This article describes about the reason which BGP over IPSEC is not establishing when the peer device is Palo-Alto

When the peer device sends payload with extra padded bytes, which creates discrepancies between the outer IP length and inner IP length. Hence SRX will drop the packet with error: Decap invalid padding.

We can find the packet-drops  using the command "monitor security packet-drops"

20:23:52.979552:LSYS-ID-00 10.0.0.19/0-->10.0.0.7/0;esp,ipid-38555,N/A,Dropped by PMI:Decap invalid padding

20:23:46.548855:LSYS-ID-00 10.0.0.19/0-->10.0.0.7/0;esp,ipid-38552,N/A,Dropped by PMI:Decap invalid padding

20:23:42.517017:LSYS-ID-00 10.0.0.19/0-->10.0.0.7/0;esp,ipid-38553,N/A,Dropped by PMI:Decap invalid padding

The issue is resolved in the below version:

junos:22.4R3-S4 junos:24.4R1

Workaround is to disable the PMI, shall use the below command to disable PMI:

"set security flow power-mode-disable"