Unknown reason is basically the catch-all when a more specific packet drop reason does not exist such as if it's dropped due to route lookup issues or if the first tcp packet is not a syn packet among many others. In some cases, the packet drop reason can be expected. In such events, it is necessary to configure flow traceoptions in order to gather more details about why the drop happens.

As an example, In one particular case, the customer had the "rst-sequence-check" configured under flow tcp-sessions:

  flow {
    tcp-session {
      rst-sequence-check;
    }
  }

By definition, this feature will drop a packet marked with a RST flag which does not have the expected sequence number for an existing tcp session. The complete definition can be found here: https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-rst-sequence-check.html

When flow traceoptions were configured, we could see a packet comes into the SRX and has an existing session already:

Jul 23 22:00:24 22:00:23.972272:CID-1:THREAD_ID-23:LSYS_ID-00:RT:~~~FLOW <10.10.10.10/4098->20.20.20.100/443;6,0x0> matched filter one(0) in root-logical-system for iif reth0 of root-logical-system:

Jul 23 22:00:24 22:00:23.972284:CID-1:THREAD_ID-23:LSYS_ID-00:RT: flow session id 4312114129

We could tell this is a tcp packet which has the RST and ACK bits set from the tcp flag equating to 20 (which breaks down to RST[4]+ACK[16]):

Jul 23 22:00:24 22:00:23.972292:CID-1:THREAD_ID-23:LSYS_ID-00:RT:Entered flow_proc_tcp_fin

Jul 23 22:00:24 22:00:23.972292:CID-1:THREAD_ID-23:LSYS_ID-00:RT:flow_proc_tcp_fin: TCP flag = 20

Packet is recorded as dropped as the RST packet happened to have a sequence number outside what the firewall was expecting:

Jul 23 22:00:24 22:00:23.972309:CID-1:THREAD_ID-23:LSYS_ID-00:RT:flow_tcp_proc_vector_: Dropping packet

Jul 23 22:00:24 22:00:23.972309:CID-1:THREAD_ID-23:LSYS_ID-00:RT:flow_proc_rc: -1.

When running the "monitor security packet-drop" command, the buffer might report back that the packet has dropped due to an "Unknown reason"
 

SRX> monitor security packet-drop destination-prefix 20.20.20.100

22:00:23.972318:LSYS-ID-00 10.10.10.10/4098-->20.20.20.100/443;tcp,ipid-2234,reth0,Dropped by FLOW:Unknown reason

For the aforementioned example, removal of the rst-sequence-check knob caused the "Unknown reason" packet drop messages to cease. Further troubleshooting into the issue may be necessary in order to get a more detailed look into what is triggering the packet to be dropped due to "Unknown reasons".