Junos OS

Hi all,

Already half of the year i try to solve this problem with "USP_IF_TOOLKIT: Duplicate attach for ifl_indexXX, flags 3, localaddr 0xXXXXXXXX local_plen 32"

Junos with version 18.4R3-S2

This error / log / notification directly affected to all connecton with untrust interface (ge0/0/0), connection dropped to 5-10 minutes

All IP address on all interfaces are different 

Maybe somebody had this problem before and solved it somehow

messages | grep 'Dup'

May 13 13:49:56 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122ab5a7 local_plen 32
May 13 13:50:02 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x116ceb73 local_plen 32
May 13 15:17:15 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0xc530ccf local_plen 32
May 13 15:17:20 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x1229fbc3 local_plen 32
May 13 16:06:45 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0xc530ccf local_plen 32
May 13 16:06:51 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122906ab local_plen 32
May 13 20:02:45 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122c3567 local_plen 32
May 13 20:02:50 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122768fb local_plen 32
May 13 20:24:56 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0xc530ccf local_plen 32
May 13 20:25:01 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122906ab local_plen 32
May 13 21:04:18 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index83, flags 3, localaddr 0x1229f5b7 local_plen 32
May 13 21:04:23 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index83, flags 3, localaddr 0x1155e2f3 local_plen 32

Please post all logs when the issue appears, this will help to evaluate the cause of these messages.

These messages USP_IF_TOOLKIT: Duplicate attach for ifl_indexXX, flags 3, localaddr 0xXXXXXXXX local_plen 32" are informational only that a duplicate address is assigned on an IFL.

Do you have VRRP configured around this interface? Any secondary IP on the same interface?

Also, check the upstream device(s) if the interface is flapping on that side. 

Check the KB here: 

https://kb.juniper.net/InfoCenter/index?page=content&id=KB35058&actp=RSS

Hi Malik

Thanks a lot for your reply!

Actually this is all log:

May 14 02:27:28 SRXFW sshd[4212]: Accepted keyboard-interactive/pam for root from 10.0.20.15 port 65440 ssh2
May 14 07:49:05 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x122784bf local_plen 32
May 14 07:49:12 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298633 local_plen 32
May 14 09:15:06 SRXFW sshd[19249]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 49954 ssh2
May 14 12:14:23 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x122c0b0f local_plen 32
May 14 12:14:28 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298633 local_plen 32
May 14 13:43:13 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298027 local_plen 32
May 14 13:43:18 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12279573 local_plen 32
May 14 15:17:42 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x11b3876f local_plen 32
May 14 15:18:28 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12268aeb local_plen 32
May 14 15:26:25 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298027 local_plen 32
May 14 15:26:30 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x11a90393 local_plen 32
May 14 22:24:00 SRXFW mib2d[1967]: SNMP_TRAP_LINK_DOWN: ifIndex 515, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/3
May 14 22:24:14 SRXFW jdhcpd: DH_SVC_SENDMSG_FAILURE: sendmsg() from 10.0.30.1 to port 68 at 10.0.30.11 via interface 76 and outgoing routing instance default failed: Network is down
May 14 22:24:15 SRXFW mib2d[1967]: SNMP_TRAP_LINK_UP: ifIndex 515, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-0/0/3
May 14 22:32:38 SRXFW sshd[48631]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 61721 ssh2
May 14 23:17:13 SRXFW mib2d[1967]: SNMP_TRAP_LINK_DOWN: ifIndex 515, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/3
May 14 23:26:31 SRXFW sshd[50652]: error: PAM: authentication error for root from 10.0.20.21
May 14 23:26:31 SRXFW sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '10.0.20.21'
May 14 23:26:40 SRXFW sshd[50652]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 49519 ssh2

No any VRRP config, i have just one SRX

This is very strange, because i reset settings and did config from scratch, but this error did not disappeared

You can find my Junos config here: https://github.com/Feratti/Junos-18.4R3-S2

Most probably the issue is with your provider's DHCP server. 

Could you please

1. Delete the ge-0/0/0 interface.

2. Reconfigure it as DHCP client.

3. Pull-out the cable from ge-0/0/0 interface and plug it back.

delete interfaces ge-0/0/0

set interfaces ge-0/0/0.0 family inet dhcp

Hi,

can you please share:

- show interfaces snmp-index <ifl_index#> terse

- features configured like NAT, DHCP, VRRP, ...

Thanks

Ulf

Hi Ulf

Thanks a lot for your reply!

Please find fresh logs, command output and config bellow

P.S. No any VRRP config

May 14 02:27:28 SRXFW sshd[4212]: Accepted keyboard-interactive/pam for root from 10.0.20.15 port 65440 ssh2
May 14 07:49:05 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x122784bf local_plen 32
May 14 07:49:12 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298633 local_plen 32
May 14 09:15:06 SRXFW sshd[19249]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 49954 ssh2
May 14 12:14:23 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x122c0b0f local_plen 32
May 14 12:14:28 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298633 local_plen 32
May 14 13:43:13 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298027 local_plen 32
May 14 13:43:18 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12279573 local_plen 32
May 14 15:17:42 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x11b3876f local_plen 32
May 14 15:18:28 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12268aeb local_plen 32
May 14 15:26:25 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12298027 local_plen 32
May 14 15:26:30 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x11a90393 local_plen 32
May 14 22:24:00 SRXFW mib2d[1967]: SNMP_TRAP_LINK_DOWN: ifIndex 515, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/3
May 14 22:24:14 SRXFW jdhcpd: DH_SVC_SENDMSG_FAILURE: sendmsg() from 10.0.30.1 to port 68 at 10.0.30.11 via interface 76 and outgoing routing instance default failed: Network is down
May 14 22:24:15 SRXFW mib2d[1967]: SNMP_TRAP_LINK_UP: ifIndex 515, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-0/0/3
May 14 22:32:38 SRXFW sshd[48631]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 61721 ssh2
May 14 23:17:13 SRXFW mib2d[1967]: SNMP_TRAP_LINK_DOWN: ifIndex 515, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-0/0/3
May 14 23:26:31 SRXFW sshd[50652]: error: PAM: authentication error for root from 10.0.20.21
May 14 23:26:31 SRXFW sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '10.0.20.21'
May 14 23:26:40 SRXFW sshd[50652]: Accepted keyboard-interactive/pam for root from 10.0.20.21 port 49519 ssh2
May 14 23:42:12 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x1232c587 local_plen 32
May 14 23:42:17 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index75, flags 3, localaddr 0x12322b9b local_plen 32

root@SRXFW> show interfaces ifl-index 75
Logical interface ge-0/0/2.0 (Index 75) (SNMP ifIndex 521)
Flags: Up SNMP-Traps 0x0 Encapsulation: ENET2
Input packets : 3910333
Output packets: 7918082
Security: Zone: Zone02
Allowed host-inbound traffic : dhcp https ping ssh
Protocol inet, MTU: 1500
Max nh cache: 100000, New hold nh limit: 100000, Curr nh cnt: 18, Curr new hold cnt: 0, NH drop cnt: 0
Flags: Sendbcast-pkt-to-re
Addresses, Flags: Is-Preferred Is-Primary
Destination: 10.0.20/24, Local: 10.0.20.1, Broadcast: 10.0.20.255

root@SRXFW>
root@SRXFW> show interfaces snmp-index 521 terse
Interface Admin Link Proto Local Remote
ge-0/0/2.0 up up inet 10.0.20.1/24

root@SRXFW>

My Junos config you can find here https://github.com/Feratti/Junos-18.4R3-S2

Hello Feratti,

Greetings!

I have investigated about the log message - "May 13 13:49:56 SRXFW USP_IF_TOOLKIT: Duplicate attach for ifl_index84, flags 3, localaddr 0x122ab5a7 local_plen 32"

The above messages are expected when an address change occurs on an interface with an address of the same subnet. In this scenario, this error message only indicates that either a secondary IP or a Duplicate IP (within the same subnet) has been assigned on an interface due to VRRP.
Generally, log happens when there is below situation:
1. When deleting multiple IP addresses on the same logical interface at the same time.
2. When adding more than two IP addresses and deleting one IP address on the same logical interface at the same time.
The above behaviors caused duplicated accesses to the same local address, which would be the location of the IP address and the SRX generated the logs.
The above message is related to the logical interface assignment.
It seems these messages are not related to any issue on the SRX.

Please be informed that these messages are informational and can be ignored now.

Let me know if you are seeing any customer impact cause of this issue.

The above log message is tracked under below KB, please refer it for more understanding:

https://kb.juniper.net/InfoCenter/index?page=content&id=KB35058

In case if you would like to prevent certain syslogs, please follow the steps as mentioned in the following KB article -

https://kb.juniper.net/InfoCenter/index?page=content&id=KB9382&act=login

use the below command to suppress the above logs:

user@lab-re0# show system syslog user * {
    any emergency;
} file messages {
    any notice;
    match "!(.*Duplicate.*)";
}

I hope this helps. Please mark this post "Accept as solution" if this answers your query.

Kudos are always appreciated! 

Best Regards,

Lingabasappa H

Hello Ferrati,

Can you also check if there is any interface flap on ge0/0/0 by using the below command?

show interfaces ge-0/0/0 extensive |match "last flapped"

Kudos are always appreciated! 

Best Regards,

Lingabasappa H</