Description

When creating specific rules for NFS traffic (port 2049) above an existing over-permissive parent rule, the traffic continues to match the old policy due to SUN-RPC ALG behaviour.

Symptoms

A new policy was added above an existing permissive rule to allow NFS traffic for specific source and destination IPs. Despite this, traffic still hits the old policy.
 
SUN-RPC ALG creates a parent session and associated gate entries. These entries allow subsequent NFS sessions to bypass policy lookup, causing them to match the old policy.
 
Flow trace shows logs similar to:
 
 jsf drop pak pid 40, sess_id <masked>
 After jsf gate hit. sid <masked>, pid 40, rc = 17
 RM populated xlate info for nsp2: <masked>/2049 -> <masked>/1022
 flow_first_in_dst_nat: bypassed by RM
 flow_first_rule_dst_xlate: bypassed by RM
 
Gate entries present in active state:
 
 Id 0100009d, CP Id 010002a8, pid 40, state 2, flags 0x20, cookie 0x5, Max lifetime 0, Timeout 131070, Child lifetime 0, Count 1, Flags 0x20 Zone : <ZONE_NAME_MASKED>, VRF GROUP ID: 0, Logical system : <LSYS_NAME_MASKED> 0.0.0.0-0.0.0.0/0-0 -> <IP_MASKED>-<IP_MASKED>/2049-2049, 6
 
Id 0100009a, CP Id 010002bc, pid 40, state 2, flags 0x20, cookie 0x5, Max lifetime 0, Timeout 131070, Child lifetime 0, Count 1, Flags 0x20 Zone : <ZONE_NAME_MASKED>, VRF GROUP ID: 0, Logical system : <LSYS_NAME_MASKED> 0.0.0.0-0.0.0.0/0-0 -> <IP_MASKED>-<IP_MASKED>/2049-2049, 6

Solution

Disable SUN-RPC ALG and clear the map-table to remove gate entries:
 
*Note: please collect the below logs before disabling the ALG*

Steps

1. Collect Logs

> request security policies check from-zone <zone> to-zone <zone>
> show security policies checksum logical-system all
> show security match-policies from-zone <zone> to-zone <zone> source-ip <IP> destination-ip <IP> destination-port 2049 protocol tcp
> show security flow session source-prefix <IP> destination-prefix <IP> destination-port <port>
> flow trace
 
2. Check ALG and Gate Table
 
srx-cprod.sh -s spu -c "show usp algs sun-rpc map-table"
srx-cprod.sh -s spu -c "show usp algs sun-rpc map-table lsys-name <masked>"
srx-cprod.sh -s spu -c "show usp gate table"
srx-cprod.sh -s spu -c "show usp gate table lsys-name <masked>"
 
3. Disable ALG
 
# set security alg SUNRPC disable 
# commit
 
4. Clear Map Table
 
srx-cprod.sh -s spu -c "clear usp algs sun-rpc map-table"






Important:


  • If CGNAT is not used with ALG, disabling SUN-RPC ALG should have no impact.
  • If application payload requires address or port translation, disabling ALG may cause issues.












Modification History
2025-12-28 : Article Created