Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: SRX VPN network issue

$
0
0

SRX210 has st0.0 configured with 10.1.124.251 address. I dont this it is needed, can you remove it? Note that you need to leave the "family inet" configured on that interface.

 

So far I have checked the following.

 

+Topology:

 

 

                            st0.0                                    st0.0
(10.0.0.0/8)------SRX210-(ge-0/0/0:24.106.47.110)------Internet----(fe-0/0/0)-SRX100-------(10.1.124.0/24)
                                     static                           dhcp
		 Brookfield                                                  Greendale

 

+Junos

 

RootsBrookfieldWI-SRX210he: 12.1X46-D45.4;

RootsGreendaleWI-SRX100h: version 10.4R4.5;

 

+IKE configured as host-inbound-traffic on the untrust zones.
+IKE-IDs configured properly for phase 1.
+Proxy-IDs: any,any,any due to route-based VPN, so they match.
+VPN configuration match correctly (cant tell about configured pre-shared-keys because they are encrypted in the config)
+Static routes configured and pointing to correct st0.0 interfaces.
+st0.0 interfaces are configured with family inet.

 

Try configuring again the preshared-keys to a common value:

 

SRX100:

#set security ike policy IKE-POL-GREENDALE-ATT pre-shared-key ascii-text junos

SRX210:

#set security ike policy ike-policy-GD pre-shared-key ascii-text junos

 

After those two changes, please collect again:

 

> show security flow session protocol udp destination-port 500> show security ike security-associations> show security ipsec security-associations> show security ipsec inactive-tunnels

Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>