Juniper SRX firewalls can operate in Packet Mode (stateless) or Flow Mode (stateful), each defining how traffic is processed.

This article explains in-depth difference between Packet Mode (stateless) and Flow Mode (stateful).

In Juniper SRX firewalls, traffic can be processed in two distinct modes: Packet Mode and Flow Mode. These modes define how traffic is handled at the network layer and influence how the firewall interacts with packets and sessions. Each mode has unique operational characteristics and impacts on network performance, security, and resource utilization.

Packet Mode (Stateless Forwarding)

In Packet Mode, Juniper SRX devices forward traffic on a per-packet basis without creating any session or maintaining state. This mode is analogous to traditional routing behavior and provides the simplest form of traffic handling.

• Stateless: Every packet is treated independently, meaning no session information is created or tracked.
• Policy Enforcement: Basic policy checks can be enforced at the packet level, such as static NAT or packet-based firewall filters.
• Features: Features like route lookup, forwarding, and basic network address translation (NAT) are applied.
• High Performance: Since no session state is maintained, Packet Mode generally provides higher throughput with less overhead, ideal for scenarios where deep inspection is unnecessary.

Use Case:

• Packet Mode is generally used for Layer 3 forwarding in trusted networks where security filtering and inspection are not critical. Examples include traffic on a secure internal segment or traffic passing through VPN tunnels that do not require session-based inspection.
•  

Flow Mode (Stateful Inspection)

In Flow Mode, the SRX firewall inspects traffic by analyzing and tracking complete sessions. This mode provides more advanced security mechanisms and is the default operating mode for Juniper SRX firewalls.

• Stateful: Traffic is analyzed on a per-flow basis, meaning the firewall creates sessions that track the state of the connection (e.g., TCP handshake, UDP sessions). The session table maintains information about active flows.
• Security Features: Flow Mode enables features like Unified Threat Management (UTM), Intrusion Prevention System (IPS), deep packet inspection (DPI), application-level gateways (ALGs), and stateful firewalling.
• NAT: In Flow Mode, advanced NAT configurations (like Source NAT, Destination NAT, and Proxy ARP) are possible based on the session information.
• Policies: Security policies are applied at the session level, meaning actions like blocking or allowing traffic can be done more intelligently by looking at the entire flow.

Session Creation Process:

1. Packet enters the SRX device.
2. Lookup in the session table:

• If a session exists, it is matched, and the packet is forwarded.
• If no session exists, the device evaluates the first packet against security policies, zone checks, and routing decisions.

1. Once allowed, a session is created, and subsequent packets for that flow follow the same path.
2. On session termination (FIN, RST for TCP or timeout for UDP), the session is removed from the session table.