Session log entries are tied to policy configuration. Each main session event—create, close, and deny—will create a log entry if the controlling policy has enabled logging.

Different fields are logged for session create, session close, and session deny events.

The central point (CP) architecture has two basic flow functionalities: load balancing and traffic identification (global session matching). As described in this topic, the central point architecture is implemented either in centric mode, in which all session distribution and session matching are performed by the central point, or in mixed-mode, in which a percentage of Services Processing Unit (SPU) is dedicated to performing the central point functionality.

Syslog message:

CP NACK is a response received on a "Session Close" action. CP NACK means there’s a conflict on the CP and the session cannot be installed. 

CP sends a delete session message to SPU to delete the SPU session. Usually, it is used when CP finds conflict session/invalid session request on cp, it would delete one and keep the other.

When multiple ICMP packets using the same source IP/port and destination IP/port (in the ICMP session the source port means the ICMP sequence number and the destination port means the ICMP identifier) comes into the SRX, the CP sends the NACK to SPU to delete the conflict session and the log would be generated.

CP NACK is a negative acknowledgment received as a response for CP Session. It could be due to a CP Session leak. When valid CP session has no corresponding SPU session; it means there is a CP session leak, because valid CP session depends on the SPU session to delete it. If there is no SPU session, the valid CP session cannot age out and cannot delete manually.

Ideally, this will not lead to a traffic drop. It will delete the conflict session and allow the traffic through the existing session and generates this error. There is no impact due to this message.

To confirm if the traffic is impacting we need to set trace options and confirm after looking at the results. Please configure the below-mentioned trace option and let it run on the source for few minutes and see if it captures anything otherwise let it run for a longer duration.

set security flow traceoptions file CP-NACK size 10m files 3 world-readable
set security flow traceoptions flag all
set security flow traceoptions packet-filter pf1 source-prefix <source_prefix>
set security flow traceoptions packet-filter pf1 destination-prefix <destination_prefix>

Note: Trace options may take a toll on the CPU of the device. Please keep a check on the CPU hikes while this trace is enabled.

• Security Processing