Hi
Having an issue with Route-Based VPN. Traffic is being forwarded in incorrect VPN.
Setup:
+ Juniper SRX 650 Cluster
+ Two VPN Tunnels towards remote location with Primary/Secondary setup.
+ Forwarding Routing-Instance (Name: RInstance) configured with default route (st0.3 - primary / st0.1 - secondary)
+ Both internal network and st0 interfaces were in trust zone with a policy permitting all traffic.
+ Firewall filter configured to match the internal traffic and pointed to "RInstance"
Issue:
+ Traffic flow between remote end to our local network went unsuccessful.
+ Can see the session installed with incorrect incoming interface.
+ Traffic received from St0.3 but session table show St0.1
Tunnel Index:
St0.1 - 131074
St0.3 - 131075
Session ID: 92441, Policy name: trust-trust-policy/150, State: Active, Timeout: 2, Valid
In: X.X.4.167/11798 --> X.X.9.5/53764;icmp, If: st0.1, Pkts: 1, Bytes: 60
Out: X.X.9.5/53764 --> X.X.4.167/11798;icmp, If: reth0.0, Pkts: 1, Bytes: 60
Total sessions: 1
Logs where incorrect interface is installed.
====================================
Nov 11 11:34:36 11:34:36.777192:CID-1:RT: Session (id:92441) created for first pak 10224
Nov 11 11:34:36 11:34:36.777192:CID-1:RT:first pak processing successful
Nov 11 11:34:36 11:34:36.777192:CID-1:RT: flow_first_install_session======> 0x57ae6960
Nov 11 11:34:36 11:34:36.777192:CID-1:RT: nsp 0x57ae6960, nsp2 0x57ae69f0
Nov 11 11:34:36 11:34:36.777192:CID-1:RT: make_nsp_ready_no_resolve()
Nov 11 11:34:36 11:34:36.777349:CID-1:RT:flow_ipv4_rt_lkup success X.X.4.167, iifl 0x55, oifl 0x53
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: route lookup: dest-ip X.X.4.167 orig ifp st0.3 output_ifp st0.1 orig-zone 8 out-zone 8 vsd 0
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: reroute handling for tunnel 20020003
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: Doing IPSec traffic-selector match for X.X.9.5 -> X.X.4.167
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: Did not find traffic-selector enabled nsp_tunnel for st0-ifp st0.1. Finding non-traffic-selector nsp_tunnel
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: Found non-NHTB IPSec nsp_tunnel for ifp st0.1
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: Found IPSec nsp_tunnel 0x5e3fac00 for bind-ifp st0.1
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: existing vector list 0x10224-0x4b2da2d0.
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: setting tunnel vector since the routed interface is st0.1
Nov 11 11:34:36 11:34:36.777349:CID-1:RT: route to X.X.4.167
Nov 11 11:34:36 11:34:36.777479:CID-1:RT:ha_ifp: reth0.0
Any Suggestions..
Thanks in Advance