On SRX Series platforms managed via Mist or standalone configurations, IPsec VPN tunnels experience frequent flapping, resulting in subsequent BGP flaps across multiple sites.
This issue typically manifests on branch deployment sites utilizing dynamic external interface assignments (such as DHCP or PPPoE broadband) combined with Dynamic FQDN gateways, where transient WAN IP changes trigger proactive security association clearings.
Active IPsec VPN tunnels intermittently drop and renegotiate immediately, causing a domino effect on overlay BGP neighbors.
High CPU utilization is observed on the rpd as it repeatedly attempts to reconverge network routes and process continuous kernel updates during the flap event.
rpd
Running the operational command show security ipsec security-associations detail reveals explicit diagnostic log triggers indicating that the external gateway IP is shifting:
show security ipsec security-associations detail
External interface's address received. Information updated (1 times) External-interface's address deleted. Existing IPSec SAs cleared (1 times)
External interface's address received. Information updated (1 times)
External-interface's address deleted. Existing IPSec SAs cleared (1 times)
On the Mist Portal, the affected branch device shows short-lived "Tunnel Down" events followed rapidly by "Tunnel Up" notifications, while routing topologies remain unstable.
This issue will occur if all the following conditions are met:
Deployment Topology: Branch SRX endpoints (e.g., SRX340) establishing site-to-site IPsec architecture over dynamic or provider-managed WAN handoffs.
Log Sequence: Explicit entries of external address deletion and receipt in security association diagnostic details.
Upstream Alignment: Verify and rectify the configuration settings of any third-party routing or SD-WAN profiling tools upstream to ensure they do not map identical IP pools across separate ST interfaces simultaneously.
Hold-Timer Tweaks: In heavy-flap conditions, tune your BGP peer definitions on the Mist overlay with extended hold-times or apply route-damping strategies to transient tunnel updates.
Static Allocation: Wherever network constraints permit, request static IP allocations from local service providers on primary critical WAN nodes to mitigate dynamic peer tracking dependencies.