This article aims to explain the meaning of packet drop error "Incoming-zone-check-failed" and how to solve it.
Consider the following topology:
ICMP (ping) packet between 192.168.90.2 and 172.16.10.2 is getting dropped at the SRX firewall. During troubleshooting flow traceoptions were configured and provided the following output:
Apr 4 17:39:51 17:39:51.738340:CID-0:THREAD_ID-01:LSYS_ID-00:RT:~~~FLOW <192.168.90.2/1->172.16.10.2/8259;1,0x0> matched filter C2S(0) of root-logical-system for iif ge-0/0/0.0:
Apr 4 17:39:51 17:39:51.738344:CID-0:THREAD_ID-01:LSYS_ID-00:RT:packet [60] ipid = 14076, @0x984e9d4e
Apr 4 17:39:51 17:39:51.738345:CID-0:THREAD_ID-01:LSYS_ID-00:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 15, common flag 0x0, mbuf 0x70f20800, rtbl_idx = 0
Apr 4 17:39:51 17:39:51.738347:CID-0:THREAD_ID-01:LSYS_ID-00:RT: flow process pak fast ifl 72 in_ifp ge-0/0/0.0
Apr 4 17:39:51 17:39:51.738349:CID-0:THREAD_ID-01:LSYS_ID-00:RT: ge-0/0/0.0:192.168.90.2->172.16.10.2, icmp, (8/0)
Apr 4 17:39:51 17:39:51.738351:CID-0:THREAD_ID-01:LSYS_ID-00:RT: find flow: table 0x2a535040, hash 33411(0xffff), sa 192.168.90.2, da 172.16.10.2, sp 1, dp 8259, pr oto 1, tok 0, conn-tag 0x00000000, vrf-grp-id 0
Apr 4 17:39:51 17:39:51.738356:CID-0:THREAD_ID-01:LSYS_ID-00:RT: no session found, start first path. in_tunnel - 0x0, from_cp_flag - 0
Apr 4 17:39:51 17:39:51.738357:CID-0:THREAD_ID-01:LSYS_ID-00:RT: packet dropped, Incoming zone check failed
Apr 4 17:39:51 17:39:51.738358:CID-0:THREAD_ID-01:LSYS_ID-00:RT: flow find session returns error.
Apr 4 17:39:51 17:39:51.738359:CID-0:THREAD_ID-01:LSYS_ID-00:RT:flow_proc_rc: -1.
Apr 4 17:39:51 17:39:51.738360:CID-0:THREAD_ID-01:LSYS_ID-00:RT: ---- flow_process_pkt rc 0x7 (fp rc -1)
The ping ingress interface is ge-0/0/0, and it is not part of a security zone; to resolve the error, add the ge-0/0/0 interface to a security zone, otherwise it will be assigned to the default "null zone" and will neither receive nor send traffic. For example:
set security zones security-zone TRUST interfaces ge-0/0/0.0
2024-12-03 Article Created
For information about how to configure SRX flow traceoptions please visit: https://supportportal.juniper.net/s/article/SRX-How-to-use-flow-traceoptions-and-security-datapath-debug