Prove the SRX is working — first tool + proof field

1. Why “is it working?” is five questions

Operators collapse five failures into one sentence. The first packet never matched a from-zone/to-zone policy. The session formed and Out Pkts stayed 0. The node you logged into is not the redundancy-group primary. Phase 2 never installed. The first-path drop is only in a scoped flow trace. Those are five first tools.

This page is the night-shift desk for proof. The factory taught zone → policy → NAT → session. Here you learn the five tools you actually open, in order, when someone asks you to prove the SRX is working.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you type. Each tool is allowed to prove one thing. Over-claiming a field is how you ship a bad commit at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open the policy book until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the console. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the live session (CLI or J-Web). Side B proves what the box logged. Side C proves the plane, the SA, or the first-path miss. On a messy Sev-2, do them in this order until a field lights up.

Side A — Live session (CLI + J-Web)

1. Filter the 5-tuple. Do not dump the whole table.

   Operational mode. Official filters include destination-prefix, destination-port, source-prefix, source-port, protocol, interface, policy-id, session-identifier, and node on a cluster. Privilege: view. Source: Junos OS — show security flow session.

2. Quote the four fields that close a “firewall is blocking” ticket

   Session ID — number that identifies the session; use it with show security flow session session-identifier or extensive. Policy name — name and ID of the policy that the first packet matched. In — incoming flow (addresses, protocol, If, Pkts, Bytes). Out — reverse flow, same counters. Source: same CLI reference, Output Fields table.

3. Read In/Out before you touch policy

   If Policy name is a permit and Out Pkts is 0, the factory already allowed the flow. Isolate return path (route, ARP, NAT rewrite on the Out line). If there is no session, do not stay in Side A — go to Side B for RT_FLOW_SESSION_DENY.

4. Same table in J-Web if that is all they will accept

   Official J-Web: Monitor → Security → Flow Session. On SRX5400 / SRX5600 / SRX5800 the same page is documented as Monitor → Security → Flow Session Statistics. Quote the same CLI field names. J-Web is a view, not a commit. Source: Junos J-Web Help — Monitoring Flow Session Statistics.

Session ID: 1042, Policy name: allow-app/4, Timeout: 1800, Valid
  In: 10.10.8.22/51901 --> 198.51.100.80/443;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 12, Bytes: 1880
  Out: 198.51.100.80/443 --> 203.0.113.20/18422;tcp, If: ge-0/0/0.0, Pkts: 0, Bytes: 0
Total sessions: 1

Side B — Structured syslog (create / close / deny)

1. Know what the policy is allowed to write

   Session log entries are tied to policy configuration. Each main session event — create, close, and deny — creates a log entry if the controlling policy has logging enabled. Configure then log session-init and/or then log session-close. Official note: for the default-permit security policy, RT_FLOW traffic logs are generated when a session ends; session-init is optional. A deny never creates a session, so you need session-init (or a logged explicit deny) to see RT_FLOW_SESSION_DENY. Source: Junos OS — Monitoring Security Flow Sessions, “Information Provided in Session Log Entries.”

2. Prefer structured-data so the field names are on the wire

   Security logs can be BSD syslog, structured syslog, or WELF. Structured form is what SIEM parsers expect: RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.26 source-address="…" …]. On-box: show log <filename> — files live under /var/log/. Source: Junos OS — Configure System Logging for Security Devices.

3. Quote the fields that close the ticket

   Create: policy-name, session-id-32, source-zone-name, destination-zone-name, nat-source-address, src-nat-rule-name, packet-incoming-interface. Close: add reason, packets-from-client, bytes-from-client, packets-from-server, bytes-from-server, elapsed-time. Deny: policy-name is “the name of the policy that denied the session creation” plus reason. Source: same session-log tables.

RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.26
  source-address="10.10.8.22" source-port="51901"
  destination-address="198.51.100.80" destination-port="443"
  service-name="junos-https"
  nat-source-address="203.0.113.20" nat-source-port="18422"
  nat-destination-address="198.51.100.80" nat-destination-port="443"
  src-nat-rule-name="PAT-OUT" dst-nat-rule-name="None" protocol-id="6"
  policy-name="allow-app" source-zone-name="trust" destination-zone-name="untrust"
  session-id-32="1042" packet-incoming-interface="ge-0/0/1.0"]

RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.26
  reason="TCP FIN" … session-id-32="1042"
  packets-from-client="12" bytes-from-client="1880"
  packets-from-server="0" bytes-from-server="0" elapsed-time="18"
  packet-incoming-interface="ge-0/0/1.0"]

RT_FLOW - RT_FLOW_SESSION_DENY [junos@2636.1.1.1.2.26
  source-address="10.10.8.22" destination-address="198.51.100.80"
  destination-port="443" service-name="junos-https" protocol-id="6"
  policy-name="None" source-zone-name="trust" destination-zone-name="untrust"
  reason="policy deny" session-id-32="0"
  packet-incoming-interface="ge-0/0/2.0"]

Side C — Plane, SA, or first-path trace

1. Name the redundancy group before you trust an empty table

   show chassis cluster status (optional redundancy-group <n>). Quote Cluster ID, Redundancy-Group, node (node0 / node1), Priority, Status (Primary — active and passing traffic; Secondary — passive; Lost — control-link contact lost; Unavailable — no heartbeat since the peer booted), Preempt, Manual failover, Monitor-failures. Official: a redundancy group is primary on one node and secondary on the peer. RG0 and RG1+ can differ. Source: Junos OS — show chassis cluster status Output Fields.

2. If the ticket is a site-to-site VPN, prove the SA, not the internet policy

   First show security ike security-associations. Official meaning: Remote Address must be the peer; State UP means the IKE SA is established; DOWN (or no row) means Phase 1 failed. Then show security ipsec security-associations. Quote ID (use it with index / detail), Gateway, Port (500, or 4500 if NAT-T), VPN name, State Installed / Not Installed, Local gateway / Remote gateway, Bind-interface. If the remote gateway is not listed, the IPsec SA is not active. Source: Junos OS — Troubleshoot a VPN Tunnel That is Down; show security ipsec security-associations.

3. Last resort: scoped flow trace, then tear it down

   Official hierarchy: edit security flow traceoptions. Set file (under /var/log), flag basic-datapath (and session if you need create/delete), and a packet-filter using destination-prefix, destination-port, source-prefix, source-port, protocol, interface. trace-level brief is documented for policy match and packet drop reasons. Then show log <file>. Official caution: tracing can impact scale and security — disable immediately after collection. Operational alternative: monitor security flow filter + file + start / stop — no commit, but it cannot run in parallel with flow traceoptions. Source: Junos OS — traceoptions (Security Flow); Configure Data Path Debugging; Monitoring Security Flow Sessions Overview.

show chassis cluster status
Cluster ID: 1
Node                  Priority Status         Preempt Manual failover
Redundancy group: 0 , Failover count: 1
    node0                  200 primary             no      no
    node1                  100 secondary           no      no
Redundancy group: 1 , Failover count: 1
    node0                  200 primary             no      no
    node1                  100 secondary           no      no

show security ike security-associations
Index   State  Mode           Remote Address
1       UP     IKEv2          203.0.113.50

show security ipsec security-associations
Total active tunnels: 1
  ID     Algorithm           SPI      Life:sec/kb  Mon  Port  Gateway
  131073 ESP:aes-256/sha256  …        28744/unlim   -    500   203.0.113.50

show security ipsec security-associations index 131073 detail
  VPN name: BRANCH-VPN
  State: Installed
  Local gateway: 203.0.113.1
  Remote gateway: 203.0.113.50
  Bind-interface: st0.0

edit security flow traceoptions
set file flow-trace size 10m files 3
set flag basic-datapath
set packet-filter FINANCE-443 protocol tcp
set packet-filter FINANCE-443 destination-prefix 198.51.100.80/32
set packet-filter FINANCE-443 destination-port 443
commit
… reproduce one flow …
show log flow-trace
deactivate security flow traceoptions
commit

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and addresses below are lab-only.

Journey · one zero Out is the ticket

SRX-EVD-01 — Prove the live session (In / Out)

02:14 · P2. Browser spins to 198.51.100.80. L1 already cloned allow-app. Someone wants a third permit.

First tool: show security flow session destination-prefix 198.51.100.80 destination-port 443.

Proof field: Session ID 1042, Policy name allow-app/4, In Pkts 12, Out Pkts 0, Out dest 203.0.113.20 (interface PAT). That is a return-path isolate, not a policy miss. Next isolate commands — still read-only — are the route and ARP for the next hop, and show security nat source rule only to confirm Action and hits, not to disable PAT.

SRX-EVD-02 — Prove the deny (RT_FLOW_SESSION_DENY)

02:28 · P2. A VLAN cutover at 01:00. Policy book still shows allow-app from trust to untrust. No session forms. L1 wants permit any any.

First tool: structured log / show log filtered on RT_FLOW_SESSION_DENY for that source and UTC window. J-Web: Monitor → Logs → All Events, event family RT_FLOW.

Proof field: policy-name (officially: the policy that denied session creation — often None on implicit deny), reason = policy deny, source-zone-name / destination-zone-name, packet-incoming-interface. If the cutover put the user VLAN on ge-0/0/2.0 in another zone, this context is the wrong book. Redraw show security zones before you edit trust→untrust.

SRX-EVD-03 — Prove the plane (chassis cluster)

02:40 · P1. After a power event, apps fail. Someone says “fail back to node0.” You have not named a redundancy group.

First tool: show chassis cluster status.

Proof field: Redundancy-Group 0 and 1, each node’s Status, Preempt, Manual failover. “node0 is primary” without a group name is a junior answer — RG0 (RE) and RG1+ (data) can have different primaries. Official Lost vs Unavailable are different control-link stories. Manual failover of RG0 is documented change-control with process-restart risk — not a night-shift reboot.

SRX-EVD-04 — Prove the SA (IKE + IPsec)

02:55 · P1. Branch prefix via st0.0 died after a 02:00 peer change. L1 wants a new trust→untrust permit for the branch net.

First tool: show security ike security-associations, then show security ipsec security-associations. If the remote gateway is missing, the IPsec SA is not active — official VPN-down runbook.

Proof field: IKE State UP or DOWN + Remote Address. IPsec ID, Gateway, Port (500 vs 4500), State Installed, VPN name, Bind-interface. An Installed SA with zero flow sessions is a route / traffic-selector / proxy-id ticket, not a missing internet permit. A missing IKE row is Phase 1 (proposal, PSK, UDP 500/4500) — isolate toward the peer, not the policy book.

SRX-EVD-05 — Prove the first path (traceoptions)

03:10 · P2. Empty session table. Empty RT_FLOW_SESSION_DENY (logging was never set on the implicit deny). Policy text looks right. Someone typed Sev-1.

First tool: a scoped security flow traceoptions packet-filter with flag basic-datapath, or operational monitor security flow if you do not want a commit. Official filter keys: destination-prefix / destination-port / protocol (and source / interface if you have them). Official trace-level brief is the drop-reason view.

Proof field: the first-path line that names why the packet died (zone, policy lookup, route, NAT). Then deactivate security flow traceoptions and commit — or monitor security flow stop. Leaving flag all without a filter is how you melt a production SRX.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Junos OS — show security flow session (Session ID, Policy name, In, Out, If, Pkts, Bytes, Timeout, State, filters including destination-prefix, session-identifier, node)
• Junos OS — Monitoring Security Flow Sessions (filters; monitor security flow start/stop; cannot run in parallel with flow traceoptions; session-init / session-close; structured RT_FLOW_SESSION_CREATE / CLOSE / DENY fields including policy-name, session-id-32, reason, packets-from-client, packets-from-server, packet-incoming-interface)
• Junos OS — Configure System Logging for Security Devices (BSD / structured syslog / WELF; default-permit generates RT_FLOW on session end; J-Web Monitor → Reports → Traffic)
• Junos OS — traceoptions (Security Flow) (packet-filter keys; flag basic-datapath / session; trace-level brief for policy match and packet drop reasons; official disable caution)
• Junos OS — Configure Data Path Debugging and Trace Options (flow traceoptions packet-filter combinations)
• Junos OS — show chassis cluster status (Cluster ID, Redundancy-Group, Priority, Status Primary / Secondary / Lost / Unavailable, Preempt, Manual failover, Monitor-failures)
• Junos OS — Chassis Cluster Redundancy Groups
• Junos OS — Chassis Cluster Redundancy Group Failover (primary on one node, secondary on the peer; request chassis cluster failover)
• Junos OS — show security ipsec security-associations (ID, Gateway, Port, State Installed, VPN name, Local gateway / Remote gateway, Bind-interface, Mon)
• Junos OS — show security ike security-associations
• Junos OS — Troubleshoot a VPN Tunnel That is Down (missing remote gateway ⇒ IPsec SA not active; IKE State UP / DOWN)
• Junos J-Web Help — Monitoring Flow Session Statistics (Monitor → Security → Flow Session Statistics on SRX5400/5600/5800; Monitor → Security → Flow Session on other SRX)
• Junos OS — Configuring Security Policies (session-init / session-close logging notes)
• Junos OS — Source NAT
• Junos OS — Security Zones

Related: Blog 1 · SRX session factory · SRX architecture — planes, zones, commit · Juniper SRX practice hub · All lessons