This article explains the behavior of TCP flows when the 'no-syn-check' option is configured in the security flow settings and TCP-RST is enabled at the zone level on SRX devices.

When the no-syn-check option is configured in the security flow and TCP-RST is configured at the zone level on an SRX device:

• Without TCP-RST Configuration:
  • If the first TCP packet received is not a SYN packet, the SRX will allow the flow to complete in the first path without dropping it.
  • After the initial flow, the session will transition to the fast path, where the SRX will then start checking for a SYN packet in the TCP section.

• With TCP-RST Configuration at the Zone Level:
  • The SRX will inspect the first packet in the zone section.
  • If the first TCP packet is not a SYN packet, the SRX will drop the packet.
  • Additionally, the SRX will send a TCP-RST packet back to the originator, effectively terminating the connection attempt.