By default, J Series and SRX Series devices running JUNOS Software use flow-based forwarding. You can change the context in which your device is running from secure context (using flow-based forwarding) to router context (using packet-based forwarding) by using a predefined template configuration file. Switching between secure and router contexts does allow you both packet-based and flow-based forwarding, but you have to choose one or the other forwarding mode.
Selective stateless packet-based services allow you to have both flow-based and packet-based services simultaneously on a system. This is achieved by configuring stateless firewall filters (ACLs) that allow you to bypass flow-based (stateful) forwarding. Bypassing flow-based forwarding is useful for deployments where you explicitly want to avoid flow session-scaling constraints.
Figure 14 shows traffic flow with selective stateless packet-based services bypassing flow-based processing.
Figure 14: Traffic Flow with Selective Stateless Packet-Based Services
When the packet comes in on an interface, the input packet filters configured on the interface are applied.
Packets arriving on interfaces where you have not applied the firewall filter will follow the default flow-based forwarding option.
A defined set of stateless services is available with selective stateless packet-based services:
The following security features are not supported with selective stateless packet-based services—stateful firewall NAT, IPsec VPN, DOS screens, J-flow traffic analysis, WXC integrated security module, security policies, zones, attack detection and prevention, PKI, ALGs, and chassis cluster.