This article explains why the logs of VPN negotiation failed messages for the VPN peers that are not configured are seen, and how to prevent it.
user@host> show log messages | match kmd
Feb 24 05:46:13 host kmd[2339]: IKE negotiation failed with error: IKE gateway configuration lookup failed during negotiation. IKE Version: 1, VPN: Not-Available Gateway: Not-Available, Local: X.X.X.X/500, Remote: Y.Y.Y.Y/2342, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0: Role: Responder
This is an expected behaviour when all services are allowed on any interface whose IP address is accessible to everyone.
set security zones security-zone VPN host-inbound-traffic system-services all
set security zones security-zone VPN host-inbound-traffic protocols all
set security zones security-zone VPN interfaces <WAN_interface>
OR
set security zones security-zone VPN interfaces <WAN_interface> host-inbound-traffic system-services all
set security zones security-zone VPN interfaces <WAN_interface> host-inbound-traffic protocols all
To avoid these messages, allow VPN only from trusted prefixes.
This can be done by configuring firewall filters as follows:
set firewall filter protect-RE term Allowed-VPN-Hosts source-prefix-list <allowed_hosts>
set firewall filter protect-RE term Allowed-VPN-Hosts protocol udp
set firewall filter protect-RE term Allowed-VPN-Hosts destination-port 500
set firewall filter protect-RE term Allowed-VPN-Hosts destination-port 4500
set firewall filter protect-RE term Allowed-VPN-Hosts protocol esp
set firewall filter protect-RE term Allowed-VPN-Hosts then accept
set firewall filter protect-RE term Deny-VPN-Hosts source-address any
set firewall filter protect-RE term Deny-VPN-Hosts protocol udp
set firewall filter protect-RE term Deny-VPN-Hosts destination-port 500
set firewall filter protect-RE term Deny-VPN-Hosts destination-port 4500
set firewall filter protect-RE term Deny-VPN-Hosts protocol esp
set firewall filter protect-RE term Deny-VPN-Hosts then deny
set firewall filter protect-RE term Other_traffic then accept
set interfaces <required_interface> family inet filter input protect-RE