This article provides information about IPsec packet loss issues that may occur after upgrading to Junos 21.4R3, along with steps to resolve the problem.

root# run show security flow status 

 Flow forwarding mode:

  Inet forwarding mode: flow based

  Inet6 forwarding mode: flow based

  MPLS forwarding mode: drop

  ISO forwarding mode: drop

  Tap mode: disabled (default)

  Enhanced services mode: Disabled

 Flow trace status

  Flow tracing status: off

 Flow session distribution

  Distribution mode: Hash-based

  GTP-U distribution: Disabled

  SCTP distribution: Enabled

 Flow ipsec performance acceleration: off

 Flow gre performance acceleration: off

 Flow packet ordering

  Ordering mode: Hardware

 Flow power mode: Enabled

 Flow power mode IPsec: Enabled

 Flow power mode IPsec QAT: Disabled

 Fat core group status: off

 Flow inline fpga crypto: Disabled

Starting with Junos version 21.3R1, PMI (Power-mode) is enabled by default. On SRX4K series and vSRX platforms with PMI enabled, IPsec packets containing small IP packets (less than 64 bytes) may be dropped when transmitted through IPsec tunnels.

This issue has been resolved in the following Junos versions: 21.2R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R3, 23.1R2, 23.2R1, and 23.3R1.

For more information about the PR, check the PR1692885