Review the router configuration. Verify a firewall filter term discards BGP packets with a TTL less than 255. [edit firewall family inet] filter gtsm { term 1 { from { protocol tcp; ttl 255; destination-port bgp; } then accept; } term 2 { from { protocol tcp; destination-port bgp; } then { log; syslog; discard; } } <additional accept terms> term default { then { log; syslog; discard; } } } Some routers support the "ttl-except" directive that can replace the two term filter shown above. For example: [edit firewall family inet] filter gtsm { term 1 { from { protocol tcp; ttl-except 255; destination-port bgp; } then { log; syslog; discard; } } <additional accept terms> term default { then { log; syslog; discard; } } } Verify the filter is applied to BGP neighbor interfaces. [edit interfaces] <bgp interface> { unit <number> { family inet { filter input gtsm; } address <IPv4 address>.<mask>; } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example: input-list [ permit_mgt permit_routing_protocols default-deny ]; If the router is not configured to use GTSM for all Exterior Border Gateway Protocol peering sessions, this is a finding.