When trying to connect the Access Manager client to the SRX, the Connection result is blank.

This article is a part of the Dynamic VPN Resolution Guide:  KB17220 - Troubleshoot Dynamic VPN client that is not working [juniper.net] .

Unless otherwise noted these steps apply to all versions of Dynamic VPN. Any steps which apply to a specific version will note which versions the step applies to.

Symptoms:

• Dynamic VPN client is not connecting to the SRX. The Connection Result for the Connection Status in the Juniper Networks Access Manager window is blank.
• Connection Status stays at 'Reconnecting to server'
• You followed the steps in KB17232 - Dynamic VPN Client status is 'Disconnected' [juniper.net] , and it referred you to this article.

Perform the following steps when the 'Connection result' is blank:

1. RADIUS IP address specified on the SRX is incorrect OR the secret does not match between the SRX and RADIUS server . You can check this by viewing the logs as explained below. 

   user@srx# set system processes general-authentication-service traceoptions flag all
user@srx# run clear log authd
   user@srx# commit
   
   [Have user attempt to connect and login again]
   
   user@srx> show log authd

   
   The auth-debug log will contain the following if there is a problem with the connection  to the RADIUS server:
   Apr 8 17:29:33 AUTHEN - module(radius) return: ASYNC
Apr 8 17:29:45 RADIUS server 172.18.66.10:1812 was used for last request
Apr 8 17:29:45 Radius : authd_radius_servers_dead: profile -radius-server, radius server - 172.18.66.88:1812 status set to DEAD
   
   For additional RADIUS debugging, refer to KB17335 [juniper.net] .

2. External interface specified for the security ike gateway may be incorrect.  Confirm that the external interface listed is the correct interface for the Dynamic VPN traffic.  Also, confirm the xauth access-profile is pointing to the correct access profile (as seen with show access ). 
   
   Double check these with the command show security ike .  Below are sample working configurations:
    
   Junos 10.3 and below:
   
   root@srx# show security ike

proposal simple-ike-proposal {
   authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm 3des-cbc;
   }
   policy simple-ike-policy {
   mode aggressive;
proposals simple-ike-proposal;
pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
   }
   gateway dyn-gw-user1 {
   ike-policy simple-ike-policy;
dynamic hostname host1;
external-interface ge-0/0/5.0;   <---------------
xauth access-profile radius-server-profile ;   <--------------
   }
    
   Junos 10.4 and above :
   
   root@srx# show security ike

policy ike-dyn-vpn-policy {
   mode aggressive;
proposal-set standard;
pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
   }
   gateway dyn-vpn-local-gw {
   ike-policy ike-dyn-vpn-policy;
dynamic hostname dynvpn;
external-interface ge-0/0/5.0;   <---------------
xauth access-profile radius-server-profile ;   <--------------
   }
   
    
3. IPsec (Phase 2) on the SRX may be misconfigured.   This is documented in the Dynamic VPN application note . 
    
   Junos 10.3 and below:
   
   root@srx# show security ipsec

proposal simple-ipsec-proposal {
   protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
   }
   policy simple-ipsec-policy {
   perfect-forward-secrecy {
   keys group2;
   }
   proposals simple-ipsec-proposal;
   }
   vpn dyn-vpn-user1 {
   ike {
   gateway dyn-gw-user1 ;
ipsec-policy simple-ipsec-policy;
   }
   }
    
   Junos 10.4 and above:
   
   root@srx# show security ipsec
policy ipsec-dyn-vpn-policy {
   perfect-forward-secrecy {
   keys group2;
   }
   proposal-set standard;
   }
   vpn dyn-vpn {
   ike {
   gateway dyn-vpn-local-gw ;
ipsec-policy ipsec-dyn-vpn-policy;
   }
   }
   
    
4. Web-management process needs to be restarted.  To do this, perform the following steps:
   1. Access the Unix shell from the operational command line. (The prompt will change from a > to a %.)
      Note:  The following steps require you to have root access to the SRX device.

      user@srx> start shell
user@srx%

   2. Remove the tokens-info file:

      user@srx% rm -rf /var/db/dynamic-vpn-ipsec/tokens-info

   3. Exit the shell:

      user@srx% exit

   4. Restart the web-management process:

      user@srx> restart web-management

2024-09-02: minor non tech changes
2020-02-21: minor non-technical edits.