This article describes the issue of the inability to manage SRX through the dynamic VPN tunnel and also provides a workaround for it.

Could not SSH to 192.168.1.1 (trust interface IP) from the Dynamic VPN client.  Able to ping to that IP address, but not any other TCP traffic such as FTP and so on. 

All the transit traffic from the Dynamic VPN client to the remote-protected-resources is working fine. The issue is only with TCP Self-traffic.

This is a current limitation in SRX.  When the Dynamic VPN client pool is in the same network of remote-protected-resources, TCP self-traffic through the tunnel will have issues.

SRX will not respond to the SYN packet received from the Dynamic VPN clients, which are in the same network of remote-protected-resources.

Using a different network for the Dynamic VPN clients (address-assignment pool) resolves the issue. If using a different network for Dynamic VPN clients is not an option, there is a workaround -  Create a pool-based source NAT for all the traffic coming through the tunnel ; so that the source is translated to a different network .

CLI Configuration

version 11.1R1.10;
system {
    host-name Gateway;
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    services {
        ssh;
        web-management {
            https {
                system-generated-certificate;
            }
        }
    }
}
interfaces {
    fe-0/0/0 {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
    fe-0/0/1 {
        unit 0 {
            family inet {
                address 100.1.1.1/30;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 100.1.1.2;
    }
}
security {
    ike {
        traceoptions {
            flag all;
        }
        policy p1 {
            mode aggressive;
            proposal-set standard;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        gateway g1 {
            ike-policy p1;
            dynamic {
                hostname test;
                connections-limit 3;
                ike-user-type group-ike-id;
            }
            external-interface fe-0/0/1.0;
            xauth access-profile vpn;
        }
    }
    ipsec {
        proposal prop1 {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm aes-128-cbc;
        }
        policy p2 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposal-set standard;
        }
        vpn mydvpn {
            ike {
                gateway g1;
                ipsec-policy p2;
            }
        }
    }
    dynamic-vpn {
        access-profile vpn;
        clients {
            myclinets {
                remote-protected-resources {
                    192.168.1.0/24;
                }
                remote-exceptions {
                    0.0.0.0/0;
                }
                ipsec-vpn mydvpn;
                user {
                    jtac;
                    
                }
            }
        }
    }
    flow {
        traceoptions {
            file ssh;
            flag basic-datapath;
            flag packet-drops;
            flag all;
            packet-filter 1 {
                source-prefix 192.168.1.200/32;
            }
            packet-filter 2 {
                source-prefix 192.168.1.1/32;
            }
        }
    }

## Workaround for the TCP Self-traffic issue, pool-based source NAT for the traffic coming through the tunnel

    nat {
        source {
            pool mypool {
                address {
                    192.168.2.1/32 to 192.168.2.10/32;
                }
            }
            rule-set 1 {
                from zone untrust;
                to zone trust;
                rule 1 {
                    match {
                        source-address 192.168.1.0/24;
                    }
                    then {
                        source-nat {
                            pool {
                                mypool;
                            }
                        }
                    }
                }
            }
        }
        proxy-arp {
            interface fe-0/0/0.0 {
                address {
                    192.168.1.200/32 to 192.168.1.210/32;
                }
            }
        }
    }
    policies {
        from-zone untrust to-zone trust {
            policy dvpn {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn mydvpn;
                        }
                    }
                }
            }
        }
        
    }
    zones {
        security-zone trust {
            interfaces {
                fe-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            interfaces {
                fe-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            ike;
                            ping;
                            https;
                            ssh;
                        }
                    }
                }
            }
        }
    }
}
access {
    profile vpn {
        client jtac {
            firewall-user {
                password "$ABC123"; ## SECRET-DATA
            }
        }
        
        address-assignment {
            pool mypool;
        }
    }
    address-assignment {
        pool mypool {
            family inet {
                network 192.168.1.0/24;
                range r1 {
                    low 192.168.1.200;
                    high 192.168.1.210;
                }
            }
        }
    }
    firewall-authentication {
        web-authentication {
            default-profile vpn;
        }
    }
}