Open Issues

In certain conditions, a stale rewrite rule entry is left behind in the Packet Forwarding Engine and the corresponding kernel state is incorrect. The pre-conditions to note this phenomenon include a sequence of aggregated Ethernet specific operations along with the present of CoS configuration.PR1649510

The aggregated Ethernet interfaces in per-unit-scheduler mode and committing the CoS configuration on the aggregated Ethernet logical interfaces in a single commit leads to race-conditions.PR1656441

In Provider Backbone Bridging - Ethernet VPN (PBB-EVPN) environment, ARP suppression feature which is not supported by PBB might be enabled unexpectedly. Therefore, MAC addresses of remote CE devices are not learned resulting in traffic loss. PR1529940

EVPN-MPLS multihoming control MACs are missing after removing VLAN ID and adding back on a trunk logical interface of one of the multihoming PE devices. This is not a recommended way to modify VLAN ID configuration. Always both multihoming PE devices need to be in symmetric. PR1596698

EVPN local ESI MAC limit configuration is not effective when the remote multihoming MACs learn the MAC limit. As a workaround, clear the MAC table from all multihoming PE devices and configure the MAC limit over the local ESI interfaces. PR1619299

The configuration statement fast-lookup-filter with match condition is not supported in FLT hardware might cause a traffic drop. PR1573350

If a vmhost snapshot is taken on an alternate disk and there is no further vmhost software image upgrade, the current vmhost image might corrupt and the system reboots with the alternate disk. The user can recover the primary disk to restore the state. However, the host root file system and the node boots with the previous vmhost software instead of the alternate disk. PR1281554

When VLAN is added as an action for changing the VLAN in both ingress and egress filters, the filter is not installed. PR1362609

On MX Series routers with MPC7E, MPC8E, or MPC9E installed, if optics QSFPP-4X10GE-LR (part number 740-054050) is used, the link might flap. PR1436275

When you boot MPC11 linecard, the following harmless errors are seen. These errors have no functional impact. timestamp device kernel: i2c i2c-100: (11/1:0x41) i2c transaction error (0x00000002) timestamp device kernel: i2c i2c-64: (7/1:0x41) i2c transaction error (0x00000002. PR1457655

The following error might be seen on the MX Series routers with XQ chip (for example, MPC5E, MPC2E-3D-NG-Q, MPC3E-3D-NG-Q, and more.) or EA chip (for example, JNP10003-LC2103, MPC7E, and more). fpcx Cmerror Op Set: XQCHIP(46): XQ-chip[0]: SCHED L4NP[0] Parity errors (status=0x20000). PR1464297

When hardware link errors occur on all 32 links on an FPC 11, all FPCs reports destination errors towards FPC 11. The FPC 11 is taken offline with "offlined due to unreachable destinations" reason. PR1483529

When you run the show pfe filter hw filter-name filter name command, the command fails to retrieve the Packet Forwarding Engine programming details of the filter. PR1495712

When backup Routing Engine stops, CB1 goes offlbn; and comes back online. This restarts the backup Routing Engine, and it shows the reboot reason as "0x1:power cycle/failure".

PR1497592

In the platform using indirect next hop (INH), such as Unilist as route next hop type for multiple paths scenario (such as BGP PIC or ECMP), the session fast-reroute might be enabled in the Packet Forwarding Engine. When the version-id of session-id of INH is above 256, the Packet Forwarding Engine might not respond to session update because the session-id might stuck permanently with the weight of 65535 in the Packet Forwarding Engine. It might lead the Packet Forwarding Engine to have a different view of unilist against load-balance selectors. Then either the BGP PIC or the ECMP-FRR might not work properly and traffic might be dropped or silently discarded. PR1501817

The JFlow service might not report accurate throughput rate. This issue is seen when there is high sampled traffic rate with low flow cache hit ratio.PR1502645

A delay of 35 seconds is added to the reboot time in Junos OS Release 20.2R1 compared to Junos OS Release 21.4R2. PR1514364

In MAC-OS platforms when a client connects successfully, the client will not be minimized to tray icon and it stays connected and needs to manually minimize it. PR1525889

Due to BRCM KBP issue route lookup might fail. As a workaround, you can upgrade KBP. PR1533513

The Flexible PIC Concentrator (FPC) might generate a core file if the flap-trap-monitor feature under set protocols oam ethernet cfm performance-monitoring sla-iterator-profiles is used resulting in performance monitoring flap.PR1536417

On a scaled MX2020 router with vrf localisation enabled, 4 million next hop scale, and 800K route scale, FPCs might go offline on GRES. Post GRES, router continues to report many fabric related CM_ALARMs. FPC might continue to reboot and might not come online. Rebooting master and backup Routing Engine will help recover and get the router back into a stable state. PR1539305

The FPC process might not get spawned after hard reboot in a rare case, which causes the FPC to not come online successfully. PR1540107

On MX480 router, the following error message appears: Feb 27 20:26:40 xolo fpc3 Cannot scan phys_mem_size.out. Please collect /var/log/*.out (0;0xdd3f6ea0;-1) (posix_interface_get_ram_size_info): Unknown error: -1. PR1548677

Running help apropos command in configuration mode will generate an MGD core file. PR1552191

The script compiles an unsupported configuration that hits the maximum threshold for the given platform. PR1555159

5M DAC connected between QFX10002-60C and MX2010 do not link up. But with 1M and 3M DAC, this interoperability works as expected. On QFX10002-60C and ACX or traffic generator the same 5M DAC works seamlessly. PR1555955

VE and CE mesh groups are default mesh groups created for a given routing instance. On VLAN or bridge-domain add, flood tokens and routes are created for both VE and CE mesh-group or flood-group. Ideally, VE mesh-group does not require on a CE router where IGMP is enabled on CE interfaces. MX Series based CE boxes have unlimited capacity of tokens. PR1560588

Due to a race condition, the show multicast route extensive instance instance-name output displays the session status as Invalid. Such an output is a cosmetic defect and not indicative of a functional issue. PR1562387

Configure an interface hold time to avoid the additional interface flap. PR1562857

Stale TCNH entries are seen in new primary Routing Engine after switchover with NSR even though all the prpd routes are deleted. These TCNH entries are present because NSR is not supported for BGP static programmable routes. This leads to an extra reference count in the backup Routing Engine, because next hop is not free. PR1566666

On MX Series platforms, when inline Jflow is configured at high sampling rate (more than 4000 per second) is set, high CPU utilization might be observed and this might result in relevant impacts on traffic analysis and billing. PR1569229

In MX Series devices, the device might not send pause frames in case of congestion. PR1570217

When aggregated Ethernet link is brought down, a transient error message, [Error] Nexthop: EalNhHandler: failed to add Nh: xxxx, type: composite, as pil add failed might be seen. There is no functional impact due to these errors. PR1570710

A vulnerability in handling exceptional conditions in Juniper Networks, Junos OS Evolved (EVO) allows an attacker to send specially crafted packets to the device, causing the advanced forwarding toolkit manager (evo-aftmand-bt or evo-aftmand-zx) process to crash and restart, impacting all traffic going through the FPC, resulting in a Denial of Service (DoS). PR1572969

The following messages might be seen in the logs from MPC11E line-card: Feb 9 11:35:27.357 router-re0-fpc8 aftd-trio[18040]: [Warn] AM : IPC handling - No handler found for type:27 subtype:9. There is no functional impact and these logs can be ignored. PR1573972

In EVPN-VXLAN scenario with OSPF configured over the IRB, OSPF sessions might not get established because of the connectivity issues. PR1577183

Path validation fails for network-instances protocols. PR1579439

When you configure /8 pool with block size as 1 and commit, the block creation utilizes more memory causing NAT pool memory shortage which is currently being notified to customer with syslog tagged RT_NAT_POOL_MEMORY_SHORTAGE. PR1579627

In a fully loaded device, the firewall programming fails at times due to scaled prefix configuration with more than 64,800 entries. However, this issue is not observed in development setup. PR1581767

Under the conditions of the bridge domains in the virtual-switch type instance having "vlan-id-list", Bridge domain names information is not displayed properly in show bridge statistics instance. PR1584874

When the active secondary interface is deactivated, the PTP lock status is set to 'INITIALIZING' state in show ptp lock-status output for few seconds before BMCA chooses the next secondary interface. This is the day-1 behavior and there is no functional impact. PR1585529

In rare circumstances during GRES, the routing protocol daemon will restart generating a core file in the former active Routing Engine (new backup Routing Engine). PR1589432

Inline NPT on MX Series routers does not translate the source IPv6 of packet with authentication header present. The packet is simply passed through upstream. Consequently, it is not expected that downstream traffic arrives with NPT pool IPv6 address as IPv6 destination address and with Authentication header. Such traffic might be malicious and this must be handled via external configuration. The fix suggested is to configure firewall for downstream direction that blocks traffic destined to NPT pool address and with authentication header. PR1592957

Pim VxLAN does not work on TD3 chipsets enabling VxLAN flexflow after Junos OS Release 21.3R1. PR1597276

On all MX Series routers, changing configuration AMS 1:1 warm-standby to load-balance or deterministic NAT might result in generating vmcore file and cause traffic loss. PR1597386

On the MX10016 platform, PICs might not come online for all FPCs in case "spmb" process restarts immediately after the power cycle. PR1597630

On MX Series routers, compact forwarding engine board (afeb) process might crash with MIC-3D-8DS3-E3. If a MIC-3D-8DS3-E3 having any hardware fault is initialized into the device. The AFEB crash will restore automatically in sometime and faulty hardware need to be replaced. The AFEB crash might impact the traffic forwarding during the time of issue. PR1598411

Release note needed PR1600502

It seems that ubuntu root-fs 18.04 shipped in the latest release does not have the "en_US.UTF-8" locale enabled by default. PR1601262

When the interface transitions from down to up, the carrier transition counter value of a particular interface can be incorrect when the peer interface takes longer time to come up. PR1601946

The convergence time degradation is seen in IS-ISv6, OSPFv2, and OSPFv3 when comparing convergence time with Junos OS Release 21.1R1.5. As it is a convergence time issue, many components are involved and hence need investigation of rpd, kernel, and Packet Forwarding Engine. PR1602334

In vMX platform, after a system reboot, the protect-Routing Engine filter on lo0 interface is no longer applied. PR1604401

Rebooting JDM from inside JDM shell changes JDM's main PID as a result systemd's knowledge of JDM PID becomes stale. Due to this reason systemd fails to stop or start JDM. PR1605060

An RPD agent sends an INH deletion or additions out of order to backup RPD, RPD generates a core file. PR1607553

IS-IS adjacency remain down in backup Routing Engine during MOFRR convergence test.PR1608591

When high pps traffic sent for a 'establish tunnels on-tarffic' IPsec VPN with S2S configuration, IKED process will be inundated with IKE trigger and IKE negotiation messages from peer. This causes a delay in handling messages at IKED process and timeouts for IKE negotiations, and eventually results in tunnels not getting established. This issue might occur when the tunnels are negotiated for the first time or when one of the VMS in the AMS bundle goes down. PR1610863

Several warning messages show up while the RPD process restarts during performing GRES on a system running Junos EVO. PR1612487

Changing aggregated Ethernet mode (aggregated-ether-options link-protection) with subscribers logged in on that aggregated Ethernet will cause undesirable subscriber management behavior. Users will need to confirm there are no subscribers on the aggregated Ethernet before changing the aggregated Ethernet protection mode. PR1614117

In some NAPT44 and NAT64 scenarios, duplicate SESSION_CLOSE syslog will be seen. PR1614358

Mastership switch is not supported during FRU reconnect during master release" is observed.PR1615344

MPC gets rebooted while enabling FLT for inet6 filter with 10000 terms, instead of fallback to DMEM filter gracefully. Currently, fast lookup filter supports up to 8000 terms. PR1617174

Fabric errors could be expected when SLC is restarted when ISSU is in progress, to avoid this problem "do not restart SLC when ISSU is in progress". PR1619180

USF-SFW:Memory Zone is not reflecting properly while doing memory tests via Vty command test usp service-sets memory-testing start" . PR1619499

Destination errors will be seen when unified ISSU is done on GNF without enhanced-mode. This is seen with and without SLC configuration. PR1620705

System_id formate of AFT-MPC(MPC10E) is not aligned with non-AFT MPCs. PR1622073

Fabric goes to check state the configurations when the SLC / GNF ISSU is in progress. PR1622511

When installing an IPv6 firewall filter using BGP flowspec, matching traffic counters might show "0" values. PR1623170

Cannot login to dhcp or pppoe client on double-tagged dynamic vlans. PR1623785

in scaled setup with ldp over rsvp configuration and maximum-ecmp as 32 or 64, line card CPU usage can remain high for extended duration on link flap operation. In this duration, LACP can take more than 5 minutes to move from detached to CD state. PR1624219

flowd core file is observed with TLB configuration only with combination of MPC10 card with older MPC card. PR1624572

Pkid crashes due to null pointer dereferencing during local certificate verification in some cases. PR1624844

DHCP v6 server binding will not happen, when mld-snooping is enabled along with DHCP v6 snooping. PR1627690

For a topology with VSTP and VRRP configured and IPv6 traffic, if VSTP bridge priority is changed a couple of times (to trigger toggling of root bridge), it is possible that IPv6 traffic drop is seen on some of the streams. PR1629345

On ACX5448, MX204 and MX2008 VM Host-based platforms, starting with Junos 21.4R1 or later, ssh and root login are required for copying line card image (chspmb.elf for MX2008) from Junos VM to Linux host during installation. The ssh and root login are required during installation. Use the deny-password instead of deny as default root-login option under ssh configuration to allow internal trusted communication. Alternatively, once installed, it can be disabled in the configurations. Refer to TSB18224. PR1629943

Zeroize RPC returns no positive reply. PR1630167

In scaled setup with high number of nexthops and routes, a configuration churn might lead to high CPU utilization and delayed convergence for Indus and Daniel MPC linecards. PR1631612

DSLite do not work on MX Series platform installed with MPC7E line card and SPC3 service PIC. PR1632278

It is noted that the single hop BFD session over aggregated Ethernet is not fully functional after exercising Packet Forwarding Engine reset feature. The BFD session was up before Packet Forwarding Engine reset operation is initiated but after the reset the BFD rx session is not fully functional. PR1632585

During ZPL ISSU of MPC10 or MPC11 line cards, if LACP and LFM configurations are present, PPMAN core might be seen. PR1633286

On MX Series routers with SPC3 service card installed, TFTP control sessions are getting refreshed with inactivity time-out after data session is closed, causing the control session to stay in session table for some more time. Service impact is minor or negligible as the TFTP control session will eventually get deleted after timeout. PR1633709

FRR loss of around 18- 20 seconds is seen during LAG bundle failure triggers with scaled configuration. PR1636785

WIth PTPoIPv6 on MPC2E 3D EQ, PTP secondary stays in acquiring state. PR1642890

Under some circumstances, alarmd will generate core file due to some discrepancy in Junos-synchronization component. PR1643743

Issue is specific to YT cards during mlp delete messages the logical interface ktree lookup is resulting in an incorrect dword for the IIF registry. Because of this counter address is incorrectly read resulting in ppe traps. Issue is not seen in ZT cards. PR1645483

With overlapping NAT pool configured with different NAT rules under different service sets, when service outside interface is moved between different routing instances (for example, from vr1 to default, and from default to vr1), NAT routes corresponding to the service-set in default routing instance are getting deleted, resulting in reverse path traffic failure for NAT sessions. PR1646822

Core file seen while testing "hcm_dpi_pcef_usf_3.robot". PR1648886

Traffic drop might be observed on MX960 platforms for some MAC entries which are learned on interchassis control link (ICL) instead of multichassis link aggregation (MC-AE). PR1653926

The low priority stream might be marked to destinate error. As a result, the low priority stream gets stuck and traffic drops. PR1657378

ICCP does not come up when mc-lag PE is rebooted since static ARP is deleted and never re-installed back. Therefore, it is not recommended to configure ICCP over IRB which is associated with mc-lag bridge 166 domain. Customer upgrading from old release to new release (PR 1075917 support) might come across issue like static ARP is not reinstalled for remote mc-lag IRB IP when existing static ARP entry is removed. PR1409508

When family bridge is configured, logical interfaces are not created. If logical interfaces are not created, l2ald does not create IFBDs (interface to BD association) and if we do not have IFBDs in the system, STP is not enabled on that interface. PR1622024

On all Junos OS platforms, the addition or removal of VRRP group might flap the other VRRP group under the same physical interface. The bug causes the already existing configuration of all VRRP groups under the same physical interfaces (along with the ones where no configuration change is being committed) to be treated as a new configuration and eventually deletes it before adding it back. Therefore, all VRRP sessions flaps and virtual-router uptime is reset. PR1658966

Abrupt termination of the client socket may take time for the disconnect to be detected by JSD. The client would have to wait for the connection terminal to be detected in such cases, which could be around 1 hour or restart JSD before being able to connect back with the same client ID. PR1549044

The stub creation functions are present in *pb2_grpc.py. PR1580789

GRPC on WAN port is not working. The libsi can only be linked with 64-bit binaries. To access data or WAN ports, you need to link libsi with the binary. By default, the shell on the device includes libsi, but it is not available to the CLI commands as the CLI will make mgd invoke cscript to run a Python script through CLI. PR1603437

On MX5, MX10, MX40, MX80, and MX104 Series platforms with DHCP server configuration for DHCP subscribers, the jdhcpd memory leak might occur and the memory increase by 15MB depends on the number of subscribers when testing the DHCP subscribers log-in or log-out. PR1432162

Making configuration changes with apply-group add/delete associated with DHCP might result in the client connection failure. PR1550628

In case of the access-side interfaces used as SP-style interfaces, when a new logical interface is added and if there is already a logical interface on the physical interface, there is 20--50 ms traffic drop on the existing logical interface. PR1367488

BFD session flap during unified ISSU only in MPC7E card (BFD sessions from other cards of DUT to peer routers did not flap during unified ISSU). Issue is not seen frequently. PR1453705

In MVPN case, if the nexthop index of a group is not same between primary and backup after a nsr switchover, you might see a packet loss of 250 to 400 ms. PR1561287

The use-for-shortcut configuration statement is meant to be used only in SRTE tunnels which use SSPF (Strict SPF Algo 1) Prefix SIDs. If set protocols isis traffic-engineering family inet-mpls shortcuts and set protocols isis traffic-engineering tunnel-source-protocol spring-te is configured on a device, and if any SRTE tunnel using Algo 0 Prefix SIDs is configured with use-for-shortcut configuration statement. This might lead to generate routing loops or rpd core files. PR1578994

LDP session authentication key-chain configuration based on session remote-id on initiator stops from session establishment even though the responder's authentication key-chain is configured for its remote-id. PR1592431

On the MX10016 routers, when there is scaled RSVP sessions (for example, 21,000) and the RSVP is enabled for all the interfaces, then the rpd process goes through all the interfaces which results into a high CPU utilization for some time. This also results in LSP flap. PR1595853

RPD crashes continuously in backup Routing Engine with below configuration set routing-options static route destination-prefix p2mp-ldp-next-hop root-address p2mp-root-address lsp-id lsp-id set routing-options warm-standby. PR1645457

PPPOE_V4 traffic stream is not within threshold ( +/-10% ) range of 100mbps. Issue is seen after GRES and it can impact in traffic loss or PPPoE subscriber bringup failure. PR1649763

On all Junos OS platforms, if [edit routing-option resolution preserve-nexthop] hierarchy is configured globally, Routing-engine (RE) kernel crash might be observed in the one-hop-LSP MPLS scenario with Routing Engine outbound traffic.PR1654798

Junos has a feature to block or deny all hidden commands. Users can get this feature by configuring set system no-hidden-commands. However, when this is configured and committed Junos OS blocks or denies new netconf or junoscript XML sessions. As a workaround, users can delete system no-hidden-commands configuration statement and start the new netconf or junoscript sessions. PR1590350

A minor memory leak is seen in the event-daemon process when multiple GRES switchovers are performed. PR1602536

mgd can crash when an invalid value is configured for identityref type leafs/leaf-lists while configuring Openconfig or any other third-party YANG, problem occurs with json and xml loads. PR1615773

The traps are the result of PPE commands injected from the host. One possible reason might be Layer 2 BD code, which is trying to decrement BD MAC count in the data plane. It is unlikely that there is a packet loss during this condition. This could happen during unified ISSU and this might be due to a problem with the unified ISSU counter morphing used for LU-based cards, where certain counters are not disabled or disabled too late during the unified ISSU. PR1426438

With GRES and NSR functionality with VXLAN feature, the convergence time might be slightly higher than expected for L2-DOMAIN-TO-L3VXLAN. PR1520626

When the DHCP relay mode is configured as no-snoop, the offer gets dropped due to incorrect ASIC programming. This issue only affects while running DHCP relay on EVPN/VXLAN environment. PR1530160

During Routing Engine switchover, interface flap might be seen along with scheduler slippage. PR1541772

When a EX4400 Virtual Chassis is scaled with different features configurations and device is stressed with traffic, device might not respond for CLI commands for a short period of time and a vmcore might be reported at that time. Once VM core is saved, device will continue to operate normally. PR1599498

Do notuse the control-type light under platforms where this feature is not supported at present. At present IPv4 and IPv6 twamp-light is supported on the platforms using TRIO and PE chipsets. PR1603128

Traffic loss of is observed with vrrp mastership change from backup to master. This is seen while we bring up the route back after enabling the link. PR1612504

On MX Series platforms, during reboot, the aggregated Ethernet logical interfaces are first added, then deleted and again added. This flapping causes corner case where the filter attachment IPC has older aggregated Ethernet logical interface index on which the filter bind fails. Filter will not be attached to the interface, so any filter related service will not work. PR1614480

Using static labeled switched path (LSP) configuration, the child node is not removed from the flood composite when the core interface goes down.PR1631217

MACs are not getting learned initially on a specific bridge domain. However, the MACs are learned in that specific BD after some duration. This delay in MAC learning will be fixed in the upcoming releases. PR1632411

The CLI configuration can be used to bump the ARP packets priority to use NC3 in case customers have continuous congestion of best-effot queue. set system arp arp-request-bump-priority. PR1644973

When multihop multipath EBGP is configured over IPsec tunnels established using SPC3, vmcore files are seen. PR1646428

In MX Series platforms, if a small size packet (for example 64 byte) is transmitted out of the queue, the Packet Forwarding Engine gets disabled.PR1657203

TILFA backup path fails to install in LAN scenario and also breaks SR-MPLS tilfa for LAN with more than four end-x sids configured per interface. PR1512174

Multicast traffic is hogging the switch core when igmp-snooping is removed. The MCSNOOPD will generate a core file due to the changes in mrouter interfaces and routes. PR1569436

When MPLS traffic engineering and rib inet.3 protect core file is enabled then transport routes in inet.3 will not be used for route resolution. PR1605247

On MX Series routers, initial multicast register packets might get dropped. This might affect the multicast services. PR1621358

When filter is configured through an open config and bound to a Routing table instance, the filter bind object is not getting published due to the absence of Routing table object. Hence, the filter does not work as expected since the traffic does not hit the filter. PR1644421

In all Junos OS platforms, when the BGP neighbor is brought down because of the prefix count received exceeds the prefix-limit configured. If BGP is disabled and then enabled, the BGP session might be brought up and then the rpd process crash might be observed.PR1655228

On all Junos platforms, the rpd core file might be observed when the next hop for multicast upstream is not available. PR1658458

File delete with regex might fail, if using filename without regex works. PR1624562

Tunnel debugging configuration is not synchronized to the backup node. It needs to be configured again after RG0 failover. PR1450393

On all Junos OS platforms with MVPN scenario, stale PIM (S, G) state might be seen when there are no local/remote receivers and the multicast source is inactive. Only stale PIM entry will be seen, and it does nt impact MVPN service or functionalities. PR1536903

In certain cases, the PUSH ACK message from the group member to the group key server might be lost. The group member can still send rekey requests for the TEK SAs before the hard lifetime expiry. Only if the key server sends any new PUSH messages to the grooup members, those updates might not be received by the group member since the key server would have removed the member from registered members list. PR1608290