This article explains how to change the forwarding mode on SRX devices from flow-based to packet-based for IPv4 traffic. Packet based forwarding mode is supported on the following SRX models: SRX300-series, SRX1500, SRX4100, SRX4200, vSRX.

Note: The solution described here does not apply to the following SRX models: SRX1600, SRX2300, SRX4300, SRX4600, SRX5400, SRX5600, SRX5800.

An SRX device can operate in different forwarding modes: packet mode and flow mode. In flow mode, SRX processes all traffic by analyzing the state or session of traffic. This is also called stateful processing of traffic. In packet mode, SRX processes the traffic as a traditional router on a per-packet basis. This is also known as stateless processing of traffic. Security features like IPsec, NAT, UTM, and so on, do not work in packet mode. By default, Junos OS on SRX devices work in flow mode.

To check the forwarding mode:

1. From operational mode, enter the show security flow status command.

root> show security flow status
  Flow forwarding mode:
    Inet forwarding mode: flow based
    Inet6 forwarding mode: flow based
    MPLS forwarding mode: drop
    ISO forwarding mode: drop
...

As you can see, the device is in flow-based mode for IPv4 (inet) and IPv6 (inet6) traffic.
 

2. As the device in packet mode will work as a router (and not a firewall), delete the security feature configuration from the device.

[edit]
root# delete security 

3. Change the mode to packet-based for IPv4 using the following command:

• In Junos versions from 24.2 onwards:

[edit] 
root# set security forwarding-options family inet mode packet-based

• In Junos versions before 24.2:

[edit] 
root# set security forwarding-options family mpls mode packet-based

4. If you plan on using IPv6 with this device in packet mode as well, you can change the mode to packet-based for IPv6 using the following command:

[edit] 
root# set security forwarding-options family inet6 mode packet-based

5. In Junos 24.2 and above, jf you plan on using MPLS in packet mode with this device as well, you can change the mode to packet-based for MPLS using the following command:

[edit] 
root# set security forwarding-options family mpls mode packet-based

6. Commit the change. The commit completes with the following warning, prompting you to reboot the device to make the changes effective.

[edit]
root# commit
warning: You have changed mpls flow mode.
You have to reboot the system for your change to take effect.
If you have deployed a cluster, be sure to reboot all nodes.
warning: Inet flow mode has been changed to packet-based mode for mpls mode modification.
warning: You must reboot the system for your change to take effect.
If you have deployed a cluster, be sure to reboot all nodes.
commit complete

6. Reboot the device. Reboot both nodes in the case of a cluster.

[edit]
root# run request system reboot
Reboot the system ? [yes,no] (no) yes

Verification:

1. Once the device is up after reboot, check the flow status again. As you can see, the forwarding mode is now packet-based.

root> show security flow status
  Flow forwarding mode:
    Inet forwarding mode: packet based
    Inet6 forwarding mode: packet based
    MPLS forwarding mode: packet based
    ISO forwarding mode: drop
...

Note: As of Junos 15.1X49-D70, for the SRX1500 series, SRX4100, SRX4200, devices and vSRX, you do not need to reboot the device when you are switching modes between flow mode and packet mode. For SRX300-Series you do need to reboot.
 

Note: As of Junos 24.2R1, packet mode configuration changed. Each family (inet, inet6, mpls) can be configured in packet based forwarding mode separately. In earlier releases, setting family mpls to packet based would automatically set family inet to packet based as well.
 

2024-06-15: Updated to new behavior on how to set packet mode from Junos 24.2R1 onwards
2020-01-13: Added note about solution not applying to some SRX High End devices
2017-03-21: Added note that solution is not supported on SRX High End devices
2017-06-22: Added that no need to reboot after 15.1X49-D70
2017-08-07: Reboot is required for entire SRX300-Series

• Understanding the Default Processing Behavior for IPv4 Traffic