I recently brought up dual-stack IPv6 connectivity on my network, and I've
been in the process of tweaking my ingress/egress firewall filters to
strike a reasonable balance between functionality and security, and I've
run into the following issue:
Periodically, processing of packets through the firewall filters, or at
least the ingress filter, seems to stall. I've verified this by
attempting to browse to websites and run MTR sessions to hosts that I know
to be IPv6-reachable. I've found that if I deactivate my IPv6 input
(ingress) filter on one of my upstream interfaces, commit, reactivate it,
and then commit again, that the filter resumes normal operation. I can
browse to the sites I couldn't reach, and MTR traces now reach the
destination network, rather than dying at my border routers.
I have a case open with JTAC on this, but I wanted to check if anyone here
has run into any similar behavior. I looked for possibly relevant pug
reports, but I've found Juniper's bug search tool to be a little dodgy on
occasion.
This is on a pair of M120s running Junos 10.4R9.2. I am aware of the some
of the shortcomings of Junos IPv6 firewall filters on this platform, such
as the possibility of IPv6 packets with appropriately crafted extension
headers being able to bypass the filters if there is a catch-all 'accept'
at the bottom, but I haven't heard of anything that would cause packet
processing to stall periodically.
Nothing interesting shows up in the message log, and no IPv6 traffic shows
up as being dropped in the output of "show firewall log". The filter
terms that drop specific traffic are set up to log any matches against
those terms.
jms
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
