Customer has an issue with SCTP traffic passing through SRX5600 firewalls.
Initially Customer configured a security policy in one direction which did not work. Then we followed article KB31567 [juniper.net] and created a policy in both directions, with an application (sctp-29168) that has "alg gprs-sctp" configured, along with a SCTP inspection profile (nat-only) in both directions:
show security sctp
profile sctp-profile-1 {
nat-only;
association-timeout 1440;
permit {
payload-protocol all;
The SCTP INIT comes from a remote site and hits a static NAT rule on the SRX5600, which forwards it to an internal host.
The static NAT rules are :
user@router# show security nat static rule-set PWS-RULESET rule test
match {
destination-address x.x.x.x/32;
then {
static-nat {
prefix {
y.y.y.y/32;
routing-instance PWS;
After configuring bi-directional policies the traffic is permitted, however the service flaps every ~2 minutes. Customer sees that heartbeats are being sent and after a couple of minutes the host on the SRX5600 side sends ABORT chunks.
Customer also see that the INIT ACK IPs are not translated.
According to the documentation
https://www.juniper.net/documentation/us/en/software/junos/gtp-sctp/topics/topic-map/security-gprs-sctp-configuration.html
Only static NAT is supported and the STCP internal IPs should be translated according to the NAT rule, when using a SCTP inspection profile. Customer is using the nat-only option here.
Also the commands below shows all counters as 0
">show security sctp counters"
">show security sctp association"
Customer is monitoring and seeing that the SCTP sessions get established, but then within 2 minutes the sessions flap.
There were 2 suggestions to the customer.
1). Customer had configured routing-instance inside the static nat.
}
It was confirmed that routing-instance option inside Static nat is only supported from 23.1 Junos, hence it was requested to be removed from the configuration.
2). Customer has "nat-only" configured inside the SCTP profile.
user@router# show security sctp
Customer was suggested to remove nat-only option from the sctp profile, since nat-only option causes SCTP inspection not work.
2025-09-25 : Article Created
2025-09-29 : Article published