Bug: protocol definition for junos_firewall_filter ethernet-switching family

[NikitaPuglachenko]

Terraform and Provider Versions

Terraform v1.5.4
on darwin_amd64
+ provider registry.terraform.io/hashicorp/external v2.3.1
+ provider registry.terraform.io/jeremmfr/junos v2.3.1

Terraform Configuration Files

resource "junos_firewall_filter" "ethernet-switching-demo" {
  name   = "ethernet-switching-demo"
  family = "ethernet-switching"
  term {
    name = "allow-udp"
    from {
      destination_prefix_list = ["DEMO-NETWORK"]
      protocol                = ["udp"]
      source_prefix_list      = ["DEMO-NETWORK"]
    }
    then {
      action = "accept"
    }
  }
}

Expected Behavior

The junos_firewall_filter is applied

Actual Behavior

Error:

│ Error: Conflict Configuration Error
| ...
│ protocol in from block cannot be configured with family "ethernet-switching"

Steps to Reproduce

1. terraform plan --target junos_firewall_filter.ethernet-switching-demo

Additional Context

Junos supports protocol definition for ethernet-switching family

References

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/example/firewall-filter-ex-series-configuring.html

---

i guess it's enough to add "ethernet-switching", there

• https://github.com/jeremmfr/terraform-provider-junos/blame/f64a906e2585f5c7ce707d8a9d5a1433303678a8/internal/providerfwk/resource_firewall_filter.go#L1484
• https://github.com/jeremmfr/terraform-provider-junos/blame/f64a906e2585f5c7ce707d8a9d5a1433303678a8/internal/providerfwk/resource_firewall_filter.go#L1493

[jeremmfr]

Hi 👋

Thank you for raising this issue.

I hadn't authorized protocol with ethernet-switching because the Junos cli hide the option :

# set firewall family ethernet-switching filter 1 term 1 from ?
Possible completions:
...
+ learn-vlan-id        Match Learnt VLAN ID
+ learn-vlan-id-except  Do not match Learnt VLAN ID
+ port                 Match TCP/UDP source or destination port
+ port-except          Do not match TCP/UDP source or destination port
> source-mac-address   Match MAC source address
+ source-port          Match TCP/UDP source port
+ source-port-except   Do not match TCP/UDP source port
...

but indeed, I do think it's a mistake.
It's strange that protocol is hidden but not port. What's more, Juniper docs use protocol in their examples -> juniper.net

I'll take care of fixing it.