Outstanding and Resolved Issues, Limitations, and Upgrade/Downgrade Issues in JUNOS Release 9.4 for EX-series Switches

Outstanding issues in the JUNOS Release 9.4R4 software for EX-series switches, limitations, issues that have been resolved since JUNOS Release 9.4R3, and issues regarding software upgrade or downgrade are described on the following pages.

• Outstanding Issues
• Resolved Issues
• Limitations in JUNOS Release 9.4 for EX Series Switches
• Upgrading or Downgrading from JUNOS Release 9.4R1 for EX-series Switches
• Upgrading from JUNOS Release 9.3 to Release 9.4 for EX-series Switches
• Upgrading from JUNOS Release 9.2 to Release 9.4 for EX-series Switches
• Downgrading from JUNOS Release 9.4 to Release 9.2 for EX 4200 Switches

Outstanding Issues

The following are outstanding issues in JUNOS Release 9.4R4 for EX-series switches. The identifier following the description is the tracking number in our bug database.

Note: The following PRs that were previously included in the JUNOS Release 9.4R3 release notes as outstanding issues have been removed, because these issues are not present in JUNOS Release 9.4R4 for EX-series switches: 274019, 278784, 389276, 390812, 398046, 398182, 400360, 402109, 402163, 405899, 406032, 407020, 410947, 411660, 412908, 413637, 414110, 414213, 415959, 416062, 417024, 417236, 418325, 419981

Access Control and Port Security

• When you have a port with membership in a VoIP VLAN and a guest VLAN and configured with 802.1X authentication, traffic in the VoIP VLAN is forwarded even after authentication has failed for the port. [PR/292268]
• When you change the MTU value for an interface, the DHCP snooping database and the IP source guard database are reset. [PR/295588]
• On EX-series switches, if you configure the RADIUS server revert-interval interval option, the switch does not attempt to reconnect to the unreachable server after the revert interval has elapsed. [PR/304637]
• On EX 8200 switches, the medium attachment unit (MAU) type field is empty in the Link Layer Discovery Protocol (LLDP) protocol data unit (PDU). [PR/392043]
• When an EX-series switch detects an invalid MAC address on an interface configured for a specific MAC address, the switch does not log this event to the system messages logs. [PR/401294]
• EX-series switches use the source IP address instead of the relay agent IP address when relaying a DHCP Discover message or DHCP Request message to the DHCP server. [PR/426952]

Bridging, VLANs, and Spanning Trees

• On EX 8200 switches, when the links on STP-enabled routed VLAN interfaces (RVIs) come up, control packets might egress before the STP BPDUs. [PR/300576]

Class of Service

• On EX 8200 switches, classification of packets using ingress firewall filter rules with forwarding-class and loss-priority configurations does not rewrite the DSCP or 802.1p bits. Rewriting of packets is determined by the forwarding-class and loss-priority values set in the DSCP classifier applied on the interface. [PR/399331]

Hardware

• On some 48-port SFP line cards used in EX 8200 switches, you cannot insert a copper transceiver into the first or last ports on the bottom row (ports 1 and 47). If you cannot insert the transceiver smoothly into one of these two ports, do not force it. Instead use another port. [PR/423694]

Firewall Filters

• Policers may be shared across interfaces that are part of the same Packet Forwarding Engine. If the same policer is applied to two interfaces on the same Packet Forwarding Engine, then the policer is shared. If the same policer is applied to two interfaces on different Packet Forwarding Engines, the policer is not shared and functions as two separate policers. [PR/405111]
• The accept, log, and syslog actions in the firewall filter configuration might not work as expected for packets destined for the switch CPU. [PR/406714]

Infrastructure

• After you upgrade or downgrade the software on an EX-series switch (by using either the CLI or the J-Web interface), the Juniper Web Device Manager might not function properly until you clear the cache in your Web browser. [PR/286614]
• The RADIUS request sent by an EX-series switch contains both Extensible Authentication Protocol (EAP) Identity Response and State attributes. [PR/300790]
• On EX-series switches, configuration using configuration groups is not supported in the J-Web interface. When management access port, default gateway, and Telnet or SSH services are configured using configuration groups through the CLI, the corresponding J-Web configuration pages might not show the configuration properly. [PR/303153]
• On EX 8200 switches, a 48-port RJ-45 line card configured for fixed mode (no-auto-negotiation) does not disable interfaces when the two ends of the connection are configured with different speeds. [PR/307834]
• On EX 8200 switches, while commits of configuration changes under the interfaces or routing-options stanza are in progress, VRRP advertisement does not occur for a short time. This can result in a change of VRRP mastership. [PR/310524]
• On EX 8200 switches, during chassis bootup, the system log might display the following messages:

  "RT-HAL,rt_entry_add_msg_check,1116:unknown vlan index 0"
  "RT-HAL,rt_msg_handler,407:route check failed"

  [PR/313185, PR/313187]

• On EX 8200 switches, RIP version 1 does not work properly. [PR/394905]
• If you configure interface parameters on an EX 3200 or EX 4200 switch running JUNOS Release 9.2 or Release 9.3 for EX-series switches and then attempt to upgrade to a later release or to a later version of Release 9.3 than the one that is currently installed, the switch might display the following error message: init: interface-control is thrashing , not restarted. As a workaround, on the interfaces you had previously configured, configure no-auto-negotiation and set the link mode to full-duplex, then commit the revised configuration. [PR/397290]
• On EX 3200 and EX 4200 switches, when the neighbor switch reloads, kernel error messages flood the message logs and the following error message might appear in the log files:

  kernel: %KERN-1-RT_PFE: RT msg op 1 (PREFIX ADD) failed

  [PR/398203]

• In the J-Web interface, you cannot commit some configuration changes in the Port Configuration and VLAN Configuration pages because of the following limitations for port mirroring ports and port mirroring VLANs:
  • A port configured as the output port for an analyzer cannot be a member of any VLAN other than the default VLAN.
  • A VLAN configured to receive analyzer output can be associated with only one port.

  [PR/400814]

• When you are connected to an EX 8200 switch using Telnet, issuing the show lacp statistics interfaces command might cause the CLI to stop responding. [PR/402393]
• On EX 8200 switches, the in-band management option is not supported in the EZSetup wizard. Use the out-of-band management option while using the EZSetup wizard for initial configuration. [PR/414960]
• On EX-series switches, the storm control command options no-broadcast and no-unknown-unicast do not have any effect. [PR/415542]
• On EX 8200 switches, the LCD might display FAN FAIL even though the fans are operational and running at normal speed. [PR/415756]
• On EX 8200 switches, after a graceful Routing Engine switchover (GRES), unicast routed traffic might egress as untagged packets or as packets with incorrect tag values. As a workaround, restart the egress line card. [PR/416358]
• When the MSTP topology changes in an extended VLAN topology, sometimes sessions such as those for VRRP, BFD, and protocols dependent upon BFD (such as PIM or OSPF) bounce briefly. [PR/416400]
• If you swap the VLAN IDs of a PVLAN and a VoIP VLAN and then swap again to restore the original VLAN IDs, the VoIP-tagged traffic is discarded due to VLAN filtering on the VoIP access interfaces. [PR/416706]
• After a redundant trunk group (RTG) interface switchover, MAC address aging does not stop, even though traffic is sent continuously and switched correctly. [PR/416739]
• Traffic might not be forwarded correctly in a Q-in-Q VLAN if a customer VLAN is added and deleted. [PR/416817]

Interfaces

• The following message might appear in the system log.

  Resolve request came for an address matching on Wrong nh nh:355, type:Unicast...?

  You can ignore this message. [PR/313195]

• On EX 8200 switches with 48-port RJ-45 line cards, interface links might go down and come back up while you are adding the interfaces to an aggregated Ethernet interface. [PR/395936]
• On EX 8200 switches, when a Layer 3 subinterface and an RVI are next hops for a multicast group, modifying the subinterface configuration causes flooding in the VLAN until the IGMP snooping table is populated. [PR/403597]
• The system log might display the following messages when the monitor interfaces interface-name command is issued simultaneously from multiple Telnet sessions:

  Nov 21 11:55:29  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-6/0/40, stats_req 0xa8f33d80, sreq_id 41028, new sreq_id 42053
  Nov 21 11:55:44  st-grande02-re0 login: LOGIN_INFORMATION: User regress logged in from host 172.24.104.140 on device ttyp5
  Nov 21 11:55:45  st-grande02-re0 su: regress to root on /dev/ttyp5
  Nov 21 11:55:53  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-0/0/35, stats_req 0xa8a9dd20, sreq_id 4380, new sreq_id 5405
  Nov 21 11:56:27  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-0/0/30, stats_req 0xa8b60de0, sreq_id 54857, new sreq_id 55882
  Nov 21 11:56:46  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-0/0/31, stats_req 0xa89a56c0, sreq_id 36596, new sreq_id 37621
  Nov 21 11:56:58  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-0/0/33, stats_req 0xa8bd3d20, sreq_id 32622, new sreq_id 33647
  Nov 21 11:57:08  st-grande02-re0 /kernel: ifd_pfestat_req_wait_internal: ifd ge-0/0/31, stats_req 0xa8bd3d20, sreq_id 52160, new sreq_id 53185

  [PR/403842]

• On EX 8200 switches, if primary and backup interfaces for link protection are configured on a LAG interface (under the ether-options 802.3ad statement), packets might egress on the backup interface instead of the primary interface when the line card is restarted or during Routing Engine switchover. As a workaround, remove and reapply the LAG configuration. [PR/409934]
• On EX 8200 switches, if a Layer 3 LAG interface is configured with VLAN tagging, disabling one subinterface disables the aggregated Ethernet interface.

  As a workaround, do the following:

  1. Deactivate and activate the configuration.
  2. Delete and add the LAG interface again.
  3. Restart the respective line card.

  [PR/413110]

• On EX 8200 switches, aggregated Ethernet interfaces might go down and come back up for a few minutes while the switch is updating many routes. [PR/416976]

Layer 3 Protocols

• IGMP snooping does not function for IGMPv3 reports with the exclude filter mode. [PR/286600]
• On EX 8200 switches, occasionally, IGMP snooping details of a VLAN are not reflected in the multicast route for that group. [PR/390991]
• On EX 8200 switches, if Protocol Independent Multicast (PIM) is enabled, the switch might record the following in the system log:

  Jan 13 15:13:19  st-grande02-re0 fpc0 RT-HAL,rt_entry_change_msg_check,1207: Unknown prefix 8.0.1.6
  Jan 13 15:13:19  st-grande02-re0 /kernel: RT_PFE: RT msg op 3 (PREFIX CHANGE) failed, err 5 (Invalid) 
  Jan 13 15:13:19 st-grande02-re0 fpc0 RT-HAL,rt_msg_handler,407: route check failed.

  [PR/415748]

Resolved Issues

The following are the issues that have been resolved since JUNOS Release 9.4R3 for EX-series switches. The identifier following the descriptions is the tracking number in our bug database.

Bridging, VLANs, and Spanning Trees

• When you change the configuration of an interface configured using the apply-groups configuration statement to an interface-specific configuration, or if you have both an interface-specific configuration and configuration using the apply-groups configuration statement under the interface stanza, the interface might become part of the default VLAN even when the interface is configured as a member of another VLAN. [PR/453054: This issue has been resolved.]

Infrastructure

• On EX 8200 switches, in a scaled environment with a large number of routes and ARP entries, OSPF adjacency links might not come up while the switch is deleting ARP entries when there is data traffic through the interface. Stopping data traffic on the OSPF interface resolves this condition. [PR/414998: This issue has been resolved.]

Virtual Chassis

• When a new switch is added as a member switch to a Virtual Chassis setup and member 0 in the Virtual Chassis is not the master or has been disconnected, the newly added switch might not have the same configuration as the master switch. [PR/454249: This issue has been resolved.]
• When the Virtual Chassis is split, a member switch in the linecard role might continue to forward traffic, resulting in loops in the network. [PR/458194: This issue has been resolved.]

Limitations in JUNOS Release 9.4 for EX Series Switches

This section lists the limitations in JUNOS Release 9.4R4 for EX-series switches.

Bridging, VLANs, and Spanning Trees

• EX 8200 switches, when IGMP snooping is configured, do not distinguish between non-IP-multicast packets and IP-multicast packets on routed VLAN interfaces (RVIs), and they suppress non-IP-multicast packets.

Class of Service

• On EX 8200 switches, when multiple forwarding classes are mapped to the same queue, the tail-drop counters for some queues might show an incorrect value.

Infrastructure

• On EX-series switches running JUNOS Release 9.3 or later, if speed is set to 1 Gbps and link-mode is set to half-duplex under interfaces interface-name ether-options, configuration commits fail. As a workaround, revise the configuration to set the link-mode to full-duplex.

Interfaces

• On EX 8200 switches, for egress traffic, statistical mirroring does not work properly.

Upgrading or Downgrading from JUNOS Release 9.4R1 for EX-series Switches

The ARP aging time configuration in the system configuration stanza in JUNOS Release 9.4R1 is incompatible with the ARP aging time configuration in JUNOS Release 9.3R1 or earlier and JUNOS Release 9.4R2 or later. If you have configured system arp aging-timer aging-time on EX-series switches running JUNOS Release 9.4R1 and upgrade to JUNOS Release 9.4R2 or later or downgrade to JUNOS Release 9.3R1, the switch will display configuration errors on booting up after the upgrade or downgrade. As a workaround, delete the arp aging-timer aging-time configuration in the system configuration stanza and reapply the configuration after you complete the upgrade or downgrade.

Upgrading from JUNOS Release 9.3 to Release 9.4 for EX-series Switches

If you are upgrading from JUNOS Release 9.3R1 and have voice over IP (VoIP) enabled on a private VLAN (PVLAN), you must remove this configuration before upgrading, to prevent upgrade problems. VoIP on PVLAN interfaces is not supported on releases after JUNOS Release 9.3R1.

Upgrading from JUNOS Release 9.2 to Release 9.4 for EX-series Switches

For JUNOS Release 9.3 and later for EX-series switches, during the upgrade process, the switch performs reference checks on VLANs and interfaces in the 802.1X configuration stanza. If there are references in the 802.1X stanza to names or tags of VLANs that are not currently configured on the switch or to interfaces that are not configured or do not belong to the ethernet-switching family, the upgrade will fail. In addition, static MAC addresses on single-supplicant mode interfaces are not supported.

Caution: If your Release 9.2 configuration includes any of the following conditions, revise the configuration before upgrading to Release 9.4. If you do not take these actions, the upgrade will fail: Ensure that all VLAN names and tags in the 802.1X configuration stanza are configured on the switch and that all interfaces are configured on the switch and assigned to the ethernet-switching family. If the VLAN or the interface are not configured and you try to commit the configuration, the commit will fail. Remove static MAC addresses on single-supplicant mode interfaces. If they exist and you try to commit the configuration, the commit will fail. In an 802.1X configuration stanza, if authentication-profile-name does not exist and you try to commit the configuration, the commit will fail. In an 802.1X configuration stanza, broadcast and multicast MAC addresses are not supported in a static MAC configuration. If they exist and you try to commit the configuration, the commit will fail. Support for static MAC address bypass in single or single-secure mode has been removed. If static MAC address bypass is configured in one of those modes and you try to commit the configuration, the commit will fail. In an 802.1X configuration stanza, the switch will not accept the keyword vrange as an assigned VLAN name. If it exists and you try to commit the configuration, the commit will fail. Enabling 802.1X user authentication and the port mirroring feature on the same interface is not supported. If you enable 802.1X and port mirroring on the same interface and then attempt to commit the configuration, the commit will fail. In an 802.1X configuration stanza, if the VLAN name or tag specified under dot1x authenticator static does not exist and you try to commit the configuration, the commit will fail. If the MSTP configuration contains a VLAN (under protocols mstp msti msti-id) that does not exist on the switch and you try to commit the configuration, the commit will fail. Remove the VLAN from the MSTP configuration before you perform an upgrade. In the interfaces configuration stanza, if no-auto-negotiation is configured but speed and link duplex settings are not configured under ether-options and you try to commit the configuration, the commit will fail. If no-auto-negotiation is configured under ether-options, you must configure speed and link duplex settings before upgrading from Release 9.2 to Release 9.4. In the ethernet-switching-options configuration, if action is not configured for the number of MAC addresses allowed on the interface (under secure-access-port interface interface-name mac-limit in the CLI or in the Port Security Configuration page in the J-Web interface), and you try to commit the configuration, the commit will fail. You must configure an action for the MAC address limit before upgrading from Release 9.2 to Release 9.4. If you have configured a tagged interface on logical interface 0 (unit 0), configure a tagged interface on a logical interface other than unit 0 before upgrading from Release 9.2 to Release 9.4. If you have not done this and you try to commit the configuration, the commit will fail. Beginning with JUNOS software Release 9.3 for EX-series switches, untagged packets, BPDUs (such as in LACP and STP), and priority-tagged packets are processed on logical interface 0 and not on logical interface 32767. In addition, if you have not configured any untagged interfaces, the switch creates a default logical interface 0. On EX 4200 switches, if you have installed advanced licenses for features such as BGP, rename the /config/license directory to /config/.license_priv before upgrading from Release 9.2 to Release 9.3 or later. If a switch does not have the /config/license directory, create the /config/.license_priv directory manually before you upgrade. If you do not rename the /config/license directory, or create the /config/.license_priv directory manually, the licenses installed will be deleted after you upgrade from Release 9.2 to Release 9.3 or later.

Downgrading from JUNOS Release 9.4 to Release 9.2 for EX 4200 Switches

When you downgrade a Virtual Chassis configuration from JUNOS Release 9.4 to Release 9.2 for EX-series switches, member switches might not retain the mastership priorities that had been configured previously. To restore the previously configured mastership priorities, commit the configuration by issuing the commit command.

Related Topics

• New Features in JUNOS Software for EX-series Switches, Release 9.4