Description

Note: A product listed in this article has either reached hardware End of Life (EOL) OR software End of Engineering (EOE). Refer to End of Life Products & Milestones for the EOL, EOE, and End of Support (EOS) dates.


This article describes the issue of SCTP packets being dropped, when Static NAT is configured on the SRX device.

Symptoms

SCTP packets are dropped by the SRX device, when NAT is configured. This is how it can be identified: 

root@srx> start shell
root@srx% srx-cprod.sh -s spu -c  "sh usp jsf counter gprs-sctp"
======== Start SPU1.0, node1.fpc1.pic0, spu =======
        gate hit                             193287
        gate hit ok                              12

======== Start SPU4.0, node1.fpc4.pic0, spu ========

        gate hit                             231443
        gate hit ok                               4

======== Start SPU4.0, node0.fpc4.pic0, spu ========

        gate hit                             202467
        gate hit ok                               0

Flow traceoptions for the flow: 
CID-01:FPC-04:PIC-00:THREAD_ID-11:RT:SPU invalid session id 00000000
CID-01:FPC-04:PIC-00:THREAD_ID-11:RT: After jsf gate hit. sid 0xbf4, pid 6, cookie 0xfaad2, jbuf 0x11. rc = 77
CID-01:FPC-04:PIC-00:THREAD_ID-11:RT:  packet dropped, denied by gate_hit callback
CID-01:FPC-04:PIC-00:THREAD_ID-11:RT:denied by gate_hit callback

Solution

 To resolve this issue, stop using Static NAT; otherwise this issue is resolved in 11.4R3.

Modification History

2021-01-01: Tagged article for EOL/EOE.