SRX is not allowing to establish SCTP association as the 4th packet of the four-way handshake gets dropped if it contains COOKIE ACK and SHUTDOWN chunks in the same packet.

When SCTP inspection is used, and the COOKIE ACK chunk is bundled together with the SHUTDOWN chunk in a single packet, this packet is dropped by the SRX firewall, and the following log message is recorded:

vSRX01 mobile-sec: RT_SCTP_CTL_MSG_COOKIE_ACK: chunk_len=4,src=10.0.0.1/1234,dst=10.0.1.1/5678,verification_tag=0x00001234,result=DROP,drop_reason=sctp chunks layout error: COOKIE-ACK chunks is followed by non-SACK CONTROL chunk.

Although there might be other vendor implementations which allow this combination of chunks, Junos OS currently does not allow to combine COOKIE ACK chunk with SHUTDOWN chunk in the same packet.