Site to site VPN, where initiator is behind a NAT device, and responder has a public IP on the Internet. When VPN Monitor is configured, the VPN drops once every 1-2 minutes.

Topology:

PC1 ----------- SRX1 ------------ NAT Device ----- Internet ----------- SRX2 ----- PC2     
172.16.10.2       10.1.1.1              1.1.1.1                   2.2.2.1       192.168.10.1

• Site-to-site VPN
• Initiator is SRX (SRX1) that is behind a NAT device (1.1.1.1)
• Responder (SRX2) is on the Internet with a public IP address (2.2.2.1)
• When VPN Monitor is enabled on the responder, the VPN drops every 1-2 minutes

In this scenario, SRX1 as the initiator wil send a vpn-monitor packet with an address of 10.1.1.1. After NAT, the public IP is 1.1.1.1. 

On the responder, SRX2, when VPN-Monitor is configured, it will use 1.1.1.1 as the default destination-ip to send out VPN-Monitor packet.  However, this public IP is not recognized for VPN-Monitoring processing, and this probe will fail.  As a result, it will bring the VPN tunnel down.

The solution for this environment is to use source-interface (the egress outgoing-interface for IKE negotiations) and destination-ip (termination point on the other side of the vpn) in vpn-monitor:  On SRX2, use the source-interface ge-0/0/0.0.  The destination-ip is the termination point at SRX1, 10.1.1.1. The configuration should look like the following:

vpn corp-vpn {
    bind-interface st0.0;
    vpn-monitor {
        source-interface ge-0/0/0.0;
        destination-ip 10.1.1.1;
    }
    ike {
        gateway corp-gw;
        ipsec-policy dyn-ipsec-policy;
    }
    establish-tunnels on-traffic;
}

• PR 603886