This article explains the reason for VPN tunnels going down, with the reason "Flow - First path nsp2 install failed." after upgrading to 19.4R3-S1

• The tunnels were down with the reason "No response from peer. Negotiation failed."
• From monitor security packet-drop, we observed that the SRX was dropping the response packet from the peer due to "First path nsp2 install failed."
• From security flow traceoptions, found that the response traffic was being processed by a user-specified security policy, then dropped by the flow as a reason failed to install nsp2.
• This occurred because there was an existing session with the same 5-tuple, causing a conflict.
• We deactivated the security policy, after which the VPNs came up successfully.
• No security policy is required for to-the-box traffic; only host-inbound services need to be allowed at the interface or zone level.