This article explains about an IPsec VPN tunnel that may go down when the peer device is restarted or its IKE negotiation state changes. In some cases, the SRX reports the tunnel as inactive with the reason “IKE SA UDP port change detected with peer exiting IPsec SA cleared.”

The symptoms can be followed as:

1) VPN tunnel to peer goes down after peer restart or reconfiguration.

2) user@host > show security ipsec inactive-tunnels

Tunnel Down Reason

IKE SA UDP port change detected with peer exiting IPsec SA cleared

3) Clearing IPsec SAs manually does not restore the tunnel.

4) Tunnel only comes back after bouncing the secure tunnel interface (st0.x).

The issue occurs when the peer device restart changes the IKE UDP source port. SRX continues to associate Phase 2 SAs with the old port. Clearing SAs manually does not fully remove the association because the kmd process still holds the SA binding to the old interface. As a result, Phase 2 cannot renegotiate properly and the VPN remains down.

To resolve this issue provided it goes through the same symptoms,

Bounce the affected tunnel interface:

user@host# deactivate interfaces st0.x

user@host# commit

user@host# activate interfaces st0.x

user@host# commit

This forces SRX to remove security-zone and policy bindings, clear stale IPsec VPN associations in kmd and trigger a fresh IKE/Phase 2 negotiation.