When 'session-persistence-scan' is along with NAT46/NAT64 and the source NAT rule is changed, the PFE process crashes when session reverse flow source IP address is treated to be of different IP version than it actually happens to be in the session table.
 
In a standalone scenario, the traffic will be dropped till the PFE restarts. In case of cluster or MNHA, the node would reboot and failover will be triggered.
 
The following commands can be used to locate the crash files.
user@hostname> show system core-dumps
-rw-rw-rw-  1 root  wheel  XXXXXX <timestamp> core-lcore-slave-xxx.core.tgz

On Junos OS SRX Series platforms with  'session-persistence-scan'  and NAT46 or NAT64 configured, modification to source Network Address Translation (NAT) rule will cause Packet Forwarding Engine (PFE) to crash when there is live IPv6 traffic.  
This will cause all traffic to be dropped and cause service disruption.

https://prsearch.juniper.net/problemreport/PR1933239

Workaround

1. Remove session-persistence-scan configuration
2. 'Or' edit the source nat rule only without live traffic

Triggers

This issue might be seen if the following conditions are met:
* On all Junos OS SRX Series platforms
*  NAT46 or NAT64 is configured
* The knob 'session-persistence-scan' is configured
* Modification to source NAT rule

Resolved In