On all 5K SRX Series devices starting from "21.4R3-S3" will have the source port of the GTP-U "TEID 0" packet will be changed as same as destination port and it will be denied by the policy.
The source port change as same as destination port has been introduced by PR1740093, since, sessions are missed in the flow table when GTPU distribution and NP cache are enabled this fix was working well for single wing traffic. But, this solution is not working for the GTP-U type with "TEID 0", as it will also have a reverse wing. Due to which for the reverse wing the source port is being replaced by destination port, and the packet is being dropped by policy.
From the packet captures, we could see session getting built on different source and destination ports.
PCAP from Firewall:
64 2024-03-13 12:53:09.413247 0x069e (1694) 145.7.74.66 35040 217.71.36.8 2152 GTP 58 0x00
65 2024-03-13 12:53:09.413620 0x069e (1694) 145.7.74.66 35040 217.71.36.8 2152 GTP 58 0x00
66 2024-03-13 12:53:09.414315 0x31bd (12733) 217.71.36.8 2152 145.7.74.66 35040 GTP 60 0xe0
From the flow trace of the device, we could see that the device is changing the source-port of both wing.
Mar 13 07:29:09 07:29:09.412351:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT:~~~FLOW <217.71.36.8/2152->145.7.74.66/35040;17,0x0> matched filter out-pac2(3) in root-logical-system for iif reth0.20 of root-logical-system:
..........
Mar 13 07:29:09 07:29:09.412449:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT: find flow: table 0x576b3b240, hash 4024854(0x3fffff), sa 217.71.36.8, da 145.7.74.66, sp 35040, dp 35040, proto 17, tok 28680, conn-tag 0x00000000, vrf-grp-id 0
Mar 13 07:29:09 07:29:09.413089:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT: packet dropped, denied by policy
Mar 13 07:29:09 07:29:09.413094:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT: denied by policy w1928(1017), dropping pkt
Mar 13 07:29:09 07:29:09.413100:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT: packet dropped, policy deny.
Mar 13 07:29:09 07:29:09.413119:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT:flow_initiate_first_path: first pak no session
Mar 13 07:29:09 07:29:09.413133:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT: flow find session returns error.
Mar 13 07:29:09 07:29:09.413138:CID-01:FPC-00:PIC-02:THREAD_ID-25:LSYS_ID-00:RT:flow_proc_rc: -1.
It has been address with 1798041 , and Engineering has committed fix in versions: junos:21.4R3-S7 junos:22.2R3-S4 junos:22.3R3-S3 junos:23.2R2-S1 junos:23.4R2 junos:24.2R1