View Only
last person joined: yesterday 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  packet mode and flow mode

    Posted 04-13-2012 00:30

    Hi Guys


    I have run into a small problem and im hoping the forum could shed some light and point me in the right direction.


    I need to setup packet-mode for a particular range of public IP's


    I have setup a prefix-list that refrences the public IP's


    I have setup a firewall filter from source to destination(prefix-list) then packet-mode


    I have then bound the filter to both interfaces. Ge-0/0/0 and Ge-0/0/3


    I have attached a diagram and the config of the SRX220




    Once i applied the config, we could ping the servers from the internet. 

    Voice services were working like a dream

    sho firewall command indicated the filter was being hit





    We could not connect to any TCP services on the prefic-list. But yet UDP traffic was working well.

    port 80 was not responding

    port 5900 - not responding

    SSH - not responding


    Seems like TCP was being blocked for some reason.........

    Has anyone else had the same problem? am i doing something wrong


    Let me know











    CONFIG.txt   8 KB 1 version

  • 2.  RE: packet mode and flow mode

    Posted 04-13-2012 01:24



    If possible, could you please provide the flow trace output  for the problematic traffic - that would help in speedy resolution . 


    set security flow traceoptions file testing

    set security flow traceoptions flag all  ( not basic-datapath)

    se security flow traceoptions packet-filter 1 source-prefix x.x.x.x desitnation-prefix y.y.y.y protocol tcp

    set security flow traceoptions packet-filter 2 source-prefix y.y.y.y destination-prefix x.x.x.x protcol tcp


    Initiate one TCP flow and   provide the output of  "show log testing | no-more" .


  • 3.  RE: packet mode and flow mode

    Posted 04-13-2012 01:32

    Hi Pardeep


    i will as soon as i get a change window.


    do you think it might be because the interfaces are assigned to zones?


    As soon as we get another change window, ill setup the trace and post the output


    Currently the firewall is is full packet-mode


    set security fowarding options family mpls mode packet-based

  • 4.  RE: packet mode and flow mode
    Best Answer

    Posted 04-13-2012 04:12

    Hi ,


    I think , as you have applied the same filter on ge-0/0/0 and ge-0/0/3 , for tcp connections initiated from Internet , first packet (SYN) will match firewall filter applied on ge-0/0/0 and processed in packet modei,e bypass flow module . the reply (SYN+ACK) fom the server in DMZ will come on ge-0/0/3 interface and does NOT match firewall filter main term (because for this packet, the destination is NOT the MIA prefix list) and it matches term 2 and will be processed by flow module . during this flow processing (first path processing)  , and  it might be dropped by SRX, as the first packet is not a syn .


    so removing the filter on ge-0/0/3 might help or apply a different filter with correct match conditions.

  • 5.  RE: packet mode and flow mode

    Posted 04-13-2012 04:42

    Hi There


    correct - i should have show my latest config.....sorry


    i realised that too - so i then created a reverse filter for source (porefix-list and destination 0/0 and then bound it to ge-0/0/3


    same problem........TCP traffic would not pass through



    ill setup a trace when we get a change window..



    TX for the help so far

  • 6.  RE: packet mode and flow mode

    Posted 04-13-2012 06:45

    Hi ,


    Just one more thing - how did you apply the firewall filters on these interfaces ? in both input and output directions(as shown in your current config)  or only input direction ? 


    If we apply the same filter  in both directions(input ,output) on the same interface , i think that will create an issue again . 


    You may try by applying the two filters configured on the respective interfaces only in the input direction .

  • 7.  RE: packet mode and flow mode

    Posted 04-14-2012 11:44

    Hi There


    I have moved to the new config and all seems to be working fine - i now have and input filter on ge-0/0/0 and an inout filter on ge-0/0/3


    we have tested and now TCP works.......everything works




    TX for your help