This article provides a work-around for correcting the error condition.

Traffic from the 10.88.x.x subnet (advertised through BGP neighbors) is intermittently blocked. Logs show packets being dropped due to Flow Move / stale flow-move keep-alive conditions.

Sample log snippet :

serviceArea.log: Jul 31 01:36:40.909 [SESS|SA ] ERROR (SessionProc-00 ) Dropped packet with key: Packet key [src ip 10.88.x.x, dest ip 147.161.x.x, src port 61101, dest port 443, proto 6, interface 1.910], is flow-hit, detour reason: Flow Move (7), is not bfd tunneled, DSCP steering: None, packet internally generated for Flow Move (4), has no metadata due to PacketWithStaleFlowMoveKeepAlive: Packet with stale flow-move keep-alive. Flow Key[src ip 10.88.x.x, dest ip 147.161.x.x, src port 61101, dest port 443, proto 6, interface 1.910]

Root Cause

Traffic from non-directly connected networks may be misclassified by the default “Access to Mist Cloud” setting.
This option is designed for directly connected networks and may unintentionally apply filtering or detour behavior to other routed subnets (such as those learned via BGP). As a result, flows may experience stale flow-move conditions, leading to random drops.

Workaround

For networks that are not directly connected but still require access to Mist Cloud:

• Do not rely on the global “Access to Mist Cloud” checkbox.
• Instead, create a dedicated application policy specifically for the non-directly connected network (e.g., the 10.88.x.x subnet) to allow Mist Cloud traffic explicitly.

This ensures correct classification and prevents unintended URL filtering or flow-detour behavior.

If you face any further issues, please contact JUNIPER JTAC Support for assistance.