Technical Tip: How to fix the (SYN, ECE, CWR) packet when BGP over IPsec is not established.

The BGP may receive the following packet from the BGP peer while the remote peer is through an IPsec tunnel:

Internet Protocol Version 4, Src: 192.168.10.1, Dst: 172.16.1.12
Transmission Control Protocol, Src Port: 50351, Dst Port: 179, Seq: 0, Len: 0
    Source Port: 50351
    Destination Port: 179
    [Stream index: 1]
    [Conversation completeness: Incomplete, ESTABLISHED (7)]
    [TCP Segment Len: 0]
    Sequence Number: 0    (relative sequence number)
    Sequence Number (raw): 1833552113
    [Next Sequence Number: 1    (relative sequence number)]
    Acknowledgment Number: 0
    Acknowledgment number (raw): 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x0c2 (SYN, ECE, CWR)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Accurate ECN: Not set
        .... 1... .... = Congestion Window Reduced: Set
        .... .1.. .... = ECN-Echo: Set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ····CE····S·]
    Window: 64240
    [Calculated window size: 64240]
    Checksum: 0xb1b5 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted

This could be an NPU issue, so disabling NPU can be an option:

config vpn ipsec phase1

    edit phase-1-name

        set npu-offload disable

    end