This issue occurs when PMI and L2 switch mode are enabled simultaneously with an IRB interface, ssh getting timed out over the IRB interface. Ping and FTP traffic are working, but SSH is not. The SRX as a middle device, does not transmit the packet out. The packet is processing by PMI fast path.

Non-Working flow trace: (service side miss the ACK packet )

Sep 24 05:33:34 05:33:33.989725:CID-0:THREAD_ID-02:LSYS_ID-00:RT: Got ack, 10.10.10.100(53378)->10.100.86.34(22), natpflag 0x40, nspflag 0x201021, 0x201020, timeout=900

Sep 24 05:33:34 05:33:33.989727:CID-0:THREAD_ID-02:LSYS_ID-00:RT:flow_tcp_proc_vector_(5269), c->s.

Sep 24 05:33:34 05:33:33.989727:CID-0:THREAD_ID-02:LSYS_ID-00:RT:flow_adjust_tcp_pak_seq_ack_num(4789), seq: 0x7fef116b, ack: 0xc137a103, nsp diff: 0x0/0x0, nsp2 diff: 0x0/0x0.

Sep 24 05:33:34 05:33:33.989728:CID-0:THREAD_ID-02:LSYS_ID-00:RT:flow_dscp_vector: natp 0x28d6eeb00 dscp 0x0

On SRX1500/SRX1600/SRX2300/SRX4K/SRX5K platforms with PMI (PowerMode IPsec) enabled, IRB (Integrated Routing and Bridging) traffic in Layer 2 switch mode is not supported, resulting in packet drops.

Junos 23.4R2-S4, 24.2R2, 24.4R1, 25.1R1 fix the issue.

Or disable PMI.

#set security flow power-mode-disable 

#commit