The customer reported that some connections to their internal web servers are failing from the Internet, while others work.

Traffic was dropped due IDP ip-action. Despite the removal of the IDP configuration, the IP-action entries remain active with a timeout value of 0, indicating they are set to never expire.

The solution is to clear the ip-action table, or configure a different ip-action for the rule if applicable: 

> monitor security packet-drop | grep 2.2.2.2
LSYS-ID-00 2.2.2.2/29360 ---> 3.3.3.3/443;tcp, ipid-39923, reth6.0, Dropped by FLOW:First path IP Action

> show security flow ip-action | grep 2.2.2.2
2.2.2.2 *   *    */*   never   *    drop   Active 

>clear security flow ip-action all 
IP-action entries cleared: 632 on FPC0.PIC0 

11/18/2025: Article Created 

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-ip-action.html