Description

This article describes the issue of IKE [Phase-1] failure messages being logged for Proxy ARP addresses.

Symptoms

The following message is generated, when IKE traceoptions are enabled in file messages, kmd or the traceoptions file; even though 1.1.1.4 is a Proxy ARP address: 

KMD_PM_P1_POLICY_LOOKUP_FAILURE: Policy lookup for Phase-1 [responder] failed for p1_local=ipv4(any:0,[0..3]=1.1.1.4) 
p1_remote=ipv4(any:0,[0..3]=2.2.2.2)
This behavior is noticed with version below 11.2.

Solution

As mentioned in KB24709 - [SRX] Ping to proxy ARP address does not work after 11.2R1 [juniper.net] , prior to 11.2, SRX would reply to ping packets that were destined for Proxy ARP addresses; even though NAT did not occur. Similarly, SRX also accepts IKE packets and tries to lookup the Phase-1 configuration; which results in this error.

To resolve this issue, either de-activate IKE traceoption or upgrade to Junos 11.2 or later, in which Proxy ARP will start to display a discard route (that is, reject any packets that are destined to them; unless NAT occurs). In earlier versions of Junos, a receive route was available. For more information, refer to KB24709 - [SRX] Ping to proxy ARP address does not work after 11.2R1 [juniper.net] .