Previous Releases

9.2R3

The following issues have been resolved since JUNOS Release 9.2R2. The identifier following the description is the tracking number in our bug database.

Platform and Infrastructure

• If you configure a large number of MD5 authentication keys for BGP sessions, and then deactivate and reactivate the keys, the router might generate a commit error and MD5 authentication might not be applied on some of the BGP sessions. [PR/238960: This issue has been resolved.]
• When you issue the file copy command with an FTP path as the source or destination and include the source-address option, the specified source address is not used for establishing a connection with the peer FTP server. [PR/240580: This issue has been resolved.]
• Including the mirror-flash-on-disk statement at the [edit system] hierarchy level has no effect. [PR/268474: This issue has been resolved.]
• On MX-series platforms using Routing Engine-based sampling, when samples are sent from the Packet Forwarding Engine to the Routing Engine over certain interfaces, the interface Input/Output index and next-hop address are set to 0. The following interfaces are affected: ge-x/0/y, ge-x/1/y, xe-x/2/0, and xe-x/3/0. It is not possible in this case to match on the interface index to retrieve data from the NetFlow collector. [PR/286089: This issue has been resolved.]
• If a small form-factor pluggable transceiver (SFP) does not respond to a request for diagnostic data, a message is written to the system log. The message is unnecessary because the failure to respond has no operational impact. [PR/293212: This issue has been resolved.]
• For individual T1 links in an MLPPP bundle, the counts of input bytes and input packets are not reported correctly in the “Traffic statistics” section of the output from the monitor interface t1-fpc/pic/port command. [PR/299688: This issue has been resolved.]
• On M320 and T-series routing platforms, when member links of a Multilink Frame Relay bundle go down and come back up, an FPC in which a Link Services Queuing (LSQ) PIC is installed might stop forwarding traffic and need to be rebooted. As a workaround, install the PICs with the member links and the LSQ PIC in the same FPC. [PR/300331: This issue has been resolved.]
• When you configure a static route on an unnumbered link, it causes the router to reset; even rebooting does not help. You must remove the static route configuration to restore stability to the router. [PR/301732: This issue has been resolved.]
• As a result of the fix for PR 298073, when several multicast route changes occur within a short period of time, the system message log might record the following entry: “cannot perform nh operation ADDANDGET nhop (null) type indirect index 0 errno 22.” There is no operational impact. [PR/302530: This issue has been resolved.]
• When a line containing more than 1405 characters is pasted from a console configured with the load merge terminal option, the pasting process might stop after the first 1405 characters are shown. [PR/304956: This issue has been resolved.]
• The maximum number of active security services flows on a J-series Services Router for each platform and memory allotment is as follows:
  • J2320 router with 512 MB—20,000 flows
  • J2320 router with 1 GB—45,000 flows
  • J2350 router with 512 MB—30,000 flows
  • J2350 router with 1 GB— 50,000 flows
  • J4300 router with 512 MB—20,000 flows
  • J4300 router with 1 GB—45,000 flows
  • J6300 router with 512 MB—20,000 flows
  • J6300 router with 1 GB—45,000 flows
  • J4350 router with 512 MB—40,000 flows
  • J4350 router with 1 GB—60,000 flows
  • J6350 router with 512 MB—40,000 flows
  • J6350 router with 1 GB—65,000 flows
  • J6350 router with 2 GB—75,000 flows

  These are the system maximum values. If you configure max-flows for a service set, the other service sets share whatever is left from the system maximum value. The sum of the max-flows values for individual service sets cannot exceed the global maximum value. If the configured total exceeds this value, the max-flows value for the last configured service set is truncated and a warning message is logged. [PR/305350: This issue has been resolved.]

• When you attempt to upgrade J-series or JSR images with the validate option configured, the software upgrade might fail. As a workaround, perform the upgrade using the no-validate option. [PR/307212: This issue has been resolved.]
• During graceful Routing Engine switchover (GRES), resynchronization between Routing Engines might fail. In this case, the “Kernel database” field in the output of the show system switchover command reports the value “Connection error, Initialize error.” [PR/307501: This issue has been resolved.]
• When a PE router receives a PIM Join message from a CE router and the source for the required multicast data is another directly connected CE router, the attempt to create a flood next hop might initially fail. Messages including the following are written to the system log: “NH: Failed to install flood nexthop: <index>.” The next hop is eventually installed, so there is no operational impact. [PR/307579: This issue has been resolved.]
• When the mirror-flash-on-disk statement is included at the [edit system] hierarchy level and the Routing Engine is rebooted, the following spurious message appears when you log in to the Routing Engine: “NOTICE: System is running on alternate media device (/dev/<device-file>).” [PR/311768: This issue has been resolved.]
• When two BGP peers are configured to use MD5 authentication and you issue the clear bgp neighbor command on one peer, the following message might be written to the system log on the other peer: “tcp_auth_ok: Packet from <address>:<identifier> missing MD5 digest.” Traffic forwarding is not affected. [PR/312680: This issue has been resolved.]
• When you configure the authentication-key statement, BGP uses TCP sessions with an active MD5 digest option. Under certain circumstances a TCP four-way handshake might fail to perform a proper tear down of a previously established TCP session configured with the MD5 digest option, because of problems with authentication of the last ACK, leaving a socket on the remote router in TCP LAST_ACK state. The router that performed a passive close and became stuck in LAST_ACK state logs a message such as the following: “/kernel: tcp_auth_ok: Packet from 10.0.0.46:62056 missing MD5 digest,” for every ACK packet sent from the remote endpoint with a broken MD5 digest option. [PR/313119: This issue has been resolved.]
• On MX-series and M120 routers, and M320 routers with an Enhanced III FPC, if the configuration includes the explicit-null statement at the [edit protocols mpls] or [edit protocols ldp] hierarchy level, a DPC or FPC might reboot (but not generate a core file) when an MPLS packet with time-to-live (TTL) equal to 0 (zero) or 1 (one) is processed at the egress of a tunnel. [PR/313319: This issue has been resolved.]
• When an IPv6 BGP peer becomes unreachable, raw IPv6 packets might be forwarded without the correct Layer 2 encapsulation over an Ethernet connection. [PR/314629: This issue has been resolved.]
• When the Routing Engine hard disk fails, the compact flash might be removed from the list of media used at boot time, instead of the hard disk being removed. In some cases, this makes the Routing Engine unable to initialize. [PR/389540: This issue has been resolved.]
• The output from the traceroute command includes both the IP address and DNS hostname of each hop. The hostname information might be incorrect for one or more hops. [PR/389794: This issue has been resolved.]
• During recovery after the Routing Engine hard drive fails, the JUNOS kernel might fail, causing the router to reboot. [PR/390306: This issue has been resolved.]
• When a member link of an aggregate interface goes down and comes back up and new forwarding information is installed during that change-in-status period, traffic might be lost. [PR/392550: This issue has been resolved.]
• On T-series routing platforms with aggregated SONET/SDH interfaces, if multiple statistics requests for these interfaces are queued at the same time, a memory corruption might occur, causing the kernel to reset unexpectedly. [PR/393572: This issue has been resolved.]
• In an MPLS Layer 3 VPN network, the traceroute command does not return a valid result (it returns three asterisks [* * *] instead) for the hop between two routers when their configuration includes both of the following features: (a) per-packet load balancing (the load-balance per-packet statement is included at the [edit policy-options policy-statement policy-name then] hierarchy level and that policy-name statement is included at the [edit routing-options forwarding-table] hierarchy level), and (b) multiple equal-cost paths between the routers (for example, when the encapsulation frame-relay statement is included at the [edit interfaces interface-name] hierarchy level for a SONET/SDH interface and the same address is specified for more than one of its logical interfaces at the [edit interfaces interface-name unit logical-unit-number family family address] hierarchy level). [PR/396280: This issue has been resolved.]
• On M120 and MX-series routers, and on some FPCs on M320 routers, the Packet Forwarding Engine might not free memory correctly during operations on multicast next hops. [PR/396903: This issue has been resolved.]
• On a T1600 routing node, an FPC might stop operating while processing an ICMP TTL expiration packet. Such packets increment the count in the “ttl expired” field of the output from the show pfe statistics ip icmp command. [PR/398059: This issue has been resolved.]
• On T640 and T1600 routing platforms with the Enhanced Scaling FPC4, errors like the following might be written to the system log: “<x> new errors (mtu error) in HDRF,lout_hdrf_poll_stats,” “Error (code: 30, type:Minor) encountered, cmalarm_passive_alarm_signal,” and “1 new errors in SLout OP.” There is no operational impact. [PR/399258: This issue has been resolved.]
• On egress PE routers, the correct EXP classifier is not applied to label-switched interfaces (LSIs) that are created by including the vrf-table-label statement at the [edit routing-instances routing-instance-name] hierarchy level. [PR/399634: This issue has been resolved.]
• When you install an FPC in all eight slots on a T1600 routing node configured for graceful Routing Engine switchover (the graceful-switchover statement is included at the [edit chassis redundancy] hierarchy level), the routing node might reboot repeatedly. As a workaround, disable GRES or remove one FPC. [PR/400267: This issue has been resolved.]
• On J2300 Services Routers, sometimes the onboard Fast Ethernet ports do not allow traffic to pass through, while other interfaces are still passing traffic. [PR/406476: This issue has been resolved.]
• The traffic class byte is set to 0x00000000 in the header of some BGP packets sent between interfaces that have IPv6 addresses, instead of the correct setting 0xc0 (INTERNETCONTROL). [PR/406802: This issue has been resolved.]

User Interface and Configuration

• When you issue the request system (halt | power-off | reboot) other-routing-engine lcc routing-node-index command on a TX Matrix platform, the requested operation is performed on the TX Matrix platform instead of the specified routing node (line-card chassis, or LCC). As a workaround, issue the command on the routing node itself (without the lcc option). [PR/241274: This issue has been resolved.]
• Under certain conditions, when you issue the show configuration | compare command, the management process (mgd) might generate a core file. [PR/281705: This issue has been resolved.]
• When TACACS+ authentication is configured and a user tries to log in to the router over an SSH or FTP connection, the JUNOS software does not include the remote user address in the authentication request packet sent to the TACACS+ server. [PR/301927: This issue has been resolved.]

Interfaces and Chassis

• If virtual channel identifiers (VCIs) for a large number (approximately 400) of virtual connections (VCs) on an ATM DS3 interface are changed frequently, the interface might mishandle the ATM cells. As a result, OSPF and IS-IS neighbor adjacencies might not remain stable. [PR/25639: This issue has been resolved.]
• On channelized T3 interfaces, the T1 loopback state does not reflect loopbacks set by facilities data link requests using the remote-loopback-respond statement at the [edit interfaces interface-name t1-options] hierarchy level. [PR/45837: This issue has been resolved.]
• In the output from the show interfaces extensive command, the count of REI-P errors in the “SONET path” section is incorrect when the RDI-P error also appears in the “SONET defects” field. [PR/256049: This issue has been resolved.]
• On a router configured for graceful Routing Engine switchover, if the backup Routing Engine is running JUNOS Release 8.1 or later and the master Routing Engine is running JUNOS Release 8.0 or earlier, updates might not be made to the forwarding table. [PR/273492: This issue has been resolved.]
• When you issue the show interfaces diagnostics optics command and do not specify an interface name, the output is the same as for the show interfaces command, instead of including optic diagnostics. [PR/285978: This issue has been resolved.]
• On MX-series routers, when a DPC configured with a large number of interfaces restarts, the chassis process (chassisd) might write the following messages to the log: “failed to complete channel bonding” and “reached link 5 max index value.” [PR/292057: This issue has been resolved.]
• In JUNOS Release 9.0 and later, the monitor interface interface-name command output is missing some information. [PR/296131: This issue has been resolved.]
• The commit operation does not fail when the configuration includes the following invalid combination of statements: the address specified by the source or destination statement at the [edit interfaces gr-fpc/pic/port unit logical-unit-number tunnel] hierarchy level is the same as the interface's own subnet address (as specified by the address statement at the [edit interfaces gr-fpc/pic/port unit logical-unit-number family family-name] hierarchy level). [PR/299443: This issue has been resolved.]
• On a router without redundant Routing Engines (such as the M7i router), if the Routing Engine restarts, the router might stop forwarding packets. As a workaround on the M7i router, issue the request chassis cfeb restart command. [PR/301788: This issue has been resolved.]
• When only one Routing Engine is installed in an M120 router, on the craft interface the LEDs for the power supplies never light up. Similarly, in the “PS LEDs” section of the output from the show chassis craft-interface command, there is a period in all four fields (indicating that no LEDs are lit). [PR/302504: This issue has been resolved.]
• When you configure bandwidth management for a Protected System Domain (PSD) by including the control-plane-bandwidth-percent statement at the [edit chassis system-domains protected-system-domain psdn] hierarchy level, it might take up to four hours for FPC core files to transfer to the PSD. To reduce the transfer time to approximately 15 minutes, use one of the following workarounds: (a) remove the control-plane-bandwidth-percent statement, or (b) set the control-plane-bandwidth-percent value to 96 on the PSD to which the FPC is assigned. [PR/304765: This issue has been resolved.]
• When the links in a redundant LSQ bundle are not configured at the remote site, if a graceful Routing Engine switchover occurs and then a primary or secondary LSQ PIC goes offline, the backup Routing Engine might generate a core file. [PR/306667: This issue has been resolved.]
• For SONET/SDH interfaces, when the hold-time statement is included at the [edit interfaces so-fpc/pic/port] hierarchy level and you change the framing type from the default (SONET) to SDH by including the framing sdh statement at the same hierarchy level, the interface does not come up after the commit operation. As a workaround, deactivate the hold-time statement before changing the framing. [PR/306687: This issue has been resolved.]
• When you disable a Fast Ethernet interface, a router at the other end of a link to the interface might not mark the link as down. [PR/307538: This issue has been resolved.]
• The 1-port ATM2 OC48/STM12 IQ PIC might generate an RDI-P error when it receives a packet in which the bits corresponding to the enhanced path-RDI encoding of the G1 path overhead byte are set, even if the formal path-RDI bit within the G1 path overhead byte is not set. [PR/309929: This issue has been resolved.]
• On aggregated Ethernet interfaces configured for LACP (the lacp statement is included at the [edit interfaces aex aggregated-ether-options] hierarchy level), if you deactivate one of the interfaces in the aggregate, multicast traffic might not be detoured as expected. [PR/313617: This issue has been resolved.]
• On a router with dual Routing Engines, if the hard disk is inoperable or missing on the backup Routing Engine, no chassis alarm is set (visible in the output of the show chassis alarms command), nor is an SNMP trap or system log message generated. The only indication is a line like the following in the output from the show system boot-messages command: “ad<x>: not attached, missing in Boot List.” [PR/392837: This issue has been resolved.]
• When more than one of a physical interface’s logical interfaces is associated with a bridge domain (the family bridge statement is included at more than one [edit interfaces interface-name unit logical-unit-number] hierarchy level and each logical interface is specified as the value for an interface statement at the [edit bridge-domains domain-name] hierarchy level), the monitor physical-interface-name command displays incorrect values in the “Input packets” field of the “Traffic statistics” section. [PR/397745: This issue has been resolved.]
• When Multilink Frame Relay encapsulation is configured on an interface (the encapsulation multilink-frame-relay-uni-nni statement is included at the [edit interfaces interface-name] hierarchy level), the kernel might generate a core file. [PR/408066: This issue has been resolved.]

Layer 2 Ethernet Services

• On MX-series routers, access ports configured for VSTP (the interface statement corresponding to the port is included at the [edit protocols vstp] hierarchy level) might not interoperate properly with other vendors’ switches. [PR/390026: This issue has been resolved.]
• On an MX-series router configured for VRRP for IPv6, during a mastership change the original master does not relinquish mastership, with the result that both it and the original backup are reported as “master” in the “VR state” field of the output from the show vrrp summary command. [PR/398399: This issue has been resolved.]

Services Applications

• The issue arises when you configure the NAT match-direction output statement and attach it to a interface-style service set on an egress interface. When you explicitly configure forward and backward rules for a NAT service set, an ICMP fragmentation-needed message is not sent and the traffic is dropped without notification. If the backward rule is not configured and is left implicit, this problem is not seen. An explicit backward rule causes the ICMP error packet to be handled as a new flow. As a workaround, do not explicitly configure backward rules unless they are absolutely necessary. [PR/238215]
• If the Juniper-Firewall-Attribute attribute in a RADIUS server configuration file names a policer that sets a bandwidth limit for Layer 2 Tunneling Protocol (L2TP) sessions but not an exclude-bandwidth limit, the bandwidth limit might not be set correctly. [PR/254503: This issue has been resolved.]
• When a PPP session on a dedicated interface is terminated, associated static routes might remain in the routing table. [PR/309771: This issue has been resolved.]
• Input packet counters do not increment for IPSec packets on an AS or MultiServices PIC (sp- interface) over a multilink bundle. [PR/314456: This issue has been resolved.]
• Network address translation (NAT) is not performed correctly for Real-Time Streaming Protocol (RTSP) methods when the Content-Length field is set to 0 (zero). [PR/393171: This issue has been resolved.]
• When you configure L2TP with link fragmentation and interleaving (LFI), the MultiServices PIC drops a significant number of MLPPP fragments. [PR/401247: This issue has been resolved.]

General Routing

• Enabling traceoptions with certain trace levels for DHCP might cause the DHCP process to dump core. [PR/301102: This issue has been resolved.]

Routing Protocols

• When an IPv6 duplicate address is detected, the interface stops forwarding but IS-IS and OSPF3 continue to announce the interface as a valid route. However, the address is unreachable and all traffic destined to or through the interface is dropped. [PR/296740: This issue has been resolved.]
• When you run the snmpwalk query for multicast interfaces in a routing instance, the logical interface might not appear in the query. [PR/297470: This issue has been resolved.]
• On a router with dual Routing Engines that is configured for nonstop active routing (NSR) and graceful Routing Engine switchover, if the backup-router or inet6-backup-router statement is included at the [edit system] hierarchy level, the static route to the backup destination is not deleted on the backup Routing Engine when you activate nonstop active routing. [PR/305597: This issue has been resolved.]
• When you include the stale-routes-time statement at the [edit protocols bgp graceful-restart] hierarchy level, but omit the graceful-restart statement at the [edit routing-options] hierarchy level, the commit operation fails with the following message: “Error in neighbor <address> of group <group-name>: graceful restart must be enabled in routing-options too.” [PR/307034: This issue has been resolved.]
• When you re-add a previously deleted or deactivated address statement for an interface’s IPv6 address on a PIM upstream neighbor (at the [edit interfaces interface-name unit logical-unit-number family inet6] hierarchy level), the addition does not register at the downstream neighbor. On the downstream neighbor, the value in the “Upstream interface” and “Upstream neighbor” fields remains “unknown” in the output from the show pim join extensive command. As a workaround, issue the clear pim join command. [PR/309972: This issue has been resolved.]
• Protocol Independent Multicast (PIM) might not work correctly when NSR (nonstop routing) is enabled. Sometimes you might receive the following error message: “cannot perform nh operation ADDANDGET nhop (null) type indirect index 0 errno 22.” [PR/314279: This issue has been resolved.]
• If unicast routes towards a multicast source are updated via BGP static routing and an IPv6 address on a BGP peer router is deactivated and reactivated, multicast forwarding does not function correctly. [PR/386781: This issue has been resolved.]
• If the source address for IPv6 multicast traffic is resolved by a static route, information about an upstream neighbor might not be updated after a graceful Routing Engine switchover event (the value “unknown” appears in both the “Upstream interface” and “Upstream neighbor” fields in the output from the show pim join extensive command). [PR/389856: This issue has been resolved.]
• When a PE router receives an external LSA of type 7 (NSSA) that has a matching VPN tag or has the DN (down) bit set, it nevertheless includes the advertised route in its OSPF route calculation. According to RFC 4576, it must ignore such routes. [PR/391733: This issue has been resolved.]
• On a router configured for nonstop active routing (NSR), when you apply a BGP import policy and issue the clear bgp neighbor address soft command to reset BGP, the policy does not take effect. (In terms of configuration statements, the nonstop-routing statement is included at the [edit routing-options] hierarchy level and the import policy-name statement at the [edit protocols bgp group group-name neighbor address] hierarchy level.) As a workaround, either disable nonstop active routing or issue the clear bgp neighbor address command without the soft option, which forces BGP peers to reestablish their sessions. [PR/396291: This issue has been resolved.]
• When two BGP peers establish a session, they negotiate the hold time to use for keepalive messages. If one of the peers uses a nondefault hold-time value (that is, the hold-time statement is included at the [edit protocols bgp group group-name] hierarchy level in its configuration), and either of the peers goes down immediately after the session is established, the hold timer incorrectly expires after the default interval instead of the negotiated interval. [PR/396823: This issue has been resolved.]
• If the route to a multicast source address is learned using BGP and the upstream interface goes down, PIM might not detect the outage. As a consequence, the value “unknown” appears in the “Upstream interface” and “Upstream neighbor” fields of the output from the show pim join extensive command. [PR/397410: This issue has been resolved.]
• If you specify an IPv6 address as a value for the ssm-groups statement at the [edit routing-options multicast] hierarchy level, the SSM group does not work as expected. As a workaround, specify only IPv4 addresses. [PR/399352: This issue has been resolved.]
• If PIM sources are accessed via different addresses on the same neighbor, and PIM is deactivated and reactivated on the neighbor, the “Upstream interface” and “Upstream neighbor” fields of the output from the show pim join extensive command continue to report the value “unknown” after the neighbor is active. [PR/400573: This issue has been resolved.]
• When you enable distributed periodic packet management (by including the delegate-processing statement at the [edit routing-options ppm] hierarchy level), BFD packets are transmitted on a queue other than queue 3 (queue 0 or 4 depending on the JUNOS version). If system load allows it, disable distributed PPM as a workaround. [PR/400907: This issue has been resolved.]
• When you issue the show ospf database advertising-router command and a NULL argument is passed to the command, the routing protocol process (rpd) might stop operating. [PR/401437: This issue has been resolved.]
• When you issue the mtrace source command and the route to the source is defined in the routing table for a PIM nonforwarding instance (that is, not in the main instance table, inet.0), the command fails with the following messages: “...giving up” and “Timed out receiving responses.” [PR/403033: This issue has been resolved.]
• When peers in different BGP peer groups have similar export policies such that identical advertisements are sent, the routing protocols process (rpd) might generate a core file and become unresponsive when the backup Routing Engine comes online. [PR/404471: This issue has been resolved.]
• When certain statements are included at the [edit protocols bgp group group-name] hierarchy level, the routing protocols process (rpd) might generate a core file and stop operating in some circumstances. [PR/404667: This issue has been resolved.]
• A SNMP walk of the downstream interfaces of point-to-multipoint multicast routes might cause the routing protocol process (rpd) to dump core. [PR/405505: This issue has been resolved.]
• PIM mistakenly prefers a more specific hidden route over an active less specific route as the RPF route to the MCAST source. This issue has been fixed. [PR/411385: This issue has been resolved.]

MPLS Applications

• When both CSPF and link protection are enabled, in rare instances the routing protocol process (rpd) might generate a core file and restart. [PR/266126: This issue has been resolved.]
• If an ingress LSP detects a routing loop (reported as “Routing loop detected [number times]” in the output from the show mpls lsp name lsp-name extensive command), it might stop handling traffic. [PR/293686: This issue has been resolved.]
• After some types of network events (for example, when an interface goes down and comes back up), LDP routes might be removed incorrectly from the inet.3 routing table. As a workaround, restart all LDP sessions. [PR/297144: This issue has been resolved.]
• When a CCC comes back up after an interruption of network connectivity, the MPLS routing table does not record the label change for CCC appropriately, and traffic is not sent through the CCC connection. [PR/306043: This issue has been resolved.]
• When you issue the traceroute mpls ldp command, the MPLS OAM process (mplsoamd) might generate a core file. [PR/307732: This issue has been resolved.]
• If there is a single hop to an LDP neighbor and the source address of the received LDP Link Hello address is the same as the LDP Targeted Hello source address, when the LDP link neighbor and target LDP neighbor go down and come back up in a certain sequence, the Layer 2 circuit connection might remain inactive (reported as “VC-Dn” in the “St” field of the entry for the neighbor in the output from the show l2circuit connections command). To return the connection to the active state, issue the clear ldp neighbor address command. [PR/312672: This issue has been resolved.]
• If an RSVP LSP configured with LDP tunnels initiates auto bandwidth adjustments, LDP might fail to send keepalive messages, which could trigger LDP Session flap as a result of hold-down timer expiration. As a workaround, increase the LDP keepalive-timeout value at the [edit protocols ldp] hierarchy level from the default (30 seconds) to 90 seconds. [PR/407707: This issue has been resolved.]

VPNs

• The time-to-live (TTL) threshold value is not propagated correctly for VPNs that use IPv6 addresses. This might cause multiple entries for the same address in the output from the traceroute command. [PR/257497: This issue has been resolved.]
• If you take a PIC offline that hosts a large number (for example, 1000) of CE-facing interfaces in a Layer 2 VPN, the routing protocols process (rpd) might generate a core file. [PR/300601: This issue has been resolved.]
• When a logical tunnel (lt-) interface forwards a multicast packet, it incorrectly sets the destination MAC address. [PR/304516: This issue has been resolved.]
• In a VPLS dual-homed configuration, sometimes traffic loss might occur for approximately 20 seconds during switchover from the backup to the primary interface. [PR/404605: This issue has been resolved.]

High Availability

• When a Routing Engine switchover takes place, the kernel might generate a core file. [PR/301327: This issue has been resolved.]

Class of Service

• When configuration for an interface is added at the [edit class-of-service interfaces] hierarchy level, the value in the ”Output rate” field of the output from the show interfaces command might stop incrementing. The condition persists even if the CoS configuration is deactivated. As a workaround, deactivate and reactivate the interface at the [edit interfaces] hierarchy level. [PR/405280: This issue has been resolved.]

Forwarding and Sampling

• When you configure Routing Engine-based sampling (by including the sampling statement at the [edit forwarding-options] hierarchy level), 4-byte AS numbers might be incorrectly reported as 2-byte numbers in the output from the monitor start sampled command. [PR/310276: This issue has been resolved.]
• If a prefix list specified at the [edit firewall family inet6 filter filter-name term term-name from source-prefix-list] hierarchy level includes an IPv4 address, the commit operation fails with the following message: “Invalid inet6 addr: ‘<ipv4-address>/<prefix-length>’.” [PR/310299: This issue has been resolved.]
• Specifying peer as the value for the autonomous-system-type statement at the [edit forwarding-options sampling output cflowd hostname] hierarchy level has no effect (the exported information is the same as when the value origin is specified). [PR/310313: This issue has been resolved.]

Network Management

• When some PIC types are taken offline and brought back online, an SNMP linkUp trap is not generated for some of the logical interfaces. [PR/294667: This issue has been resolved.]
• The JUNOS software does not generate an SNMP linkDown trap when an interface's state (represented by the ifOperStatus object) changes from “up” to “lowerLayerDown.” The trap is required by RFC 2863. [PR/297829: This issue has been resolved.]
• When you enable firewall counters for IPv4 and IPv6 traffic on an interface (by including the count statement at the [edit firewall family (inet | inet6) filter filter-name term term-name then] hierarchy level and the filter statement at the [edit interfaces interface-name unit logical-unit-number family (inet | inet6)] hierarchy level), the show snmp mib walk jnxFWCounterByteCount command might not display all of the counters. [PR/313194: This issue has been resolved.]

9.2R2

The following issues have been resolved since JUNOS Release 9.2R1. The identifier following the description is the tracking number in our bug database.

Platform and Infrastructure

• When you configure aggregated interfaces as core-facing links, translational cross-connect (TCC) might not work properly. [PR/267867: This issue has been resolved.]
• When you partition the hard drive after upgrading the compact flash, the partition sizes in some cases received slightly incorrect values as a result of bsdlabel behavior. This prevented mirror-flash-on-disk from working properly. [PR/270154: This issue has been resolved.]
• On MX-series Ethernet Services routers, if a label-switched interface (LSI) is enabled for an xe member link that is part of an aggregated Ethernet (ae) interface, the xe interface statistics are counted twice. [PR/274396: This issue has been resolved.]
• When you issue the request system snapshot command on Routing Engine RE-3 after upgrading to 1GB compact flash, it might make a corrupt copy on the hard drive. [PR/291295: This issue has been resolved.]
• In an environment with many active multicast routes and one or more aggregated interfaces as downstream interfaces, when an aggregated interface flaps or an FPC containing an aggregated interface restarts, the kernel might restart unexpectedly. This issue is seen in networks with greater than 1000 multicast routes. The chance of kernel restarts increases as the number of multicast routes increases or the number of downstream aggregated interfaces increases. [PR/292521: This issue has been resolved.]
• When a Multilink Point-to-Point Protocol (MLPPP) link is incorrectly added to a Multilink Frame Relay (MLFR) bundle, the kernel resets unexpectedly. [PR/294885: This issue has been resolved.]
• An MPLS frame with an explicit NULL label designated for the Routing Engine might be dropped by the Packet Forwarding Engine. [PR/298967: This issue has been resolved.]
• When you configure an unnumbered interface to borrow from a loopback or non-Ethernet interface and also configure unrestricted proxy ARP on the unnumbered interface, the incoming proxy-ARP requests are dropped. As a workaround, configure the unnumbered interface to borrow from any Ethernet interface. [PR/301101: This issue has been resolved.]
• On platforms with dual Routing Engines, the Routing Engines might dump core during processing of a BGP UPDATE message with a NEXT_HOP attribute that is a broadcast address of a local interface. [PR/302236: This issue has been resolved.]
• When you configure Connectionless Network Service (CLNS) on an lt interface, the source MAC address becomes corrupted. [PR/304323: This issue has been resolved.]
• The maximum number of active security services flows on a J-series Services Router for each platform and memory allotment is as follows:
  • J2320 router with 512 MB—20,000 flows
  • J2320 router with 1 GB—45,000 flows
  • J2350 router with 512 MB—30,000 flows
  • J2350 router with 1 GB—50,000 flows
  • J4300 router with 512 MB—20,000 flows
  • J4300 router with 1 GB—45,000 flows
  • J4350 router with 512 MB—40,000 flows
  • J4350 router with 1 GB—60,000 flows
  • J6300 router with 512 MB—20,000 flows
  • J6300 router with 1 GB—45,000 flows
  • J6350 router with 512 MB—40,000 flows
  • J6350 router with 1 GB—65,000 flows
  • J6350 router with 2 GB—75,000 flows

  These are the system maximum values. If you configure max-flows for a service set, the other service sets share whatever is left from the system maximum value. The sum of the max-flows values for individual service sets cannot exceed the global maximum value. If the configured total exceeds this value, the max-flows value for the last configured service set is truncated and a warning message is logged. [PR/305350: This issue has been resolved.]

User Interface and Configuration

• Under the following conditions, the commit operation might fail with the syntax error “inactive: group group-name { ... }”: (a) you use the configure private command to enter configuration mode, (b) a BGP group is deactivated, and (c) you change another BGP group’s name. As a workaround, use the configure command to enter configuration mode. [PR/300917: This issue has been resolved.]
• When you invoke a commit or commit check operation for a configuration that includes forwarding-table filters, the firewall process (dfwd) might generate a core file and restart. [PR/301806: This issue has been resolved.]
• Deactivating a configuration node via transient change does not work when applied using a commit script from JUNOS Release 9.1 and later; it causes all the transient changes to be discarded. The fix for PR 294131 made updates in the transient-change implementation that broke some of the transient-change behaviors. This fix reverts the updates made as part of PR 294131. A separate PR will handle updates to the transient-change implementation. [PR/307352: This issue has been resolved.]

Interfaces and Chassis

• If you configure a compression-device on an ATM interface by mistake, the JUNOS kernel might dump core and restart. [PR/265542: This issue has been resolved.]
• If you enable nonstop active routing (NSR) and perform a commit synchronize when the backup Routing Engine is not available, the system provides a warning message. To expedite protocol synchronization, issue the restart routing command on the backup Routing Engine when it comes up. [PR/277993: This issue has been resolved.]
• When you repeatedly perform BGP nonstop active routing (NSR) procedures, the routing protocol process (rpd) dumps core on every third or fourth switchover. [PR/288783: This issue has been resolved.]
• The commit operation does not fail when the configuration includes the following invalid combination of statements: the address specified by the source or destination statement at the [edit interfaces gr-fpc/pic/port unit logical-unit-number tunnel] hierarchy level is the same as the interface’s own subnet address (as specified by the address statement at the [edit interfaces gr-fpc/pic/port unit logical-unit-number family family-name] hierarchy level). [PR/299443: This issue has been resolved.]
• When you configure VRRP on a logical interface on an IQ2 PIC, the reported logical interface statistics are incorrect. The problem is compounded if there is no transit traffic on the logical interface, because additional bytes might be erroneously included. [PR/303151: This issue has been resolved.]
• In a Protected System Domain with a large number of LSPs configured (for example, 50,000), an FPC might generate a core file when you issue the show pfe route mpls command repeatedly. [PR/303349: This issue has been resolved.]
• When a change occurred in VRRP priority or tracking information, it caused the state machine to reset. As a result, VRRP went through an idle-backup-master transition. With the fix, the reset is avoided and VRRP continues to be the master/backup. [PR/303701: This issue has been resolved.]
• When you configure bandwidth management for a Protected System Domain (you include the control-plane-bandwidth-percent statement at the [edit chassis system-domains protected-system-domain psd number] hierarchy level), any FPC core files that are generated might take up to 4 hours to completely transfer onto the PSD. There are two workarounds, if you need to generate a FPC core file within a 15-minute time frame, either one can be applied: either remove the control-plane-bandwidth-percent statement or set the control-plane-bandwidth-percent value to 96 percent for the PSD that owns the particular FPC. [PR/304765: This issue has been resolved.]
• When the links of an RLSQ bundle are not configured at the remote site and a Routing Engine switchover is performed followed by taking a primary or secondary LSQ PIC offline, the backup Routing Engine might reset. [PR/306667: This issue has been resolved.]
• When you configure bridge options (under bridge domains) for a specific trunk interface and the bridge domain is part of the default virtual switch, the configuration does not work properly. [PR/307000: This issue has been resolved.]
• When the vlan-id and vlan-tagging configuration changes for a bridge domain, the multicast snooping process might reset unexpectedly. This should not affect bridge functionality and the snooping process should recover automatically. [PR/307322: This issue has been resolved.]

Services Applications

• If Network Address Port Translation (NAPT) is configured and multiple short-lived flows are established, ports on MS PICs might not be assigned correctly. In some cases, this situation causes the MS PIC to stop functioning. [PR/300553, 304088: This issue has been resolved.]

Routing Protocols

• When you configure the stale-routes-time statement at the [edit protocols bgp graceful-restart] hierarchy level along with nonstop active routing (NSR), or in default mode (without graceful restart or nonstop active routing configured at the [edit routing-options] hierarchy level), it causes a commit error. [PR/307034: This issue has been resolved.]
• When you enable nonstop-routing at the [edit routing-options] hierarchy level and configure the router as an AS boundary router or a route reflector for a VPN address family, and the router has routing-instance configuration for locally attached VPN sites, deactivating and then activating the routing-instance configuration causes the VPN routes not to be imported into the routing-instance (VRF) tables. [PR/307770: This issue has been resolved.]
• When BGP advertises static routes to unnumbered interfaces by means of a policy, it causes the routing protocol process (rpd) to reset unexpectedly. [PR/308465: This issue has been resolved.]
• When the length of the next-hop network address field in MP_REACH_NLRI is incorrectly set, the JUNOS software mistakenly sends error code 3, subcode 1 (Malformed Attribute List). The appropriate error code is 3, subcode 9 (Optional attribute error). [PR/308628: This issue has been resolved.]

MPLS Applications

• When you configure the traffic-engineering mpls-forwarding statement for a link-protected point-to-multipoint LSP, RSVP creates two link-protection routes, which eventually causes the routing protocol process (rpd) to dump core. [PR/303993: This issue has been resolved.]
• If two point-to-multipoint branch LSPs share the same incoming interface, and one of them comes up after the other during a remerge event at a transit router, the in-label for both LSPs is marked “Discard,” as reported by the show route table mpls.0 command. [PR/306312: This issue has been resolved.]
• When there is a direct and targeted LDP neighbor to the same IP address and the neighbor is flapping, the routing process might terminate abnormally under certain circumstances. [PR/308178: This issue has been resolved.]
• If there is a single hop to an LDP neighbor and the source address of the received LDP Link Hello address is the same as the LDP Targeted Hello source address, when the LDP link neighbor and target LDP neighbor go down and come back up in a certain sequence, the Layer 2 circuit connection might remain inactive (reported as VC-Dn in the S field of the entry for the neighbor in the output from the show l2circuit connections command). To return the connection to the active state, issue the clear ldp neighbor command. [PR/312672: This issue has been resolved.]

VPNs

• A dynamic change to the provider tunnel type might cause the routing protocol process (rpd) to generate a core file. [PR/305081: This issue has been resolved.]
• In rare cases, changes to the encapsulation or MAC address on a PE router’s CE-facing interface, followed by a nonstop active routing (NSR) event, might disrupt Layer 2 circuit communications. The show l2circuit connections command reports an MTU Mismatch (MM) status for the Layer 2 circuit connection on the remote PE router. To restore communications on the local PE router, deactivate and reactivate the l2circuit configuration stanza at the [edit protocols] hierarchy level. To avoid the error, include the ignore-mtu-mismatch statement at the [edit protocols l2circuit local-switching interface interface-name] hierarchy level for every interface. [PR/306453: This issue has been resolved.]

Class of Service

• On J-series Services Routers, MLPPP bundles with congested member links on which fragmentation is active might interfere with other bundles within the same system and trigger high latency or packet drops. As a possible workaround, configure the shaping rate on the bundle with fragmentation enabled to avoid flow control from the member link. [PR/281985: This issue has been resolved.]
• When you delete CoS interface scheduler-map configurations, the allocated IDs are not removed from the Packet Forwarding Engine. As a result, when the new CoS interface configuration is applied, a system log message shows no profile space available. [PR/292223: This issue has been resolved.]

Forwarding and Sampling

• When you include the route-accounting statement at the [edit forwarding-options family inet6] hierarchy level, the sampling process (sampled) might generate a core file. [PR/291455: This issue has been resolved.]
• Under some circumstances, when you add a prefix at the [edit policy-options prefix-list list-name] hierarchy level, the commit might fail with one of the following error messages: “Check-out failed for Firewall daemon (/usr/sbin/dfwd) without details” or “configuration check-out failed.” [PR/305510: This issue has been resolved.]
• For Routing Engine based-sampling, 4-byte AS numbers were not reported appropriately. [PR/310276: This issue has been resolved.]

9.2R1

The following issues have been resolved since JUNOS Release 9.1R2. The identifier following the description is the tracking number in our bug database.

Software Installation and Upgrade

• On an M320 router, when you perform an in-service software upgrade (ISSU), destination class accounting statistics might not be restored properly. [PR/284647: This issue has been resolved.]

Platform and Infrastructure

• When graceful Routing Engine switchover (GRES) and multicast are both configured on a router, the master Routing Engine kernel might dump core because of inconsistencies between the multicast forwarding database on the master Routing Engine and the multicast forwarding database on the backup Routing Engine. [PR/100795]
• When you use aggregate bundles with FRR, packet loss occurs for about 10 to 16 seconds when one of the member links fails. [PR/101295]
• If Layer 2 encapsulation is larger than 34 bytes, the Packet Forwarding Engine might restart unexpectedly. [PR/240080]
• On an MX-series routing platform, a DPC with 10-Gigabit Ethernet interfaces might report the same interface statistics on all ports of the same PIC slot if the first interface has the family mpls statement configured. As a workaround, do not configure the family interface on the first port of the PIC slot. [PR/262607]
• On M10i routers that have Channelized DS3 IQ PICs installed, the Compact Forwarding Engine Board (CFEB) might generate a core file, which interrupts FPC operation. [PR/283943: This issue has been resolved.]
• On a J-series router configured to capture packets, certain conditions might trigger messages similar to the following: “Apr 7 15:00:07 lhotse fwdd[2911]: ipc_msg_write: IPC message type: 13, subtype: 4 exceeds MTU, mtu 1550, length 1552.” These messages indicate that some packets not have been captured as expected. There is no impact on traffic passing though the router. [PR/285242: This issue has been resolved.]
• Under certain circumstances, DHCP discover packets might be leaked to all the configured VRFs. [PR/286139: This issue has been resolved.]

Interfaces and Chassis

• When graceful Routing Engine switchover is enabled and the backup Routing Engine is taken offline, a CHASSISD_SNMP_TRAP message might not be generated. [PR/238797]
• Very rarely, when there is a PIC error and the PIC is coming online again, the system might reset unexpectedly. With the fix, the PIC fails to attach if it has a hardware error. It does not cause the FPC to reset as in the previous case. [PR/241092: This issue has been resolved.]
• When you configure MLPPP or MLFR UNI NNI (FRF.16) bundles on link services IQ interfaces, a certain mix of traffic might cause a lower-priority queue to be starved when packets expire after not being scheduled for some time. [PR/262901: This issue has been resolved.]
• When a Fast Ethernet interface is connected to a Gigabit Ethernet interface that is configured for full duplex without autonegotiation, the information for the Fast Ethernet interface is incorrect in the “Autonegotiation information” section of the output from the show interfaces extensive command. [PR/263957: This issue has been resolved.]
• For a routing node in a routing matrix, when you remove a hardware component from the chassis, alarms are cleared for that component (which is correct), but also for all components of the same type. [PR/278672: This issue has been resolved.]
• If you power off and power on a Routing Engine model RE-A-2000 on a T640 routing node (by issuing the request system power-off other-routing-engine and request system power-on other-routing-engine commands), the output of the show chassis hardware command no longer includes an entry for Switch Processor Mezzanine Board (SPMB) 1. [PR/281463: This issue has been resolved.]
• Adding per-unit-scheduler configuration to a one- or two-port IQ PIC might cause errors and affect the forwarding state of the ports. [PR/282934: This issue has been resolved.]
• Prior to JUNOS Releases 9.0R3 and 9.1R2, you cannot unplug a 4-port 10-Gigabit Ethernet PIC without taking the PIC offline first. [PR/288077: This issue has been resolved.]
• When you insert an OC192 SONET/SDH PIC that uses XFP optics into an Enhanced Type 3 FPC on a T640 routing node, the FPC might generate a core file. [PR/288884: This issue has been resolved.]
• Under the following conditions, a logical interface configured for VRRP (in which the vrrp-group statement is included at the [edit interfaces interface-name unit logical-unit-number family family address address] hierarchy level) does not initialize properly and the output for it from the show vrrp summary command displays the value bringup in the “VR State” field:
  • The logical interface is configured with dual VLAN tags (the vlan-tags statement is included at the [edit interfaces interface-name unit logical-unit-number] hierarchy level).
  • The configuration for another logical interface of the same physical interface includes the vlan-id statement at the [edit interfaces interface-name unit logical-unit-number] hierarchy level.

  The problem can occur even though the interfaces do not belong to the same VRRP group. [PR/288975: This issue has been resolved.]

• When multicast packets are replicated to multiple outbound interfaces at a moderate traffic load, transmit packets might be corrupted. There is no workaround. [PR/289353: This issue has been resolved.]
• On JCS 1200 platforms, the control-plane-bandwidth-percent statement at the [edit chassis system-domains protected-system-domains domain-name] hierarchy level might not work properly. The platform might continue to use the default setting. [PR/289611: This issue has been resolved.]

Services Applications

• When you commit a configuration that does not include either the pre-shared-key statement or the local-certificate statement at the [edit security ike policy policy-name] hierarchy level, the key management process (kmd) generates a core file. [PR/267957: This issue has been resolved.]
• In JUNOS Release 9.1, a license feature was introduced for all customer edge (CE) platforms. As a result, on M120 routers (a designated CE platform) whenever you configure L2TP sessions and tunnels with RADIUS authentication, the following message might be displayed:

  profile user1 {

  ##

  ## Warning: requires 'subscriber-authentication' license

  ##

  authentication-order radius;

  }

  In the system log, the following message might appear: “regress@turkey# Apr 1 16:13:22 turkey alarmd[4669]: Alarm cleared: License color=YELLOW, class=CHASSIS, reason=Per Subscriber Radius Authentication usage requires a license Apr 1 16:13:22 turkey alarmd[4669]: LICENSE_EXPIRED: License for feature subscriber-authentication(31) expired.” This has no effect on the generation of the L2TP tunnels and sessions. [PR/277424: This issue has been resolved.]

Routing Protocols

• BGP traceoptions incorrectly reports Path Attribute flags with the EXT bit always reset. [PR/51953: This issue has been resolved.]
• If more than 1000 communities are attached to a route, the routing process (rpd) might become unresponsive. Removing the communities and restarting the routing process might be necessary to recover. [PR/77001: This issue has been resolved.]
• When routes are exported into OSPF and then OSPF is deactivated, the routing protocol process (rpd) might generate a core file and stop operating. [PR/232362: This issue has been resolved.]
• The show ospf route detail command output displays optional-capability values for intra-area router routes only. [PR/273809: This issue has been resolved.]
• In JUNOS Release 9.0 and later, the multicast snooping process (snoopd) leaks memory even if it is not configured. As a workaround, disable the process if it is not required. [PR/279378: This issue has been resolved.]
• When PIM is used, certain multicast routing topologies might cause delays in multicast route convergence. [PR/282109: This issue has been resolved.]
• When you enable BGP multipath (by including the multipath statement at the [edit protocols bgp group group-name] hierarchy level) and route updates arrive from multipath and nonmultipath peers in a certain order, load balancing across paths might stop working correctly. [PR/288694: This issue has been resolved.]
• When BGP deletes a secondary route, the routing process (rpd) might exit unexpectedly and dump core. [PR/290863: This issue has been resolved.]

MPLS Applications

• When the target of the ping mpls rsvp command is another vendor’s router, the value in the “Local transmit time” field is a UNIX timestamp instead of an NTP timestamp, as specified by RFC 4379. [PR/289535: This issue has been resolved.]
• Packet loss can occur following an RSVP auto-bandwidth adjustment. [PR/289553: This issue has been resolved.]

VPNs

• When nonstop active routing (NSR) is enabled and you issue the restart routing command on the master Routing Engine, VPLS connections on the backup Routing Engine might not be re-established quickly. To speed up the synchronization process, issue the restart routing command on the backup Routing Engine. [PR/282095: This issue has been resolved.]
• The delete routing-instances vpls protocols vpls mtu command does not reset the MTU to its default value. As a workaround, deactivate and then reactivate the VPLS instance to set the MTU to the default value of 1500. [PR/288026: This issue has been resolved.]

Network Management

• A syntax error in the mib-rfc3811.txt MIB file prevents SNMP from using the MIB. The file is included in the package accessible at https://download.juniper.net/ software/junos-export/<release>/juniper-mibs-<release>-signed.tgz, where <release> is a JUNOS Release number such as “8.2R4.5.” [PR/80648: This issue has been resolved.]