This article explains the error message: "Dropped by FLOW: First path NSP2 installation failed" and provides information on the reasons behind packet drops and potential solutions.

Packet drops can be verified using the command monitor security packet-drop, as shown below:

10:15:42.123456:LSYS-ID-00 172.16.20.1/1-->192.168.2.1/1;61,ipid-0,st0.0,Dropped by FLOW: First path nsp2 install failed  

This issue occurs when the reply packet does not match the same flow, causing a new session to be created. However, when the reverse wing is installed, it matches the existing wing, leading to packet drops.

For example, if both primary and secondary ISP tunnels are configured on an SRX device, and the first packet is forwarded through the primary tunnel while the reply is received through the secondary tunnel, the reply packet will attempt to establish a new session. This attempt fails, resulting in the observed error.

To resolve this issue, ensure that reply packets are received on the same interface as the original request and that the network does not have any asymmetric routing issues.