This article provides one behavior that SRX4600 Jflow sampling does not work as expected when services offloading is enabled.

On SRX4600 platform, the customer may find J-flow sampling result is much fewer than expected when services offloading feature is enabled.

SRX4600 has FPC 0 and FPC 1 two cards as below, and J-flow is only enabled on CPU/SPU card, for SRX4600, it is FPC 0.

show chassis hardware

FPC 0      REV 11  711-065484  CAJM6809     SRX4600 SPM  

FPC 1      REV 12  711-065676  CAJM8577     SRX4600 MPC

When services offloading feature is enabled, sessions are off-loaded to IOC(FPC 1) in case of SRX4600, Jflow will NOT ACT on those sessions for traffic sampling, since JFlow only works on CPU/SPU(FPC 0).

Jflow and services offloading basically two features are working on different direction.

If J-flow sampling is preferred and services offloading is not a major request, the customer can use 'set security forwarding-options services-offload disable' to disable services offloading globally.

Note: For SRX4600, services offloading is by default enabled from Junos OS Release 21.2R1. 

2023-08-25: Article created

Express Path Overview | Junos OS | Juniper Networks