This article explains the reasons why reverse SCTP traffic is being dropped or denied by the default policy.

The packet will be dropped due to the deny policy, as shown below:

Sep 12 06:58:44 06:58:44.616411:CID-01:FPC-00:PIC-03:THREAD_ID-09:LSYS_ID-00:RT: packet dropped, policy deny.
Sep 12 06:58:44 06:58:44.616430:CID-01:FPC-00:PIC-03:THREAD_ID-09:LSYS_ID-00:RT:flow_initiate_first_path: first pak no session
Sep 12 06:58:44 06:58:44.616435:CID-01:FPC-00:PIC-03:THREAD_ID-09:LSYS_ID-00:RT: flow find session returns error.
Sep 12 06:58:44 06:58:44.616439:CID-01:FPC-00:PIC-03:THREAD_ID-09:LSYS_ID-00:RT:flow_proc_rc: -1.

Starting with Junos OS Release 15.1X49-D40 and Junos OS Release 17.3R1, tag-based hash distribution is used to address the load-balancing issue. This ensures that SCTP traffic from different associations is evenly distributed across all SPUs. A 32-bit connection tag, known as the vTag, is introduced to uniquely identify SCTP sessions. If the connection tag is not used, the connection ID remains 0.

As a result, security policies are now required in both directions to allow separate SCTP flow sessions to be created for each direction. Both the INIT and INIT-ACK messages now establish their own sessions.

For more details, please refer to the following document: SCTP Overview