On all 5K SRX Series devices starting from "21.4R3-S3" will have the source port of the GTPv2 "create session response" packet will be changed as same as destination port and it will be denied by the policy.

The source port change as same as destination port has been introduced by PR1740093, since, sessions are missed in the flow table when GTPU distribution and NP cache are enabled this fix was working well for single wing traffic. But, this solution is not working for the GTP-C type with conn_id 0, as it will also have a reverse wing. Due to which for the reverse wing the source port is being replaced by destination port, and the packet is being dropped by policy.

From the packet captures, we could see session getting built on different source and destination ports.

root@ubuntu-200403:~/sulaiman# tcpdump -ner gtp.pcap | more                                                 
01:08:27.512449 00:50:56:a9:08:8e > 00:10:db:ff:10:00, ethertype IPv4 (0x0800), length 299: Y.Y.Y.Y.50023 > X.X.X.X.2123: UDP, length 257
01:08:27.631443 00:50:56:a9:23:aa > 00:10:db:ff:10:00, ethertype IPv4 (0x0800), length 186: X.X.X.X.2123 > Y.Y.Y.Y.50023: UDP, length 144

From the flow trace of the device, we could see that the device is changing the source-port of both wing.

Oct 27 01:11:27 01:11:27.264298:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:~~~FLOW <Y.Y.Y.Y/2123->X.X.X.X/50023;17,0x0> matched filter in-pac1(0) in root-logical-system for iif reth0.20 of root-logical-system:
..........
..........
Oct 27 01:11:27 01:11:27.264407:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT: find flow: table 0x576b3b240, hash 2472062(0x3fffff), sa Y.Y.Y.Y, da X.X.X.X, sp 50023, dp 50023, proto 17, tok 16392, conn-tag 0x0a9a39a6, vrf-grp-id 0 
..........
..........
01:11:27 01:11:27.264671:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:Policy lkup: vsys 0 zone(8:trust_grx) -> zone(9:untrust_grx) scope:0 src vrf (0) dsv vrf (0) scope:2147483634
Oct 27 01:11:27 01:11:27.264685:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:             Y.Y.Y.Y/50023 -> X.X.X.X/50023 proto 17
Oct 27 01:11:27 01:11:27.264827:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:Policy lkup: vsys 0 zone(5:global) -> zone(5:global) scope:0  src vrf (0) dsv vrf (0) scope:50023
Oct 27 01:11:27 01:11:27.264838:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:             Y.Y.Y.Y/50023 -> X.X.X.X/50023 proto 17

..........
..........
01:11:27 01:11:27.262230:CID-01:FPC-00:PIC-03:THREAD_ID-28:LSYS_ID-00:RT:~~~FLOW <X.X.X.X/50023->Y.Y.Y.Y/2123;17,0x0> matched filter out-pac1(1) in root-logical-system for iif reth0.30 of root-logical-system:
..........
..........
01:11:27 01:11:27.265124:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:  packet dropped, denied by policy
Oct 27 01:11:27 01:11:27.265130:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:  denied by policy w1928(1009), dropping pkt
Oct 27 01:11:27 01:11:27.265136:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:  packet dropped,  policy deny.
Oct 27 01:11:27 01:11:27.265158:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:flow_initiate_first_path: first pak no session
Oct 27 01:11:27 01:11:27.265166:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:  flow find session returns error.
Oct 27 01:11:27 01:11:27.265171:CID-01:FPC-00:PIC-01:THREAD_ID-28:LSYS_ID-00:RT:flow_proc_rc: -1.


And also if we have session logging enabled, We will see the packet getting dropped by security policy:

jtac-srx5400-r2004 RT_FLOW: RT_FLOW_SESSION_DENY: session denied X.X.X.X/50023->Y.Y.Y.Y/50023 0x8d9f52c0 None 17(0) w1928(global) untrust_grx trust_grx UNKNOWN UNKNOWN N/A(N/A) reth0.124 No Denied by policy 3298534883369 N/A N/A -1 N/A N/A N/A N/A N/A

It has been address with PR1771176 , and Engineering has committed fix in versions: junos:21.4R3-S6 junos:22.2R3-S3 junos:22.4R3 junos:23.2R2 junos:23.4R1 junos:23.4R2