QFX example doesn't work on 5100s

[grizz]

QFX example doesn't work on 5100s

[job]

POS

[nickhilliard]

juniper are notorious for changing what's acceptable in firewall rules between different models and different code trains.

[job]

What do you mean it doesn't work on 5100s?

[email protected]> show chassis hardware | match Chassis
Chassis                                VF3715360176      QFX5100-48S-6Q

[email protected]> show configuration | display set | match jobtest2
set interfaces xe-0/0/46 unit 0 family ethernet-switching filter input jobtest2
set firewall family ethernet-switching filter jobtest2 term cull-v4 from ip-version ipv4 port bgp
set firewall family ethernet-switching filter jobtest2 term cull-v4 from ip-version ipv4 ip-source-address 192.0.2.0/24
set firewall family ethernet-switching filter jobtest2 term cull-v4 from ip-version ipv4 ip-destination-address 192.0.2.0/24
set firewall family ethernet-switching filter jobtest2 term cull-v4 from ip-version ipv4 ip-protocol tcp
set firewall family ethernet-switching filter jobtest2 term cull-v4 then discard
set firewall family ethernet-switching filter jobtest2 term cull-v6 from ip-version ipv6 next-header tcp
set firewall family ethernet-switching filter jobtest2 term cull-v6 from ip-version ipv6 port bgp
set firewall family ethernet-switching filter jobtest2 term cull-v6 from ip-version ipv6 ip6-source-address 2001:db8:2::/64
set firewall family ethernet-switching filter jobtest2 term cull-v6 from ip-version ipv6 ip6-destination-address 2001:db8:2::/64
set firewall family ethernet-switching filter jobtest2 term cull-v6 then discard
set firewall family ethernet-switching filter jobtest2 term rest then accept

[grizz]

[email protected]# show firewall family ethernet-switching filter jobtest2    
term cull-v4 {
    from {
        ip-version {
            ipv4 {
                ##
                ## Warning: value port ignored: unsupported platform (qfx5100-48s-6q)
                ##
                port bgp;

[job]

Fixed e346d41

[nickhilliard]

no idea why this doesn't work on qfx5100. the t2+ chipset supports this just fine.

[job]

Given Junos' volatile approach to CLI and supported features I'm inclined to defer any Junos examples to the living document that is the https://github.com/bgp/bgp-session-culling-config-examples

[timoid]

came across this debugging some qfx copp issues.
qfx (at least) doesn't support port, but does support destination-port.
seems unhappy with ambiguous direction definitions (prefix-list vs source-prefix-list was another that tripped me up).