hi. just to close the loop on this issue - my configuration was correct. i opened a case with JTAC and we narrowed it down to the PFE being stupid. once we restarted the PFE proc the packets arrived at my proxy as desired. thanks to those who helped, and hopefully this helps someone else in the future! a very frustrating few days, indeed.