Post upgrade to 22.4R3-S5, selective stateless packet-based service as configured below is not working.

https://www.juniper.net/documentation/us/en/software/junos/flow-packet-processing/topics/topic-map/security-packet-based-forwarding.html#id-example-configuring-selective-stateless-packet-based-services-for-packet-based-to-flow-based-forwarding

Packet drops seen on the SRX trace-options

: no session found, start first path. in_tunnel - 0x0, from_cp_flag - 0

: packet dropped, Incoming zone check failed

: flow find session returns error.

:flow_proc_rc: -1.

: ---- flow_process_pkt rc 0x7 (fp rc -1)

The issue is seen while upgrading SRX post 22.4R3-S3 and above.

If MPLS mode was not set to flow, the traffic coming over the lsi/lt interface was made to bypass the flow by default before 22.4R3-S3 release.

However based on the change in behaviour post 22.4R3-S3, to make selective packet mode work for lsi/lt interface, we need to attach filter to the vrf as shown below:

set routing-instances <VRF> forwarding-options family inet filter input inet inet-nonlocal-packet-mode