This article provide the information about the error "FLOW:fast path pkt reroute failed "

SRX reports "fast path pkt reroute failed "

root@SRX-1> monitor security packet-drop from-zone SERVER source-prefix 192.168.0.10 

Starting packet drop: 

13:18:59.559759:LSYS-ID-00 192.168.0.10/57860-->10.0.0.0.1/161;udp,ipid-61078,reth2.0,Dropped by FLOW:fast path pkt reroute failed 

13:19:01.354238:LSYS-ID-00 192.168.0.10/54387-->10.0.0.0.1/161;udp,ipid-15314,reth2.0,Dropped by FLOW:fast path pkt reroute failed 

Asynchronous routing environment reporting drops due reroute failure:

Session ID: 4302706706, Policy name: Trust-Policy-B/129, HA State: Active, Timeout: -1, Session State: Valid

 In: 192.168.0.10/42294 --> 10.0.0.0.1/161;udp, Conn Tag: 0x0, If: reth0.11, Pkts: 29, Bytes: 5020,

 Out: 10.0.0.0.1/161 --> 192.168.0.10/42294;udp, Conn Tag: 0x0, If: reth0.0, Pkts: 20, Bytes:  3670,

Sample Traceoptions:-

Oct 2 08:41:34 08:41:33.960260::RT:~~~FLOW <192.168.0.10/42294->10.0.0.0.1/161;17,0x0> matched filter pf1(0) in root-logical-system for iif reth2.0 of root-logical-system:

Oct 2 08:41:34 08:41:33.960264::RT: packet [92] ipid = 4774, @0xe3538be92

Oct 2 08:41:34 08:41:33.960266::RT:---- flow_process_pkt: (thd 2): flow_ctxt type 15, common flag 0x0, mbuf 0x83be2600, rtbl_idx = 0

Oct 2 08:41:34 08:41:33.960267::RT: flow process pak fast ifl 66 in_ifp reth2.0

Oct 2 08:41:34 08:41:33.960267::RT:flow_decap_fast_tcp_udp_vector: session found in express path  

Oct 2 08:41:34 08:41:33.960268::RT: flow got session.

Oct 2 08:41:34 08:41:33.960268::RT: flow fast tcp/udp session id 4302706706

Oct 2 08:41:34 08:41:33.960270::RT:ha_ifp: reth1.0

Oct 2 08:41:34 08:41:33.960273::RT:flow_ipv4_rt_lkup success 10.0.0.0.1, iifl 0x43, oifl 0x83

Oct 2 08:41:34 08:41:33.960275::RT: route lookup failed: dest-ip 10.0.0.0.1 orig ifp reth1.0 output_ifp reth0.0  <<<<<<<

fto 0x1bd46f5a0 orig-zone 11 out-zone 18 

Oct 2 08:41:34 08:41:33.960278::RT: readjust timeout to 30s

Oct 2 08:41:34 08:41:33.960278::RT:ha_ifp: reth1.0

Oct 2 08:41:34 08:41:33.960278::RT:ha_ifp: reth1.0

Oct 2 08:41:34 08:41:33.960279::RT: packet dropped, pak dropped since re-route failed

From the above trace options, it is observed packets tuple <192.168.0.10/42294->10.0.0.0.1/161;17> is recognised with an existing session "4302706706", such session's outbound interface reth0.0; but from this packet was checked and it was compared to the Routing Table, the routing outcome was reth1.0, meaning that reth0.0 is no longer the outbound interface. System tries to reroute the packet over the latest valid route/outbound interface which It turns to be reth1.0. This interface belongs to a different security zone than the previous known outbound interface, hence the packet drop.

It implies a RIB change. Its suggested to validate if asynchronous routing is in place and avoid it when possible.

KB21983 [juniper.net] is suggested for reference. Further alternative found at Asymmetric Traffic with a Flow Based Device

Resolution:-

Clearing the older sessions can also fix the problem.

> clear security flow session session-identifier 4295271581

All other options below:

> clear security flow session ?

Possible completions:

 <[Enter]>           Execute this command

 advanced-anti-malware Show advanced-anti-malware sessions

 all                 Clear all sessions

 all-logical-systems-tenants All multitenancy systems

 application         Application protocol name

 application-traffic-control Show application-traffic-control sessions

 conn-tag            Session connection tag (0..4294967295)

 destination-port    Destination port (1..65535)

 destination-prefix  Destination IP prefix or address

 destination-service Vector routing destination service

 dynamic-application Dynamic application name

 dynamic-application-group Dynamic application group name

 family              Protocol family

 idp                 IDP sessions

 interface           Name of incoming or outgoing interface

 logical-system      Logical-system name

 nat                 Sessions with network address translation

 protocol            IP protocol number

 resource-manager    Sessions with resource manager

 root-logical-system Root logical-system (default)

 security-intelligence Show security-intelligence sessions

 services-offload    Services-offload sessions

 session-identifier  Clear session with specified session identifier

 session-state       Session state

 source-port         Source port (1..65535)

 source-prefix       Source IP prefix or address

 source-tenant       Vector routing source tenant

 ssl                 SSL sessions

 tenant              Tenant name

 tunnel              Tunnel sessions

 tunnel-inspection-type Tunnel inspection type

 vrf-group           Session L3VPN VRF Group

 vxlan-vni           VXLAN VNI (0..4294967295)

 |                   Pipe through a command

In order to configure the flow-traces to get the trace logs as shown in the symptoms, user need to configure flow traces as shown below --- 

# set security flow traceoptions file flow-trace

# set security flow traceoptions flag basic-datapath

# set security flow traceoptions flag packet-drops

# set security nat traceoptions flag all

# set security flow traceoptions packet-filter f0 source-prefix <sourceip> destination-prefix <destination-ip>

# set security flow traceoptions packet-filter f1 source-prefix <destinationip> destination-prefix <sourceip>

# commit

# run show log flow-trace