Description

In some environments, traffic to specific websites may fail or become intermittently inaccessible when Intrusion Detection and Prevention (IDP) is enabled on the SRX device.

The issue is typically caused by TCP reassembly failures inside the IDP engine, resulting in packet drops. Traffic usually starts working again after the IDP policy is disabled.

Symptoms

1. IDP Packet Drop Counters Increase
The following counters may increment, particularly Dropped by Error:
root@SRX-FW# run show security idp counters packet | no-more



node0:

--------------------------------------------------------------------------

IDP counters:

 

  IDP counter type                                                      Value

Processed packets                                                       3898

Dropped packets                                                         45

Dropped ICMP packets                                                    0

Dropped TCP packets                                                     45

Dropped UDP packets                                                     0

Dropped Other packets                                                   0

Dropped by IDP Policy                                                   0

Dropped by Error                                                        45 >>>>>HERE

Dropped sessions                                                        0

 

A steadily increasing Dropped by Error counter typically indicates packet drops due to TCP reassembly or protocol validation failures within the IDP engine.
 
2. Flow Trace Logs Indicate IDP Packet Processing Failure

 

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT: plugin name junos-jdpi. action JSF_SESSION_ACTION_NONE, stbuf 0x0

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT:PKT-PROC for plugin junos-jdpi jbuf 0xd1d159d80, sess jsf flags 0x0, rc 0

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT: plugin name junos-dynapp. action JSF_SESSION_ACTION_NONE, stbuf 0x0

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT:PKT-PROC for plugin junos-dynapp jbuf 0xd1d159d80, sess jsf flags 0x0, rc 7

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT: plugin name junos-dpi-stream. action JSF_SESSION_ACTION_IGNORE, stbuf 0x0

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT: plugin name junos-idp. action JSF_SESSION_ACTION_NONE, stbuf 0x0

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT:PKT-PROC for plugin junos-idp jbuf 0xd1d159d80, sess jsf flags 0x0, rc 8 >>>> It goes to IDP Module for packet processing 

[Time-stamps]:CID-1:THREAD_ID-01:LSYS_ID-00:RT:flow_proc_rc: -1.         >>>>>>>>>>Drop
Key flow markers:

  • PKT-PROC for plugin junos-idp rc 8

    • Indicates the packet is being processed by the IDP module.

  • flow_proc_rc: -1

    • Indicates packet/session processing failure.
Solution
Workaround:




Configure the IDP reassembler to ignore reassembly failures instead of dropping packets:


"set security idp sensor-configuration re-assembler action-on-reassembly-failure ignore" 


This changes the default behavior from drop to ignore, allowing traffic to pass even when TCP reassembly anomalies are detected.


Modification History
2024-03-26 : Article Created