Current Software Release

The current software release is Release 9.2R4. For information about obtaining the software packages, see M-series, MX-series, and T-series Upgrade and Downgrade Instructions or J-series Upgrade and Downgrade Instructions, depending on your router platform.

Resolved Issues

Class of Service

• When you configure an ES PIC, a message similar to the following might be written to the system log: “fpc0 LCHIP(3): Unable to fathom what channel used by IFD <id>.” There is no operational impact. [PR/36184: This issue has been resolved.]
• If you deactivate or activate an aggregated Ethernet interface, the Packet Forwarding Engine might report errors. [PR/50090: This issue has been resolved.]
• When you use wildcards to configure class-of-service attributes for interfaces on IQ and IQ2 PICs, the scheduler map specified for the interface might be applied to the chassis stream. Performing a Routing Engine switchover in this situation might cause the chassis scheduler map to be removed. As a workaround, you can explicitly configure a chassis scheduler map with the scheduler-map-chassis statement at the [edit class-of-services interfaces] hierarchy level. [PR/425710: This issue has been resolved.]
• On M320 routers, when the Tunnel PIC is on a standard FPC, multicast traffic conforming to Internet draft draft-rosen-vpn-mcast-08.txt might be subject to incorrect CoS queuing and rewrite. [PR/433142: This issue has been resolved.]

Forwarding and Sampling

• On MX-series routers running JUNOS Release 8.4 and later, entries in the MAC address table expire three times faster than on MX-series routers running JUNOS Release 8.3 and earlier, and on M-series and T-series routing platforms running any release of the JUNOS software (including JUNOS Release 8.4 and later). To configure the correct effective value on MX-series routers running JUNOS Release 8.4 and later, specify a value for the mac-table-aging-time statement at the [edit protocols l2-learning] hierarchy level that is three times the desired value. For example, if you want the expiration time to be 15 seconds, specify 45 seconds. [PR/241485: This issue has been resolved.]
• A flow route is assigned an internal identifier that captures the values of all match conditions specified at the [edit routing-options flow route route-name match] hierarchy level. If the length of the identifier exceeds a certain limit, the MIB II process (mib2d) might repeatedly generate a core file and fail to restart. The higher the number of match conditions, and the more values specified for conditions that accept multiple values (such as the destination-port and source-port statements), the more likely the problem is to occur. As a workaround, limit the number of conditions or values or both. [PR/273373: This issue has been resolved.]
• On an M320 router with mixed FPCs installed, the Packet Gateway Control Protocol process (pgcpd) fails to retrieve filter counters. [PR/284637: This issue has been resolved.]
• If you configure a filter whose last term includes the next-term statement and apply the filter individually and within the term of another filter, or apply it in an input list or an output list, the firewall process performs the commit with system log errors and the filters might not be applied. [PR/395561: This issue has been resolved.]
• The password statement configured at the [edit accounting-options file file-name archive-sites] hierarchy level might not work correctly. [PR/396648: This issue has been resolved.]
• Because of a memory allocation failure, the sample process (sampled) asserts and dumps core. [PR/418126: This issue has been resolved.]
• For list filters, the firewall process creates temporary interface-specific filters marked with DFW_FLAGS_IFACE_INLINE and uses them to clone as needed. These filters should be deleted after cloning, but instead remained and occupied index space. [PR/426137: This issue has been resolved.]
• Policers could not be modified after a system upgrade because of a flaw in the parser routine: when the current item is deleted, the parser cannot proceed to the next item. With the fix, the routine in the forwarding process (dwfd) has been modified so that the next item in the object tree is fetched before the current object is parsed. [PR/433418: This issue has been resolved.]

General Routing

• When you configure multiple addresses for the from neighbor statement inside a routing policy term, only the last address takes effect. [PR/414768: This issue has been resolved.]
• On TX Matrix platforms running JUNOS Release 9.1 and later, inclusion of the generate statement in a routing-options configuration with a reference to a policy causes the commit not to complete successfully. Even with the fix, the instance-export and instance-import statements at the [edit routing-options] hierarchy level should not be configured on TX Matrix platforms. [PR/416380: This issue has been resolved.]

Interfaces and Chassis

• On J4350 and J6350 Services Routers, if the MTU is set to more than 6 KB for a built-in Gigabit Ethernet port or a 1-port Gigabit Ethernet ePIM, packets might be discarded with an FCS error. [PR/82245: This issue has been resolved.]
• On channelized DS3 interfaces, if you include the family mlfr-end-to-end statement at the [edit interfaces interface-name unit logical-unit-number] hierarchy level for a logical interface that has a smaller index number than another logical interface for which you include the encapsulation frame-relay-ppp statement at the same hierarchy level, the commit operation fails with the error message “Link encapsulation type is not valid for device type.” As a workaround, configure the indicated family statement on a logical interface with a larger index than the logical interface configured with the indicated encapsulation statement. [PR/229071: This issue has been resolved.]
• On 1-port 10-Gigabit Ethernet XFP Uplink PICs and 1-port 10-Gigabit Ethernet XENPAK PICs, when the 10-Gigabit Ethernet port is disabled through the CLI, the transmit laser is shut off correctly. After this, if the XFP or XENPAK module is changed or reseated, the transmit laser is turned on, even though the port is disabled. [PR/267308: This issue has been resolved.]
• On a router with Frame Relay multilink configured on a MultiServices 400 PIC or on a channelized DS3 PIC, when the minimum links value for the Frame Relay interface is set to 8 and a link is deactivated from the configuration, the link remains up. [PR/285244: This issue has been resolved.]
• In OC768-over-OC192 mode on the 4-port OC192c PIC, when you change the clocking statement from internal to external at the [edit interfaces interface-name] hierarchy level, the clock might not come up. [PR/395847: This issue has been resolved.]
• On T640 routers, when an FPC is taken offline and the monitor interface traffic command is issued, the aggregated Ethernet bundle statistics field displays a high value. This is not an issue for TX Matrix platforms. [PR/399451: This issue has been resolved.]
• Under the following conditions, the high priority traffic gets RED dropped although the rate is lower than the shaping rate:
  • 248 VLANs are configured on a single port within an IQ2 8-port Gigabit Ethernet PIC.
  • The shaping rate for each VLAN is set to 4m and buffer size for high-priority (real-time) traffic is 5 percent.
  • Both high- and low-priority traffic are sent out through all 248 VLANs, where the total rate is higher than the line rate.

  Because of the IQ2 PIC hardware architecture, the queue priority does not get propagated among VLANs (logical interfaces). As a result, the queue priority is used to determined which queue should be served within a single logical interface only, and each logical interface in turn transmits the packets in a round-robin fashion. Because only 5 percent buffer size is configured, the queue for high-priority traffic might get full before it has the chance to transmit. For example, if a high-priority packet arrives right after the logical interface was served, it would have to wait until the next round before transmitting this packet.

  This probability increases when the port is oversubscribed and the traffic has small packet size. In IQ2 PICs, packets are buffered in 512-byte units. Thus, frames smaller than 512 bytes still occupy one unit. As a result, when the router sends 64-byte frames, the effective buffer size becomes 1/8 of the theoretical one. In addition, when the port is oversubscribed, each logical interface could send more than what it should for each round. This could also potentially increase the waiting time for a logical interface to be served.

  As a workaround, revise the configuration in one of the following ways:

  Configure a guarantee-rate to make sure the high-priority traffic gets through. For example, the following configuration guarantees at least 2M high-priority traffic per VLAN:

  class-of-service {

  traffic-control-profiles {

  vlan_shaping {

  scheduler-map sched-map_50:40:30:30;

  shaping-rate 4m;

  guaranteed-rate 2m;

  }

  }

  }

  No oversubscription is used in the current configuration, even though the sum of shaping rates is less than 1 Gbps. However, by default the configured shaping-rate does not take the preamble and minimum interframe gap into consideration. Assuming the frame size is 1500 bytes, the actual bandwidth required for total shaping-rate is (4M*248)*(1500+20)/1500 = 1005M > 1G. Hence, the port is indeed oversubscribed. You can reduce the configured shaping-rate value or configure the following option so that the JUNOS software takes care of the overhead:

  chassis {

  fpc slot {

  pic port {

  traffic-manager {

  egress-shaping-overhead 20;

  }

  }

  }

  }

  [PR/401893: This issue has been resolved.]

• When an Enhanced Compact Forwarding Engine Board (E-CFEB) is installed on an M7i or M10i router, there might be a complete traffic drop after CFEB switchover, because of multiple PIC offline/online scenarios. [PR/407608: This issue has been resolved.]
• When a 10-Gigabit Ethernet interface on a DPC is connected to a faulty optical card that causes the link state to change at a very high rate, the DPC might reset unexpectedly. [PR/411072: This issue has been resolved.]
• Incorporating any changes in the interfaces configuration results in a small leak in the dcd process. The leak is at the rate of 16 bytes per interface configured per commit. [PR/411596: This issue has been resolved.]
• When you configure LACP on an aggregated Ethernet interface, the counters displayed by the show interface extensive command might show unexpected values. This problem occurs for logical interfaces that have an incoming interface index value that matches the default index of the data stream. [PR/418054: This issue has been resolved.]
• When you apply a Layer 2 policer to an egress router interface, the dropped frame statistics might show incorrect information. [PR/419181: This issue has been resolved.]
• On an IQ2 PIC, the slow-aging interval might be overwritten with a value of 202 seconds. This causes the MAC entry to be removed between 6 and 7 minutes later. [PR/419510: This issue has been resolved.]
• The address family of aggregated Ethernet child next hops was incorrectly set to the address family of the protocol interface, instead of the address family of the parent next hop. [PR/425802: This issue has been resolved.]
• When you change a hardware Field Replacement Unit (FRU) in the chassis, the craft process (craftd) might fail upon reinitializing the device list and generate a core file. This does not affect normal operation of the FRU. [PR/429171: This issue has been resolved.]

Layer 2 Ethernet Services

• When you configure a router as a DHCP relay agent with option 82 enabled, it starts dropping packets when the packet size exceeds the maximum size as specified in option 57. [PR/411626: This issue has been resolved.]

MPLS Applications

• On M-series and T-series routing platforms, if a node-link protected LSP with multiple paths experiences an LSP switchover, traffic loss might occur. [PR/392406: This issue has been resolved.]
• If an RSVP LSP configured with LDP tunnels initiates auto bandwidth adjustments, LDP might fail to send keepalive messages, which could trigger LDP session flap as a result of hold-down timer expiration. As a workaround, increase the LDP keepalive-timeout value at the [edit protocols ldp] hierarchy level from the default (30 seconds) to 90 seconds. [PR/407707: This issue has been resolved.]
• If you have disabled the trap statement at the [edit protocols ldp log-updown] hierarchy level, upgrading to JUNOS Release 9.2 and later from a release previous to 9.2 will fail. [PR/432003: This issue has been resolved.]

Network Management

• If the kernel is slow to respond to interface statistics requests made by the Management Information Base II (MIB II) process (mib2d), mib2d can block the request. Under this condition, if there is an interface flap (link down followed by up), the mib2d process might recognize only the latest interface link state and thereby miss modifying the ifLastChange object identifier (OID) associated with the interface, and also miss sending a link down trap. [PR/421585: This issue has been resolved.]
• When Routing Engine 1 (RE1) is reloaded, the Management Information Base II (MIB II) process (mib2d) dumps core. [PR/436218: This issue has been resolved.]
• When the master SNMP process (snmpd) restarts on a TX Matrix platform, the SNMP subagent running on the line-card chassis (LCC) chassis process (chassisd) tries to register MIB objects with the master snmpd. If the registration progress enters an infinite loop, it causes the master snmpd to consume high CPU utilization. [PR/438085: This issue has been resolved.]

Platform and Infrastructure

• In a routing matrix configured for graceful Routing Engine switchover (GRES), when the master Routing Engine of a T640 routing node (line-card chassis, or LCC) enters debug mode, it does not release mastership. [PR/66308: This issue has been resolved.]
• If you configure the same IPv6 address on the fxp0 interface and another public interface within the same routing instance, the backup Routing Engine might restart. [PR/72573: This issue has been resolved.]
• On Fast Ethernet and Gigabit Ethernet PICs, LACP is not supported on an aggregated Ethernet interface that is configured with either extended-vlan-vpls encapsulation or ethernet-vpls encapsulation. As a workaround, use vlan-vpls encapsulation on the aggregated Ethernet interface. This limitation does not apply to aggregated Ethernet interfaces configured on Gigabit Ethernet IQ2 PICs. [PR/94480: This issue has been resolved.]
• Output drops might occur with 10-port Gigabit Ethernet PICs because the software incorrectly calculates the number of queues for polling statistics, even though it is different from other PICs. [PR/277693: This issue has been resolved.]
• The MX Tri-rate DPC does not support MAC accounting and returns the following message: “error: MAC accounting and policing not supported.” [PR/387919: This issue has been resolved.]
• With aggregated interfaces and graceful Routing Engine switchover (GRES) enabled, when the neighboring machine goes down, the next hop turns to a hold next hop waiting to be resolved. If the next hop is resolved immediately, there is a possibility for the replicated Routing Engine to panic. [PR/394209: This issue has been resolved.]
• When you have configured the vrf-table-label statement at the [edit routing-instances routing-instance-name] hierarchy level for a VRF routing instance, IPv4 and IPv6 MTU error notification is not handled properly. On M320 routers with an incoming FPC as SFPC and an outgoing FPC as FFPC, large IPv6 packets are not being detected and discarded properly. [PR/397334: This issue has been resolved.]
• When the Routing Engine requests numerous statistics that surpass a set boundary, “PFEMAN: Couldn't write...” messages might be logged and DPC core dumps might be produced. [PR/398233: This issue has been resolved.]
• Prolonged fast interface flaps with thousands of Address Resolution Protocol (ARP) entries might cause the FPC to stop functioning. [PR/399175: This issue has been resolved.]
• In specific configurations such as MVPN, restarting the routing protocol process (rpd) might cause a small memory leak in the Packet Forwarding Engine lookup table memory. This PR also addressed a cosmetic internal counter issue that caused M120, M320, and MX-series routers (with E3-FPCs) to record system log messages such as “fpc0 Stats bucket for jtree app XX negative.” [PR/400917: This issue has been resolved.]
• On J2300 Services Routers, sometimes the onboard Fast Ethernet ports do not allow traffic to pass through, while other interfaces are still passing traffic. [PR/406476: This issue has been resolved.]
• On MX-series platforms running JUNOS Release 9.1R1 or later, when traffic is sent to a router with the 802.1p value set to 2 or Source Class Usage (SCU) configured, the packets might be discarded at the Packet Forwarding Engine. [PR/414491: This issue has been resolved.]
• The show pfe statistics command output did not display I-CHIP Ipktwr packet drop counts. With the fix, a new display line has been added to display I-CHIP Ipktwr packet drop counts. [PR/416477: This issue has been resolved.]
• Under rare circumstances, the kernel might panic on the TX Matrix line-card chassis (LCC) or on the SRX platform following a Routing Engine switchover or Reliable Data Protocol (RDP) connection timeout between the LCC and the switch-card chassis (SCC). [PR/416973: This issue has been resolved.]
• For multicast traffic, if the outgoing interface is on an aggregated interface and its member link is on a different Packet Forwarding Engine, multicast traffic might be lost after the FPC that has the incoming interface for the multicast is rebooted. [PR/418583: This issue has been resolved.]
• After a Type 4 or Type 3-ES FPC is booted, it might discard incoming ARP packets for 60 seconds because of a flaw in the default ARP policer. [PR/419909: This issue has been resolved.]
• SNMP's remote operations process (rmopd) might fail after configuring a BGP neighbor with a local address. [PR/420504: This issue has been resolved.]
• On MX-series routers, when you configure MPLS and a tunnel configuration on the same Gigabit Ethernet DPC, the tunnel interface displays traffic as the sum of the traffic of the other Gigabit Ethernet interfaces on the DPC. This is a cosmetic issue and does not affect functionality. [PR/422274: This issue has been resolved.]
• On MX-series Ethernet Services routers, the FPC might reboot without a core dump when the DWDM is incorrectly configured, and that incorrect configuration causes many link flaps. As a workaround, either disconnect the offending link or include the disable statement at the [edit interfaces] hierarchy level to stop the FPC reboots. [PR/430703: This issue has been resolved.]
• When you configure flow monitoring on a T1600 router with a T640 or T1600 Enhanced Scaled FPC4, if both input and output traffic are located on the same bottom Packet Forwarding Engine, the next-hop address and output interface are set to 0. [PR/431567: This issue has been resolved.]
• On MX-series and M120 routers, and M320 routers with an Enhanced III FPC, if the VRF configuration includes the vrf-table-label statement, a DPC or FPC might dump core when an MPLS packet with time-to-live (TTL) equal to 0 (zero) or 1 (one) is processed at the egress provider edge (PE) router. [PR/436017: This issue has been resolved.]
• The Address Resolution Protocol (ARP) retry count might be incorrect: instead of sending out the first five retries every second, the third and consequent retries might be sent out every 15 seconds. [PR/436580: This issue has been resolved.]

Routing Protocols

• When the Internet Group Management Protocol (IGMP) multicast listener discovery (MLD) source-specific multicast (SSM)-map feature is enabled on a LAN interface with multiple receiving hosts, the router might continue to forward traffic for the group until the IGMP group membership timeout interval expires, even though all receivers might have already left the group. [PR/61538: This issue has been resolved.]
• If graceful Routing Engine switchover (GRES) is not enabled, during a Routing Engine switchover the routing protocol process (rpd) on the new backup Routing Engine quits before cleaning up the forwarding table. [PR/402372: This issue has been resolved.]
• Aggregate routes with a large number of contributing members can cause the routing protocol process (rpd) to monopolize the CPU constantly with frequent routing changes. However this condition applies only when you configure a policy with the aggregate-contributor match condition. [PR/405499: This issue has been resolved.]
• If you redistribute a default route or other labeled unicast FEC with the discard or reject action into BGP and enable traffic statistics at the [edit protocols bgp family inet labeled-unicast] hierarchy level, the routing protocol process (rpd) might dump core and FECs might be logged with a value of 0. As a workaround, change the next-hop action to any valid IP destination. [PR/407546: This issue has been resolved.]
• When changing from static, OSPF, or IS-IS route load balancing to BGP load balancing with multipath enabled, the routes might not be load balanced correctly until you restart the BGP session. [PR/407925: This issue has been resolved.]
• PIM mistakenly prefers a more specific hidden route over an active less specific route as the reverse path forwarding (RPF) route to the MCAST source. [PR/411385: This issue has been resolved.]
• If OSPF is in overload mode on the standby Routing Engine but not in overload mode on the master Routing Engine, It may take a long time to install OSPF routes on the standby Routing Engine. [PR/421636: This issue has been resolved.]
• In certain unusual cases, when all of a peer group go down and the peer group is deleted, BGP might not clean its data structures correctly. [PR/423060: This issue has been resolved.]
• In a large-scale BGP multipath setup, the BGP multipath calculation uses a large amount of CPU and slows down the routing protocol process (rpd) for a long period of time. [PR/424360: This issue has been resolved.]
• Community types were allocated at random to the members in the community list; as a result, sometimes extended communities were treated as simple and vice versa, which caused problems with the VRF import code. [PR/430728: This issue has been resolved.]
• If PIM is disabled, embedded rendezvous point (RP) configurations might cause continuous routing protocol process (rpd) cores. [PR/438159: This issue has been resolved.]

Services Applications

• On routing platforms configured for Internet Key Exchange (IKE)-based IPSec, if a remote peer using other vendors’ equipment does not renegotiate the IKE security association (SA) when it is about to expire and continues to send dead peer detection (DPD) requests on the same SA, the routing platform might not be able to reply to these messages. [PR/47004: This issue has been resolved.]
• When you configure the NAT match-direction output statement and attach it to a interface-style service set on an egress interface, and also explicitly configure forward and backward rules for a NAT service set, an ICMP fragmentation-needed message is not sent and the traffic is dropped without notification. If the backward rule is not configured and is left implicit, this problem is not seen. An explicit backward rule causes the ICMP error packet to be handled as a new flow. As a workaround, do not explicitly configure backward rules unless they are absolutely necessary. [PR/238215: This issue has been resolved.]
• When you configure L2TP with link fragmentation and interleaving (LFI), the MultiServices PIC drops a significant number of MLPPP fragments. [PR/401247: This issue has been resolved.]
• When an IPv6 packet is received by an MS PIC, it might reset unexpectedly because it incorrectly validates the IP header. [PR/401857: This issue has been resolved.]

Subscriber Access Management

• The router's address-assignment pool support enables you to create a named address range that is based on a specific DHCP option 82 value (either circuit-id or remote-id). However, when a client request is received, the router ignores the specified option 82 value and instead uses the first named range of addresses in the address-assignment pool. [PR/263077: This issue has been resolved.]

User Interface and Configuration

• For Gigabit Ethernet intelligent queuing 2 (IQ2) interfaces, the logical interface statistics displayed in the show interfaces command output might not accurately reflect the traffic on the wire. [PR/239167: This issue has been resolved.]
• When you issue the commit confirmed command on a TX Matrix platform, it might not roll back to the original configuration as expected when the commit is not confirmed. [PR/425642: This issue has been resolved.]
• When you configure traceoptions at the [edit system scripts commit] hierarchy level, the router sometimes produces commit errors. [PR/438289: This issue has been resolved.]

VPNs

• In a VPLS dual-homed configuration, sometimes traffic loss might occur for approximately 20 seconds during switchover from the backup to the primary interface. [PR/404605: This issue has been resolved.]
• If MAC addresses are learned within a VPLS instance, CE devices will communicate directly even though no-local-switching is configured. [PR/419976: This issue has been resolved.]
• Multicast group addresses ending with .232 are classified as SSM groups when using multicast VPNs. These routes are not installed in the multicast VPN routing table and all traffic destined to these destinations is dropped. As a workaround, include the asm-override-ssm statement at the [edit routing-instances routing-options multicast] hierarchy level. [PR/426811: This issue has been resolved.]
• When multicast code handles logical interface mismatch notification, it finds the active route from the (S,G); this is the route that should get installed in the forwarding plane, leading to the mismatch. Multicast then sends the mismatch notification to the protocol that owns the active route. While it is finding the active route, multicast ignores the MVPN route and the mismatch notification is dropped. [PR/431211: This issue has been resolved.]

Outstanding Issues

Class of Service

• When a logical tunnel (lt) interface is the outbound interface and you include the ieee-802.1 statement at the [edit class-of-service interfaces lt-fpc/pic/port unit logical-unit-number rewrite-rules] hierarchy level, the commit operation fails. [PR/55903]
• If you try to configure a scheduler map containing two forwarding classes that are mapped to the same queue, the class-of-service scheduler is not applied to the Packet Forwarding Engine. As a workaround, configure a single forwarding class for each available queue. [PR/57907]
• On M-series routers connected by VLAN circuit cross-connects (CCCs) and configured with class of service (CoS), when explicit forwarding (EF) traffic is generated from the ingress customer edge router (CE1) to the egress customer edge router (CE2), the ingress provider edge router (PE1) properly marks the packets with default EXP bits and sends the packets out queue 1, but the intermediary core router forwards all traffic through queue 0 instead of sending it through the EF queue. As a workaround, include the no-control-word statement at any of the following hierarchy levels: [edit logical-routers logical-router-name protocols l2circuit neighbor address interface interface-name], [edit protocols l2circuit neighbor address interface interface-name], [edit logical-routers logical-router-name routing-instances routing-instance-name protocols l2vpn], or [edit routing-instances routing-instance-name protocols l2vpn]. [PR/65280]
• When you configure a specific classifier for a logical unit, it does not override the fixed classifier configured using wildcards. [PR/68888]
• On M320 and T-series routing platforms, if you map multiple forwarding classes to the same queue (specify the same value for the queue-num statement at the [edit class-of-service forwarding-classes class class-name] hierarchy level for multiple classes) and then include the multiple classes in one scheduler map (by including the forwarding-class statement for each one at the [edit class-of-service scheduler-maps map-name] hierarchy level, the commit operation fails with the message “Total bandwidth allocation exceeds 100 percent for scheduler-map.” [PR/103370]
• On MX-series routers, when you configure VPLS over an LSI interface, classification does not work on the egress PE router for traffic flowing from the core of the network to the egress CE router. [PR/240777]
• If you configure the tri-color statement at the [edit class-of-service] hierarchy level, the drop counters for the show interfaces queue command appear to not work for the medium-high (yellow) priority traffic and the low (green) priority traffic. The drop counter for the high-priority traffic (red) functions normally. [PR/258499]
• In JUNOS Release 8.4 and later, the commit or commit-check operation fails if a rewrite rule is defined both at the [edit class-of-service interfaces interface-name unit logical-unit-number rewrite-rules] hierarchy level and in a configuration group (defined at the [edit groups] hierarchy level) that is applied to that interface. The correct behavior is for the directly applied rule to override the rule inherited from the configuration group. [PR/261229]
• On MX960 platforms, bandwidth sharing across high priority and strict-high priority schedulers might not be as expected. This issue occurs when the schedulers are configured on logical interfaces. [PR/265603]
• When you set the port speed of a multirate SONET Type 2 PIC to OC3, it does not correctly change the CoS speed value within the Packet Forwarding Engine. The speed value remains OC12, which results in unexpected CoS behavior. There is no workaround. [PR/279617]
• When a core-facing interface on a PE router that is acting as an IGP peer is deactivated (for example, by deactivating the interface interface-name statement at the [edit protocols ospf area area-id] hierarchy level), the following message might be written to the system log: “COSMAN: cosman_unbind_update_if_refcount: Failed to find the ifd <interface-name> (<index>) in the ifdtable for ifl <index>.” There is no operational impact. [PR/291630]

Forwarding and Sampling

• On M320 and T-series routing platforms, when you configure interface output sampling, packets sometimes might travel through the output firewall. As a workaround, configure a firewall filter on the output interface with then sample and then next-term statements. The workaround provides the same functionality as the other configuration, but avoids the problem behavior. [PR/70473]
• On an MX480 router, if you change link speed for a physical interface (by changing the value of the speed statement at the [edit interfaces interface-name] hierarchy level) and a rate-limiting output policer is applied to one of its logical interfaces (the output statement is included at the [edit interfaces interface-name unit logical-unit-number family family-name policer] hierarchy level), the traffic rate does not change (as reported by the show policer command). As a workaround, deactivate the policer statement, commit, reactivate the statement, and commit again. [PR/314143]
• Under the conditions specified in the following sentence, this message might be written to the system log: “rts_cos_get_shaping_rate_for_ifl(): Entry not found for IFL <index> in cos ifl table.” The conditions are: (a) you configure interface-specific input and output filters that contain logical bandwidth policers (include the logical-bandwidth-policer statement at the [edit firewall policer policer-name] hierarchy level, and both that policer and the interface-specific statement at the [edit firewall family family filter filter-name term term-name then] hierarchy level), (b) you apply the filters to an interface (include the input filter-name and output filter-name statements at the [edit interfaces interface-name unit logical-unit-number family family filter] hierarchy level), (c) you apply a traffic control profile to the interface (include the profile-name statement at the [edit class-of-service traffic-control-profiles] hierarchy level and the output-traffic-control-profile profile-name statement at the [edit class-of-service interfaces interface-name] hierarchy level), and (d) the router receives host-bound packets or IP option packets. As a workaround, include the shaping-rate statement at the [edit class-of-service traffic-control-profiles profile-name] hierarchy level. [PR/314292]
• When a filter term has next term as the action, the action might be shown in the firewall log as “unknown” for the matched outgoing packets. [PR/421810]

High Availability

• When you issue the show chassis ethernet-switch statistics command on a routing platform with graceful Routing Engine switchover enabled, the two Routing Engines might be unable to exchange information for about 2 seconds. [PR/233779]
• On a router with dual Routing Engines and nonstop active routing (NSR) enabled, if you perform a commit synchronize operation when the backup Routing Engine is not available, routing protocol sessions might not be reestablished. To expedite protocol synchronization, issue the restart routing command on the backup Routing Engine when it comes up. [PR/277993]
• Following a unified in-service software upgrade (ISSU), logical tunnel interfaces might not work properly. Problems might include failure of the ping command and formation of Layer 2 forwarding loops. As a workaround, deactivate and activate the affected interfaces after the upgrade finishes. [PR/294284]
• On M-series, MX-series, and T-series routing platforms, if you configure IPv6 on an interface with no MAC address (such as a SONET or loopback interface), it might cause the Routing Engine to restart. As a workaround, do not configure IPv6 addresses on interfaces that do not have MAC addresses. [PR/439252]

Interfaces and Chassis

• On aggregated SONET/SDH interfaces, the counter for drops and errors in the show interfaces command output does not display the correct value, because the counter does not collect data from the constituent interfaces within the aggregate. [PR/23577]
• On ATM interfaces, when the IP address of a remote device is changed, the output of the show ilmi interface command on the local routing platform might continue to display the old IP address for the remote device. [PR/24126]
• On channelized E1 interfaces, you might be able to configure clocking on ds-fpc/pic/port:n interfaces, where n is not unit 0. This is an invalid configuration and might cause a clocking selection problem on the other channels. [PR/24722]
• On a 2-port OC12 ATM2 IQ interface, the total virtual path (VP) downtime might not be displayed correctly in the show interfaces command output. [PR/27128]
• On a 2-port OC12 ATM2 IQ interface, if you configure and then change the virtual path (VP) setting, the SNMP jnxAtmVpTotalDownTime counter might be reset. [PR/27131]
• On M20 and M40 routers, when a physical layer problem affects a SONET/SDH interface, carrier transition statistics might not increment correctly in the output of the show interfaces extensive command. [PR/33325]
• When you configure both the bundle link and constituent links at the [edit logical-routers logical-router-name interfaces] hierarchy level, the constituent links do not come up. As a workaround, configure the constituent links at the [edit interfaces] hierarchy level. [PR/35578]
• On ATM2 DS3 and E3 interfaces, when you configure ATM point-to-multipoint permanent virtual circuits (PVCs), the following error messages might appear in the system log: “/kernel: RT_COS: COS IPC op 4 (CLASS TO IFL) failed,” “err 1 (Unknown)”, “ssb BCHIP 0: invalid entry type 127 at stream 8 channel 0 for ifl 83,” and “ssb COSMAN: mapping table bind to ifl 83 failed.” There is no operational impact. [PR/36524]
• When you apply an IPSec firewall filter to match traffic sent across a generic routing encapsulation (GRE) tunnel and originating from the local routing platform, the local traffic is dropped. Transient traffic is not affected. [PR/44871]
• On channelized OC12 intelligent queuing (IQ) interfaces, incoming code violation path (CV-P) messages might not trigger the sending of remote error indication path (REI-P) messages. [PR/47188]
• On a Link Services PIC, the CLI might incorrectly allow you to configure a logical tunnel interface (interface identifier lt); the resulting interface might not work correctly. [PR/49818]
• If an MLPPP LSQ bundle carries a large volume of link fragmentation and interleaving (LFI) traffic and a small proportion of multilink traffic, packets might be dropped on the egress constituent links. [PR/56664]
• For ISDN dialer interfaces in a J-series Services Router, when you configure the no-keepalives statement at the [edit interfaces dl0 unit logical-unit-number] hierarchy level and you issue the show interfaces dl0 command, the Link flags field in the output might still show ‘Keepalives.’ [PR/58520]
• If you disable an adaptive services interface by including the disable statement at the [edit interfaces sp-fpc/pic/port] hierarchy level and then delete the disable statement from the configuration, IPSec service is not reset correctly. As a workaround, either issue the deactivate services command followed by the activate services command, or issue the request chassis pic offline fpc-slot slot-number pic-slot pic-number command followed by the request chassis pic online fpc-slot slot-number pic-slot pic-number command. [PR/58522]
• On ISDN interfaces in a J-series Services Router, if you include the vrf-table-label statement at the [edit routing-instances instance-name] hierarchy level, packets might be dropped from the connection. [PR/59718]
• On ISDN dialer interfaces in a J-series Services Router, if you include the minimum-links statement at the [edit interfaces dl0 unit logical-unit-number] hierarchy level and then deactivate the BRI interface associated with the dialer interface, the output packets counter displayed in the output of the show interfaces dl0 command might continue to increment. [PR/59986]
• On ISDN dialer interfaces in a J-series Services Router, when you include the load-threshold 100 statement at the [edit interfaces dl0 unit logical-unit-number dialer-options] hierarchy level and the 56-Kbps bandwidth threshold is exceeded, the interface does not support additional network traffic and might not activate another BRI interface. [PR/60045]
• When a switchover event occurs on a routing platform configured with IS-IS, MPLS, and graceful Routing Engine switchover (GRES), the routing platform might end the PPP IP Control Protocol (IPCP) sessions and renegotiate them if the remote side has changed interface MTU settings prior to the switchover event. [PR/61121]
• If you configure graceful Routing Engine switchover and issue the request chassis routing-engine master acquire command, in rare cases the master Routing Engine might fail to relinquish mastership, or the switchover to the backup Routing Engine might take up to 360 seconds. [PR/61821]
• For Automatic Protection Switching (APS) on SONET/SDH interfaces, there are no operational mode commands that display the presence of APS mode mismatches. An APS mode mismatch occurs when one side is configured to use bidirectional mode, and the other side is configured to use unidirectional mode. [PR/65800]
• J4350 and J6350 Services Routers might not have enough data buffers to meet expected delay-bandwidth requirements. Lack of data buffers might degrade CoS performance with smaller-sized packets (500 bytes or less). [PR/73054]
• If you ping a nonexistent IPv6 address that belongs to the same subnet as an existing point-to-point link, the packet loops between the two point-to-point interfaces until the time to live expires. [PR/94954]
• The output of the show interfaces diagnostics optics command includes the "Laser rx power low alarm" field even if the transceiver is a type (such as XENPAK) that does not support this alarm. [PR/103444]
• On serial interfaces transmitting either 64-byte or 128-byte packets, the effective bandwidth might be reduced when the interface is highly oversubscribed. [PR/235753]
• If you configure more than 50 track routes (any combination of IPv4 and IPv6 routes) by including the track statement at the [edit interfaces interface-name unit logical-unit-number family (inet | inet6) address address (vrrp-group | vrrp-inet6-group) group-id] hierarchy level, the VRRP software might not correctly update route information when the status of routes changes. [PR/267769]
• Hot swapping the M120 fan tray might cause the Check CB alarm to activate. [PR/268735]
• On the JCS 1200, when you issue the clear -config -T switch[1] command using the management module, the switch module returns to its factory default setting instead of the Juniper Networks default setting. As a workaround, do not issue the command. [PR/274399]
• When you configure ILMI on an ATM interface (include the ilmi statement at the [edit interfaces interface-name atm-options] hierarchy level) and a graceful Routing Engine switchover (GRES) or unified in-service software upgrade (ISSU) event occurs, the show ilmi command no longer returns any output. [PR/282051]
• On the Juniper Control System (JCS) platform, the control and management traffic for all Routing Engines share the same physical link on the same switch module. In rare cases, the physical link might become oversubscribed, causing the management connection to Protected System Domains (PSDs) to be dropped. [PR/293126]
• On a Protected System Domain (PSD) configured with a large number of BGP peers and routes (for example, 5000 peers and a million routes), FPCs might restart during a graceful Routing Engine switchover. [PR/295464]
• When two routers are connected via SONET/SDH interfaces that are configured as container interfaces and the Routing Engine on one router reboots, the container interfaces on the other router might go down and come up again. [PR/302757]
• On M5, M10, M20, and M40 routers, when you issue an SNMP query for alarm LED status (such as show snmp mib walk jnxLEDState), the message “FPM device not open” might be logged. This is an erroneous message and can be ignored. [PR/313073]
• When you reboot an FPC while it is coming online and if the FPC adding process is interrupted before it is successfully completed, the chassis process does not operate properly. [PR/400676]
• When traffic is passed at near maximum throughput to any queuing IQ2 or IQ2E PICs or DPCs, the show interfaces xe-fpc/pic/port extensive command output for queue counters might be incorrect. [PR/401431]
• The PPP MTU value of an interface protocol on a peer might change as a result of an irrelevant configuration change and cause the PPP MTU negotiation to fail. [PR/421706]
• During the Switching and Forwarding Module (SFM) switchover process, the algorithm to switch over the SFM and take the FPC offline had a flaw and did not clear the hard and soft errors on each FPC. [PR/433616]
• Too many ATM2 error interrupts might cause the FPC to panic. [PR/438073]
• In the output of the show chassis pic fpc-slot slot-number pic-slot slot-number command, the SFP-GE40KM SFP might be shown erroneously as 1000LH instead of 1000EX. [PR/438753]
• When you configure the payload port-data statement at the [edit family mpls hash-key] hierarchy level on M120, MX-series, or M320 platforms with E3 FPCs, the hashing algorithm might not take the port-data values into account. [PR/442223]

Layer 2 Ethernet Services

• On MX480 routers only, the temperature difference between MX480 fan speed-up and slow-down has changed from 0° Celsius to 5° Celsius. Previously, the fan would speed up at a maximum temperature of 54° and slow down at 53° (0-degree gap). With the fix, the fan speeds up at a maximum temperature of 56° and slows down at 49° (5-degree gap). [PR/394651]
• When you configure graceful Routing Engine switchover (GRES) on MX-series routers, the Switch Interface Board (SIB) might not initialize if you reboot both Routing Engines simultaneously or reboot a router with only one Routing Engine installed. [PR/408359]

MPLS Applications

• If you configure a label-switched path (LSP) with the no-cspf statement at the [edit protocols mpls] hierarchy level, the LSP might cycle up and down several times before stabilizing. [PR/10415]
• If a circuit cross-connect (CCC) LSP traverses a forwarding-adjacency LSP, traffic forwarding might be affected. [PR/60088]
• RSVP graceful restart does not function for LSPs that have a forwarding adjacency (FA) label-switched path (LSP) as a next hop. [PR/60256]
• When you modify the primary path for an MPLS LSP by using the delete protocols mpls label-switched-path lsp-path-name primary path-name command in configuration mode, followed by the set protocols mpls label-switched-path lsp-path-name primary path-name command, and then issue the commit command, the entire LSP (both primary and secondary) is torn down and then rebuilt from scratch. As a workaround, issue the delete protocols mpls label-switched-path lsp-path-name primary path-name command in configuration mode followed by the commit command. Then issue the set protocols mpls label-switched-path lsp-path-name primary path-name command followed by the commit command. [PR/62365]
• When you enable per-packet load balancing on parallel label-switched paths (LSPs), the output of the show mpls lsp ingress command might display all the routes on only one of the LSPs even when traffic is evenly balanced across the LSPs. [PR/70487]
• An error in the Constrained Shortest Path First (CSPF) software might cause the routing protocol process (rpd) to generate a core file and stop operating. [PR/103777]
• When you include the load-balance bandwidth statement at the [edit protocols rsvp] hierarchy level for a router with two LSPs to a destination, the balance coefficient is set to zero for the next-hop interfaces in the MPLS forwarding table entry for the route to the destination that is marked with “(S=0).” (In other words, in the output from the show route forwarding-table family mpls extensive command, the record with the header “Destination: index (S=0)” has “Next-hop interface” entries for which the “Balance“ field does not appear.) [PR/257570]
• When there are more than five link-protected or node-link-protected LSPs to the same destination and per-packet load balancing is enabled, some bypass next-hops might not be part of the active route. This can occur after a primary link goes down and comes back up. [PR/259219]
• For point-to-multipoint LSPs configured for VPLS, the ping mpls command reports 100 percent packet loss even though the VPLS connection is active. [PR/287990]
• On M-series and T-series routers, configuration changes to some attributes of the standby secondary path of an MPLS label-switched path (LSP) might cause the LSP to flap, which might result in packet loss. [PR/394184]

Network Management

• The following groups of MIB objects do not segregate the data they return according to the routing instance specified in an SNMP request: vrrpMIB, jnxCosIfqStatsTable, and jnxCosQstatTable. [PR/63045]
• When subagents are slow in responding to SNMP queries, the SNMP process continues to buffer the incoming SNMP requests. SNMP memory becomes exhausted after the buffer increases to a bigger value, which causes the SNMP process to dump core. [PR/430106]

Platform and Infrastructure

• On T-series platforms, a Layer 2 maximum transmission unit (MTU) check is not supported for MPLS packets exiting the routing platform. [PR/46238]
• When you configure a source class usage (SCU) name with an integer (for example, 100) and use this source class as a firewall filter match condition, the class identifier might be misinterpreted as an integer, which might cause the filter to disregard the match. [PR/50247]
• When a Monitoring Services PIC is overloaded with traffic, the FPC might take the PIC offline and repeatedly send the same error message. The error message does not affect normal operation of the FPC and PICs. As a workaround, restart the FPC or bring the PIC online. [PR/55981]
• If you configure several DNS servers by including the name-server statement at the [edit system] hierarchy level, the JUNOS software uses only the first three configured DNS servers. [PR/59172]
• On a Monitoring Services III PIC configured as a dynamic flow capture (DFC) interface (dfc-fpc/pic/port), when you configure the DFC interface as the next hop in a forwarding path, port-mirrored packets might become corrupted. [PR/60799]
• If you configure 11 or more logical interfaces in a single VPLS instance, VPLS statistics might not be reported correctly. [PR/65496]
• If you see warnings like the following: “Warning: Block size restricts cylinders per group to xx,” you can safely ignore them. This type of message indicates the maximum number of cylinders per cylinder group as determined by various other parameters. This warning message no longer appears in JUNOS Release 8.5 and later. [PR/65917]
• When a large number of kernel system log messages are generated, the log information might become garbled and the severity level could change. This behavior has no operational impact. [PR/71427]
• On M320 and T-series routing platforms, there is a process that monitors FPCs while they transition to an online state. If an FPC is busy and cannot complete the transition within the time limit, the process might time out and prevent the FPC from coming online. [PR/72364]
• On M320 and T-series routing platforms, when you configure the local gateway of an IPSec tunnel in a routing instance, IPSec might not function properly over a generic routing encapsulation (GRE) tunnel. [PR/73864]
• When a link services interface to a CE router appears in the VPN routing and forwarding table (VRF table) and fragmentation is required, the interface does not forward Internet Control Message Protocol (ICMP) messages from a remote PE router that is also in the VRF table. As a workaround, include the vrf-table-label statement at the [edit routing-instances routing-instance-name] hierarchy level. [PR/75361]
• If you commit configuration for an IPv6 address to a logical interface while the interface is flagged in a down state, the IPv6 address remains tentative and unusable after the logical interface returns to the up state. [PR/75896]
• On M160 and M40e routers, a hardware error on the Switch Fabric Module (SFM) might cause the board to reboot. [PR/79236]
• On the T-series routing platform, when you include the no-labels configuration statement at the [edit forwarding-options hash-key family mpls] hierarchy level, the statement is added to the configuration; however, MPLS labels are still included in the hash key. [PR/80334]
• Traceroute does not work when ICMP tunneling is configured. [PR/94310]
• On T-series or M320 routers, multicast traffic with the “do not fragment” bit set is dropped because a low MTU value is configured. If the clear pim join command is issued, the router might stop forwarding all traffic transiting this interface. [PR/95272]
• When aggregated Ethernet interfaces handle a large volume of multicast traffic, the kernel might generate system log messages that include the following text: “request type <type> did not expect ipc reply type <type> subtype <subtype> uniquifier <uniquifier>.” [PR/95931]
• A firewall filter that matches the forwarding class of incoming packets (that is, includes the forwarding-class statement at the [edit firewall filter filter-name term term-name from] hierarchy level) might incorrectly discard traffic destined for the Routing Engine. Transit traffic is handled correctly. [PR/97722]
• During system boot on J-series Services Routers, you cannot use as the media device a USB device (such as the "U3 Titanium" device from SanDisk Corporation) that provides U3 features. You must remove the U3 support before using the device as external media. For the U3 Titanium device, you can use the U3 Launchpad Removal Tool on a Windows-based system to remove the U3 features. The tool is available for download at http://www.sandisk.com/Retail/Default.aspx?CatID=1415. (To restore the U3 features, you can use the U3 Launchpad Installer Tool, accessible at http://www.sandisk.com/Retail/Default.aspx?CatID=1411.) [PR/102645]
• When you enable point-to-multipoint LSPs over an outgoing aggregated Ethernet interface that is configured with circuit cross-connect (CCC) switching, the LSP fails to forward traffic and the following error appears in the system log: “nh_ucast_add.” As a workaround, disable the interface and LSP, re-enable them in that order, and then clear the RSVP session for the LSP. [PR/105884]
• The JUNOS software does not support dynamic ARP resolution on Ethernet interfaces that are designated for port mirroring. This causes the Packet Forwarding Engine to drop mirrored packets. As a workaround, configure the next-hop address as a static ARP entry by including the arp ip-address statement at the [edit interfaces interface-name] hierarchy level. [PR/237107]
• On MX960 routers, if you issue the request system power-off other-routing-engine command to power down a Routing Engine, it does not power back on when you then issue the request system power-on other-routing-engine command. [PR/253061]
• On T640, T320, and M320 routers, if you take an FPC offline during an ISSU boot and there is transit traffic flowing from the other FPCs towards the offlined FPC, other FPCs in the router might reset unexpectedly. [PR/268294]
• When the file resolve.conf does not include a proper working DNS server name, the show ntp associations command output displays the message “Can't find host localhost” with NTP server definitions. Because the DNS server name is not mandatory in resolve.conf, the error message is unnecessary. [PR/270915]
• When a GGSN C-PIC sends a packet larger than the MTU of the outgoing interface in a default VRF, ICMP error messages that indicate fragmentation is needed do not reach the C-PIC. [PR/276392]
• When Periodic Packet Management (PPM) delegation for Bidirectional Forwarding Detection (BFD) sessions is deleted, (the delegate-processing statement is removed at the [edit routing-options ppm] hierarchy level), the BFD sessions might be terminated (because a “state is down” message is sent) and then re-established. [PR/280233]
• When you perform an in-service software upgrade (ISSU) on a routing platform with an FPC3 or an Enhanced FPC3 with 256 MB of memory and the number of routes in the routing table exceeds 750,000, route loss might occur. If route loss occurs, as a workaround, perform either of the following tasks: replace the FPC3 or Enhanced FPC3 with another FPC that has more memory; or, after the ISSU is complete, reboot only the FPC3 or Enhanced FPC3. [PR/282146]
• Due to a limitation in the Packet Forwarding Engine (PFE), VPN traffic received on a physical interface on an IQ2 PIC might not be counted on the parent aggregated Ethernet physical interface. [PR/284162]
• For Routing Engines rated at 850 MHz (which appear as “RE-850” in the output from the show chassis hardware command), messages like the following might be written to the system log when you insert a PC Card: “bad Vcc request” and “Device does not support APM.” Despite the messages, operations that involve the PC Card work properly. [PR/293301]
• Next-hop marking (marked with a dash) in the show route forwarding-table command output indicates which next hops might not transmit traffic in a hierarchical load-balancing topology (for example, multiple load-balanced LSPs over multiple paths or aggregated interfaces). The forwarding-options indexed-next-hop statement was added to address hierarchical load-balancing issues, but configuring this statement may result in the next-hop marking being inaccurate and so the markings should be ignored. [PR/293306]
• If both the key and ttl statements are included at the [edit logical-systems logical-system-name interfaces interface-name unit logical-unit-number tunnel] hierarchy level for a GRE tunnel, the TTL value might be decremented incorrectly. This can cause the ping command to fail. [PR/300956]
• In some JUNOS releases, temporary files that have names in the format cprodxxxxxx are retained in the /tmp directory on the router. They should be deleted. [PR/304750]
• On the TX Matrix platform, if there are a large number of interface configuration changes in a small amount of time, or if the alarm process (alarmd) restarts, it might take a long time for the show version detail command to return all of its output. [PR/307228]
• On M320 platforms running JUNOS Release 9.1R2 or later with M320 Enhanced III FPCs or on M120 platforms, traffic is dropped towards the fabric after graceful Routing Engine switchover (GRES). The following system log entry might appear: “ichip_f_check_dest_errors: Fabric request time out for plane ...” To recover, you must restart the Enhanced III FPC on M320 platforms or the Forwarding Engine Board (FEB) on M120 platforms. [PR/310061]
• Under certain circumstances, running tcpdump causes VRRP to fail. If you configure VRRP and run tcpdump on another port on the same interface, when tcpdump exits, the packets sent to the VRRP MAC address are no longer accepted by the router. [PR/398816]
• When you configure per-packet load balancing, outgoing traffic is dropped on T640 routers. The problem is exacerbated if you have configured two Packet Forwarding Engine instances. [PR/402031]
• Following an FPC reset, the next-hop route pointing to the service PIC interface running RPM might be incorrect. [PR/438599]
• When certain FPCs (T1600-FPC4-ES, T640-FPC4-1P-ES, T640-FPC1-ES, T640-FPC2-ES, and T640-FPC3-ES) receive corrupted cells via high-speed links, they might unnecessarily reboot and report the following system log error message: “Unrecoverable Error: Flist gtop bit toggled !.” No reset is needed to recover from this condition. [PR/441844]

Routing Policy and Firewall Filters

• The extended Dynamic Host Configuration Protocol (DHCP) relay agent feature does not function properly on a nondefault logical router. Although the JUNOS CLI permits you to include the dhcp-relay statement at the following hierarchy levels, the feature does not work properly:
  • [edit logical routers logical-router-name forwarding-options]
  • [edit logical routers logical-router-name routing-instances routing-instance-name forwarding-options]

  [PR/82275]

Routing Protocols

• The CLI allows you to commit a configuration that specifies a value higher than 32 for the metric statement at the [edit protocols dvmrp interface all] hierarchy level, but values higher than 32 are invalid. [PR/33429]
• If a router receives a Pragmatic General Multicast (PGM) Source Path Message (SPM), it does not create a forwarding cache, nor does it forward the message to other routers as a heartbeat, as specified in RFC 3208. Also, the router’s multicast cache might time out if it does not receive actual PGM data (ODATA) for more than 6 minutes. As a workaround, configure the PGM source application to send PGM ODATA at least once every 6 minutes. The ODATA acts as the heartbeat message in lieu of the SPM messages and ensures that the multicast and forwarding caches are created and updated. [PR/37504]
• If you configure the sham-link statement at the [edit routing-instances instance-name protocols ospf area] or [edit routing-instances instance-name protocols ospf] hierarchy level on a provider edge (PE) router, extraneous OSPF link-state advertisements (LSAs) might be added. In some cases, this can result in a routing loop between the customer edge (CE) and PE routers. [PR/40000]
• You can specify a value for the lsp-interval statement at the [edit protocols isis interface-name] hierarchy level that exceeds the documented maximum (the operation does not fail when you commit such a configuration). However, values that exceed the maximum can cause unexpected behavior. [PR/41613]
• When you configure damping globally and use the import policy to prevent damping for specific routes, and a new route is received from a peer with the local interface address as the next hop, the route is added to the routing table with default damping parameters, even though the import policy has a nondefault setting. As a result, damping settings do not change appropriately when the route attributes change. [PR/51975]
• If a BGP group is created but without any defined peers, a warning message appears when the configuration is committed. [PR/63279]
• When you issue the show ldp traffic-statistics command, the following system log message might be generated for all forwarding equivalence classes (FECs) with an ingress counter set to zero: "send rnhstats GET: error: ENOENT -- Item not found." [PR/67647]
• If ICMP tunneling is enabled on the router and you configure a new logical router that does not have ICMP tunneling enabled, the feature is globally disabled. [PR/81884]
• When the flow of multicast traffic changes because an OSPFv3 link goes down, the output from the show multicast statistics inet6 command reports incorrect values in the “In kbytes” and “In packets” fields for the new ingress interface. [PR/234969]
• When you commit a new configuration for nonstop active routing (NSR) on a primary Routing Engine that differs from the configuration for nonstop active routing that is already running on the backup Routing Engine, the routing protocol process stops functioning on the backup Routing Engine only. Traffic forwarding is not affected. [PR/254379]
• On a router with dual Routing Engines and nonstop routing (NSR) configured, the backup routing protocol process (rpd) might reset unexpectedly in a very rare scenario while processing an indirect next hop deletion. The reset should not affect any functionality. [PR/302731]
• The clear ospf io-statistics command might not clear the counter values that are displayed by the show ospf io-statistics command. [PR/308679]
• When more than one external path originates from the same autonomous system (AS), the JUNOS software does not comply with the path selection algorithm defined in RFC 5004. [PR/392819]
• Deactivation of routing instances might cause the routing protocol process (rpd) to create a soft assertion core dump. [PR/396122]
• When you configure the BFD event flag trace option, the backup Routing Engine might report a “down -> down” event repeatedly and fill up the trace file. As a workaround, disable the use of BFD trace options to prevent excess disk usage. [PR/405022]
• When nonstop routing (NSR) is configured and rapid configuration commits occur for a certain type of configuration changes, the routing protocol process (rpd) might stop consuming further configuration changes with the message “SIGHUP while previous commit isn't yet complete.” [PR/405761]
• If a multiaccess interface is disabled, after a Routing Engine switchover this disabled link is advertised in the router link-state advertisement (LSA). [PR/418559]
• If RIP authentication is turned on and there is a sequence number mismatch, updates might get dropped because they are not processed in the order they are received. [PR/429297]
• When you configure the path-selection always-compare-med statement at the [edit protocols bgp] hierarchy level, BGP multipath might not find all the eligible paths. [PR/444629]

Services Applications

• The output of the show services nat pool command displays duplicate entries for a single Network Address Translation (NAT) pool. [PR/34678]
• The show services accounting flow-detail extensive command sometimes displays incorrect information about input and output interfaces. [PR/40446]
• When you configure intrusion detection service (IDS) on J-series platforms, including the threshold statement at the [edit services ids rule rule-name term term-name then logging] hierarchy level has no effect. [PR/46577]
• On Adaptive Services PICs configured for IPSec tunnel redundancy, if there are a large number of tunnels, sometimes a few of the tunnels might switch over to the backup tunnel. [PR/46733]
• If the socket buffer becomes full on a remote router, you cannot clear all the IPSec security associations (SAs) from the router. [PR/55189]
• When a routing platform is configured for graceful Routing Engine switchover and Adaptive Services (AS) PIC redundancy, and a switchover to the backup Routing Engine occurs, the redundant services interface (rsp-) always activates the primary services interface (sp-), even if the secondary interface was active before the switchover. [PR/59070]
• For Adaptive Services II PICs, even if you do not configure flow collector services, a temporary file might be created every 15 minutes in the /var/log/flowc/ directory. The file is deleted if there are no clients, and re-created only when a client connects and attempts to write to the file. [PR/75515]
• The JUNOS software does not issue a warning when you configure an address as both the destination IP address of a voice over IP (vp-) interface and the primary address of another interface on the router. This configuration is not valid and can disrupt forwarding of traffic to the voice over IP interface. [PR/75535]
• On J4350 and J6350 Services Routers, when you insert a Telephony Gateway Module (TGM) 550 PIM and the PIM is in a reset state, the router might not respond to any show chassis commands for up to 5 seconds. [PR/78695]
• On some J-series Services Routers, when you press the F10 key to save and exit from BIOS configuration mode, the operation might not work as expected. As a workaround, use the "Save and Exit" option from the "Exit" menu. This issue affects J4350 and J6350 routers with BIOS Version 080011, and J2320 and J2350 routers with BIOS Version 080012. [PR/237721]
• On some J-series Services Routers, the Clear NVRAM option in BIOS configuration mode does not work as expected. This issue affects J4350 and J6350 routers with BIOS Version 080011, and J2320 and J2350 routers with BIOS Version 080012. To help mitigate this issue, keep records of any changes you make to the BIOS configuration, so that you can revert to the default BIOS configuration as needed. [PR/237722]
• If a large number of BGP authentication sessions (for example, 400) are configured in a VRF instance, the following message is written to the system log when the configuration is committed: “keyadmin[<pid>]: dump_assn: posting additional read.” There is no operational impact. [PR/295407]
• When the L2TP process restarts, the corresponding kernel data structures are not removed. If the newly restarted process finds configuration-related kernel entries, the process considered this to be an error. With the fix, the process consider this as a normal case. [PR/441395]
• A TCP-based stateful firewall flow might remain active after the service interface inactivity timeout expired, even though the corresponding TCP session was already closed. Several iterations of Reset and TCP keepalive messages might be exchanged between the peers before the flow is completely closed. [PR/446960]

Software Installation and Upgrade

• For hard disks that were originally formatted by JUNOS Release 4.4 or earlier, after you issue the request system snapshot partition command, the router cannot boot from the hard disk. As a workaround, issue the request system snapshot command before upgrading. [PR/36742]

User Interface and Configuration

• On M20 routers, after a Routing Engine mastership switchover, it might not be possible to enter CLI configuration mode on the new master Routing Engine. Also, the request system reboot and request system halt commands do not clearly fail but do not return the CLI prompt either. [PR/64899]
• The logical router administrator can modify and delete master administrator only configurations by performing local operations such as issuing the load override, load replace, and load update commands. [PR/238991]
• When you add a comment to an inactive element in private configuration mode, the commit fails with a syntax error. [PR/270160]
• If a BGP peer is defined in a configuration group, it might not be possible to establish a connection with it. [PR/283238]
• In the output from the configuration mode show | compare command, the banner might be the parent level of the current hierarchy level instead of the current level itself. For example, when the current hierarchy level is [edit interfaces fe-1/1/1], the banner in the output reads [edit interfaces], but the additions and deletions are reported with respect to the [edit interfaces fe-1/1/1] hierarchy level. [PR/291574]
• If you use the replace pattern command to change the name of a policy that is applied to an object at the [edit protocols] hierarchy level (for example, the import policy-name statement is included at the [edit protocols bgp group group-name neighbor address] hierarchy level) and then commit the configuration, the show | compare command reports the name change at the hierarchy level for the object but shows the new name as both the old and new value. The output remains the same even after multiple repetitions of the commit command. However, the policy with the new name is being applied correctly. [PR/294344]
• When you include the match regular-expression statement at the [edit system syslog (console | file | host | user)] hierarchy level to refine the set of messages included in the log, messages that do not match the expression are still included. [PR/295523]
• The alarm process (alarmd) updates /var/db/feature.db, a license-tracking file, every 60 seconds, even on routers that do not support the JUNOS software licensing feature (for example, the M7i, M10i, M40e, and T-series routing platforms). This causes unnecessary hard disk drive activity. To determine whether a router supports licensing, issue the show system license command. On routers that do not support licensing, the command returns the message “syntax error, expecting <command>.” As a workaround, you can create an empty /config/license directory at the root privilege level. [PR/308466]
• When you set the time-zone statement at the [edit system] hierarchy level, it might cause the backup Routing Engine to lock the configuration. As a result, you would no longer be able to reboot the Routing Engine or perform any commits. To clear the issue, you must log into the backup Routing Engine and issue the clear system commit command. [PR/309100]
• A user belonging to a login class with limited rights to modify a specific firewall filter cannot use the insert command to reorder firewall terms. [PR/310872]
• Wildcard apply groups do not work properly in JUNOS Releases 9.1, 9.2, 9.3R1 and 9.3R2. [PR/425355]

VPNs

• When you modify the frame-relay-tcc statement at the [edit interfaces interface-name unit logical-unit-number] hierarchy level of a Layer 2 VPN, the connection for the second logical interface might not come up. As a workaround, restart the chassis process (chassisd) or reboot the router. [PR/32763]
• Traffic might not flow when an ATM interface is used as the access circuit on an M120 router. [PR/255160]
• Applying configuration changes that remove a static point-to-multipoint LSP and at the same time a static MVPN provider tunnel group configuration can cause the routing protocol process (rpd) to reset unexpectedly. To avoid this problem, first delete the provider-tunnel configuration and then the LSP configuration. [PR/288456]
• When you delete a Layer 2 VPN routing instance and add a new VPLS routing instance using the same interface within the same commit, the routing protocol process (rpd) might dump core. [PR/291407]
• When a provider edge (PE) router acts as the auto-RP mapping agent for a PIM multicast instance within a Multiprotocol BGP Layer 3 VPN, the rendezvous point (RP) elections are handled correctly on other routers in the VPN, but do not work on the mapping agent. Also, when you issue the show pim rps instance command on the mapping agent router, no RP information appears. [PR/305325]
• For a VRF instance configured for PIM, MVPN, and provider tunnels (the pim and mvpn statements are included at the [edit routing-instances vpn-name protocols] hierarchy level and the provider-tunnel statement is included at the [edit routing-instances vpn-name] hierarchy level), when PIM is deactivated and reactivated, it fails to install type-5 (source-active) routes in the instance.mvpn.0 routing table. This issue arises only when remote C-multicast joins are configured on the ingress PE router (as displayed by the show mvpn c-multicast command). [PR/306983]
• When an LSP switches from a primary path to a bypass path, Layer 2 circuits might go down and come up again, resulting in packet loss. [PR/309085]
• On a router configured for nonstop active routing (NSR) (the nonstop-routing statement is included at the [edit routing-options] hierarchy level), if a nonstop active routing switchover occurs after the configuration for routing instances changes in certain ways, BGP sessions between PE and CE routers might not be established after the switchover. [PR/399275]