This article details how to enable TCP SYN and sequence check for specific security policies in the configuration in SRX devices.

SRX is a stateful firewall and allows traffic that matches an existing session. Sessions are created when a TCP SYN packet is received and it is permitted by the security policy. This of course means that the firewall needs to see both directions of a flow (client-server and server-client); otherwise, these checks will block legitimate packets. For more information about TCP sessions, refer to Understanding TCP Session Checks per Policy .

Whenever possible, it is best to ensure that asymmetric flows cannot occur, but this is not always possible. Therefore, you can disable these checks globally on the SRX device:

set security flow tcp-session no-syn-check
set security flow tcp-session no-sequence-check

This has a security compromise and because it is a global option, it applies to all traffic flowing through the device. However, recent Junos OS releases allow these checks to be enabled on a per-policy basis, similar to the following:

policy trust-to-untrust {
    match {
        source-address any;
        destination-address any;
        application any;
    }
    then {
        permit {
            tcp-options {
                syn-check-required;
                sequence-check-required;
            }
        }
    }
}

To disable TCP SYN or sequence checking on one policy while enabling it on all other policies, an apply-group can be used. This can be conceptualized as follows: 

1. Globally disabling syn and sequence checking
2. Using an apply-group to set syn-check-required and sequence-check-required on ALL security policies
3. Using apply-groups-except to disable this apply-group on the few policies where syn or sequence checking is not desired

The following are the commands to enable it:

groups {
    test {
        security {
            policies {
                from-zone <*> to-zone <*> {
                    policy <*> {
                        then {
                            permit {
                                tcp-options {
                                    syn-check-required;
                                    sequence-check-required;
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

security {
    policies {
        apply-groups test;
    }
}

security {
    policies {
     from-zone 1 to-zone 2 {
      policy one {
       apply-groups-except test;
                ...
   }
  }
}
}

2026-01-30: Updated Categories

2020-06-17: Article reviewed for accuracy; no changes made; article valid