Description

The default behavior for the SRX firewall is when a TCP connection with a 4-way close finishes, the session will generally have one tick left remaining before the session completely ages out. During this period, packets for a new connection (ie, SYN) with the same 5-tuples (src ip/port, dst ip/port, and protocol) may pass through the firewall if they pass the SEQ check.

 

However, if the session within the firewall is in a FIN state, the behavior is to drop all packets with a SYN flag. Only SYN packets for new connection with same 5-tuples will success after this session state set to invalid state.

Symptoms

Packets are getting dropped within the security flow due to the aforementioned reason.  The following example is from the packet-drop buffer:
  
user@SRX> monitor security packet-drop destination-port 7001 source-prefix 10.10.10.100
Starting packet drop:
16:23:12.015173:LSYS-ID-00 10.10.10.100/60538-->20.20.20.100/7001;tcp,ipid-12430,reth0.0,Dropped by FLOW:Tcp fin state syn packet

At the same time, a packet capture may show that a TCP port number is being reused and carrying a new SYN packet sent by the client to its destination and are getting dropped by the SRX.  E.g., a SYN packet coming into the Fireall with the announcement that it is reusing a tcp port:
  
10.10.10.100 20.20.20.100 [TCP Port numbers reused] 42672 → 7001 [SYN] Seq=0 Win=21300 Len=0 MSS=1400 SACK_PERM TSval=3898237247 TSecr=0 WS=128

 

Solution

Sometimes the request to the server for closing a session is not complete and can cause the firewall to not close a session.  In the above example output, when the client sends a TCP port number reused SYN packet to server, this SYN packet gets dropped in firewall.

A potential way to mitigate the issue is to configure the flow knob: fin-invalidate-session" to help avoid this issue from occurring.
  
set security flow tcp-session fin-invalidate-session

More information concerning this knob is provided at the following techdoc: https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/fin-invalidate-session-edit-security-flow-tcp-session.html

Modification History

2024-10-03 : Article Created