SRX

I've spent more than a week trying to figure this out and at a total loss.

I've followed all the steps provided by Amazon, used the configuration they supplied, and have no idea how to troubleshoot.

root@HSRX300> show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
139471 DOWN aa7dfa9d3a2f1ec7 0000000000000000 Main 52.87.109.64
139472 DOWN 7ece629a6b35cb88 0000000000000000 Main 52.206.202.16

root@HSRX300> show security ipsec security-associations
Total active tunnels: 0

Since this is not in production and much of the information will change when it is, I have included the VPN config file provided by Amazon, the VPN section of my running config, and the output from the KMD log.

Any help would be greatly appreciated.

Attachment(s)

160808-VPN.txt   3 KB 1 version

kmd.txt   502 KB 1 version

vpn-60c3d501.txt   12 KB 1 version

Hi,

Looks like we are not getting a response from the other side.

#set security ike traceoptions file test1 size 2m files 2

#set security ike traceoptions flag all

#commit

>request security ike debug-enable local <SRX_External_Interface_IP> remote <Peer_Address> level 12

Please provide the test1 file for further analysis.

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

Hope I did this right.

Attachment(s)

test1.txt   489 KB 1 version

Dale,

Looks like the SRX is not getting a response from the remote side after transitioning to port 4500 due to a NAT device in the path. it is timig out the phase 1 negotiation after a few attempts.

Please check if the remote side is responding to the SRX's requests on port 4500.

Also check if you have a firewall filter on the external/loopback interface which is blocking UDP 4500 replies.

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

I would love to but not exactly sure how to do either of those things.

Hi Dale,

You can use packet captures or similar stuff on the remote side to check if it is responding to our requests.

In order to check for filters on the SRX :-

• Identify which interface you have specified as the external-interface in the ike gateway config.
• #show interfaces <name_of_interface>
• Check if you see any filters applied as input/output.
• show interfaces lo0
• Again check for filters on this.
• FIlter config can be checked using "#show firewall" on the SRX.

Regards,

Sahil Sharma

---------------------------------------------------

Please mark my solution as accepted if it helped, Kudos are appreciated as well.

I apologize for my lack of knowledge, though I've worked with SRX before I've never really had any issues that required "actual Knowledge".

root@HSRX300> show interfaces st0.1
Logical interface st0.1 (Index 70) (SNMP ifIndex 532)
Flags: Up Link-Layer-Down Point-To-Point SNMP-Traps Encapsulation: Secure-Tunnel
Input packets : 0
Output packets: 0
Security: Zone: trust
Allowed host-inbound traffic : bootp bfd bgp dns dvmrp igmp ldp msdp nhrp ospf pgm pim rip router-discovery rsvp sap vrrp dhcp finger ftp tftp ident-reset http https ike netconf ping reverse-telnet reverse-ssh rlogin rpm rsh snmp
snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp webapi-clear-text webapi-ssl
Protocol inet, MTU: 1436
Flags: Sendbcast-pkt-to-re, User-MTU
Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
Destination: 169.254.44.192/30, Local: 169.254.44.194

root@HSRX300> show interfaces st0.1
Logical interface st0.1 (Index 70) (SNMP ifIndex 532)
Flags: Up Link-Layer-Down Point-To-Point SNMP-Traps Encapsulation: Secure-Tunnel
Input packets : 0
Output packets: 0
Security: Zone: trust
Allowed host-inbound traffic : bootp bfd bgp dns dvmrp igmp ldp msdp nhrp ospf pgm pim rip router-discovery rsvp sap vrrp dhcp finger ftp tftp ident-reset http https ike netconf ping reverse-telnet reverse-ssh rlogin rpm rsh snmp
snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp webapi-clear-text webapi-ssl
Protocol inet, MTU: 1436
Flags: Sendbcast-pkt-to-re, User-MTU
Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
Destination: 169.254.44.192/30, Local: 169.254.44.194

root@HSRX300> show interfaces st0.2
Logical interface st0.2 (Index 81) (SNMP ifIndex 533)
Flags: Up Link-Layer-Down Point-To-Point SNMP-Traps Encapsulation: Secure-Tunnel
Input packets : 0
Output packets: 0
Security: Zone: trust
Allowed host-inbound traffic : bootp bfd bgp dns dvmrp igmp ldp msdp nhrp ospf pgm pim rip router-discovery rsvp sap vrrp dhcp finger ftp tftp ident-reset http https ike netconf ping reverse-telnet reverse-ssh rlogin rpm rsh snmp
snmp-trap ssh telnet traceroute xnm-clear-text xnm-ssl lsping ntp sip r2cp webapi-clear-text webapi-ssl
Protocol inet, MTU: 1436
Flags: Sendbcast-pkt-to-re, User-MTU
Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
Destination: 169.254.45.144/30, Local: 169.254.45.146

root@HSRX300> show interfaces lo0
Physical interface: lo0 , Enabled, Physical link is Up
Interface index: 6, SNMP ifIndex: 6
Type: Loopback, MTU: Unlimited
Device flags : Present Running Loopback
Interface flags: SNMP-Traps
Link flags : None
Last flapped : Never
Input packets : 2067964
Output packets: 2067964

Logical interface lo0.16384 (Index 65) (SNMP ifIndex 21)
Flags: Down SNMP-Traps Encapsulation: Unspecified
Input packets : 0
Output packets: 0
Security: Zone: Null
Protocol inet, MTU: Unlimited
Flags: None
Addresses
Local: 127.0.0.1

Logical interface lo0.16385 (Index 66) (SNMP ifIndex 22)
Flags: Down SNMP-Traps Encapsulation: Unspecified
Input packets : 2067964
Output packets: 2067964
Security: Zone: Null
Protocol inet, MTU: Unlimited
Flags: None
Addresses, Flags: Is-Default Is-Primary
Local: 10.0.0.1
Addresses
Local: 10.0.0.16
Addresses
Local: 128.0.0.1
Addresses
Local: 128.0.0.4
Addresses
Local: 128.0.1.16

Logical interface lo0.32768 (Index 64) (SNMP ifIndex 251)
Flags: Encapsulation: Unspecified
Input packets : 0
Output packets: 0
Security: Zone: Null

Hi.

Can you try disabling NAT-Traversal on the SRX side of the connection?

set security ike gateway xxxxx no-nat-traversal

Perhaps this will 'force' the SRX to keep negotiating phase1 on port udp/500.

Regards,

Sam

WOW!
That did it!
Thanks.

root@HSRX300> show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
142510 UP f56860d62b53f165 11034fd46b0e9d4a Main 52.87.109.64
142512 UP 53b12a1ca1d20744 973ddc0a8143808c Main 52.206.202.16

root@HSRX300> show security ipsec security-associations
Total active tunnels: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<131073 ESP:aes-cbc-128/sha1 c84815a9 2765/ unlim U root 500 52.87.109.64
>131073 ESP:aes-cbc-128/sha1 3f4d61b3 2765/ unlim U root 500 52.87.109.64
<131074 ESP:aes-cbc-128/sha1 a8d4d6c9 2775/ unlim U root 500 52.206.202.16
>131074 ESP:aes-cbc-128/sha1 a0c3e28c 2775/ unlim U root 500 52.206.202.16

looks as if starting from the 5th packet of phase1 exchange, NAT-T is recognized:

ike_send_packet: <-------- sending SA = { caca4f81 5cf535f6 - d201dbee ac425781}, len = 92, nego = -1, local ip= 173.161.47.145, dst = 52.87.109.64:4500

Is there a NAT device in the path?  I don't know if AWS supports NAT-T/Aggressive mode.

Sam