For the pass through traffic, if the loop is detected on the firewall and it is intended to create two sessions to merge it as one, then merge will fail with below error, if IDP is enabled only for one of the sessions of the loop.
:::RT::combine_loopback_session: Error ! : the session jsf_plugin_info 0x0 in natp mismatch 0x6920f01a0 in new_natp
>> With the help of flow trace or "monitor security packet-drop", you can identify the issue. Below interpretation of flow trace will help to understand the issue:
>Below flow trace is captured from source 10.1.1.1 (trust) to destination 192.168.1.1 (wan), where 192.168.1.1 is static NAT to 10.0.1.1 (dmz)
>Source NAT will be performed for 10.1.1.1 as 192.168.1.2, if source IP is matched for from zone as trust and to zone as wan
>Destination/Static NAT will be performed for 192.168.1.1 as 10.0.1.1, if destination IP is matched for from zone as wan
>For the policy "trust-to-wan" no L7 services enabled or no IDP is enabled
>For the policy "wan-to-dmz" IDP is enabled
Flow Trace Example for failed merging session, if IDP enabled for only one of the sessions:
856::RT::~~~FLOW <10.1.1.1/34050->192.168.1.1/80;6,0x0> matched filter pf1(0) in root-logical-system for iif reth1.308 of root-logical-system: >>>>>>>>>>>>>>>> Packet matched with filter source and destination IP
893::RT::flow_first_routing: vr_id 22, call flow_route_lookup(): src_ip 10.1.1.1, x_dst_ip 192.168.1.1, in ifp reth1.308, out ifp N/A sp 34050, dp 80, ip_proto 6, tos 0
900::RT:: routed (x_dst_ip 192.168.1.1) from trust-zone (reth1.308 in 1) to reth0.2200, Next-hop: 192.168.1.1 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Destination route lookup, routed to interface, which is of wan zone
913::RT:: permitted by policy trust-to-wan(859) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Permitted by policy from trust zone to wan zone
914::RT:: packet passed, Permitted by policy.
928::RT:: dip id = 88/1, 10.1.1.1/34050->192.168.1.2/61715 protocol 6 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Performing source NAT
930::RT:: choose interface reth0.2200(P2P) as outgoing phy if
931::RT::is_loop_pak: Found loop on ifp reth0.2200 due to MIP >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Loop is identified due to static NAT configured as from zone as wan
932::RT::flow_first_loopback_check: Setting interface: reth0.2200 as loop ifp.
938::RT::flow_first_complete_session, pak_ptr: 0x167ffdc710, nsp: 0x4db330480, in_tunnel: 0x0
942::RT:: Session (id:42951841357) created for first pak 1002 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 1st session created, no L7 or IDP seen on flow
943::RT:: flow_first_install_session======> 0x4db330480
950::RT:: post addr xlation: 192.168.1.2->192.168.1.1.
951::RT::proc_loopback_common: Found loop if reth0.2200 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Performing 2nd session, since loop is identified
956::RT:: flow_first_create_session
962::RT::flow_first_rule_dst_xlate: packet 192.168.1.2-> nsp2 0.0.0.0->10.0.1.1. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Performing destination NAT
968::RT::flow_first_routing: vr_id 22, call flow_route_lookup(): src_ip 192.168.1.2, x_dst_ip 10.0.1.1, in ifp reth0.2200, out ifp N/A sp 61715, dp 80, ip_proto 6, tos 0
974::RT:: routed (x_dst_ip 10.0.1.1) from wan-zone (reth0.2200 in 1) to reth1.4, Next-hop: 10.0.1.1 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Destination route lookup, routed to interface, which is of dmz zone
992::RT:: permitted by policy wan-to-dmz(1073) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Permitted by policy from wan zone to dmz zone
993::RT:: packet passed, Permitted by policy.
015::RT::-jsf : preset sess plugin info for session 42954088429
017::RT::[JSF] set ext handle 0x1738c8d20 for plugin 10 on session 42954088429 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Deep packet inspection plugin invoked
023::RT:: Allocating plugin info block for plugin(19)>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> IDP plugin invoked
031::RT::[JSF]Plugins(0x10080400, count 3) enabled for session = 42954088429, impli mask(0x40), post_nat cnt 7 svc req(0x6)
033::RT:: 10/junos-jdpi
033::RT:: 19/junos-idp
041::RT::flow_first_complete_session, pak_ptr: 0xd22457780, nsp: 0x5420fe480, in_tunnel: 0x0
046::RT:: Session (id:42954088429) created for first pak 94a2 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2nd session created, with IDP seen on flow
047::RT::combine_loopback_session:Ready to merge loop sessions: 42951841357 & 42954088429 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Initiated to combine both the sessions
048::RT::combine_loopback_session:First session:
048::RT::nsp:0x4db330480, 10.1.1.1/34050 -> 192.168.1.1/80:6, If: reth1.308, nsp-flag: 0x21 tok: 0x16027, nh:0x0
050::RT::nsp:0x4db330540, 192.168.1.1/80 -> 192.168.1.2/61715:6, If: reth0.2200, nsp-flag: 0x8 tok: 0x14007, nh:0x4d37bc4
053::RT::combine_loopback_session:Second session:
053::RT::nsp:0x5420fe480, 10.1.1.1/61715 -> 192.168.1.1/80:6, If: reth0.2200, nsp-flag: 0x2601 tok: 0x14007, nh:0x0
054::RT::nsp:0x5420fe540, 10.0.1.1/80 -> 192.168.1.2/61715:6, If: reth1.4, nsp-flag: 0x2600 tok: 0x16031, nh:0x4da2bc4
056::RT::combine_loopback_session: Error ! : the session jsf_plugin_info 0x0 in natp mismatch 0x6920f01a0 in new_natp >>>>>>>>>>>>>>>>>>>>>>>>>>>>> Combine session and new session creation failed, since IDP is enabled on only one session
Flow trace example of successful merging session, if no IDP enabled or no L7 enabled for both the sessions:
44::RT::combine_loopback_session:Ready to merge loop sessions: 25779523924 & 30065438362
45::RT::combine_loopback_session:First session:
46::RT::nsp:0x634e41980, 10.1.1.1/46440 -> 192.168.1.1/443:6, If: reth1.308, nsp-flag: 0x21 tok: 0x16027, nh:0x0
48::RT::nsp:0x634e41a40, 192.168.1.1/443 -> 192.168.1.2/34086:6, If: reth0.2200, nsp-flag: 0x8 tok: 0x14007, nh:0x4d37bc4
50::RT::combine_loopback_session:Second session:
50::RT::nsp:0x4967beb80, 10.1.1.1/34086 -> 192.168.1.1/443:6, If: reth0.2200, nsp-flag: 0x1 tok: 0x14007, nh:0x0
52::RT::nsp:0x4967bec40, 10.0.1.1/443 -> 192.168.1.2/34086:6, If: reth1.4, nsp-flag: 0x0 tok: 0x16031, nh:0x4da2bc4
54::RT::old natp: flow_fto1 0x634e419b8(fto 0x0) flow_fto2 0x634e41a78(fto 0x16da60f20),new natp: flow_fto1 0x4967bebb8(fto 0x0), flow_fto2 0x4967bec78 (fto 0x16a7d2720)
57::RT::combine_loopback_session: vector index of sess1 1002, vector index of sess2 1022
57::RT:: existing vector list 0x1022-0x16c36f340.
58::RT:: existing vector list 0x1022-0x16c36f340.
58::RT::combine_loopback_session: New vector index 1022.
59::RT::combine_loopback_session: New merged session has id 25779523924, natflag: 0x44408000 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Combine session and new session creation was successful, since no L7 services involved on both the sessions
59::RT::nsp:0x634e41980, 10.1.1.1/46440 -> 192.168.1.1/443:6, If: reth1.308, nsp-flag: 0x21 tok: 0x16027, nh:0x0
62::RT::nsp:0x634e41a40, 10.0.1.1/443 -> 192.168.1.2/34086:6, If: reth1.4, nsp-flag: 0x0 tok: 0x16031, nh:0x4da2bc4
1. It is a day one expected behavior with the firewall, that, both of the sessions should have L7 enabled or L7 disabled.
2. If you are performing Hairpin NAT with firewall, please follow the KB24639 [juniper.net], so it will create single session, instead of merging two created sessions of loop.
3. Either have IDP enabled for both the policies or disabled for both the policies.
Reference hairpin NAT KB link:https://supportportal.juniper.net/s/article/SRX-How-to-set-up-NAT-hairpinning