Description

This article explains why both "RT_FLOW_SESSION_CREATE" and "RT_FLOW_SESSION_DENY" logs are generated at the same time.

Does this mean that the SRX is allowing and denying traffic both?

Symptoms

We see the following logs:

Jan 1 16:24:10 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.1/1->192.168.2.1/3 0x0 icmp 0.0.0.0/0->192.168.2.1/3 0x0 N/A N/A N/A N/A 1 DenyAll RED RED 415 N/A(N/A) ge-0/0/0.0 UNA

Jan 1 16:24:10 RT_FLOW: RT_FLOW_SESSION_DENY: session denied 192.168.1.1/1->192.168.2.1/3 0x0 icmp 1(8) DenyAll RED RED UNKNOWN UNKNOWN N/A(N/A) ge-0/0/0.0 No Denied by policy 415 N/A N/A -1 A


Solution

When the configuration is as follows:

set security policies from-zone trust to-zone untrust policy test match source-address denied_host

set security policies from-zone trust to-zone untrust policy test match destination-address any

set security policies from-zone trust to-zone untrust policy test match application any

set security policies from-zone trust to-zone untrust policy test then deny

set security policies from-zone trust to-zone untrust policy test then log session-init

set security policies from-zone trust to-zone untrust policy test then log session-close


As per the design, "session-init" will trigger a log when a session is created, generating a "RT_FLOW_SESSION_CREATE" log and "session-close" will trigger a log when a session is closed, generating a "RT_FLOW_SESSION_DENY" log

"RT_FLOW_SESSION_CREATE" does not mean that the traffic is getting permitted, it just means that the SRX has received traffic, and the SRX has started to process it for creating a session (if valid).

Modification History

2026-04-14 : Article Created