This article explain the about when using the drop-flow feature in an LSYS (Logical System) environment, unexpected behavior may occur.

when using the drop-flow feature in an LSYS, Below behaviour is seen :

• The Sessions-in-drop-flow counter remains constant and does not clear.
• The timeout value for drop-flow sessions is set to -1, causing sessions to persist indefinitely.

Example output:

root@SRX> show security flow session summary all-logical-systems-tenants no-forwarding
Flow Sessions on FPC0 PIC1:
Unicast-sessions: 60189
Multicast-sessions: 2621442
Services-offload-sessions: 29904
Failed-sessions: 0
Sessions-in-drop-flow: 2621440 <<<<<<<< (10% of total allowed sessions)
Sessions-in-use: 2688682
Valid sessions: 2678339
Pending sessions: 0
Invalidated sessions: 10343
Sessions in other states: 0
Maximum-sessions: 26214400

The drop-flow feature is not supported for LSYS deployments. It is designed to work only on the Root Logical System.

If LSYS is configured, disable the drop-flow feature and clear existing drop-flow sessions.

Step 1: Disable drop-flow

set security flow drop-flow max-sessions 0

Step 2: Clear current drop-flow sessions

View existing sessions:

show security flow session drop-flow

Clear sessions:

clear security flow session drop-flow
Note: All commands must be executed on the Root Logical System.

RLI-54583

PR1835052 [Confidential] - 25.1dcb:flow:drop-flow:after configuration change from tenant to lsys drop-flow max sessions value does