when firewall filter is configured to perform selective packet mode (flow mode for BGP and all other traffic packet mode), TCP syn-ack packets are discarded by the flow module, as a result it causes BGP to stay down.

Sample trigger configuration ->

- Firewall filter configured to perform selective packet mode:

set firewall family inet filter inet-packet-mode term bgp-flow-mode from protocol tcp

set firewall family inet filter inet-packet-mode term bgp-flow-mode from port 179

set firewall family inet filter inet-packet-mode term bgp-flow-mode then count exempt-bgp

set firewall family inet filter inet-packet-mode term bgp-flow-mode then log

set firewall family inet filter inet-packet-mode term bgp-flow-mode then accept

set firewall family inet filter inet-packet-mode term packet-mode then log

set firewall family inet filter inet-packet-mode term packet-mode then packet-mode

- Filter added to routing instance:

set routing-instances RF forwarding-options family inet filter input inet-packet-mode?

- Traceoptions will show packet dropped due to first packet not sync  (set security flow traceoptions file tracelog)

> Show log tracelog

Mar 15 06:30:01 06:30:01.431396:CID-0:THREAD_ID-16:LSYS_ID-00:RT:  no session found, start first path. in_tunnel - 0x0, from_cp_flag - 0

Mar 15 06:30:01 06:30:01.431397:CID-0:THREAD_ID-16:LSYS_ID-00:RT:  packet dropped, first pak not syn

> monitor security packet-drop

08:01:29.411710:LSYS-ID-00 10.10.0.254/179-->10.10.0.253/54910;tcp,ipid-29054,.local..8,Dropped by FLOW:First path Pkt not syn

> show bgp summary 

Stuck in active state 

10.10.0.253          65501          0          0       0       0          11 Active

10.10.0.254          65000          0          0       0       0          11 Active

Workaround:-

Configure the 'no-syn-check' option using the command: "set security flow tcp-session no-syn-check"

Resolved in junos:24.4R2, junos:25.2R1