This article provides information and solution regarding application issues faced due to incorrect TCP Window Size update after upgrade of SRX devices.

Server sends SYN-ACK packet with larger TCP window size and immediately after sending SYN-ACK, the server shrinks its TCP window size. 

This is a known bug and the fix is available in the JunOS releases 21.2R3-S4, 21.2R3-S5, 21.3R3-S4, 21.3R3-S5, 21.4R3-S3, 21.4R3-S4, 22.1R3-S1, 22.1R3-S3, 22.2R3, 22.2R3-S1, 22.3R2, 22.3R3, 22.4R2, 23.1R1 and higher releases. 
Please refer to PR1699578 for the complete list.

Workaround:
Disable TCP sequence check globally by using below command-
#set security flow tcp-session no-sequence-check

Or,
 
Selectively disable TCP sequence check. Please refer to following KB: 
[SRX] How to selectively disable ‘syn’ and ‘sequence’ checking

2024-06-23 : Article Created