Chassis) setup, IGMP (Internet Group Management Protocol) control packet received on a port in the backup (backup-RE) unit is forwarded back to the same port whereas split horizon is not working. Due to this, we might observe MAC (Media Access Control) move or flap. The workaround is to change the mastership between FPCs.
PR Number Synopsis Category: QFX L2 PFE
1614767 On QFX5K VLAN firewall filter is not deleted in PFE after configuration change
For VLAN based firewall filters configured on QFX5K series platforms, when replacing a firewall filter with another one, the previous filter might not be deleted in the Packet Forwarding Engine (PFE) after the configuration change, hence leading to traffic not being filtered as expected.
PR Number Synopsis Category: QFX EVPN / VxLAN
1593950 The dcpfe process might crash in EVPN-VxLAN scenario
On QFX5k platforms with EVPN-VxLAN, the dcpfe core may be observed in one of the LEAF devices in steady state after performing 'clear ethernet-switching table' on remote SPINE device in.
1612905 Arp resolution for data traffic received over Type5 might fail
Arp resolution for Data traffic received over Type5 might fail if the VNI ussed for decap for a given tunnel is also used for Encap VNI for another tunnel. When Encap VNI for a tunnel is created first followed by Decap VNI(same vni) for another tunnel we fail to update the routing instance needed for Decap.
PR Number Synopsis Category: QFX5100 Platform optics
1606003 QFX5100 : Generate an optical power after detached and attached QSFP on disabled interface.
On QFX5100, optical power is seen after detached and attached QSFP on disable interface.
PR Number Synopsis Category: QFX5100 Virtual Chassis
1619997 Disabled VCP (Virtual chassis port) will be UP after the optic on it is reseated
On all EX and QFX platforms, disabled VCP(Virtual Chassis Port) using the command "request virtual-chassis vc-port set interface vcp-xx/xx/xx disable member XX" will be up after the optic on it is reseated. It should keep disabling VC on the port. After it is UP and then a Master switchover is performed, the port will be disabled.
PR Number Synopsis Category: QFX5200/5110/5120/5210 Interface
1605037 The carrier transition counter might not get incremented upon link flap after the reboot
On all QFX platforms supporting auto-channelization, after reboot the carrier transition counter does not increment upon link flap.
PR Number Synopsis Category: Indirect nexthop routing infrastructure
1613723 The process rpd might crash in BGP rib-sharding scenario
In all Junos and Junos Evolve platforms, rpd crash might be seen when BGP rib-sharding is enabled and it may affect services/traffic.
PR Number Synopsis Category: SW PRs for SCBE3 fabric
1560053 When the system has only one plane (in the process of plane offline or online), the MPC10-10C line card displays a destination error
On MX Series routers with the MPC10 line card, the MPC10-10C line card displays a destination error if there is only one plane in the system and a new plane is brought online. Traffic might be impacted in this scenario.
PR Number Synopsis Category: Generic platform and infra issues for MS-MIC and MS-MPC(XLP)
1617830 Traceroute packets might get dropped in SFW service-set when other service-sets with asymmetric traffic processing are also enabled on the same MS-MIC/MS-MPC
When there are service-sets which are configured with knob "enable-asymmetric-traffic-processing" along with other CGNAT(carrier grade NAT) or SFW(stateful firewall) service-set, traceroute packets might get dropped on those even when the ICMP works for ping operation or otherwise. This can happen on ms- interfaces, i.e. on MX devices where multiservices-MPC (modular PIC concentrators) like MS-MPC or MS-MIC are installed. The initiator of the traceroute will not receive any error messages informing them about the failure.
PR Number Synopsis Category: SRX branch platforms
1580667 [SRX] error message tcp_timer_keep:Local(0x81100001:60753) Foreign(0x8f100001:33010) is seen in messages log every 80 seconds
On SRX series platform with Chassis Cluster, tcp_timer_keep:Local(0x81100001:60753) Foreign(0x8f100001:33010) is seen in messages log every 80 seconds.
PR Number Synopsis Category: SRX5XX platform
1575231 The fxp0 interface of an SRX550 in cluster might become unreachable from an external network
On SRX550 configured with chassis cluster, fxp0 interfaces might not be reachable from external management interface when the fxp0 and redundant Ethernet(reth) interfaces are in separate routing instances. This is because there is no ARP entry for the reth interface in fxp0 ARP table. As a result of this, SRX cluster cannot be accessed from an external management network.
PR Number Synopsis Category: Trio LU, IX, QX, MQ chip drivers, ucode & related SW
1619111 Degraded traffic processing performance might be observed in case of processing very high PPS rate traffic
MX-Series devices processing very high Packets per second (PPS) rate transit traffic might not show traffic processing performance enough and drop traffic.
PR Number Synopsis Category: Trio pfe bridging, learning, stp, oam, irb software
1606731 The FPC might crash if 'flow-table-size' is configured on MX platforms
On MX platforms, if knob 'set chassis fpc slot-number inline-services flow-table-size' or 'set chassis fpc slot-number inline-services flex-flow-sizing' is configured, the FPC might crash.
PR Number Synopsis Category: Authentication, Authorization, Accounting, PAM (RADIUS/tacplus)
1620564 SRX Accounting and auditd process might not work on secondary node
On SRX platforms, auditd process might not work in any of the cluster nodes except protocol master, hence accounting logs (login/logout/command execution logs) might not be sent to the configured authentication authorization and accounting (AAA) TACACS/RADIUS servers. The auditd process is responsible for accounting and hence this feature might be impacted.
PR Number Synopsis Category: Junos Automation, Commit/Op/Event and SLAX
1604622 File download using "request system download" might fail
On a EX4400 device, any files scheduled for download using the cli command "request system download" might fail due to error. The files can be downloaded using normal ftp/scp commands on the device.
PR Number Synopsis Category: Configuration management, ffp, load action
1601159 The commitd core file may be observed after committing some configuration change
On all Junos platforms, if juniper.db size is more than 700 MB and commitd is invoked, it causes the device to generate a core file (or dump file).
PR Number Synopsis Category: UI Infrastructure - mgd, DAX API, DDL/ODL
1586229 Fix fast-diff to detect the change when a deactivated delta-list element is deleted
Fix fast-diff to detect the change when a deactivated delta-list element is deleted
PR Number Synopsis Category: PTX/QFX10002/8/16 specific software components
1599183 False fan failure alarm flaps (set and cleared) frequently
Joule FTs on evo/Scapa has implemented dampening the zero speed failures. Vale/Junos will implement the same via this PR for joule FTs.
PR Number Synopsis Category: PTX/QFX100002/8/16 interface software
1600768 CRC errors increase continuously after interface flap
On PTX10008/PTX10016 devices with LC1101/LC1102/LC1103 line cards, interface flapping may cause the interface CRC errors increase continuously, then traffic loss might be seen. This is a rare timing issue.

20.3R3-S2 - List of Known issues

PR Number Synopsis Category: BBE Remote Access Server
1625858 Radius CoA (Change of Authorization) NAK may not be sent with the configured Source Address in a virtual-router environment
On all Junos, when running a radius server in multiple routing instances, the CoA NAK messages uses the interface address instead of the configured source address for non-existent sessions. This issue happens when the Radius server is configured in different virtual routers with different settings.
PR Number Synopsis Category: RPD Next-hop issues including indirect, CNH, and MCNH
1561984 The rpd crash might be observed during processing a huge amount of PIM prune messages.
In MVPN scenario, if huge amount of PIM prune messages (e.g. more than 3500 receivers for more than 3 multicast groups) are processed on a Junos device, the rpd crash might occur.
PR Number Synopsis Category: Resource Reservation Protocol
1453705 On the MX2010 Series routers, the BFD session on the IS-IS step up flaps during the ISSU - FRU upgrade stage.
Bfd session flaps during ISSU only in mpc7e card(Bfd sessions from other cards of DUT to peer routers did not flap during ISSU). Issue is not seen frequently.
Modification History:
First publication 2021-12-08
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search