On SRX5000 Series devices equipped with SRX5K-SPC3 (SPC3) cards, or operating in mixed-mode with both SPC3 and SRX5K-SPC-4-15-320 (SPC2) cards, IPsec tunnels may become unevenly distributed across SPU resources after tunnels are re-established.

You may observe the following:

• Uneven distribution of IPsec tunnels across SPC3 threads or SPC2 SPUs.
• Imbalanced utilization of SPU resources after IPsec tunnel re-establishment.
• The condition can occur after a tunnel is torn down and re-established, whether initiated locally or by the remote peer.
• The issue is most noticeable in deployments with a large number of IPsec VPN tunnels.

The tunnel distribution can be verified using:

> show security ipsec tunnel-distribution

Affected Platforms:

SRX5000 Series devices with:SRX5K-SPC3 cards installed, or Mixed-mode deployments using both SPC3 and SRX5K-SPC-4-15-320 (SPC2) cards

Workarounds:

• Re-distribute IPsec VPNs:
• > request security re-distribution ipsec-vpn gateway-name <xxxx> fpc x pic x 

• Restark iked:
• > restart ike-key-management

• Reboot the device

Issue is tracked in Problem Report (PR): PR1615763