SRX

hi,

i am fighting with a second ipsec vpn tunnel since winter. we got a bigger internet line in the office, i configured a port for this on the office-srx100, all our internet traffic is using this now. we have a vpn to our data center, there is a cluster of two srx100/100H2 vpn endpoint. now i wanted to make a second tunnel to the data center over the new line, transfer all routes and then switch off the old tunnel. i did this before with pf-senses, but on juniper i just cannot understand how this should be done.

i copied the secrets from the config of the first to the second firewall, so this should be ok. what i dont understand is why tunnel1 endpoint from firewall 1 has a completely different secret than tunnel 1 endpoint on firewall2 and it still works. ???

my ( cleaned ) config at the moment, there were so many tries and changes the last 1/2 year i tried this that i cannot recall everything i did until now, i did not push every time:

firewall office:

interfaces {
   fe-0/0/0 {
        unit 0 {
            encapsulation ppp-over-ether;
        }
   }
    fe-0/0/7 {
        description Telekom;
        speed 100m;
        mtu 1492;
        link-mode full-duplex;
        fastether-options {
            no-auto-negotiation;
        }
        unit 0 {
            description "Feste IP";
            family inet {
                address 172.10.10.10/29;
            }
        }
     pp0 {
        traceoptions;
        unit 0 {
            apply-macro "telekom dsl";
            ppp-options {
                chap {
                    default-chap-secret "$9$/somesecretchap"";
                    local-name "fixed-ip-telekom";
                    no-rfc2486;
                    passive;
                }
                pap {
                    local-name "fixed-ip-telekom";
                    no-rfc2486;
                    local-password "$9$/somesecretchap";
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/0.0;
                idle-timeout 0;
                auto-reconnect 10;
            }
            family inet {
                mtu 1492;
                negotiate-address;
            }
        }
    }
    st0 {
        unit 0 {
            family inet {
                address 192.168.210.20/24;
            }
        }
        unit 1 {
            description MunichII;
            family inet {
                address 192.168.210.21/24;
            }
        }
    }
    ike {
        traceoptions {
            flag all;
            level 0;
        }
        policy ike_pol_wizard_dyn_vpn {
            mode aggressive;
            proposal-set compatible;
            pre-shared-key ascii-text "$9$xxxxxverylongpassword1";
        }
        policy ike-policy-cfgr {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$notsolongpassword1";
        }
        policy ike-policy-sdsl {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$notsolongpassword1";
        }
        gateway gw_wizard_dyn_vpn {
            ike-policy ike_pol_wizard_dyn_vpn;
            dynamic {
                hostname rt1;
                connections-limit 50;
                ike-user-type group-ike-id;
            }
            external-interface pp0.0;
            xauth access-profile remote_access_profile;
        }
        gateway ike-gate-cfgr {
            ike-policy ike-policy-cfgr;
            address 172.10.11.146;
            external-interface pp0.0;
        }
        gateway ike-gate-sdsl {
            ike-policy ike-policy-sdsl;
            address 172.10.11.146;
            external-interface fe-0/0/7.0;
        }
    }
    ipsec {
        policy ipsec_pol_wizard_dyn_vpn {
            proposal-set compatible;
        }
        policy ipsec-policy-cfgr {
            proposal-set standard;
        }
        policy ipsec-policy-sdsl {
            proposal-set standard;
        }
        vpn wizard_dyn_vpn {
            ike {
                gateway gw_wizard_dyn_vpn;
                ipsec-policy ipsec_pol_wizard_dyn_vpn;
            }
        }
        vpn ipsec-vpn-cfgr {
            bind-interface st0.0;
            ike {
                gateway ike-gate-cfgr;
                ipsec-policy ipsec-policy-cfgr;
            }
            establish-tunnels immediately;
        }
        vpn ipsec-vpn-sdsl {
            bind-interface st0.1;
            ike {
                gateway ike-gate-sdsl;
                ipsec-policy ipsec-policy-sdsl;
            }
            establish-tunnels immediately;
        }
      }

firewall data center

interfaces {    
     reth2 {
        description "UPLINK IPX";
        redundant-ether-options {
            redundancy-group 1;
        }
        unit 0 {
            family inet {
                address 172.10.11.146/29;
            }
        }
    }
    st0 {
        unit 0 {
            family inet {
                address 192.168.210.10/24;
            }
        }
        unit 1 {
            family inet {
                address 192.168.210.11/24;
            }
            family inet6;
        }
    }
    ike {
        policy ike-policy-cfgr {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$somecompletelydifferentpasswordthentheothers";
        }
        policy ike_pol_sdsl {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$thesecreticopiedfromotherfirewall";
        }
        gateway ike-gate-cfgr {
            ike-policy ike-policy-cfgr;
            address 172.old.ppoe.address;
            external-interface reth2.0;
        }
        gateway gw_sdsl {
            ike-policy ike_pol_sdsl;
            address 172.10.10.62;
            external-interface reth2.0;
        }
    }
    ipsec {
        policy ipsec-policy-cfgr {
            proposal-set standard;
        }
        policy ipsec_pol_sdsl {
            proposal-set standard;
        }
        vpn ipsec-vpn-cfgr {
            bind-interface st0.0;
            ike {
                gateway ike-gate-cfgr;
                ipsec-policy ipsec-policy-cfgr;
            }
            establish-tunnels immediately;
        }
        vpn sdsl {
            bind-interface st0.1;
            ike {
                gateway gw_sdsl;
                ipsec-policy ipsec_pol_sdsl;
            }
            establish-tunnels immediately;
        }
    }

i do change the config in the webinterface cli editor. always.

i enabled kmd logs on both firewalls.

logs say tunnel from RZ to old gateway established perfectly, from new gateway to RZ office log says:

Jul  9 16:40:14  rt1 kmd[65052]: IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: ipsec-vpn-sdsl Gateway: ike-gate-sdsl, Local: 172.10.10.62/500, Remote: 172.10.11.146/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
Jul  9 16:41:09  rt1 kmd[65052]: Config download: Processed 4 - 5 messages
Jul  9 16:41:09  rt1 kmd[65052]: Config download time: 0 seconds

i really tried everything now. using the same policy and gateway on RZ ( its the same gate anyway ), making a st0.1 with same ip and different gateway name, using the same policy on office firewall, make a new one....

i am out of options. i tried the

https://www.juniper.net/support/tools/vpnconfig/#remoteSite

configurator and copied the  relevant portions into the config, committed and it did not work. i even went as far as making a backdoor around the firewall in datacenter to not lose connectivity and tried the cli set thing, to no avail except the tunnel really went down then. luckily the commit confirmed brought it back after 10 minutes.

so what to do?

Hi,

I hope the VPN which is not working is "ipsec-vpn-sdsl".  If it is yes, the peer ip address configured on Datacenter SRX is wrong.

Office SRX:
+++++++++++++
        gateway ike-gate-sdsl {
            ike-policy ike-policy-sdsl;
            address 172.10.11.146;   <------------ IP address of reth2.0 interface of DC firewall
            external-interface fe-0/0/7.0; <------ Local IP is 172.10.10.10/29
        }

DC Firewall:-
++++++++++++++
        gateway gw_sdsl {
            ike-policy ike_pol_sdsl;
            address 172.10.10.62; <--------- This ip is wrongly configured. It should be ip address of fe-0/0/7 of Office SRX: 172.10.10.10
            external-interface reth2.0; <------ Local IP is 172.10.11.146/29
        }
        
And the VPN logs show that it is getting timed out. So I believe it is because of wrong peer ip configured in DC firewall.

hello nellikka,

i changed that now, but still not better. as i said before i was changing that config over halfa year now constantly, trying to get it work. is there a condition that a juniper cannot open a second tunnel from the same interface?

these are the logs right now

datacenter:

Jul 10 09:18:53  fw1 kmd[49319]: IKE negotiation failed with error: SA unusable. IKE Version: 1, VPN: ipsec-vpn-sdsl Gateway: ike-gate-sdsl, Local: 172.10.11.146/500, Remote: 172.10.10.10/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0

office:

cat kmd-log
[Jul 10 09:18:53]172.10.10.10:500 (Responder) <-> 172.10.11.146:500 { 7629791d 4c0eb038 - b08ced6d 5bf26911 [-1] / 0x00000000 } IP; Connection timed out or error, calling callback
[Jul 10 09:18:53]iked_pm_ike_sa_done: Phase-1 failed with error (Timeout) p1_sa 7719884
[Jul 10 09:18:53] IKEv1 Error : Timeout

cat kmd
Jul 10 09:17:53 rt1 kmd[65052]: IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: ipsec-vpn-sdsl Gateway: ike-gate-sdsl, Local: 172.10.10.10/500, Remote: 172.10.11.146/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
Jul 10 09:27:53 rt1 last message repeated 10 times

 i double/triple checked on the passwords. using the same password for all connetions now, copied the same $9$ password everywhere.

Hi,
Please share the output of below mentioned commands

Office:-
++++++++++
show interfaces fe-0/0/7.0 extensive
show interfaces st0.1  extensive
show configuration | display set | match dsl
show route 172.10.11.146

DC:-
++++++++
show interfaces reth2.0 extensive
show interfaces  st0.1 extensive
show configuration | display set | match dsl
show route 172.10.10.10

Hi Nellikka,

i stopped cleaning the real ip addresses of my config now, i cannot keep track in all this logs now 🙂

so here again my momentary config, real addresses

box1 datacenter

interfaces
 reth2 {
        description "UPLINK IPX/QSC";
        redundant-ether-options {
            redundancy-group 1;
        }
        unit 0 {
            family inet {
                address 80.190.133.146/29;
            }
            family inet6 {
                address 2a01:0138:9014:0000::5/64;
            }
        }
    }

    }
    st0 {
        unit 0 {
            family inet {
                address 192.168.210.10/24;
            }
        }
        unit 1 {
            family inet {
                address 192.168.211.11/24;
            }
        }
    }

routing-options {
    rib inet6.0 {
        static {
            route 0::0/0 next-hop 2a01:0138:9014:0000::1;
        }
    }
    static {
        route 0.0.0.0/0 next-hop 80.190.133.145;
        route 192.168.30.0/24 next-hop st0.0;
        route 192.168.150.0/24 next-hop st0.0;
        route 192.168.161.0/24 next-hop st0.0;
        route 192.168.160.0/24 next-hop st0.0;
        route 10.95.0.0/24 next-hop 80.190.119.222;
        route 10.96.0.0/24 next-hop 80.190.119.222;
        route 10.97.0.0/16 next-hop 80.190.119.222;
        route 192.168.170.0/24 next-hop st0.0;
    }
}
    ike {
        policy ike-policy-cfgr {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$password1";
        }
        policy ike-policy-sdsl {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$password1";
        }
        gateway ike-gate-cfgr {
            ike-policy ike-policy-cfgr;
            address 217.92.249.16;
            external-interface reth2.0;
        }
        gateway ike-gate-sdsl {
            ike-policy ike-policy-sdsl;
            address 62.154.246.62;
            external-interface reth2.0;
        }
    }
    ipsec {
        policy ipsec-policy-cfgr {
            proposal-set standard;
        }
        policy ipsec-policy-sdsl {
            proposal-set standard;
        }
        vpn ipsec-vpn-cfgr {
            bind-interface st0.0;
            ike {
                gateway ike-gate-cfgr;
                ipsec-policy ipsec-policy-cfgr;
            }
            establish-tunnels immediately;
        }
        vpn ipsec-vpn-sdsl {
            bind-interface st0.1;
            ike {
                gateway ike-gate-sdsl;
                ipsec-policy ipsec-policy-sdsl;
            }
            establish-tunnels immediately;
        }
    }

box2 office

interfaces 
   fe-0/0/7 {
        description Telekom;
        speed 100m;
        mtu 1492;
        link-mode full-duplex;
        fastether-options {
            no-auto-negotiation;
        }
        unit 0 {
            description "Feste IP";
            family inet {
                address 62.154.246.62/29;
            }
        }
    }
    pp0 {
        traceoptions;
        unit 0 {
            apply-macro "telekom dsl";
            ppp-options {
                chap {
                    default-chap-secret "$9$passwordppoetcom";
                    local-name "somefixedip@t-online-com.de";
                    no-rfc2486;
                    passive;
                }
                pap {
                    local-name "somefixedip@t-online-com.de";
                    no-rfc2486;
                    local-password "$9$passwordppoetcom";
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/0.0;
                idle-timeout 0;
                auto-reconnect 10;
            }
            family inet {
                mtu 1492;
                negotiate-address;
            }
        }
    st0 {
        unit 0 {
            family inet {
                address 192.168.210.20/24;
            }
        }
        unit 1 {
            description MunichII;
            family inet {
                address 192.168.211.11/24;
            }
        }
    }
routing-options {
    static {
        route 192.168.201.0/24 next-hop st0.0;
        route 192.168.161.0/24 next-hop 192.168.160.11;
        route 10.95.0.0/24 next-hop st0.0;
        route 10.96.0.0/24 next-hop st0.0;
        route 0.0.0.0/0 {
            next-hop 62.154.246.57;
            qualified-next-hop pp0.0 {
                preference 10;
            }
            preference 5;
        }
        route 80.190.133.146/32 next-hop pp0.0;
        route 10.97.0.0/16 next-hop st0.0;
        route 4.2.2.0/24 next-hop 62.154.246.57;
        route 80.190.119.222/32 next-hop pp0.0;
        route 80.190.119.214/32 next-hop pp0.0;
        route 80.190.119.218/32 next-hop pp0.0;
        route 80.190.119.211/32 next-hop pp0.0;
        route 192.168.33.0/24 next-hop st0.0;
    }
}

    ike {
        traceoptions {
            flag all;
            level 0;
        }
        policy ike_pol_wizard_dyn_vpn {
            mode aggressive;
            proposal-set compatible;
            pre-shared-key ascii-text "$9$somecompletelydifferentotherpassword";
        }
        policy ike-policy-cfgr {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$password1";
        }
        policy ike-policy-sdsl {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$password1";
        }
        gateway gw_wizard_dyn_vpn {
            ike-policy ike_pol_wizard_dyn_vpn;
            dynamic {
                hostname rt1;
                connections-limit 50;
                ike-user-type group-ike-id;
            }
            external-interface pp0.0;
            xauth access-profile remote_access_profile;
        }
        gateway ike-gate-cfgr {
            ike-policy ike-policy-cfgr;
            address 80.190.133.146;
            external-interface pp0.0;
        }
        gateway ike-gate-sdsl {
            ike-policy ike-policy-sdsl;
            address 80.190.133.146;
            external-interface fe-0/0/7.0;
        }
    }
    ipsec {
        policy ipsec_pol_wizard_dyn_vpn {
            proposal-set compatible;
        }
        policy ipsec-policy-cfgr {
            proposal-set standard;
        }
        policy ipsec-policy-sdsl {
            proposal-set standard;
        }
        vpn wizard_dyn_vpn {
            ike {
                gateway gw_wizard_dyn_vpn;
                ipsec-policy ipsec_pol_wizard_dyn_vpn;
            }
        }
        vpn ipsec-vpn-cfgr {
            bind-interface st0.0;
            ike {
                gateway ike-gate-cfgr;
                ipsec-policy ipsec-policy-cfgr;
            }
            establish-tunnels immediately;
        }
        vpn ipsec-vpn-sdsl {
            bind-interface st0.1;
            ike {
                gateway ike-gate-sdsl;
                ipsec-policy ipsec-policy-sdsl;
            }
            establish-tunnels immediately;
       }

now the output of the commands you gave me on box office

show interfaces fe-0/0/7.0 extensive 
  Logical interface fe-0/0/7.0 (Index 85) (SNMP ifIndex 523) (Generation 150)
    Description: Feste IP
    Flags: SNMP-Traps 0x0 Encapsulation: ENET2
    Traffic statistics:
     Input  bytes  :          82221464479
     Output bytes  :           6517232360
     Input  packets:             72974046
     Output packets:             55242341
    Local statistics:
     Input  bytes  :            108847923
     Output bytes  :             89803759
     Input  packets:               753714
     Output packets:               365479
    Transit statistics:
     Input  bytes  :          82112616556               493352 bps
     Output bytes  :           6427428601                46488 bps
     Input  packets:             72220332                   64 pps
     Output packets:             54876862                   64 pps
    Security: Zone: untrust
    Allowed host-inbound traffic : https ike ssh
    Flow Statistics :  
    Flow Input statistics :
      Self packets :                     490159
      ICMP packets :                     198353
      VPN packets :                      0
      Multicast packets :                0
      Bytes permitted by policy :        82200275088
      Connections established :          23589 
    Flow Output statistics: 
      Multicast packets :                0
      Bytes permitted by policy :        6512026745 
    Flow error statistics (Packets dropped due to): 
      Address spoofing:                  0
      Authentication failed:             0
      Incoming NAT errors:               0
      Invalid zone received packet:      0
      Multiple user authentications:     0 
      Multiple incoming NAT:             0
      No parent for a gate:              0
      No one interested in self packets: 50       
      No minor session:                  0 
      No more sessions:                  0
      No NAT gate:                       0 
      No route present:                  5 
      No SA for incoming SPI:            0 
      No tunnel found:                   0
      No session for a gate:             0 
      No zone or NULL zone binding       0
      Policy denied:                     0
      Security association not active:   0 
      TCP sequence number out of window: 197
      Syn-attack protection:             0
      User authentication errors:        0
    Protocol inet, MTU: 1478, Generation: 160, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 62.154.246.56/29, Local: 62.154.246.62, Broadcast: 62.154.246.63, Generation: 156

show interfaces st0.1 extensive         
  Logical interface st0.1 (Index 70) (SNMP ifIndex 533) (Generation 135)
    Description: MunichII
    Flags: Link-Layer-Down Point-To-Point SNMP-Traps Encapsulation: Secure-Tunnel
    Traffic statistics:
     Input  bytes  :                    0
     Output bytes  :                    0
     Input  packets:                    0
     Output packets:                    0
    Local statistics:
     Input  bytes  :                    0
     Output bytes  :                    0
     Input  packets:                    0
     Output packets:                    0
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :                    0                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps
    Security: Zone: vpn
    Flow Statistics :  
    Flow Input statistics :
      Self packets :                     0
      ICMP packets :                     0
      VPN packets :                      0
      Multicast packets :                0
      Bytes permitted by policy :        0
      Connections established :          0 
    Flow Output statistics: 
      Multicast packets :                0
      Bytes permitted by policy :        0 
    Flow error statistics (Packets dropped due to): 
      Address spoofing:                  0
      Authentication failed:             0
      Incoming NAT errors:               0
      Invalid zone received packet:      0
      Multiple user authentications:     0 
      Multiple incoming NAT:             0
      No parent for a gate:              0
      No one interested in self packets: 0       
      No minor session:                  0 
      No more sessions:                  0
      No NAT gate:                       0 
      No route present:                  0 
      No SA for incoming SPI:            0 
      No tunnel found:                   0
      No session for a gate:             0 
      No zone or NULL zone binding       0
      Policy denied:                     0
      Security association not active:   0 
      TCP sequence number out of window: 0
      Syn-attack protection:             0
      User authentication errors:        0
    Protocol inet, MTU: 9192, Generation: 148, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: 192.168.211/24, Local: 192.168.211.11, Broadcast: Unspecified, Generation: 300

show configuration |display set |match dsl 
set interfaces pp0 unit 0 apply-macro "telekom dsl"
set interfaces pp0 unit 2 apply-macro "telekom dsl 2"

set security ike policy ike-policy-sdsl mode main
set security ike policy ike-policy-sdsl proposal-set standard
set security ike policy ike-policy-sdsl pre-shared-key ascii-text "$9$password1 ( cleaned out again)"
set security ike gateway ike-gate-sdsl ike-policy ike-policy-sdsl
set security ike gateway ike-gate-sdsl address 80.190.133.146
set security ike gateway ike-gate-sdsl external-interface fe-0/0/7.0
set security ipsec policy ipsec-policy-sdsl proposal-set standard
set security ipsec vpn ipsec-vpn-sdsl bind-interface st0.1
set security ipsec vpn ipsec-vpn-sdsl ike gateway ike-gate-sdsl
set security ipsec vpn ipsec-vpn-sdsl ike ipsec-policy ipsec-policy-sdsl
set security ipsec vpn ipsec-vpn-sdsl establish-tunnels immediately
set security zones security-zone untrust address-book address mx-office-sdsl-public-ip 62.154.246.62/32

show route 80.190.133.146 

inet.0: 31 destinations, 33 routes (31 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.190.133.146/32  *[Static/5] 17:20:31
                    > via pp0.0

box datacenter now

show interfaces reth2.0 extensive

  Logical interface reth2.0 (Index 69) (SNMP ifIndex 540) (Generation 134)
    Flags: SNMP-Traps 0x0 Encapsulation: ENET2
    Statistics        Packets        pps         Bytes          bps
    Bundle:
        Input :   20757993295        117 5696621339348       132000
        Output:   24585907216        156 22011327190982      1183528
    Link:
      fe-0/0/2.0
        Input :   20757992294        117 5696621259448       132000
        Output:   24585907216        156 22011327190982      1183528
      fe-1/0/2.0
        Input :          1001          0         79900            0
        Output:             0          0             0            0
    Marker Statistics:   Marker Rx     Resp Tx   Unknown Rx   Illegal Rx
      fe-0/0/2.0                 0           0            0            0
      fe-1/0/2.0                 0           0            0            0
    Security: Zone: UPLINK
    Allowed host-inbound traffic : https ike ping
    Flow Statistics :  
    Flow Input statistics :
      Self packets :                     21520646
      ICMP packets :                     10259238
      VPN packets :                      2559824794
      Multicast packets :                1897
      Bytes permitted by policy :        3348589382194
      Connections established :          190217636 
    Flow Output statistics: 
      Multicast packets :                0
      Bytes permitted by policy :        3103358881335 
    Flow error statistics (Packets dropped due to): 
      Address spoofing:                  0
      Authentication failed:             0
      Incoming NAT errors:               0
      Invalid zone received packet:      0
      Multiple user authentications:     0 
      Multiple incoming NAT:             0
      No parent for a gate:              0
      No one interested in self packets: 0       
      No minor session:                  0 
      No more sessions:                  0
      No NAT gate:                       0 
      No route present:                  66 
      No SA for incoming SPI:            4858 
      No tunnel found:                   0
      No session for a gate:             0 
      No zone or NULL zone binding       0
      Policy denied:                     39222934
      Security association not active:   878 
      TCP sequence number out of window: 2348781
      Syn-attack protection:             8786
      User authentication errors:        0
    Protocol inet, MTU: 1500, Generation: 149, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 80.190.133.144/29, Local: 80.190.133.146, Broadcast: 80.190.133.151, Generation: 153
    Protocol inet6, MTU: 1500, Generation: 150, Route table: 0
      Flags: None
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 2a01:138:9014::/64, Local: 2a01:138:9014::5
    Generation: 155
      Addresses, Flags: Is-Preferred
        Destination: fe80::/64, Local: fe80::210:dbff:feff:1002
    Generation: 157                     
                                        
{primary:node0}

show interfaces st0.1 extensive 
  Logical interface st0.1 (Index 89) (SNMP ifIndex 522) (Generation 157)
    Flags: Link-Layer-Down Point-To-Point SNMP-Traps Encapsulation: Secure-Tunnel
    Traffic statistics:
     Input  bytes  :             30838939
     Output bytes  :           4057280509
     Input  packets:               201951
     Output packets:              4118242
    Local statistics:
     Input  bytes  :                65434
     Output bytes  :                45843
     Input  packets:                  854
     Output packets:                  203
    Transit statistics:
     Input  bytes  :             30773505                    0 bps
     Output bytes  :           4057234666                    0 bps
     Input  packets:               201097                    0 pps
     Output packets:              4118039                    0 pps
    Security: Zone: vpn
    Allowed host-inbound traffic : ike
    Flow Statistics :  
    Flow Input statistics :
      Self packets :                     854
      ICMP packets :                     4036
      VPN packets :                      0
      Multicast packets :                0
      Bytes permitted by policy :        30201218
      Connections established :          7341 
    Flow Output statistics: 
      Multicast packets :                0
      Bytes permitted by policy :        4057230769 
    Flow error statistics (Packets dropped due to): 
      Address spoofing:                  0
      Authentication failed:             0
      Incoming NAT errors:               0
      Invalid zone received packet:      0
      Multiple user authentications:     0 
      Multiple incoming NAT:             0
      No parent for a gate:              0
      No one interested in self packets: 0       
      No minor session:                  0 
      No more sessions:                  0
      No NAT gate:                       0 
      No route present:                  0 
      No SA for incoming SPI:            0 
      No tunnel found:                   0
      No session for a gate:             0 
      No zone or NULL zone binding       0
      Policy denied:                     10566
      Security association not active:   0 
      TCP sequence number out of window: 0
      Syn-attack protection:             0
      User authentication errors:        0
    Protocol inet, MTU: 9192, Generation: 174, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: 192.168.211/24, Local: 192.168.211.11, Broadcast: Unspecified, Generation: 183

show configuration | display set | match dsl 

set security ike policy ike-policy-sdsl mode main
set security ike policy ike-policy-sdsl proposal-set standard
set security ike policy ike-policy-sdsl pre-shared-key ascii-text "$9$Q3gPzn9RhrWLNEcKWL7VbiHq.TF69A0ORKMjqm5/9EhSlK8Xx-"
set security ike gateway ike-gate-sdsl ike-policy ike-policy-sdsl
set security ike gateway ike-gate-sdsl address 62.154.246.62
set security ike gateway ike-gate-sdsl external-interface reth2.0
set security ipsec policy ipsec-policy-sdsl proposal-set standard
set security ipsec vpn ipsec-vpn-sdsl bind-interface st0.1
set security ipsec vpn ipsec-vpn-sdsl ike gateway ike-gate-sdsl
set security ipsec vpn ipsec-vpn-sdsl ike ipsec-policy ipsec-policy-sdsl
set security ipsec vpn ipsec-vpn-sdsl establish-tunnels immediately
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match source-address addr_192_168_221_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match source-address addr_192_168_201_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match source-address addr_192_168_33_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match destination-address addr_192_168_170_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match destination-address addr_192_168_160_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match destination-address addr_192_168_150_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match destination-address addr_192_168_30_0_24
set security policies from-zone trust to-zone vpn policy policy_out_sdsl match application any
set security policies from-zone trust to-zone vpn policy policy_out_sdsl then permit
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match source-address addr_192_168_170_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match source-address addr_192_168_160_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match source-address addr_192_168_150_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match source-address addr_192_168_30_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match destination-address addr_192_168_221_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match destination-address addr_192_168_201_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match destination-address addr_192_168_33_0_24
set security policies from-zone vpn to-zone trust policy policy_in_sdsl match application any
set security policies from-zone vpn to-zone trust policy policy_in_sdsl then permit

show route 62.154.246.62 

inet.0: 23 destinations, 26 routes (23 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 195w3d 20:47:03
                    > to 80.190.133.145 via reth2.0

{primary:node0}

Hello,

Are You getting a public IP 62.154.246.62 actually assigned to Your office SRX pp0 interface via PPPoE?

Or is there NAT involved and Your SRX pp0 interface IP is NATed to 62.154.246.62?

HTH

Thx

Alex

Hi Alex,

the ppoe interface has actually 217.92.249.16 which gets assigned on the ppoe modem. this tunnel works.

the 62.154.246.62/29 is the new address that is assigned to fe-0/0/7.0

Hi, The route to reach DC SRX ip is still pointed via old Internet ISP (pp0). It should be changed to new Internet isp ip. Details below: routing-options { static { ...... route 80.190.133.146/32 next-hop pp0.0; via pp0.0 <---------------

Hi,

The route to reach DC SRX ip is still pointed via old Internet ISP (pp0). It should be changed to new Internet isp ip.

Details below:

routing-options {
    static {
......
        route 80.190.133.146/32 next-hop pp0.0; <------- It should be pointed towards new ISP ip 62.154.246.57 or remove this static route. There is a default route towards new isp

show route 80.190.133.146

inet.0: 31 destinations, 33 routes (31 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.190.133.146/32  *[Static/5] 17:20:31
                    > via pp0.0 <---------------

Hello Nellikka,

thank you for your reply.

ok, i see. i took out the route. seems promising now, i thought i could get both tunnels up simultaneously, but obviously that does not work.

office-box:

[Jul 10 13:54:24]<none>:500 (Responder) <-> 80.190.133.146:500 { 2e8bd7cb 41e0bb2f - 3fadf6c4 0219d080 [0] / 0xc79d83a0 } QM; Invalid protocol_id = 0
[Jul 10 13:54:24]QM notification `(null)' (40001) (size 8 bytes) from 80.190.133.146 for protocol Reserved spi[0...3]=92 d2 99 2
Jul 10 13:54:24  rt1 kmd[65052]: KMD_PM_SA_ESTABLISHED: Local gateway: 62.154.246.62, Remote gateway: 80.190.133.146, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x4feb162e, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: 
Jul 10 13:54:24  rt1 kmd[65052]: KMD_PM_SA_ESTABLISHED: Local gateway: 62.154.246.62, Remote gateway: 80.190.133.146, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x92d29921, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: 
Jul 10 13:54:24  rt1 kmd[65052]: KMD_VPN_UP_ALARM_USER: VPN ipsec-vpn-sdsl from 80.190.133.146 is up. Local-ip: 62.154.246.62, gateway name: ike-gate-sdsl, vpn name: ipsec-vpn-sdsl, tunnel-id: 131074, local tunnel-if: st0.1, remote tunnel-ip: 192.168.211.11, Local IKE-ID: 62.154.246.62, Remote IKE-ID: 80.190.133.146, XAUTH username: Not-Applicable, VR id: 0, Traffic-selector: , Traffic-selector local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Traffic-selector remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)

data center cluster:

Jul 10 13:54:24  rt1 kmd[65052]: KMD_PM_SA_ESTABLISHED: Local gateway: 62.154.246.62, Remote gateway: 80.190.133.146, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x4feb162e, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: 
Jul 10 13:54:24  rt1 kmd[65052]: KMD_PM_SA_ESTABLISHED: Local gateway: 62.154.246.62, Remote gateway: 80.190.133.146, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x92d29921, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: 
Jul 10 13:54:24  rt1 kmd[65052]: KMD_VPN_UP_ALARM_USER: VPN ipsec-vpn-sdsl from 80.190.133.146 is up. Local-ip: 62.154.246.62, gateway name: ike-gate-sdsl, vpn name: ipsec-vpn-sdsl, tunnel-id: 131074, local tunnel-if: st0.1, remote tunnel-ip: 192.168.211.11, Local IKE-ID: 62.154.246.62, Remote IKE-ID: 80.190.133.146, XAUTH username: Not-Applicable, VR id: 0, Traffic-selector: , Traffic-selector local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Traffic-selector remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)

trying now rerouting on both boxes when there is less traffic in the office.

Hello,

See if this post from 2011 helps

https://forums.juniper.net/t5/SRX-Services-Gateway/Cannot-get-multiple-IPsec-tunnels-working-on-SRX/m-p/109680/highlight/true#M13768

HTH

Thx
Alex

alex, i was reading the thread you linked for me. i dont think that applies because i have different physical interfaces on the second router.

as far as i understood i can always make, instead of setting the one gateway to multipoint, a second interface unit ( st0.1 in my case ) with a different ip and point the tunnel over that one to the other physical interface.

the the SPI, as far as i understood, would be different anyway because the ip of the other box's second physical interface is different?