Description

Upon upgrading Junos, certain types of traffic no longer pass over SRX / J-series correctly

Symptoms

Application Layer Gateways (ALG) may not have been supported in a previous versions of Junos and thus were disabled in the system as seen below.

alt
As support for an ALG is added to future versions these ALGs will be enabled by default which may cause problems with specific types of traffic.

 

Solution

Check release notes for newer version of Junos to verify is new ALG support has been added
 

1. http://www.juniper.net/techpubs/hardware/junos-srx/index.html
2. Select version
3. Select option for Frames, No-Frames, PDF.
4. Located option for JUNOS Software Release Notes for Juniper Networks SRX Series Services Gateways and J Series Services Routers
5. Review information in 'New Features in Junos Release..."
Verify if ALG is enabled
  1.   >show security alg status
Disable ALG as needed
  1.  Disable ALG globally
    •  >configure
    • #set security alg <name> disable
    • #commit and quit
  2.   Disable ALG based on security policy.
    • Create a custom application
      • #set applications application custom_app destination-port <port number>
      • #set applications application custom_app application ignore
      • #set applications application custom_app protocol <protocol type>
      • Assign custom application to security policy
    •  set security policies from-zone <name> to-zone <name> policy <name> match application custom_app

Modification History

2020-06-30: ​Archived since these behavioral changes are no longer seen in new versions; relevant to old Junos OS releases