SRX

 View Only
last person joined: 5 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  FW-SITE1 can't ping FW-SITE2 (Hub-and-Spoke VPN LAB Setup)

    Posted 06-03-2025 02:29

    Hello Everyone,

    I am replicating the lab on hub-and-spoke VPNs. I think the VPN is okay based on the ike/ipsec security associations.  My problem is site1 server can't ping site2 server. Attached is the configuration on each SRX. Need your help. 

    Topology:

    show security ike security-associations

    show security ipsec security-associations

    Thanks, in advanced.



    ------------------------------
    Gerald
    ------------------------------

    Attachment(s)

    txt
    fw-site2.txt   5 KB 1 version
    txt
    fw-site1.txt   6 KB 1 version
    txt
    hub-srx.txt   6 KB 1 version


  • 2.  RE: FW-SITE1 can't ping FW-SITE2 (Hub-and-Spoke VPN LAB Setup)

    Posted 06-03-2025 10:03

    You can run show security packet-drop records on the HUB to see what happens with the traffic.

    Since st0.0 is multipoint on the HUB with two VPNs bound to it, you'll need to specify which IPsec tunnel corresponds to which next hop:

    • set interfaces st0 unit 0 family inet next-hop-tunnel 10.25.0.1 ipsec-tunnel To-FW_SW1
    • set interfaces st0 unit 0 family inet next-hop-tunnel 10.25.0.2 ipsec-tunnel To-FW_SW2


    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 3.  RE: FW-SITE1 can't ping FW-SITE2 (Hub-and-Spoke VPN LAB Setup)

    Posted 06-03-2025 10:10

    Actually, use show security ipsec next-hop-tunnels first to see next-hop mappings really are missing ... 

    Here's a nice write-up that I think matches your use case -- https://junosnotes.blogspot.com/2014/01/srx-vpn-multipoint.html



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message