This article explains an issue where the BGP goes down suddenly on standalone SRX.

BGP connections and all the connectivity via SRX will go down and below given logs can be seen in the syslog messages.

alarmd[22241]: Alarm set: SESSION TABLE id=-2147483631, color=YELLOW, class=ETHER, reason=Flow session table is almost full on FPC 3 PIC 1

craftd[21611]: Minor alarm set, Flow session table is almost full on FPC 3 PIC 1

alarmd[22241]: Alarm set: SESSION TABLE id=-2147483631, color=YELLOW, class=ETHER, reason=Flow session table is almost full on FPC 2 PIC 1

craftd[21611]: Minor alarm set, Flow session table is almost full on FPC 2 PIC 1

RT_FLOW: FLOW_RESOURCE_CHANGE: Flow resource session table is full

RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer xx.xx.xx.xx (External AS xxxxx) changed state from Established to Idle

This issue can be caused by the denial of service attacks, as we observe the sudden resource exhaustion like PFE CPU and session table on the SRX. This issue can be avoided by configuring the junOS screen options on SRX like the TCP flood screens and UDP flood screens. These screens will protect the SRX from any flood attacks and also will help you to identify the source from where the attack is initiated. You can use the below given Juniper tech document for configuring screens:

https://www.juniper.net/documentation/us/en/software/junos/denial-of-service/topics/topic-map/security-introduction-to-adp.html

After the source is identified, you can use the firewall filters on SRX to block all the traffic from the attacker.