This article describes the troubleshooting steps to identify if the return packets are received on the firewall.

Source PC is unable to access the server.

Traffic is passing through the SRX

Here we have to isolate that if the SRX is processing the packets correctly.

1.Take the flow session and identify if we are receiving the packets from the source.

"show security flow session source-prefix <source-IP> destination-prefix <destination-IP> "

Session ID: 40006, Policy name: test/4, Timeout: 1792, Session State: Valid
 In: 10.20.20.12/53382 --> 20.198.119.143/443;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 5268, Bytes: 398179, >> Incoming packet from source
 Out: 20.198.119.143/443 --> 10.219.65.82/25069;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 3518, Bytes: 473232,

2. Check if we are receiving the return packets.

Session ID: 40006, Policy name: test/4, Timeout: 1792, Session State: Valid
 In: 10.20.20.12/53382 --> 20.198.119.143/443;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 5268, Bytes: 398179,
 Out: 20.198.119.143/443 --> 10.20.20.12/25069;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 3518, Bytes: 473232, >> Return packet from the destination.

3. Check if the packets are hitting the desired policy.

Session ID: 40006, Policy name: test/4, Timeout: 1792, Session State: Valid >>>>> Policy name "test"
 In: 10.20.20.12/53382 --> 20.198.119.143/443;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 5268, Bytes: 398179, >> ge-0/0/1 is the ingress interface of SRX
 Out: 20.198.119.143/443 --> 10.219.65.82/25069;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 3518, Bytes: 473232, >>>ge-0/0/2 is the egress interface of SRX.

If the incoming bytes are 0 rather than a value, it could be either SRX is not receiving the packets or We are dropping it.

To verify if we are dropping it or not even receiving it, take a flow trace to further check.

set security flow ​traceoptions file JTAC-TRACE size 10m files 10
set security flow traceoptions flag basic-datapath
set security flow traceoptions flag packet-drops
set security flow traceoptions packet-filter out-pac source-prefix 10.20.20.12
set security flow traceoptions packet-filter out-pac destination-prefix 20.198.119.143
set security flow traceoptions packet-filter in-pac source-prefix 20.198.119.143
set security flow traceoptions packet-filter in-pac destination-prefix 10.20.20.12
commit and quit

You can use the below commands to check if there are any return packets:
show log JTAC-TRACE | match in-pac
show log JTAC-TRACE | match matched

You can use the below commands to check if there are any drops:
show log JTAC-TRACE | match drop

In case if packet is dropping and you require to troubleshoot the issue, please raise JTAC case.