How to understand Juniper SRX flow creation

With help from our service provider we've been able to localise the problem. The idea I had in my last comment proved correct: the difference between fast ethernet and gigabit ethernet was the source of the problem.

The reason for dropping connections, undeliverable packets and segmented packets was a mismatch in link mode between the fiber switch and the SRX - they hardcoded their port to 100m full duplex, but the SRX had automatic negotiation, which resolved to 100m half duplex.

The problem was further complicated by Juniper's odd configuration of speed and link mode. Just setting these configuration options wasn't enough:

speed 100m;
link-mode full-duplex;

This configuration was accepted, but when running show interfaces ge-0/0/0, it still showed:

Link-level type: Ethernet, MTU: 1514, Link-mode: Half-duplex, Speed: 100mbps,

Apparently, you have to explicitly disable auto-negotiation:

speed 100m;
link-mode full-duplex;
gigether-options {
    no-auto-negotiation;
}

In the end, I found that this guy had the exact same problem (and the solution!)

Thanks for all your help.

You are correct, these are not the same thing.

"Interface Filters" / Firewall Filters

The show interfaces filters command is used to show what firewall filters are applied to each interface, and in which direction. Firewall filters are supported on just about every Juniper hardware platform.

jhead@MX-WS-ZT-1> show interfaces filters ge-0/0/0
Interface       Admin Link Proto Input Filter         Output Filter
ge-0/0/0        up    up
ge-0/0/0.0      up    up   inet  MGMT

In a general sense, firewall filters are far less robust than the application firewall feature. They cannot do deep packet inspection (they operate on Layers 3 and 4), they can see things like source/destination IP or source/destination port. The most common use for firewall filters is to protect your control/management plane on a Juniper device, here's a very basic example on how to only allow SSH.

NOTE: Firewall filters are generally called ACL's by other vendors and the industry.

NOTE: Firewall filters can also be used in CoS configuration.

jhead@SRX1> show configuration firewall
    family inet {
        filter MGMT {
            term SSH {
                from {
                    port 22;
                }
                then accept;
            }
        }
    }

jhead@SRX1> show configuration interfaces ge-0/0/0
unit 0 {
    family inet {
        filter {
            input MGMT;
        }
        address 172.16.67.2/24;
    }
}

If you want some good information, check out the Juniper Documentation.

Application Firewall

The other command you referenced, show security application-firewall rule-sets all relates to SRX's application firewall feature.

The full feature set of application firewalls can get pretty unwieldy, but in short they do a much more thorough analysis of the traffic. If you check out the Application Firewall Overview you'll see the following text:

Many dynamic applications use HTTP static ports to tunnel non-HTTP traffic through the network. Such applications can send traffic that might not be adequately controlled by standard network firewall policies, leading to a security threat. Standard policies function based on IP address and port and therefore are not effective with these dynamic applications.

The reference to "standard network firewall policies" is pretty much a direct comparison to the above mentioned "firewall filters". Let me know if this isn't clear, and I'll happily edit my answer.