This article covers a specific scenario where syslog over TLS on MX480 is not working due to incomplete TCP 3-way handshake between Juniper MX and syslog server.

Packet capture on juniper and 'show system connection' will show TCP 3-way handshake is not complete.

1. Review if the syslog server configuration on juniper router is correctly configured. Refer KB: KB75040 [juniper.net].

2. TLS rides on top of TCP layer. Hence, TLS session between Juniper and syslog server will begin after TCP 3-way handshake is complete.

• In this specific scenario where TCP 3-way handshake communication between Juniper and syslog server does not established.
• Juniper must send SYN to syslog server, receive SYN-ACK from syslog server and finally send ACK to syslog server.

3. Tools like Packet capture and Firewall filter counters will help to narrow the issue.

• Capture the TCP packet on the juniper interface which is sourcing the syslog packets. (example, lo0, fxp, physical interfaces)

> monitor traffic interface <interface name> size 1500 write-file /var/tmp/capture.pcap

4. Implement a firewall filter counter to see if counter incrementing with desired TCP flow.

  set interfaces lo0 unit 0 family inet filter input FF-PROTECT-RE
  set firewall family inet filter FF-PROTECT-RE term term-1 from source-address <Syslog_Server_IP>
  set firewall family inet filter FF-PROTECT-RE term term-1 from protocol tcp
  set firewall family inet filter FF-PROTECT-RE term term-1 from port <Syslog_Port_number>
  set firewall family inet filter FF-PROTECT-RE term term-1 then count Syslog_Count
  set firewall family inet filter FF-PROTECT-RE term term-1 then accept

• If somehow any of above is not going through then re-evaluate if there is any Firewall filter that is dropping the packet going out or coming in, then validate by deactivating the FF temporarily to see if TCP establishes and modify it FF to correctly match the TCP flow.