Description

The article provides information about the possibility of a SRX branch device using the loopback interfaces to access dynamic VPN.

Symptoms

The possibility of a SRX branch device using the loopback interfaces to access dynamic VPN.

Solution

  • When the httpServer daemon of SRX receives a request from a dynamic VPN client, the daemon checks the ingress interface of the packet.
  • If the ingress interface is on the dynamic VPN allow interface list, these packet are allowed and if the ingress interface is not in the list, httpServer displays an error.
  • When the loopback interface is set as an external interface of dynamic VPN, it will be on the list.
  • However, the actual ingress interface is not a loopback interface; but a physical interface. This is why the client displays an error.

Use a physical interface, instead of using the loopback interface; which is a logical interface. The loopback interface will not work for the dynamic VPN; as per design.

Related Information