JUNOSe 11.0.0 Release Notes > Release 11.0.0 > Known Problems and Limitations

Known Problems and Limitations

This section identifies the known problems and limitations in this release. For more information about known problems that were discovered at customer sites, you can log in to the JUNOSe Knowledge Base at https://www2.juniper.net/kb/, enter the defect ID number in the Search by Keyword field, and click Search.

ANCP

• On an E320 router that has established 3000 ANCP adjacencies with a client and traffic is initiated, the following behavior occurs sporadically: All existing Telnet sessions are disconnected and no new Telnet sessions can be established for several minutes. [Defect ID 83872]

ATM

• The line module resets when you issue the show nbma arp command after you have configured NBMA interfaces on an ATM line module. [Defect ID 88491]
• When 16,000 PPPoA interfaces are configured on an OCx/STMx ATM line module paired with an OC3-4 I/O module in an ERX14xx model, ERX7xx model, or ERX310 router, Ping traffic passing through the line module on the restarting router experiences an outage of 103 seconds, which is beyond the maximum limit, after a unified ISSU from JUNOSe Release 9.2.0p1-0 to 9.3.0b0-12. This outage does not occur when the same configuration is applied on a Gigabit Ethernet interface. [Defect ID 179794]
• When you reload an ATM line module that is configured with NBMA circuits as passive OSPF interfaces and that has established OSPF adjacencies and IBGP peers (configured on Gigabit Ethernet interfaces), the transmission of OSPF hello packets might be affected until all the NBMA interfaces have initialized. [Defect ID 46157]

Work-around: Either remove the passive OSPF interface statements on the NBMA interfaces, or statically configure the OSPF cost on the NBMA interfaces.

• When a mirror rule that triggers on username is employed for packet mirroring of dynamic IP subscribers over ATM, removal of the rule does not disable packet mirroring. [Defect ID 175356]

Work-around: Use a mirror rule that triggers on account session ID rather than on username.

• The ATM peak cell rate (PCR) does not appear in the L2TP Calling Number AVP for the first PPP session when the ATM shaping parameters were configured by RADIUS return attributes. [Defect ID 60933]
• When you issue the no atm atm1483 auto-configure upperInterfaceType lockout-time command in Profile Configuration mode, the lockout time range does not revert to the default values. [Defect ID 66544]
• When one or more ATM1483 attributes appears in a profile, the show configuration include-defaults command fails to display the default values for all possible ATM1483 attributes. [Defect ID 67157]
• The output of the show atm arp command displays only 4096 entries when the line module is configured with more than 4096 NBMA ARP entries. [Defect ID 68849]
• When you use the no-authenticate keyword with the subscriber command to prevent subscriber authentication so that the subscriber information can be used for DHCP option 82, suboption 2, the SRP module can reset. This issue does not occur when you use the no-authenticate keyword with the subscriber command as a way to perform a RADIUS configuration. [Defect ID 69865]
• When you perform an snmpWalk on the juniAtmSubIfVccTable, a response is received for only a few of the total configured ATM subinterfaces when both of the following are true: the router has a line module that has some ATM-related configuration and the line module is in the disabled state. [Defect ID 80020]
• The baseline interface atm command fails for a VCD assigned by the router to F4 OAM circuits. [Defect ID 174482]
• Unified ISSU is not supported when ILMI is configured on ATM interfaces. [Defect ID 176007/177297/177122]
• ATM line modules reset after unified ISSU completes at the LAC when an MLPPP bundle with three links are tunneled to the LNS. [Defect ID 178821]
• For PPPoE, the AAL5 inPacket Discards counter might increment erroneously during call setup when a packet is passed directly to PPPoE for negotiation rather than being discarded. [Defect ID 51757]

Work-around: Incremental InPacketDiscards during call setup do not necessarily indicate a problem. However, we recommend you investigate an excessive count because that might indicate a connection that cannot be successfully brought up for some reason, such as RADIUS denials or improper configuration.

• The inPacketOctetDiscards counter in the output of the show atm vc atm interface vcd command includes both inBytesDropped and inBytesUnknownProtocol statistics. The inBytesUnknownProtocol stxatistics should be displayed by a separate counter.

At the major interface level, the inPacketDiscards counter includes both inPacketsDropped and inPacketUnknownProtocol statistics. The inPacketUnknownProtocol statistics should be displayed by a separate counter. [Defect ID 44286]

• When you configure an ATM PVC where PCR = SCR and maximum burst size is zero, the CLI returns an error indicating the burst size is invalid and it does not create the VC. [Defect ID 58357]

Work-around: Configure a CBR or a UBR plus PCR to create the circuit with the same parameters, depending on the desired priority for the traffic. CBR has a high priority and UBR plus PCR has a medium priority.

BFD

• After you have shut down the interface to the next hop (for the route that is used to establish the BFD session), output for the show bfd session command erroneously indicates the shutdown interface as Management Interface (FastEthernet 6/0). [Defect ID 174271]

Bridged Ethernet

• The CLI erroneously permits you to configure bridge1483 encapsulation over AAL5MUX IP even though that configuration is not supported. [Defect ID 35013]

CLI

• When you issue a run show ppp command, the CLI changes the configuration level of the command line to Global Configuration mode rather than remaining at the level from which you issued the command. [Defect ID 52165]

Work-around: Reissue the commands necessary to reenter the desired mode.

• The logout subscribers all command may not log out all of the DHCP subscribers. Although the bindings and DHCP addresses are cleared, the show subscribers summary command may display some of the DHCP subscribers. [Defect ID 180176]

Work-around: Try using the dhcp delete-binding all command. If this does not clear the subscribers, you may want to reload the line module to avoid further issues.

DHCP

• DHCP packets are not forwarded to the DHCP server over dynamically created interfaces when all of the following are true: [Defect ID 180343]

• DHCP relay or DHCP relay proxy is configured on the router.
• The client-facing interfaces are created dynamically using bridged Ethernet over static ATM PVCs.
• The ip auto-detect ip-subscriber command is configured to enable packet detection (packet triggering) and to trigger creation of dynamic subscriber interfaces.

Work-around: To avoid this defect, do all of the following:

• Do not use the ip auto-detect ip-subscriber command to enable packet triggering and to create dynamic subscriber interfaces
• Ensure that DHCP external server is configured in the virtual router.
• Ensure that the set dhcp relay inhibit-access-route-creation command is configured in the virtual router to prevent DHCP relay from installing host routes by default.

DHCP External Server

• With the unique client ID option enabled, when two clients with the same MAC address or client ID are on an interface (where one client is connected over a router and relay and the other client is connected directly), sending a release request from one of the clients might terminate another client. [Defect ID 179759]
• The DHCP renew counter and release counter (displayed with the show ip dhcp-external statistics command) are doubled rather than incremented for each renew and release sent. [Defect ID 78802]
• When DHCP clients on an S-VLAN over bridged Ethernet stack configuration send a decline message to a router that has DHCP relay and DHCP external server configured in the same VR, the clients bindings are not removed from the DHCP external server. [Defect ID 87086]
• When DHCP relay and DHCP external server are configured in the same VR with server-sync enabled, bindings are not created in the DHCP external server when DHCP clients on an ATM bulk configuration interface stack and dynamic VLAN over Ethernet stack sends a renew message. [Defect ID 87087]
• DHCP NAK packets are sent from a different VLAN than the one on which the renew request is received on a router that is configured with dynamic VLANs, DHCP local server, and automatically created dynamic subscriber interfaces. This behavior occurs only after a link flap has taken place. [Defect ID 87062]

DoS Protection

• A Telnet session closes when sending ipLocalBGP protocol traffic at a rate in the range 4096-4200 packets per second (pps) with suspicious control flow detection enabled. [Defect ID 81974]

Work-around: When the traffic drops below 4096 pps, open a new Telnet session.

Ethernet

• When autonegotiation is enabled on Gigabit Ethernet interfaces with the speed automatically negotiate command, issuing the link selection command logs out subscribers. [Defect ID 87185]

Work-around: Use the following commands to enable auto link selection (GE port redundancy) and to switch from one port to the other port:

(config-if)#no link selection

(config-if)#link failover force

File System

• When the primary SRP module is running JUNOSe Release 7.2.0 or higher-numbered release and the standby SRP module is running a release numbered lower than Release 7.2.0 (as in a downgrade situation), you cannot display the files for the standby SRP module. [Defect ID 74104]

Forwarding

• The DoS protection egress rate is not accurate for the ES2 10G LM or the ES2 10G Uplink LM. [Defect ID 86925]
• When performing MAC validation to match subscriber demux entries with ARP host entries, the ES2 10G LM does an exact match, rather than a longest prefix match. The subscriber demux entry source address must be a /32 value matching the IP address of an ARP entry in order to validate the MAC address against that ARP entry. [Defect ID 79641]
• When PPPoE over LAG is configured on an interface, and you re-execute the PPPoE-over-LAG configuration before you delete the previous configuration, the ES2 10G LM line module resets. [Defect ID 179639]

Work-around: Before you can re-execute the PPPoE-over-LAG configuration, delete the existing PPPoE-over-LAG configuration.

• VPLS forwarding does not function properly when any of the following conditions occur: [Defect ID 79856]

• MLPPP interfaces are used
• L2TP is used with sequence numbers enabled
• GRE is used with sequence numbers enabled

• Specifying S-VLAN ranges that partially overlap does not work. [Defect ID 81918]

For example, the following configuration fails because S-VLAN 22 falls within the previously specified S-VLAN range of 21-23.

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 23 401 426

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 23 427 712

host1(config-if)#vlan bulk-config BulkCezarCnfg2 svlan-range 22 22 101 110

Work-around: You can do either of the following to avoid this problem.

• Specify each S-VLAN within the partially overlapping range as individual S-VLANs, as in the following example:

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 21 401 426

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 22 22 401 426

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 23 23 401 426

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 21 427 712

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 22 22 427 712

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 23 23 427 712

host1(config-if)#vlan bulk-config BulkCezarCnfg2 svlan-range 22 22 101 110

• Use fully overlapping ranges rather than partially overlapping ranges, as in the following example:

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 23 401 426

host1(config-if)#vlan bulk-config BulkDHCPCnfg1 svlan-range 21 23 427 712

host1(config-if)#vlan bulk-config BulkCezarCnfg2 svlan-range 21 23 101 110

• When you attach certain hierarchical policies to subinterfaces as input policies, secondary input policies, and output policies, incoming traffic loss can occur when the number of subinterfaces to which the policies are attached exceeds 4600. [Defect ID 86741]
• Ethernet statistics are incorrectly displayed for virtual port 8 of the ES2-S1 GE-8 IOA when that module is paired with the ES2 10G LM or the ES2 10G Uplink LM. [Defect ID 174784]
• The ES2 10G LM does not support framed routes configured for dynamic subscriber interfaces. [Defect ID 83154]
• A memory leak of about two percent can occur on the ES2 10G LM and result in a module reset when a large number of successive SRP switchovers take place with active DHCP clients. [Defect ID 86245]
• On the ES2 10G LM, a VLAN ID of 0 assigned to an interface can prevent packets from being properly forwarded. [Defect ID 176125]

ICR

• If you saved the running configuration of the router as a script file (.scr) and execute the script to apply the settings on the router, ICR partition configuration commands in the .scr file might fail to add group members to the partition. This problem happens when the subscriber configuration in the .scr file is placed before the ICR partition configuration. However, this problem does not occur if you used a system configuration (.cnf) file to set up the router. [Defect ID 183913]

Work-around: To correct this problem and enable ICR partitions to be created correctly, make sure that you add the ICR partition configuration before the subscriber interface configuration in the .scr file. You can perform this reordering by modifying the .scr file to place the commands that configure subinterfaces for ICR partitions before the commands used for VLAN-based or S-VLAN-based grouping of subscribers.

• When you configure ICR settings using a CLI macro, ICR commands are run in quick succession. Sometimes, in such a scenario, the active SRP module resets if the event that causes the change of state of the VRRP instance reaches the ICR application before the ICR partition has been created. [Defect ID 184095]

Work-around: To avoid this problem, add an additional delay of one second using the sleep command in the macro, before the ip vrrp vrid enable command that is written in the macro to enable VRRP instance.

For example, consider a macro that contains the following commands:

ip vrrp vrid enable

ip vrrp vrid icr-partition partitionId

Modify the macro, as follows, to add a delay of one second before the VRRP instance ID is enabled on the router and a delay of another second before the ICR partition that corresponds to the VRRP instance is created:

sleep 1

ip vrrp vrid enable

sleep 1

ip vrrp vrid icr-partition partitionId

IGMP

• IGMPv3 proxy is not supported. [Defect ID 46038]
• The E Series router IGMPv3 proxy does not operate correctly in the presence of IGMPv2 queriers. [Defect ID 46039/46045]

Work-around: If an IGMPv2 router is present on the network, do not configure version 3 with the ip igmp-proxy version command on that network interface. (Version 2 is the default.)

• The default value for the IGMPv3 proxy unsolicited report interval timer should be 1 second rather than 10 seconds (the value for v2). [Defect ID 46040]
• When more than about 100,000 mapped OIF entries are configured on a virtual router, issuing the no virtual router command for this and other virtual routers does not delete all the virtual routers within the deletion timeout interval (3 minutes). The virtual routers do eventually delete after this timeout. [Defect ID 63882]
• The E Series router does not log a warning when it receives an IGMPv2 query but is not configured to use IGMPv2 on the interface. [Defect ID 46046]

IP

• The ES2 4G LM can reset during a unified ISSU after you issue the issu start command on a router configured with 8000 dynamic VCs and 8000 packet-triggered dynamic subscriber interfaces. [Defect ID 86761]
• If you have a large configuration on a hybrid module combination (OC3/STM-1 GE/FE line module with the OC3-2 GE APS I/O module), boot from NVS, and issue the slot erase command before booting has completed, the line module resets. [Defect ID 64104]

Work-around: To recover from the error, issue the slot reload command anytime after the module begins to reset.

• Deleting a VRF with 32,000 static subscriber interfaces fails to complete. [Defect ID 82670]

Work-around: Use a macro to delete all static subscriber interfaces before you delete a VRF.

• IP interface statistics become inconsistent when a slot is reset, because some traffic (such as control traffic) might be destined for the SRP module and is therefore counted elsewhere. [Defect ID 26697]
• The ip route permanent command does not work properly. [Defect ID 34303]

Work-around: Issue the ip alwaysup command to prevent the route from being removed from the IP routing table after the interface is shut down.

• Traffic statistics for dynamic subscriber interfaces associated with Mobile IP subscribers are not maintained as the subscribers move between Mobile IP nodes. Consequently the reported interface statistics are only the values accumulated since the last time a mobile node moved. [Defect ID 174509]
• When a router configured with PIM on a virtual router undergoes multiple warm restarts, the router subsequently hangs when an IP profile is configured. [Defect ID 176470]
• Logical port 20 on the ES2-S3 GE-20 IOA is reserved for the hardware multicast packet replication feature. Logical port 20 and the hardware multicast replication feature are not supported on the ES2-S3 GE-20 IOA in this release. [Defect ID 84727]
• When you change the demultiplexer type on a primary interface that has 1024 demultiplexer table entries, the ICC ping threshold times out due to the removal of the old entries and the addition of the new ones. [Defect ID 182218]
• After an SRP stateful switchover completes on an ERX1410 router configured with a single VPN routing and forwarding instance (VRF) and Network Address Translation (NAT), the SRP module that becomes active after the switchover resets. [Defect ID 180058]
• After you remove a virtual router configured with an SRC client, which is enabled to support policies on IPv6 interfaces, the primary SRP module on an E320 router resets. Also, if you perform a warm restart of an ERX1440 router that contains a virtual router, which is configured to support policies on L2TP interfaces, the primary SRP module resets. [Defect 184120]
• Although the IP access-internal route is deleted from the routing table after you issue the shutdown command on a major PPP interface, or after you issue the logout subscribers all command and the subscribers try to log in again, logging in of PPP subscribers fails. This problem occurs because the AAA server that authenticates subscribers responds with a message that access is denied owing to detection of duplicate addresses. Also, the access denied: duplicate address detected message is recorded in the aaaUserAccess event log category that you can view from the output of the show log command. [Defect ID 185109]

IPSec

• When the LAC-to-LNS data path runs over an MPLS tunnel and the MPLS tunnel originates or terminates at the LAC on an ES2 10G LM or an ES2 10G Uplink LM, the L2TP data traffic that originated or terminated at the LAC is discarded. [Defect ID 87260]
• In a network where you use the tunnel signalling command to specify that the security parameters and keys are configured manually for IPSec tunnels between VRs, the line modules reset when you delete and then re-create the IPSec tunnels. If you attempt to configure the tunnels again after the modules come back up, the line modules reset again.

Work-around: Configure the IPSec tunnels to use ISASKMP/IKE to negotiate SA and establish keys. [Defect ID 178304]

• IPSec tunnels created over Fast Ethernet interfaces fail to come up. [Defect ID 179256]

Work-around: After you create the tunnel, bounce the tunnel interface by issuing the shutdown/no shutdown command sequence. The tunnel comes up successfully.

IS-IS

• On a router configured with IS-IS and BFD, using the redundancy force srp command to force an SRP switchover sometimes brings down IS-IS and BFD. [Defect ID 179287]
• IS-IS graceful restart (nonstop forwarding) does not work on the broadcast interface when the restarting router is the designated intermediate system (DIS). Graceful restart works properly when the restarting router is not the DIS. [Defect ID 61496]

L2TP

• After a unified ISSU completes on a router functioning as an L2TP access concentrator (LAC), traffic outages occur on the L2TP network server (LNS)-facing interface at the LAC in a configuration with 16,000 or 32,000 L2TP sessions over 500 tunnels. [Defect ID 180147]

MLD

• MLDv2 proxy is not supported. [Defect ID 46038]
• The E Series router MLDv2 proxy does not operate correctly in the presence of MLDv1 queriers. [Defect ID 46039/46045]

Work-around: If an MLDv1 router is present on the network, configure version 1 with the ipv6 mld-proxy version command on that network interface. (Version 2 is the default.)

• The default value for the MLDv2 proxy unsolicited report interval timer should be 1 second rather than 10 seconds (the value for v1). [Defect ID 46040]
• The E Series router does not log a warning when it receives an MLDv1 query but is not configured to use MLDv1 on the interface. [Defect ID 46046]

MLPPP

• Failure to meet all of the following conditions for fragmented packets can result in an incorrect operation during packet classification of the resulting reassembled packet: [Defect ID 50111]

• The initial fragment of a packet must either contain the entire MLPPP packet or be greater than 128 bytes.
• The fragment size of the peer must not be lower than 128 bytes.
• The initial fragment of a packet must be larger than subsequent fragments of that packet.

Mobile IP

• The clear ip mobile binding nai @realm command does not work. [Defect ID 178652]

Work-around: Use the following version of the command instead:

clear ip mobile binding nai user@realm

• The @realm variable and the @ keyword alone do not work for the show ip mobile binding command. [Defect ID 178653]

Work-around: You can use the user@realm syntax instead to display the binding for a specific user, as in this example:

host1#show ip mobile binding nai xyz@example.com

Alternatively, you can display the entire Mobile IP binding table by issuing the show ip mobile binding command without additional options.

• The setup rate for Mobile IP client sessions decreases when you repeatedly bring a large number of sessions down and back up. [Defect ID 178760]
• When mobility bindings are present and you delete the Mobile IP home agent with the no virtual router command, Mobile IP sends a RADIUS Acct-Stop message with no accounting statistics for the subscribers. [Defect ID 179081]

Work-around: Issue the clear ip mobile binding all command before you issue the no virtual router command. The clear command clears all the MIP subscribers and sends a RADIUS Acct-Stop message with the appropriate accounting statistics for the subscribers.

MPLS

• When MPLS and IS-IS are configured on Ethernet interfaces, you cannot delete the interface after the IP address is removed. This issue is not a problem on Ethernet VLAN interfaces. [Defect ID 66813]

Work-around: Issue the no mpls command to disable MPLS, then delete the interface.

• You cannot use an underscore character (_) in an MPLS tunnel name. [Defect ID 31291]
• If LSPs are announced into IS-IS, then the IS-IS routes cannot be used for multicast RPF checks, because LSPs are unidirectional. [Defect ID 28526]

Work-around: Configure static RPF routes with native hops when LSPs are autoroute announced to IGPs.

• When the IPv4 explicit null label appears anywhere other than at the bottom of the label stack, TTL expiration for this label is not handled correctly. As a result, the traceroute command does not work correctly for LSPs that have the IPv4 explicit null label anywhere other than at the bottom of the label stack. [Defect ID 76037]
• When you upgrade the router to JUNOSe Release 7.1.0 or a higher-numbered release from a release numbered lower than Release 7.1.0, remote ATM layer 2 over MPLS circuits (also known as MPLS shim interfaces) that use Martini encapsulation are erroneously signaled with the control word attribute setting "Control word is not preferred by default". Because control words are required for these MPLS shim interfaces, these circuits should instead be signaled with the setting "Control word is preferred by default". [Defect ID 87048]

Work-around: To reinstate the proper setting ("Control word is preferred by default"), remove the MPLS shim interface from the ATM subinterface and then reconfigure it.

• When you issue a traceroute or trace mpls command to trace the paths of router packets over MPLS interfaces on an ES2 10G LM or ES2 10G Uplink LM, the results include an extra unknown host. [Defect ID 174537]

Multicast

• When you configure more than 10,219 outgoing interfaces (OIFs) on the same ES2 10G LM in a single multicast group, the configuration of the multicast group's OIF membership from the SRP module to the line module exceeds the size of a single message and is sent in fragments. Because of this fragmentation, the ES2 10G LM generates the following error message: [Defect ID 81768]

pc: 0x9e5c88: -> fatalPanic(void) offset: 0x8

Netflow

• Flow sampling stops after a cold switchover on a router that is configured with 16 VRs and 32 interfaces per VR, when all flows are passing through the configuration (32 flows per VR). [Defect ID 74477]

Work-around: After the cold switchover is completed, reissue the ip flow-sampling-mode packet-interval 10 command on each VR, even though the command is present in the configuration.

• The OC3/STM1 GE/FE line module might reset after sending Ethernet traffic into a VPLS network in a test environment when Ethernet packets are flooded to remote VPLS bridges. [Defect ID 74540]

Policy Management

• On the E320 router, redirecting a large configuration with thousands of interfaces to a script file can take a long time, perhaps exceeding a half-hour depending on the configuration. [Defect ID 80429]
• When you attach a policy to an interface and the policy contains a classifier rule that is unsupported for that interface, the CLI generates a message and the policy is applied. However, if an existing policy is already attached to that interface, then support for the new policy is not checked and the invalid policy is applied to the interface without warning. The results of this attachment are not predictable. [Defect ID 83562]
• If you have removed the last rule in a policy list, the router generates a warning only after you exit Policy List Configuration mode. If you have removed the last policy rule and then added a classifier group before you exit Policy List Configuration mode, the router does not generate a warning about removing the last rule. [Defect ID 83834]
• When an MD-Port-Number value greater than 65,535 is sent to an E120 or E320 router by means of a COA request, the value that is displayed in the UDP header of mirrored packets is the actual value minus 65,536. For example, an MD-Port-Number of 65,540 is displayed in the mirrored packet as 4. [Defect ID 84712]
• On the E120 and E320 routers, when a mirror rule is deleted after a CoA request is sent with Juniper-LI-Action set to No-Action, the existing mirroring session is not disabled. [Defect ID 84826]
• No logs are created if you use the policy-list option with the log severity severityValue policyMgrPacketLog policy-list policyListName command when logging policyMgrPacketLog events. [Defect ID 87203]
• When you reload the slot holding a GE-2 or GE-HDE line module and you have configured more than about 2000 policies with rate limiting on that module, the drop count becomes more than expected. This unexpected drop count does not occur when you create the same configuration after you reload the router to the factory-default configuration. [Defect ID 175696]
• On E320 line modules that support secure policies, the SRP module enables you to configure more than 1022 secure policies per module. [Defect ID 175756]

Work-around: To avoid potential performance issues, we recommend that you do not configure more than 1022 secure policies per module.

• Unified in-service software upgrade (unified ISSU) is not supported on an E120 or E320 router if a hierarchical policy is attached to an external parent group. [Defect ID 177478]
• When you modify a rate-limit profile in Global Configuration mode after the system is in a scaled state, changes to the rate-limit profile fail owing to lack of adequate policy resources. However, the changed value of the rate-limit profile is displayed in the output of the show rate-limit profile command. [Defect ID 79342]

Work-around: To avoid this problem, do not update the rate-limit profile in Global Configuration mode in a scaled environment.

• When you enter the no ip policy-parameter hierarchical parameterName command or no ipv6 policy-parameter hierarchical parameterName command for a hierarchical policy-parameter type in Interface Configuration mode, the explicit reference of the parameter is removed successfully from the interface. However, the Referenced by interfaces field in the output of the show policy-parameter command does not change from the previously configured value to implicit. [Defect ID 183957]

Work-around: To correct this problem, remove the entire interface configuration.

• When you enter the no ip policy-parameter hierarchical parameterName command or no ipv6 policy-parameter hierarchical parameterName command for a hierarchical policy-parameter type in Interface Configuration mode, the explicit reference of the parameter is removed successfully from the interface. However, the Referenced by interfaces field in the output of the show policy-parameter command does not change from the previously configured value to implicit. [Defect ID 183957]

Work-around: To correct this problem, remove the entire interface configuration.

PPPoE

• The E Series router erroneously accepts a PADI with a payload length of 0 instead of rejecting it and incrementing the PPPoE Invalid PAD packet length counter. [Defect ID 48356]

QoS

• You cannot paste a load-rebalance command string that uses the percent option into a console or Telnet session from show configuration output because the output displays the % sign rather than the percent keyword that was submitted with the command and the percent sign is not recognized by the CLI. [Defect ID 81705]
• The router cannot resolve inconsistent requests caused by two QoS profiles that modify the same scheduler property inconsistently. [Defect ID 61485]

Work-around: Avoid using two QoS profiles that modify the same scheduler property inconsistently, such as setting different values for the shaping rate for the same S-VLAN node.

• When you perform an SNMP walk of the juniQosQueueStatistics MIB, a timeout of up to 5 minutes ensues, during which the SRP module CPU utilization goes to 100 percent. [Defect ID 62252]
• The compound shared shaping feature does not work properly on egress forwarding ASIC 2 (EFA2)-based ATM line modules when the shared shaper is queue-controlled as opposed to node-controlled. In a node-controlled configuration, in which you configure the shared-shaping rate on the best-effort scheduler node for the logical interface, integration of the EFA2 and ATM segmentation and reassembly (SAR) schedulers functions properly. However, in a queue-controlled configuration, in which you configure the shared-shaping rate on the best-effort queue for the logical interface, integration of the EFA2 and ATM SAR schedulers does not function properly. [Defect ID 69167]

Work-around: Use node-controlled compound shared shaping configured on the best-effort scheduler node with EFA2-based ATM line modules.

• Egress strict-priority packets may experience high latency on OC3/STM1 ATM interfaces associated with the LM if you have shaped the port rate to more than 148.5 Mbps. [Defect ID 80378]

Work-around: To ensure low strict-priority latency, shape the port rate to no more than 148.5 Mbps.

• An error message regarding the qos-parameter instance QosParameterDefinition is erroneously generated on an ERX1440 router when it is configured for L2C and QoS RAM and receives TLV 144 (DSL Type). The parameter instantiation actually functions properly. [Defect ID 80620]
• The CLI erroneously enables you to configure a QoS profile with the ethernet node group command. [Defect ID 80861]
• The dynamic shaping rate calculated by the simple shared shaper can vary because of the variation in the enqueue rate of the constituent queues. Even when the offered load is constant, the mechanism that calculates the enqueue rate introduces a slight variation, introducing a slight variation in the calculated dynamic shaping rate. [Defect ID 80938]
• On a router that has both an ES2 10G LM and an ES2 4G LM installed, the byte count reported by the show fabric-queue egress-slot command is incorrect. The reported packet count is correct. [Defect ID 80965]
• On the E120 and E320 routers, you cannot attach QoS profiles to L2TP tunnels by means of the CLI because the CLI does not pass the router ID to QoS. [Defect ID 81516]
• PPP sessions may be dropped if you change the shaping rate in a QoS profile that affects thousands of circuits while QoS traffic affected by the profile is being forwarded. [Defect ID 82950]

Work-around: Do not change the shaping rate in a QoS profile that affects thousands of circuits while QoS traffic is using the profile.

• Egress traffic may be dropped on OC12/STM4 ATM interfaces if you have shaped the port rate to more than 542 Mbps. [Defect ID 83785]

Work-around: Do not exceed a shaped port rate of 542 Mbps.

• Incorrect output is sent to the CLI the first time you enter Global Configuration mode or issue the show subscribers command after viewing the VLAN subinterface over which a subscriber is connected. [Defect ID 84507]
• When QoS resources such as failure nodes and statistics bins are exhausted because of insufficient memory available on the line module, the failures are properly logged, but additional log messages are generated every 10 minutes that report zero failures. [Defect ID 85105]
• The no qos-parameter-define definition command does not delete the specified QoS parameter definition. [Defect ID 176844]

Work-around: Remove the interface and add the desired QoS parameters when you re-create the interface instead of deleting the definition.

• When 32,000 subscribers with 128,000 QoS queues are brought up on an ES2 10G or ES2 10G ADV LM, the LM resets if you modify the QoS profile that contains the best-effort IP or VLAN node rule, which references a scheduler profile configured with shared shaping rate, to a scheduler profile configured with legacy shaping rate. [Defect ID 183291]

Work-around: To avoid this problem, apply shared shaping on the best-effort queue, instead of on the best-effort node.

• Simple shared shaping does not function correctly when it is used for 32,000 subscribers on an ES2 10G ADV LM. However, when you change the shaper to compound shared shaping, it works properly. Also, simple shared shaping does not function correctly for 16,000 subscribers on an ES2 10G ADV LM. [Defect ID 183512]
• When you configure an E120 or E320 router with an ES2 10G ADV LM as a LAC on one side of an L2TP tunnel and as a LNS to receive packets from the LAC on the other side of the tunnel, use RADIUS servers for authentication of subscribers on both sides of the tunnel, and attempt to bring up 16,000 subscribers on the L2TP tunnel, the LM that has subscribers on the LAC side of the tunnel resets when approximately 8000 logged-in subscribers are logged out and try to reestablish the connection. [Defect ID 184118]

RSVP-TE

• After stateful SRP switchover, forwarding of VPN traffic might not resume if the core interface that carries an MPLS base tunnel with LDP over RSVP-TE flaps (constantly goes up and down). [Defect ID 182019]

Service Manager

• After you activate an independent IPv6 service and issue either of the following commands on the default virtual router or any other virtual router, except the one on which the subscriber session is active, no output is displayed in the CLI interface: [Defect ID 181929]

• show service-management subscriber-session subscriberName interface interfaceType interfaceSpecifier
• show service-management subscriber-session subscriberName interface interfaceType interfaceSpecifier service-session serviceName

This problem also occurs when a subscriber is authenticated using a RADIUS server for a combined IPv4 and IPv6 service in a dual stack.

Work-around: To avoid this problem, use the show service-management owner-session ownerName ownerId command to display subscriber session information based on the session owner, instead of the show service-management subscriber-session subscriberName interface interfaceType command to display details on subscriber sessions.

SNMP

• When you configure the router with an address pool that has two IP address ranges, only the range that you configured first is available via the MIB. [Defect ID 61232]

SONET

• You cannot use the highest sensitivity bit-error rate setting (a value of 9) associated with APS/MSP alarm when you issue the threshold sd-ber command to configure a cOCx/STMx line module with cOC12-APS-capable IOAs. [Defect ID 72861]

Work-around: Use only a value in the range 5-8 when you issue the threshold sd-ber command for this module combination, as in the following example:

host1(config)#controller sonet 2/1

host1(config-controll)#aps group boston

host1(config-controll)#aps protect

host1(config-controller)#threshold sd-ber 6

SRC Software and SDX Software

• The SRC client does not prevent you from changing the name of the router while the client is connected to the SAE, resulting in SAE issues such as lost IP addresses and stale users. [Defect ID 77102]

Work-around: To change the router name while the SRC client is connected to the SAE, shut down the SRC client, change the name, then re-enable the SRC client.

• When multiple IPv6 interfaces are configured with policies attached from SRC, only some of the IPv6 interfaces have the policies attached. [Defect ID 179498]
• Changing the SSCC status (enable/disable) while IPv6 interfaces are configured might cause the SRP to reset. [Defect ID 179537]

Stateful SRP Switchover (High Availability) and IP Tunnels

• When you issue show commands as soon as the CLI is available after a stateful SRP switchover, the commands can hang until the warm restart is completed. [Defect ID 85306]
• A packet loss sometimes occurs during stateful SRP switchover when you use the ping command on a router that is configured for OSPF graceful restart, and is connected to a helper router in the OSPF IPv6 broadcast network and another helper router in the OSPF IPv6 backbone area. [Defect ID 181470]

• ERX7xx model, ERX14xx model, or ERX310 router:

• When you use the ping command with the IPv6 address of the helper router in the multicast area as the destination address and the loopback address of the helper router in the backbone area as the source address, a packet loss of 2 seconds occurs for the first stateful SRP switchover. However, no packet loss occurs for successive stateful SRP switchovers.
• When you use the ping command with the IPv6 address of the helper router in the broadcast network as the destination address and no source address when stateful SRP switchover is performed the first time, an identical packet loss occurs. In this case too, no packet loss occurs during subsequent switchovers.

• E120 router or E320 router

• When you use the ping command with the IPv6 address of the helper router in the broadcast network as the destination address and the loopback address of the helper router in the backbone area as the source address, no packet loss occurs.
• When you use the ping command with the IPv6 address of the helper router in the multicast area as the destination address and no source address, a packet loss of 1-2 seconds sometimes occurs during stateful SRP switchovers.

Subscriber Management

• When a dynamic GRE tunnel interface for Mobile IP relocates between SM modules because the original SM reloads, Mobile IP deletes the relocated tunnel interface. [Defect ID 178399]
• When a subscriber has subscribed for a service, service session accounting records always contains a default Acct-Terminate-Cause value of 10. This value remains unchanged even after you use the terminate-code command to configure a custom mapping between application terminate reasons and RADIUS Acct-Terminate-Cause attributes. [Defect ID 181043]
• Dynamic subscriber interfaces continue to remain in the down or not present operational state in either of the following scenarios: [Defect ID 81269]

• If you configured a dynamic interface column, such as a dynamic bridged Ethernet interface, dynamic VLAN interface, or an ATM interface, and when any one of the following conditions is satisfied:

• The major interface is bounced (shut down and reenabled)
• The major interface is shut down, which cause the dynamic VLAN interfaces to be removed
• The physical link goes down and comes back up
• The line module is removed and reinserted

• If you configured a static interface column and removed the major interface

These scenarios might occur if you administratively issue the shutdown and no shutdown commands on the major interface in which the dynamic interface column is configured.

Work-around: Use the no interface ip ipAddress command to remove the dynamic subscriber interfaces. Although you can use the dhcp delete-binding command to remove the DHCP binding and the dynamic subscriber interfaces, the DHCP client does not detect the binding removal and retains the lease.

System

• You cannot use a configuration script to boot the E320 router. [Defect ID 80304]
• If you hot swap an IOA and then remove it again before that IOA's OK or FAIL LED is illuminated, the associated line module can reset. [Defect ID 177313/177267]

Work-around: Ensure that you firmly insert the IOA into the chassis when you hot swap IOAs. Do not attempt a second hot swap of an IOA that has not indicated that it completed the first hot swap cycle. You can remove the IOA when either its OK or FAIL LED is illuminated.

• If your router is in Manual Commit mode, then you must issue the write memory command before you perform an SRP module switch or a manual reload. You must do this even when you have made no changes to the system configuration and the file systems are synchronized. [Defect ID 44469]

System Logging

• The show configuration category management syslog virtual-router default command incorrectly displays logs for multiple syslog destinations when you add a log to only one syslog destination. The show log configuration command shows the correct configuration. [Defect ID 84082]

TCP

• The SRP module resets in any of the following circumstances on an E320 router that has a line module configured with 5000 ANCP adjacencies: [Defect ID 176916]

• When you issue the issu initialization command from the console and then reload the line module from a Telnet session.
• When the client that has the 5000 ANCP clients resets or an intermediate switch resets.
• When you reload the line module.

Unified ISSU

• ATM line modules might reset after a unified ISSU when you attempt to add memory to a VLAN subinterface in a large bridged Ethernet configuration. [Defect ID 178798]
• Under certain conditions, a unified ISSU from JUNOSe Release 9.2.0p1-0 to the current release fails, and causes the SRP module and the ES2 4G LM to reset. [Defect ID 179975]
• When any of the subsystems is excluded for a JUNOSe release, a unified ISSU to that release fails to apply conversion code to all of the line modules. As a result, the line modules reset when they come up with that release. [Defect ID 179595]

Work-around: To prevent the exclusion of a subsystem file from the release, do the following before you upgrade to a new JUNOSe release that supports unified ISSU:

1. Issue the show subsystems file fileName.rel command, where fileName is the name of the software release file, to determine whether any of the subsystem files are excluded from the release.
2. For each subsystem file that is excluded, issue the no exclude-subsystem subsystemName command to remove the exclusion for the specified subsystem file.

If you copied the software release to the router before removing the subsystem file from the exclusion list, you must copy the release to the router again to ensure that all subsystem files are included in the release.

• Unified ISSU is not supported with 8000 bridged Ethernet interfaces on an OC3/STM1 GE/FE ATM line module. [Defect ID 178811/178797/
  179547]