The requirements for passing Stream Control Transmission Protocol (SCTP) traffic changed after the release of SCTP Inspection feature. After upgrading to the code that supports this feature, users may experience impact on their SCTP traffic forwarding, both when they apply SCTP Inspection profile and when they do not. 

SCTP traffic is being dropped randomly. The General Packet Radio Service (GPRS) SCTP association​ is created, but the traffic is being dropped. In some cases, messages similar to the following are seen in the flow trace:

PKT-PROC for plugin junos-gprs jbuf 0x96028948, sess jsf flags 0x0, rc 7

Even when SCTP Inspection is not used, there are certain requirements for the configuration for all platforms/releases that support the SCTP Inspection feature. If the SCTP Inspection is used, additional requirements apply. 

There are two new requirements that apply even when the SCTP Inspection is not used:

1. Bi-directional security policies:  Security policies are now needed in both directions, so that separate SCTP flow sessions can be created in both directions. The INIT and INIT-ACK each now create their own session.

2. SCTP ALG : SCTP ALG is now required, so "application-protocol ignore" statement should NOT be used for any SCTP-passing application in security policies. 

Please refer to the technical documentation, Understanding Stream Control Transmission Protocol .

However, for the case where the gprs-sctp-profile is used, even after applying the above configuration, the issue might persist.
In the failure scenario described below, both ingress and egress interface were at the same security zone.
A single policy was used to allow both directions of the SCTP traffic:

from-zone  zone_A  to-zone  zone_A  {
            policy  SCTP  {
                match {
                    source-address [  <Add_set_A> <Add_set_B>  ];
                    destination-address [  <Add_set_A> <Add_set_B>  ];
                    application junos-gprs-sctp;
                }
                then {
                    permit {
                        application-services {
                            gprs-sctp-profile  <name> ;
                        }
                    }
                    count;
                }
            }

To resolve the issue, the single policy above should be split into two policies:

​from-zone zone_ A  to-zone zone_ A {

            policy SCTP_A-to-B {
                match {
                    source-address <Add_set_A> ;
                    destination-address <Add_set_B> ;
                    application junos-gprs-sctp;
                }
                then {
                    permit {
                        application-services {
                            gprs-sctp-profile <name> ;
                        }
                    }
                    count;
                }

            policy SCTP_B-to-A {
                match {
                    source-address <Add_set_B> ;
                    destination-address <Add_set_A> ;
                    application junos-gprs-sctp;
                }
                then {
                    permit {
                        application-services {
                            gprs-sctp-profile <name> ;
                        }
                    }
                    count;
                }

            }

2017-05-30: Reworded the summary and solution for clarity.

• Understanding Stream Control Transmission Protocol