This article will help determine the reason an IPsec VPN is not active and not passing data, and help resolve the issue.
Troubleshoot a site-to-site VPN tunnel that is not establishing.
IPsec VPN tunnel is down or inactive.
VPN is not working.
Use the following steps to assist with resolving a VPN tunnel that is not active or passing traffic.
For the flowchart version of these steps, click the flowchart icon:
What type of VPN tunnel are you having trouble with?
Site-to-site (LAN-to-LAN) VPN - Continue with Step 2 . Remote Access IPsec VPN or Client-to-LAN VPN For SRX Branch Series, see KB17220 - Resolution Guide - SRX - Troubleshoot Pulse VPN connections to SRX [juniper.net] . For SRX1400, SRX3400, SRX3600, SRX5600, and SRX5800 devices, continue with Step 2 .
Site-to-site (LAN-to-LAN) VPN - Continue with Step 2 .
Remote Access IPsec VPN or Client-to-LAN VPN
For SRX Branch Series, see KB17220 - Resolution Guide - SRX - Troubleshoot Pulse VPN connections to SRX [juniper.net] .
For SRX1400, SRX3400, SRX3600, SRX5600, and SRX5800 devices, continue with Step 2 .
Is the VPN tunnel's Security Association (SA) active? In other words, is the VPN's Phase 2 up?
Run the command show security ipsec security-associations . Locate the Gateway address of the VPN in question. If the remote gateway is not displayed, then the VPN SA is not active. For more information, consult: KB10090 - [SRX] How do I tell if a VPN Tunnel SA (Security Association) is active [juniper.net] .
Run the command show security ipsec security-associations .
show security ipsec security-associations
Locate the Gateway address of the VPN in question. If the remote gateway is not displayed, then the VPN SA is not active.
For more information, consult: KB10090 - [SRX] How do I tell if a VPN Tunnel SA (Security Association) is active [juniper.net] .
user@CORPORATE> show security ipsec security-associations total configured sa: 2 ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys <32785 2.2.2.2 1398 ESP:3des/sha1 29e26eba 28735/unlim - 0 >32785 2.2.2.2 1398 ESP:3des/sha1 6d4e790b 28735/unlim - 0 total configured sa: 2 ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys <32786 3.3.3.3 500 ESP:3des/sha1 5c13215d 28782/unlim U 0 >32786 3.3.3.3 500 ESP:3des/sha1 18f67b48 28782/unlim U 0
No (SA is not listed) - Continue to Step 3 . Yes (SA is listed, so Phase 2 is up) - If traffic is not passing, consult: KB10093 - How to troubleshoot a VPN that is up, but is not passing traffic [juniper.net] . Sometimes , SA is bouncing between active and inactive - Consult: KB10096 - How to troubleshoot a VPN tunnel that is going up and down [juniper.net] .
Yes (SA is listed, so Phase 2 is up) - If traffic is not passing, consult: KB10093 - How to troubleshoot a VPN that is up, but is not passing traffic [juniper.net] .
Sometimes , SA is bouncing between active and inactive - Consult: KB10096 - How to troubleshoot a VPN tunnel that is going up and down [juniper.net] .
Is the VPN tunnel's IKE Phase 1 up?
Run the command show security ike security-associations . Locate the Remote Address of the VPN in question, and verify that the State is UP. For more information, consult: KB10090 - How do I tell if a VPN tunnel SA (Security Association) is active [juniper.net] .
Run the command show security ike security-associations .
show security ike security-associations
Locate the Remote Address of the VPN in question, and verify that the State is UP.
For more information, consult: KB10090 - How do I tell if a VPN tunnel SA (Security Association) is active [juniper.net] .
user@CORPORATE> show security ike security-associations Index Remote Address State Initiator cookie Responder cookie Mode 1 2.2.2.2 UP 744a594d957dd513 1e1307db82f58387 Main 2 3.3.3.3 UP 744a594d957dd513 1e1307db82f58387 Main
No (Remote Address is not listed or State is DOWN) - Continue to Step 4. Yes (state is UP) - Jump to Step 5.
No (Remote Address is not listed or State is DOWN) - Continue to Step 4.
Yes (state is UP) - Jump to Step 5.
[Phase 1 not up] Analyze the IKE phase 1 messages on the responder for a solution.
Consult: KB10101 - [SRX] How to troubleshoot IKE Phase 1 VPN connection issues [juniper.net] . If you are unable to find your solution in the logs on the responder side, jump to Step 6 .
Consult: KB10101 - [SRX] How to troubleshoot IKE Phase 1 VPN connection issues [juniper.net] .
If you are unable to find your solution in the logs on the responder side, jump to Step 6 .
[Phase 2 not up] Analyze the phase 2 messages on the responder for a solution.
Consult: KB10099 - [SRX] How to troubleshoot IKE Phase 2 VPN connection issues [juniper.net] . If you are unable to find your solution in the logs on the responder side, then continue to Step 6 .
Consult: KB10099 - [SRX] How to troubleshoot IKE Phase 2 VPN connection issues [juniper.net] .
If you are unable to find your solution in the logs on the responder side, then continue to Step 6 .
Analyze the phase 1 or phase 2 logs for this VPN tunnel on the initiating VPN device.
If you are unable to find your solution in the logs on the initiating side, then continue to Step 7 .
If the issue is still not resolved, collect logs, flow traceoptions, IKE traceoptions, and open a case with your technical support representative.
Consult: Logs: KB21781 - [SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net] . See the IPsec VPN Policy-based or Route-based sections. Flow traceoptions: KB16233 – [SRX] How to use "flow traceoptions" and "security datapath-debug" [juniper.net] IKE traceoptions: KB19943 – [SRX] How to enable VPN (IKE/IPsec) traceoptions for specific SAs (Security Associations) [juniper.net]
Consult:
Logs: KB21781 - [SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net] . See the IPsec VPN Policy-based or Route-based sections.
Flow traceoptions: KB16233 – [SRX] How to use "flow traceoptions" and "security datapath-debug" [juniper.net]
IKE traceoptions: KB19943 – [SRX] How to enable VPN (IKE/IPsec) traceoptions for specific SAs (Security Associations) [juniper.net]
See the Related Links section for more configuration and troubleshooting resources.
2020-06-25: Article reviewed for accuracy; no changes required; article still relevant and used in conjunction with the VPN resolution guide: KB21898 - [SRX] Configuring Web-Authentication using secure ID in Dynamic VPN [juniper.net]
2021-07-06: Article updated to reflect current links and information