After upgrading SRX Series devices to Junos OS 24.2, traffic forwarding issues may occur when the device is operating in packet mode.

Traffic fails to forward after the upgrade

monitor security packet-drop shows "Dropped by first path invalid zone."

Starting with Junos OS 24.2R1, the inet family is no longer automatically enabled for packet mode along with mpls. If the device is operating in packet mode, this must now be explicitly configured.

To restore traffic forwarding, configure the following:

set security forwarding-options family inet mode packet-based

Commit the configuration after applying the change.

This ensures that packet mode is enabled for the inet family and restores normal data plane operation.